7ce8fb06-46eb-4f4f-90d5-5518a6561f15

gmer64.sys

Description

Driver used by the GMER application. Which is an application that detects and removes rootkits

UUID: 7ce8fb06-46eb-4f4f-90d5-5518a6561f15
Created: 2023-05-22
Author: Michael Haag
Acknowledgement: hfiref0x | hfiref0x

This download link contains the malicious driver!

Commands

sc.exe create gmer64.sys binPath=C:\windows\temp\gmer64.sys type=kernel &amp;&amp; sc.exe start gmer64.sys

Use Case	Privileges	Operating System
Elevate privileges	kernel	Windows 10

Detections

YARA 🏹

Expand

Exact Match

with header and size limitation

Threat Hunting

without header and size limitation

Sigma 🛡️

Expand

Names

detects loading using name only

Hashes

detects loading using hashes only

Sysmon 🔎

Expand

Block

on hashes

Alert

on hashes

Resources

https://github.com/magicsword-io/LOLDrivers/issues/55#issuecomment-1537161951

http://www.gmer.net/

https://github.com/gtworek/PSBits/blob/master/Misc/KillWithLolDriver.ps1

https://github.com/ZeroMemoryEx/Blackout

https://github.com/b1-team/superman

Known Vulnerable Samples

Property	Value
Filename	gmer64.sys
Creation Timestamp	2016-03-09 00:28:57
MD5	a822b9e6eedf69211013e192967bf523
SHA1	83506de48bd0c50ea00c9e889fe980f56e6c6e1b
SHA256	18c909a2b8c5e16821d6ef908f56881aa0ecceeaccb5fa1e54995935fcfd12f7
Authentihash MD5	7514f440c5b9e5c4a0498e4489b76d62
Authentihash SHA1	0bca6c35159282fd64615abc4d398399b061847b
Authentihash SHA256	3913d9754b78182aa25d38fbd7ea02502bdf1d81e6525ab4b5ffe5f543200478
RichPEHeaderHash MD5	ae0016968883c7b6d9bf26bf6adcb454
RichPEHeaderHash SHA1	ae1e456ae17f0bce4cb62e8cc3a76e5b83c53caa
RichPEHeaderHash SHA256	9c178663dffdd9f9429f961711da30f4c966a2437d235785d182a6e5afb40fbc
Company	GMER
Description	GMER Driver http://www.gmer.net
Product	GMER
OriginalFilename	gmer64.sys

Download

Certificates

Expand

Certificate 0400000000012f4ee1355c

Field	Value
ToBeSigned (TBS) MD5	f6a9e8eb8784f3f694b4e353c08a0ff5
ToBeSigned (TBS) SHA1	589a7d4df869395601ba7538a65afae8c4616385
ToBeSigned (TBS) SHA256	cbdc9a0ad785d0c2013211746b42234e18bdc7d54a7a260647badc1c9e712ed4
Subject	C=BE, O=GlobalSign nv,sa, CN=GlobalSign CodeSigning CA , G2
ValidFrom	2011-04-13 10:00:00
ValidTo	2019-04-13 10:00:00
Signature	225cc5dd3df40b70d8e3f5e7c58e0901bbb196365c5a07adc7a8444951257aae0da4193b929ccfb94226bb3b6c97e7c7ce116d6891da8d6df1534d54388c61f3c8827669be81320b31c36cc99e200a582ff048fe7e4807aad743589473540431a9780d3b8cb070c13d7ed7bd2f2ac3e2f58f0c90dc6ba5c8be685e5d6df878d2be49951e15780891fb34c8be84adbce0c6dd18dbf3caf07bc2143c18b803ba953e211e3f60697a7f6a039e8d4af9f0282c30845eec267242b16dcb64c3128cd6844b67417cb103177809e3ada8b6962da47e80034f88f7c16b5a4615cd2c198bd8709ce52d49886072a8a4195270435edad64603b0680e24ef4af60b2524ef24
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	0400000000012f4ee1355c
Version	3

Certificate 1121c5bcad73319ee0131e328a2b814e164a

Field	Value
ToBeSigned (TBS) MD5	6f0e4c627d045bd81b94ec79fd4b371d
ToBeSigned (TBS) SHA1	a624238b100a59ac8722559c4d1e75aa4f7d99a4
ToBeSigned (TBS) SHA256	f0f8a64560267f1ff198c83420155851c8b91ae9eeb6227c9d1833b29b504e83
Subject	C=PL, ST=Katowice, L=Katowice, O=GMEREK Systemy Komputerowe Przemyslaw Gmerek, CN=GMEREK Systemy Komputerowe Przemyslaw Gmerek
ValidFrom	2014-01-02 07:01:46
ValidTo	2015-02-04 15:04:09
Signature	ad49289aa50c6f87bd70af8712f5c8bf00f5e44e58d92f3e0429b2179e6368a89ba4d6a35a08a6bb271dbaa454a1ffeaa1e774eb5e3b564d08998c930453ce3db67186fe7797ebf4aeb2b3f693ff919ce7ffe24ad3715ed12a2838ffd6b3a43d79b6771dd89e5b076fae811e8aca865f6ed5475a5316ee5ab85888101e65671416a1afb6fee3ac3d70a45090331e481e2bbbbe8c48f0fe31e44cc172c45c563897e70cd1c7d5afb602735b7160cb4853b6ec4b61efee01be7408f6a00214bd9381b173531fd1c903839906b8eb104a1684084a30f9618774ef23ecfbc7b6f5c7e53ed59e4be74fe4e18ceec5cb4ea9561bf8827e8bce6d30299ec8d5d5df62d2
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	1121c5bcad73319ee0131e328a2b814e164a
Version	3

Certificate 6129152700000000002a

Field	Value
ToBeSigned (TBS) MD5	0bb058d116f02817737920f112d9fd3b
ToBeSigned (TBS) SHA1	fd116235171a4feafedee586b7a59185fb5fd7e6
ToBeSigned (TBS) SHA256	f970426cc46d2ae0fc5f899fa19dbe76e05f07e525654c60c3c9399492c291f4
Subject	C=BE, O=GlobalSign nv,sa, OU=Root CA, CN=GlobalSign Root CA
ValidFrom	2011-04-15 19:55:08
ValidTo	2021-04-15 20:05:08
Signature	5ff8d065746a81c6a6ca5b03b6914ae84bbdef2ba142f0efb4a5adcd3389ec0b9585ac62501108aa58d25aa08310e5a6337af25af2c5fe787cf09c83df190ad97396002dd62ccde914d41d9de83f3c1a76f7904efb01350a6c9313a0c356eb67a0e4d17a96dec267f190f80a7bf5321b94ec5f751f8d1b34da6c58a7cb2d279e2226b7c9aa30cc0777b836e38201b5393ccc8dd9a75f7f23b3877fdb5798918bd7ce2520e39d644fdd87f72b68490318e0a5df7c5f68644d36838d4781f2e9e0a869abfa7b163c05a449ea8830190a6c73055178dfd41ddd3ad47f2de44e54be83431e7a7433b4a4ebd77073bc2a02988966eef6bc8f749378e329025a5a43e258ce7ccf9acad236893be25fda26054ec8d4e72c910e1797c5beee8b13112323294ffa83d050f6bafad53db3173df4ff034aa325dce67561d1fa35086bd62744d068b78d45e0eb852cc8a15d614474160e5958aed2b5eea5bcd6d7076ab62978fd976767dd8d4f17944fd2ed0caf972437c3a29c81da6be143b6577b4cecbf791319e79fe844e94781b75e701e91f83dd17b27f50b7056434805dda92fab86101d0b12e31ad04c6e75ded645b30b748887935c564a41029af7aeb799d8b67f88fa11f2457cf4d71b91c01cf1a0fbd4080a411a142acef4eb34486e66879ed54b7a397fbb0e3d3861cf735706e412066bd96b5308cd7018c22d4f974691bca9f0
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	6129152700000000002a
Version	3

