Driver intelligenceVulnerableVerified

HardwareMon-x86.sys

HardwareMon-x86.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / 24d8bef2-379c-4a27-bd2d-4f13136f3476ADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

HardwareMon-x86.sysSample 1 · HVCI FALSE

MD5: 99498c8990be78cc7f0fe0d08fee873d
SHA1: 1e293e3d795e3a19e54ab14f2f70d8c556907ca5
SHA256: 14807ce592bf8f12da8a338d7ef575ae60c2d513c5c7ecf1f276aef3b2aa627c
Imphash: 70ba87ed0810c07055c329c7899396de
Authentihash MD5: 859b80d95a55d0e7bd45a9298ae32f88
Authentihash SHA1: b98ccf5b0b7d0d17750bc867ae999a627c66d080
Authentihash SHA256: 6bfb88d3563e28e2fccaad764c14513dc70018519a5a360762cccc35ddc67c0b
Machine: AMD64
Version: 1.1.0.0
Publisher: Hubei Century Network Technology Co., Ltd.

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create HardwareMon-x86 binPath=C:\windows\temp\HardwareMon-x86.sys type=kernel && sc.exe start HardwareMon-x86

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint