← writing

vulnerable drivers

a live index of publicly known vulnerable Windows kernel drivers (BYOVD), cross-referenced against Microsoft's Vulnerable Driver Block List.

687 public vulnerable drivers

479 samples bypass HVCI

1419 samples in MS blocklist

145 MS-blocked driver families

sources: LOLDrivers · Microsoft block list (v10.0.29545.0) · 2,390 samples · generated 2026-09-18

machine-readable: /drivers.json · /drivers.csv · schema · per-sample hashes in the pro vault

all publicly known vulnerable drivers

87 on Microsoft's blocklist · 230 load despite HVCI enabled

showing 687 of 687 drivers

driver	category	hvci bypass	ms block	reference
_xyzxbqvb.rdu_GFAC_Sys_x64.sys T1068 1 sample	vulnerable driver	none	—	open ↗
1.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
1109.sys T1068 1 sample	vulnerable driver	none	—	open ↗
1fc7aeeff3ab19004d2e53eae8160ab1.sys T1014 1 sample	malicious	bypass (1)	—	open ↗
2.sys T1068 1 sample	malicious	none	blocked	open ↗
2.sys T1068 1 sample	malicious	none	blocked	open ↗
360hvm64.sys 360安全中心 T1562.001 1 sample	vulnerable driver	not evaluated	—	open ↗
360netmon_wfp.sys, 360netmon.sys 360.cn T1562.001 1 sample	vulnerable driver	not evaluated	—	open ↗
4.sys T1068 1 sample	malicious	none	—	open ↗
4118b86e490aed091b1a219dba45f332.sys T1014 1 sample	malicious	bypass (1)	—	open ↗
4748696211bd56c2d93c21cab91e82a5.sys T1014 1 sample	malicious	bypass (1)	—	open ↗
5a4fe297c7d42539303137b6d75b150d.sys T1014 1 sample	malicious	bypass (1)	—	open ↗
6771b13a53b9c7449d4891e427735ea2.sys T1014 1 sample	malicious	bypass (1)	—	open ↗
6c8a.sys T1068 1 sample	vulnerable driver	none	—	open ↗
7.sys T1068 1 sample	malicious	none	—	open ↗
80.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
81.sys T1068 3 samples	vulnerable driver	none	blocked	open ↗
834761775.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
8492937_2_Driver.sys T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
927e3aef03a8355d236230cace376b3023480a40c5ac08453c07dab343dd1f11 T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
a236e7d654cd932b7d11cb604629a2d0.sys T1014 1 sample	malicious	bypass (1)	—	open ↗
a26363e7b02b13f2b8d697abb90cd5c3.sys T1014 1 sample	malicious	bypass (1)	—	open ↗
a9df5964635ef8bd567ae487c3d214c4.sys T1014 1 sample	malicious	bypass (1)	—	open ↗
AccelLid.sys ECSl (E) Education T1068 2 samples	vulnerable driver	bypass (1)	—	open ↗
ACE-BASE.sys ANTICHEATEXPERT.COM CVE-2024-22830 T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
ACPIx86.sys T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
ADRMDRVSYS.sys ADLINK Technology, Inc. T1068 6 samples	vulnerable driver	none	—	open ↗
ADV64DRV.sys FUJITSU LIMITED. T1068 1 sample	vulnerable driver	none	—	open ↗
AdvCare.sys Advantech Co., Ltd. T1068 1 sample	vulnerable driver	none	—	open ↗
Afd.sys Microsoft Corporation CVE-2023-21768 +1 T1068 2 samples	vulnerable driver	bypass (2)	—	open ↗
Agent64.sys Phoenix Technologies T1068 6 samples	vulnerable driver	none	—	open ↗
AIDA64Driver.sys T1068 1 sample	vulnerable driver	none	—	open ↗
Air_SYSTEM10.sys T1068 1 sample	malicious	none	—	open ↗
Alinubx.sys, nvfsflt64.sys CnCrypt Foundation T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
ALSysIO64.sys Arthur Liberman T1068 4 samples	vulnerable driver	bypass (1)	—	open ↗
Amd_RPMC_BiosToolCommonDriver.sys Advanced Micro Devices T1068 1 sample	vulnerable driver	none	—	open ↗
AMDPowerProfiler.sys Advanced Micro Devices, Inc. CVE-2021-26334 T1068 3 samples	vulnerable driver	none	—	open ↗
AMDRyzenMasterDriver.sys Advanced Micro Devices T1068 11 samples	vulnerable driver	none	—	open ↗
amifldrv64.sys, amifldrv.sys Windows (R) Win 7 DDK provider T1068 24 samples	vulnerable driver	bypass (7)	—	open ↗
amigendrv64.sys T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
amp.sys CYREN Inc. T1068 1 sample	vulnerable driver	none	—	open ↗
ampa.sys T1068 1 sample	vulnerable driver	bypass (1)	—	—
ampg.sys Microsoft Corporation T1562.001 1 sample	malicious	not evaluated	—	open ↗
amsdk.sys Copyright 2018. T1068 1 sample	vulnerable driver	none	—	open ↗
amsdk.sys WatchDogDevelopment.com, LLC. T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
AODDriver.sys Advanced Micro Devices T1068 13 samples	vulnerable driver	bypass (6)	—	open ↗
AppShopDrv103.sys ASRock Incorporation T1068 1 sample	vulnerable driver	none	—	open ↗
AppVkgr.sys T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
ardrv.sys, ardrv_1.sys, ardrv_2.sys, ardrv_3.sys, ardrv_4.sys, ardrv_6.sys, ardrv_7.sys, ardrv_8.sys, ardrv_9.sys, ardrv_10.sys, ardrv_11.sys, ardrv_13.sys, ardrv_14.sys, ardrv_15.sys, ardrv_16.sys OPSWAT, Inc. CVE-2026-36425 T1068 16 samples	vulnerable driver	bypass (1)	—	open ↗
ArgusMonitor.sys Argotronic eGbR T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
asas.sys T1068 1 sample	vulnerable driver	none	—	open ↗
asio.sys, AsIO32.sys, AsIO3.sys, AsIO3_64.sys, AsIO2.sys Asustek Computer Inc. T1068 37 samples	vulnerable driver	bypass (14)	blocked	open ↗
ASIO32.sys T1068 6 samples	vulnerable driver	none	blocked	open ↗
AsmIo64.sys Asmedia Technology Inc. T1542, T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
asmmap64.sys ASUS, ASUSTeK Computer Inc. T1068 4 samples	vulnerable driver	none	—	open ↗
AsrAutoChkUpdDrv_1_0_32.sys ASRock Incorporation T1068 1 sample	vulnerable driver	none	—	open ↗
AsrAutoChkUpdDrv.sys ASRock Incorporation T1068 1 sample	vulnerable driver	none	—	open ↗
AsrCDDrv.sys ASRock Incorporation T1068 1 sample	vulnerable driver	none	—	open ↗
AsrDrv.sys ASRock Incorporation T1068 4 samples	vulnerable driver	none	—	open ↗
AsrDrv10.sys ASRock Incorporation T1068 1 sample	vulnerable driver	none	blocked	open ↗
AsrDrv101.sys ASRock Incorporation T1068 1 sample	vulnerable driver	none	blocked	open ↗
AsrDrv102.sys ASRock Incorporation T1068 1 sample	vulnerable driver	none	blocked	open ↗
AsrDrv103.sys ASRock Incorporation T1068 1 sample	vulnerable driver	none	blocked	open ↗
asrdrv104.sys ASRock Incorporation T1068 7 samples	vulnerable driver	none	—	open ↗
AsrDrv106.sys ASRock Incorporation T1068 2 samples	vulnerable driver	none	—	open ↗
AsrDrv107.sys, AsrDrv107n.sys ASRock Incorporation CVE-2020-15368 T1068 2 samples	vulnerable driver	not evaluated	—	open ↗
AsrIbDrv.sys RW-Everything T1068 1 sample	vulnerable driver	none	—	open ↗
AsrOmgDrv.sys ASRock Incorporation T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
AsrRapidStartDrv.sys RW-Everything T1068 1 sample	vulnerable driver	none	—	open ↗
AsrSetupDrv103.sys RW-Everything T1068 10 samples	vulnerable driver	none	—	open ↗
AsrSmartConnectDrv.sys RW-Everything T1068 1 sample	vulnerable driver	none	—	open ↗
Astra64.sys Licensed for Sysinfo Lab T1068 1 sample	vulnerable driver	none	—	open ↗
AsUpIO.sys, AsUpIO64.sys T1068 4 samples	vulnerable driver	bypass (3)	blocked	open ↗
AsusSAIO.sys, ASUSSAIO ASUSTeK COMPUTER INC. CVE-2024-55408 T1068 32 samples	vulnerable driver	not evaluated	—	open ↗
aswArPot.sys AVG Technologies CZ, s.r.o., AVAST Software CVE-2022-26522 +1 T1068 3 samples	vulnerable driver	none	—	open ↗
aswArPot.sys, avgArPot.sys AVG Technologies CZ, s.r.o., AVAST Software T1068 39 samples	vulnerable driver	bypass (13)	—	open ↗
aswVmm.sys AVAST Software T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
athpexnt.sys AhnLab, Inc. T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
atidsmxx.sys, AtiDCM Advanced Micro Devices, Inc. T1068 1 sample	vulnerable driver	none	—	open ↗
atillk64.sys ATI Technologies Inc., Overclocking Tool T1068 6 samples	vulnerable driver	none	—	open ↗
atillk64.sys ATI Technologies Inc. T1068 3 samples	vulnerable driver	none	—	open ↗
atlAccess.sys Windows (R) Win 7 DDK provider T1068 1 sample	vulnerable driver	none	—	open ↗
atomicredteamcapcom.sys T1068 1 sample	vulnerable driver	none	—	open ↗
ATSZIO.sys ASUSTek Computer Inc. T1068 9 samples	vulnerable driver	bypass (2)	—	open ↗
ATSZIO.sys, ATSZIO64.sys ASUSTek Computer Inc. CVE-2024-33222 T1068 2 samples	vulnerable driver	none	—	open ↗
avalueio.sys Avalue Technology Inc. T1068 2 samples	vulnerable driver	none	—	open ↗
avkiller.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
b.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
b1.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
b3.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
b4.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
bandai.sys T1068 2 samples	vulnerable driver	none	—	open ↗
BdApiUtil.sys Baidu, Inc. T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
BdApiUtil.sys Baidu, Inc. T1068 1 sample	vulnerable driver	none	—	open ↗
BdApiUtil64.sys Baidu, Inc. T1068 2 samples	vulnerable driver	not evaluated	—	open ↗
be6318413160e589080df02bb3ca6e6a.sys T1014 1 sample	malicious	bypass (1)	—	open ↗
bedaisy.sys T1068 34 samples	vulnerable driver	none	—	open ↗
bin_intigua_driver64.sys Intigua T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
BioNTdrv.sys Paragon Software GmbH CVE-2025-0285 +4 T1068 6 samples	vulnerable driver	not evaluated	—	open ↗
BiosToolCommonDriver.sys Advanced Micro Devices T1068 1 sample	vulnerable driver	none	—	open ↗
Black.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
Blackbone.sys T1068 1 sample	vulnerable driver	none	—	open ↗
BlackBoneDrv10.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
blacklotus_driver.sys T1068 7 samples	malicious	bypass (7)	—	open ↗
bootrepair.sys LENOVO T1068 1 sample	vulnerable driver	none	—	open ↗
Bs_Def.sys AsusTek Computer Inc. T1068 1 sample	vulnerable driver	none	—	open ↗
BS_Def64.sys AsusTek Computer Inc. T1068 3 samples	vulnerable driver	none	—	open ↗
BS_Flash64.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
BS_HWMIO64_W10.sys BIOSTAR Group T1068 1 sample	vulnerable driver	none	—	open ↗
bs_hwmio64.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
BS_HWMIo64.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
BS_I2c64.sys, BS_I2cIo.sys BIOSTAR Group T1068 1 sample	vulnerable driver	none	—	open ↗
BS_I2cIo.sys BIOSTAR Group T1068 1 sample	vulnerable driver	none	—	open ↗
BS_RCIO.sys T1068 1 sample	vulnerable driver	none	—	open ↗
bs_rcio64.sys T1068 1 sample	vulnerable driver	none	—	open ↗
BS_RCIO64.sys BIOSTAR Group T1068 2 samples	vulnerable driver	none	—	open ↗
BS_RCIOW1064.sys T1068 1 sample	vulnerable driver	none	—	open ↗
BS_RVSIO64.sys BIOSTAR Group T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
bsitf.sys, AsusBSItf.sys, ASUS BIOS Flash Driver ASUSTeK COMPUTER INC., ASUSTek Computer Inc. CVE-2024-33221 T1068 14 samples	vulnerable driver	bypass (2)	—	open ↗
BSMEM64_W10.sys, BSMEM BIOSTAR Group T1068 1 sample	vulnerable driver	none	—	open ↗
BSMEMx64.sys BIOSTAR Group T1068 1 sample	vulnerable driver	none	—	open ↗
BSMI.sys, BSMIXP64.sys T1068 1 sample	vulnerable driver	none	—	open ↗
BSMIx64.sys T1068 1 sample	vulnerable driver	none	—	open ↗
burntcigar.sys T1068 1 sample	malicious	not evaluated	—	open ↗
bw.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
bwrs.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
bwrsh.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
c.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
c94f405c5929cfcccc8ad00b42c95083.sys T1014 1 sample	malicious	bypass (1)	—	open ↗
capcom.sys T1068 7 samples	vulnerable driver	none	blocked	open ↗
capcom2.sys T1068 1 sample	vulnerable driver	none	—	open ↗
CardIo64.sys T1068 1 sample	vulnerable driver	none	—	open ↗
CcProtect.sys CnCrypt Foundation T1562.001 1 sample	vulnerable driver	not evaluated	—	open ↗
cg6kwin2k.sys NMS Communications CVE-2024-29216 T1068 2 samples	vulnerable driver	none	—	open ↗
changsha CrowdStrike, Inc. T1068 1 sample	malicious	not evaluated	—	open ↗
Chaos-Rootkit.sys T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
Chaos-Rootkit.sys T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
chinese_cheat_driver.sys T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
CITMDRV_AMD64.sys T1068 16 samples	vulnerable driver	bypass (13)	—	open ↗
CITMDRV_IA64.sys T1068 20 samples	vulnerable driver	bypass (10)	—	open ↗
CmUpx.sys Realtek Semiconductor Corp. T1068 1 sample	vulnerable driver	none	—	open ↗
Cndom6.sys, XiaoH.sys, rwdriver.sys T1068 3 samples	malicious	not evaluated	—	open ↗
ComputerZ.Sys 360.cn, ludashi.com, 鲁大师, Z武器, ComputerZ T1068 50 samples	vulnerable driver	bypass (10)	—	open ↗
ControlCenter.sys Quanta T1068 1 sample	vulnerable driver	none	—	open ↗
CorMem.sys Teledyne Digital Imaging Inc. T1068 1 sample	vulnerable driver	none	—	open ↗
CorsairLLAccess64.sys Corsair Memory, Inc. T1068 5 samples	vulnerable driver	none	—	open ↗
CorsairLLAccess64.sys Corsair Memory, Inc. T1068 2 samples	vulnerable driver	bypass (2)	—	open ↗
CP2X72C.SYS Interface Corporation T1068 5 samples	vulnerable driver	none	—	open ↗
cpqsysio64.sys Hewlett-Packard, Hewlett Packard Enterprise T1068 2 samples	vulnerable driver	none	—	open ↗
cpupress.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
cpuz_x64.sys Windows (R) Server 2003 DDK provider T1068 1 sample	vulnerable driver	none	—	open ↗
cpuz.sys CPUID, Windows (R) Codename Longhorn DDK provider, Windows (R) Win 7 DDK provider, Windows (R) Server 2003 DDK provider T1068 100 samples	vulnerable driver	none	—	open ↗
cpuz.sys CPUID, Windows (R) Win 7 DDK provider, Windows (R) Codename Longhorn DDK provider T1068 45 samples	vulnerable driver	none	—	open ↗
cpuz141.sys CPUID T1068 1 sample	vulnerable driver	none	—	open ↗
CSAgent.sys CrowdStrike, Inc. T1014 1 sample	malicious	not evaluated	—	open ↗
CSAgent.sys CrowdStrike, Inc. T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
CSAgent.sys CrowdStrike, Inc. T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
CSAgent.sys CrowdStrike, Inc. T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
CSC.sys Microsoft Corporation CVE-2024-26229 T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
CtiIo64.sys Creative Technology Innovation Co., LTd. T1068 1 sample	vulnerable driver	none	—	open ↗
CupFixerx64.sys Windows (R) Win 7 DDK provider T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
cyvrlpc.sys Palo Alto Networks, Inc. T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
d.sys T1068 1 sample	vulnerable driver	bypass (1)	blocked	open ↗
d2.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
d3.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
d39DuiY9sxtDSiu4LSvS.sys, wifis.sys T1547.006 1 sample	malicious	not evaluated	—	open ↗
d4.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
d591004.sys T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
daxin_blank.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
daxin_blank1.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
daxin_blank2.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
daxin_blank3.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
daxin_blank4.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
daxin_blank5.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
daxin_blank6.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
dbk64.sys T1068 2 samples	vulnerable driver	bypass (1)	—	open ↗
dbutil_2_3.sys T1068 4 samples	vulnerable driver	bypass (1)	—	open ↗
dbutil.sys T1068 4 samples	vulnerable driver	none	—	open ↗
DBUtilDrv2.sys Dell T1068 2 samples	vulnerable driver	bypass (2)	—	open ↗
DcProtect.sys Windows (R) Win 7 DDK provider T1068 8 samples	vulnerable driver	bypass (8)	—	open ↗
dcr.sys T1068 1 sample	vulnerable driver	none	—	open ↗
DCRCVDrv.sys MOCOMSYS & DCRC T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
DDDriver.sys Dell Computer Corporation T1068 1 sample	vulnerable driver	none	—	open ↗
dddriver64Dcsa.sys Dell Inc. T1068 2 samples	vulnerable driver	bypass (1)	—	open ↗
dellbios.sys T1068 11 samples	vulnerable driver	bypass (5)	—	open ↗
dellinstrumentation.sys Dell T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
deresute64.sys, andappsvc2_64.sys, usrdrv018064.sys, usrdrv017764.sys, usrdrv017864.sys, wfs64.sys, usrdrv118064.sys, Umamusume64_2.sys T1562.001 8 samples	vulnerable driver	bypass (8)	—	open ↗
devhost.sys T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
devMemDrv.sys Acculogic Inc T1068 1 sample	vulnerable driver	none	—	open ↗
Dh_Kernel_10.sys YY Inc. T1068 1 sample	vulnerable driver	none	—	open ↗
Dh_Kernel.sys YY Inc. T1068 1 sample	vulnerable driver	none	—	open ↗
directio.sys T1068 1 sample	vulnerable driver	none	—	open ↗
DirectIo.sys T1068 6 samples	vulnerable driver	bypass (2)	—	open ↗
DirectIo.sys T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
directio32_legacy.sys, DirectIo32.sys T1068 1 sample	vulnerable driver	none	—	open ↗
DirectIo32.sys T1068 8 samples	vulnerable driver	none	—	open ↗
directio64.sys T1068 10 samples	vulnerable driver	bypass (2)	—	open ↗
directio64.sys, utiA2D4.sys CVE-2025-52347 T1068 2 samples	vulnerable driver	none	—	open ↗
ditpio64.sys T1068 1 sample	vulnerable driver	none	—	open ↗
dkrTK.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
DNDrv.sys Oracle Corporation T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
dpmemio.sys Windows (R) Codename Longhorn DDK provider T1068 2 samples	vulnerable driver	none	—	open ↗
driver_090d409f.sys Pinchins Technology Co.,Ltd. T1068 1 sample	malicious	bypass (1)	—	open ↗
driver_099ef491.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
driver_0a636606.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
driver_0ffb4081.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
driver_146b8f4f.sys Pinchins Technology Co.,Ltd. T1068 1 sample	malicious	bypass (1)	—	open ↗
driver_16773074.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
driver_1a74c2bd.sys Pinchins Technology Co.,Ltd. T1068 1 sample	malicious	bypass (1)	—	open ↗
driver_1afc1d06.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
driver_206006a1.sys Windows (R) Win 7 DDK provider T1068 1 sample	malicious	bypass (1)	—	open ↗
driver_290bc782.sys Microsoft Corporation T1068 1 sample	malicious	bypass (1)	—	open ↗
driver_312c83a9.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
driver_4d8bc539.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
driver_4f9b5a2f.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
driver_4fc254af.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
driver_5c308aed.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
driver_5d61e4ea.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
driver_668c5bea.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
driver_77225a99.sys Tonec Inc. T1068 1 sample	malicious	bypass (1)	—	open ↗
driver_82d928c5.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
driver_85ca0dcd.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
driver_89036534.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
driver_930da474.sys Pinchins Technology Co.,Ltd. T1068 1 sample	malicious	bypass (1)	—	open ↗
driver_981d03e1.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
driver_a6deeea6.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
driver_ab811ca5.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
driver_b4f33ffe.sys Chingachguk & Denger2k T1068 1 sample	malicious	bypass (1)	—	open ↗
driver_bfcbc010.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
driver_c3d48ddd.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
driver_d1ea9e16.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
driver_d9f15d91.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
driver_e1123b59.sys 湖北盾网网络科技有限公司 T1068 1 sample	malicious	bypass (1)	—	open ↗
driver_ef9d653a.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
driver_fdd16a94.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
Driver_win10.sys, Filter.sys T1068 3 samples	vulnerable driver	bypass (1)	—	open ↗
driver7-x64.sys ASUStek T1068 1 sample	vulnerable driver	none	—	open ↗
driver7-x86-withoutdbg.sys ASUStek T1068 1 sample	vulnerable driver	none	—	open ↗
driver7-x86.sys ASUStek T1068 1 sample	vulnerable driver	none	—	open ↗
Driver7.sys ASUStek T1068 1 sample	vulnerable driver	none	—	open ↗
DriversCloud_amd64.sys CybelSoft T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
DsArk64.sys, DsArk.sys 360.cn T1068 4 samples	vulnerable driver	bypass (2)	—	open ↗
dtr_ec.sys Dell Technologies T1068 1 sample	vulnerable driver	none	—	open ↗
dXIw8eZ9aYxQYzgm.sys T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
e29f6311ae87542b3d693c1f38e4e3ad.sys T1014 1 sample	malicious	bypass (1)	—	open ↗
e939448b28a4edc81f1f974cebf6e7d2.sys T1014 1 sample	malicious	bypass (1)	—	open ↗
echo_driver.sys T1134 5 samples	vulnerable driver	none	—	open ↗
ecsiodriverx64.sys Elitegroup Computer Systems T1068 2 samples	vulnerable driver	none	—	open ↗
ef0e1725aaf0c6c972593f860531a2ea.sys T1014 1 sample	malicious	bypass (1)	—	open ↗
EIO.sys ASUSTeK Computer Inc. T1068 4 samples	vulnerable driver	none	—	open ↗
elbycdio.sys Elaborate Bytes AG, Elaborate Bytes CVE-2009-0824 T1068 32 samples	vulnerable driver	bypass (7)	—	open ↗
ElbyCDIO.sys Elaborate Bytes AG T1068 10 samples	vulnerable driver	none	—	open ↗
elrawdsk.sys EldoS Corporation T1068 2 samples	vulnerable driver	bypass (2)	—	open ↗
ene.sys T1068 4 samples	vulnerable driver	none	—	open ↗
eneio64.sys T1068 2 samples	vulnerable driver	bypass (2)	—	open ↗
EneIo64.sys T1068 1 sample	vulnerable driver	none	—	open ↗
energydriver.sys T1068 2 samples	vulnerable driver	bypass (1)	—	open ↗
EneTechIo64.sys T1068 1 sample	vulnerable driver	none	—	open ↗
EnPortv.sys Guidance Software Inc. T1562.001 1 sample	vulnerable driver	not evaluated	—	open ↗
etdsupp.sys HP Development Company T1068 1 sample	vulnerable driver	none	—	open ↗
evga_kernel_driver-x64.sys T1068 1 sample	vulnerable driver	none	—	open ↗
f.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
FairplayKD.sys Multi Theft Auto T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
fastdumpx64.sys CounterTack T1068 1 sample	vulnerable driver	none	—	open ↗
fbiosdrv.sys, Fujitsu BIOS Driver FUJITSU CLIENT COMPUTING LIMITED, FUJITSU LIMITED CVE-2025-65001 T1068 9 samples	vulnerable driver	not evaluated	—	open ↗
fd3b7234419fafc9bdd533f48896ed73_b816c5cd.sys T1068 1 sample	vulnerable driver	none	—	open ↗
FDMCJHJYXZITI.sys Advanced Micro Devices T1068 1 sample	vulnerable driver	none	—	open ↗
fekern.sys, FireEye Realtime Driver, Trellix HX Agent FireEye, Inc. CVE-2025-14963 T1068 2 samples	vulnerable driver	not evaluated	—	open ↗
fgme.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
FH-EtherCAT_DIO.sys T1068 2 samples	vulnerable driver	bypass (1)	—	open ↗
fiddrv.sys T1068 2 samples	vulnerable driver	none	blocked	open ↗
fiddrv64.sys T1068 3 samples	vulnerable driver	none	blocked	open ↗
fidpcidrv.sys T1068 4 samples	vulnerable driver	none	blocked	open ↗
fidpcidrv64.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
fildds.sys Filseclab Corporation T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
filnk.sys Filseclab Corporation T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
filwfp.sys Filseclab Corporation T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
fjfwupgd.sys FUJITSU LIMITED T1068 1 sample	vulnerable driver	none	—	open ↗
FoxKeDriver64.sys Foxconn (R) Corporation T1068 1 sample	vulnerable driver	none	—	open ↗
FPCIE2COM.sys Fintek Corp., Feature Integration Technology Inc. T1068 6 samples	vulnerable driver	bypass (2)	—	open ↗
full.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
fur.sys T1068 1 sample	malicious	none	—	open ↗
GameDriverX64.sys, KSophon_x64.sys GameDriver, PROXIMA BETE CVE-2025-61155 T1068 10 samples	vulnerable driver	not evaluated	—	open ↗
gameink.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
gametersafe.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
GameTerSafe.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
gdrv.sys Windows (R) Server 2003 DDK provider, GIGA-BYTE TECHNOLOGY CO., LTD. T1068 3 samples	vulnerable driver	none	blocked	open ↗
gdrv.sys GIGA-BYTE TECHNOLOGY CO., LTD., Windows (R) Server 2003 DDK provider, Windows (R) 2000 DDK provider T1068 10 samples	vulnerable driver	none	blocked	open ↗
GEDevDrv.SYS GE Intelligent Platforms, Inc., General Electric Company T1068 4 samples	vulnerable driver	none	—	open ↗
gftkyj64.sys, deame.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
GGProtect64.sys 湖南南澳网络科技有限公司 T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
gibepext.sys Group-IB LTD. T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
giveio.sys T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
GLCKIO2.sys T1068 1 sample	vulnerable driver	bypass (1)	blocked	open ↗
GLCKIO2.sys T1068 2 samples	vulnerable driver	none	blocked	open ↗
GlobalVistaVentures_v3.sys T1068 1 sample	vulnerable driver	none	—	open ↗
gmer64.sys, superman.sys GMER T1068 2 samples	malicious	none	—	open ↗
goad.sys T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
GoFly64.sys T1068 1 sample	vulnerable driver	none	—	open ↗
gpcidrv64.sys T1542 1 sample	vulnerable driver	none	—	open ↗
GPU-Z.sys T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
GtcKmdfBs.sys Getac Technology Corporation T1068 5 samples	vulnerable driver	bypass (5)	—	open ↗
gvcidrv64.sys T1068 2 samples	vulnerable driver	bypass (1)	blocked	open ↗
GVCIDrv64.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
HardwareMon-x86.sys Hubei Century Network Technology Co., Ltd. T1068 1 sample	vulnerable driver	none	—	open ↗
hax.sys, IntelHaxm.sys, Intel HAXM, Hardware Accelerated Execution Manager Intel Corporation CVE-2022-21812 T1068 9 samples	vulnerable driver	not evaluated	—	open ↗
hlpdrv.sys T1068 1 sample	malicious	not evaluated	—	open ↗
HOSTNT.sys SafeNet, Inc. T1068 1 sample	vulnerable driver	none	—	open ↗
HP_SWTOOLS_DRIVER.sys, HP_WKS_SWTOOLS_DRIVER.sys HP Inc. T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
hp64vision.sys Windows (R) Codename Longhorn DDK provider T1068 1 sample	vulnerable driver	none	—	open ↗
HpPortIox64.sys HP Inc. T1068 1 sample	vulnerable driver	none	blocked	open ↗
HpPortIox64.sys HP Inc. T1068 1 sample	vulnerable driver	none	blocked	open ↗
hw.sys Marvin Test Solutions, Inc. T1068 1 sample	vulnerable driver	none	—	open ↗
hw.sys Marvin Test Solutions, Inc. T1068 4 samples	vulnerable driver	none	—	open ↗
HW.sys Marvin Test Solutions, Inc. T1068 1 sample	vulnerable driver	none	—	open ↗
HWAuidoOs2Ec.sys, havoc.sys Huawei Device Co., Ltd. T1068 2 samples	vulnerable driver	bypass (1)	—	open ↗
hwdetectng.sys iNFERRE T1068 3 samples	vulnerable driver	none	—	open ↗
HWiNFO32.SYS REALiX(tm) T1068 11 samples	vulnerable driver	none	—	open ↗
HWiNFO64I.SYS REALiX(tm) T1068 1 sample	vulnerable driver	none	—	open ↗
HwOs2Ec10x64.sys, HwOs2Ec.sys, Huawei MateBook Huawei, Huawei Device Co., Ltd. T1068 2 samples	vulnerable driver	bypass (1)	—	open ↗
HwOs2Ec7x64.sys Huawei T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
HwRwDrv.sys Windows® winows 7 driver kits provider T1068 1 sample	vulnerable driver	none	—	open ↗
HwRwDrv.sys Windows® winows 7 driver kits provider T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
idmtdi.sys Tonec Inc., CrowdStrike, Inc., Palo Alto Networks, Inc. T1068 9 samples	malicious	bypass (9)	—	open ↗
IMFForceDelete, IMFForceDelete.sys, ForceDelete.sys IObit CVE-2019-6494 T1562.001 1 sample	vulnerable driver	not evaluated	—	open ↗
ImmunetUtilDriver.sys Cisco Systems, Inc. T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
inetcache.sys T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
inpout32.sys Highresolution Enterprises [www.highrez.co.uk] T1068 5 samples	vulnerable driver	none	—	open ↗
inpoutx64.sys Highresolution Enterprises [www.highrez.co.uk] T1068 3 samples	vulnerable driver	none	—	open ↗
IoAccess.sys T1068 2 samples	vulnerable driver	bypass (1)	—	open ↗
iobios64.sys T1068 1 sample	vulnerable driver	none	—	open ↗
iobitunlocker.sys IObit, IObit Information Technology T1068 24 samples	vulnerable driver	none	—	open ↗
iOCdrv.sys Intel Corporation T1068 1 sample	vulnerable driver	none	—	open ↗
IoManager.sys COMPAL ELECTRONIC INC. T1068 1 sample	vulnerable driver	none	—	open ↗
IOMap64.sys ASUSTeK Computer Inc. CVE-2024-41498 T1068 2 samples	vulnerable driver	none	—	open ↗
iomem64.sys DT Research, Inc. T1068 2 samples	vulnerable driver	none	—	open ↗
ipctype.sys Digital Electronics Corporation T1068 1 sample	vulnerable driver	none	—	open ↗
iQVW64.SYS Intel Corporation T1068 19 samples	vulnerable driver	none	—	open ↗