Imports

Expand

ntoskrnl.exe

Imported Functions

Expand

PsProcessType
IoDeleteSymbolicLink
ExFreePoolWithTag
strncmp
_snwprintf
PsLookupProcessByProcessId
RtlInitUnicodeString
IoDeleteDevice
KeUnstackDetachProcess
KeDetachProcess
IoDriverObjectType
wcsrchr
ExAllocatePool
ZwClose
KeBugCheck
IofCompleteRequest
ObReferenceObjectByHandle
KeAttachProcess
PsGetVersion
PsThreadType
IoCreateSymbolicLink
MmIsAddressValid
ObfDereferenceObject
ObReferenceObjectByName
IoCreateDevice
ObOpenObjectByPointer
KeStackAttachProcess
PsLookupThreadByThreadId
KeClearEvent
IoGetBaseFileSystemDeviceObject
IoBuildSynchronousFsdRequest
_wcsnicmp
ZwReadFile
wcsncpy
KeInitializeEvent
ZwSetInformationFile
strncpy
IoGetDeviceObjectPointer
NtClose
KeWaitForSingleObject
ZwDeleteFile
RtlCompareUnicodeString
ObfReferenceObject
ZwOpenFile
ZwQueryInformationFile
ZwWriteFile
IofCallDriver
wcschr
MmUnmapLockedPages
_stricmp
_strnicmp
RtlVolumeDeviceToDosName
ZwMapViewOfSection
MmGetSystemRoutineAddress
ZwQuerySystemInformation
KeReleaseSpinLock
ZwOpenThread
IoFreeMdl
KeDelayExecutionThread
MmMapLockedPagesSpecifyCache
ZwUnmapViewOfSection
IoGetCurrentProcess
MmProbeAndLockPages
ZwOpenProcess
MmUnlockPages
ZwQueryInformationProcess
ZwCreateSection
wcsncmp
ZwTerminateProcess
ZwQueryInformationThread
IoAllocateMdl
KeAcquireSpinLockRaiseToDpc
ZwQuerySymbolicLinkObject
KeSetEvent
RtlEqualUnicodeString
ZwOpenSymbolicLinkObject
ZwOpenDirectoryObject
ZwQueryDirectoryObject
IoFreeIrp
IoAllocateIrp
IoGetDeviceInterfaces
IoCreateNotificationEvent
ObQueryNameString
ZwWaitForSingleObject
ZwQueryDirectoryFile
KeResetEvent
KdDebuggerNotPresent
PsCreateSystemThread
PsTerminateSystemThread
KeBugCheckEx
__C_specific_handler

