Driver intelligenceVulnerableVerified

p2KGhmzsARY1.sys

p2KGhmzsARY1.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / 90239ca5-500d-422a-a3e6-6b771b55b3ebADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

p2KGhmzsARY1.sysSample 1 · HVCI TRUE

MD5: 1265a42ceab0418f2371e0f3e72c9b39
SHA1: 22b359cc9530f0b8f86714dc8ce170e05bd8d956
SHA256: 4473fef2a90a3217db685de44f575d2586666fcf3db7fa9efa1328afcdbf34a8
Imphash: 8963c6910b2f849b18673270f69eaf00
Authentihash MD5: 95ecc6664c0889c965731b988c93db35
Authentihash SHA1: f0297effb86a2504ae57c7adfc1cc8d6bc105987
Authentihash SHA256: e127efb8513c4866dedf8e506418ec65f87b7a49d8cc6606cafc8507d2eb550b
Machine: AMD64
Version: Not recorded
Publisher: Not recorded

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create p2KGhmzsARY1 binPath=C:\windows\temp\p2KGhmzsARY1.sys type=kernel && sc.exe start p2KGhmzsARY1

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint