LOLDriversTHE DRIVER THREAT CATALOG
← Back to driver explorer
Driver intelligenceVulnerableVerified

zam64.sys

Description not recorded.

UUID / e5f12b82-8d07-474e-9587-8c7b3714d60cADDED / 2023-01-09AUTHOR / Michael Haag, Nasreddine Bencherchali

Known samples 13

11 recorded TRUE · 1 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.

zam64.sysSample 1 · HVCI TRUE
MD5
2a3ce41bb2a7894d939fbd1b20dae5a0
SHA1
cd248648eafca6ef77c1b76237a6482f449f13be
SHA256
2bbc6b9dd5e6d0327250b32305be20c89b19b56d33a096522ee33f22d8c82ff1
Imphash
b35d1d3faa6c97b106b343823d5df867
Authentihash MD5
689e0587c7821c19c711424fa619dbad
Authentihash SHA1
b9b230bb66c82e15f563ac0873a3a1db25995064
Authentihash SHA256
1997b7217dfddd8fbd4924e86b58fe585ef4bd91c3069d3deeb34ea70eb82d60
Machine
AMD64
Version
Not recorded
Publisher
Zemana Ltd.
Download vulnerable sampleView on VirusTotal
zam64.sysSample 2 · HVCI TRUE
MD5
db46c56849bbce9a55a03283efc8c280
SHA1
8f4b79b8026da7f966d38a8ba494c113c5e3894b
SHA256
3c18ae965fba56d09a65770b4d8da54ccd7801f979d3ebd283397bc99646004b
Imphash
7fba20994f76fb31b9f5a2b3f0c00055
Authentihash MD5
a7d940958aa06308dfb68ed67e6ae18c
Authentihash SHA1
ddb4d31681eb2e8e95aa33b78d454b29542d2a98
Authentihash SHA256
ab1290211250af83be645072d346693890f3f29feda5a3a23ea97758247f7ba1
Machine
AMD64
Version
Not recorded
Publisher
Zemana Ltd.
Download vulnerable sampleView on VirusTotal
zamguard64.sysSample 3 · HVCI TRUE
MD5
99c131567c10c25589e741e69a8f8aa3
SHA1
3b8ddf860861cc4040dea2d2d09f80582547d105
SHA256
45f42c5d874369d6be270ea27a5511efcca512aeac7977f83a51b7c4dee6b5ef
Imphash
3edc60bda68569cac7ad7604728ff40d
Authentihash MD5
38757cf8a65976f362f287c3e94f8c1b
Authentihash SHA1
87cdb7698822d92a070b83b732fffa0ea99e34a2
Authentihash SHA256
950b672d3300bcacefe568156fbc8b16fa09da13df2f6ecda31254faaaf041f9
Machine
AMD64
Version
Not recorded
Publisher
Zemana Ltd.
Download vulnerable sampleView on VirusTotal
zam64.sysSample 4 · HVCI TRUE
MD5
e5f8fcdfb52155ed4dffd8a205b3d091
SHA1
90abd7670c84c47e6ffc45c67d676db8c12b1939
SHA256
76614f2e372f33100a8d92bf372cdbc1e183930ca747eed0b0cf2501293b990a
Imphash
c6a0f65ba653ee78255cc9e314abc442
Authentihash MD5
ad2c4382390a8740dcea8b0aef5552c2
Authentihash SHA1
0740faffcb163f4c8cd204c367b9492f2e361207
Authentihash SHA256
b529550e8d2ec6133be50d7139179654301ff84ba09da0cd256c5dec924a185c
Machine
AMD64
Version
Not recorded
Publisher
Zemana Ltd.
Download vulnerable sampleView on VirusTotal
zam64.sysSample 5 · HVCI FALSE
MD5
707ab1170389eba44ffd4cfad01b5969
SHA1
b99a5396094b6b20cea72fbf0c0083030155f74e
SHA256
7cb594af6a3655daebc9fad9c8abf2417b00ba31dcd118707824e5316fc0cc21
Imphash
3edc60bda68569cac7ad7604728ff40d
Authentihash MD5
fb3161dd2e402cfdd3495278974f4181
Authentihash SHA1
9c7deb9def09bca28c37211992c76880f575b9ef
Authentihash SHA256
a59ad5be59f73f2a138c70d8aa634bf5f3364a67e072b64ff2a6d4627514a9ad
Machine
AMD64
Version
3.0.0.000
Publisher
Zemana Ltd.
Download vulnerable sampleView on VirusTotal
zam64.sysSample 6 · HVCI TRUE
MD5
9e0659d443a2b9d1afc75a160f500605
SHA1
09f117d83f2f206ee37f1eb19eea576a0ac9bdcc
SHA256
8fe9828bea83adc8b1429394db7a556a17f79846ad0bfb7f242084a5c96edf2a
Imphash
7fba20994f76fb31b9f5a2b3f0c00055
Authentihash MD5
536527a09edbc7e8c174f7f7423a79a1
Authentihash SHA1
60d4d82640d4550c3e2cfba69f00b5c7472e4926
Authentihash SHA256
dcf9bc1e511993fd8c87b8cab5c23366cc818cccc40617cabc8f242d4a8751d7
Machine
AMD64
Version
Not recorded
Publisher
Zemana Ltd.
Download vulnerable sampleView on VirusTotal
zamguard64.sysSample 7 · HVCI TRUE
MD5
51e7b58f6e9b776568ffbd4dd9972a60
SHA1
2cf75df00c69d907cfe683cb25077015d05be65d
SHA256
9a95a70f68144980f2d684e96c79bdc93ebca1587f46afae6962478631e85d0c
Imphash
0e9dfd08346bbe128159bff440d13389
Authentihash MD5
e03436e22127cd75a132169b627e5a3f
Authentihash SHA1
b8d8e15e952b3fd2a510699d2124253565ecd611
Authentihash SHA256
082adcdc2d246d2291bcf135a7519840a84f27cfa3143d1372a9e2aa5e514dbd
Machine
AMD64
Version
Not recorded
Publisher
Zemana Ltd.
Download vulnerable sampleView on VirusTotal
zamguard32.sysSample 8 · HVCI TRUE
MD5
06897b431c07886454e0681723dd53e6
SHA1
40d29aa7b3fafd27c8b27c7ca7a3089ccb88d69b
SHA256
ab2632a4d93a7f3b7598c06a9fdc773a1b1b69a7dd926bdb7cf578992628e9dd
Imphash
a49a51d7f2ae972483961eb64d17888e
Authentihash MD5
4e0b0bd19c0f3c4a2a75e786474d9d06
Authentihash SHA1
c5388c61135c7fe5617607206d663ac3eaef649c
Authentihash SHA256
de99cea1cb680816afa10d2629a8067af1dc289d2d162a21b9dba71eb0e47745
Machine
I386
Version
Not recorded
Publisher
Zemana Ltd.
Download vulnerable sampleView on VirusTotal
zam64.sysSample 9 · HVCI TRUE
MD5
d4a10447fdaff7a001715191c1f914b6
SHA1
628e63caf72c29042e162f5f7570105d2108e3c2
SHA256
d7e091e0d478c34232e8479b950c5513077b3a69309885cee4c61063e5f74ac0
Imphash
089e8a8f2bb007852c63b64e66430293
Authentihash MD5
8ff959801623fcaf37f6fde89a4aeec1
Authentihash SHA1
b24f8e34221cb7eaa5bed2f177f6701380a0e71f
Authentihash SHA256
1a166e70dcaf3ef12836db1927953ee528e532cdae8165e67d776971e4cbc48c
Machine
AMD64
Version
2.11.1.510
Publisher
Zemana Ltd.
Download vulnerable sampleView on VirusTotal
zam64.sysSample 10 · HVCI TRUE
MD5
75e50ae2e0f783e0caf912f45e15248a
SHA1
a3d612a5ea3439ba72157bd96e390070bdddbbf3
SHA256
de8f8006d8ee429b5f333503defa54b25447f4ed6aeade5e4219e23f3473ef1c
Imphash
5f6fd4ffba177389f414dd1a6ded24b4
Authentihash MD5
cf4707d1cc2b1d1344058ac750e4e61e
Authentihash SHA1
3bd3de766013c31d87545bd7affd8e52c4e24f72
Authentihash SHA256
e5316670c0bddc0519ef96b2db89285a8620a260429a97f9d2cf5b58b0287d91
Machine
AMD64
Version
Not recorded
Publisher
Zemana Ltd.
Download vulnerable sampleView on VirusTotal
zam64.sysSample 11 · HVCI TRUE
MD5
5054083cf29649a76c94658ba7ff5bce
SHA1
dd4cd182192b43d4105786ba87f55a036ec45ef2
SHA256
e428ddf9afc9b2d11e2271f0a67a2d6638b860c2c12d4b8cc63d33f3349ee93f
Imphash
519cf5394541bf5e2869edeec81521e1
Authentihash MD5
8d4a371e8da97e8dfd254e7b860bf147
Authentihash SHA1
d2a888f664ffa91e876dbd797ca1fc95c511c5bc
Authentihash SHA256
27f5c5eb9a5fc9e02d3ac3cd83fc26b07f3d0143b03db69d6dcf7554d0c50fb6
Machine
AMD64
Version
Not recorded
Publisher
Zemana Ltd.
Download vulnerable sampleView on VirusTotal
zam64.sysSample 12 · HVCI TRUE
MD5
21e13f2cb269defeae5e1d09887d47bb
SHA1
16d7ecf09fc98798a6170e4cef2745e0bee3f5c7
SHA256
543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91
Imphash
3edc60bda68569cac7ad7604728ff40d
Authentihash MD5
3f2771b22553380efcee72a27dc4d96c
Authentihash SHA1
0d15b7de0f1129b540f48d7a3cba2c6bf5d44112
Authentihash SHA256
ceb1bf90d8652dac481fba362e5c3a6548a116897e729733f2be27f4edc5fc1f
Machine
AMD64
Version
Not recorded
Publisher
Zemana Ltd.
Download vulnerable sampleView on VirusTotal
tProtect.dllSample 13 · HVCI unknown
MD5
a87587ee2f2281297f24bbd96902faa5
SHA1
63399ac91e92f0c92ffaeac43616e1b7c77a9791
SHA256
078e7fb479ad6f0734682d41a17d41518de35bf4f6c5c212643b7d37e641041e
Imphash
3edc60bda68569cac7ad7604728ff40d
Authentihash MD5
096b2f20901609e482340d5f8cbc79ac
Authentihash SHA1
1c6501199c9d759970a11cc41b9077a946c3c276
Authentihash SHA256
196c803aa8217eb8d2783ad9750cd27bbe540a449480c842cc128cc7a5a64f04
Machine
AMD64
Version
Not recorded
Publisher
Zmana Ltd.
Download vulnerable sampleView on VirusTotal

Recorded command

sc.exe create zam64.sys binPath=C:\windows\temp\zam64.sys type=kernel && sc.exe start zam64.sys

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references