Exported Functions

Expand

Sections

Expand

.text
.rdata
.data
.pdata
INIT
.rsrc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "0400000000012f4ee1355c",
      "Signature": "225cc5dd3df40b70d8e3f5e7c58e0901bbb196365c5a07adc7a8444951257aae0da4193b929ccfb94226bb3b6c97e7c7ce116d6891da8d6df1534d54388c61f3c8827669be81320b31c36cc99e200a582ff048fe7e4807aad743589473540431a9780d3b8cb070c13d7ed7bd2f2ac3e2f58f0c90dc6ba5c8be685e5d6df878d2be49951e15780891fb34c8be84adbce0c6dd18dbf3caf07bc2143c18b803ba953e211e3f60697a7f6a039e8d4af9f0282c30845eec267242b16dcb64c3128cd6844b67417cb103177809e3ada8b6962da47e80034f88f7c16b5a4615cd2c198bd8709ce52d49886072a8a4195270435edad64603b0680e24ef4af60b2524ef24",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=BE, O=GlobalSign nv,sa, CN=GlobalSign CodeSigning CA , G2",
      "TBS": {
        "MD5": "f6a9e8eb8784f3f694b4e353c08a0ff5",
        "SHA1": "589a7d4df869395601ba7538a65afae8c4616385",
        "SHA256": "cbdc9a0ad785d0c2013211746b42234e18bdc7d54a7a260647badc1c9e712ed4",
        "SHA384": "dcec542f242317863d0b3d23947e17d6982e381003831777b07ed75b46fb18bd0392a89c9beb6862981cd05f3f2fb77b"
      },
      "ValidFrom": "2011-04-13 10:00:00",
      "ValidTo": "2019-04-13 10:00:00",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "1121c5bcad73319ee0131e328a2b814e164a",
      "Signature": "ad49289aa50c6f87bd70af8712f5c8bf00f5e44e58d92f3e0429b2179e6368a89ba4d6a35a08a6bb271dbaa454a1ffeaa1e774eb5e3b564d08998c930453ce3db67186fe7797ebf4aeb2b3f693ff919ce7ffe24ad3715ed12a2838ffd6b3a43d79b6771dd89e5b076fae811e8aca865f6ed5475a5316ee5ab85888101e65671416a1afb6fee3ac3d70a45090331e481e2bbbbe8c48f0fe31e44cc172c45c563897e70cd1c7d5afb602735b7160cb4853b6ec4b61efee01be7408f6a00214bd9381b173531fd1c903839906b8eb104a1684084a30f9618774ef23ecfbc7b6f5c7e53ed59e4be74fe4e18ceec5cb4ea9561bf8827e8bce6d30299ec8d5d5df62d2",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=PL, ST=Katowice, L=Katowice, O=GMEREK Systemy Komputerowe Przemyslaw Gmerek, CN=GMEREK Systemy Komputerowe Przemyslaw Gmerek",
      "TBS": {
        "MD5": "6f0e4c627d045bd81b94ec79fd4b371d",
        "SHA1": "a624238b100a59ac8722559c4d1e75aa4f7d99a4",
        "SHA256": "f0f8a64560267f1ff198c83420155851c8b91ae9eeb6227c9d1833b29b504e83",
        "SHA384": "3f63878ac97adadd93ed3e316d703f25459441d2d9847dd8caec36af8c904906aaf96b55cde8cefda3d3c8031c722dd1"
      },
      "ValidFrom": "2014-01-02 07:01:46",
      "ValidTo": "2015-02-04 15:04:09",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "6129152700000000002a",
      "Signature": "5ff8d065746a81c6a6ca5b03b6914ae84bbdef2ba142f0efb4a5adcd3389ec0b9585ac62501108aa58d25aa08310e5a6337af25af2c5fe787cf09c83df190ad97396002dd62ccde914d41d9de83f3c1a76f7904efb01350a6c9313a0c356eb67a0e4d17a96dec267f190f80a7bf5321b94ec5f751f8d1b34da6c58a7cb2d279e2226b7c9aa30cc0777b836e38201b5393ccc8dd9a75f7f23b3877fdb5798918bd7ce2520e39d644fdd87f72b68490318e0a5df7c5f68644d36838d4781f2e9e0a869abfa7b163c05a449ea8830190a6c73055178dfd41ddd3ad47f2de44e54be83431e7a7433b4a4ebd77073bc2a02988966eef6bc8f749378e329025a5a43e258ce7ccf9acad236893be25fda26054ec8d4e72c910e1797c5beee8b13112323294ffa83d050f6bafad53db3173df4ff034aa325dce67561d1fa35086bd62744d068b78d45e0eb852cc8a15d614474160e5958aed2b5eea5bcd6d7076ab62978fd976767dd8d4f17944fd2ed0caf972437c3a29c81da6be143b6577b4cecbf791319e79fe844e94781b75e701e91f83dd17b27f50b7056434805dda92fab86101d0b12e31ad04c6e75ded645b30b748887935c564a41029af7aeb799d8b67f88fa11f2457cf4d71b91c01cf1a0fbd4080a411a142acef4eb34486e66879ed54b7a397fbb0e3d3861cf735706e412066bd96b5308cd7018c22d4f974691bca9f0",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=BE, O=GlobalSign nv,sa, OU=Root CA, CN=GlobalSign Root CA",
      "TBS": {
        "MD5": "0bb058d116f02817737920f112d9fd3b",
        "SHA1": "fd116235171a4feafedee586b7a59185fb5fd7e6",
        "SHA256": "f970426cc46d2ae0fc5f899fa19dbe76e05f07e525654c60c3c9399492c291f4",
        "SHA384": "c0df876be008c26ca407fe904e6f5e7ccded17f9c16830ce9f8022309c9e64c97f494810f152811ae43e223b82ad7cc6"
      },
      "ValidFrom": "2011-04-15 19:55:08",
      "ValidTo": "2021-04-15 20:05:08",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=BE, O=GlobalSign nv,sa, CN=GlobalSign CodeSigning CA , G2",
      "SerialNumber": "1121c5bcad73319ee0131e328a2b814e164a",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename
Creation Timestamp	2016-03-09 00:28:57
MD5	98b8507e725b3d28537fc374eb2de72d
SHA1	c80d7fe8279ddfd466505a24b9c8cc7a68b9d0e4
SHA256	0052aa88e42055a2eed5ddd17c3499c692360155e5e031a211edfcef577acce3
Authentihash MD5	7514f440c5b9e5c4a0498e4489b76d62
Authentihash SHA1	0bca6c35159282fd64615abc4d398399b061847b
Authentihash SHA256	3913d9754b78182aa25d38fbd7ea02502bdf1d81e6525ab4b5ffe5f543200478
RichPEHeaderHash MD5	ae0016968883c7b6d9bf26bf6adcb454
RichPEHeaderHash SHA1	ae1e456ae17f0bce4cb62e8cc3a76e5b83c53caa
RichPEHeaderHash SHA256	9c178663dffdd9f9429f961711da30f4c966a2437d235785d182a6e5afb40fbc
Company	GMER
Description	GMER Driver http://www.gmer.net
Product	GMER
OriginalFilename	gmer64.sys

Download

Certificates

Expand

Certificate 0400000000012f4ee1355c

Field	Value
ToBeSigned (TBS) MD5	f6a9e8eb8784f3f694b4e353c08a0ff5
ToBeSigned (TBS) SHA1	589a7d4df869395601ba7538a65afae8c4616385
ToBeSigned (TBS) SHA256	cbdc9a0ad785d0c2013211746b42234e18bdc7d54a7a260647badc1c9e712ed4
Subject	C=BE, O=GlobalSign nv,sa, CN=GlobalSign CodeSigning CA , G2
ValidFrom	2011-04-13 10:00:00
ValidTo	2019-04-13 10:00:00
Signature	225cc5dd3df40b70d8e3f5e7c58e0901bbb196365c5a07adc7a8444951257aae0da4193b929ccfb94226bb3b6c97e7c7ce116d6891da8d6df1534d54388c61f3c8827669be81320b31c36cc99e200a582ff048fe7e4807aad743589473540431a9780d3b8cb070c13d7ed7bd2f2ac3e2f58f0c90dc6ba5c8be685e5d6df878d2be49951e15780891fb34c8be84adbce0c6dd18dbf3caf07bc2143c18b803ba953e211e3f60697a7f6a039e8d4af9f0282c30845eec267242b16dcb64c3128cd6844b67417cb103177809e3ada8b6962da47e80034f88f7c16b5a4615cd2c198bd8709ce52d49886072a8a4195270435edad64603b0680e24ef4af60b2524ef24
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	0400000000012f4ee1355c
Version	3

Certificate 1121c5bcad73319ee0131e328a2b814e164a

Field	Value
ToBeSigned (TBS) MD5	6f0e4c627d045bd81b94ec79fd4b371d
ToBeSigned (TBS) SHA1	a624238b100a59ac8722559c4d1e75aa4f7d99a4
ToBeSigned (TBS) SHA256	f0f8a64560267f1ff198c83420155851c8b91ae9eeb6227c9d1833b29b504e83
Subject	C=PL, ST=Katowice, L=Katowice, O=GMEREK Systemy Komputerowe Przemyslaw Gmerek, CN=GMEREK Systemy Komputerowe Przemyslaw Gmerek
ValidFrom	2014-01-02 07:01:46
ValidTo	2015-02-04 15:04:09
Signature	ad49289aa50c6f87bd70af8712f5c8bf00f5e44e58d92f3e0429b2179e6368a89ba4d6a35a08a6bb271dbaa454a1ffeaa1e774eb5e3b564d08998c930453ce3db67186fe7797ebf4aeb2b3f693ff919ce7ffe24ad3715ed12a2838ffd6b3a43d79b6771dd89e5b076fae811e8aca865f6ed5475a5316ee5ab85888101e65671416a1afb6fee3ac3d70a45090331e481e2bbbbe8c48f0fe31e44cc172c45c563897e70cd1c7d5afb602735b7160cb4853b6ec4b61efee01be7408f6a00214bd9381b173531fd1c903839906b8eb104a1684084a30f9618774ef23ecfbc7b6f5c7e53ed59e4be74fe4e18ceec5cb4ea9561bf8827e8bce6d30299ec8d5d5df62d2
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	1121c5bcad73319ee0131e328a2b814e164a
Version	3

Certificate 6129152700000000002a

Field	Value
ToBeSigned (TBS) MD5	0bb058d116f02817737920f112d9fd3b
ToBeSigned (TBS) SHA1	fd116235171a4feafedee586b7a59185fb5fd7e6
ToBeSigned (TBS) SHA256	f970426cc46d2ae0fc5f899fa19dbe76e05f07e525654c60c3c9399492c291f4
Subject	C=BE, O=GlobalSign nv,sa, OU=Root CA, CN=GlobalSign Root CA
ValidFrom	2011-04-15 19:55:08
ValidTo	2021-04-15 20:05:08
Signature	5ff8d065746a81c6a6ca5b03b6914ae84bbdef2ba142f0efb4a5adcd3389ec0b9585ac62501108aa58d25aa08310e5a6337af25af2c5fe787cf09c83df190ad97396002dd62ccde914d41d9de83f3c1a76f7904efb01350a6c9313a0c356eb67a0e4d17a96dec267f190f80a7bf5321b94ec5f751f8d1b34da6c58a7cb2d279e2226b7c9aa30cc0777b836e38201b5393ccc8dd9a75f7f23b3877fdb5798918bd7ce2520e39d644fdd87f72b68490318e0a5df7c5f68644d36838d4781f2e9e0a869abfa7b163c05a449ea8830190a6c73055178dfd41ddd3ad47f2de44e54be83431e7a7433b4a4ebd77073bc2a02988966eef6bc8f749378e329025a5a43e258ce7ccf9acad236893be25fda26054ec8d4e72c910e1797c5beee8b13112323294ffa83d050f6bafad53db3173df4ff034aa325dce67561d1fa35086bd62744d068b78d45e0eb852cc8a15d614474160e5958aed2b5eea5bcd6d7076ab62978fd976767dd8d4f17944fd2ed0caf972437c3a29c81da6be143b6577b4cecbf791319e79fe844e94781b75e701e91f83dd17b27f50b7056434805dda92fab86101d0b12e31ad04c6e75ded645b30b748887935c564a41029af7aeb799d8b67f88fa11f2457cf4d71b91c01cf1a0fbd4080a411a142acef4eb34486e66879ed54b7a397fbb0e3d3861cf735706e412066bd96b5308cd7018c22d4f974691bca9f0
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	6129152700000000002a
Version	3

