← Back to driver explorer
Driver intelligenceVulnerableVerified
DcProtect.sys
bundled with chinese application "DrvCeo" is a set of rootkits. The malicious functionality. prevents registry value writing where the registry key or value includes "dcprotect" or "drvceo". Prevents file deletion if pathname contains "driverdownload", "program files\sysceo", "program files (x86)\sysceo"
Known samples 8
8 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
DcProtect.sysSample 1 · HVCI TRUE
- MD5
563b33cfc3c815feff659caaa94edc33- SHA1
da689e8e0e3fc4c7114b44d185eef4c768e15946- SHA256
b2247e68386c1bdfd48687105c3728ebbad672daffa91b57845b4e49693ffd71- Imphash
e800cd3299d4cda0d9e02255acc3b7dd- Authentihash MD5
6eb18a9f44c6022e259088a2106f048c- Authentihash SHA1
ea9a484278d7a80a46edcd096447bbea0c892f64- Authentihash SHA256
1ff54579dc4b76e814495d8e1d452a6f868adf06c2de0afdc5c3878b380d0a17- Machine
- AMD64
- Version
- 1.2.0.0
- Publisher
- Windows (R) Win 7 DDK provider
DcProtect.sysSample 2 · HVCI TRUE
- MD5
53f103e490bc11624ef6a51a6d3bdc05- SHA1
5499f1bca93a3613428e8c18ac93a93b9a7249fb- SHA256
3af9c376d43321e813057ecd0403e71cafc3302139e2409ab41e254386c33ecb- Imphash
2ece23bdef16ee294bd905c7ba1be589- Authentihash MD5
bc49e6eba2c3a95f1fe0d1c5c4f2fb70- Authentihash SHA1
fc759e3940f05c22d3919c20d08c44d4fd806b99- Authentihash SHA256
fcffb9cecbcefc399a2a08d99fcc2b797911afa26f3d69a28a139311cb61c39a- Machine
- I386
- Version
- 1.2.0.0
- Publisher
- Windows (R) Win 7 DDK provider
DcProtect.sysSample 3 · HVCI TRUE
- MD5
d90cdd8f2826e5ea3faf8e258f20dc40- SHA1
a71c17bfeefd76a9f89e74a52a2b6fdd3efbabe2- SHA256
9dee9c925f7ea84f56d4a2ad4cf9a88c4dac27380887bf9ac73e7c8108066504- Imphash
e800cd3299d4cda0d9e02255acc3b7dd- Authentihash MD5
96cd68100963cf38f3090777a3dfc543- Authentihash SHA1
87c65b5bc7991c7161e41dcd609ab3cacf1c5753- Authentihash SHA256
3f085bc766d865fa012163ed7c044af25285525b1276b6cef2085efab78e9b66- Machine
- AMD64
- Version
- 1.2.0.0
- Publisher
- Windows (R) Win 7 DDK provider
DcProtect.sysSample 4 · HVCI TRUE
- MD5
c28b4a60ebd4b8c12861829cc13aa6ff- SHA1
ba5b4eaa7cab012b71a8a973899eeee47a12becc- SHA256
ff55c1f308a5694eb66a3e9ba326266c826c5341c44958831a7a59a23ed5ecc8- Imphash
2ece23bdef16ee294bd905c7ba1be589- Authentihash MD5
9674f398b8e67adf4d10637287d56acb- Authentihash SHA1
c7cf5617544aea0c8df8adb71cdc1951b88cb381- Authentihash SHA256
68fcb5cf6723dd195cf6d929cf9c6aaaca649f6956eb3bd63c2c1a8391c0b21f- Machine
- I386
- Version
- 1.2.0.0
- Publisher
- Windows (R) Win 7 DDK provider
DcProtect.sysSample 5 · HVCI TRUE
- MD5
c52dce2bee8ec88748411e470ff531f6- SHA1
47830d6d3ee2d2a643abf46a72738d77f14114bc- SHA256
f8d45fa03f56e2ea14920b902856666b8d44f1f1b16644baf8c1ae9a61851fb6- Imphash
e800cd3299d4cda0d9e02255acc3b7dd- Authentihash MD5
d23bcd43e1a50a59ecdbf9069b37207a- Authentihash SHA1
79e6df018bd867ebefb8400297f57f5d1586d10a- Authentihash SHA256
1b14ff6a1054fa4bae158111fbcaf35baeedaa9b664c8fb7241db98f7e1c6c20- Machine
- AMD64
- Version
- 1.2.0.0
- Publisher
- Windows (R) Win 7 DDK provider
DcProtect.sysSample 6 · HVCI TRUE
- MD5
3e9ee8418f22a8ae0e2bf6ff293988fa- SHA1
f8e88630dae53e0b54edefdefa36d96c3dcbd776- SHA256
c35cab244bd88bf0b1e7fc89c587d82763f66cf1108084713f867f72cc6f3633- Imphash
2ece23bdef16ee294bd905c7ba1be589- Authentihash MD5
ac737185ad0ab4144de464bc0c1aa6a6- Authentihash SHA1
8d81b766e0a9e03109ccf5414649d95c0b0c7466- Authentihash SHA256
bf1264cf5b9ca687a447a5021394db27eecf31f009185deb634b32f7ed49f620- Machine
- I386
- Version
- 1.2.0.0
- Publisher
- Windows (R) Win 7 DDK provider
DcProtect.sysSample 7 · HVCI TRUE
- MD5
2ab9f5a66d75adb01171bb04ab4380f2- SHA1
1479717fab67d98bbc3665f6b12adddfca74e0ef- SHA256
1698ba7eeee6ff9272cc25b242af89190ff23fd9530f21aa8f0f3792412594f3- Imphash
e800cd3299d4cda0d9e02255acc3b7dd- Authentihash MD5
039cffceb3ae187e569f5d727270298d- Authentihash SHA1
a8b62bfd32512bd382fa1e236dbbe01a5be4cbeb- Authentihash SHA256
9923b3d6e508aa2086c66b36038b37206b0f8d26beaf87022290a2b574c2e047- Machine
- AMD64
- Version
- 1.2.0.0
- Publisher
- Windows (R) Win 7 DDK provider
DcProtect.sysSample 8 · HVCI TRUE
- MD5
2c957aa79231fad8e221e035db6d0d81- SHA1
6de3d5c2e33d91eef975a30bc07b0e53a68e77b8- SHA256
55b5bcbf8fb4e1ce99d201d3903d785888c928aa26e947ce2cdb99eefd0dae03- Imphash
2ece23bdef16ee294bd905c7ba1be589- Authentihash MD5
007b4e42848dd962ea718006bab02c73- Authentihash SHA1
b19d88aecf348d25a9dbe3d884a4069e5f79c49a- Authentihash SHA256
52b1c4667ef36a02a0e6d7f147b8d4bc0e30645e6c88bd2984e53abc693bc18e- Machine
- I386
- Version
- 1.2.0.0
- Publisher
- Windows (R) Win 7 DDK provider
Recorded command
sc.exe create DcProtect.sys binPath=C:\windows\temp\DcProtect.sys type=kernel && sc.exe start DcProtect.sysElevate privileges · Privileges: kernel · OS: Windows 10