← Back to driver explorer
Driver intelligenceVulnerableVerified
tmnciesc.sys
A vulnerable kernel driver that can be used to disable Code Integrity
Known samples 1
0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
tmnciesc.sysSample 1 · HVCI unknown
- MD5
0e21f1bd9c7eeb87665213810735b56c- SHA1
7dec39af5a6db63351efc71e30e6f710952ed13d- SHA256
a2071d1ed96b11763635580064d44fc9d14d1fe40cf36cd8f4e46aa2d084ab47- Imphash
f31392d62bc3b3a5a1d0d76c73aea777- Authentihash MD5
29aae025b9bc97a8009a3d3ac0805926- Authentihash SHA1
7b16aa69ad9d0cd7a67045dbd22e91a7da93aafc- Authentihash SHA256
7fb441081c1435b6d78b8cb90478510ddc3f32d8c5ba932f54865f4a1c843064- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create tmnciesc binPath=C:\windows\temp\tmnciesc.sys type=kernel && sc.exe start tmnciescElevate privileges · Privileges: kernel · OS: Windows 10
Research & references
Acknowledgement: Andrea Monzani, Davide Netti, Antonio Parata