Imports

Expand

ntoskrnl.exe

Imported Functions

Expand

PsProcessType
IoDeleteSymbolicLink
ExFreePoolWithTag
strncmp
_snwprintf
PsLookupProcessByProcessId
RtlInitUnicodeString
IoDeleteDevice
KeUnstackDetachProcess
KeDetachProcess
IoDriverObjectType
wcsrchr
ExAllocatePool
ZwClose
KeBugCheck
IofCompleteRequest
ObReferenceObjectByHandle
KeAttachProcess
PsGetVersion
PsThreadType
IoCreateSymbolicLink
MmIsAddressValid
ObfDereferenceObject
ObReferenceObjectByName
IoCreateDevice
ObOpenObjectByPointer
KeStackAttachProcess
PsLookupThreadByThreadId
KeClearEvent
IoGetBaseFileSystemDeviceObject
IoBuildSynchronousFsdRequest
_wcsnicmp
ZwReadFile
wcsncpy
KeInitializeEvent
ZwSetInformationFile
strncpy
IoGetDeviceObjectPointer
NtClose
KeWaitForSingleObject
ZwDeleteFile
RtlCompareUnicodeString
ObfReferenceObject
ZwOpenFile
ZwQueryInformationFile
ZwWriteFile
IofCallDriver
wcschr
MmUnmapLockedPages
_stricmp
_strnicmp
RtlVolumeDeviceToDosName
ZwMapViewOfSection
MmGetSystemRoutineAddress
ZwQuerySystemInformation
KeReleaseSpinLock
ZwOpenThread
IoFreeMdl
KeDelayExecutionThread
MmMapLockedPagesSpecifyCache
ZwUnmapViewOfSection
IoGetCurrentProcess
MmProbeAndLockPages
ZwOpenProcess
MmUnlockPages
ZwQueryInformationProcess
ZwCreateSection
wcsncmp
ZwTerminateProcess
ZwQueryInformationThread
IoAllocateMdl
KeAcquireSpinLockRaiseToDpc
ZwQuerySymbolicLinkObject
KeSetEvent
RtlEqualUnicodeString
ZwOpenSymbolicLinkObject
ZwOpenDirectoryObject
ZwQueryDirectoryObject
IoFreeIrp
IoAllocateIrp
IoGetDeviceInterfaces
IoCreateNotificationEvent
ObQueryNameString
ZwWaitForSingleObject
ZwQueryDirectoryFile
KeResetEvent
KdDebuggerNotPresent
PsCreateSystemThread
PsTerminateSystemThread
KeBugCheckEx
__C_specific_handler

