← Back to driver explorer
Driver intelligenceVulnerableVerified
virtio_rng.sys
A vulnerable kernel driver that can be used to disable Code Integrity
Known samples 1
0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
virtio_rng.sysSample 1 · HVCI unknown
- MD5
90efcd59ca7522d9733d1493589a2676- SHA1
2a1623c931152f906240de1a50ec9a1e6271f7e6- SHA256
1f0ed057b98e7242b7a3a23fbfb05a4b9d29726132705948ce70045369152f10- Imphash
a146c524ad562ffdb24af0e97da6af14- Authentihash MD5
adab0078e3081974460da5d5ffb7484c- Authentihash SHA1
02c80a03d1d09eb2251aeaa20bee8abb2b4f096c- Authentihash SHA256
db421ce2f3379a515ae545f9c7e44be0484c91513b7fac4f379f9191cd7b41fd- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create virtio_rng binPath=C:\windows\temp\virtio_rng.sys type=kernel && sc.exe start virtio_rngElevate privileges · Privileges: kernel · OS: Windows 10
Research & references
Acknowledgement: Andrea Monzani, Davide Netti, Antonio Parata