procexp.sys

procexp.sys is the kernel helper used by Sysinternals Process Explorer, Microsoft's advanced task manager. Process Explorer is a developer and system-administrator staple; the driver is what lets it inspect kernel handles, driver state, and protected processes that user-mode APIs do not expose.

It is on the LOLDrivers list because that same inspection ability is useful for tampering with security products. There are well-known public reports of criminal data-extortion crews using older signed copies of procexp.sys to terminate endpoint-protection processes before deploying their payload; Microsoft now ships explicit blocks for those older builds in the Vulnerable Driver Blocklist.

Common on developer machines, power-user setups, and IT shops. Use the current Process Explorer release.

procexp.sys is listed as a known-vulnerable driver on the public LOLDrivers project. 28 distinct binary hashes matching this filename are on record, meaning multiple versions of the file have been observed.