iqvw64e.sys, iQVW64.SYS, IQVW32.sys, NalDrv.sys Intel Corporation CVE-2015-2291 T1068 1 sample	vulnerable driver	none	—	open ↗
irec.sys T1068 1 sample	vulnerable driver	none	—	open ↗
iscflashx64.sys Insyde Software T1542 1 sample	vulnerable driver	bypass (1)	—	open ↗
isodrivep64.sys CrowdStrike, Inc. T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
isodrivep64.sys T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
IUForceDelete.sys IObit T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
jnprva.sys, neofltr.sys Pulse Secure, LLC T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
jokercontroller.sys T1068 1 sample	vulnerable driver	none	—	open ↗
K7RKScan.sys K7 Computing Pvt. Ltd. T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
K7RKScan.sys K7 Computing Pvt. Ltd. T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
KApcHelper_x64.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
kavservice.bin T1562 1 sample	malicious	not evaluated	—	open ↗
kbdcap64.sys T1068 3 samples	vulnerable driver	none	blocked	open ↗
kdhacker64_ev.sys Kingsoft Corporation T1068 1 sample	vulnerable driver	none	—	open ↗
kdriver.sys T1068 1 sample	vulnerable driver	none	—	open ↗
kernel_utility_driver64.sys, kernel_utility_driver32.sys T1562.001 2 samples	malicious	not evaluated	—	open ↗
kerneld.amd64 T1068 36 samples	vulnerable driver	bypass (8)	—	open ↗
kEvP64.sys PowerTool T1068 7 samples	vulnerable driver	none	—	open ↗
kEvP64.sys PowerTool T1068 2 samples	vulnerable driver	none	—	open ↗
KExplore.sys T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
KfeCo10X64.sys Rivet Networks, LLC. T1068 1 sample	vulnerable driver	none	—	open ↗
KfeCo11X64.sys Rivet Networks, LLC. T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
Khwmon.sys T1068 1 sample	vulnerable driver	none	—	open ↗
Kinkajou.sys T1068 1 sample	vulnerable driver	none	—	open ↗
KKYUM.sys T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
KmWpsMs.sys NComputing Co., Ltd T1068 1 sample	vulnerable driver	none	—	open ↗
KObjExp.sys T1068 2 samples	vulnerable driver	not evaluated	—	open ↗
kprocesshacker.sys wj32 T1068 2 samples	vulnerable driver	none	—	open ↗
KRegExp.sys T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
ksapi.sys Kingsoft Corporation T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
ksapi.sys Kingsoft Corporation T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
KslD.sys, MpKslDrv.sys Microsoft Corporation T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
kt2.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
ktapi.sys Kontron Technology A/S T1562.001 3 samples	vulnerable driver	not evaluated	—	open ↗
ktes.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
ktgn.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
ktmutil7ODM.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
l1malwarebits.sys T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
Lallamon.sys Lallasoft T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
LcTkA.sys T1068 1 sample	malicious	none	—	open ↗
LECOMAx64.sys, LECOMAx.SYS LECO Corporation T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
LenovoDiagnosticsDriver.sys Lenovo Group Limited (R) CVE-2022-3699 T1068 4 samples	vulnerable driver	none	—	open ↗
LgCoreTemp.sys Logitech T1068 2 samples	vulnerable driver	bypass (1)	—	open ↗
LgDataCatcher.sys Windows (R) Win 7 DDK provider T1068 3 samples	vulnerable driver	none	—	open ↗
LgDCatcher.sys NetFilterSDK.com T1068 3 samples	vulnerable driver	none	blocked	open ↗
LHA.sys LG Electronics Inc. T1068 1 sample	vulnerable driver	none	—	open ↗
LHA.sys LG Electronics Inc. T1068 1 sample	vulnerable driver	none	—	open ↗
libnicm.sys Novell, Inc. T1068 5 samples	vulnerable driver	bypass (3)	—	open ↗
libnicm.sys Novell, Inc., Micro Focus T1068 19 samples	vulnerable driver	none	—	open ↗
LMIinfo.sys LogMeIn, Inc. T1068 2 samples	vulnerable driver	bypass (2)	—	open ↗
LnvMSRIO.sys Lenovo CVE-2025-8061 T1068 10 samples	vulnerable driver	none	—	open ↗
lsigetwin_SliffDriver.sys T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
Lurker.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
Lv561av.sys Logitech Inc. T1068 1 sample	vulnerable driver	none	—	open ↗
magdrvamd64.sys T1068 1 sample	vulnerable driver	none	—	open ↗
malicious.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
mapmom.sys T1068 1 sample	vulnerable driver	none	—	open ↗
MemCtl.sys DFI T1068 1 sample	vulnerable driver	none	—	open ↗
MemLoaderCustomize.sys, deletekey.sys T1014 2 samples	malicious	not evaluated	—	open ↗
Mhyprot2.sys, mhyprot.sys T1068 10 samples	vulnerable driver	bypass (2)	—	open ↗
mhyprot3.sys T1068 6 samples	vulnerable driver	none	—	open ↗
mhyprotect.sys T1068 2 samples	vulnerable driver	none	—	open ↗
mhyprotnap.sys T1068 1 sample	vulnerable driver	none	—	open ↗
mhyprotrpg.sys T1068 1 sample	vulnerable driver	none	—	open ↗
mhyprotrpg.Sys T1068 1 sample	vulnerable driver	none	—	open ↗
mimidrv.sys gentilkiwi (Benjamin DELPY) T1068 147 samples	malicious	bypass (1)	—	open ↗
mimikatz.sys T1068 12 samples	malicious	none	—	open ↗
mJj0ge.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
mlgbbiicaihflrnh.sys T1068 1 sample	malicious	none	—	open ↗
Mnemosyne.sys T1068 1 sample	vulnerable driver	none	—	open ↗
Monitor_win10_x64.sys IObit CVE-2018-16712 T1068 1 sample	vulnerable driver	none	—	open ↗
MonProcessEX.sys Honor Device Co., Ltd. T1562.001 1 sample	vulnerable driver	not evaluated	—	open ↗
msio32.sys T1068 1 sample	vulnerable driver	none	—	open ↗
MsIo32.sys CVE-2019-18845 T1068 1 sample	vulnerable driver	none	—	open ↗
MsIo64.sys MICSYS Technology Co., LTd CVE-2020-17382 T1068 1 sample	vulnerable driver	none	—	open ↗
MsIo64.sys MICSYS Technology Co., LTd, MICSYS T1068 6 samples	vulnerable driver	bypass (1)	—	open ↗
MSqPq.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
msr.sys T1068 2 samples	vulnerable driver	none	—	open ↗
msrhook.sys T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
mst.sys Mellanox Technologies Ltd. T1068 1 sample	vulnerable driver	none	—	open ↗
mtcBSv64.sys MiTAC Technology Corporation T1068 1 sample	vulnerable driver	none	—	open ↗
mtxC9CB.sys T1068 1 sample	vulnerable driver	none	—	open ↗
mtxmem.sys Matrox Electronic Systems Ltd. T1068 1 sample	vulnerable driver	none	—	open ↗
My.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
mydrivers.sys MyDrivers.com CVE-2023-1676 T1068 2 samples	vulnerable driver	none	—	open ↗
MyPortIO_x64.sys, MyPortIO_x86.sys, MyPortIO0 Nuvoton Technology Corp. T1068 2 samples	vulnerable driver	not evaluated	—	open ↗
NBIOLib_X64.sys MSI T1068 1 sample	vulnerable driver	none	—	open ↗
NCHGBIOS2x64.SYS TOSHIBA Corporation T1068 2 samples	vulnerable driver	none	—	open ↗
ncpl.sys Novell, Inc. CVE-2013-3956 T1068 1 sample	vulnerable driver	none	—	open ↗
ndislan.sys Microsoft Corporation T1068 1 sample	malicious	bypass (1)	—	open ↗
NeacSafe64.sys, OWNeacSafePort 网易(杭州)网络有限公司杭州 CVE-2025-45737 T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
Netfilter.sys T1068 16 samples	vulnerable driver	none	—	open ↗
netfilter2.sys 宏图无忧, Windows (R) Win 7 DDK provider T1068 25 samples	vulnerable driver	none	—	open ↗
netfilterdrv.sys T1068 7 samples	vulnerable driver	none	blocked	open ↗
netflt.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
NetFlt.sys T1068 2 samples	vulnerable driver	none	blocked	open ↗
NetProxyDriver.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
NetworkLocker_x64.sys T1068 1 sample	vulnerable driver	none	—	open ↗
ngiodriver.sys AVAST Software T1068 12 samples	vulnerable driver	none	—	open ↗
NGStar.sys NITGEN&COMPANY Co., Ltd. T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
ni.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
nicm.sys Novell, Inc. CVE-2013-3956 T1068 18 samples	vulnerable driver	none	—	open ↗
NICM.sys Novell, Inc. T1068 1 sample	vulnerable driver	none	—	open ↗
NICM.SYS Novell, Inc. T1068 3 samples	vulnerable driver	bypass (1)	—	open ↗
nipalk.sys National Instruments Corporation CVE-2021-38304 T1068 2 samples	vulnerable driver	none	—	open ↗
NlsLexicons0024UvN.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
NodeDriver.sys T1068 1 sample	malicious	none	—	open ↗
Novawave_Novabench_NovabenchDriverWin10.sys T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
NPR0.sys noping.com T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
NQrmq.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
nscm.sys Novell, Inc., Micro Focus CVE-2013-3956 T1068 33 samples	vulnerable driver	bypass (4)	—	open ↗
nscm.sys Novell, Inc., Micro Focus T1068 6 samples	vulnerable driver	bypass (2)	—	open ↗
NSecKrnl.sys NSEC Co.,Ltd T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
nstr.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
nstrwsk.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
nt2.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
nt3.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
nt4.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
nt5.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
nt6.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
ntbios_2.sys Microsoft Corporation T1068 1 sample	malicious	bypass (1)	—	open ↗
ntbios.sys Microsoft Corporation T1068 1 sample	malicious	bypass (1)	—	open ↗
NTIOLib_X64.sys MSI T1068 1 sample	vulnerable driver	none	—	open ↗
NTIOLib.sys MSI T1068 5 samples	vulnerable driver	none	—	open ↗
NTIOLib.sys MSI T1068 42 samples	vulnerable driver	none	—	open ↗
nvaudio.sys NVidia Corp. T1068 1 sample	vulnerable driver	none	—	open ↗
nvflash.sys NVIDIA Corporation T1068 8 samples	vulnerable driver	none	—	open ↗
nvflash.sys T1068 1 sample	vulnerable driver	none	—	open ↗
nvflsh32.sys T1068 11 samples	vulnerable driver	none	—	open ↗
nvflsh64.sys T1068 15 samples	vulnerable driver	bypass (1)	—	open ↗
nvoclock.sys NVIDIA Corp., NVidia Corp. T1068 25 samples	vulnerable driver	bypass (5)	—	open ↗
nxeng.sys Beijing Huorong Network Technology Co., Ltd. T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
OAToolx64.sys Insyde Software T1068 1 sample	vulnerable driver	none	—	open ↗
OpenLibSys.sys OpenLibSys.org T1068 2 samples	vulnerable driver	none	—	open ↗
otipcibus.sys OTi T1068 1 sample	vulnerable driver	none	—	open ↗
p2KGhmzsARY1.sys T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
PanIO.sys Pan Yazilim Bilisim Teknolojileri Tic. Ltd. Sti. T1068 1 sample	vulnerable driver	none	—	open ↗
PanIOx64.sys Pan Yazilim Bilisim Teknolojileri Tic. Ltd. Sti. T1068 1 sample	vulnerable driver	none	—	open ↗
PanMonFlt.sys Pan Yazilim Bilisim Teknolojileri Tic. Ltd. Sti. T1068 1 sample	vulnerable driver	none	—	open ↗
PanMonFltX64.sys Pan Yazilim Bilisim Teknolojileri Tic. Ltd. Sti. T1068 1 sample	vulnerable driver	none	—	open ↗
pcdsrvc_x64.sys PC-Doctor, Inc. CVE-2019-12280 T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
pchunter.sys 安芯网盾（北京）科技有限公司 T1068 1 sample	vulnerable driver	none	—	open ↗
PCHunter.sys 一普明为（北京）信息技术有限公司 T1068 1 sample	vulnerable driver	none	—	open ↗
PcieCubed.sys Legal Corp. T1068 1 sample	malicious	none	—	open ↗
PCTcore64.sys, PCTCore64.sys PC Tools CVE-2026-8501 T1562.001 1 sample	vulnerable driver	not evaluated	—	open ↗
PDFWKRNL.sys Advanced Micro Devices, Inc. T1068 4 samples	vulnerable driver	bypass (2)	—	open ↗
PDFWKRNL.sys Advanced Micro Devices, Inc. T1068 2 samples	vulnerable driver	none	—	open ↗
PGPwded.sys, eedDiskEncryptionDriver.sys, Symantec Encryption Desktop, Symantec Endpoint Encryption CA, Inc., a Broadcom subsidiary, Symantec Corporation CVE-2019-9702 +1 T1068 7 samples	vulnerable driver	not evaluated	—	open ↗
PGRHostControl.sys Point Grey Research T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
PhlashNT.sys Phoenix Technologies, Ltd. T1068 1 sample	vulnerable driver	none	—	open ↗
phydmaccx64.sys T1068 1 sample	vulnerable driver	none	—	open ↗
phydmaccx86.sys T1068 1 sample	vulnerable driver	none	—	open ↗
phymem_ext64.sys T1068 4 samples	vulnerable driver	none	—	open ↗
phymem64.sys, phymem.sys Super Micro Computer, Inc. T1068 3 samples	vulnerable driver	none	—	open ↗
Phymemx64.sys T1068 2 samples	vulnerable driver	none	—	open ↗
physmem.sys Hilscher Gesellschaft für Systemaoutomation mbH T1068 2 samples	vulnerable driver	bypass (1)	—	open ↗
piddrv.sys T1068 2 samples	vulnerable driver	none	blocked	open ↗
piddrv64.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
PlugPlayService.sys, neonddu.sys T1014 2 samples	malicious	not evaluated	—	open ↗
PMAD.sys Catalyst Enterprises Inc. T1068 1 sample	vulnerable driver	none	—	open ↗
pmxdrv64.sys, pmxdrv.sys, PMxDrv Intel Corporation T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
PoisonX.sys, G11.sys, PoisonX10.sys, PoisonX11.sys, PoisonX12.sys, PoisonX13.sys, PoisonX14.sys, PoisonX15.sys, PoisonX16.sys, PoisonX17.sys, PoisonX18.sys, PoisonX2.sys, PoisonX3.sys, PoisonX4.sys, PoisonX5.sys, PoisonX6.sys, PoisonX7.sys, PoisonX8.sys, PoisonX9.sys T1562 19 samples	vulnerable driver	none	—	open ↗
POORTRY.sys T1068 1 sample	malicious	none	—	open ↗
POORTRY1.sys T1068 1 sample	malicious	none	—	open ↗
POORTRY2.sys T1068 1 sample	malicious	none	—	open ↗
portwell.sys Portwell Inc. T1068 1 sample	vulnerable driver	none	—	open ↗
ppa_x64.sys T1068 1 sample	vulnerable driver	none	—	open ↗
probmon.sys ITM SYSTEM CVE-2024-26506 T1562 1 sample	vulnerable driver	not evaluated	—	open ↗
ProcessCtr.sys EsafeNet T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
procexp.Sys Sysinternals - www.sysinternals.com T1068 31 samples	vulnerable driver	bypass (2)	—	open ↗
ProcObsrvesx.sys MicroWorld Technologies Inc. T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
prokiller64.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
ProtectS.sys T1068 4 samples	vulnerable driver	none	blocked	open ↗
Proxy32.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
Proxy64.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
ProxyDrv.sys 雷神（武汉）网络技术有限公司 T1068 2 samples	vulnerable driver	none	—	open ↗
PSKD64.SYS APSoft T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
pskmad_64.sys, PSKMAD.sys, Panda Kernel Memory Access Driver Panda Security, S.L. CVE-2023-6330 +2 T1068 2 samples	vulnerable driver	not evaluated	—	open ↗
psmounterex.sys Windows (R) Win 7 DDK provider T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
pstrip64.sys EnTech Taiwan CVE-2026-29923 T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
pxitrig64.sys ADLink T1068 1 sample	vulnerable driver	none	—	—
QIOMem.sys TOSHIBA CVE-2026-56129 T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
qu829.sys T1068 2 samples	malicious	none	—	open ↗
RadHwMgr.sys Radiant Systems, Inc. , NCR Corporation T1068 6 samples	vulnerable driver	bypass (2)	—	open ↗
Realtime Driver.sys Mandiant T1068 1 sample	vulnerable driver	none	—	open ↗
reddriver.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
rksafe.sys T1014 1 sample	malicious	not evaluated	—	open ↗
RootLaser.sys, TrueSight.sys Adlice Software T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
rspot.sys Beijing Rising Network Security Technology Co., Ltd. T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
RTCore64.sys T1068 33 samples	vulnerable driver	bypass (2)	—	open ↗
RTCore64.sys T1068 43 samples	vulnerable driver	bypass (2)	—	open ↗
rtcoremini64.sys T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
rtif.sys TenAsys Corporation T1068 7 samples	vulnerable driver	none	—	open ↗
rtkio.sys, rtkio64.sys, rtkiow8x64.sys, rtkiow10x64.sys Realtek , Windows (R) Codename Longhorn DDK provider T1068 14 samples	vulnerable driver	bypass (11)	—	open ↗
rtkiow8x64.sys Realtek T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
rtport.sys Windows (R) 2003 DDK 3790 provider, Windows (R) 2000 DDK provider, REALTEK Semiconductor Corp. T1068 8 samples	vulnerable driver	bypass (5)	—	open ↗
RtsPer.sys Realtek Semiconductor Corporation T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
RtsTpx.sys Realtek Semiconductor Corp. T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
RtsUer.sys Realsil Semiconductor Corporation T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
rwdrv.sys RW-Everything T1068 4 samples	vulnerable driver	none	—	open ↗
RwDrv.sys RW-Everything T1068 7 samples	vulnerable driver	bypass (2)	—	open ↗
RzDev_00X10.sys T1014 1 sample	malicious	not evaluated	—	open ↗
rzpnk.sys Razer, Inc. CVE-2017-9769 T1068 22 samples	vulnerable driver	none	—	open ↗
sandra.sys SiSoftware T1068 5 samples	vulnerable driver	none	—	open ↗
SANDRA.sys SiSoftware T1068 4 samples	vulnerable driver	none	—	open ↗
SBIOSIO64.sys Windows (R) Win 7 DDK provider T1068 4 samples	vulnerable driver	none	—	open ↗
sdrv_win_sliff.sys T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
Se64a.sys EnTech Taiwan T1068 1 sample	vulnerable driver	none	—	open ↗
SeasunProtect.sys Chengdu Westhouse Interactive Entertainment Ltd. T1068 1 sample	vulnerable driver	bypass (1)	—	—
segwindrvx64.sys Insyde Software Corp. T1068 7 samples	vulnerable driver	none	—	open ↗
semav6msr.sys, semav6msr64.sys T1068 3 samples	vulnerable driver	none	blocked	open ↗
Sense5Ext.sys Sense5 CORP T1068 2 samples	malicious	none	—	open ↗
sepdrv3_1.sys T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
sfdrvx32.sys Almico Software T1068 2 samples	vulnerable driver	none	—	open ↗
sfdrvx32.sys Almico Software T1068 1 sample	vulnerable driver	none	—	open ↗
sfdrvx64.sys Almico Software T1068 3 samples	vulnerable driver	bypass (2)	—	open ↗
shield.sys, shield-async.sys, shieldwp.sys Horizon Datasys, Inc. T1068 3 samples	vulnerable driver	not evaluated	—	open ↗
shimano32.sys, shimano64.sys T1068 2 samples	vulnerable driver	not evaluated	—	open ↗
signeddrv.sys T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
SIOCTL.sys Windows (R) Win 7 DDK provider T1068 1 sample	vulnerable driver	none	—	open ↗
SIVX64.sys Ray Hinchliffe T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
skill.sys T1068 1 sample	vulnerable driver	none	—	open ↗
SMARTEIO64.SYS EVGA Technology Inc. T1068 1 sample	vulnerable driver	none	—	open ↗
smep_capcom.sys T1068 1 sample	vulnerable driver	none	—	open ↗
smep_namco.sys T1068 1 sample	vulnerable driver	none	—	open ↗
SmSerl64.sys Motorola Inc. T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
snxpsamd.sys, SUNIX Serial Driver SUNIX Co., Ltd. T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
SONiXDDRx64.sys T1068 1 sample	vulnerable driver	none	—	open ↗
SparkIO.sys T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
speedfan.sys Windows (R) Server 2003 DDK provider CVE-2007-5633 T1068 1 sample	vulnerable driver	none	—	open ↗
spf.sys T1068 1 sample	vulnerable driver	none	—	open ↗
spwizimgVT.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
srswdrv.sys Lenovo T1068 1 sample	vulnerable driver	none	—	open ↗
SSPORT.sys Samsung Electronics T1068 1 sample	vulnerable driver	none	—	open ↗
stdcdrv64.sys Intel Corporation T1068 1 sample	vulnerable driver	none	—	open ↗
stdcdrvws64.sys Intel Corp. T1068 1 sample	vulnerable driver	none	—	open ↗
STProcessMonitor.sys, ProcessMonitorDriver.sys, STProcessMonitor_v114.sys Safetica Technologies T1562.001 2 samples	vulnerable driver	not evaluated	—	open ↗
superbmc.sys Super Micro Computer, Inc. T1068 6 samples	vulnerable driver	none	—	open ↗
SvIoCtrlx64.sys www.seavo.com T1068 1 sample	vulnerable driver	none	—	open ↗
sxav64-v1.5.1.sys, sxav.sys 河南寒露电子科技有限公司 T1562.001 1 sample	vulnerable driver	not evaluated	—	open ↗
sysconp.sys T1068 2 samples	vulnerable driver	none	—	open ↗
SysDrv3S.sys 3S-Smart Software Solutions GmbH T1068 1 sample	vulnerable driver	none	—	open ↗
SysFile_X64.sys T1068 1 sample	vulnerable driver	none	—	open ↗
SysInfo.sys T1068 1 sample	vulnerable driver	none	—	open ↗
SysInfoDetectorX64.sys Database Harbor Software T1068 1 sample	vulnerable driver	none	—	open ↗
SysInfoX64.sys T1068 1 sample	vulnerable driver	none	—	open ↗
szkg64.sys iS3 Inc. T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
t.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
t3.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
t7.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
t8.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
tboflhelper.sys TeraByte, Inc. T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
TBT_Force_Power_Control_Access64.sys T1068 1 sample	vulnerable driver	none	—	open ↗
TcIo.sys, TcRouter.sys Beckhoff Automation GmbH, Beckhoff Automation GmbH & Co. KG T1068 2 samples	vulnerable driver	bypass (2)	—	open ↗
tdeio64.sys T1068 2 samples	vulnerable driver	none	—	open ↗
tdevflt.sys, ABYSSWORKER Palo Alto Networks, Inc. T1562.001 1 sample	malicious	not evaluated	—	open ↗
TdkLib64.sys T1068 17 samples	vulnerable driver	bypass (17)	—	open ↗
telephonuAfY.sys T1068 5 samples	malicious	bypass (5)	—	open ↗
termdd.sys Microsoft Corporation T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
test2.sys T1068 1 sample	vulnerable driver	none	—	open ↗
TestBone.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
tfbfs3ped.sys T1068 1 sample	vulnerable driver	none	—	open ↗
TfSysMon.sys PC Tools, Advanced Micro Devices, Inc T1068 2 samples	vulnerable driver	none	—	open ↗
TGSafe.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
thelper.sys TEC Solutions Limited. T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
throttlestop.sys T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
titidrv.sys genitlkiwi (Benjamin XXXXX) T1068 1 sample	vulnerable driver	none	—	open ↗
tm_filter.sys, tmfsdrv2.sys Windows (R) Win 7 DDK provider T1056.001 2 samples	vulnerable driver	not evaluated	—	open ↗
TmComm.sys Trend Micro Inc. T1068 1 sample	vulnerable driver	none	blocked	open ↗
TmComm.sys Trend Micro Inc. T1068 41 samples	vulnerable driver	bypass (7)	blocked	open ↗
Tmel.sys Trend Micro Inc. T1068 3 samples	vulnerable driver	none	—	open ↗
TPwSav.sys Compal Electronic, Inc. T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
TRIXX.sys T1068 3 samples	vulnerable driver	none	—	open ↗
truesight.sys Adlice Software T1068 2 samples	vulnerable driver	none	—	open ↗
TSDRVX64.sys ToolHouse Entwicklungs-KG T1068 2 samples	vulnerable driver	none	—	open ↗
TVicPort64.sys EnTech Taiwan CVE-PENDING T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
typelibdE.sys T1068 1 sample	malicious	bypass (1)	—	open ↗
UCOREW64.SYS T1068 1 sample	vulnerable driver	none	—	open ↗
UDDB2B6.sys T1068 1 sample	vulnerable driver	none	—	open ↗
unknown.sys T1562.001 1 sample	vulnerable driver	not evaluated	—	open ↗
vboxdrv.sys Sun Microsystems, Inc. T1068 7 samples	vulnerable driver	none	—	open ↗
VBoxDrv.sys Vektor T13 Security Service, Sun Microsystems, Inc., Pinduoduo Ltd Corp T1068 7 samples	vulnerable driver	bypass (5)	—	open ↗
vboxguest.sys innotek GmbH T1068 2 samples	vulnerable driver	none	—	open ↗
VBoxMouseNT.sys innotek GmbH T1068 1 sample	vulnerable driver	none	—	open ↗
VBoxTAP.sys innotek GmbH, Sun Microsystems, Inc. T1068 2 samples	vulnerable driver	none	—	open ↗
VBoxUSB.Sys T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
VBoxUSB.Sys innotek GmbH, Sun Microsystems, Inc. T1068 2 samples	vulnerable driver	none	—	open ↗
VBoxUSBMon.sys innotek GmbH, Sun Microsystems, Inc. T1068 2 samples	vulnerable driver	none	—	open ↗
VdBSv64.sys MiTAC Technology Corporation T1068 1 sample	vulnerable driver	none	—	open ↗
viraglt64.sys, viragt64.sys TG Soft S.a.s. T1068 1 sample	vulnerable driver	none	blocked	open ↗
viragt.sys TG Soft S.a.s. T1068 2 samples	vulnerable driver	none	blocked	open ↗
viragt64.sys TG Soft S.a.s. T1068 8 samples	vulnerable driver	bypass (5)	blocked	open ↗
ViveRRAudio.sys HTC VIVE T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
vmdrv.sys Windows (R) Win 7 DDK provider T1068 2 samples	vulnerable driver	none	—	open ↗
vmdrv.sys Windows (R) Win 7 DDK provider T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
VProEventMonitor.sys Symantec Corporation T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
vsdatant.sys Check Point, LTD T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
wamsdk.sys WatchDogDevelopment.com, LLC. T1068 2 samples	vulnerable driver	not evaluated	—	open ↗
wantd_2.sys Microsoft Corporation T1068 1 sample	malicious	bypass (1)	—	open ↗
wantd_3.sys Microsoft Corporation T1068 1 sample	malicious	bypass (1)	—	open ↗
wantd_4.sys Microsoft Corporation T1068 1 sample	malicious	bypass (1)	—	open ↗
wantd_5.sys Microsoft Corporation T1068 1 sample	malicious	bypass (1)	—	open ↗
wantd_6.sys Microsoft Corporation T1068 1 sample	malicious	bypass (1)	—	open ↗
wantd.sys Microsoft Corporation T1068 1 sample	malicious	bypass (1)	—	open ↗
watabe.sys T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
WCPU.sys Windows (R) Codename Longhorn DDK provider T1068 1 sample	vulnerable driver	none	—	open ↗
wdisvhost.sys T1068 1 sample	vulnerable driver	none	—	open ↗
WDTKernel.sys Dell Inc T1068 2 samples	vulnerable driver	bypass (2)	—	open ↗
wfshbr64.sys, wfshbr32.sys CVE-2022-42046 T1068 2 samples	malicious	none	—	open ↗
whql.sys T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
WibuKey64.sys, WibuKey WIBU-SYSTEMS AG CVE-2024-45181 +1 T1068 3 samples	vulnerable driver	not evaluated	—	open ↗
windbg.sys Microsoft Corporation T1068 17 samples	malicious	bypass (17)	—	open ↗
windbg.sys Microsoft Corporation T1068 20 samples	malicious	bypass (20)	—	open ↗
windivert.sys Basil T1068 3 samples	malicious	bypass (3)	—	open ↗
Windows_CPU_Temperature_Component.sys Guangzhou Shirui Electronics T1068 2 samples	vulnerable driver	none	—	open ↗
Windows-Memory-Informer.sys T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
windows-xp-64.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
windows7-32.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
windows8-10-32.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
windrvr1251.sys, windrvr1260.sys, windrvr1280.sys, windrvr1281.sys, windrvr1411.sys, Jungo WinDriver Jungo Connectivity CVE-2023-47569 +4 T1068 7 samples	vulnerable driver	not evaluated	—	open ↗
WinFlash64.sys T1068 1 sample	vulnerable driver	none	blocked	open ↗
WinFlash64.sys T1068 3 samples	vulnerable driver	none	blocked	open ↗
WinIO32.sys T1068 1 sample	vulnerable driver	none	—	open ↗
WinIO32A.sys T1068 1 sample	vulnerable driver	none	—	open ↗
WinIO32B.sys T1068 1 sample	vulnerable driver	none	—	open ↗
winio64.sys T1068 2 samples	vulnerable driver	bypass (2)	—	open ↗
winio64.sys T1068 2 samples	vulnerable driver	bypass (1)	—	open ↗
WinIo64.sys T1068 5 samples	vulnerable driver	bypass (1)	—	open ↗
WinIo64A.sys T1068 1 sample	vulnerable driver	none	—	open ↗
WinIo64B.sys T1068 1 sample	vulnerable driver	none	—	open ↗
WinIo64C.sys T1068 2 samples	vulnerable driver	none	—	open ↗
WINIODrv.sys T1068 3 samples	vulnerable driver	none	—	open ↗
WinRing0.sys, WinRing0x64, OpenHardwareMonitorLib.sys OpenLibSys.org T1068 10 samples	vulnerable driver	bypass (1)	blocked	open ↗
WinTapix.sys, SRVNET2.SYS Microsoft Corporation T1068 3 samples	malicious	bypass (3)	—	open ↗
WiRwaDrv.sys Wistron Corporation T1068 1 sample	vulnerable driver	none	—	open ↗
WiseUnlo.sys WiseCleaner.com T1068 7 samples	vulnerable driver	bypass (3)	—	open ↗
wnbios.sys Windows (R) Win 7 DDK provider T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
wsdkd.sys WatchDogDevelopment.com, LLC. CVE-2023-1453 T1068 1 sample	vulnerable driver	bypass (1)	—	open ↗
wsftprm.sys Topaz OFD CVE-2023-52271 T1068 2 samples	vulnerable driver	bypass (1)	—	open ↗
WYProxy64.sys, WYProxy32.sys T1068 2 samples	vulnerable driver	none	blocked	open ↗
xhunter1.sys Wellbia.com Co., Ltd. CVE-2026-3609 T1562.001 2 samples	vulnerable driver	not evaluated	—	open ↗
xhunter2.sys Wellbia.com Co., Ltd. CVE-2026-15430 T1562.001 1 sample	vulnerable driver	not evaluated	—	open ↗
xjokercontroller.sys T1068 1 sample	vulnerable driver	none	—	open ↗
xkpsm.sys Jiransoft Co. Ltd. T1068 1 sample	vulnerable driver	none	—	open ↗
XLHA.sys LG Electronics Inc. T1068 1 sample	vulnerable driver	none	—	open ↗
yyprotect64.sys T1068 1 sample	vulnerable driver	none	—	open ↗
zam64.sys, zamguard32.sys, zamguard64.sys Zemana Ltd., Zmana Ltd. CVE-2018-5713 T1068 13 samples	vulnerable driver	bypass (11)	—	open ↗
zntport.sys Zeal SoftStudio T1068 1 sample	vulnerable driver	not evaluated	—	open ↗
ZYArKit.sys T1562.001 1 sample	vulnerable driver	not evaluated	—	open ↗

Microsoft vulnerable driver block list

policy version 10.0.29545.0 · 250 named driver families

showing 250 of 250 families

blocked driver family	deny rules (unique hashes)
passmark directio.sys	42
netfilterdrv.sys	22
asio32.sys	12
asio64.sys	12
gameink.sys	8
lgdcatcher.sys	8
msio.sys	8
81.sys	6
05f052_4045ae_694848_8cb62c_b1d962	4
32-bit dell dbutil.sys	4
64-bit dell dbutil.sys	4
6c6a4d07e95ab4212c2afefcb0ce37dc485fa56120b0419b636bd8bd326038c1.sys	4
asrdrv10.sys	4
asrdrv101.sys	4
asrdrv102.sys	4
asrdrv103.sys	4
asupio64.sys	4
bs_flash64.sys	4
bs_hwmio64.sys	4
capcom.sys	4
fiddrv.sys	4
fiddrv64.sys	4
fidpcidrv.sys	4
fidpcidrv64.sys	4
glckio2.sys	4
gvcidrv64.sys	4
irec32--1.sys	4
irec32--10.sys	4
irec32--11.sys	4
irec32--2.sys	4
irec32--3.sys	4
irec32--5.sys	4
irec32--7.sys	4
irec32--8.sys	4
irec32--9.sys	4
irec64--16.sys	4
irec64--17.sys	4
irec64--18.sys	4
irec64--19.sys	4
irec64--21.sys	4
irec64--23.sys	4
irec64--24.sys	4
irec64--25.sys	4
irec64--26.sys	4
irec64--27.sys	4
irec64--28.sys	4
irecarm64--45.sys	4
phymemx64	4
piddrv.sys	4
piddrv64.sys	4
protects.sys	4
semav6msr64.sys	4
winflash64.sys	4
winring0.sys	4
1.sys	2
2.sys	2
80.sys	2
b.sys	2
b1.sys	2
b3.sys	2
b4.sys	2
black.sys	2
blackbonedrv10.sys	2
bw.sys	2
bwrs.sys	2
bwrsh.sys	2
c.sys	2
cpupress.sys	2
d.sys	2
d2.sys	2
d3.sys	2
d4.sys	2
full.sys	2
gametersafe.sys	2
kbdcap64.sys	2
lurker.sys	2
my.sys	2
netflt.sys	2
netproxydriver.sys	2
ni.sys	2
nstr.sys	2
nstrwsk.sys	2
nt2.sys	2
nt3.sys	2
nt4.sys	2
nt5.sys	2
nt6.sys	2
proxy32.sys	2
proxy64.sys	2
t.sys	2
t3.sys	2
t7.sys	2
t8.sys	2
testbone.sys	2
tgsafe.sys	2
windows-xp-64.sys	2
windows7-32.sys	2
windows8-10-32.sys	2
wyproxy32.sys	2
wyproxy64.sys	2
hp ssport.sys	1
000547560fea0dd4b477eb28bf781ea67bf83c748945ce8923f90fdd14eb7a4b fileattribute	0
001e3ecc4c3294712b8a80ad21b6ba952acfdd9f8297eb7dda3ac1d932eaa15e fileattribute	0
0025d232ed0ff9a572f8004094cfe21f62070db832398345425554334e036da6 fileattribute	0
006e089d3e53a5d3cd55ea7dd7b629e4aae3fbd96ee236b88306ab78236c36ee fileattribute	0
0083e0e95bd2960f983516c0aac7cb8878c6906fc6a1ed1a751bc2ce12f79b3b fileattribute	0
00c3e86952eebb113d91d118629077b3370ebc41eeacb419762d2de30a43c09c fileattribute	0
0184b8314b3ddb11dd929b3ad9e4302f8246e99027077e42d7fc14b25d799428 fileattribute	0
01af9b2e49907308312be623a125a4cd71da9e626a54dfa746336e5d69c0a70a fileattribute	0
021badff5a3c84ee422d9fa40a842f89b1c60e0164eabd58da7374327ea99d3c fileattribute	0
023d722cbbdd04e3db77de7e6e3cfeabcef21ba5b2f04c3f3a33691801dd45eb fileattribute	0
02bf867ca3f4bd7f3d2829f4eaf0ad10a32e67e7c976f80ef0d1009c2d9cdf25 fileattribute	0
02fa3060a8319f0f691547345863679d750bfea0974798ffcd379ee965bce83d fileattribute	0
030ec373e4eb92592cbfc5e590ddbcbc5ece2d43809b141bb3fffceb0e01f72e fileattribute	0
036c1151a30a9c25afc961d7305c58cbf8f68e5e5c1e726565c9a8168c2f3cdb fileattribute	0
04e9a85d89a5119ff2dd2342719f6129d42627e3083559c88d4f3be607dd1f06 fileattribute	0
053b5bc1d35c76f2e9574f8403c2f5ce07b9a44d00495ce546662d4c0476fd2d fileattribute	0
05c15a75d183301382a082f6d76bf3ab4c520bf158abca4433d9881134461686 fileattribute	0
05f7419335418b1eb5c983860a8a68e73147508b31e7cb1341a9dbeeb81f96b4 fileattribute	0
061d9e1cbb06bee5bad025bbc190de1d83bc8298610a6eb525102d9600cfd683 fileattribute	0
06508aacb4ed0a1398a2b0da5fa2dbf7da435b56da76fd83c759a50a51c75caf fileattribute	0
06a5d8632ecdd64da4e44ddf3495a62657b513b1139cb8a3a78f641d4e31bf95 fileattribute	0
070ff602cccaaef9e2b094e03983fd7f1bf0c0326612eb76593eabbf1bda9103 fileattribute	0
07d0090c76155318e78a676e2f8af1500c20aaa1e84f047c674d5f990f5a09c8 fileattribute	0
083ff41609e2c0402f20cc00da1110a0cb80c515ca1c2f551606ecc94986cff9 fileattribute	0
08675796b8712e0e4ccbdf7831450b907bb94c2e3e85560d9aba1b24931f0d55 fileattribute	0
0997b76ab0fc63f2d7056cb0da1ae55d076cda74b973826008c69d6dab49987f fileattribute	0
0aa79d4c5c3baca0aee095bdbdfddfe70fad495c791066c416bd732eaec2d965 fileattribute	0
0b57569aaa0f4789d9642dd2189b0a82466b80ad32ff35f88127210ed105fe57 fileattribute	0
0bd1523a68900b80ed1bccb967643525cca55d4ff4622d0128913690e6bb619e fileattribute	0
0be8483c2ea42f1ce4c90e84ac474a4e7017bc6d682e06f96dc1e31922a07b10 fileattribute	0
0c003e038173bfa30069b09f99712780a293328abbc91633b07751246c0ef149 fileattribute	0
0d133ced666c798ea63b6d8026ec507d429e834daa7c74e4e091e462e5815180 fileattribute	0
0d383e469d0e27ebb713770f01f7f1a57068a7d30478221e6f2276125048d1c9 fileattribute	0
0dd9daf0852a5b1b436199e9f2bf318f641f43173ab0dc22ad8c7e9cbaee9ad3 fileattribute	0
1072beb3ff6b191b3df1a339e3a8c87a8dc5eae727f2b993ea51b448e837636a fileattribute	0
11832c345e9898c4f74d3bf8f126cf84b4b1a66ad36135e15d103dbf2ac17359 fileattribute	0
12b3d8bc5cc1ea6e2acd741d8a80f56cf2a0a7ebfa0998e3f0743fcf83fabb9e fileattribute	0
159e7c5a12157af92e0d14a0d3ea116f91c09e21a9831486e6dc592c93c10980 fileattribute	0
15ffa1952b4018e4c07a5caf53d650a792b4872fa806deb8e22ccce69e6def6e fileattribute	0
174c8d771d31d70fc95448e961a395f5ceb7658f0cc381a718fb3b854cde4efe fileattribute	0
17927b93b2d6ab4271c158f039cae2d60591d6a14458f5a5690aec86f5d54229 fileattribute	0
17942865680bd3d6e6633c90cc4bd692ae0951a8589dbe103c1e293b3067344d fileattribute	0
1beb15c90dcf7a5234ed077833a0a3e900969b60be1d04fcebce0a9f8994bdbb fileattribute	0
1dccd1e13da17bd541a66b48d62e914df390818c15f5f599c636d42c05996ace fileattribute	0
1e24c45ce2672ee403db34077c88e8b7d7797d113c6fd161906dce3784da627d fileattribute	0
1fac3fab8ea2137a7e81a26de121187bf72e7d16ffa3e9aec3886e2376d3c718 fileattribute	0
223f61c3f443c5047d1aeb905b0551005a426f084b7a50384905e7e4ecb761a1 fileattribute	0
24342de3b93a06b4e4534140b13cd0726e8e8f4665866a9dcbcceb5685b83cf3 fileattribute	0
265259015d4fda3e9d14b7740b8153b9097ab054cf6873b46f9fefdc97266d35 fileattribute	0
270547552060c6f4f5b2ebd57a636d5e71d5f8a9d4305c2b0fe5db0aa2f389cc fileattribute	0
29f449fca0a41deccef5b0dccd22af18259222f69ed6f389beafe8d5168c59e36 fileattribute	0
2aa1b08f47fbb1e2bd2e4a492f5d616968e703e1359a921f62b38b8e4662f0c4 fileattribute	0
2b34ca35bd4f61d8e1d62b6129bef0a64c4655e80d6d39da06cb27c08e6996a3 fileattribute	0
2b507e0ad4515d9d47fb7f0bfa1f1eb11de25db4fca49fc1417ea991dc33b6bf fileattribute	0
2f8b68de1e541093f2d4525a0d02f36d361cd69ee8b1db18e6dd064af3856f4f fileattribute	0
33a73e36499d4a33f9321c5ac40a4e34c029a2d7ea26205a245592df78195776.sys fileattribute	0
37022838c4327e2a5805e8479330d8ff6f8cd3495079905e867811906c98ea20 fileattribute	0
37507cdb5df5669862f0213feb521dc82a3c87b85c5489bbffdaedd1c43da132 fileattribute	0
3807e9a1bc159b9e8fc0c7caad10d7213ff8ed8ad1cea9ea552b093c81bf624b fileattribute	0
3c0a36990f7eef89b2d5f454b6452b6df1304609903f31f475502e4050241dd8 fileattribute	0
3c11dec1571253594d64619d8efc8c0212897be84a75a8646c578e665f58bf5d fileattribute	0
40b62ba97ba2edd3e01ed62d26ae8c09f36144ab33db18b42e5f1ccf82db1754 fileattribute	0
455ff5274fbdd19ce1da6fc6725a00752761998759c6bacb9713081f613c1752 fileattribute	0
45e5977b8d5baec776eb2e62a84981a8e46f6ce17947c9a76fa1f955dc547271.sys fileattribute	0
4880f40f2e557cff38100620b9aa1a3a753cb693af16cd3d95841583edcb57a8 fileattribute	0
4ae42c1f11a98dee07a0d7199f611699511f1fb95120fabc4c3c349c485467fe fileattribute	0
507b07b0dc0e638b65b4a4d11a462b35439c746d42337b9888927bf994176102 fileattribute	0
530d9223ec7e4123532a403abef96dfd1af5291eb49497392ff5d14d18fccfbb fileattribute	0
5b0ebf255769224b95d23ff0511014ae80ad8778737d6aaa071aeb794012b058 fileattribute	0
68ca1b5151181a98cd6da55d6dfd6ef0c94f0cf9379be37a8f86dd996d677946 fileattribute	0
6b830ea0db6546a044c9900d3f335e7820c2a80e147b0751641899d1a5aa8f74 fileattribute	0
70afdc0e11db840d5367afe53c35d9642c1cf616c7832ab283781d085988e505 fileattribute	0
770ab79212b08cd13864d6cfd9b97180d7b3f084d1d44aec09c8314d9466039e fileattribute	0
7c6f16af074c3f1c74fc69734f1c8b8a03b0594ac2085d5a0c582fc8cc378858 fileattribute	0
7e0124fcc7c95fdc34408cf154cb41e654dade8b898c71ad587b2090b1da30d7 fileattribute	0
87ece1b3b8446517dd9696a1b2c62f82a80220956618485efbdf5671f2676616 fileattribute	0
8dba0ab11ce9f9df5c8fb9fff18bbe9c8c654864053c8b0c4f175ec7203a2e51 fileattribute	0
8ec9a4c4ec2b73440c591bc91543d0f685ffa1c3658926b25b06d929c5b6feed fileattribute	0
91314768da140999e682d2a290d48b78bb25a35525ea12c1b1f9634d14602b2c fileattribute	0
a3908b3fa59c0fc7600ff8887a87861a4f8566ca0a3bdcf2371bb9f36745db91 fileattribute	0
a5a4a3c3d3d5a79f3ed703fc56d45011c21f9913001fcbcc43a3f7572cff44ec fileattribute	0
agnitum sandbox fileattribute	0
amdpowerprofiler.sys fileattribute	0
amdryzenmaster.sys	0
asus ashitio_drv fileattribute	0
asus memory mapping driver	0
atillk64 fileattribute	0
atszio.sys fileattribute	0
avast aswarpot fileattribute	0
avast aswelam/avgelam overpermissive elam fileattribute	0
b80bea4c09dafb0bfd2ca067130a7ead64faba8f78599dad4d4291a4a29f3a23 fileattribute	0
bs_def fileattribute	0
bs_def64 fileattribute	0
bsmem64_w10 fileattribute	0
c02eabc2e096f00e6e46fb3b5cf0062db5e1b9d92877b701d2ea0bf27cd82cbe fileattribute	0
c3a2dade7d95085d5af4bf9dc218c97f802440b6c1bd2fdac520cb1a376b7e84 fileattribute	0
cheat engine driver	0
creative tech msio32.sys fileattribute	0
d205286bffdf09bc033c09e95c519c1c267b40c2ee8bab703c6a2d86741ccd3e fileattribute	0
d8fc8e3a1348393c5d7c3a84bcbae383d85a4721a751ad7afac5428e5e579b4e fileattribute	0
deny fairplaykd.sys mta san andreas versions 367.*	0
ef55a5a3be73d5bfc5aa2a2b3f0cc574b824d96a129a67931a1667e770d5d938 fileattribute	0
eset eelam overpermissive elam fileattribute	0
f596e64f4c5d7c37a00493728d8756b243cfdc11e3372d6d6dfeffc13c9ab960 fileattribute	0
fileattribute	0
gdrv.sys	0
gmerek gmer64 fileattribute	0
haxm.sys fileattribute	0
hpportiox64.sys	0
hwrwdrv fileattribute	0
iobit monitor.sys fileattribute	0
iobitunlocker fileattribute	0
iqvw64.sys fileattribute	0
kaspersky klmd.sys filerule	0
kevp64.sys fileattribute	0
kingsoft ksapi.sys fileattribute	0
kprocesshacker.sys filerule	0
lenovodiagnosticsdriver fileattribute	0
lha.sys fileattribute	0
lv561v64 logitech fileattribute	0
ms windows appid.sys 21h1 fileattribute	0
ms windows appid.sys 21h2 fileattribute	0
ms windows appid.sys 22h2 fileattribute	0
ms windows appid.sys 23h2 fileattribute	0
ms windows appid.sys ws2019 fileattribute	0
ms windows appid.sys ws2022 fileattribute	0
ms windows appid.sys ws23h2 fileattribute	0
mtcbsv64.sys fileattribute	0
mydrivers.sys fileattribute	0
nvidia nvflash fileattribute	0
pchunter driver	0
phymem fileattribute	0
phymemx64 memory mapping driver	0
physmem.sys fileattribute	0
razer rzpnk.sys fileattribute	0
realix_hwinfo32 fileattribute	0
realix_hwinfo64a fileattribute	0
realix_hwinfo64i fileattribute	0
segwindrvx64.sys fileattribute	0
signers of known vulnerable or malicious drivers	0
superbmc fileattribute	0
sysinternals process explorer fileattribute	0
system mechanic cve-2018-5701	0
tmcomm.sys	0
trendmicro tmel overpermissive elam fileattribute	0
viragt.sys 32-bit	0
viragt64.sys	0
vmdrv.sys fileattribute	0
wiseunlo fileattribute	0