← Back to driver explorer
Driver intelligenceVulnerableVerified
ardrv.sys
OPSWAT AppRemover ardrv.sys version 2017.10.02.1551 and earlier exposes a user-accessible \\.\ardrv device. Public research documents IOCTL 0x2420031 reaching process-termination paths, including ZwTerminateProcess, without sufficient caller or target validation. This allows local users to terminate arbitrary processes, including security tooling, and makes the driver useful in BYOVD-style defense impairment after it is loaded. Acronis observed the tracked ardrv.sys variant in an August 2026 campaign where it was used to terminate Microsoft Defender, Huorong, and Tencent security processes before SparkRAT deployment.
Known samples 16
1 recorded TRUE · 0 recorded FALSE · 15 unknown for loading despite HVCI. Results apply to individual samples.
ardrv.sysSample 1 · HVCI TRUE
- MD5
826c6d2e3d80f2d43f7977f998525ad3- SHA1
7340eae2ccf3d57ac3ae271c9983996d8ae7fde0- SHA256
07c5209bf83065fe760f4fee4ed2308b0c523671f68ca73a3854c2c8c28c0541- Imphash
04becf2aed91570c44993f040922303d- Authentihash MD5
68b2bff40bed9106fe7d684926fae2cc- Authentihash SHA1
cf52d28e919f5034a2d206491742ab21df16e0d4- Authentihash SHA256
c23b96fdf13b405480bbcd2e611cc67d98fd92f92cd2444da73fd8c4a4770393- Machine
- AMD64
- Version
- 2017.10.02.1551
- Publisher
- OPSWAT, Inc.
ardrv.sysSample 2 · HVCI unknown
- MD5
567f0e5ba3865b0c3af7083ca02794d9- SHA1
4efb248e4330ead57850ed81f249c54af783e88b- SHA256
7504887e1e195ad585cffa5b6a5034161a7cc49f351123d60def79302bdb8326- Imphash
04becf2aed91570c44993f040922303d- Authentihash MD5
68b2bff40bed9106fe7d684926fae2cc- Authentihash SHA1
cf52d28e919f5034a2d206491742ab21df16e0d4- Authentihash SHA256
c23b96fdf13b405480bbcd2e611cc67d98fd92f92cd2444da73fd8c4a4770393- Machine
- AMD64
- Version
- 2017.10.02.1551
- Publisher
- OPSWAT, Inc.
ardrv_1.sysSample 3 · HVCI unknown
- MD5
099b1f700fbe9d6cebe21e6edd24ba80- SHA1
70b09d5ae1b0e6c5cb2e05e2587f11baba8d2292- SHA256
0b4c5a2d24810748de8ce6fb3d6a3e8acd0305272d6425fa054632410d23ec80- Imphash
04becf2aed91570c44993f040922303d- Authentihash MD5
429e22f2a8d076f0374c83717958cd24- Authentihash SHA1
cd45e04ef4d008f9c39fa744048b741a16aa9e74- Authentihash SHA256
0a06c3ad018bf9756293d858418493f66ca807f67b9a42e72b96276a96bcbe7d- Machine
- AMD64
- Version
- 2017.11.21.1111
- Publisher
- OPSWAT, Inc.
ardrv_2.sysSample 4 · HVCI unknown
- MD5
75f0123d41e16a14f98c47a2d40bce68- SHA1
de016290d02e6fb438950da38311c0309909e67c- SHA256
1c5129b4d63f2d5252b5b02a0a7d655dac3b6eac23dd4ed92b4dd55f243387ff- Imphash
a7bb9c93850e96a3893e41efd0986b3b- Authentihash MD5
f39442348d960f6a96ef23da92e7da29- Authentihash SHA1
747ac325a69b19ff8e552657b5fb249c7e40d541- Authentihash SHA256
9fe018578f9b53dc5cfff659974a69351e630f17a078210f7b71c4026c43aaaf- Machine
- AMD64
- Version
- 2019.10.22.0658
- Publisher
- OPSWAT, Inc.
ardrv_3.sysSample 5 · HVCI unknown
- MD5
a21bc9c04bd840d655bfcd274cc84e40- SHA1
da57a16315d9e9c7bd426cc69bbb0427874b52d7- SHA256
4d07b6423f4d5d80d2daec8faed7ecc40855339bee95c26289179c1fd083078e- Imphash
04becf2aed91570c44993f040922303d- Authentihash MD5
4d827e63c628676213a2a63e13fc1ca5- Authentihash SHA1
fae53fe11250869426275062dfa59fe891edb79c- Authentihash SHA256
b8c5be860e52484d513f45266eb41e7587d2db69c5fed075bc6f3b546aba5b6e- Machine
- AMD64
- Version
- 2018.11.14.1555
- Publisher
- OPSWAT, Inc.
