Driver intelligenceVulnerableVerified

_xyzxbqvb.rdu_GFAC_Sys_x64.sys

_xyzxbqvb.rdu_GFAC_Sys_x64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / 63535f5c-9535-4bb0-ae8c-4366d40055f9ADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

_xyzxbqvb.rdu_GFAC_Sys_x64.sysSample 1 · HVCI FALSE

MD5: c6016d13579a954adb70e656d2711838
SHA1: 127a34bc163a830e9bd4b9db6879bff81ca02699
SHA256: b6748d7da5759dee7d5f2f32b0326b4edb7b2135a0e4a6d5ff26aef1e139d8b2
Imphash: 53d0750e054b7fb8b84c710a76fb0766
Authentihash MD5: c7e4f8c22d24c9209d4782e1d5958a71
Authentihash SHA1: 310a06a4fdae0c5afb3b29b43477d3e6cff61458
Authentihash SHA256: 82e9fc464c46b441fb638ba8883d7b8054a83d4ee10285a753028df9f3ffdf18
Machine: AMD64
Version: Not recorded
Publisher: Not recorded

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create _xyzxbqvb.rdu_GFAC_Sys_x64 binPath=C:\windows\temp\_xyzxbqvb.rdu_GFAC_Sys_x64.sys type=kernel && sc.exe start _xyzxbqvb.rdu_GFAC_Sys_x64

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint