{"Id":"6ca608ec-df2e-4a8d-8a0b-350f9e0271ab","Tags":["IMFForceDelete","IMFForceDelete.sys","ForceDelete.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2026-06-22","MitreID":"T1562.001","CVE":["CVE-2019-6494"],"Category":"vulnerable driver","Commands":{"Command":"sc.exe create IMFForceDelete binPath=C:\\windows\\temp\\IMFForceDelete.sys type=kernel && sc.exe start IMFForceDelete","Description":"IObit Malware Fighter IMFForceDelete.sys is a vulnerable force-delete filter driver. ESET documents GentleKiller's Cleaner variant dropping this driver without the trailing .sys extension, and CVE-2019-6494 describes IOCTL 0x8016E000 allowing low-privileged users to delete files regardless of access controls.","Usecase":"Delete protected files and impair defenses through a vulnerable kernel driver.","Privileges":"kernel","OperatingSystem":"Windows 10, Windows 11"},"Resources":["https://www.welivesecurity.com/en/eset-research/killing-me-gently-inside-gentlemens-edr-killer-framework/","https://www.eset.com/us/about/newsroom/research/eset-research-gentlemen-ransomware-gang-edr-killers/","https://github.com/magicsword-io/LOLDrivers/issues/377","https://nvd.nist.gov/vuln/detail/CVE-2019-6494","https://github.com/advisories/GHSA-rj7p-8gjh-5gqf"],"Detection":[],"Acknowledgement":{"Person":"ESET Research, 0xd3vnull","Handle":"@ESETresearch, @0xd3vnull"},"KnownVulnerableSamples":[{"Filename":"IMFForceDelete.sys","MD5":"75590850346c74a95d505ea3f8ff4a75","SHA1":"12500f6c87ce62712a0ed6652c57468d15c14223","SHA256":"ef4e4b88df24825dbf4e7131e71a41002715d38b7a8c0c432aa936c854152ef3","Imphash":"7816745e971bb8da69822ba11f0b6c0c","Authentihash":{"MD5":"91745beee76b54a6e5101c031c03833b","SHA1":"58118cdd342ebd74ec8bef20ad2da155d2d701fd","SHA256":"f003c8abf8a692de770eb3bb8babec8c72f836d856f9c96f4de30e3ab47fea0f"},"RichPEHeaderHash":{"MD5":"c59742756e448e47b7673ded67c45d30","SHA1":"c3ca9eea968c480ca30e203a6f02217975bf11fc","SHA256":"aeaa5c0937ebafe5e6c743e443fddcc92494ab90c4cba7d3434270332c6bd43d"},"Sections":{".text":{"Entropy":6.182311569738715,"Virtual Size":"0x1047"},".rdata":{"Entropy":5.163965659867767,"Virtual Size":"0x324"},".data":{"Entropy":0.30140680731160896,"Virtual Size":"0x1110"},".pdata":{"Entropy":3.5988696353179748,"Virtual Size":"0xb4"},"INIT":{"Entropy":5.086052316781448,"Virtual Size":"0x388"},".rsrc":{"Entropy":3.280523564332369,"Virtual Size":"0x388"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2022-08-02 01:57:01","Description":"IMF ForceDelete filter driver","Company":"IObit","InternalName":"ForceDelete.sys","OriginalFilename":"ForceDelete.sys","FileVersion":"7.0.0.5 built by: WinDDK","Product":"IObit Malware Fighter","ProductVersion":"7.0.0.5","Copyright":"© IObit. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["ExAllocatePoolWithTag","IoDeleteSymbolicLink","ExFreePoolWithTag","IoGetRelatedDeviceObject","RtlInitUnicodeString","IoDeleteDevice","KeSetEvent","IoCreateFile","KeInitializeEvent","RtlUnicodeStringToAnsiString","RtlUTF8ToUnicodeN","IoFileObjectType","ZwClose","IofCompleteRequest","ObReferenceObjectByHandle","KeWaitForSingleObject","IoFreeIrp","IoAllocateIrp","IoCreateSymbolicLink","ObfDereferenceObject","IoCreateDevice","DbgPrint","IofCallDriver","KeBugCheckEx","__C_specific_handler"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA","ValidFrom":"2011-04-15 19:45:33","ValidTo":"2021-04-15 19:55:33","Signature":"208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"61204db4000000000027","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"8e3ffc222fbcebdbb8b23115ab259be7","SHA1":"ee20bff28ffe13be731c294c90d6ded5aae0ec0e","SHA256":"59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821","SHA384":"f2dab7e56a33298654924501499487f6ba72c7d9477476a186e1ed7a9be031fade0e35ac09eff5e56bbbab95ae5374e7"}},{"Subject":"JURISDICTION_OF_INCORPORATION_C=CN, JURISDICTION_OF_INCORPORATION_SP=Sichuan, JURISDICTION_OF_INCORPORATION_L=Wuhou District, Chengdu, BUSINESS_CATEGORY=Private Organization, serialNumber=91510107072412418F, C=CN, ST=Sichuan, L=Chengdu, O=IObit CO., LTD, CN=IObit CO., LTD","ValidFrom":"2019-08-27 00:00:00","ValidTo":"2022-08-30 12:00:00","Signature":"89d53256ccf4b2e50a8e05d88de9ed33f6adde16e143a6f7f042ec4ed9220c7c4195b543ad1ae9c5ae5421f192140d62b28449c83a0c31759765c127fed77c447072976f2d5e8d44e07dafbbc5a0cea9e8020081c3f8a22a1519e53d8c69ff3ffbd7e090e92593a738b8bd6d583b27e5e797672294147fd1b8492683b1b3f202c3e0c571f9fad02d95f8204e054fa722ac42bf21e54ec1891942ab339f004ab57cb01838539bf5196fc1579e0add7c42206ff5e10bb0934b4a801fab12ed748a6a858af5c9601296ce6ca9b14b46f731a0485f49f142ab65dacb0103daaee13b2269f2c2b2d2bb2b04abe93642ecc988fa536170194acc1c73d48a781d3d5f0e","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0d98f5df96c592c5b76bfde1cb823096","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"d0ba095f2bdb679cea084b4106479484","SHA1":"80aba0ecbd2b71c84bc73ac42963bc9ce247a020","SHA256":"a93f8b7111c3e2288e164e42131e2ad52867060479ade1f6e6b3124cde822cfa","SHA384":"8293c567ba382434adab5899693e47e5d6e06c0b9f3c158bf17675d5a1476627db51d00dc9573bf4b89412617e651ba6"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA","ValidFrom":"2012-04-18 12:00:00","ValidTo":"2027-04-18 12:00:00","Signature":"9e5b963a2e1288acab016da49f75e40187a3a532d7bcbaa97ea3d61417f7c2136b7c738f2b6ae50f265968b08e259b6ceffa6c939208c14dcf459e9c46d61e74a19b14a3fa012f4ab101e1724048111368b9369d914bd7c2391210c1c4dcbb6214142a615d4f387c661fc61bffadbe4f7f945b7343000f4d73b751cf0ef677c05bcd348cd96313aa0e6111d6f28e27fcb47bb8b91120918678ea0ed428ff2ad52438e837b2ec96bb9fbc4a1650e15ebf517d23a032c7c1949e7ac9c026a2cc2587a0127e749f2d8db1c8e784beb9d1e9debb6a4e887371e12238cb2487e9737e51b2ff98eb4e7e2fe0ca0efab35ed1ba0542a8489f83f63fc4caa8df68a05061","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"0dd0e3374ac95bdbfa6b434b2a48ec06","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"f92649915476229b093c211c2b18e6c4","SHA1":"2d54c16a8f8b69ccdea48d0603c132f547a5cf75","SHA256":"2cd702a7dec30aa441345672e8992ef9770ce4946f276d767b45b0ed627658fb","SHA384":"511b0e0d7f3a48935cf2413348ff5f327887dc1e58f887bb5ed528d09f79173b55ab6439cf097fc7693b5749f7304ace"}}],"Signer":[{"SerialNumber":"0d98f5df96c592c5b76bfde1cb823096","Issuer":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA","Version":1}]}]}]}