amsdk.sys

amsdk.sys is the original (version 1.0.600) kernel driver for WatchDog Antimalware, a consumer security product. The driver is built on the Zemana Anti-Malware SDK, which is licensed to several third-party security tools. Check Point Research documented in 2025 that the Silver Fox APT was using amsdk.sys 1.0.600 in the wild before any patch existed; the driver could be loaded by an unprivileged caller and used to terminate Protected Process Light targets including endpoint-protection software. WatchDog later shipped a patched build under a new filename (wamsdk.sysDriverwamsdk.sysWatchDog Antimalware driver (patched build of amsdk.sys)Open plate →, version 1.1.100), but Check Point reported the patch did not fully resolve the issue, and the operators continued to use the patched build with hash-evasion tricks.

If you have WatchDog Antimalware installed and current, the patched wamsdk.sys is the file you should see; the original amsdk.sys 1.0.600 on disk is a sign of an outdated install and is worth removing.

amsdk.sys is listed as a known-vulnerable driver on the public LOLDrivers project. 2 distinct binary hashes matching this filename are on record, meaning multiple versions of the file have been observed.