Driver intelligenceVulnerableVerified

FDMCJHJYXZITI.sys

FDMCJHJYXZITI.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / f650dfc3-d3a1-4a9a-8b71-c599d1f9579cADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

FDMCJHJYXZITI.sysSample 1 · HVCI FALSE

MD5: 622cca8e67e9056955e0aeb55716a68f
SHA1: d4c584732fa9abd7d7eb83e169686764c500f2e0
SHA256: 177227f68cc28ee7726381b95f7d2215da35be3750157ebcb7e113201059026c
Imphash: e3c915c62d33052b715b0a50dfa2d89d
Authentihash MD5: be3cf8458143f2e2f47481043a18e6f5
Authentihash SHA1: 129f2f059513ae62d0f63e3644cbfa7b671b938b
Authentihash SHA256: 14deaf22605904971fe757778cec9e46a0fd59a1895491760740404843929481
Machine: AMD64
Version: 1.1.3.0
Publisher: Advanced Micro Devices

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create FDMCJHJYXZITI binPath=C:\windows\temp\FDMCJHJYXZITI.sys type=kernel && sc.exe start FDMCJHJYXZITI

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint