CmdID / Files

ArgusMonitor.sys

Argus Monitor Hardware Access Driver file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/08fbd284-7ad2-466d-b55f-6d5a7d07aca5/

1 known sample

2.40.2 · its entry

df9b2892498c68805fdc0fabb369f8bcf011e784898cb32fdc5d85f6123f1126

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real ArgusMonitor.sys?

file version info and known copies

ProductArgus Monitor Driver, Argotronic eGbR

DescriptionArgus Monitor Hardware Access Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.