Driver intelligenceVulnerableVerified

dXIw8eZ9aYxQYzgm.sys

dXIw8eZ9aYxQYzgm.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / 847e6aa7-ce2d-4f4a-aa6c-a00c5f0ad728ADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

dXIw8eZ9aYxQYzgm.sysSample 1 · HVCI TRUE

MD5: ee831c7f623190a53ce3f7b9cc3083a7
SHA1: 3dd0107a1226975496c767a655518bf761dde772
SHA256: c3ea9a13da6f137238b4b912b1f398b8ccfae41ba618993e6cc6c73eb24800db
Imphash: 501a0cef5c1b58c54a3c564c7a5d2158
Authentihash MD5: 9f923f93441bf99eca3f88bf3a9dc998
Authentihash SHA1: 82871fbb09ccea28d6859dde876d628bdfb9dd32
Authentihash SHA256: 8fc25a8624138b00199db96d0de2360acd2f9cef82d444c24a9f5d307ed7764b
Machine: AMD64
Version: Not recorded
Publisher: Not recorded

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create dXIw8eZ9aYxQYzgm binPath=C:\windows\temp\dXIw8eZ9aYxQYzgm.sys type=kernel && sc.exe start dXIw8eZ9aYxQYzgm

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint