← Back to driver explorer
Driver intelligenceVulnerableVerified
pmxdrv64.sys
Intel PMxDrv / pmxdrv64.sys is listed as a KDU provider for Intel Management Engine Tools driver abuse. Public vulnerable-driver research also documents physical-memory access through this driver family.
Known samples 2
0 recorded TRUE · 0 recorded FALSE · 2 unknown for loading despite HVCI. Results apply to individual samples.
pmxdrv64.sysSample 1 · HVCI unknown
- MD5
3807073232994eca5dafe266b9674743- SHA1
9e5fcaea33c9a181c56f7d0e4d9c42f8edead252- SHA256
b1a8ee1222eea5f199028d90b9b77c2acf46d6d84a9e125403b2888c6f681c72- Imphash
3a1007f4b4aba578ddc0289781690ab6- Authentihash MD5
e98caa099ab8e87140954476824ab409- Authentihash SHA1
7919108cb1278503ec4a78dd25694c6770eaa989- Authentihash SHA256
b80303d69de7ca0cb35c5cc7da1e479f088595493b3fb69a1fe9e895c0915d27- Machine
- AMD64
- Version
- 1.0.0.1003
- Publisher
- Intel Corporation
pmxdrv.sysSample 2 · HVCI unknown
- MD5
0bee791c7c7ace453c134e73633c497d- SHA1
17bdfa70fe84e515183e5fa675d72d5d0e2090e8- SHA256
82b30461dbf40ac15fce6a83b9bad2ebd05b27dea1b784eaa096422fe8927b7b- Imphash
90b0b267ea9388c89393b4e84846c14e- Authentihash MD5
eb4e28237e3b98664988b13cbec48258- Authentihash SHA1
7812103dcd0cfae434003d17b1b3579bdc4c6f4d- Authentihash SHA256
7a1416d03758f28dd3848988f6134f4ccf43c18f57ba0bf2508e93d915bb6cd0- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create pmxdrv64 binPath=C:\windows\temp\pmxdrv64.sys type=kernel && sc.exe start pmxdrv64Access privileged kernel or physical-memory primitives through a vulnerable Intel Management Engine Tools driver. · Privileges: kernel · OS: Windows 10, Windows 11
Research & references
Acknowledgement: KDU Project / SharpKernel / 3ggspl01t @hfiref0x / @hsheric0210 / @3ggspl01t