← Back to driver explorer
Driver intelligenceVulnerableVerified
shimano32.sys
HyperTech DNP CrackProof DRM kernel drivers (32-bit and 64-bit variants) from Shimano E-TUBE Project. Expose EPROCESS manipulation IOCTLs (0xAA013880, 0xAA013884, 0xAA013888) similar to capcom.sys exploitation technique. Device accessible at \\.\Htsysm4EFB. Zero detections (0/72 and 0/73) on VirusTotal. Signed by Microsoft WHCP via HyperTech DNP CrackProof (Japanese DRM vendor).
Known samples 2
0 recorded TRUE · 0 recorded FALSE · 2 unknown for loading despite HVCI. Results apply to individual samples.
shimano32.sysSample 1 · HVCI unknown
- MD5
6a4cced9a784369f50e618d85a16d234- SHA1
ae47836896e8e996d3dd6f860c63b95d011ee741- SHA256
e8b1a0ddc7a4404eb3c46217e07b5ed91723f44464a6ef589634aeb4fb8f5666- Imphash
df3935786e2f33563e5ace152d5d7517- Authentihash MD5
edadfe645e5fb9d921f81aa383b6fcac- Authentihash SHA1
632b17a46a046ee021b0d4e77c50c1cc0601865d- Authentihash SHA256
41011afde89ff9727fbd0380ec2d5cc733e1e0289d1f45d5bd45b7b1aa963aea- Machine
- I386
- Version
- Not recorded
- Publisher
- Microsoft Windows Hardware Compatibility Publisher
shimano64.sysSample 2 · HVCI unknown
- MD5
c047c92696e5cef5485a22df97e6646e- SHA1
37de60ae6adc042b596a90446ce12d53030c5db2- SHA256
e3a1f0d967335c8a080a5b1e7e3a06a61f6cea39739cda3ebab11d2908713d80- Imphash
df43355c636583e56e92142dcc69cc58- Authentihash MD5
08bbf3b41df7fb7629edf67fb9206e0c- Authentihash SHA1
06a02e1ec8d9fd2f25770706f0034e7d70d8290b- Authentihash SHA256
bf8734d83d2b8bc9798ba931794504af791e9a0d913266fa39d41b574ce53d88- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Microsoft Windows Hardware Compatibility Publisher
Recorded command
sc.exe create shimano binPath=C:\windows\temp\shimano64.sys type=kernel && sc.exe start shimanoElevate privileges · Privileges: kernel · OS: Windows 10
Research & references
Acknowledgement: Wack0 @Wack0