ardrv_4.sysSample 6 · HVCI unknown
- MD5
1569d08f94cca34993ae1ccb763de7d0- SHA1
590df795c95b229360abb5cd1d83c1eaef755e01- SHA256
6b208ce68ba3f6c788bd89ba677ebf1c2407a55f9f43a42ea7207635634baf66- Imphash
04becf2aed91570c44993f040922303d- Authentihash MD5
273297a89c1c999554acb5cfcc8b034f- Authentihash SHA1
d906ddf3fbbaa66ba04e17bd805aab5102b91af4- Authentihash SHA256
40d9ef785f8363522bd79f70b03c30f8e82902860b3d40cebff42f95130c8cd4- Machine
- AMD64
- Version
- 2019.04.23.1053
- Publisher
- OPSWAT, Inc.
ardrv_6.sysSample 7 · HVCI unknown
- MD5
78518c0636da8f3bf1bbeefbeb2b4920- SHA1
4e367bb25124c2e45579f267a0fb01bcc3fc3f3b- SHA256
7b3f8fa5844d829142002d47c2df8573c7d67defe4171414c6a015a38afe55f5- Imphash
04becf2aed91570c44993f040922303d- Authentihash MD5
724292b2e438061faa574208759022f1- Authentihash SHA1
4322a81827b98943887cc7696cd9a649992092de- Authentihash SHA256
f219247bdbbb8755ba0d765424e4a753ca5b01b1ce4e74a4c651a2867c82f7e4- Machine
- AMD64
- Version
- 2018.03.02.1310
- Publisher
- OPSWAT, Inc.
ardrv_7.sysSample 8 · HVCI unknown
- MD5
630c1751ae29f3e1a127afcbcfa7c4d7- SHA1
1583390bdd47357cf81d116d449f882b908348cb- SHA256
9f326ede322930a7d5e149fa8720802b0623c1972dc54e41a2a73608fb6810dd- Imphash
04becf2aed91570c44993f040922303d- Authentihash MD5
71d5ca5029e81a04e0d65a387c197b6d- Authentihash SHA1
e055500885c87851e8f53810957c47f68eea36c9- Authentihash SHA256
958b3c5b647856ed0fabc30683e9deb256968060b85411e8afe9ed3d94884c38- Machine
- AMD64
- Version
- 2018.10.10.0320
- Publisher
- OPSWAT, Inc.
ardrv_8.sysSample 9 · HVCI unknown
- MD5
3226c85fee6897a798a566aeb9d0b2f0- SHA1
029430fcfc45dc1fda080af6b429e5f48fc8216f- SHA256
34ad901b4fea05da301ebb619fa48cfac058720e41db71b3fca1c47763bae066- Imphash
04becf2aed91570c44993f040922303d- Authentihash MD5
aaadb7cd10b470f24c1d06e6ed4a0c90- Authentihash SHA1
38e59152902d88ebe97cd65255e423acd1b97df9- Authentihash SHA256
ca94e53f4537f945a734c27d1ad28b318ffd3c746232e3dd03070e2ed505c962- Machine
- AMD64
- Version
- 2018.03.22.0625
- Publisher
- OPSWAT, Inc.
ardrv_9.sysSample 10 · HVCI unknown
- MD5
c8078d9e8bc13f562631c2a742b42c39- SHA1
5971b2b204b2e60dc8c4727833c99decac11a714- SHA256
4574cf50dbe2fbce849881e8875297753ce2e240c312e01b3b461d80df063bbe- Imphash
04becf2aed91570c44993f040922303d- Authentihash MD5
c94e9d5d40e78bb6fdd5cf335f9a390a- Authentihash SHA1
05f6effe0e2768d3ff1471a5b06e0c9dd4a09278- Authentihash SHA256
2ade2faf3b07080560d5d9792ff635c9f6cc1f530fd7cfb005aa8b5a048f2017- Machine
- AMD64
- Version
- 2018.06.14.0343
- Publisher
- OPSWAT, Inc.
ardrv_10.sysSample 11 · HVCI unknown
- MD5
e62c7582ecc0f5a9694f02374c0014ed- SHA1
19a7c0f3bd57e289c3522b0ec94df86dc051145f- SHA256
75454a8583ea2a5b6c7711e9bf32c61b8a7e902f5c429fcbe36673ccc076e910- Imphash
04becf2aed91570c44993f040922303d- Authentihash MD5
68b2bff40bed9106fe7d684926fae2cc- Authentihash SHA1
cf52d28e919f5034a2d206491742ab21df16e0d4- Authentihash SHA256
c23b96fdf13b405480bbcd2e611cc67d98fd92f92cd2444da73fd8c4a4770393- Machine
- AMD64
- Version
- 2017.10.02.1551
- Publisher
- OPSWAT, Inc.
ardrv_11.sysSample 12 · HVCI unknown
- MD5
e03e68542ce64a1922794f497faeb861- SHA1
99f6eee59a77b479cc4fb6e9007a1294cab8d9f7- SHA256
551254a5e59df92e6049867162633e3e476cdf5999d05c3e23a57c98be03f475- Imphash
04becf2aed91570c44993f040922303d- Authentihash MD5
62dbea684cb595e62d8a05813c252ecf- Authentihash SHA1
a2bb57742714c7e25dc08eed86b667e749d0651d- Authentihash SHA256
52fc780cc73b70fda46d528cdea0700d8e4c0ffa586dc0d543f6a86d532ea12e- Machine
- AMD64
- Version
- 2018.04.19.0409
- Publisher
- OPSWAT, Inc.
ardrv_13.sysSample 13 · HVCI unknown
- MD5
3c06828180ffe41164bf353c97c813bb- SHA1
b2f72854bbef8ef1b7be7fa9f5a5967a0161d001- SHA256
33233988d8c735fdf1162e043ed1e6fff62e7d6102c5bd300561d71fd32526f3- Imphash
04becf2aed91570c44993f040922303d- Authentihash MD5
7fca31ccd3dc311b164dab3c7d7ab1b1- Authentihash SHA1
7b4a420fd8d69037ba8ad37a3e2b2208e7bdbf8c- Authentihash SHA256
bc3171fb4293c061770ecd9db47b19adf8a7375523d58085d6e5deb228a3360c- Machine
- AMD64
- Version
- 2017.11.15.1435
- Publisher
- OPSWAT, Inc.
ardrv_14.sysSample 14 · HVCI unknown
- MD5
77bdf1dada2014c98e4e50b2765fbd05- SHA1
11e24f2debc92df1dd0574a7de14ae7903b1ca5f- SHA256
59080957de2519f5013be8ccf0b9012dc97ad692e69578cb3f60148c528bdbb1- Imphash
a7bb9c93850e96a3893e41efd0986b3b- Authentihash MD5
1af56274e9ab6dbb0304ee0280c0b71c- Authentihash SHA1
f7e3d145f82d069dc318723a1814dfbf52cf9675- Authentihash SHA256
135621810a6cf5cd73ce2a08c5b1c35111ecac44bc0e1a8e241f328f6f7ed5e9- Machine
- AMD64
- Version
- 2019.09.06.0344
- Publisher
- OPSWAT, Inc.
ardrv_15.sysSample 15 · HVCI unknown
- MD5
50390455e92fb62cbe6a89dbb61037c2- SHA1
b02ad9271e5410dfd7edd03d50469997ea54a8b2- SHA256
d82108e6578f4866d7114d6847282c04f0b146809bc66ded3300fe993b42d20f- Imphash
04becf2aed91570c44993f040922303d- Authentihash MD5
516afe0e8a9715fe3c7c2799717ac537- Authentihash SHA1
2280abcbe90c9afd74b3393e484f0a033241c0ea- Authentihash SHA256
3484d14dd304bfb29343e2c38ed28cfc6838771d250029468e6a2c4ab8384ea1- Machine
- AMD64
- Version
- 2018.08.28.0135
- Publisher
- OPSWAT, Inc.
ardrv_16.sysSample 16 · HVCI unknown
- MD5
400dadc6b2cedba270fd1e2ff8295813- SHA1
ff7d6a3f9d7534cf822759950a03da312e5e6536- SHA256
e3cb9f52a4fde53fc886dc35d41bb36e8b993c74826389d22440b92d94480a6d- Imphash
04becf2aed91570c44993f040922303d- Authentihash MD5
66ef2f069da685e765e779a62744dc24- Authentihash SHA1
e8df9abc595355f8073c3459c8fa145bcaeeac8a- Authentihash SHA256
67c2bd29bc47bb2cfcf8d0a804c75394986bea81a90f4abc322ac9cf4235ce2e- Machine
- AMD64
- Version
- 2018.08.16.0951
- Publisher
- OPSWAT, Inc.
Recorded command
sc.exe create ardrv binPath= C:\windows\temp\ardrv.sys type= kernel && sc.exe start ardrvTerminate arbitrary processes from kernel mode through an insufficiently protected IOCTL handler. · Privileges: kernel · OS: Windows 10, Windows 11
Research & references
Acknowledgement: Jehad Abudagga, wwwab, Jose Manuel Martinez @j3h4ck, @wwwab123, @josemmm11-eng