LOLDriversTHE DRIVER THREAT CATALOG
← Back to driver explorer
Driver intelligenceVulnerableVerified

deresute64.sys

Create and start driver

UUID / dbd78de7-f5ab-4fb7-a246-39cbcca4678cADDED / 2026-05-05AUTHOR / Pierre-Henri Pezier

Known samples 8

8 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

andappsvc2_64.sysSample 1 · HVCI TRUE
MD5
b7d34956622d0adc9242fb3f17944043
SHA1
074de2138433c15f50c95dc1fec24d58f56644c2
SHA256
09a5ca7673f3734f8987b2b4d69255ffaa05cd2e77cf2d6f72a2d6a3c91139fb
Imphash
7ff8b7e52d90fc7aaec62298cb528434
Authentihash MD5
4fe744dd84e7e343417adf511f4e5ca0
Authentihash SHA1
0fe1af745d86f9bbe889ee8ac4ef8639e9155afe
Authentihash SHA256
9fee77b87c5726fe35fa349784f1304caa3a0b789a4c75ced2697df2269df19b
Machine
AMD64
Version
1.1.0.0
Publisher
株式会社ＤＮＰハイパーテック
Download vulnerable sampleView on VirusTotal
usrdrv018064.sysSample 2 · HVCI TRUE
MD5
9d9314faa1c0c4962c075c64698a262e
SHA1
a30cd72f9a1528001cda841531b016c752c72ce1
SHA256
1f280d67ff50607e1435b1c10f67c633d681801bcad0d8870128b3698c10634d
Imphash
7ff8b7e52d90fc7aaec62298cb528434
Authentihash MD5
a3b23ebf3308772db4283ebd5102d9ce
Authentihash SHA1
7cdcb102edc0dc4382fda104e5c2df2a67f06620
Authentihash SHA256
5b0fc1bff6d7cb5ddbaafd13a886cebeda5627d12ce498cbb2a76e892cb41c43
Machine
AMD64
Version
1.1.0.0
Publisher
株式会社ＤＮＰハイパーテック
Download vulnerable sampleView on VirusTotal
Umamusume64_2.sysSample 3 · HVCI TRUE
MD5
165900b09295d79bf0b53f3acd2a9aa3
SHA1
3406929eb81855c878261c897f9b452aed3aa3ea
SHA256
079842b1c4fae65b5c6af3e75a7305a263865cd033696a5a2fe7ea707e0c3d71
Imphash
7ff8b7e52d90fc7aaec62298cb528434
Authentihash MD5
16777e3d2942a22ea0e853cead1af8eb
Authentihash SHA1
f4d9ea94b248e4091b8dc712dfa27dcbe0e71acb
Authentihash SHA256
3257940a4fee01241e1475daa884934aaf9ee9d47b9d6e83fc68a36f736c8dd3
Machine
AMD64
Version
1.1.0.0
Publisher
株式会社ＤＮＰハイパーテック
Download vulnerable sampleView on VirusTotal
usrdrv118064.sysSample 4 · HVCI TRUE
MD5
05c0f275cb3270e196d099e13e23612d
SHA1
62d68301154018e04f456a000a24fe9f5048ec52
SHA256
79c2d06072e004639ea3b27c405d5cbb50a0af3531b743521c2b4a42557cc26f
Imphash
7ff8b7e52d90fc7aaec62298cb528434
Authentihash MD5
ed4bcd3278a71332a62268b54bca47bc
Authentihash SHA1
3e07ff7a833ba957822e13a2f25e7e4a0e368025
Authentihash SHA256
0dcdeb561d4cbe26be3a68ca205f6f0dfb0de6df1757c996474bc6dde526dc0c
Machine
AMD64
Version
1.1.0.0
Publisher
株式会社ＤＮＰハイパーテック
Download vulnerable sampleView on VirusTotal
usrdrv017864.sysSample 5 · HVCI TRUE
MD5
5480873d19c83b3cb8d5542f03c4182d
SHA1
cfed486846db08c66afccfcfcba9d458162eed15
SHA256
65b2956b1f1f26136b692d91de8ad98d6590b7f5b94d0acc88bbc61f8228a579
Imphash
7ff8b7e52d90fc7aaec62298cb528434
Authentihash MD5
26d16cf0147cbe1c9e4d3b4863926501
Authentihash SHA1
54f2d2cc9be0bc0dfc46e23ef8742f13a8c90a5c
Authentihash SHA256
e3f30a5653a65584894a1688c0ec9e1f49b184684c53b6082495f2b945f95371
Machine
AMD64
Version
1.1.0.0
Publisher
株式会社ＤＮＰハイパーテック
Download vulnerable sampleView on VirusTotal
deresute64.sysSample 6 · HVCI TRUE
MD5
b78864853fc27438b3df480bf3ceddc7
SHA1
b040522bf83a7aab46b1bab007d8c122cc446967
SHA256
52591fc20b01ab714543e97b4fcbcfad630d50a4725d98da6f11e9bd5b1cf5bb
Imphash
7ff8b7e52d90fc7aaec62298cb528434
Authentihash MD5
67188ad94eba50e19930744bbe56bffe
Authentihash SHA1
298e46103d0d622edca4773d27181056c88f3111
Authentihash SHA256
721ab86e40648e8e23db4b87f0a74de4b422262fba2dbafb533eb6ae2feaf067
Machine
AMD64
Version
1.1.0.0
Publisher
株式会社ＤＮＰハイパーテック
Download vulnerable sampleView on VirusTotal
usrdrv017764.sysSample 7 · HVCI TRUE
MD5
ed96f1a99a3693d40cc302d5ae0840b8
SHA1
0707e4b64fd745d2887c3066fdda1eeda20e434b
SHA256
64035e86735d0c01e0eb0862def6a48f012ec0a8e701874092ee1506ab65d273
Imphash
7ff8b7e52d90fc7aaec62298cb528434
Authentihash MD5
2808446ab3b0b417ba0a451bf23872c2
Authentihash SHA1
dd79bb7dbb7679d3bf886467f90201d520436883
Authentihash SHA256
c31a1e223df7ea4b48df23b4ab92110a5d8732e2383c326dbe521d84dbabf875
Machine
AMD64
Version
1.1.0.0
Publisher
株式会社ＤＮＰハイパーテック
Download vulnerable sampleView on VirusTotal
wfs64.sysSample 8 · HVCI TRUE
MD5
73236c534a805826368406f849ca4e23
SHA1
371b65249aed01a48bdfb266083016a219108b91
SHA256
740025dd6d222bc08b925692a6ef3bd5af86ecd030a8e8cef68b09f5da761fb2
Imphash
7ff8b7e52d90fc7aaec62298cb528434
Authentihash MD5
d3b9c278912b765f93a03e1e5b9a81ce
Authentihash SHA1
329fd5bbc921699d5583da5234f693a4e25fa829
Authentihash SHA256
44d64f2cbbb480f7a989f15ebb33fba6f0fae3b38e0c2c6c585c27f43ab0edc7
Machine
AMD64
Version
1.1.0.0
Publisher
株式会社ＤＮＰハイパーテック
Download vulnerable sampleView on VirusTotal

Recorded command

sc.exe create deresute64.sys binPath=C:\windows\temp\deresute64.sys type=kernel && sc.exe start deresute64.sys

Load a kernel driver · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: Nextron Research @nextronresearch