← Back to driver explorer
Driver intelligenceVulnerableVerified
HP_SWTOOLS_DRIVER.sys
HP_SWTOOLS_DRIVER exposes privileged CPU and memory operations through the \\.\HP_WKS_SWTOOLS_DRIVER device. Static analysis confirms IOCTLs for MSR read and write, performance-counter access, physical/MMIO mapping and read/write, PCI configuration access, port I/O, and a CPU-halt path. A standard user can reach the device after an administrator installs the driver.
Known samples 1
0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
HP_SWTOOLS_DRIVER.sysSample 1 · HVCI unknown
- MD5
c3c0be3d23dac6698ba12cea5d7b2dd8- SHA1
528c24f0b3424598843937c10f97ee37dbb07109- SHA256
bf07c46effde8b6b0fd3c9586a5a9636800fb37418c1e8e606c67cb613cbf832- Imphash
367517ad3d7699009eb23e8b62c3d5d5- Authentihash MD5
2bfeb9e03baf8869598f2eb8753af710- Authentihash SHA1
eaa3f5e371f710b9823e297eafcbd95ee6254433- Authentihash SHA256
6c9cf15e82c22d909eb2b17c4f7bc88ca246cf8b66f720d0094c8066c3fc39b9- Machine
- AMD64
- Version
- 1.5.0.0
- Publisher
- HP Inc.
Recorded command
sc.exe create HP_SWTOOLS_DRIVER binPath= C:\windows\temp\HP_SWTOOLS_DRIVER.sys type= kernel && sc.exe start HP_SWTOOLS_DRIVERRead or modify privileged CPU state and physical memory from user mode. · Privileges: Administrator required to install; device access is available to standard users after installation · OS: Windows 10, Windows 11
Research & references
Acknowledgement: Faxs @10fax01