← Back to driver explorer
Driver intelligenceVulnerableVerified
rwdrv.sys
This utility access almost all the computer hardware, including PCI (PCI Express), PCI Index/Data, Memory, Memory Index/Data, I/O Space, I/O Index/Data, Super I/O, Clock Generator, DIMM SPD, SMBus Device, CPU MSR Registers, ATA/ATAPI Identify Data, Disk Read Write, ACPI Tables Dump (include AML decode), Embedded Controller, USB Information, SMBIOS Structures, PCI Option ROMs, MP Configuration Table, E820, EDID and Remote Access. And also a Command Window is provided to access hardware manually.
Known samples 4
0 recorded TRUE · 4 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
rwdrv.sysSample 1 · HVCI FALSE
- MD5
257483d5d8b268d0d679956c7acdf02d- SHA1
fbf8b0613a2f7039aeb9fa09bd3b40c8ff49ded2- SHA256
ea0b9eecf4ad5ec8c14aec13de7d661e7615018b1a3c65464bf5eca9bbf6ded3- Imphash
176d8e75a27a45e2c6f5d4cceca4d869- Authentihash MD5
3cd1454d2308cee5c59b45d5f952e70b- Authentihash SHA1
2c3b01ff8ce024f70f9daad31ea6c78de54f239b- Authentihash SHA256
acb65f96f1d5c986b52d980a1c5ea009292ff472087fdd8a98a485404948f585- Machine
- I386
- Version
- 1.00.00.0000 built by: WinDDK
- Publisher
- RW-Everything
rwdrv.sysSample 2 · HVCI FALSE
- MD5
f7a09ac4a91a6390f8d00bf09f53ae37- SHA1
8031ecbff95f299b53113ccd105582defad38d7b- SHA256
d15a0bc7a39bbeff10019496c1ed217b7c1b26da37b2bdd46820b35161ddb3c4- Imphash
955e7b12a8fa06444c68e54026c45de1- Authentihash MD5
9c15e4f6f0e218cbaae27bf6952f6303- Authentihash SHA1
e15698840eaa0d72abce8207b4e57966e8c064b2- Authentihash SHA256
b1d0fdfddddfe520afc18b79b18b5eef730f7586639bd05857a41c0d09a9b9e6- Machine
- AMD64
- Version
- 1.00.00.0000 built by: WinDDK
- Publisher
- RW-Everything
rwdrv.sysSample 3 · HVCI FALSE
- MD5
1276f735d22cf04676a719edc6b0df18- SHA1
108575d8f0b98fed29514a54052f7bf5a8cb3ff0- SHA256
83fbf5d46cff38dd1c0f83686708b3bd6a3a73fddd7a2da2b5a3acccd1d9359c- Imphash
955e7b12a8fa06444c68e54026c45de1- Authentihash MD5
26e06bbacf3f202b0295342c22e71124- Authentihash SHA1
53aea389ddaba5c52c577a82e416c8c533d1cd1d- Authentihash SHA256
21e6d9229f380d5e9591beaa82bd93547f517af90707d7757f0e27ff4731b484- Machine
- AMD64
- Version
- 1.00.00.0000 built by: WinDDK
- Publisher
- RW-Everything
rwdrv.sysSample 4 · HVCI FALSE
- MD5
9650db2ef0a44984845841ab24972ced- SHA1
9d191bee98f0af4969a26113098e3ea85483ae2d- SHA256
bdcacb9f373b017d0905845292bca2089feb0900ce80e78df1bcaae8328ce042- Imphash
6f0b9814da4da038669c47e77c2f268f- Authentihash MD5
d82a89cc750ae680af9f463b1b4ec8d9- Authentihash SHA1
3b61791f361c785019347cff13712400198c9364- Authentihash SHA256
1997e2a6302f3196975f858fef63188a249f79b6c2982d31ae07405e8aada58f- Machine
- AMD64
- Version
- 1.00.00.0000 built by: WinDDK
- Publisher
- RW-Everything
Recorded command
sc.exe create rwdrv.sys binPath=C:\windows\temp\rwdrv.sys type=kernel && sc.exe start rwdrv.sysElevate privileges · Privileges: kernel · OS: Windows 10