Driver intelligenceVulnerableVerified

KExplore.sys

KExplore.sys is Pavel Yosifovich's Kernel Explorer driver and is listed as a KDU-compatible provider. KDU uses supported provider drivers to access kernel memory primitives for actions such as process-object modification and driver mapping.

UUID / 1b916d35-f62b-41ef-8454-3aed20299cb0ADDED / 2026-06-16AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.

KExplore.sysSample 1 · HVCI unknown

MD5: b685345355d9fba9af6df590a87948ce
SHA1: 090a4fc285d4f47b1e6a1011353a329c1f4c8e09
SHA256: c71e14961ac29165ddf6e5e8f9372e82fc79494da07afbfaf2ccfc9bd3bbbe18
Imphash: 3965dae43010cc5fb249037453f57240
Authentihash MD5: 77ca8cbab2fd1342df3fc6d42cac8d89
Authentihash SHA1: c77403cffcd15438ea3dddf0763ab0a70a9100cb
Authentihash SHA256: 45222ddbb5e445221e780b84d11a4c579ae8d28e7e9c2c67afced22d589f5e00
Machine: AMD64
Version: Not recorded
Publisher: Not recorded

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create KExplore binPath=C:\windows\temp\KExplore.sys type=kernel && sc.exe start KExplore

Access kernel primitives through a KDU-supported provider driver. · Privileges: kernel · OS: Windows 10, Windows 11

Research & references

Acknowledgement: KDU Project / SharpKernel @hfiref0x / @hsheric0210