ntoskrnl.exe
- File Path:
C:\WINDOWS\system32\ntoskrnl.exe - Description: NT Kernel & System
Hashes
| Type | Hash |
|---|---|
| MD5 | 26EC638921BD2378C429D0991ACB5A28 |
| SHA1 | 230E14A63BA0BD8EF4EBEDF7AC1F2408533A0058 |
| SHA256 | 77761AE0821CAA94C42D5A4CF9D18126A729EF1ACC6C1FD7A137E89B076D9F65 |
| SHA384 | 537E98BA65A46BD8BA98870ED02E5E2AE1603EBE2FF3DA25E49B829C9CB6C0BB7C6B10DE8CB22F72DAD3CFD691883C31 |
| SHA512 | 3C0DD490CCD8DE4B5C3EAAE7C8EDE1C7F1AD3329449294D469AEC1AFAAD4A7DA9A7687B5C1958F55B8A43CE877B90DB2DA7758E9D12D18F935531C3BE578C291 |
| SSDEEP | 98304:tktxKZY977ghP7uLAytJOgqkXSw4o8kOC8Zt+8GIhUnI5y/dC7Yk7Gwt:toxeY970l7JytYwXOksWIhMdC37Gc |
| IMP | F160E1580BD40F0557DCCF104A894FCB |
| PESHA1 | D10102365AE4FA8987099FC785398B5C34AF0244 |
| PE256 | 979F7F394F6F74EF76F3ACF9E2412ECF3797618A51ADEDC799B5D1F5E3DBBD52 |
Signature
- Status: Signature verified.
- Serial:
33000002ED2C45E4C145CF48440000000002ED - Thumbprint:
312860D2047EB81F8F58C29FF19ECDB4C634CF6A - Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
- Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
File Metadata
- Original Filename: ntkrnlmp.exe
- Product Name: Microsoft Windows Operating System
- Company Name: Microsoft Corporation
- File Version: 10.0.22000.282 (WinBuild.160101.0800)
- Product Version: 10.0.22000.282
- Language: English (United States)
- Legal Copyright: Microsoft Corporation. All rights reserved.
- Machine Type: 64-bit
File Scan
- VirusTotal Detections: 0/73
- VirusTotal Link: https://www.virustotal.com/gui/file/77761ae0821caa94c42d5a4cf9d18126a729ef1acc6c1fd7a137e89b076d9f65/detection
Possible Misuse
The following table contains possible examples of ntoskrnl.exe being misused. While ntoskrnl.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.
| Source | Source File | Example | License |
|---|---|---|---|
| signature-base | apt_hackingteam_rules.yar | $x4 = “C:\\Windows\\Sysnative\\ntoskrnl.exe” fullword ascii /* PEStudio Blacklist: strings */ | CC BY-NC 4.0 |
| signature-base | apt_winnti.yar | $s17 = “NTOSKRNL.EXE” fullword wide /* Goodware String - occured 4 times */ | CC BY-NC 4.0 |
| signature-base | apt_winnti.yar | $a5 = “ntoskrnl.exe” ascii fullword | CC BY-NC 4.0 |
| signature-base | apt_winnti.yar | $a3 = “%SystemRoot%\System32\ntoskrnl.exe” ascii | CC BY-NC 4.0 |
| signature-base | apt_winnti_hdroot.yar | $s1 = “\system32\ntoskrnl.exe” fullword ascii | CC BY-NC 4.0 |
| signature-base | spy_querty_fiveeyes.yar | $s3 = “ntoskrnl.exe” fullword ascii | CC BY-NC 4.0 |
| signature-base | spy_regin_fiveeyes.yar | $s4 = “ntoskrnl.exe” fullword ascii | CC BY-NC 4.0 |
MIT License. Copyright (c) 2020-2021 Strontic.