e6378671-986d-42a1-8e7a-717117c83751

BioNTdrv.sys :inline

Description

Microsoft has identified five security flaws in the Paragon Partition Manager BioNTdrv.sys driver, one of which was exploited by ransomware gangs in zero-day attacks to gain SYSTEM privileges on Windows systems. These vulnerabilities, found in BioNTdrv.sys versions 1.3.0 and 1.5.1, enable attackers to escalate their privileges to SYSTEM level to a higher access level than standard administrator permissions.

  • UUID: e6378671-986d-42a1-8e7a-717117c83751
  • Created: 2025-03-02
  • Author: Swachchhanda Shrawan Poudel

Download

This download link contains the vulnerable driver!

Block BioNTdrv.sys across your endpoints

Add this driver to your block policy in minutes with MagicSword, threat-driven application control. Free for up to 100 endpoints.

Start Blocking for Free

Commands

sc.exe create BioNTdrv.sys binPath=C:\windows\temp\BioNTdrv.sys type=kernel && sc.exe start BioNTdrv.sys
Use CasePrivilegesOperating System
Elevate privilegeskernelWindows 10

Detections

YARA 🏹

Expand

Exact Match

with header and size limitation

Threat Hunting

without header and size limitation

Renamed

for renamed driver files

Sigma 🛡️

Expand

Names

detects loading using name only

Hashes

detects loading using hashes only

Sysmon 🔎

Expand

Block

on hashes

Alert

on hashes

Resources


  • https://www.sdxcentral.com/alerts/paragon-partition-manager-driver-flaws-enable-privilege-escalation-and-dos-attacks/2025/02/
  • https://www.bleepingcomputer.com/news/security/ransomware-gangs-exploit-paragon-partition-manager-bug-in-byovd-attacks/
  • https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-Products-of-Hard-Disk-Manager-Product-Line-Biontdrv-sys

    • Known Vulnerable Samples

    PropertyValue
    Filename
    Creation Timestamp2018-01-30 13:32:16
    MD5ef32d203a12462403c205b39eb4eef5b
    SHA1b31a85406ac9a6a69bfbee74d6dc67d9d7bddee6
    SHA256fb0dbc3b9c897b7571b94fb2203ffb1ac0facfe366b2cb1f91904ea5335018f0
    Authentihash MD58d1f5412cc6e58af2bdbff2e179f298d
    Authentihash SHA15d01cd9701213f7fd4073507cdbe18f4b742baf7
    Authentihash SHA256efde1a896c24055780aefb6f1c5fee097b8dffbe79b7e2c26320f6fe7ea3b74d
    RichPEHeaderHash MD51e7257fad0156a8620120920a4eba3d1
    RichPEHeaderHash SHA181c0a25338b94e6f37fd4b008a96ec206578ae8c
    RichPEHeaderHash SHA25628b974fe883d1f49b63303afa89877013459bc739b2443009f34bf3f7206140e
    CompanyParagon Software GmbH
    DescriptionA part of Paragon System Utilities
    ProductParagon System Utilities
    OriginalFilenamebiontdrv.sys

    Download

    Certificates

    Expand
    Certificate 247d157352d5671a5e44263793df43d2
    FieldValue
    ToBeSigned (TBS) MD51a2e03e5b6dc284e5d998e6158740a72
    ToBeSigned (TBS) SHA11d0ed63f8c96e325d1ffb31c332f8596c305793d
    ToBeSigned (TBS) SHA2563900ed5cdcf9df569542b660de61a8ef8c0afd49ce16b6cc69bf81f186be3fc1
    SubjectC=DE, ST=Baden,Wrttemberg, L=Freiburg im Breisgau, O=Paragon Software GmbH, CN=Paragon Software GmbH
    ValidFrom2017-08-28 00:00:00
    ValidTo2018-09-16 23:59:59
    Signatureb6880e26e7f7a31499535b4ef31185c25627f07f203bb88c3db097e8f87d9c700a61a5ec4181d88e49e8aa287813fa2322eb15e5c590bed5bc39b545f5ca5a716e7be94f0f93985746d938462bd0c0649eb72fdedea26b837085fb177a738968d3a92e8c1f8408d108c0ad23f075feed4be4bb72430a46380d7c9e90aff4a1972a3bf3c82112f902d88e26b1b585cd0daec825d64468e0642f9a0f3269ee440efe0a1b561f69cf827aa480cd1fe02638f02d6fb2474a033cc7bd72e95b609a54bd3b3cf58ed3da2a13145e0c973a104d173af454ec00611912b1e706fcb09da6f159e5659107afcc8ba2620c7524af645a6804fdcc54f51ef40e5e9fb5246b6d
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber247d157352d5671a5e44263793df43d2
    Version3
    Certificate 611993e400000000001c
    FieldValue
    ToBeSigned (TBS) MD578a717e082dcc1cda3458d917e677d14
    ToBeSigned (TBS) SHA14a872e0e51f9b304469cd1dedb496ee9b8b983a4
    ToBeSigned (TBS) SHA256317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
    ValidFrom2011-02-22 19:25:17
    ValidTo2021-02-22 19:35:17
    Signature812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber611993e400000000001c
    Version3
    Certificate 5200e5aa2556fc1a86ed96c9d44b33c7
    FieldValue
    ToBeSigned (TBS) MD5b30c31a572b0409383ed3fbe17e56e81
    ToBeSigned (TBS) SHA14843a82ed3b1f2bfbee9671960e1940c942f688d
    ToBeSigned (TBS) SHA25603cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
    ValidFrom2010-02-08 00:00:00
    ValidTo2020-02-07 23:59:59
    Signature5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber5200e5aa2556fc1a86ed96c9d44b33c7
    Version3

    Imports

    Expand
    • ntoskrnl.exe
    • HAL.dll

    Imported Functions

    Expand
    • KeWaitForSingleObject
    • MmMapLockedPages
    • MmMapIoSpace
    • MmUnmapIoSpace
    • IoBuildDeviceIoControlRequest
    • IoBuildSynchronousFsdRequest
    • IofCallDriver
    • IofCompleteRequest
    • IoCreateDevice
    • IoCreateSymbolicLink
    • IoDeleteDevice
    • IoDeleteSymbolicLink
    • IoGetRelatedDeviceObject
    • PoRegisterSystemState
    • PoUnregisterSystemState
    • KeInitializeEvent
    • ObfDereferenceObject
    • ZwOpenFile
    • ZwClose
    • __C_specific_handler
    • IoFileObjectType
    • InbvAcquireDisplayOwnership
    • InbvDisplayString
    • InbvEnableDisplayString
    • InbvIsBootDriverInstalled
    • InbvResetDisplay
    • InbvSetScrollRegion
    • InbvSetTextColor
    • InbvSolidColorFill
    • InbvNotifyDisplayOwnershipLost
    • ObReferenceObjectByHandle
    • RtlInitUnicodeString
    • HalReturnToFirmware

    Exported Functions

    Expand

    Sections

    Expand
    • .text
    • .data
    • .pdata
    • .idata
    • .rsrc
    • .reloc

    Signature

    Expand
    {
  "Certificates": [
    {
      "CertificateType": "Leaf (Code Signing)",
      "IsCA": false,
      "IsCertificateAuthority": false,
      "IsCodeSigning": true,
      "SerialNumber": "247d157352d5671a5e44263793df43d2",
      "Signature": "b6880e26e7f7a31499535b4ef31185c25627f07f203bb88c3db097e8f87d9c700a61a5ec4181d88e49e8aa287813fa2322eb15e5c590bed5bc39b545f5ca5a716e7be94f0f93985746d938462bd0c0649eb72fdedea26b837085fb177a738968d3a92e8c1f8408d108c0ad23f075feed4be4bb72430a46380d7c9e90aff4a1972a3bf3c82112f902d88e26b1b585cd0daec825d64468e0642f9a0f3269ee440efe0a1b561f69cf827aa480cd1fe02638f02d6fb2474a033cc7bd72e95b609a54bd3b3cf58ed3da2a13145e0c973a104d173af454ec00611912b1e706fcb09da6f159e5659107afcc8ba2620c7524af645a6804fdcc54f51ef40e5e9fb5246b6d",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=DE, ST=Baden,Wrttemberg, L=Freiburg im Breisgau, O=Paragon Software GmbH, CN=Paragon Software GmbH",
      "TBS": {
        "MD5": "1a2e03e5b6dc284e5d998e6158740a72",
        "SHA1": "1d0ed63f8c96e325d1ffb31c332f8596c305793d",
        "SHA256": "3900ed5cdcf9df569542b660de61a8ef8c0afd49ce16b6cc69bf81f186be3fc1",
        "SHA384": "2508ac23775fa2b90f5a4117779a83be588f54f1e581751656f00af68a09b66c386f23b4d86e06e96531fc43b5e7fe23"
      },
      "ValidFrom": "2017-08-28 00:00:00",
      "ValidTo": "2018-09-16 23:59:59",
      "Version": 3
    },
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": false,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "247d157352d5671a5e44263793df43d2",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}
    PropertyValue
    Filename
    Creation Timestamp2022-08-11 08:04:23
    MD5525ef6014f0ef20e44fe47c1d9980b69
    SHA1cab45e9d03efa8a09595b99b275caadb8f250811
    SHA256174c8d771d31d70fc95448e961a395f5ceb7658f0cc381a718fb3b854cde4efe
    Authentihash MD5778ca6c522c672bdd509cd37339916c8
    Authentihash SHA166f199e8edc9580a33c81d056b34b590481a7f01
    Authentihash SHA256015956494226d4cbb89283c7b915a46353670c7d41e02f0f2ba741c0d2c73615
    RichPEHeaderHash MD5103ed1ac1ea56c3cc7db32fa7d2eae72
    RichPEHeaderHash SHA14888504201b2e54209e2098252644cf9c7dac7ba
    RichPEHeaderHash SHA256180e1ac2cc854b49c7afdf2bd752147097fb55f5a5199a831885db6a4957ec10
    CompanyParagon Software GmbH
    DescriptionA part of Paragon System Utilities
    ProductParagon System Utilities
    OriginalFilenamebiontdrv.sys

