CmdID / Files

wamsdk.sys

WatchDog Antimalware Driver file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/9cb4b2fa-67fb-4415-a064-7da7bc47e105/

2 known samples

1.1.100 · its entry

0be8483c2ea42f1ce4c90e84ac474a4e7017bc6d682e06f96dc1e31922a07b10

1.1.100 · its entry

5af1dae21425dda8311a2044209c308525135e1733eeff5dd20649946c6e054c

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real wamsdk.sys?

file version info and known copies

Productwamsdk, WatchDogDevelopment.com, LLC.

DescriptionWatchDog Antimalware Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.