Exported Functions

Expand

Sections

Expand

.text
.rdata
.data
.pdata
INIT
.rsrc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "0400000000012f4ee1355c",
      "Signature": "225cc5dd3df40b70d8e3f5e7c58e0901bbb196365c5a07adc7a8444951257aae0da4193b929ccfb94226bb3b6c97e7c7ce116d6891da8d6df1534d54388c61f3c8827669be81320b31c36cc99e200a582ff048fe7e4807aad743589473540431a9780d3b8cb070c13d7ed7bd2f2ac3e2f58f0c90dc6ba5c8be685e5d6df878d2be49951e15780891fb34c8be84adbce0c6dd18dbf3caf07bc2143c18b803ba953e211e3f60697a7f6a039e8d4af9f0282c30845eec267242b16dcb64c3128cd6844b67417cb103177809e3ada8b6962da47e80034f88f7c16b5a4615cd2c198bd8709ce52d49886072a8a4195270435edad64603b0680e24ef4af60b2524ef24",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=BE, O=GlobalSign nv,sa, CN=GlobalSign CodeSigning CA , G2",
      "TBS": {
        "MD5": "f6a9e8eb8784f3f694b4e353c08a0ff5",
        "SHA1": "589a7d4df869395601ba7538a65afae8c4616385",
        "SHA256": "cbdc9a0ad785d0c2013211746b42234e18bdc7d54a7a260647badc1c9e712ed4",
        "SHA384": "dcec542f242317863d0b3d23947e17d6982e381003831777b07ed75b46fb18bd0392a89c9beb6862981cd05f3f2fb77b"
      },
      "ValidFrom": "2011-04-13 10:00:00",
      "ValidTo": "2019-04-13 10:00:00",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "1121c5bcad73319ee0131e328a2b814e164a",
      "Signature": "ad49289aa50c6f87bd70af8712f5c8bf00f5e44e58d92f3e0429b2179e6368a89ba4d6a35a08a6bb271dbaa454a1ffeaa1e774eb5e3b564d08998c930453ce3db67186fe7797ebf4aeb2b3f693ff919ce7ffe24ad3715ed12a2838ffd6b3a43d79b6771dd89e5b076fae811e8aca865f6ed5475a5316ee5ab85888101e65671416a1afb6fee3ac3d70a45090331e481e2bbbbe8c48f0fe31e44cc172c45c563897e70cd1c7d5afb602735b7160cb4853b6ec4b61efee01be7408f6a00214bd9381b173531fd1c903839906b8eb104a1684084a30f9618774ef23ecfbc7b6f5c7e53ed59e4be74fe4e18ceec5cb4ea9561bf8827e8bce6d30299ec8d5d5df62d2",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=PL, ST=Katowice, L=Katowice, O=GMEREK Systemy Komputerowe Przemyslaw Gmerek, CN=GMEREK Systemy Komputerowe Przemyslaw Gmerek",
      "TBS": {
        "MD5": "6f0e4c627d045bd81b94ec79fd4b371d",
        "SHA1": "a624238b100a59ac8722559c4d1e75aa4f7d99a4",
        "SHA256": "f0f8a64560267f1ff198c83420155851c8b91ae9eeb6227c9d1833b29b504e83",
        "SHA384": "3f63878ac97adadd93ed3e316d703f25459441d2d9847dd8caec36af8c904906aaf96b55cde8cefda3d3c8031c722dd1"
      },
      "ValidFrom": "2014-01-02 07:01:46",
      "ValidTo": "2015-02-04 15:04:09",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "6129152700000000002a",
      "Signature": "5ff8d065746a81c6a6ca5b03b6914ae84bbdef2ba142f0efb4a5adcd3389ec0b9585ac62501108aa58d25aa08310e5a6337af25af2c5fe787cf09c83df190ad97396002dd62ccde914d41d9de83f3c1a76f7904efb01350a6c9313a0c356eb67a0e4d17a96dec267f190f80a7bf5321b94ec5f751f8d1b34da6c58a7cb2d279e2226b7c9aa30cc0777b836e38201b5393ccc8dd9a75f7f23b3877fdb5798918bd7ce2520e39d644fdd87f72b68490318e0a5df7c5f68644d36838d4781f2e9e0a869abfa7b163c05a449ea8830190a6c73055178dfd41ddd3ad47f2de44e54be83431e7a7433b4a4ebd77073bc2a02988966eef6bc8f749378e329025a5a43e258ce7ccf9acad236893be25fda26054ec8d4e72c910e1797c5beee8b13112323294ffa83d050f6bafad53db3173df4ff034aa325dce67561d1fa35086bd62744d068b78d45e0eb852cc8a15d614474160e5958aed2b5eea5bcd6d7076ab62978fd976767dd8d4f17944fd2ed0caf972437c3a29c81da6be143b6577b4cecbf791319e79fe844e94781b75e701e91f83dd17b27f50b7056434805dda92fab86101d0b12e31ad04c6e75ded645b30b748887935c564a41029af7aeb799d8b67f88fa11f2457cf4d71b91c01cf1a0fbd4080a411a142acef4eb34486e66879ed54b7a397fbb0e3d3861cf735706e412066bd96b5308cd7018c22d4f974691bca9f0",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=BE, O=GlobalSign nv,sa, OU=Root CA, CN=GlobalSign Root CA",
      "TBS": {
        "MD5": "0bb058d116f02817737920f112d9fd3b",
        "SHA1": "fd116235171a4feafedee586b7a59185fb5fd7e6",
        "SHA256": "f970426cc46d2ae0fc5f899fa19dbe76e05f07e525654c60c3c9399492c291f4",
        "SHA384": "c0df876be008c26ca407fe904e6f5e7ccded17f9c16830ce9f8022309c9e64c97f494810f152811ae43e223b82ad7cc6"
      },
      "ValidFrom": "2011-04-15 19:55:08",
      "ValidTo": "2021-04-15 20:05:08",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=BE, O=GlobalSign nv,sa, CN=GlobalSign CodeSigning CA , G2",
      "SerialNumber": "1121c5bcad73319ee0131e328a2b814e164a",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

source

last_updated: 2024-09-26