Driver intelligenceVulnerableVerified

probmon.sys

A vulnerable kernel driver that can be used to terminate arbitrary processes

UUID / 3bf3fd5d-dee3-42da-b8be-6a0b8b7bc88cADDED / 2025-01-29AUTHOR / Antonio Parata, Andrea Monzani

Known samples 1

0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.

probmon.sysSample 1 · HVCI unknown

MD5: 8c8c93a6b6c6d6e632a54877fc1a209e
SHA1: 7310d6399683ba3eb2f695a2071e0e45891d743b
SHA256: 023d722cbbdd04e3db77de7e6e3cfeabcef21ba5b2f04c3f3a33691801dd45eb
Imphash: 6ebc02245b720f105b7087c78b8f3a6e
Authentihash MD5: 9740e9ac3b5e4cdbd1a35d5032b94e1c
Authentihash SHA1: c250f8111b95a0cfd72a1b83c0dd08d8727a1038
Authentihash SHA256: e8bdfab9d5b5c37f6f23ddf9dddba2feb74261b61a80dee0c6aebffbf39948fb
Machine: AMD64
Version: 3.0.0.4
Publisher: ITM SYSTEM

sc.exe create probmon.sys binPath=C:\windows\temp\probmon.sys type=kernel && sc.exe start probmon.sys

EDR Kill · Privileges: Admin privileges · OS: Windows 10