← Back to driver explorer
Driver intelligenceMaliciousVerified
WinTapix.sys
Wintapix.sys is partially protected by VMProtect, a software protection tool that uses virtualization to protect software applications from reverse engineering and unauthorized usage. It transforms the original executable file into a virtualized code executed in a protected environment, making it difficult to analyze and tamper with.
Known samples 3
3 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
WinTapix.sysSample 1 · HVCI TRUE
- MD5
3dd829fb27353622eff34be1eabb8f18- SHA1
22c9da04847c26188226c3a345e2126ef00aa19e- SHA256
8578bff36e3b02cc71495b647db88c67c3c5ca710b5a2bd539148550595d0330- Imphash
65ccc2c578a984c31880b6c5e65257d3- Authentihash MD5
bb6790230efd9de2ee1a5be037f3c32e- Authentihash SHA1
8d29b561a12cc9e04c93f0915cebc13c400bd749- Authentihash SHA256
d0d8dcc01aba3ac08084ad40df3c64e7dfdd26ad403b08e610b96e2fcaf8a713- Machine
- AMD64
- Version
- 6.3.9600.16384 (winblue_rtm.130821-1623)
- Publisher
- Microsoft Corporation
WinTapix.sysSample 2 · HVCI TRUE
- MD5
a90236e4962620949b720f647a91f101- SHA1
7f7d144cc80129d0db3159ea5d4294c34b79b20a- SHA256
1485c0ed3e875cbdfc6786a5bd26d18ea9d31727deb8df290a1c00c780419a4e- Imphash
65ccc2c578a984c31880b6c5e65257d3- Authentihash MD5
b39131751dda6e639ad70e2480d5fcd9- Authentihash SHA1
cf1390d2e70d6ee560d3030b891d90f5fc897f8f- Authentihash SHA256
6ca42465bf4101ff63117c171cb31204dd29c45ba4ea7c31fd950f17e19b5d03- Machine
- AMD64
- Version
- 6.3.9600.16384 (winblue_rtm.130821-1623)
- Publisher
- Microsoft Corporation
WinTapix.sysSample 3 · HVCI TRUE
- MD5
4dd6250eb2d368f500949952eb013964- SHA1
6802e2d2d4e6ee38aa513dafd6840e864310513b- SHA256
f6c316e2385f2694d47e936b0ac4bc9b55e279d530dd5e805f0d963cb47c3c0d- Imphash
8d070a93a45ed8ba6dba6bfbe0d084e7- Authentihash MD5
5858899869ed5c70f3af5287d4f4299c- Authentihash SHA1
b52e5da0ba19dc71148c4d4499f688ff4d86ed59- Authentihash SHA256
9ac6d632f61d9abe287616ade35f555cd8cf5b91adda382c5ced0cbae468b0e7- Machine
- AMD64
- Version
- 10.0.18362.693 (WinBuild.160101.0800)
- Publisher
- Microsoft Corporation
Recorded command
sc.exe create WinTapix.sys binPath=C:\windows\temp\WinTapix.sys type=kernel && sc.exe start WinTapix.sysElevate privileges · Privileges: kernel · OS: Windows 10