← Back to driver explorer
Driver intelligenceMaliciousVerified
gmer64.sys
Driver used by the GMER application. Which is an application that detects and removes rootkits
Known samples 2
0 recorded TRUE · 2 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
gmer64.sysSample 1 · HVCI FALSE
- MD5
a822b9e6eedf69211013e192967bf523- SHA1
83506de48bd0c50ea00c9e889fe980f56e6c6e1b- SHA256
18c909a2b8c5e16821d6ef908f56881aa0ecceeaccb5fa1e54995935fcfd12f7- Imphash
a998fe47a44bfbf2399968e21cfdf7ca- Authentihash MD5
7514f440c5b9e5c4a0498e4489b76d62- Authentihash SHA1
0bca6c35159282fd64615abc4d398399b061847b- Authentihash SHA256
3913d9754b78182aa25d38fbd7ea02502bdf1d81e6525ab4b5ffe5f543200478- Machine
- AMD64
- Version
- 2, 0, 6983 built by: WinDDK
- Publisher
- GMER
gmer64.sysSample 2 · HVCI FALSE
- MD5
98b8507e725b3d28537fc374eb2de72d- SHA1
c80d7fe8279ddfd466505a24b9c8cc7a68b9d0e4- SHA256
0052aa88e42055a2eed5ddd17c3499c692360155e5e031a211edfcef577acce3- Imphash
a998fe47a44bfbf2399968e21cfdf7ca- Authentihash MD5
7514f440c5b9e5c4a0498e4489b76d62- Authentihash SHA1
0bca6c35159282fd64615abc4d398399b061847b- Authentihash SHA256
3913d9754b78182aa25d38fbd7ea02502bdf1d81e6525ab4b5ffe5f543200478- Machine
- AMD64
- Version
- 2, 0, 6983 built by: WinDDK
- Publisher
- GMER
Recorded command
sc.exe create gmer64.sys binPath=C:\windows\temp\gmer64.sys type=kernel && sc.exe start gmer64.sysElevate privileges · Privileges: kernel · OS: Windows 10
Research & references
Acknowledgement: hfiref0x hfiref0x