Driver intelligenceVulnerableVerified

ksapi.sys

Driver can be used to load unsigned drivers

UUID / 7f80bb6e-bbf6-46dd-b77d-ecef24f1c2cdADDED / 2025-09-18AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.

26ed45461e62d733f33671bfd0724399d866ee7606f3f112c90896ce8355392eSample 1 · HVCI unknown

MD5: 6d5fbbb446b119cb151c97b8e16be822
SHA1: 38ce6a9e00b059c1710b728af9454a3e9f45e579
SHA256: 26ed45461e62d733f33671bfd0724399d866ee7606f3f112c90896ce8355392e
Imphash: 6b84b4c98d44b362d90f36c816b7f49b
Authentihash MD5: 03ff5165bc71e59c3001152f36628e99
Authentihash SHA1: 21f62d2144377d024519b7ea663f692d639fd941
Authentihash SHA256: b57caf226aaf1ee53a3e98e2f2ed40837bfa7a889b2914796f03ead147f219a6
Machine: AMD64
Version: 2017,12,06,132
Publisher: Kingsoft Corporation

sc.exe create ksapi.sys binPath=C:\windows\temp\ksapi.sys type=kernel && sc.exe start ksapi.sys

Elevate privileges · Privileges: kernel · OS: Windows 10