Driver intelligenceVulnerableVerified

IoManager.sys

IoManager.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / 2ad22816-46de-45b5-999b-864944635e0aADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

IoManager.sysSample 1 · HVCI FALSE

MD5: e100351d149ad783e54fa99bb3391c1a
SHA1: ee71af9b7e0f72d8e6a79088d8a8375f1956ec90
SHA256: d7833a5d77ab264572458a51226000190857f1b5807c556e23e18c39bb950ca6
Imphash: acb4a7b1f0ca51362dbe3b879b7719db
Authentihash MD5: f555e3988e405bb52f55e3ce7aee787f
Authentihash SHA1: 206603e653feaa5ab9108634956dc91fa843689e
Authentihash SHA256: fb4826d8c213cd529520e02ce4d823a41b6f5b6c96b73d41ceb2de5dc573ae74
Machine: AMD64
Version: 1, 0, 0, 32
Publisher: COMPAL ELECTRONIC INC.

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create IoManager binPath=C:\windows\temp\IoManager.sys type=kernel && sc.exe start IoManager

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint