Driver intelligenceVulnerableVerified

Realtime Driver.sys

Realtime Driver.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / 6882f954-e69b-464a-b7cf-0cda802d3257ADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

Realtime Driver.sysSample 1 · HVCI FALSE

MD5: 8bc5c3a6284e0e46ad37408e622e47ae
SHA1: 60a0d45cc465b64316665d09e333e31571cd56d9
SHA256: 1e87c118482101a9acb0952f4545dad155956dd397858b5d2748c63f0d836704
Imphash: 82df62bd98a4d4095d233de81216212c
Authentihash MD5: 013752a854e0e9dea08acf793c82622f
Authentihash SHA1: 5be2bc54d2308b2e0f95cdc716fe7df292e22265
Authentihash SHA256: a2246b6ab3feeb637ecd2bc81a955e5ec495ebb6bed562d125cb9a939724166d
Machine: AMD64
Version: 10.6.18
Publisher: Mandiant

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create Realtime Driver binPath=C:\windows\temp\Realtime Driver.sys type=kernel && sc.exe start Realtime Driver

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint