← Back to driver explorer
Driver intelligenceVulnerableVerified
procexp.Sys
Description not recorded.
Known samples 31
2 recorded TRUE · 29 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
procexp.SysSample 1 · HVCI FALSE
- MD5
e6cb1728c50bd020e531d19a14904e1c- SHA1
2dd916cb8a9973b5890829361c1f9c0d532ba5d6- SHA256
075de997497262a9d105afeadaaefc6348b25ce0e0126505c24aa9396c251e85- Imphash
d122c1eaa50839be14c31876d0d4e0be- Authentihash MD5
fe54aac5dfae8729c48361d2ea4f7271- Authentihash SHA1
2a4e81a1d23e3b7d9c14b6fbc393ecfad5f34133- Authentihash SHA256
c5732937c3ab5e0fd244cc1b820eaa1fb7d97110c213cd6b9dadebafe3ea853d- Machine
- AMD64
- Version
- 16.32
- Publisher
- Sysinternals - www.sysinternals.com
procexp.SysSample 2 · HVCI FALSE
- MD5
fea9319d67177ed6f36438d2bd9392fb- SHA1
db6170ee2ee0a3292deceb2fc88ef26d938ebf2d- SHA256
16a2e578bc8683f17a175480fea4f53c838cfae965f1d4caa47eaf9e0b3415c1- Imphash
bfe13c695e41d3eee414d3929b1bd523- Authentihash MD5
fbc316e1e634e967c5413a200cde7ad6- Authentihash SHA1
a1dd17b946ade947b621e9fec4fe7ad0835f0ac9- Authentihash SHA256
4533a11f4f190354b749f2842b57233e5e9e8b37fa4031bcb976118cff902101- Machine
- ARM64
- Version
- 16.42
- Publisher
- Sysinternals - www.sysinternals.com
procexp.SysSample 3 · HVCI FALSE
- MD5
eeb8e039f6d942538eb4b0252117899a- SHA1
bebf97411946749b9050989d9c40352dbe8269ea- SHA256
1b00d6e5d40b1b84ca63da0e99246574cdd2a533122bc83746f06c0d66e63a6e- Imphash
9376f1c4ab79240cc948b77bf9e8814b- Authentihash MD5
750ecd21c673a6fda9199887013d3751- Authentihash SHA1
82d3299c06b944895385fd2f3d9d18391273019d- Authentihash SHA256
8e38148ad4ed9946e8600b37f63996bf17c0101e3f50123b3b8513c895a4b521- Machine
- I386
- Version
- 12.00
- Publisher
- Sysinternals - www.sysinternals.com
procexp.SysSample 4 · HVCI FALSE
- MD5
c56a9ed0192c5a2b39691e54f2132a2f- SHA1
9099482b26e9ba8e1d303418afc9111a3bffd6b3- SHA256
30abc0cc700fdebc74e62d574addc08f6227f9c7177d9eaa8cbc37d5c017c9bb- Imphash
0b40636205c64cacfd2e4f407518ad58- Authentihash MD5
eb6ceb9aa0eaedee2d112b167908e871- Authentihash SHA1
4d68ec346d13359525da958af0fada57bc9ff35a- Authentihash SHA256
7a4e4ee169fe0f1f079e5f5c1da38ea70fe717e728faf054deb180f9e37fe574- Machine
- AMD64
- Version
- 11.30
- Publisher
- Sysinternals - www.sysinternals.com
procexp.SysSample 5 · HVCI FALSE
- MD5
6ff59faea912903af0ba8e80e58612bc- SHA1
736531c76b8d9c56e26561bf430e10ecabff0186- SHA256
3503ea284b6819f9cb43b3e94c0bb1bf5945ccb37be6a898387e215197a4792a- Imphash
d122c1eaa50839be14c31876d0d4e0be- Authentihash MD5
8b8a646469bdd1bab7b402ac83dba4a5- Authentihash SHA1
075998a905d4afda2e1727f6f31030c4d126dcc5- Authentihash SHA256
083828dd2e4afe22f5d27b56bd7f5a60e43aea7ec8f8cb0a138be84ee639a09c- Machine
- AMD64
- Version
- 15.00
- Publisher
- Sysinternals - www.sysinternals.com
procexp.SysSample 6 · HVCI FALSE
- MD5
8e78ab9b9709bafb11695a0a6eddeff9- SHA1
2f9b0cd96d961e49d5d3b416028fd3a0e43d6a28- SHA256
3c7e5b25a33a7805c999d318a9523fcae46695a89f55bbdb8bb9087360323dfc- Imphash
8a5edbe5251fe141ea0262d5d572178b- Authentihash MD5
acacde5c8a3a37b4fa43d9b651df85ea- Authentihash SHA1
f14e20cea5fac19bca02f5b067d12a459a393467- Authentihash SHA256
c286dfac5ca413efeb1936e876688b6bd46d25dc64206f86efb4f52ad83d1889- Machine
- AMD64
- Version
- 15.00
- Publisher
- Sysinternals - www.sysinternals.com
procexp.SysSample 7 · HVCI FALSE
- MD5
a91a1bc393971a662a3210dac8c17dfd- SHA1
e4fcb363cfe9de0e32096fa5be94a41577a89bb0- SHA256
3ff39728f1c11d1108f65ec5eb3d722fd1a1279c530d79712e0d32b34880baaa- Imphash
ebf30b4cd57a4f4548a03eab0f6c418c- Authentihash MD5
455eb57840b64c8fe0d942ea5da23c6b- Authentihash SHA1
aa8756d00691d3d8959b68c3626ba896cc2709fb- Authentihash SHA256
1a902521c5f82ad9acac815229a00e6ed9137b8d49106b64147b088ff89d0f01- Machine
- I386
- Version
- 11.40
- Publisher
- Sysinternals - www.sysinternals.com
procexp.SysSample 8 · HVCI FALSE
- MD5
e4a0bba88605d4c07b58a2cc3fac0fe9- SHA1
ac31d15851c0af14d60cfce23f00c4b7887d3cb7- SHA256
46621554728bc55438c7c241137af401250f062edef6e7efecf1a6f0f6d0c1f7- Imphash
f27327907e57c0c2c9fddc68eab2eb7b- Authentihash MD5
24263d0e152884eb7d180070164830c8- Authentihash SHA1
929c28f99d550278415c7087b71511e44439a41c- Authentihash SHA256
b4f9272894f926d4f3b957fca673140a3a24dc896f1a49badaa1e04687b223cd- Machine
- AMD64
- Version
- 15.00
- Publisher
- Sysinternals - www.sysinternals.com
procexp.SysSample 9 · HVCI FALSE
- MD5
880686bceaf66bfde3c80569eb1ebfa7- SHA1
10b9ae9286837b3bf6a00771c7e81adbdea3cbfe- SHA256
51e91dd108d974ae809e5fc23f6fbd16e13f672f86aa594dae4a5c4bc629b0b5- Imphash
505e0a016962137ca6169bce64ba2f53- Authentihash MD5
5d265a745ca048fb2ee0a59cc7ffc8aa- Authentihash SHA1
e5d5076fca6ed125d14d9f70fff802a1fa992ac6- Authentihash SHA256
17bdeeb4447f0758c3720991d3ed43a405efb49fd2cdbb37f7b5feb349693acb- Machine
- AMD64
- Version
- 12.00
- Publisher
- Sysinternals - www.sysinternals.com
procexp.SysSample 10 · HVCI FALSE
- MD5
ad03f225247b58a57584b40a4d1746d3- SHA1
e525f54b762c10703c975132e8fc21b6cd88d39b- SHA256
59b09bd69923c0b3de3239e73205b1846a5f69043546d471b259887bb141d879- Imphash
4792bcb395d06f9efb72e8020c4af5e6- Authentihash MD5
9e4c2a2e8832f10ecdd2be70eb6bc300- Authentihash SHA1
2b15e90dc654ce779bd460787352639768cd8baa- Authentihash SHA256
26536758c2247b6251a342d2e80de1753c006a0dce9b3b8a6a5b1d3110c8fc34- Machine
- AMD64
- Version
- 15.00
- Publisher
- Sysinternals - www.sysinternals.com
procexp.SysSample 11 · HVCI FALSE
- MD5
90f8c1b76f786814d03ef4c51d4abb6d- SHA1
d1c38145addfed1bcd1b400334ff5a5e2ef9a5c6- SHA256
6bfc0f425de9f4e7480aa2d1f2e08892d0553ed0df1c31e9bf3d8d702f38fa2e- Imphash
8a5edbe5251fe141ea0262d5d572178b- Authentihash MD5
028b8d642c1c76b18b74f3e0f76b3522- Authentihash SHA1
1aa871802d7278272172d9d7faabf8c8292996a3- Authentihash SHA256
76adb3fa346058e95ba3fd549fd48a15adaf4920a3109391f52053ebf39e62cc- Machine
- AMD64
- Version
- 15.00
- Publisher
- Sysinternals - www.sysinternals.com
procexp.SysSample 12 · HVCI FALSE
- MD5
f9d04e99e4cab90973226a4555bc6d57- SHA1
96ec8c16f6a54b48e9a7f0d0416a529f4bf9ac11- SHA256
6e944ae1bfe43a8a7cd2ea65e518a30172ce8f31223bdfd39701b2cb41d8a9e7- Imphash
b8a35d469bc164d86ac7c64e93b0037b- Authentihash MD5
8e66ec7a60a2b67386516a2e9a236d6b- Authentihash SHA1
07dfb6fe9b3876c0e1b1cda010cb3cc24ff2ce25- Authentihash SHA256
6b3316496ab1e2d1ef02be966d9caa171674856e8fb8ea78d6a3bcfe8e2013c1- Machine
- AMD64
- Version
- 15.00
- Publisher
- Sysinternals - www.sysinternals.com
procexp.SysSample 13 · HVCI FALSE
- MD5
659a59d7e26b7730361244e12201378e- SHA1
c21510569fd84a5fe04508aa28e3cf9c8cc45b7a- SHA256
77950e2a40ac0447ae7ee1ee3ef1242ce22796a157074e6f04e345b1956e143c- Imphash
d122c1eaa50839be14c31876d0d4e0be- Authentihash MD5
3798eddcccab7da4682f64997533d27d- Authentihash SHA1
0d753c1d21c4e6c6eb74d3436eb4c5f376cc7364- Authentihash SHA256
a4859c5456d03f799de89d2f8cbb36b4518259a6c7c0bc909b1fd16f48363d5a- Machine
- AMD64
- Version
- 15.00
- Publisher
- Sysinternals - www.sysinternals.com
procexp.SysSample 14 · HVCI FALSE
- MD5
da6f7407c4656a2dbaf16a407aff1a38- SHA1
ed40c1f7da98634869b415530e250f4a665a8c48- SHA256
7a48f92a9c2d95a72e18055cac28c1e7e6cad5f47aa735cbea5c3b82813ccfaf- Imphash
d122c1eaa50839be14c31876d0d4e0be- Authentihash MD5
4eae8421b149baa7d0ce15a86470cde2- Authentihash SHA1
af5ff77f2106b31a8e433c3689b6a65628c2dfce- Authentihash SHA256
19d579e5a08bcb524405bdcbd2ea7247548af9f23ce64582a5be5ae3f184ad23- Machine
- AMD64
- Version
- 16.41
- Publisher
- Sysinternals - www.sysinternals.com
procexp.SysSample 15 · HVCI FALSE
- MD5
6b3abe55c4d39e305a11b4d1091dfaac- SHA1
1c537fd17836283364349475c6138e6667cf1164- SHA256
86721ee8161096348ed3dbe1ccbf933ae004c315b1691745a8af4a0df9fed675- Imphash
421730c2b3fa3a7d78c2eda3da1be6a8- Authentihash MD5
4b64921bd05ed4a30830f23facb43bde- Authentihash SHA1
3d9be989fbb447bbf7e4b081d9ee4d9b025476c3- Authentihash SHA256
e2e351efd57c89bc0c7b9d4d440113304d0b8a4c88cdf0126442171aa50634d4- Machine
- IA64
- Version
- 11.40
- Publisher
- Sysinternals - www.sysinternals.com
procexp.SysSample 16 · HVCI FALSE
- MD5
cec257dcac9e708cefb17f8984dd0a70- SHA1
da361c56c18ea98e1c442aac7c322ff20f64486b- SHA256
88e2e6a705d3fb71b966d9fb46dc5a4b015548daf585fb54dfcd81dc0bd3ebdc- Imphash
4792bcb395d06f9efb72e8020c4af5e6- Authentihash MD5
df8e20e6fb1d2a22135e155763bf9588- Authentihash SHA1
1915e95974b6f75f4793e81b85e148ebdaa35515- Authentihash SHA256
0c2d8e8487de5e7749f9899f6fefa6e7d40b394479449b5027a895392af23349- Machine
- AMD64
- Version
- 15.00
- Publisher
- Sysinternals - www.sysinternals.com
procexp.SysSample 17 · HVCI FALSE
- MD5
bf74d0706f5ab9c34067192260f4efb0- SHA1
6b090c558b877b6abb0d1051610cadbc6335ecbb- SHA256
89b9823ed974a5b71de8468324d45b7e9d6dc914f93615ba86c6209b25b3cbf7- Imphash
4792bcb395d06f9efb72e8020c4af5e6- Authentihash MD5
c292f0024a454f42fba117b3505b12e9- Authentihash SHA1
d9ebe7ff8318eeece457fc72bec2b582d3350b61- Authentihash SHA256
f0fb06748758082263e252050904f2fd8a29a77ae71dfdb390346bd2046ebfd4- Machine
- AMD64
- Version
- 15.00
- Publisher
- Sysinternals - www.sysinternals.com
procexp.SysSample 18 · HVCI FALSE
- MD5
92927c47d6ff139c9b19674c9d0088f6- SHA1
a98734cd388f5b4b3caca5ce61cb03b05a8ad570- SHA256
98a123b314cba2de65f899cdbfa386532f178333389e0f0fbd544aff85be02eb- Imphash
d122c1eaa50839be14c31876d0d4e0be- Authentihash MD5
26f48296b5ef64120e55008690060a6e- Authentihash SHA1
8d59ed924e8c76b0ab8b7ee653510f43062eaa3e- Authentihash SHA256
cd1beb64cd67169d57ca4dbc602a94f74891962221bb49c09abf3339ce35bc90- Machine
- AMD64
- Version
- 16.42
- Publisher
- Sysinternals - www.sysinternals.com
procexp.SysSample 19 · HVCI TRUE
- MD5
2e219df70fccb79351f0452cba86623e- SHA1
2740cd167a9ccb81c8e8719ce0d2ae31babc631c- SHA256
9d5ebd0f4585ec20a5fe3c5276df13ece5a2645d3d6f70cedcda979bd1248fc2- Imphash
3c9af2347198d96c8ab5b189b4e3db37- Authentihash MD5
0f461053add90ebe0bac9e8be9d9a8e5- Authentihash SHA1
5b27248685b909d5ae4c8ec77e2d3dcb02d6cc4b- Authentihash SHA256
cddd341f267a6094f7bd7d1b56427ebc029ccb348e7f0714d9301c2c67fdd5df- Machine
- I386
- Version
- 15.00
- Publisher
- Sysinternals - www.sysinternals.com
procexp.SysSample 20 · HVCI FALSE
- MD5
0ef05030abd55ba6b02faa2c0970f67f- SHA1
f6d826d73bf819dbc9a058f2b55c88d6d4b634e3- SHA256
bced04bdefad6a08c763265d6993f07aa2feb57d33ed057f162a947cf0e6668f- Imphash
5bb79a6caa12076a6d140085cb53892e- Authentihash MD5
82ece436a712985b767d42a178872ab3- Authentihash SHA1
e7bedb9528d3da5e7e161a14db260140a02facca- Authentihash SHA256
d28acafeb6a85294d2672fa894a2934599713aa9ce1b21184dc1ec34131af7bb- Machine
- I386
- Version
- 9.30
- Publisher
- Sysinternals - www.sysinternals.com
procexp.SysSample 21 · HVCI FALSE
- MD5
b7ca4c32c844df9b61634052ae276387- SHA1
6df6d5b30d04b9adb9d2c99de18ed108b011d52b- SHA256
bdbceca41e576841cad2f2b38ee6dbf92fd77fbbfdfe6ecf99f0623d44ef182c- Imphash
0b40636205c64cacfd2e4f407518ad58- Authentihash MD5
1694c87131cee15e63d71936859506b8- Authentihash SHA1
5eb106f413ad1d8de4c04661a1c5162410164d50- Authentihash SHA256
120f7983011211e6740d7a3a4cd2354507866ef7d36a48e2e3a9bd5b52c21c8a- Machine
- AMD64
- Version
- 11.01
- Publisher
- Sysinternals - www.sysinternals.com
procexp.SysSample 22 · HVCI FALSE
- MD5
9beecfb3146f19400880da61476ef940- SHA1
d5beca70469e0dcb099ba35979155e7c91876fd2- SHA256
c089a31ac95d41ed02d1e4574962f53376b36a9e60ff87769d221dc7d1a3ecfa- Imphash
4792bcb395d06f9efb72e8020c4af5e6- Authentihash MD5
