Driver intelligenceVulnerableVerified

ksapi.sys

Driver can be used to load unsigned drivers

UUID / fb36ebc6-fdc5-42eb-929b-a07e00c5b9dbADDED / 2025-09-18AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.

1cd219f58b249a2e4f86553bdd649c73785093e22c87170798dae90f193240afSample 1 · HVCI unknown

MD5: a7681a49d1ac6efb31409f17a7011a8b
SHA1: 5eea8ae51f488912f795b1408459657861faaf31
SHA256: 1cd219f58b249a2e4f86553bdd649c73785093e22c87170798dae90f193240af
Imphash: 6b84b4c98d44b362d90f36c816b7f49b
Authentihash MD5: 7074548d0506f5cd162319eec75c3742
Authentihash SHA1: 2d25dd401738e8b3867b608f20448c97ae7d61ae
Authentihash SHA256: 31ce60480166e9ebef758b66f770f3fea86dd429da27fc5eed755c3d8c4e20fa
Machine: AMD64
Version: 2017,12,06,131
Publisher: Kingsoft Corporation

sc.exe create ksapi.sys binPath=C:\windows\temp\ksapi.sys type=kernel && sc.exe start ksapi.sys

Elevate privileges · Privileges: kernel · OS: Windows 10