hlpdrv.sys

hlpdrv.sys is a malicious driver used to disable Windows Defender by modifying registry settings. This driver has been observed in Akira ransomware campaigns, where it is deployed to facilitate AV/EDR evasion or disablement through a Bring Your Own Vulnerable Driver (BYOVD) exploitation chain. The malware modifies the DisableAntiSpyware registry key via regedit.exe execution. In observed intrusions it is dropped to the user %TEMP% folder (C:\Users\<user>\AppData\Local\Temp\hlpdrv.sys) and registered as service KMHLPSVC alongside ThrottleStop.sys dropped as rwdrv.sys (service mgdsrv).

sc.exe create KMHLPSVC binPath=C:\windows\temp\hlpdrv.sys type=kernel && sc.exe start KMHLPSVC