c292f0024a454f42fba117b3505b12e9- Authentihash SHA1
d9ebe7ff8318eeece457fc72bec2b582d3350b61- Authentihash SHA256
f0fb06748758082263e252050904f2fd8a29a77ae71dfdb390346bd2046ebfd4- Machine
- AMD64
- Version
- 15.00
- Publisher
- Sysinternals - www.sysinternals.com
procexp.SysSample 23 · HVCI FALSE
- MD5
b79475c4783efdd8122694c6b5669a79- SHA1
d612165251d5f1dcfb1f1a762c88d956f49ce344- SHA256
cdfbe62ef515546f1728189260d0bdf77167063b6dbb77f1db6ed8b61145a2bc- Imphash
d122c1eaa50839be14c31876d0d4e0be- Authentihash MD5
bee5a87f72b42f3bb5958ba541f4caff- Authentihash SHA1
9e0516a6ce73163e2ff5bf0740b57da46846228b- Authentihash SHA256
74716032cc2f63c67b9df0882c6794b4bf66147d943329db5f233a04c2fd9b12- Machine
- AMD64
- Version
- 16.32
- Publisher
- Sysinternals - www.sysinternals.com
procexp.SysSample 24 · HVCI FALSE
- MD5
318e309e11199ec69d8928c46a4d901b- SHA1
63bb17160115f16b3fca1f028b13033af4e468c6- SHA256
d6827cd3a8f273a66ecc33bb915df6c7dea5cc1b8134b0c348303ef50db33476- Imphash
b8a35d469bc164d86ac7c64e93b0037b- Authentihash MD5
decbda17e27f012c72e5ff39c8c19089- Authentihash SHA1
ecdaa78f29e1f1a27d28b45a9de5f93af9f18f15- Authentihash SHA256
ee24071d9a0ef38dc98929cfb4d316f9fb010de107c110fad2403022cf1eebfc- Machine
- AMD64
- Version
- 15.00
- Publisher
- Sysinternals - www.sysinternals.com
procexp.SysSample 25 · HVCI TRUE
- MD5
c69c292e0b76b25a5fa0e16136770e11- SHA1
05eff2001f595f9e2894c6b5eee756ae72379a6d- SHA256
e07211224b02aaf68a5e4b73fc1049376623793509d9581cdaee9e601020af06- Imphash
4792bcb395d06f9efb72e8020c4af5e6- Authentihash MD5
92c56a03fbcd375d9569e1cf60bf78cd- Authentihash SHA1
be428ed7b322ad13b2207294b934b0a67aa8345d- Authentihash SHA256
fa959c48c055ec149d434a5adeb9f9938d1c260a65ee8a4ea1d67bfbdceab83f- Machine
- AMD64
- Version
- 15.00
- Publisher
- Sysinternals - www.sysinternals.com
procexp.SysSample 26 · HVCI FALSE
- MD5
9982da703f13140997e137b1e745a2e3- SHA1
511b06898770337609ee065547dbf14ce3de5a95- SHA256
e3f2ee22dec15061919583e4beb8abb3b29b283e2bcb46badf2bfde65f5ea8dd- Imphash
d122c1eaa50839be14c31876d0d4e0be- Authentihash MD5
db32843b80c6e8c9173847c3faab2200- Authentihash SHA1
fffeec16afdeedd2bee22860f0942c846ba9ee1a- Authentihash SHA256
cee01c69cb0c06dd0d98ff05aeb2b0a34a4aa1a71d35a3033bf9c1a35b637c55- Machine
- AMD64
- Version
- 15.00
- Publisher
- Sysinternals - www.sysinternals.com
procexp.SysSample 27 · HVCI FALSE
- MD5
9b9d367cb53df0a2e0850760c840d016- SHA1
631fdd1ef2d6f2d98e36f8fc7adbf90fbfb0a1e8- SHA256
f29073dc99cb52fa890aae80037b48a172138f112474a1aecddae21179c93478- Imphash
d122c1eaa50839be14c31876d0d4e0be- Authentihash MD5
dafa4bdbdbbd96532d03022cd6900fed- Authentihash SHA1
f2ff9b749f7c5f21043b42d97b8a386c702d4435- Authentihash SHA256
ab5324c992c7547020f85de3456516e0dba2c3c5aab10371723a96188354abaf- Machine
- AMD64
- Version
- 15.00
- Publisher
- Sysinternals - www.sysinternals.com
