Driver intelligenceVulnerableVerified

AIDA64Driver.sys

AIDA64Driver.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / deffeb8d-c7d9-46b9-a921-7d8d096460efADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

AIDA64Driver.sysSample 1 · HVCI FALSE

MD5: 3f053c140e788ae8c230be5b741dc260
SHA1: 52626d3ebd1576c6475c45dc511098da37e9beea
SHA256: 7790ab2136def33afc6c86d64da81c2e1bc25d34e33282c987961cdaa87e4330
Imphash: fd295cdeb4c0d5d8f45aaa5c66357108
Authentihash MD5: 6d811d4e09a4da41296f21d92bfe4279
Authentihash SHA1: 0a0dcd8a8b4ef739c248776dd6ed771baf26ee0b
Authentihash SHA256: 7c3328c3734cf58532a0f67149955bb66a2a5cf72d43b383b956e2ebda1f112d
Machine: AMD64
Version: Not recorded
Publisher: Not recorded

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create AIDA64Driver binPath=C:\windows\temp\AIDA64Driver.sys type=kernel && sc.exe start AIDA64Driver

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint