← Back to driver explorer
Driver intelligenceVulnerableVerified
TdkLib64.sys
The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.
Known samples 17
17 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
TdkLib64.sysSample 1 · HVCI TRUE
- MD5
7314c2bc19c6608d511ef36e17a12c98- SHA1
c00ad2a252b53cf2d0dc74b53d1af987982e1ad1- SHA256
2695390a8a7448390fe383beb1eee06d582202683f0273d6e72ef39a8cf709e1- Imphash
8e89024d2c0ef0451c12b956a2b55b91- Authentihash MD5
17fe30c93301824a424f2d61c442692b- Authentihash SHA1
4a6afd367eaea9dadcf0eb27d8c074d56d5cdd26- Authentihash SHA256
bcf811040c7552a2c93409a6cd2d63f8abbae121acca012e0b7f4fdc0b6a6b8b- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
TdkLib64.sysSample 2 · HVCI TRUE
- MD5
251e1ce4e8e9b9418830ed3dc8edd5e3- SHA1
64d0447cbb0d6a45010b94eb9d5b0b90296edcbf- SHA256
31e2e5c3290989e8624820cf5af886fd778ee8187fed593f33a6178f65103f37- Imphash
ca07de87d444c1d2d10e16e9dcc2dc19- Authentihash MD5
30b8c9b7e0cfc6d8cae8171887635007- Authentihash SHA1
28fcbce6c60bc9f0e815dd339f1c08fa4cc80dd7- Authentihash SHA256
9ff4ef4bc143cb8df2ae2f800d5124b117456b2e04d4c33db766b7e8e21ea048- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
TdkLib64.sysSample 3 · HVCI TRUE
- MD5
dc9be271f403e2278071d6ece408ff28- SHA1
42f6bfcf558ef6da9254ed263a89abf4e909b5d5- SHA256
38e6d7c2787b6289629c72b1ec87655392267044b4e4b830c0232243657ee8f9- Imphash
c0f234205c50cc713673353c9653eea1- Authentihash MD5
9b955306140aa5e1a96b98d4da9808af- Authentihash SHA1
1a5d50a3ad402e1e8f84b488e11876a79603bd3c- Authentihash SHA256
34f26fbfb72329cbb7f25d2b40cb0f553e1a80373972bcdad62c3c6284d5b2b1- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
TdkLib64.sysSample 4 · HVCI TRUE
- MD5
67b5b8607234bf63ce1e6a52b4a05f87- SHA1
c40ff3ebf6b5579108165be63250634823db32ec- SHA256
39f137083e6c0200543e1f8d3c074f857d141bdb8c8f09338d48520537b881aa- Imphash
c314c92b5c25c6f4323e3efaf8bde47a- Authentihash MD5
170f46d50f022ad74eda4920a382ad7f- Authentihash SHA1
8a156e7fed2b688235377e5febf83fe5ea028622- Authentihash SHA256
5c3ac6f22b3f1614ad0c01c180421f7588460accba5065562bf735d24bd3c674- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
TdkLib64.sysSample 5 · HVCI TRUE
- MD5
278761b706276f9b49e1e2fd21b9cb07- SHA1
1a40773dc430d7cb102710812b8c61fc51dfb79b- SHA256
4c807bacfcf5c30686e26812ec8d5581a824b82fee7434260c27c33eee2dfbe2- Imphash
08ab07a2bc35aea02cd6d1efbb954cb3- Authentihash MD5
f6bbe66fb5bb6f2267ff6a4f539c1750- Authentihash SHA1
6bd9a4ceb35bdf8cf449d85b9c1424dec1482638- Authentihash SHA256
8866f6e762dd7dea58c9e9486da53d716f3ae61048a8a10f8033b60fb5028914- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
TdkLib64.sysSample 6 · HVCI TRUE
- MD5
2a8662e91a51d8e04a94fa580c7d3828- SHA1
b62c5bae9c6541620379115a7ba0036ecfa19537- SHA256
506f56996fbcd34ff8a27e6948a2e2e21e6dbf42dab6e3a6438402000b969fd1- Imphash
304c4fcf70cfc8299a3b6eed8e7bbb31- Authentihash MD5
284bf44bdeda4a63582117174153f763- Authentihash SHA1
f682aeabaf6797e57d971eb3cca5fd16f7b75ac0- Authentihash SHA256
5dc477cc45e4c1421296373adef9f5795fb9f5035f1400c72bb37678ad7f8954- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
TdkLib64.sysSample 7 · HVCI TRUE
- MD5
d6c2e061b21c32c585aca5f38335c21c- SHA1
c32e6cddc7731408c747fd47af3d62861719fd7b- SHA256
5be106b92424b12865338b3f541b3c244dce9693fe15f763316f0c6d6fc073ee- Imphash
c314c92b5c25c6f4323e3efaf8bde47a- Authentihash MD5
4e3e460d4cebf0c109477be5ce7f933c- Authentihash SHA1
ef3256203e0f93ee9d8802a135641decf9fbe2b0- Authentihash SHA256
eb91e05733244a23f741a299e5e4a57836685a8f45366e690bc30b4befc02b14- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
TdkLib64.sysSample 8 · HVCI TRUE
- MD5
9bcb97a1697a70f59405786759af63b8- SHA1
91d026cd98de124d281fd6a8e7c54ddf6b913804- SHA256
5fbfd7c4ea3db1197ad38d5a945acf6f2f42cb350380cf8ae276bc80b0dedb77- Imphash
c0f234205c50cc713673353c9653eea1- Authentihash MD5
e3ccc0b4d5052cc744915a42c534df83- Authentihash SHA1
1767ade8ac3e931082b02f04b5d2e004e6f9c10b- Authentihash SHA256
cd57abaf2f20ea5b3f56db1193cb3772aa09bb2be3c4fa8001e7cf72ae1f078c- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
TdkLib64.sysSample 9 · HVCI TRUE
- MD5
555446a3ca8d9237403471d4744e39f4- SHA1
e83fc2331ae1ea792b6cff7e970f607fee7346be- SHA256
7277130afa0b1506998d7bc58567b0d83f52a27175f4c7c4a7186347095fceed- Imphash
c314c92b5c25c6f4323e3efaf8bde47a- Authentihash MD5
170f46d50f022ad74eda4920a382ad7f- Authentihash SHA1
8a156e7fed2b688235377e5febf83fe5ea028622- Authentihash SHA256
5c3ac6f22b3f1614ad0c01c180421f7588460accba5065562bf735d24bd3c674- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
TdkLib64.sysSample 10 · HVCI TRUE
- MD5
c6b5a3ae07b165a6e5fff7e31ff91016- SHA1
488b20ed53c2060c41b9a0cac1efb39a888df7c5- SHA256
797c1f883d90d25e7fd553624bb16bfd5db24c2658aa0c3c51c715d5833c10fd- Imphash
a8633e68c2ad9f3dc83775d8d5b21c5b- Authentihash MD5
19bf6b589e3b194cd7691c3c58172a4a- Authentihash SHA1
3fa52b5e77df976680a052ebca540e05a7235a9b- Authentihash SHA256
cf370bf2ef3fb6fd5e9722bad8af5347b74ce7252d291e2958b365aad1b0bb76- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
TdkLib64.sysSample 11 · HVCI TRUE
- MD5
2b653950483196f0d175ba6bc35f1125- SHA1
bfd8568f19d4273a1288726342d7620cc9070ae5- SHA256
89bc3cb4522f9b0bf467a93a4123ef623c28244e25a9c34d4aae11f705d187e7- Imphash
304c4fcf70cfc8299a3b6eed8e7bbb31- Authentihash MD5
284bf44bdeda4a63582117174153f763- Authentihash SHA1
f682aeabaf6797e57d971eb3cca5fd16f7b75ac0- Authentihash SHA256
5dc477cc45e4c1421296373adef9f5795fb9f5035f1400c72bb37678ad7f8954- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
TdkLib64.sysSample 12 · HVCI TRUE
- MD5
d7cf689e6c63d37bc071499f687300dd- SHA1
8e2511ae90643584ceb0d98f0f780cd6b7290604- SHA256
aa0c52cebd64a0115c0e7faf4316a52208f738f66a54b4871bd4162eb83dc41a- Imphash
91387ac37086b9b519f945b58095f38d- Authentihash MD5
7c35196443517038c52393f2641e80a9- Authentihash SHA1
389f098c0af203ddcc3c9a5905e79387c835a0fc- Authentihash SHA256
4d7d06d2f6af50ff5810c8d6a818cb59da635a56c0fdae5d0ed3d0aee4bedf3e- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
TdkLib64.sysSample 13 · HVCI TRUE
- MD5
fdf975524d4cdb4f127d79aac571ae9e- SHA1
5a69d921926ef0abf03757edf22c0d8d30c15d4b- SHA256
bef87650c29faf421e7ad666bf47d7a78a45f291b438c8d1c4b6a66e5b54c6fc- Imphash
a8633e68c2ad9f3dc83775d8d5b21c5b- Authentihash MD5
19bf6b589e3b194cd7691c3c58172a4a- Authentihash SHA1
3fa52b5e77df976680a052ebca540e05a7235a9b- Authentihash SHA256
cf370bf2ef3fb6fd5e9722bad8af5347b74ce7252d291e2958b365aad1b0bb76- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
TdkLib64.sysSample 14 · HVCI TRUE
- MD5
0a4e6bd5cc2e9172e461408be47c3149- SHA1
6b25acbcb41a593aca6314885572fc22d16582a2- SHA256
bfc121e93fcbf9bd42736cfe7675ae2cc805be9a58f1a0d8cc3aa5b42e49a13f- Imphash
a8633e68c2ad9f3dc83775d8d5b21c5b- Authentihash MD5
19bf6b589e3b194cd7691c3c58172a4a- Authentihash SHA1
3fa52b5e77df976680a052ebca540e05a7235a9b- Authentihash SHA256
cf370bf2ef3fb6fd5e9722bad8af5347b74ce7252d291e2958b365aad1b0bb76- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
TdkLib64.sysSample 15 · HVCI TRUE
- MD5
fcc5de75c1837b631ed77ea4638704b9- SHA1
b6543d006cb2579fb768205c479524e432c04204- SHA256
cbd4f66ae09797fcd1dc943261a526710acc8dd4b24e6f67ed4a1fce8b0ae31c- Imphash
7687d0eba49315582228ef660f61b471- Authentihash MD5
4c277e101b7ef1bcb6b8ed92e76c2c2e- Authentihash SHA1
36ce0ddb64a49ac05cfd7133861089d34f0bd433- Authentihash SHA256
1c0a63e8a6a335f2498794f44cf5629453075f31db314eaecbd964cf615de3f7- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
TdkLib64.sysSample 16 · HVCI TRUE
- MD5
97580157f65612f765f39af594b86697- SHA1
190c20e130a9156442eebcf913746c69b9485eec- SHA256
dd0bd7b8fae8e8835ba09118a02a06a51e111fccbe16916414844aab91cfeed4- Imphash
c0f234205c50cc713673353c9653eea1- Authentihash MD5
ec95d1e5166c31748a5a89e873806e01- Authentihash SHA1
d2660a9ec25cbdc57aea05cf0db52dc002387243- Authentihash SHA256
e3a74ac9d23efaa857333a4d8a40ed0026f28575475deeb6eb301fcc0db34efc- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
TdkLib64.sysSample 17 · HVCI TRUE
- MD5
4124de3cb72f5dfd7288389862b03f2a- SHA1
0cac0dbaa7adb7bba6e92c7cd2d514be7e86a914- SHA256
e34afe0a8c5459d13e7a11f20d62c7762b2a55613aaf6dbeb887e014b5f19295- Imphash
304c4fcf70cfc8299a3b6eed8e7bbb31- Authentihash MD5
f5bdaccb8d5ea6fdd229f2829ade9810- Authentihash SHA1
a191e684c3d55db3a913953370662517e5c78557- Authentihash SHA256
e2decc56788d257ce7f6b1915c90ea5a54fb5232f2bf9f311958de495a4eb308- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create TdkLib64sys binPath= C:\windows\temp\TdkLib64sys.sys type=kernel && sc.exe start TdkLib64sysElevate privileges · Privileges: kernel · OS: Windows 10