procexp152.sysSample 28 · HVCI FALSE
- MD5
ad03f225247b58a57584b40a4d1746d3- SHA1
e525f54b762c10703c975132e8fc21b6cd88d39b- SHA256
59b09bd69923c0b3de3239e73205b1846a5f69043546d471b259887bb141d879- Imphash
4792bcb395d06f9efb72e8020c4af5e6- Authentihash MD5
9e4c2a2e8832f10ecdd2be70eb6bc300- Authentihash SHA1
2b15e90dc654ce779bd460787352639768cd8baa- Authentihash SHA256
26536758c2247b6251a342d2e80de1753c006a0dce9b3b8a6a5b1d3110c8fc34- Machine
- AMD64
- Version
- 15.00
- Publisher
- Sysinternals - www.sysinternals.com
procexp.SysSample 29 · HVCI FALSE
- MD5
97e3a44ec4ae58c8cc38eefc613e950e- SHA1
bc47e15537fa7c32dfefd23168d7e1741f8477ed- SHA256
440883cd9d6a76db5e53517d0ec7fe13d5a50d2f6a7f91ecfc863bc3490e4f5c- Imphash
d122c1eaa50839be14c31876d0d4e0be- Authentihash MD5
0a7106a04e6e3b13eb105b013f76e031- Authentihash SHA1
0c74316dfb9c21b7ff2dc288c005f9474dc26589- Authentihash SHA256
c7fef94e329bd9b66b281539265f989313356cbd9c345df9e670e9c4b6e0edce- Machine
- AMD64
- Version
- 16.43
- Publisher
- Sysinternals - www.sysinternals.com
procexp.sysSample 30 · HVCI FALSE
- MD5
b79475c4783efdd8122694c6b5669a79- SHA1
d612165251d5f1dcfb1f1a762c88d956f49ce344- SHA256
cdfbe62ef515546f1728189260d0bdf77167063b6dbb77f1db6ed8b61145a2bc- Imphash
d122c1eaa50839be14c31876d0d4e0be- Authentihash MD5
bee5a87f72b42f3bb5958ba541f4caff- Authentihash SHA1
9e0516a6ce73163e2ff5bf0740b57da46846228b- Authentihash SHA256
74716032cc2f63c67b9df0882c6794b4bf66147d943329db5f233a04c2fd9b12- Machine
- AMD64
- Version
- 16.32
- Publisher
- Sysinternals - www.sysinternals.com
procexp1627.sysSample 31 · HVCI FALSE
- MD5
c06dda757b92e79540551efd00b99d4b- SHA1
3296844d22c87dd5eba3aa378a8242b41d59db7a- SHA256
9b6a84f7c40ea51c38cc4d2e93efb3375e9d98d4894a85941190d94fbe73a4e4- Imphash
d122c1eaa50839be14c31876d0d4e0be- Authentihash MD5
f57e986673aee44bf51e7e6bb3ed0113- Authentihash SHA1
edc10781eb6d1e3bdf9d15cfebddbe1a1fb804d9- Authentihash SHA256
decba65bbf2232ac55a698539304cab211b45eef0ed17c05dd7995bef2b98fc6- Machine
- AMD64
- Version
- 16.27
- Publisher
- Sysinternals - www.sysinternals.com
Recorded command
sc.exe create procexp.sys binPath=C:\windows\temp\procexp.Sys type=kernel && sc.exe start procexp.SysElevate privileges · Privileges: kernel · OS: Windows 10
Research & references
- https://malware.news/t/lazarus-group-attack-case-using-vulnerability-of-certificate-software-commonly-used-by-public-institutions-and-universities/67715
- https://waawaa.github.io/en/Bypass-PPL-Using-Process-Explorer/
- https://github.com/magicsword-io/LOLDrivers/issues/57
- https://github.com/elastic/protections-artifacts/search?q=VulnDriver
- https://github.com/Yaxser/Backstab/blob/master/resources/PROCEXP.sys
- https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/
- https://github.com/magicsword-io/LOLDrivers/issues/55#issuecomment-1537161951