Driver intelligenceVulnerableVerified

CcProtect.sys

CnCrypt CcProtect.sys is a signed kernel driver used by BlackSnufkin BYOVD research as a process-killer provider. The public PoC documents this hash as a vulnerable CcProtect driver and notes that HVCI must be disabled to avoid instability.

UUID / 3e3067b0-3d74-46fe-9f57-1ae3a0293958ADDED / 2026-06-16AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.

CcProtect.sysSample 1 · HVCI unknown

MD5: e74d70c851e0c39cdb19af3bd2920efd
SHA1: 0cbc7b342fa3e988192d6c9178c562c2244c3ea2
SHA256: 5f0cfe8357bb52b45068ddbac053e32bc38e6cb5e086746f5402657b0a5cfb1c
Imphash: dd0b39ba9e2c95e68b934a065d9144bc
Authentihash MD5: c44f751b6b255ab1646133301d7c03cd
Authentihash SHA1: 83a3311c1a92dacabbd026f807ffb05bf74299a1
Authentihash SHA256: 61b268c31404e7b77868f5efdc2f134fffcf3059680e1ac26d93ead48529f9a7
Machine: AMD64
Version: 1.32
Publisher: CnCrypt Foundation

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create CcProtect binPath=C:\windows\temp\CcProtect.sys type=kernel && sc.exe start CcProtect

Terminate processes from kernel mode through a vulnerable CcProtect driver path. · Privileges: kernel · OS: Windows 10, Windows 11

Research & references

https://github.com/BlackSnufkin/BYOVD/tree/main/CcProtect-Killer

Acknowledgement: BlackSnufkin @BlackSnufkin42