    Download

    Certificates

    Expand
    Certificate 08ad40b260d29c4c9f5ecda9bd93aed9
    FieldValue
    ToBeSigned (TBS) MD55d8003a64dfa5a4d88365da1566038cb
    ToBeSigned (TBS) SHA179465b56bc7ad55a37bdf633943da8bfc84db228
    ToBeSigned (TBS) SHA25684bdc82e2f2a7f7aaa782667dac556ffcb2b33240c1f9c0a00a3264526a98332
    SubjectC=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
    ValidFrom2021-04-29 00:00:00
    ValidTo2036-04-28 23:59:59
    Signature3a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e
    SignatureAlgorithmOID1.2.840.113549.1.1.12
    IsCertificateAuthorityTrue
    SerialNumber08ad40b260d29c4c9f5ecda9bd93aed9
    Version3
    Certificate 046a6191017da49a025dd21aa76934f7
    FieldValue
    ToBeSigned (TBS) MD5c7f1b7cbb054ecb1a659ffeafd5975fa
    ToBeSigned (TBS) SHA16b17d9dd7483829600f8e94e6134ad87fb667a78
    ToBeSigned (TBS) SHA256d1a7a9b52e70c6bb75ec4b9a509be4367fc0e5d5edfcbeb62e443eda89596bef
    SubjectC=DE, ST=Baden,Wrttemberg, L=Freiburg, O=Paragon Software GmbH, CN=Paragon Software GmbH
    ValidFrom2021-10-27 00:00:00
    ValidTo2022-11-09 23:59:59
    Signature60efe8e490f73560084068cb01097a77ddc92a2b0a0c4fc2d148becc30dc16ca81fa83edad0813b37ad623ada902100d64b4b3e75cd38a858ca11a068b2b70a80ad3be0edd05f449b254108d9fcdf04bfefbcf2e976b3be1c5190efcadfddd3a98493c0e088b4e5d67396054d593fa176999cd14f49d928a36aec45214539d624cfda6f97dc77691dc4155a4b8348ce3910588c7a6c309c63e2b7ab45d4b09228f62b6127c094171c5e533a69eba287b1c15aa5797f79debf5ff378692cbe41925ff5a226bf3b521ce8c988cf7ecb655bba8e5b3a6ae70792df23b1bdc86cf1d5f43aa0cddd6fb1bc9ea7c70aae4e161e7abbb12a9c63b5cccbb4efd9cd680c1c126151746b996517a083eb73c6d30b7255e38c8e52f105a58969f53f7c64811a285629b1ffc1b364342680e55c26532a8eaae218430598031cc94c37adf26f80018bbfc6d54fcbd351683f2bcd61ab84af6ef2d9ab3322b0437343c6f69ad6bfafa56e6e0cd0ba5a769bb53772b2546d43d38375d224375bb29adf2a495f5c44b04a3efb9130594ab0690bc85538a4a612efb47d6dd0bb032196eb47e00c4a150052c860a112f46163c6cf071f6ee9ef928f5c895a206a9886f23f58e394f28415dcaf227cf2dc0690a0880362bb558ba140d084966593754a8dd896ff67e5e1b7abe130c2b503406d0c7ac387422b83973c4dffe8f4b7c0d17dc800463091e
    SignatureAlgorithmOID1.2.840.113549.1.1.11
    IsCertificateAuthorityFalse
    SerialNumber046a6191017da49a025dd21aa76934f7
    Version3

