← Back to driver explorer
Driver intelligenceVulnerableVerified
KObjExp.sys
KObjExp.sys is Pavel Yosifovich's Kernel Object Explorer driver and is listed as a KDU-compatible provider. The staged samples include the KDU provider hash and a separate JobExplorer build of the same driver family.
Known samples 2
0 recorded TRUE · 0 recorded FALSE · 2 unknown for loading despite HVCI. Results apply to individual samples.
KObjExp.sysSample 1 · HVCI unknown
- MD5
5f0b029db26afd7852e077ad02c4a031- SHA1
3303ba52a334da58a4992c4f9fba7272e294b7af- SHA256
88a9b030ab81082629253c581fe0670019c766f32acfc78a6cdc1080ad272fe4- Imphash
4cc26fea341ef2b6f349339056a5dfb9- Authentihash MD5
d8ff02afd7dc24a864b4286b238786ef- Authentihash SHA1
43239d3355ced44fb56c4127bf96ef2ed1be2780- Authentihash SHA256
c667c465ff3aa9d54a580ea19d01de869d0577fd589514f4c3deb844cbf9f89a- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
KObjExp.sysSample 2 · HVCI unknown
- MD5
af27a89e19e96a2a83a9908f75a12221- SHA1
4844bff55efaa94a0d50b02e3444bb5a272bf1cb- SHA256
d93d045bb73620055ad4158dbc2e1d3d4c7bfcefbbc90fdc6dfa3663c6cbdac1- Imphash
56077d4efbf498f901e7098df0cdcf53- Authentihash MD5
57db230b3c627a84e0bb386821d77cb7- Authentihash SHA1
89f5ce7b232f7fe5b4dcf698adc0620994abdfb1- Authentihash SHA256
d313c49a56fbc0fc09e20af7b6e1dc82e4bcd0e2b8be42e6c6997dcc12f8268f- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create KObjExp binPath=C:\windows\temp\KObjExp.sys type=kernel && sc.exe start KObjExpAccess kernel object and kernel-memory primitives through KDU/Explorer driver builds. · Privileges: kernel · OS: Windows 10, Windows 11
Research & references
Acknowledgement: KDU Project / SharpKernel / zodiacon @hfiref0x / @hsheric0210 / @zodiacon