CmdID / Files

ardrv.sys

AppRemover Driver file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/9eb0156e-4c43-487f-be8c-40a7b19a4279/

16 known samples

Show the 16 samples’ SHA-256 hashes

2019.10.22.0658 · its entry

1c5129b4d63f2d5252b5b02a0a7d655dac3b6eac23dd4ed92b4dd55f243387ff

2019.09.06.0344 · its entry

59080957de2519f5013be8ccf0b9012dc97ad692e69578cb3f60148c528bdbb1

2019.04.23.1053 · its entry

6b208ce68ba3f6c788bd89ba677ebf1c2407a55f9f43a42ea7207635634baf66

2018.11.14.1555 · its entry

4d07b6423f4d5d80d2daec8faed7ecc40855339bee95c26289179c1fd083078e

2018.10.10.0320 · its entry

9f326ede322930a7d5e149fa8720802b0623c1972dc54e41a2a73608fb6810dd

2018.08.28.0135 · its entry

d82108e6578f4866d7114d6847282c04f0b146809bc66ded3300fe993b42d20f

2018.08.16.0951 · its entry

e3cb9f52a4fde53fc886dc35d41bb36e8b993c74826389d22440b92d94480a6d

2018.06.14.0343 · its entry

4574cf50dbe2fbce849881e8875297753ce2e240c312e01b3b461d80df063bbe

2018.04.19.0409 · its entry

551254a5e59df92e6049867162633e3e476cdf5999d05c3e23a57c98be03f475

2018.03.22.0625 · its entry

34ad901b4fea05da301ebb619fa48cfac058720e41db71b3fca1c47763bae066

2018.03.02.1310 · its entry

7b3f8fa5844d829142002d47c2df8573c7d67defe4171414c6a015a38afe55f5

2017.11.21.1111 · its entry

0b4c5a2d24810748de8ce6fb3d6a3e8acd0305272d6425fa054632410d23ec80

2017.11.15.1435 · its entry

33233988d8c735fdf1162e043ed1e6fff62e7d6102c5bd300561d71fd32526f3

2017.10.02.1551 · its entry

07c5209bf83065fe760f4fee4ed2308b0c523671f68ca73a3854c2c8c28c0541

2017.10.02.1551 · its entry

7504887e1e195ad585cffa5b6a5034161a7cc49f351123d60def79302bdb8326

2017.10.02.1551 · its entry

75454a8583ea2a5b6c7711e9bf32c61b8a7e902f5c429fcbe36673ccc076e910

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real ardrv.sys?

file version info and known copies

ProductAppRemover Driver, OPSWAT, Inc.

DescriptionAppRemover Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.