Driver intelligenceVulnerableVerified

mtxC9CB.sys

mtxC9CB.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / b7bfe661-591a-45be-823d-ac6dae2edeedADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

mtxC9CB.sysSample 1 · HVCI FALSE

MD5: e0efe6ca3af0eddd2ea34899206dc989
SHA1: f0f325dc9b15fef3781d01b6b14022a89c68ca46
SHA256: 0414c0d5bb6ddbcc84b3d59ce411acf1ed8b17d17054c6192e0a7594b5146d60
Imphash: 88e4a085452babe37f90155de5fedaf7
Authentihash MD5: b68d529d159b0704137ea1498f00c7ce
Authentihash SHA1: a64ee7f9111becdf289f3460de1dd10bd0d739a6
Authentihash SHA256: cde6cb8bba989b5e2b197611b96471199e8a0484e895da46e3d3007d3a328151
Machine: AMD64
Version: Not recorded
Publisher: Not recorded

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create mtxC9CB binPath=C:\windows\temp\mtxC9CB.sys type=kernel && sc.exe start mtxC9CB

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint