← Back to driver explorer
Driver intelligenceVulnerableVerified
LECOMAx64.sys
LECOMAx64.sys is a signed LECO LECOMA device driver referenced by public PPLShade supported-driver research.
Known samples 1
0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
LECOMAx64.sysSample 1 · HVCI unknown
- MD5
8ac99a014b36c4cf1eeee98f99410cca- SHA1
eb817e8af016f6a3ece2b7cf421ec6d96970e285- SHA256
0f2dff4116a84241d8cafe534b63454fb4ea26272da8977be03670701ec6631c- Imphash
4a4d806c1efb1a0f5eb911acb564db83- Machine
- AMD64
- Version
- 2.31
- Publisher
- LECO Corporation
Recorded command
sc.exe create LECOMAx64 binPath=C:\windows\temp\LECOMAx64.sys type=kernel && sc.exe start LECOMAx64Load a vulnerable signed kernel driver · Privileges: kernel · OS: Windows 10
Research & references
Acknowledgement: Arnim Rupp ruppde