← Back to driver explorer
Driver intelligenceMaliciousVerified

RzDev_00X10.sys

Nextron Systems identifies this exact sample as a kernel communication and memory-access component with a covert user-to-kernel channel and privileged memory read/write. Static analysis confirms MDL-backed kernel mappings and a transfer path that probes a caller buffer and maps supplied virtual ranges in page-sized chunks. The obfuscated transfer callback was not fully resolved; the covert channel and privileged memory read/write semantics are source-reported, not independently demonstrated. The observed RzDev_00X10.sys filename does not establish vendor ownership.

UUID / adf27819-c7a0-4476-8632-5ca759202542ADDED / 2026-09-08AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.

RzDev_00X10.sysSample 1 · HVCI unknown
MD5
e96522a7b9b55917a01f953018116d18
SHA1
22921d8c47579b8bd0a513e6e052e4a5cf50068a
SHA256
80f97dabef128a391e3ad10e4521dd0a28adc01a97e1cef980f535ac23bd0847
Imphash
663aaaf0575ac1d44d8fc39b03d2c62d
Authentihash MD5
230ac8e5ae21258d4af9007027ffe99e
Authentihash SHA1
bd8609c22fd2f655e7831cc7eb1bce1e44f66896
Authentihash SHA256
afba0119386ba096b576328f20a8a6e5539c018057c5ac4c0376f03f0b1f6c90
Machine
AMD64
Version
Not recorded
Publisher
Not recorded

Research & references

Acknowledgement: Nextron Systems Research @nextronresearch