← Back to driver explorer
Driver intelligenceVulnerableVerified
tosrfec.sys
A vulnerable kernel driver that can be used to disable Code Integrity
Known samples 1
0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
tosrfec.sysSample 1 · HVCI unknown
- MD5
f9e4534f2da02a7cb16152fcead48e57- SHA1
a43f3a8d0f75fd5ac65508a3c376ab4a99db981d- SHA256
01aa894cb84ca218e4e54f87626aac7ce16755a18b62de8f406eae522846e4d7- Imphash
f0d48d5b9f1f4eabde6b5e0e8196d84d- Authentihash MD5
6b98c3901c2ac48567c03b914fbbe012- Authentihash SHA1
53ea7f11fd01d31a1919b4b98b16578bafe75acb- Authentihash SHA256
d52c4eac784ff2fb30ae24d1c61d85871cc8e96ee9a1397ca8ca0a3fded0e107- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create tosrfec binPath=C:\windows\temp\tosrfec.sys type=kernel && sc.exe start tosrfecElevate privileges · Privileges: kernel · OS: Windows 10
Research & references
Acknowledgement: Andrea Monzani, Davide Netti, Antonio Parata