Driver intelligenceVulnerableVerified

whql.sys

whql.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / c366ee89-97ae-4523-b635-e05769384bd3ADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

whql.sysSample 1 · HVCI TRUE

MD5: 5ea6bc6b8a59d98338b8d94748491838
SHA1: d7a79e147b2b4bd0e0675795c48a3e43c805fb9a
SHA256: 412564937dea61ad443a3f50a0f7586aed1bf68795e9af184606804357499cea
Imphash: 662750337cd06c9bfbf0f6b1e63f760b
Authentihash MD5: d2ab2460dd07e0db1990f45e99e4df5e
Authentihash SHA1: 2435dc624414a2026077fdcd13c3ebfb2043f08d
Authentihash SHA256: 78c77db3e814b83f60f77f9499d8a1a55ed6f85a3e618b4545b6b60d9e17a665
Machine: AMD64
Version: Not recorded
Publisher: Not recorded

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create whql binPath=C:\windows\temp\whql.sys type=kernel && sc.exe start whql

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint