20261004_160031_925420_HapDriver.sys
- Driver Name
20261004_160031_925420_HapDriver.sys- MD5
0d81c146d5eada2bd9bcc515dd13e7e9- SHA1
b427a3e75018d82a6cc244cfe99476f0287bfd9a- SHA256
25607d285a592b9990ed1528293fced6fccff73c6b7ef6e921020546032a7627- Imphash
a02c63c0c5ace9f575a0709bc279c8e4- Vhash
074076655d151516551iz3bwzc- Authentihash
1994b240c348a02a30e9f14bbb84b32d50ae8e88280168226cddccd0a2a7c8e6- Rich PE header hash
501f44f69b1dafc24b68a3d482ecaa58- SSDEEP
1536:+N+CIYtcv3S/vD3MxHNLcqlktoLsI2AMy3pzf:wQZv3S/vD3CHNLjJLZb- TLSH
T155736C57E34040A8C2BED5BCC1968827DBBBB42253738ACF43D2D8544E637E95E3A761- Signer
Microsoft Windows Hardware Compatibility Publisher- Signing date
2026-05-30 16:38- SpcSpOpusInfo
Langtu Digital- VT detections
0/71- Compilation time
2026-05-30- PDB path
D:\Gayhub\MachineCode\XyzHwidSpoofer\3rdparty\driver-loader\bin\x64\Release\DriverLoader.pdb- Country submitter
- Turkey, United States, Hong Kong
- Flag
- Malicious
Description
Functionality: Licence-gated unsigned kernel loader.
Licence check. The driver reads a plaintext licence key from C:\Windows\SysWOW64\sc.ini. The first character selects the server port and the remainder is the key. It sends the key, with a machine identifier built from registry values (MachineGuid, product ID, install date, computer name), to 206.119.174[.]197 over unencrypted HTTP and waits for approval.
Offline cache. On approval, the driver writes the result to C:\Windows\SysWOW64\sc.dat: 176 bytes, encrypted, hidden and system attributes set. The file holds the machine identifier, a hash of the licence key, a checksum, and an expiry time 72 hours ahead. If the server is unreachable on a later start, the driver falls back to sc.dat and starts if the file is intact, belongs to this machine, matches the key in sc.ini, and has not expired. This allows three days of offline operation. If the file belongs to a different machine, the driver deletes it. If the server returns error 1202, the driver deletes the file and deliberately bugchecks the system.
Device interface. Only after the licence check passes does the driver create \Device\DriverLoader with the symbolic link \DosDevices\DriverLoader (opened from user mode as \.\DriverLoader). All functionality is reached through IOCTLs on this device. It handles eighteen control codes in the range 0x222000–0x222040, which provide:
- Arbitrary kernel memory access: read, copy, and fill any kernel memory.
-Read-only memory writes: write to read-only kernel memory by remapping it as writable.
- Module lookup: resolve the base address of any loaded driver or kernel module by name.
- Function lookup: resolve the address of any kernel function by name.
. Unsigned kernel loader: the caller passes a complete PE file in the buffer. The driver copies it into executable kernel memory, applies relocations, resolves imports, and calls its entry point with two caller-supplied arguments. No signature verification is performed, and because the image never passes through the Windows loader, Driver Signature Enforcement is bypassed. An optional flag omits the PE headers to make the mapped image harder to find in memory.