← Back to driver explorer
Driver intelligenceVulnerableVerified
ADRMDRVSYS.sys
ADLINK Resource Manager exposes physical-memory mapping through IOCTL 0x2234D4, allowing low-privilege callers to read kernel memory. The interface has also been weaponized by Blackout Reloaded to terminate protected antimalware processes through a driver path that reaches ZwTerminateProcess.
Known samples 6
0 recorded TRUE · 2 recorded FALSE · 4 unknown for loading despite HVCI. Results apply to individual samples.
ADRMDRVSYS.sysSample 1 · HVCI unknown
- MD5
4f4b41628f7685fec956017686c9ed35- SHA1
a76cf0a0f292bbf61538b9743e80aee1878c06a6- SHA256
edac730a75ed453bdcdfb7ca1dd19cf1e269e9ca59295efb15ca0071c96ed2f5- Imphash
eef1bff6680f68ccc7bfea46aaab8210- Authentihash MD5
8b1e382ad1de95ed27bddc8fbc4c5f6c- Authentihash SHA1
afa28da8f99ba78d43070a7b9e4291c1fbcc5d6d- Authentihash SHA256
b18d0039333d3bd44f8be9bf9b2fa1c7b3ce61a2de45a212b4fd5c5438888271- Machine
- AMD64
- Version
- 1.12.802.2022
- Publisher
- ADLINK Technology, Inc.
ADRMDRVSYS.sysSample 2 · HVCI unknown
- MD5
ca6367efbebda8123aa7bdaa8f38dff7- SHA1
8c922bc8e5070d76098db446f6ebdcbc7c861ce7- SHA256
9822ecd5b19022c6db17a0c2bf4a26c00216b456a834371e11ba20323efa7262- Imphash
eef1bff6680f68ccc7bfea46aaab8210- Authentihash MD5
37d6279b25aca8b3826f2eadba4c0819- Authentihash SHA1
1ab607364cd4a20b425dda1fd814434854cad0d2- Authentihash SHA256
cf547c9bfe616df155cda71c45b7cd89a2256174eea70f673ee6b9e529d8b72a- Machine
- AMD64
- Version
- 1.12.802.2022
- Publisher
- ADLINK Technology, Inc.
ADRMDRVSYS.sysSample 3 · HVCI unknown
- MD5
ceb08040c76342faa29d85c275349302- SHA1
3d99a08dfb08f1bd6c30ea393881c1d883842927- SHA256
806b9f9967e26bee69843f71a7b76305386ceb231fd57549eabeb6b1652ee07e- Imphash
eef1bff6680f68ccc7bfea46aaab8210- Authentihash MD5
43814bde1e7dbf0c899325135eb303cd- Authentihash SHA1
edd52d80b5e6ff4af724ac19872405521400bc3b- Authentihash SHA256
94f49026cb6445f9f20347b464d3d089d1ec3b4f44f7920ae809930a5fd17742- Machine
- AMD64
- Version
- 1.12.802.2022
- Publisher
- ADLINK Technology, Inc.
ADRMDRVSYS.sysSample 4 · HVCI unknown
- MD5
eceb8140cc29d5348bcff3bb78f8d1d4- SHA1
8bbe29e97cfe32a9da9d532ed8506e646e3f7321- SHA256
fa59c670b2282d870dd4c9920e56419ddfd8f5ab15b24e1b8708aa841439cc91- Imphash
eef1bff6680f68ccc7bfea46aaab8210- Authentihash MD5
9e328b923d86adec6ac0e8ad1db2dfcc- Authentihash SHA1
69a73fac571f7406db8a36f43fa522f720c7f562- Authentihash SHA256
0e1b9e8c711b06b5590ebf5f2499337041b0cc885961f18a77317e97e0690538- Machine
- AMD64
- Version
- 1.12.802.2022
- Publisher
- ADLINK Technology, Inc.
ADRMDRVSYS.sysSample 5 · HVCI FALSE
- MD5
b7b961e5052519435626a417cf612b97- SHA1
8e879a968846f811ed8d99acee414ffa66d0589f- SHA256
a1f79a2e1441970bb3e7c838f8c14a8f3d39a46b0ff9648614e922ac475c743d- Imphash
eef1bff6680f68ccc7bfea46aaab8210- Authentihash MD5
dddde12c1e852679d330a053cadd56d6- Authentihash SHA1
284c263763d9bfe78d7d6aaf3543a925325469fe- Authentihash SHA256
3df5f17da8758288b633611afc1c0b6d42c1e56aed5539cfa313986f70ce90e7- Machine
- AMD64
- Version
- 1.12.802.2022
- Publisher
- ADLINK Technology, Inc.
ADRMDRVSYS.sysSample 6 · HVCI FALSE
- MD5
12e1825a3d65c0ba409dac61ac84469d- SHA1
843ada80361bd77645af60286405600a86f0eb1f- SHA256
57afe716c49b1a141351b4c24f70d71a688c5ac6d95da8fff348d7f184851a4d- Imphash
eef1bff6680f68ccc7bfea46aaab8210- Authentihash MD5
3d0249048295586658c451c30559685e- Authentihash SHA1
ef3adfe2d9aa035237182678aecc7216075e4ecb- Authentihash SHA256
2eaff8c35176b3725624d475df80c5b2bcc60be35aa6634ec3530af852396795- Machine
- AMD64
- Version
- 1.12.802.2022
- Publisher
- ADLINK Technology, Inc.
Recorded command
sc.exe create ADRMDRVSYS binPath=C:\windows\temp\ADRMDRVSYS.sys type=kernel && sc.exe start ADRMDRVSYSElevate privileges · Privileges: kernel · OS: Windows 10
Research & references
Acknowledgement: Northwave Cyber Security, fluffycats31 @fluffycats31