← Back to driver explorer
Driver intelligenceVulnerableVerified
PDFWKRNL.sys
AMD USB-C Power Delivery Firmware Update Kernel Library driver with arbitrary physical memory read/write capabilities. Identified in ESET EDR killers research (March 2026) as actively abused by threat actors to disable EDR products.
Known samples 2
0 recorded TRUE · 1 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
PDFWKRNL.sysSample 1 · HVCI unknown
- MD5
b96d75a000367c200958089728fc5cb8- SHA1
f329ae0fdf1e198bea6ba787e59cb73f90714002- SHA256
6e8b49cf70bf854e8c59c7d27cefa89406caf8978461190dabb86dafcd8554e1- Imphash
3f4c9025125027e307b7e52dd577303b- Authentihash MD5
d255a6146ab4e75a6ac362cf07641180- Authentihash SHA1
661a1a28950cec3f2c3d0e72ab2a05d4a173cf9a- Authentihash SHA256
fc23abdcf93928e1db8401a7ff53c86c85230a8637c4168f7434208f9e8b5ded- Machine
- AMD64
- Version
- 1.0
- Publisher
- Advanced Micro Devices, Inc.
PDFWKRNL.sysSample 2 · HVCI FALSE
- MD5
546b6f66c3ba0115ab13233e2504bd38- SHA1
62f3f7101d02c9c612b1175dc9e4a1c2f8fcde71- SHA256
e9745f1791b2a6374711756e89c7bf2864e52f9ff467974f2f7bdc667f9f28c6- Imphash
3f4c9025125027e307b7e52dd577303b- Authentihash MD5
d255a6146ab4e75a6ac362cf07641180- Authentihash SHA1
661a1a28950cec3f2c3d0e72ab2a05d4a173cf9a- Authentihash SHA256
fc23abdcf93928e1db8401a7ff53c86c85230a8637c4168f7434208f9e8b5ded- Machine
- AMD64
- Version
- 1.0
- Publisher
- Advanced Micro Devices, Inc.
Recorded command
sc.exe create PDFWKRNL.sys binPath=C:\windows\temp\PDFWKRNL.sys type=kernel && sc.exe start PDFWKRNL.sysElevate privileges · Privileges: kernel · OS: Windows 10
Research & references
Acknowledgement: ESET Research, fluffycats31 @ESETresearch, @fluffycats31