LOLDriversTHE DRIVER THREAT CATALOG
← Back to driver explorer
Driver intelligenceVulnerableVerified

RTCore64.sys

The driver in Micro-Star MSI Afterburner 4.6.2.15658 (aka RTCore64.sys and RTCore32.sys) allows any authenticated user to read and write to arbitrary memory, I/O ports, and MSRs. This can be exploited for privilege escalation, code execution under high privileges, and information disclosure. These signed drivers can also be used to bypass the Microsoft driver-signing policy to deploy malicious code.

UUID / e32bc3da-4db1-4858-a62c-6fbe4db6afbdADDED / 2023-01-09AUTHOR / Michael Haag

Known samples 43

2 recorded TRUE · 41 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

RTCore64.sysSample 1 · HVCI FALSE
MD5
2d8e4f38b36c334d0a32a7324832501d
SHA1
f6f11ad2cd2b0cf95ed42324876bee1d83e01775
SHA256
01aa278b07b58dc46c84bd0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd
Imphash
7363079b9aae7d58bd33c691a613c83c
Authentihash MD5
538e5e595c61d2ea8defb7b047784734
Authentihash SHA1
4a68c2d7a4c471e062a32c83a36eedb45a619683
Authentihash SHA256
478c36f8af7844a80e24c1822507beef6314519185717ec7ae224a0e04b2f330
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 2 · HVCI TRUE
MD5
0ec361f2fba49c73260af351c39ff9cb
SHA1
af50109b112995f8c82be8ef3a88be404510cdde
SHA256
cdd2a4575a46bada4837a6153a79c14d60ee3129830717ef09e0e3efd9d00812
Imphash
9ad5f7496f8c918d6c0536751d3accae
Authentihash MD5
63fd0d800cac53db02638349cea2f8e7
Authentihash SHA1
3856e573765f090afbbb9e5be4c886653402f755
Authentihash SHA256
ff8d17761c1645bdd1f0eccc69024907bbbfbe5c60679402b7d02f95b16310fe
Machine
I386
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 3 · HVCI TRUE
MD5
0a2ec9e3e236698185978a5fc76e74e6
SHA1
4fe873544c34243826489997a5ff14ed39dd090d
SHA256
f1c8ca232789c2f11a511c8cd95a9f3830dd719cad5aa22cb7c3539ab8cb4dc3
Authentihash MD5
bcd9f192e2f9321ed549c722f30206e5
Authentihash SHA1
8498265d4ca81b83ec1454d9ec013d7a9c0c87bf
Authentihash SHA256
606beced7746cdb684d3a44f41e48713c6bbe5bfb1486c52b5cca815e99d31b4
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
View on VirusTotal
RTCore64.sysSample 4 · HVCI FALSE
MD5
9a5a35112c4f8016abcc6363b44d3385
SHA1
8800a33a37c640922ce6a2996cd822ed4603b8bb
SHA256
ad215185dc833c54d523350ef3dbc10b3357a88fc4dde00281d9af81ea0764d5
Imphash
543f80399f79401471523d335ea61642
Authentihash MD5
a17d227444e090ff69e24fcb6d43162b
Authentihash SHA1
43d3a3c1f7b14cfcc051cae2534dbbbb4c7fc120
Authentihash SHA256
b8eb26b6f79020ae988e4fb752dc06e1b6779749bf4f8df2872fc2b92bab8020
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 5 · HVCI FALSE
MD5
a5afd20e34bcd634ebd25b3ab2ff3403
SHA1
fb349c3cde212ef33a11a9d58a622dc58dff3f74
SHA256
d9a2bf0f5ba185170441f003dc46fbb570e1c9fdf2132ab7de28b87ba7ad1a0c
Imphash
543f80399f79401471523d335ea61642
Authentihash MD5
a17d227444e090ff69e24fcb6d43162b
Authentihash SHA1
43d3a3c1f7b14cfcc051cae2534dbbbb4c7fc120
Authentihash SHA256
b8eb26b6f79020ae988e4fb752dc06e1b6779749bf4f8df2872fc2b92bab8020
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 6 · HVCI FALSE
MD5
6691e873354f1914692df104718eebad
SHA1
d3d2fe8080f0b18465520785f3a955e1a24ae462
SHA256
22e125c284a55eb730f03ec27b87ab84cf897f9d046b91c76bea2b5809fd51c5
Imphash
690a0fb27a0c47c785d6bbbfc2e56501
Authentihash MD5
55466195f0b2f4afc4243b43a806e6d9
Authentihash SHA1
38b353d8480885de5dcf299deca99ce4f26a1d20
Authentihash SHA256
5182caf10de9cec0740ecde5a081c21cdc100d7eb328ffe6f3f63183889fec6b
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 7 · HVCI FALSE
MD5
b994110f069d197222508a724d8afdac
SHA1
47df454cb030c1f4f7002d46b1308a32b03148e7
SHA256
dd2c1aa4e14c825f3715891bfa2b6264650a794f366d5f73ed1ef1d79ff0dbf9
Imphash
543f80399f79401471523d335ea61642
Authentihash MD5
a17d227444e090ff69e24fcb6d43162b
Authentihash SHA1
43d3a3c1f7b14cfcc051cae2534dbbbb4c7fc120
Authentihash SHA256
b8eb26b6f79020ae988e4fb752dc06e1b6779749bf4f8df2872fc2b92bab8020
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 8 · HVCI FALSE
MD5
4b194021d6bd6650cbd1aed9370b2329
SHA1
c8a4a64b412fd8ef079661db4a4a7cd7394514ca
SHA256
96df0b01eeba3e6e50759d400df380db27f0d0e34812d0374d22ac1758230452
Imphash
543f80399f79401471523d335ea61642
Authentihash MD5
a17d227444e090ff69e24fcb6d43162b
Authentihash SHA1
43d3a3c1f7b14cfcc051cae2534dbbbb4c7fc120
Authentihash SHA256
b8eb26b6f79020ae988e4fb752dc06e1b6779749bf4f8df2872fc2b92bab8020
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 9 · HVCI FALSE
MD5
6b16512bffe88146a7915f749bd81641
SHA1
fad014ec98529644b5db5388d96bc4f9b77dcdc3
SHA256
5fe5a6f88fbbc85be9efe81204eee11dff1a683b426019d330b1276a3b5424f4
Imphash
690a0fb27a0c47c785d6bbbfc2e56501
Authentihash MD5
936e49d3eec0a2f433e9d0115a38a2b6
Authentihash SHA1
5717bf3e520accfff5ad9943e53a3b118fb67f2e
Authentihash SHA256
918d2e68a724b58d37443aea159e70bf8b1b5ebb089c395cad1d62745ecdaa19
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 10 · HVCI FALSE
MD5
0be80db5d9368fdb29fe9d9bfdd02e7c
SHA1
6cc28df318a9420b49a252d6e8aaeda0330dc67d
SHA256
5de78cf5f0b1b09e7145db84e91a2223c3ed4d83cceb3ef073c068cf88b9d444
Imphash
543f80399f79401471523d335ea61642
Authentihash MD5
a17d227444e090ff69e24fcb6d43162b
Authentihash SHA1
43d3a3c1f7b14cfcc051cae2534dbbbb4c7fc120
Authentihash SHA256
b8eb26b6f79020ae988e4fb752dc06e1b6779749bf4f8df2872fc2b92bab8020
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 11 · HVCI FALSE
MD5
61e8367fb57297a949c9a80c2e0e5a38
SHA1
a37616f0575a683bd81a0f49fadbbc87e1525eba
SHA256
d3eaf041ce5f3fd59885ead2cb4ce5c61ac9d83d41f626512942a50e3da7b75a
Imphash
543f80399f79401471523d335ea61642
Authentihash MD5
a17d227444e090ff69e24fcb6d43162b
Authentihash SHA1
43d3a3c1f7b14cfcc051cae2534dbbbb4c7fc120
Authentihash SHA256
b8eb26b6f79020ae988e4fb752dc06e1b6779749bf4f8df2872fc2b92bab8020
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 12 · HVCI FALSE
MD5
98583b2f2efe12d2a167217a3838c498
SHA1
8f266edf9f536c7fc5bb3797a1cf9039fde8e97c
SHA256
5ab48bf8c099611b217cc9f78af2f92e9aaeedf1cea4c95d5dd562f51e9f0d09
Imphash
543f80399f79401471523d335ea61642
Authentihash MD5
a17d227444e090ff69e24fcb6d43162b
Authentihash SHA1
43d3a3c1f7b14cfcc051cae2534dbbbb4c7fc120
Authentihash SHA256
b8eb26b6f79020ae988e4fb752dc06e1b6779749bf4f8df2872fc2b92bab8020
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 13 · HVCI FALSE
MD5
dca1c62c793f84bb2d8e41ca50efbff1
SHA1
7cf7644e38746c9be4537b395285888d5572ae1b
SHA256
fded693528f7e6ac1af253e0bd2726607308fdaa904f1e7242ed44e1c0b29ae8
Imphash
690a0fb27a0c47c785d6bbbfc2e56501
Authentihash MD5
55466195f0b2f4afc4243b43a806e6d9
Authentihash SHA1
38b353d8480885de5dcf299deca99ce4f26a1d20
Authentihash SHA256
5182caf10de9cec0740ecde5a081c21cdc100d7eb328ffe6f3f63183889fec6b
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 14 · HVCI FALSE
MD5
027e10a5048b135862d638b9085d1402
SHA1
a528cdeed550844ca7d31c9e231a700b4185d0da
SHA256
bac1cd96ba242cdf29f8feac501110739f1524f0db1c8fcad59409e77b8928ba
Imphash
cde9174249f04dad0f79890c976c0792
Authentihash MD5
cfe667280acf69d4b5d0e2dbc76510e4
Authentihash SHA1
b3249bacda6e43aa2c46c2af802c9ee0b7e2fd7b
Authentihash SHA256
3c9829a16eb85272b0e1a2917feffaab8ddb23e633b168b389669339a0cee0b5
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 15 · HVCI FALSE
MD5
592065b29131af32aa18a9e546be9617
SHA1
079627e0f5b1ad1fb3fe64038a09bc6e8b8d289d
SHA256
f9bc6b2d5822c5b3a7b1023adceb25b47b41e664347860be4603ee81b644590e
Imphash
543f80399f79401471523d335ea61642
Authentihash MD5
a17d227444e090ff69e24fcb6d43162b
Authentihash SHA1
43d3a3c1f7b14cfcc051cae2534dbbbb4c7fc120
Authentihash SHA256
b8eb26b6f79020ae988e4fb752dc06e1b6779749bf4f8df2872fc2b92bab8020
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 16 · HVCI FALSE
MD5
ada5f19423f91795c0372ff39d745acf
SHA1
dd893cd3520b2015790f7f48023d833f8fe81374
SHA256
613d6cc154586c21b330018142a89eac4504e185f0be7f86af975e5b6c046c55
Imphash
543f80399f79401471523d335ea61642
Authentihash MD5
a17d227444e090ff69e24fcb6d43162b
Authentihash SHA1
43d3a3c1f7b14cfcc051cae2534dbbbb4c7fc120
Authentihash SHA256
b8eb26b6f79020ae988e4fb752dc06e1b6779749bf4f8df2872fc2b92bab8020
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 17 · HVCI FALSE
MD5
8a108158431e9a7d08e330fd7a46d175
SHA1
27aa3f1b4baccd70d95ea75a0a3e54e735728aa2
SHA256
0e10d3c73596e359462dc6bfcb886768486ff59e158f0f872d23c5e9a2f7c168
Imphash
543f80399f79401471523d335ea61642
Authentihash MD5
a17d227444e090ff69e24fcb6d43162b
Authentihash SHA1
43d3a3c1f7b14cfcc051cae2534dbbbb4c7fc120
Authentihash SHA256
b8eb26b6f79020ae988e4fb752dc06e1b6779749bf4f8df2872fc2b92bab8020
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 18 · HVCI FALSE
MD5
c475c7d0f2d934f150b6c32c01479134
SHA1
2739c2cfa8306e6f78c335c55639566b3d450644
SHA256
54bf602a6f1baaec5809a630a5c33f76f1c3147e4b05cecf17b96a93b1d41dca
Imphash
543f80399f79401471523d335ea61642
Authentihash MD5
a17d227444e090ff69e24fcb6d43162b
Authentihash SHA1
43d3a3c1f7b14cfcc051cae2534dbbbb4c7fc120
Authentihash SHA256
b8eb26b6f79020ae988e4fb752dc06e1b6779749bf4f8df2872fc2b92bab8020
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 19 · HVCI FALSE
MD5
79b8119b012352d255961e76605567d6
SHA1
ea63567ea8d168cb6e9aae705b80a09f927b2f77
SHA256
7149fbd191d7e4941a32a3118ab017426b551d5d369f20c94c4f36ae4ef54f26
Imphash
543f80399f79401471523d335ea61642
Authentihash MD5
a17d227444e090ff69e24fcb6d43162b
Authentihash SHA1
43d3a3c1f7b14cfcc051cae2534dbbbb4c7fc120
Authentihash SHA256
b8eb26b6f79020ae988e4fb752dc06e1b6779749bf4f8df2872fc2b92bab8020
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 20 · HVCI FALSE
MD5
6fb3d42a4f07d8115d59eb2ea6504de5
SHA1
f56186b6a7aa3dd7832c9d821f9d2d93bc2a9360
SHA256
67e9d1f6f7ed58d86b025d3578cb7a3f3c389b9dd425b7f46bb1056e83bffc78
Imphash
543f80399f79401471523d335ea61642
Authentihash MD5
a17d227444e090ff69e24fcb6d43162b
Authentihash SHA1
43d3a3c1f7b14cfcc051cae2534dbbbb4c7fc120
Authentihash SHA256
b8eb26b6f79020ae988e4fb752dc06e1b6779749bf4f8df2872fc2b92bab8020
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 21 · HVCI FALSE
MD5
700e9902b0a28979724582f116288bad
SHA1
38a863bcd37c9c56d53274753d5b0e614ba6c8bb
SHA256
f48f31bf9c6abbd44124b66bce2ab1200176e31ef1e901733761f2b5ceb60fb2
Imphash
543f80399f79401471523d335ea61642
Authentihash MD5
a17d227444e090ff69e24fcb6d43162b
Authentihash SHA1
43d3a3c1f7b14cfcc051cae2534dbbbb4c7fc120
Authentihash SHA256
b8eb26b6f79020ae988e4fb752dc06e1b6779749bf4f8df2872fc2b92bab8020
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 22 · HVCI FALSE
MD5
ef5ba21690c2f4ba7e62bf022b2df1f7
SHA1
dd49a71f158c879fb8d607cc558b507c7c8bc5b9
SHA256
c181ce9a57e8d763db89ba7c45702a8cf66ef1bb58e3f21874cf0265711f886b
Imphash
690a0fb27a0c47c785d6bbbfc2e56501
Authentihash MD5
55466195f0b2f4afc4243b43a806e6d9
Authentihash SHA1
38b353d8480885de5dcf299deca99ce4f26a1d20
Authentihash SHA256
5182caf10de9cec0740ecde5a081c21cdc100d7eb328ffe6f3f63183889fec6b
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 23 · HVCI FALSE
MD5
d6cc5709aca6a6b868962a6506d48abc
SHA1
c0568bcdf57db1fa43cdee5a2a12b768a0064622
SHA256
ad0309c2d225d8540a47250e3773876e05ce6a47a7767511e2f68645562c0686
Imphash
543f80399f79401471523d335ea61642
Authentihash MD5
a17d227444e090ff69e24fcb6d43162b
Authentihash SHA1
43d3a3c1f7b14cfcc051cae2534dbbbb4c7fc120
Authentihash SHA256
b8eb26b6f79020ae988e4fb752dc06e1b6779749bf4f8df2872fc2b92bab8020
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 24 · HVCI FALSE
MD5
adc1e141b57505fd011bc1efb1ae6967
SHA1
d28b604b9bb608979cc0eab1e9e93e11c721aa3d
SHA256
1c425793a8ce87be916969d6d7e9dd0687b181565c3b483ce53ad1ec6fb72a17
Imphash
543f80399f79401471523d335ea61642
Authentihash MD5
a17d227444e090ff69e24fcb6d43162b
Authentihash SHA1
43d3a3c1f7b14cfcc051cae2534dbbbb4c7fc120
Authentihash SHA256
b8eb26b6f79020ae988e4fb752dc06e1b6779749bf4f8df2872fc2b92bab8020
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 25 · HVCI FALSE
MD5
2e887e52e45bba3c47ccd0e75fc5266f
SHA1
022f7aa4d0f04d594588ae9fa65c90bcc4bda833
SHA256
d21aba58222930cb75946a0fb72b4adc96de583d3f7d8dc13829b804eb877257
Imphash
543f80399f79401471523d335ea61642
Authentihash MD5
a17d227444e090ff69e24fcb6d43162b
Authentihash SHA1
43d3a3c1f7b14cfcc051cae2534dbbbb4c7fc120
Authentihash SHA256
b8eb26b6f79020ae988e4fb752dc06e1b6779749bf4f8df2872fc2b92bab8020
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 26 · HVCI FALSE
MD5
7f7b8cde26c4943c9465e412adbb790f
SHA1
879e92a7427bdbcc051a18bbb3727ac68154e825
SHA256
08828990218ebb4415c1bb33fa2b0a009efd0784b18b3f7ecd3bc078343f7208
Imphash
690a0fb27a0c47c785d6bbbfc2e56501
Authentihash MD5
55466195f0b2f4afc4243b43a806e6d9
Authentihash SHA1
38b353d8480885de5dcf299deca99ce4f26a1d20
Authentihash SHA256
5182caf10de9cec0740ecde5a081c21cdc100d7eb328ffe6f3f63183889fec6b
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 27 · HVCI FALSE
MD5
86635fdc8e28957e6c01fc483fe7b020
SHA1
089411e052ea17d66033155f77ae683c50147018
SHA256
1cedd5815bb6e20d3697103cfc0275f5015f469e6007e8cac16892c97731c695
Imphash
7363079b9aae7d58bd33c691a613c83c
Authentihash MD5
538e5e595c61d2ea8defb7b047784734
Authentihash SHA1
4a68c2d7a4c471e062a32c83a36eedb45a619683
Authentihash SHA256
478c36f8af7844a80e24c1822507beef6314519185717ec7ae224a0e04b2f330
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 28 · HVCI FALSE
MD5
e6ea0e8d2edcc6cad3c414a889d17ac4
SHA1
9db1585c0fab6a9feb411c39267ac4ad29171696
SHA256
a0dd3d43ab891777b11d4fdcb3b7f246b80bc66d12f7810cf268a5f6f4f8eb7b
Imphash
cde9174249f04dad0f79890c976c0792
Authentihash MD5
cfe667280acf69d4b5d0e2dbc76510e4
Authentihash SHA1
b3249bacda6e43aa2c46c2af802c9ee0b7e2fd7b
Authentihash SHA256
3c9829a16eb85272b0e1a2917feffaab8ddb23e633b168b389669339a0cee0b5
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 29 · HVCI FALSE
MD5
0d992b69029d1f23a872ff5a3352fb5b
SHA1
b5dfa3396136236cc9a5c91f06514fa717508ef5
SHA256
0aca4447ee54d635f76b941f6100b829dc8b2e0df27bdf584acb90f15f12fbda
Imphash
690a0fb27a0c47c785d6bbbfc2e56501
Authentihash MD5
936e49d3eec0a2f433e9d0115a38a2b6
Authentihash SHA1
5717bf3e520accfff5ad9943e53a3b118fb67f2e
Authentihash SHA256
918d2e68a724b58d37443aea159e70bf8b1b5ebb089c395cad1d62745ecdaa19
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 30 · HVCI FALSE
MD5
b418293e25632c5f377bf034bb450e57
SHA1
22c905fcdd7964726b4be5e8b5a9781322687a45
SHA256
63af3fdb1e85949c8adccb43f09ca4556ae258b363a99ae599e1e834d34c8670
Imphash
690a0fb27a0c47c785d6bbbfc2e56501
Authentihash MD5
936e49d3eec0a2f433e9d0115a38a2b6
Authentihash SHA1
5717bf3e520accfff5ad9943e53a3b118fb67f2e
Authentihash SHA256
918d2e68a724b58d37443aea159e70bf8b1b5ebb089c395cad1d62745ecdaa19
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 31 · HVCI FALSE
MD5
f4b2580cf0477493908b7ed81e4482f8
SHA1
57cc324326ab6c4239f8c10d2d1ce8862b2ce4d5
SHA256
d7a61c671eab1dfaa62fe1088a85f6d52fb11f2f32a53822a49521ca2c16585e
Imphash
543f80399f79401471523d335ea61642
Authentihash MD5
a17d227444e090ff69e24fcb6d43162b
Authentihash SHA1
43d3a3c1f7b14cfcc051cae2534dbbbb4c7fc120
Authentihash SHA256
b8eb26b6f79020ae988e4fb752dc06e1b6779749bf4f8df2872fc2b92bab8020
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 32 · HVCI FALSE
MD5
bc5366760098dc14ec00ae36c359f42b
SHA1
ba3faca988ff56f4850dede2587d5a3eff7c6677
SHA256
a10b4ed33a13c08804da8b46fd1b7bd653a6f2bb65668e82086de1940c5bb5d1
Imphash
543f80399f79401471523d335ea61642
Authentihash MD5
a17d227444e090ff69e24fcb6d43162b
Authentihash SHA1
43d3a3c1f7b14cfcc051cae2534dbbbb4c7fc120
Authentihash SHA256
b8eb26b6f79020ae988e4fb752dc06e1b6779749bf4f8df2872fc2b92bab8020
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 33 · HVCI FALSE
MD5
7c40ec9ed020cc9404de8fe3a5361a09
SHA1
3d3b42d7b0af68da01019274e341b03d7c54f752
SHA256
e6a2b1937fa277526a1e0ca9f9b32f85ab9cb7cb1a32250dd9c607e93fc2924f
Imphash
543f80399f79401471523d335ea61642
Authentihash MD5
a17d227444e090ff69e24fcb6d43162b
Authentihash SHA1
43d3a3c1f7b14cfcc051cae2534dbbbb4c7fc120
Authentihash SHA256
b8eb26b6f79020ae988e4fb752dc06e1b6779749bf4f8df2872fc2b92bab8020
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 34 · HVCI FALSE
MD5
b971b79bdca77e8755e615909a1c7a9f
SHA1
398e8209e5c5fdcb6c287c5f9561e91887caca7d
SHA256
5da0ffe33987f8d5fb9c151f0eff29b99f42233b27efcad596add27bdc5c88ff
Imphash
543f80399f79401471523d335ea61642
Authentihash MD5
a17d227444e090ff69e24fcb6d43162b
Authentihash SHA1
43d3a3c1f7b14cfcc051cae2534dbbbb4c7fc120
Authentihash SHA256
b8eb26b6f79020ae988e4fb752dc06e1b6779749bf4f8df2872fc2b92bab8020
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 35 · HVCI FALSE
MD5
96c850e53caca0469e1c4604e6c1aad1
SHA1
dbf3abdc85d6a0801c4af4cd1b77c44d5f57b03e
SHA256
4eb1b9f3fe3c79f20c9cdeba92f6d6eb9b9ed15b546851e1f5338c0b7d36364b
Imphash
690a0fb27a0c47c785d6bbbfc2e56501
Authentihash MD5
936e49d3eec0a2f433e9d0115a38a2b6
Authentihash SHA1
5717bf3e520accfff5ad9943e53a3b118fb67f2e
Authentihash SHA256
918d2e68a724b58d37443aea159e70bf8b1b5ebb089c395cad1d62745ecdaa19
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 36 · HVCI FALSE
MD5
cb22776d06f1e81cc87faeb0245acde8
SHA1
8347487b32b993da87275e3d44ff3683c8130d33
SHA256
a6c05b10a5c090b743a61fa225b09e390e2dd2bd6cb4fd96b987f1e0d3f2124a
Imphash
543f80399f79401471523d335ea61642
Authentihash MD5
a17d227444e090ff69e24fcb6d43162b
Authentihash SHA1
43d3a3c1f7b14cfcc051cae2534dbbbb4c7fc120
Authentihash SHA256
b8eb26b6f79020ae988e4fb752dc06e1b6779749bf4f8df2872fc2b92bab8020
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 37 · HVCI FALSE
MD5
1440c0da81c700bd61142bc569477d81
SHA1
4a2bb97d395634b67194856d79a1ee5209aa06a7
SHA256
7fc01f25c4c18a6c539cda38fdbf34b2ff02a15ffd1d93a7215e1f48f76fb3be
Imphash
690a0fb27a0c47c785d6bbbfc2e56501
Authentihash MD5
936e49d3eec0a2f433e9d0115a38a2b6
Authentihash SHA1
5717bf3e520accfff5ad9943e53a3b118fb67f2e
Authentihash SHA256
918d2e68a724b58d37443aea159e70bf8b1b5ebb089c395cad1d62745ecdaa19
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 38 · HVCI FALSE
MD5
70c2c29643ee1edd3bbcd2ef1ffc9a73
SHA1
62244c704b0f227444d3a515ea0dc1003418a028
SHA256
67cd6166d791bdf74453e19c015b2cb1e85e41892c04580034b65f9f03fe2e79
Imphash
543f80399f79401471523d335ea61642
Authentihash MD5
a17d227444e090ff69e24fcb6d43162b
Authentihash SHA1
43d3a3c1f7b14cfcc051cae2534dbbbb4c7fc120
Authentihash SHA256
b8eb26b6f79020ae988e4fb752dc06e1b6779749bf4f8df2872fc2b92bab8020
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 39 · HVCI FALSE
MD5
ddb7da975d90b2a9c9c58e1af55f0285
SHA1
977fd907b6a2509019d8ef4f6213039f2523f2b5
SHA256
d9a3dc47699949c8ec0c704346fb2ee86ff9010daa0dbac953cfa5f76b52fcd1
Imphash
cde9174249f04dad0f79890c976c0792
Authentihash MD5
cfe667280acf69d4b5d0e2dbc76510e4
Authentihash SHA1
b3249bacda6e43aa2c46c2af802c9ee0b7e2fd7b
Authentihash SHA256
3c9829a16eb85272b0e1a2917feffaab8ddb23e633b168b389669339a0cee0b5
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 40 · HVCI FALSE
MD5
72acbdd8fac58b71b301980eab3ebfc8
SHA1
d57c732050d7160161e096a8b238cb05d89d1bb2
SHA256
11208bbba148736309a8d2a4ab9ab6b8f22f2297547b100d8bdfd7d413fe98b2
Imphash
7363079b9aae7d58bd33c691a613c83c
Authentihash MD5
538e5e595c61d2ea8defb7b047784734
Authentihash SHA1
4a68c2d7a4c471e062a32c83a36eedb45a619683
Authentihash SHA256
478c36f8af7844a80e24c1822507beef6314519185717ec7ae224a0e04b2f330
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 41 · HVCI FALSE
MD5
260eef181a9bf2849bfec54c1736613b
SHA1
0f78974194b604122b1cd4e82768155f946f6d24
SHA256
b749566057dee0439f54b0d38935e5939b5cb011c46d7022530f748ebc63efe5
Imphash
690a0fb27a0c47c785d6bbbfc2e56501
Authentihash MD5
936e49d3eec0a2f433e9d0115a38a2b6
Authentihash SHA1
5717bf3e520accfff5ad9943e53a3b118fb67f2e
Authentihash SHA256
918d2e68a724b58d37443aea159e70bf8b1b5ebb089c395cad1d62745ecdaa19
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 42 · HVCI FALSE
MD5
aa55dd14064cb808613d09195e3ba749
SHA1
604870e76e55078dfb8055d49ae8565ed6177f7c
SHA256
3ac8e54be2804f5fa60d0d23a11ba323fba078a942c96279425aabad935b8236
Imphash
690a0fb27a0c47c785d6bbbfc2e56501
Authentihash MD5
55466195f0b2f4afc4243b43a806e6d9
Authentihash SHA1
38b353d8480885de5dcf299deca99ce4f26a1d20
Authentihash SHA256
5182caf10de9cec0740ecde5a081c21cdc100d7eb328ffe6f3f63183889fec6b
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
RTCore64.sysSample 43 · HVCI FALSE
MD5
710b290a00598fbb1bcc49b30174b2c9
SHA1
1e6c2763f97e4275bba581de880124d64666a2fe
SHA256
bbbeb5020b58e6942ec7dec0d1d518e95fc12ddae43f54ef0829d3393c6afd63
Imphash
690a0fb27a0c47c785d6bbbfc2e56501
Authentihash MD5
936e49d3eec0a2f433e9d0115a38a2b6
Authentihash SHA1
5717bf3e520accfff5ad9943e53a3b118fb67f2e
Authentihash SHA256
918d2e68a724b58d37443aea159e70bf8b1b5ebb089c395cad1d62745ecdaa19
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal

Recorded command

sc.exe create RTCore64.sys binPath=C:\windows\temp\RTCore64.sys type=kernel && sc.exe start RTCore64.sys

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references