← Back to driver explorer
Driver intelligenceVulnerableVerified
hw.sys
Description not recorded.
Known samples 4
0 recorded TRUE · 4 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
hw.sysSample 1 · HVCI FALSE
- MD5
3247014ba35d406475311a2eab0c4657- SHA1
74e4e3006b644392f5fcea4a9bae1d9d84714b57- SHA256
4880f40f2e557cff38100620b9aa1a3a753cb693af16cd3d95841583edcb57a8- Imphash
67d92a28cd2923a923adf7fd958905d8- Authentihash MD5
6eafc9b68f2047adf6879e955d3b69e8- Authentihash SHA1
8a6d85617bc601b818ddf1b8e8d5db6cf7ae31c1- Authentihash SHA256
615a7c647eba3f2dcea463d5705d5d59ca70b4250f895ad20ce6876076a8fa28- Machine
- I386
- Version
- 4.9.8.0
- Publisher
- Marvin Test Solutions, Inc.
HW.sysSample 2 · HVCI FALSE
- MD5
45c2d133d41d2732f3653ed615a745c8- SHA1
4e56e0b1d12664c05615c69697a2f5c5d893058a- SHA256
6a4875ae86131a594019dec4abd46ac6ba47e57a88287b814d07d929858fe3e5- Imphash
bd093a7d5ba5632ee52f3466a688ee55- Authentihash MD5
22db74f3f2e50ccdeb471c81e3a62532- Authentihash SHA1
6e87cd3b027a07a810164d618e3f2fce61eb6ec4- Authentihash SHA256
734b74798a680d2e534c14a033858c4081c7879af1f48037d9d5483aa27a7e90- Machine
- AMD64
- Version
- 4.8.2.0
- Publisher
- Marvin Test Solutions, Inc.
hw.sysSample 3 · HVCI FALSE
- MD5
3cf7a55ec897cc938aebb8161cb8e74f- SHA1
22fc833e07dd163315095d32ebcd3b3e377c33a4- SHA256
fd388cf1df06d419b14dedbeb24c6f4dff37bea26018775f09d56b3067f0de2c- Imphash
bd093a7d5ba5632ee52f3466a688ee55- Authentihash MD5
22db74f3f2e50ccdeb471c81e3a62532- Authentihash SHA1
6e87cd3b027a07a810164d618e3f2fce61eb6ec4- Authentihash SHA256
734b74798a680d2e534c14a033858c4081c7879af1f48037d9d5483aa27a7e90- Machine
- AMD64
- Version
- 4.8.2.0
- Publisher
- Marvin Test Solutions, Inc.
hw.sysSample 4 · HVCI FALSE
- MD5
376b1e8957227a3639ec1482900d9b97- SHA1
18f34a0005e82a9a1556ba40b997b0eae554d5fd- SHA256
55963284bbd5a3297f39f12f0d8a01ed99fe59d008561e3537bcd4db4b4268fa- Imphash
91ee149529956a79a91eeb8c48f00b3d- Authentihash MD5
0e03e32b8b0f3a1abb52581c1b5698f6- Authentihash SHA1
4614a646d19fb297aa878ba5e70dc9a6a1c5dd8a- Authentihash SHA256
25bc1b72ba6092674ec561d7de8f5e4a7adb23c29fa68de5b29a30a671257dac- Machine
- AMD64
- Version
- 4.9.8.0
- Publisher
- Marvin Test Solutions, Inc.
Recorded command
sc.exe create hw_sys binPath=C:\windows\temp\hw.sys type=kernel && sc.exe start hw.sysElevate privileges · Privileges: kernel · OS: Windows 10
Research & references
- https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules
- https://decoded.avast.io/janvojtesek/the-return-of-candiru-zero-days-in-the-middle-east/
- https://www.virustotal.com/gui/file/6a4875ae86131a594019dec4abd46ac6ba47e57a88287b814d07d929858fe3e5/detection