    Imports

    Expand
    • ntoskrnl.exe
    • HAL.dll

    Imported Functions

    Expand
    • RtlValidSecurityDescriptor
    • RtlSetDaclSecurityDescriptor
    • KeInitializeEvent
    • KeWaitForSingleObject
    • ExGetPreviousMode
    • MmMapLockedPages
    • MmMapIoSpace
    • MmUnmapIoSpace
    • SeCaptureSubjectContext
    • SeReleaseSubjectContext
    • SeAccessCheck
    • IoBuildDeviceIoControlRequest
    • IoBuildSynchronousFsdRequest
    • IofCallDriver
    • IofCompleteRequest
    • IoCreateDevice
    • IoCreateSymbolicLink
    • IoDeleteDevice
    • IoDeleteSymbolicLink
    • IoGetRelatedDeviceObject
    • IoIs32bitProcess
    • PoRegisterSystemState
    • PoUnregisterSystemState
    • ObReferenceObjectByHandle
    • ObfDereferenceObject
    • ZwOpenFile
    • ZwClose
    • ZwOpenProcess
    • RtlCreateSecurityDescriptor
    • KeAttachProcess
    • KeDetachProcess
    • ZwDuplicateObject
    • ObQueryNameString
    • SePrivilegeCheck
    • RtlInitializeSid
    • RtlSubAuthoritySid
    • RtlLengthSid
    • RtlCreateAcl
    • RtlAddAccessAllowedAce
    • RtlSetGroupSecurityDescriptor
    • RtlSetOwnerSecurityDescriptor
    • RtlAllocateHeap
    • RtlFreeHeap
    • RtlCreateHeap
    • RtlDestroyHeap
    • __C_specific_handler
    • IoFileObjectType
    • PsLookupProcessByProcessId
    • RtlInitUnicodeString
    • HalReturnToFirmware

    Exported Functions

    Expand

    Sections

    Expand
    • .text
    • .data
    • .pdata
    • .idata
    • .rsrc
    • .reloc

    Signature

    Expand
    {
  "Certificates": [
    {
      "CertificateType": "Leaf (Code Signing)",
      "IsCA": false,
      "IsCertificateAuthority": false,
      "IsCodeSigning": true,
      "SerialNumber": "247d157352d5671a5e44263793df43d2",
      "Signature": "b6880e26e7f7a31499535b4ef31185c25627f07f203bb88c3db097e8f87d9c700a61a5ec4181d88e49e8aa287813fa2322eb15e5c590bed5bc39b545f5ca5a716e7be94f0f93985746d938462bd0c0649eb72fdedea26b837085fb177a738968d3a92e8c1f8408d108c0ad23f075feed4be4bb72430a46380d7c9e90aff4a1972a3bf3c82112f902d88e26b1b585cd0daec825d64468e0642f9a0f3269ee440efe0a1b561f69cf827aa480cd1fe02638f02d6fb2474a033cc7bd72e95b609a54bd3b3cf58ed3da2a13145e0c973a104d173af454ec00611912b1e706fcb09da6f159e5659107afcc8ba2620c7524af645a6804fdcc54f51ef40e5e9fb5246b6d",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=DE, ST=Baden,Wrttemberg, L=Freiburg im Breisgau, O=Paragon Software GmbH, CN=Paragon Software GmbH",
      "TBS": {
        "MD5": "1a2e03e5b6dc284e5d998e6158740a72",
        "SHA1": "1d0ed63f8c96e325d1ffb31c332f8596c305793d",
        "SHA256": "3900ed5cdcf9df569542b660de61a8ef8c0afd49ce16b6cc69bf81f186be3fc1",
        "SHA384": "2508ac23775fa2b90f5a4117779a83be588f54f1e581751656f00af68a09b66c386f23b4d86e06e96531fc43b5e7fe23"
      },
      "ValidFrom": "2017-08-28 00:00:00",
      "ValidTo": "2018-09-16 23:59:59",
      "Version": 3
    },
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": false,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "247d157352d5671a5e44263793df43d2",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

    source

    last_updated: 2026-04-28