Driver intelligenceVulnerableVerified

AppVkgr.sys

AppVkgr.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / fbd12dbb-434e-4950-887a-382b681e8a5aADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

AppVkgr.sysSample 1 · HVCI TRUE

MD5: d788954cd8f0aa8b45dc497a1653465e
SHA1: 9d09495b4f0f4e67d2b0e9317e0dda549d56272e
SHA256: 70b47bd596e76297ded3b096839082bc31f79ef58cdffeaac7308e8b9565a6d5
Imphash: 9a763a78d71db4c69cfc550b2d5f9aad
Authentihash MD5: 7e402a7f968b288aca8fc0f249067ea8
Authentihash SHA1: 7d02a3deea214b20f9ce894ea9661498503bed74
Authentihash SHA256: 8d1b302e903bcc0f658b2aaa9d27f5845f08f4f5a1263e2a8f3a713769af9f8b
Machine: AMD64
Version: Not recorded
Publisher: Not recorded

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create AppVkgr binPath=C:\windows\temp\AppVkgr.sys type=kernel && sc.exe start AppVkgr

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint