← Back to driver explorer
Driver intelligenceVulnerableVerified
msr.sys
Identified on the MSFT Driver Block list, non-admin can write MSR.
Known samples 2
0 recorded TRUE · 2 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
msr.sysSample 1 · HVCI FALSE
- MD5
808d2bcad62afa82a2b4fdd0fec6d9c6- SHA1
14c6e52e1ed19cdaac5a82da6051de89be06c334- SHA256
ede9a3858a12d5ddea21a310e5721bf86c2248539f42c9e0c3c29ae5b0148ba5- Imphash
ddffac000a9ce8309fadca5939bd6b19- Authentihash MD5
dc5d6e5c4884d33d8e85acbb295982b0- Authentihash SHA1
2146bf058139453c0447786d6f6d5fc454ab955f- Authentihash SHA256
1f8812611cf7120e89e769cc908fabc0c9e49b27fded8dde6a3de51d9ce34f09- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
msr.sysSample 2 · HVCI FALSE
- MD5
d90251456195433abcb63ff579a8dda8- SHA1
0a02625927613c9a492a9eac3ea943ddf6f64028- SHA256
6c6a4d07e95ab4212c2afefcb0ce37dc485fa56120b0419b636bd8bd326038c1- Imphash
90862ed3cb06642744e5aff0d881f694- Authentihash MD5
b6bb37bc17ea29b0edac914de37518e6- Authentihash SHA1
381cc2b974d440edea0bbc010c4bef4cdc2169b7- Authentihash SHA256
d23f28169d6e5c09a89e5136a4ff899a3b6f886535bb0254a27dd00a2753c412- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create msr.sys binPath=C:\windows\temp\msr.sys type=kernel && sc.exe start msr.sysElevate privileges · Privileges: kernel · OS: Windows 10