windbg.sys

WinDbg kernel debugger helper

From Microsoft

Part of the Microsoft family

Status

On a known malicious list

Known variants

17 distinct hashes

Field notes

A driver shipped with Microsoft's WinDbg debugging tools. It appears on the LOLDrivers list because of the kernel access debugging requires: a kernel debugger by definition can read and write the kernel.

Expected on developer machines that have the Windows Driver Kit or Debugging Tools installed.

What the record shows

windbg.sys is listed as malicious on the public LOLDrivers project. 17 distinct binary hashes matching this filename are on record, meaning multiple versions of the file have been observed.

What this means, plainly

Presence is not proof of misuse. This filename matches a public malicious list. Vera notes it as evidence on a record; the meaning still belongs to the people with the context.

Related drivers

Other drivers in the Microsoft family. See the whole family →

procexp.sys procexp1627.sys

Source

Status data comes from the public LOLDrivers project, a community-curated registry of drivers known to be vulnerable or malicious. The snapshot Vera uses was refreshed July 10, 2026. CVE links go to the NIST National Vulnerability Database.

In plain words

Kernel driver BYOVD Ring 0 Code-signing certificate Certificate revocation The full glossary →

Cite this entry

Vera Project. “windbg.sys.” Vera Field Guide (Driver). The Vera Project. https://www.veraproject.xyz/field-guide/drivers/windbg-sys