winring0x64.sys

WinRing0x64.sys is an open-source kernel driver originally written to give user-mode hardware-monitoring tools direct read/write access to processor MSRs, PCI configuration space, and I/O ports. Because it is freely available and signed, dozens of unrelated third-party utilities embed it: temperature monitors, fan-curve tools, mining utilities, RGB controllers, overclocking helpers, peripheral software. If you have ever installed a small hardware utility on a gaming PC, there is a real chance you have a copy of WinRing0 on disk.

It is on the public LOLDrivers list for that very reason. Its IOCTL interface gives any caller broad hardware access by design; that was the point of the project. In a normal install it is a convenience; in a BYOVD scenario it is a ready-made primitive that does not even require a CVE to be useful.

Its presence on a system almost always means a hardware-monitoring utility you (or a previous install) put there. Identify which utility shipped it, and update or uninstall accordingly.

winring0x64.sys is listed as a known-vulnerable driver on the public LOLDrivers project. 2 distinct binary hashes matching this filename are on record, meaning multiple versions of the file have been observed.