rtcore64.sys

RTCore64.sys is the kernel driver that ships with MSI Afterburner and MSI Center, MSI's hardware monitoring and overclocking tools. Millions of gamers have it on their machines because Afterburner is the de facto utility for fan curves, GPU tuning, and on-screen overlays.

Older versions are on the public LOLDrivers list because of CVE-2019-16098: any local user on the machine can read and write arbitrary kernel memory, I/O ports, and processor model-specific registers through the driver's IOCTL interface. The same low-level access that lets Afterburner read GPU temperatures is the access that, in the vulnerable build, anything else on the machine could use.

Why it persists: MSI patched newer Afterburner releases, but the older signed driver still loads on modern Windows. Code-signing certificates are not revoked on a driver vulnerability the way an SSL certificate would be, and even when revoked, Windows still loads signed drivers. Updating Afterburner does not retroactively remove the older driver from every machine that ever installed it.

On the public record: security researchers (Picus, Sophos, SC Media) have documented criminal data-extortion groups dropping RTCore64.sys onto already-compromised systems and using it to disable endpoint protection products before encrypting files. The driver's presence on a gamer's machine is overwhelmingly the legitimate MSI utility; on an incident-response engagement it is one of the well-known tools attackers bring with them.

If this driver is on your system, the simplest explanation is that you have MSI hardware and installed the legitimate MSI utilities. Update MSI Center to the current version; if Windows' own Vulnerable Driver Blocklist starts complaining about an older Afterburner install, that is the same signal, and the same fix.

rtcore64.sys is listed as a known-vulnerable driver on the public LOLDrivers project. 35 distinct binary hashes matching this filename are on record, meaning multiple versions of the file have been observed.