← Back to driver explorer
Driver intelligenceVulnerableVerified
xhunter2.sys
Wellbia xhunter2.sys version 2026.6.1.192 is an XIGNCODE3 anti-cheat kernel component affected by CVE-2026-15430. Public research demonstrates bypasses for its module, caller, and request authentication layers, exposing privileged command paths for cross-process memory access, protected-process handle creation, process termination, local privilege escalation, and kernel-assisted code injection.
Known samples 1
0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
xhunter2.sysSample 1 · HVCI unknown
- MD5
9976ae79fb3887e0243dc159b2b68a48- SHA1
fb2dc9c59b8dfcf040b42f7d5eb41eb7b12852fb- SHA256
44cefb0b3b6516e6731de09a3e2e0eb8b98b02cc3fdf7bb4b22680e93f3cde1e- Imphash
adbf77a9144f66e2953ee1e6ed60c41c- Authentihash MD5
2e89c3f2aed10a71f7d1dcf16c711fe0- Authentihash SHA1
943f317e5ef8fcff293e959ec1a57d1a66dfe3e4- Authentihash SHA256
3c92a1df7bb856afaef29216533b1d407408bfc4c6236961eb2b769c205f936f- Machine
- AMD64
- Version
- 2026.6.1.192
- Publisher
- Wellbia.com Co., Ltd.
Recorded command
sc.exe create xhunter2 binPath= C:\windows\temp\xhunter2.sys type= kernel && sc.exe start xhunter2Impair security processes and access protected process memory through privileged kernel command paths. · Privileges: kernel · OS: Windows 10, Windows 11
Research & references
Acknowledgement: BlackSnufkin @BlackSnufkin42