34a92442a7082cc5bee6b8826b0f6e12947fd714e2013fbb1c9141bff858e980
- SHA256 34a92442a7082cc5bee6b8826b0f6e12947fd714e2013fbb1c9141bff858e980
Overview
overview
3Static
static
3CVE-2026-3..._1.sys
windows10-2004-x64
3CVE-2026-3..._1.sys
windows11-ltsc_2024-x64
3CVE-2026-3...10.sys
windows10-2004-x64
3CVE-2026-3...10.sys
windows11-ltsc_2024-x64
3CVE-2026-3...11.sys
windows10-2004-x64
3CVE-2026-3...11.sys
windows11-ltsc_2024-x64
3CVE-2026-3...12.sys
windows10-2004-x64
3CVE-2026-3...12.sys
windows11-ltsc_2024-x64
3CVE-2026-3...13.sys
windows10-2004-x64
3CVE-2026-3...13.sys
windows11-ltsc_2024-x64
3CVE-2026-3...14.sys
windows10-2004-x64
3CVE-2026-3...14.sys
windows11-ltsc_2024-x64
3CVE-2026-3...15.sys
windows10-2004-x64
3CVE-2026-3...15.sys
windows11-ltsc_2024-x64
3CVE-2026-3...16.sys
windows10-2004-x64
3CVE-2026-3...16.sys
windows11-ltsc_2024-x64
3CVE-2026-3..._2.sys
windows10-2004-x64
3CVE-2026-3..._2.sys
windows11-ltsc_2024-x64
3CVE-2026-3..._3.sys
windows10-2004-x64
3CVE-2026-3..._3.sys
windows11-ltsc_2024-x64
3CVE-2026-3..._4.sys
windows10-2004-x64
3CVE-2026-3..._4.sys
windows11-ltsc_2024-x64
3CVE-2026-3..._5.sys
windows10-2004-x64
3CVE-2026-3..._5.sys
windows11-ltsc_2024-x64
3CVE-2026-3..._6.sys
windows10-2004-x64
3CVE-2026-3..._6.sys
windows11-ltsc_2024-x64
3CVE-2026-3..._7.sys
windows10-2004-x64
3CVE-2026-3..._7.sys
windows11-ltsc_2024-x64
3CVE-2026-3..._8.sys
windows10-2004-x64
3CVE-2026-3..._8.sys
windows11-ltsc_2024-x64
3CVE-2026-3..._9.sys
windows10-2004-x64
3CVE-2026-3..._9.sys
windows11-ltsc_2024-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CVE-2026-36425-main/Drivers/ardrv_1.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
CVE-2026-36425-main/Drivers/ardrv_1.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
CVE-2026-36425-main/Drivers/ardrv_10.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
CVE-2026-36425-main/Drivers/ardrv_10.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
CVE-2026-36425-main/Drivers/ardrv_11.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
CVE-2026-36425-main/Drivers/ardrv_11.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
CVE-2026-36425-main/Drivers/ardrv_12.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
CVE-2026-36425-main/Drivers/ardrv_12.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
CVE-2026-36425-main/Drivers/ardrv_13.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
CVE-2026-36425-main/Drivers/ardrv_13.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
CVE-2026-36425-main/Drivers/ardrv_14.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
CVE-2026-36425-main/Drivers/ardrv_14.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
CVE-2026-36425-main/Drivers/ardrv_15.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
CVE-2026-36425-main/Drivers/ardrv_15.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
CVE-2026-36425-main/Drivers/ardrv_16.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
CVE-2026-36425-main/Drivers/ardrv_16.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
CVE-2026-36425-main/Drivers/ardrv_2.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
CVE-2026-36425-main/Drivers/ardrv_2.sys
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
CVE-2026-36425-main/Drivers/ardrv_3.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
CVE-2026-36425-main/Drivers/ardrv_3.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
CVE-2026-36425-main/Drivers/ardrv_4.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
CVE-2026-36425-main/Drivers/ardrv_4.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
CVE-2026-36425-main/Drivers/ardrv_5.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
CVE-2026-36425-main/Drivers/ardrv_5.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
CVE-2026-36425-main/Drivers/ardrv_6.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
CVE-2026-36425-main/Drivers/ardrv_6.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
CVE-2026-36425-main/Drivers/ardrv_7.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
CVE-2026-36425-main/Drivers/ardrv_7.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral29
Sample
CVE-2026-36425-main/Drivers/ardrv_8.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral30
Sample
CVE-2026-36425-main/Drivers/ardrv_8.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral31
Sample
CVE-2026-36425-main/Drivers/ardrv_9.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral32
Sample
CVE-2026-36425-main/Drivers/ardrv_9.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target 34a92442a7082cc5bee6b8826b0f6e12947fd714e2013fbb1c9141bff858e980
- Size 155KB
- Sample260802-enppcacg86
- SHA256 34a92442a7082cc5bee6b8826b0f6e12947fd714e2013fbb1c9141bff858e980
- MD5 64aa43be1491fc04598eff9eaa61d6aa
- SHA1 40f33a1a8a61dee1aa0634805f790488795261f6
- SHA512 7b64b593f67dbb4811d86ada8583da1ab4588e17088f36b95ee6fcc8a1c0979d54250601b7f4410c115534772182e02305707f175fc3e3c89be3b415b8197c62
- SSDEEP 3072:+OO6q2eU2In2sqGZRbjH+BZAG70NYGaoSonEaDPiaEnl19:BmsqGZR3eBPTG9SonEaDkl19
- TLSH T1B4F3127FF4C39AD7D48DE67625B0610B9348FD4032879D68A0056DB1C8CE84D6F29AAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Insecure Codesign Algorithm 16 IoCs
File was codesigned using an insecure algorithm.
resource unpack001/CVE-2026-36425-main/Drivers/ardrv_1.sys unpack001/CVE-2026-36425-main/Drivers/ardrv_10.sys unpack001/CVE-2026-36425-main/Drivers/ardrv_11.sys unpack001/CVE-2026-36425-main/Drivers/ardrv_12.sys unpack001/CVE-2026-36425-main/Drivers/ardrv_13.sys unpack001/CVE-2026-36425-main/Drivers/ardrv_14.sys unpack001/CVE-2026-36425-main/Drivers/ardrv_15.sys unpack001/CVE-2026-36425-main/Drivers/ardrv_16.sys unpack001/CVE-2026-36425-main/Drivers/ardrv_2.sys unpack001/CVE-2026-36425-main/Drivers/ardrv_3.sys unpack001/CVE-2026-36425-main/Drivers/ardrv_4.sys unpack001/CVE-2026-36425-main/Drivers/ardrv_5.sys unpack001/CVE-2026-36425-main/Drivers/ardrv_6.sys unpack001/CVE-2026-36425-main/Drivers/ardrv_7.sys unpack001/CVE-2026-36425-main/Drivers/ardrv_8.sys unpack001/CVE-2026-36425-main/Drivers/ardrv_9.sys
File Explorer
-
34a92442a7082cc5bee6b8826b0f6e12947fd714e2013fbb1c9141bff858e980.zip 155KB
-
CVE-2026-36425-main/Drivers/ardrv_1.sys.sys 17KB
-
CVE-2026-36425-main/Drivers/ardrv_10.sys.sys 17KB
-
CVE-2026-36425-main/Drivers/ardrv_11.sys.sys 17KB
-
CVE-2026-36425-main/Drivers/ardrv_12.sys.sys 17KB
-
CVE-2026-36425-main/Drivers/ardrv_13.sys.sys 17KB
-
CVE-2026-36425-main/Drivers/ardrv_14.sys.sys 17KB
-
CVE-2026-36425-main/Drivers/ardrv_15.sys.sys 16KB
-
CVE-2026-36425-main/Drivers/ardrv_16.sys.sys 16KB
-
CVE-2026-36425-main/Drivers/ardrv_2.sys.sys 17KB
-
CVE-2026-36425-main/Drivers/ardrv_3.sys.sys 16KB
-
CVE-2026-36425-main/Drivers/ardrv_4.sys.sys 16KB
-
CVE-2026-36425-main/Drivers/ardrv_5.sys.sys 17KB
-
CVE-2026-36425-main/Drivers/ardrv_6.sys.sys 17KB
-
CVE-2026-36425-main/Drivers/ardrv_7.sys.sys 16KB
-
CVE-2026-36425-main/Drivers/ardrv_8.sys.sys 17KB
-
CVE-2026-36425-main/Drivers/ardrv_9.sys.sys 17KB
-
CVE-2026-36425-main/README.md4KB
-
CVE-2026-36425-main/ardrvkiller_POC.cpp1KB
CVE-2026-36425-main/Drivers/ardrv_1.sys
- IMPHASH 04becf2aed91570c44993f040922303d
- SHA256 0b4c5a2d24810748de8ce6fb3d6a3e8acd0305272d6425fa054632410d23ec80
- MD5 099b1f700fbe9d6cebe21e6edd24ba80
- SHA1 70b09d5ae1b0e6c5cb2e05e2587f11baba8d2292
- SHA512 17a1a902f1e1998f48c313f6c5b97032df3097342057f8026b3cab9fea2cefaa35cb081ff7ee7775353d9b49b8c798db65ffda3cff5092562339303bd73401ed
- SSDEEP 192:JvuYacCCpQIw9l0HBs0F7QxB8mnYe+PjP4wBjtlAv6YHmoUk0kZ:NuoCCpQIY0HBs0BkznYPL4OUSYGoc0
- TLSH T15D825C8A4769209AFAD7C935D2A1C67BEC70FAD0B75609FF4158C1911D82FE06B3D309
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
cd:45:e0:4e:f4:d0:08:f9:c3:9f:a7:44:04:8b:74:1a:16:aa:9e:74
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
Chains
Nov 21, 2017
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
Serial Number
1c:a9:cc:01:74:7a:11:b1:ea:af:10:3c:8d:9a:9e:6c
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 2, 2015 - Aug 31, 2018
Minor OS version
1
Major OS version
6
Entry point
20580
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
x:\buildagent\work\34766b76f307303b\removal\ardrv\objfre_win7_amd64\amd64\ardrv.pdb
ntoskrnl.exe
IoDeleteSymbolicLink
RtlInitUnicodeString
IoDeleteDevice
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
DbgPrint
ZwAssignProcessToJobObject
PsLookupProcessByProcessId
ProbeForWrite
IoCreateFile
ZwSetValueKey
ZwSetInformationFile
KeDetachProcess
IoFileObjectType
ZwClose
ZwCreateJobObject
ObReferenceObjectByHandle
ZwFlushKey
KeAttachProcess
MmIsAddressValid
ObfDereferenceObject
ZwTerminateProcess
ZwQueryInformationFile
ObOpenObjectByPointer
FsRtlReleaseFile
FsRtlAcquireFileExclusive
ZwTerminateJobObject
ZwOpenKey
KeBugCheckEx
__C_specific_handler
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
548B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=39, id=1, productName=Unmarked objects,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=138, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
CVE-2026-36425-main/Drivers/ardrv_10.sys
- IMPHASH 04becf2aed91570c44993f040922303d
- SHA256 75454a8583ea2a5b6c7711e9bf32c61b8a7e902f5c429fcbe36673ccc076e910
- MD5 e62c7582ecc0f5a9694f02374c0014ed
- SHA1 19a7c0f3bd57e289c3522b0ec94df86dc051145f
- SHA512 27e68c76368a03719bb991da490801b36cc88979167d75ede932c777177eeadf52502fb66bf49fc1403f5fa1d62813d606394ac56d3adea958dc0063e866f369
- SSDEEP 192:JjvuYacCCpQIw9l0HKs0zTQxmnYe+PjP4wBjtlAv6YHmVm1OoG:JDuoCCpQIY0HKs0vkmnYPL4OUSYGVm1k
- TLSH T150826D8B476920AAFAE7C935C2A18677FC30FAD077564AFF4119C1911E81FE05B3D209
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
cf:52:d2:8e:91:9f:50:34:a2:d2:06:49:17:42:ab:21:df:16:e0:d4
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
Chains
Oct 2, 2017
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
Serial Number
1c:a9:cc:01:74:7a:11:b1:ea:af:10:3c:8d:9a:9e:6c
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 2, 2015 - Aug 31, 2018
Minor OS version
1
Major OS version
6
Entry point
20580
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
x:\buildagent\work\34766b76f307303b\removal\ardrv\objfre_win7_amd64\amd64\ardrv.pdb
ntoskrnl.exe
IoDeleteSymbolicLink
RtlInitUnicodeString
IoDeleteDevice
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
DbgPrint
ZwAssignProcessToJobObject
PsLookupProcessByProcessId
ProbeForWrite
IoCreateFile
ZwSetValueKey
ZwSetInformationFile
KeDetachProcess
IoFileObjectType
ZwClose
ZwCreateJobObject
ObReferenceObjectByHandle
ZwFlushKey
KeAttachProcess
MmIsAddressValid
ObfDereferenceObject
ZwTerminateProcess
ZwQueryInformationFile
ObOpenObjectByPointer
FsRtlReleaseFile
FsRtlAcquireFileExclusive
ZwTerminateJobObject
ZwOpenKey
KeBugCheckEx
__C_specific_handler
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
548B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=31, id=1, productName=Unmarked objects,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=138, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
CVE-2026-36425-main/Drivers/ardrv_11.sys
- IMPHASH 04becf2aed91570c44993f040922303d
- SHA256 551254a5e59df92e6049867162633e3e476cdf5999d05c3e23a57c98be03f475
- MD5 e03e68542ce64a1922794f497faeb861
- SHA1 99f6eee59a77b479cc4fb6e9007a1294cab8d9f7
- SHA512 447b68e6437d345ce786756c083f7d1bcf71dc6b8abba2cb7713b6fbe6429e4b04f6fab89d9b18a002ebb08d585df315dff13630712651de16fc2dc514b47fbc
- SSDEEP 384:VuoCCpQIY0HBs0TEnYPL4OUSYG34bZH4I:VbCCpQIYCBsmEhEt24I
- TLSH T1F9825B4A476920AAFAE7C935C2A1827BEC70FAD0B7561AFF4115C1911D82FE05B3D31A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
a2:bb:57:74:27:14:c7:e2:5d:c0:8e:ed:86:b6:67:e7:49:d0:65:1d
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
Chains
Apr 19, 2018
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
Serial Number
1c:a9:cc:01:74:7a:11:b1:ea:af:10:3c:8d:9a:9e:6c
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 2, 2015 - Aug 31, 2018
Minor OS version
1
Major OS version
6
Entry point
20580
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
x:\buildagent\work\34766b76f307303b\removal\ardrv\objfre_win7_amd64\amd64\ardrv.pdb
ntoskrnl.exe
IoDeleteSymbolicLink
RtlInitUnicodeString
IoDeleteDevice
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
DbgPrint
ZwAssignProcessToJobObject
PsLookupProcessByProcessId
ProbeForWrite
IoCreateFile
ZwSetValueKey
ZwSetInformationFile
KeDetachProcess
IoFileObjectType
ZwClose
ZwCreateJobObject
ObReferenceObjectByHandle
ZwFlushKey
KeAttachProcess
MmIsAddressValid
ObfDereferenceObject
ZwTerminateProcess
ZwQueryInformationFile
ObOpenObjectByPointer
FsRtlReleaseFile
FsRtlAcquireFileExclusive
ZwTerminateJobObject
ZwOpenKey
KeBugCheckEx
__C_specific_handler
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
548B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=39, id=1, productName=Unmarked objects,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=138, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
CVE-2026-36425-main/Drivers/ardrv_12.sys
- IMPHASH 04becf2aed91570c44993f040922303d
- SHA256 7504887e1e195ad585cffa5b6a5034161a7cc49f351123d60def79302bdb8326
- MD5 567f0e5ba3865b0c3af7083ca02794d9
- SHA1 4efb248e4330ead57850ed81f249c54af783e88b
- SHA512 cc70f7e6c958fb823a561d57495bb1db123d4a070c6c3509cc274091e402ac1d6b78b4d7c39497acf71435b0e61f7f355d597360893ce95bb9b528b2b05b0791
- SSDEEP 192:JjvuYacCCpQIw9l0HKs0zTQxmnYe+PjP4wBjtlAv6YHmVm1OoG:JDuoCCpQIY0HKs0vkmnYPL4OUSYGVm1k
- TLSH T167826D8B476920AAFAE7C935C2A18677FC30FAD077564AFF4119C1911E81FE05B3D209
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
cf:52:d2:8e:91:9f:50:34:a2:d2:06:49:17:42:ab:21:df:16:e0:d4
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
Chains
Oct 2, 2017
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
Serial Number
1c:a9:cc:01:74:7a:11:b1:ea:af:10:3c:8d:9a:9e:6c
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 2, 2015 - Aug 31, 2018
Minor OS version
1
Major OS version
6
Entry point
20580
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
x:\buildagent\work\34766b76f307303b\removal\ardrv\objfre_win7_amd64\amd64\ardrv.pdb
ntoskrnl.exe
IoDeleteSymbolicLink
RtlInitUnicodeString
IoDeleteDevice
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
DbgPrint
ZwAssignProcessToJobObject
PsLookupProcessByProcessId
ProbeForWrite
IoCreateFile
ZwSetValueKey
ZwSetInformationFile
KeDetachProcess
IoFileObjectType
ZwClose
ZwCreateJobObject
ObReferenceObjectByHandle
ZwFlushKey
KeAttachProcess
MmIsAddressValid
ObfDereferenceObject
ZwTerminateProcess
ZwQueryInformationFile
ObOpenObjectByPointer
FsRtlReleaseFile
FsRtlAcquireFileExclusive
ZwTerminateJobObject
ZwOpenKey
KeBugCheckEx
__C_specific_handler
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
548B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=31, id=1, productName=Unmarked objects,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=138, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
CVE-2026-36425-main/Drivers/ardrv_13.sys
- IMPHASH 04becf2aed91570c44993f040922303d
- SHA256 33233988d8c735fdf1162e043ed1e6fff62e7d6102c5bd300561d71fd32526f3
- MD5 3c06828180ffe41164bf353c97c813bb
- SHA1 b2f72854bbef8ef1b7be7fa9f5a5967a0161d001
- SHA512 e2a5b9453cfa95d525ff36481104f933ce9cae96ad3e6fe343cd557b45a9a15b2033cd237f7010c297bfe94ad18b805c2eb312dba17df61c6706c0804dff0ea9
- SSDEEP 384:HPuoCCpQIY0HEs00TnYPL4OUSYG//Oqb3:vbCCpQIYCEsNThEtpb3
- TLSH T1D0825C4A4769309AFAE3C935C2B5C66BEC70FAD0B7564AFF4215C1A11D81FE05B39309
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
7b:4a:42:0f:d8:d6:90:37:ba:8a:d3:7a:3e:2b:22:08:e7:bd:bf:8c
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
Chains
Nov 15, 2017
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
Serial Number
1c:a9:cc:01:74:7a:11:b1:ea:af:10:3c:8d:9a:9e:6c
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 2, 2015 - Aug 31, 2018
Minor OS version
1
Major OS version
6
Entry point
20580
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
x:\buildagent\work\34766b76f307303b\removal\ardrv\objfre_win7_amd64\amd64\ardrv.pdb
ntoskrnl.exe
IoDeleteSymbolicLink
RtlInitUnicodeString
IoDeleteDevice
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
DbgPrint
ZwAssignProcessToJobObject
PsLookupProcessByProcessId
ProbeForWrite
IoCreateFile
ZwSetValueKey
ZwSetInformationFile
KeDetachProcess
IoFileObjectType
ZwClose
ZwCreateJobObject
ObReferenceObjectByHandle
ZwFlushKey
KeAttachProcess
MmIsAddressValid
ObfDereferenceObject
ZwTerminateProcess
ZwQueryInformationFile
ObOpenObjectByPointer
FsRtlReleaseFile
FsRtlAcquireFileExclusive
ZwTerminateJobObject
ZwOpenKey
KeBugCheckEx
__C_specific_handler
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
548B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=39, id=1, productName=Unmarked objects,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=138, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
CVE-2026-36425-main/Drivers/ardrv_14.sys
- IMPHASH a7bb9c93850e96a3893e41efd0986b3b
- SHA256 59080957de2519f5013be8ccf0b9012dc97ad692e69578cb3f60148c528bdbb1
- MD5 77bdf1dada2014c98e4e50b2765fbd05
- SHA1 11e24f2debc92df1dd0574a7de14ae7903b1ca5f
- SHA512 c99b9c1bf55d71c4fcc19e65c98e60e035f9dedd2f5fc8af592f326e42e9e3f032af23f9dcf0f13676df076ded6dd2ed5f07727d2eabc23bad7bb743d0b68770
- SSDEEP 192:P/l8U56apCCZQyEzw9l0HNX8Lk0fOEExZZnYe+PjP8srcQqwBjtlAhSJ3:3l/5rCCZQ1zY0Huk0oZZnYPL1tqOUhY
- TLSH T110826C9B875E209BFAD3C97592E28777EC30BAE0A75505EF0165C2811E82FF05739318
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
f7:e3:d1:45:f8:2d:06:9d:c3:18:72:3a:18:14:df:bf:52:cf:96:75
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
Chains
Sep 6, 2019
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
Serial Number
59:14:c8:2b:0f:0f:ec:bd:0a:98:cb:20:4b:83:ae:27
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 17, 2018 - Sep 1, 2021
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Feb 22, 2011 - Feb 22, 2021
Minor OS version
1
Major OS version
6
Entry point
24676
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
x:\buildagent\work\e8470f9961ced0e7\removal\ardrv\objfre_win7_amd64\amd64\ardrv.pdb
ntoskrnl.exe
IoDeleteSymbolicLink
RtlInitUnicodeString
IoDeleteDevice
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
DbgPrint
ZwAssignProcessToJobObject
PsLookupProcessByProcessId
ProbeForWrite
IoCreateFile
ZwSetValueKey
ZwSetInformationFile
KeDetachProcess
IoFileObjectType
ZwClose
ZwCreateJobObject
ObReferenceObjectByHandle
ZwFlushKey
KeAttachProcess
MmIsAddressValid
ObfDereferenceObject
ZwTerminateProcess
ZwQueryInformationFile
ObOpenObjectByPointer
FsRtlReleaseFile
FsRtlAcquireFileExclusive
ZwTerminateJobObject
ZwOpenKey
_wcsicmp
MmGetSystemRoutineAddress
RtlGetVersion
CmUnRegisterCallback
KeBugCheckEx
__C_specific_handler
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
612B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
280B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
204B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=43, id=1, productName=Unmarked objects,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=138, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
CVE-2026-36425-main/Drivers/ardrv_15.sys
- IMPHASH 04becf2aed91570c44993f040922303d
- SHA256 d82108e6578f4866d7114d6847282c04f0b146809bc66ded3300fe993b42d20f
- MD5 50390455e92fb62cbe6a89dbb61037c2
- SHA1 b02ad9271e5410dfd7edd03d50469997ea54a8b2
- SHA512 f6dac88336489b81361eae5c47caadfb182c55213af51fc7d9fc6132380be9de8a06b598a1027b7c17952657bc0a334ef68a40284452e127290fd13536f4b31e
- SSDEEP 192:fvuYacCCpQIw9l0Hvs0MI1xaTnYe+PjP8srcQqwBjtlAO5gXUE:3uoCCpQIY0Hvs0MqaTnYPL1tqOUO5gz
- TLSH T14A723B8B471930AAFAD7CA75D2B6867BEC30BAD0A76605FF0165C1910E81FE05B3D319
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
22:80:ab:cb:e9:0c:9a:fd:74:b3:39:3e:48:4f:0a:03:32:41:c0:ea
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
Chains
Aug 28, 2018
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
Serial Number
59:14:c8:2b:0f:0f:ec:bd:0a:98:cb:20:4b:83:ae:27
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 17, 2018 - Sep 1, 2021
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Feb 22, 2011 - Feb 22, 2021
Minor OS version
1
Major OS version
6
Entry point
20580
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
x:\buildagent\work\34766b76f307303b\removal\ardrv\objfre_win7_amd64\amd64\ardrv.pdb
ntoskrnl.exe
IoDeleteSymbolicLink
RtlInitUnicodeString
IoDeleteDevice
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
DbgPrint
ZwAssignProcessToJobObject
PsLookupProcessByProcessId
ProbeForWrite
IoCreateFile
ZwSetValueKey
ZwSetInformationFile
KeDetachProcess
IoFileObjectType
ZwClose
ZwCreateJobObject
ObReferenceObjectByHandle
ZwFlushKey
KeAttachProcess
MmIsAddressValid
ObfDereferenceObject
ZwTerminateProcess
ZwQueryInformationFile
ObOpenObjectByPointer
FsRtlReleaseFile
FsRtlAcquireFileExclusive
ZwTerminateJobObject
ZwOpenKey
KeBugCheckEx
__C_specific_handler
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
548B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=39, id=1, productName=Unmarked objects,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=138, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
CVE-2026-36425-main/Drivers/ardrv_16.sys
- IMPHASH 04becf2aed91570c44993f040922303d
- SHA256 e3cb9f52a4fde53fc886dc35d41bb36e8b993c74826389d22440b92d94480a6d
- MD5 400dadc6b2cedba270fd1e2ff8295813
- SHA1 ff7d6a3f9d7534cf822759950a03da312e5e6536
- SHA512 e235937d76338924513c1dfdb45b2de45580d7a94ba332619c988e6d9f8659028b79720e4c76556b238ee5ba9579e5733e64c9ccd59ba3fe6d57e72d78034531
- SSDEEP 192:VvuYacCCpQIw9l0HWs05n1QxtDnYe+PjP8srcQqwBjtlAsmj58sH:RuoCCpQIY0HWs0bktDnYPL1tqOUksH
- TLSH T1AB723A8B4719306AFAD7C975C2B6867BEC31BAD0A75609FF0165C1910E81FE05B3D219
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
e8:df:9a:bc:59:53:55:f8:07:3c:34:59:c8:fa:14:5b:ca:ee:ac:8a
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
Chains
Aug 16, 2018
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
Serial Number
59:14:c8:2b:0f:0f:ec:bd:0a:98:cb:20:4b:83:ae:27
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 17, 2018 - Sep 1, 2021
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Feb 22, 2011 - Feb 22, 2021
Minor OS version
1
Major OS version
6
Entry point
20580
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
x:\buildagent\work\34766b76f307303b\removal\ardrv\objfre_win7_amd64\amd64\ardrv.pdb
ntoskrnl.exe
IoDeleteSymbolicLink
RtlInitUnicodeString
IoDeleteDevice
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
DbgPrint
ZwAssignProcessToJobObject
PsLookupProcessByProcessId
ProbeForWrite
IoCreateFile
ZwSetValueKey
ZwSetInformationFile
KeDetachProcess
IoFileObjectType
ZwClose
ZwCreateJobObject
ObReferenceObjectByHandle
ZwFlushKey
KeAttachProcess
MmIsAddressValid
ObfDereferenceObject
ZwTerminateProcess
ZwQueryInformationFile
ObOpenObjectByPointer
FsRtlReleaseFile
FsRtlAcquireFileExclusive
ZwTerminateJobObject
ZwOpenKey
KeBugCheckEx
__C_specific_handler
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
548B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=39, id=1, productName=Unmarked objects,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=138, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
CVE-2026-36425-main/Drivers/ardrv_2.sys
- IMPHASH a7bb9c93850e96a3893e41efd0986b3b
- SHA256 1c5129b4d63f2d5252b5b02a0a7d655dac3b6eac23dd4ed92b4dd55f243387ff
- MD5 75f0123d41e16a14f98c47a2d40bce68
- SHA1 de016290d02e6fb438950da38311c0309909e67c
- SHA512 1268b64676ba53b22786c582ac125764b36b63e8e3e42e9750e500ab3fea76b0e881b913755ca8b9dff4a304b7aa556ffc9b28b24a68f4d75411d1ea0db4f10b
- SSDEEP 192:H/l8U56apCCZQyEzw9l0HN38Lk0fILxUmlBnYe+PjP8srcQqwBjtlA0jVo:fl/5rCCZQ1zY0HSk0InlBnYPL1tqOUR
- TLSH T1E8825C8B4759709AFAD7C97592A28677EC30FAF0A75605EF4168C1811E82FF0573E318
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
74:7a:c3:25:a6:9b:19:ff:8e:55:26:57:b5:fb:24:9c:7e:40:d5:41
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
Chains
Oct 22, 2019
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
Serial Number
59:14:c8:2b:0f:0f:ec:bd:0a:98:cb:20:4b:83:ae:27
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 17, 2018 - Sep 1, 2021
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Feb 22, 2011 - Feb 22, 2021
Minor OS version
1
Major OS version
6
Entry point
24676
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
x:\buildagent\work\e8470f9961ced0e7\removal\ardrv\objfre_win7_amd64\amd64\ardrv.pdb
ntoskrnl.exe
IoDeleteSymbolicLink
RtlInitUnicodeString
IoDeleteDevice
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
DbgPrint
ZwAssignProcessToJobObject
PsLookupProcessByProcessId
ProbeForWrite
IoCreateFile
ZwSetValueKey
ZwSetInformationFile
KeDetachProcess
IoFileObjectType
ZwClose
ZwCreateJobObject
ObReferenceObjectByHandle
ZwFlushKey
KeAttachProcess
MmIsAddressValid
ObfDereferenceObject
ZwTerminateProcess
ZwQueryInformationFile
ObOpenObjectByPointer
FsRtlReleaseFile
FsRtlAcquireFileExclusive
ZwTerminateJobObject
ZwOpenKey
_wcsicmp
MmGetSystemRoutineAddress
RtlGetVersion
CmUnRegisterCallback
KeBugCheckEx
__C_specific_handler
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
612B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
280B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
204B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=43, id=1, productName=Unmarked objects,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=138, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
CVE-2026-36425-main/Drivers/ardrv_3.sys
- IMPHASH 04becf2aed91570c44993f040922303d
- SHA256 4d07b6423f4d5d80d2daec8faed7ecc40855339bee95c26289179c1fd083078e
- MD5 a21bc9c04bd840d655bfcd274cc84e40
- SHA1 da57a16315d9e9c7bd426cc69bbb0427874b52d7
- SHA512 8f66e04fe5820551aeb0059d313009a4e479dad9702ab1c658747fbf44a6070848e98a845e74b154fc41b8633e3b3af2b42ba51a16af1d1a696b87908b346091
- SSDEEP 192:wvuYacCCpQIw9l0H7os0GxxuSnYe+PjP8srcQqwBjtlA1U18U:cuoCCpQIY0H7os08uSnYPL1tqOU1UR
- TLSH T111724B8A4729709AFAD7CE75C2B6826BEC31FAD0B75605FF0159C1911D82FE05B3E209
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
fa:e5:3f:e1:12:50:86:94:26:27:50:62:df:a5:9f:e8:91:ed:b7:9c
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
Chains
Nov 14, 2018
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
Serial Number
59:14:c8:2b:0f:0f:ec:bd:0a:98:cb:20:4b:83:ae:27
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 17, 2018 - Sep 1, 2021
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Feb 22, 2011 - Feb 22, 2021
Minor OS version
1
Major OS version
6
Entry point
20580
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
x:\buildagent\work\65a7495ae6b47921\removal\ardrv\objfre_win7_amd64\amd64\ardrv.pdb
ntoskrnl.exe
IoDeleteSymbolicLink
RtlInitUnicodeString
IoDeleteDevice
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
DbgPrint
ZwAssignProcessToJobObject
PsLookupProcessByProcessId
ProbeForWrite
IoCreateFile
ZwSetValueKey
ZwSetInformationFile
KeDetachProcess
IoFileObjectType
ZwClose
ZwCreateJobObject
ObReferenceObjectByHandle
ZwFlushKey
KeAttachProcess
MmIsAddressValid
ObfDereferenceObject
ZwTerminateProcess
ZwQueryInformationFile
ObOpenObjectByPointer
FsRtlReleaseFile
FsRtlAcquireFileExclusive
ZwTerminateJobObject
ZwOpenKey
KeBugCheckEx
__C_specific_handler
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
548B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=39, id=1, productName=Unmarked objects,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=138, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
CVE-2026-36425-main/Drivers/ardrv_4.sys
- IMPHASH 04becf2aed91570c44993f040922303d
- SHA256 6b208ce68ba3f6c788bd89ba677ebf1c2407a55f9f43a42ea7207635634baf66
- MD5 1569d08f94cca34993ae1ccb763de7d0
- SHA1 590df795c95b229360abb5cd1d83c1eaef755e01
- SHA512 ab289c6cf43c36f2f704caf327acb7c7833c50bb8120edca01ba1ee20a9e95eccd385e005146c6c94dfba6f483b470c5183cfff40e1cf2ee7b38d3600f822b36
- SSDEEP 192:cvuYacCCpQIw9l0HaLs0jbxVWnYe+PjP8srcQqwBjtlArMsoX:QuoCCpQIY0HaLs0JVWnYPL1tqOUc
- TLSH T179724A8B471A305AFAD7CA75C2B6866BEC30BAD0B76609FF0169C1911D81FE05B3D309
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
d9:06:dd:f3:fb:ba:a6:6b:a0:4e:17:bd:80:5a:ab:51:02:b9:1a:f4
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
Chains
Apr 23, 2019
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
Serial Number
59:14:c8:2b:0f:0f:ec:bd:0a:98:cb:20:4b:83:ae:27
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 17, 2018 - Sep 1, 2021
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Feb 22, 2011 - Feb 22, 2021
Minor OS version
1
Major OS version
6
Entry point
20580
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
x:\buildagent\work\e8470f9961ced0e7\removal\ardrv\objfre_win7_amd64\amd64\ardrv.pdb
ntoskrnl.exe
IoDeleteSymbolicLink
RtlInitUnicodeString
IoDeleteDevice
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
DbgPrint
ZwAssignProcessToJobObject
PsLookupProcessByProcessId
ProbeForWrite
IoCreateFile
ZwSetValueKey
ZwSetInformationFile
KeDetachProcess
IoFileObjectType
ZwClose
ZwCreateJobObject
ObReferenceObjectByHandle
ZwFlushKey
KeAttachProcess
MmIsAddressValid
ObfDereferenceObject
ZwTerminateProcess
ZwQueryInformationFile
ObOpenObjectByPointer
FsRtlReleaseFile
FsRtlAcquireFileExclusive
ZwTerminateJobObject
ZwOpenKey
KeBugCheckEx
__C_specific_handler
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
548B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=39, id=1, productName=Unmarked objects,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=138, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
CVE-2026-36425-main/Drivers/ardrv_5.sys
- IMPHASH 04becf2aed91570c44993f040922303d
- SHA256 07c5209bf83065fe760f4fee4ed2308b0c523671f68ca73a3854c2c8c28c0541
- MD5 826c6d2e3d80f2d43f7977f998525ad3
- SHA1 7340eae2ccf3d57ac3ae271c9983996d8ae7fde0
- SHA512 162954793c2e734fbbbef058b31d91de4df13c019af7c1f33135f0cd98113d0c88ea423faaabf435fd96b7bb002c51b6b4fc6ac1748eab131badb51866b59767
- SSDEEP 192:JgvuYacCCpQIw9l0HKs0zTQxmnYe+PjP4wBjtlAv6YHmVm1OoG:JsuoCCpQIY0HKs0vkmnYPL4OUSYGVm1k
- TLSH T1BF826D8B476920AAFAE7C935C2A18677FC30FAD077564AFF4119C1911E81FE05B3D209
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
cf:52:d2:8e:91:9f:50:34:a2:d2:06:49:17:42:ab:21:df:16:e0:d4
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
Chains
Oct 2, 2017
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
Serial Number
1c:a9:cc:01:74:7a:11:b1:ea:af:10:3c:8d:9a:9e:6c
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 2, 2015 - Aug 31, 2018
Minor OS version
1
Major OS version
6
Entry point
20580
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
x:\buildagent\work\34766b76f307303b\removal\ardrv\objfre_win7_amd64\amd64\ardrv.pdb
ntoskrnl.exe
IoDeleteSymbolicLink
RtlInitUnicodeString
IoDeleteDevice
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
DbgPrint
ZwAssignProcessToJobObject
PsLookupProcessByProcessId
ProbeForWrite
IoCreateFile
ZwSetValueKey
ZwSetInformationFile
KeDetachProcess
IoFileObjectType
ZwClose
ZwCreateJobObject
ObReferenceObjectByHandle
ZwFlushKey
KeAttachProcess
MmIsAddressValid
ObfDereferenceObject
ZwTerminateProcess
ZwQueryInformationFile
ObOpenObjectByPointer
FsRtlReleaseFile
FsRtlAcquireFileExclusive
ZwTerminateJobObject
ZwOpenKey
KeBugCheckEx
__C_specific_handler
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
548B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=31, id=1, productName=Unmarked objects,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=138, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
CVE-2026-36425-main/Drivers/ardrv_6.sys
- IMPHASH 04becf2aed91570c44993f040922303d
- SHA256 7b3f8fa5844d829142002d47c2df8573c7d67defe4171414c6a015a38afe55f5
- MD5 78518c0636da8f3bf1bbeefbeb2b4920
- SHA1 4e367bb25124c2e45579f267a0fb01bcc3fc3f3b
- SHA512 5b9b62368b9fd0eefefa1826c6cf7ead1bc18703c8ecec0c0268c5384da40747092eab1acd88f6bfb00bbc89fdc38bb2a15a587841418941f120e3b9b8bdc2b0
- SSDEEP 192:kvuYacCCpQIw9l0Hls0lre9xknYe+PjP4wBjtlAv6YHmEsGpywp7BLR:IuoCCpQIY0Hls0EknYPL4OUSYGEseywZ
- TLSH T164827E8A8769209AFAD7C975C2E2C67BEC30FAD0B7560AFF4254C1811D81FE0573E219
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
43:22:a8:18:27:b9:89:43:88:7c:c7:69:6c:d9:a6:49:99:20:92:de
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
Chains
Mar 2, 2018
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
Serial Number
1c:a9:cc:01:74:7a:11:b1:ea:af:10:3c:8d:9a:9e:6c
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 2, 2015 - Aug 31, 2018
Minor OS version
1
Major OS version
6
Entry point
20580
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
x:\buildagent\work\34766b76f307303b\removal\ardrv\objfre_win7_amd64\amd64\ardrv.pdb
ntoskrnl.exe
IoDeleteSymbolicLink
RtlInitUnicodeString
IoDeleteDevice
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
DbgPrint
ZwAssignProcessToJobObject
PsLookupProcessByProcessId
ProbeForWrite
IoCreateFile
ZwSetValueKey
ZwSetInformationFile
KeDetachProcess
IoFileObjectType
ZwClose
ZwCreateJobObject
ObReferenceObjectByHandle
ZwFlushKey
KeAttachProcess
MmIsAddressValid
ObfDereferenceObject
ZwTerminateProcess
ZwQueryInformationFile
ObOpenObjectByPointer
FsRtlReleaseFile
FsRtlAcquireFileExclusive
ZwTerminateJobObject
ZwOpenKey
KeBugCheckEx
__C_specific_handler
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
548B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=39, id=1, productName=Unmarked objects,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=138, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
CVE-2026-36425-main/Drivers/ardrv_7.sys
- IMPHASH 04becf2aed91570c44993f040922303d
- SHA256 9f326ede322930a7d5e149fa8720802b0623c1972dc54e41a2a73608fb6810dd
- MD5 630c1751ae29f3e1a127afcbcfa7c4d7
- SHA1 1583390bdd47357cf81d116d449f882b908348cb
- SHA512 35dddba42e5e10f32ce122021ea92f8df347df6b968cc1d153b77516c83231c5dc7cec6861a94fe06150a310ede8c84d553f6372615a3f2de902fec93727f8ed
- SSDEEP 192:rvuYacCCpQIw9l0Hnos0jWGxIHnYe+PjP8srcQqwBjtlAnfOnJa:7uoCCpQIY0Hnos0bIHnYPL1tqOUnH
- TLSH T185724B8B4719305AFAD7CA75C2B6866BEC31BAD0A7560AFF0155C1911E81FE05B3D309
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
e0:55:50:08:85:c8:78:51:e8:f5:38:10:95:7c:47:f6:8e:ea:36:c9
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
Chains
Oct 10, 2018
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
Serial Number
59:14:c8:2b:0f:0f:ec:bd:0a:98:cb:20:4b:83:ae:27
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 17, 2018 - Sep 1, 2021
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Feb 22, 2011 - Feb 22, 2021
Minor OS version
1
Major OS version
6
Entry point
20580
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
x:\buildagent\work\65a7495ae6b47921\removal\ardrv\objfre_win7_amd64\amd64\ardrv.pdb
ntoskrnl.exe
IoDeleteSymbolicLink
RtlInitUnicodeString
IoDeleteDevice
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
DbgPrint
ZwAssignProcessToJobObject
PsLookupProcessByProcessId
ProbeForWrite
IoCreateFile
ZwSetValueKey
ZwSetInformationFile
KeDetachProcess
IoFileObjectType
ZwClose
ZwCreateJobObject
ObReferenceObjectByHandle
ZwFlushKey
KeAttachProcess
MmIsAddressValid
ObfDereferenceObject
ZwTerminateProcess
ZwQueryInformationFile
ObOpenObjectByPointer
FsRtlReleaseFile
FsRtlAcquireFileExclusive
ZwTerminateJobObject
ZwOpenKey
KeBugCheckEx
__C_specific_handler
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
548B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=39, id=1, productName=Unmarked objects,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=138, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
CVE-2026-36425-main/Drivers/ardrv_8.sys
- IMPHASH 04becf2aed91570c44993f040922303d
- SHA256 34ad901b4fea05da301ebb619fa48cfac058720e41db71b3fca1c47763bae066
- MD5 3226c85fee6897a798a566aeb9d0b2f0
- SHA1 029430fcfc45dc1fda080af6b429e5f48fc8216f
- SHA512 f9e9f81ab583ff66841fae4a358e88ac5d27622a7c96a5f87768f7a5f5b59557045cb7d4ce1f2bbccb20470fd318ca6a6ab6c501fe0dc5c2f8d7183486fc5497
- SSDEEP 192:xjvuYacCCpQIw9l0HTs0FYe9xsnYe+PjP4wBjtlAv6YHme0tIdDR:JuoCCpQIY0HTs0BsnYPL4OUSYGe0tI1
- TLSH T180825C4A47692099FAE3CD35D2A6C267EC30BAE0A7560AFF4159C1910D81FE06B3D309
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
38:e5:91:52:90:2d:88:eb:e9:7c:d6:52:55:e4:23:ac:d1:b9:7d:f9
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
Chains
Mar 22, 2018
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
Serial Number
1c:a9:cc:01:74:7a:11:b1:ea:af:10:3c:8d:9a:9e:6c
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 2, 2015 - Aug 31, 2018
Minor OS version
1
Major OS version
6
Entry point
20580
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
x:\buildagent\work\34766b76f307303b\removal\ardrv\objfre_win7_amd64\amd64\ardrv.pdb
ntoskrnl.exe
IoDeleteSymbolicLink
RtlInitUnicodeString
IoDeleteDevice
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
DbgPrint
ZwAssignProcessToJobObject
PsLookupProcessByProcessId
ProbeForWrite
IoCreateFile
ZwSetValueKey
ZwSetInformationFile
KeDetachProcess
IoFileObjectType
ZwClose
ZwCreateJobObject
ObReferenceObjectByHandle
ZwFlushKey
KeAttachProcess
MmIsAddressValid
ObfDereferenceObject
ZwTerminateProcess
ZwQueryInformationFile
ObOpenObjectByPointer
FsRtlReleaseFile
FsRtlAcquireFileExclusive
ZwTerminateJobObject
ZwOpenKey
KeBugCheckEx
__C_specific_handler
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
548B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=39, id=1, productName=Unmarked objects,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=138, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
CVE-2026-36425-main/Drivers/ardrv_9.sys
- IMPHASH 04becf2aed91570c44993f040922303d
- SHA256 4574cf50dbe2fbce849881e8875297753ce2e240c312e01b3b461d80df063bbe
- MD5 c8078d9e8bc13f562631c2a742b42c39
- SHA1 5971b2b204b2e60dc8c4727833c99decac11a714
- SHA512 b45b8699625bdd4ef0385f9b7988d80a5b7aa1e0aa58a269652f6b21faa73408d4b1c126110d4636082d39fa25271d48a3ccd44cb89b9bc5d8ef8be06b6a9c2c
- SSDEEP 192:DGvuYacCCpQIw9l0HFs06bbxdnYe+PjP4wBjtlAv6YHmYr9IbtvM:DmuoCCpQIY0HFs0SdnYPL4OUSYGYrcE
- TLSH T110825C4B4769209AFAE3C935C2A5C67BEC30BAD0775659FF4119C1911D81FE05B3D309
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
05:f6:ef:fe:0e:27:68:d3:ff:14:71:a5:b0:6e:0c:9d:d4:a0:92:78
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
Chains
Jun 14, 2018
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US
Serial Number
1c:a9:cc:01:74:7a:11:b1:ea:af:10:3c:8d:9a:9e:6c
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 2, 2015 - Aug 31, 2018
Minor OS version
1
Major OS version
6
Entry point
20580
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
x:\buildagent\work\34766b76f307303b\removal\ardrv\objfre_win7_amd64\amd64\ardrv.pdb
ntoskrnl.exe
IoDeleteSymbolicLink
RtlInitUnicodeString
IoDeleteDevice
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
DbgPrint
ZwAssignProcessToJobObject
PsLookupProcessByProcessId
ProbeForWrite
IoCreateFile
ZwSetValueKey
ZwSetInformationFile
KeDetachProcess
IoFileObjectType
ZwClose
ZwCreateJobObject
ObReferenceObjectByHandle
ZwFlushKey
KeAttachProcess
MmIsAddressValid
ObfDereferenceObject
ZwTerminateProcess
ZwQueryInformationFile
ObOpenObjectByPointer
FsRtlReleaseFile
FsRtlAcquireFileExclusive
ZwTerminateJobObject
ZwOpenKey
KeBugCheckEx
__C_specific_handler
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
548B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=39, id=1, productName=Unmarked objects,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=138, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
CVE-2026-36425-main/README.md
- SHA256 45fd3921add6d963a88689b5d1968772642e8a970003a5a396df688af66d77f1
- MD5 01da8ce381e1981b69bb12a2c6c955ba
- SHA1 9981885131e513ec2e28f7e6c79b858556ebf4e8
- SHA512 0c77de2853edfcee72100332e885ea29a07d40170904ae495582bd13f61a05c31d648f0237cb16eed991169bd3f30d131d77c80c3580a0745e9fc54a071a7258
- SSDEEP 96:eK92JrwEr6+hCtPL3K1lYmK6ksL72G5vFUP2IAiLWv:eK92CEfhKL3K1bxFUPOmWv
- TLSH T1AFA10A83E10817500DF686D7364BBAFBBEC71C08A377446814D6C1649361ABA4F3F9A1
- MD5 SHA1 SHA512 SSDEEP TLSH
CVE-2026-36425-main/ardrvkiller_POC.cpp
- SHA256 018a1c6dfd8bc7d24b5d9225ce04e8352ac5a2b06c786c24f0005297905ba857
- MD5 1189d3cb37366028a510a9a129299bb3
- SHA1 39a96e09dfc409013b9c279e6c21fb2ffab44a3f
- SHA512 bd1b0bf30f702c7075377aed43d7aae6a352559939c72cc03640ac0d66a00e5005f22c989a292cd4d8a5b928f3dd56a22c5edf73826608c3a4537c0a5719cac4
- TLSH T1F821F082694C21216F77523D6B02DC07CA2A1503137A7729B89D91C25F34052AEB5FC8
- MD5 SHA1 SHA512 TLSH