Driver intelligenceVulnerableVerified

ControlCenter.sys

ControlCenter.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / b6873d69-affe-431b-9ba8-459391386603ADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

ControlCenter.sysSample 1 · HVCI FALSE

MD5: 6a784b693da28eb0eb3e8c6e233c0bbd
SHA1: 99d26b558c423ea4bedd0e1ec38b8e590dc3d98a
SHA256: 0b12eb25db68d8714ba52583597ed20e5fab2f6e82dcd0bcb23161acb4a9a126
Imphash: 459680ff15ecf7ddefb1cdb2bb097039
Authentihash MD5: 5c94cbd66c876dc641be098068f08696
Authentihash SHA1: f30a1544a07bd8945e9084f78b6aa4571caa726f
Authentihash SHA256: 4d7dbc8ef64367eb41cd553adc1590467a506f99e9953998205007d902aa4784
Machine: AMD64
Version: 1.0.0.1
Publisher: Quanta

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create ControlCenter binPath=C:\windows\temp\ControlCenter.sys type=kernel && sc.exe start ControlCenter

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint