4137ecf0-05e7-463a-94da-47b7259d4433

81.sys

We were not able to verify the hash of this driver successfully, it has not been confirmed.

Description

81.sys is a vulnerable driver and more information will be added as found.

  • UUID: 4137ecf0-05e7-463a-94da-47b7259d4433
  • Created: 2023-01-09
  • Author: Michael Haag

Block 81.sys across your endpoints

Add this driver to your block policy in minutes with MagicSword, threat-driven application control. Free for up to 100 endpoints.

Start Blocking for Free

Commands

sc.exe create 81.sys binPath=C:\windows\temp\81.sys type=kernel && sc.exe start 81.sys
Use CasePrivilegesOperating System
Elevate privilegeskernelWindows 10

Detections

YARA 🏹

Expand

Exact Match

with header and size limitation

Threat Hunting

without header and size limitation

Renamed

for renamed driver files

Sigma 🛡️

Expand

Names

detects loading using name only

Hashes

detects loading using hashes only

Sysmon 🔎

Expand

Block

on hashes

Alert

on hashes

Resources


  • https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules

    • Known Vulnerable Samples

    PropertyValue
    Filename81.sys
    Creation Timestamp
    MD5
    SHA1
    SHA256
    Authentihash MD5
    Authentihash SHA1faa870b0cb15c9ac2b9bba5d0470bd501ccd4326
    Authentihash SHA256b430d3a0bdb837a5d6625d3b1cef07abd1953f969869ff6cf7ba398ae605431a

    Imports

    Expand

    Imported Functions

    Expand

    Exported Functions

    Expand

    Sections

    Expand

    Signature

    Expand
    PropertyValue
    Filename81.sys
    Creation Timestamp
    MD5
    SHA1
    SHA256
    Authentihash MD5
    Authentihash SHA1aca8e53483b40a06dfdee81bb364b1622f9156fe
    Authentihash SHA256b430d3a0bdb837a5d6625d3b1cef07abd1953f969869ff6cf7ba398ae605431a

    Imports

    Expand

    Imported Functions

    Expand

    Exported Functions

    Expand

    Sections

    Expand

    Signature

    Expand
    PropertyValue
    Filename81.sys
    Creation Timestamp
    MD5
    SHA1
    SHA256
    Authentihash MD5
    Authentihash SHA105ac1c64ca16ab0517fe85d4499d08199e63df26
    Authentihash SHA256b430d3a0bdb837a5d6625d3b1cef07abd1953f969869ff6cf7ba398ae605431a

    Imports

    Expand

    Imported Functions

    Expand

    Exported Functions

    Expand

    Sections

    Expand

    Signature

    Expand

    source

    last_updated: 2026-05-04