← Back to driver explorer
Driver intelligenceVulnerableVerified
XLHA.sys
XLHA.sys is a kernel driver from LG Electronics Inc. that exposes physical memory read/write via MmMapIoSpace and MSR read. Two other LG LHA.sys variants are already tracked in LOLDrivers. The driver is available in the KeServiceDescriptorTable/vulnerable-drivers repository.
Known samples 1
0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
XLHA.sysSample 1 · HVCI FALSE
- MD5
ec7f14be325648533fc04aff9da8635f- SHA1
086e5aab557be8fc970cb11b17d948f8a11978d8- SHA256
11c9cbc39b6e028f2e8f9e7f83b47ae83ca73961ecfebb2f7213f9478f5446d5- Imphash
1dd3b83f2b007f862a1d8de4a1d3303f- Authentihash MD5
2d9afb49cfc1bad59a7f65cfdea6cf9c- Authentihash SHA1
6826c2bcdcfe39f096bd70b52ebe4c24c2a8e208- Authentihash SHA256
c0166630f8a9453c118c650f9bdaaa1bb6014b4a3d759d90b8268268797133a0- Machine
- AMD64
- Version
- 6.1.7600.16385 built by: WinDDK
- Publisher
- LG Electronics Inc.
Recorded command
sc.exe create XLHA binPath=C:\windows\temp\XLHA.sys type=kernel && sc.exe start XLHAElevate privileges · Privileges: kernel · OS: Windows 10
Research & references
Acknowledgement: @rainbowdynamix, @DbgPrint