CmdID

CmdID / Files

athpexnt.sys

Sample Driver (AMD64) file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers
T1068Exploitation for Privilege Escalation
Its entryhttps://www.loldrivers.io/drivers/f4e00816-97a8-4c2d-b990-9812f16fe3d3/

1 known sample

1,0,0,2 · its entry

fa0902daefbd9e716faaac8e854144ea0573e2a41192796f3b3138fe7a1d19f1

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real athpexnt.sys?

file version info and known copies
ProductAhnLab Security Product, AhnLab, Inc.
DescriptionSample Driver (AMD64)

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.