iqvw64.sys

iqvw64.sys is a legacy Intel Ethernet diagnostic driver, originally bundled with Intel's PROSet networking software. Intel patched the underlying flaw (CVE-2015-2291) over a decade ago, but the older signed binary still loads on modern Windows.

It has become one of the most-documented BYOVD targets in public security research, including in the public reporting on the Slingshot and Equation APT campaigns and, more recently, on RobbinHood-family extortion software that used it to disable security drivers. The presence of the driver name in those write-ups is what keeps it on every blocklist; the underlying gaming PC reality is much more boring.

Most current Intel network software does not include this driver. If you find it, look for an outdated Intel networking utility and update it.

iqvw64.sys is listed as a known-vulnerable driver on the public LOLDrivers project. 19 distinct binary hashes matching this filename are on record, meaning multiple versions of the file have been observed.