Afd.sys
Ancillary Function Driver for WinSock file version info
Driver on Windows LOLDrivers vulnerable driver
A known vulnerable driver
T1068Exploitation for Privilege Escalation
2 known samples
10.0.22621.608 (WinBuild.160101.0800) · its entry
95fd266cc454177901cb58f4d30417c4a7caf29be62bb8649e5b8fca5882360010.0.22621.1105 (WinBuild.160101.0800) · its entry
ebf6be42d39fd5d9361afa43479f883ff8eba97d72f313ece289f78cb51c22f2From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real Afd.sys?
ProductMicrosoft® Windows® Operating System, Microsoft Corporation
DescriptionAncillary Function Driver for WinSock
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.