BioNTdrv.sys
A part of Paragon System Utilities file version info
Driver on Windows LOLDrivers vulnerable driver
A known vulnerable driver
T1068Exploitation for Privilege Escalation
6 known samples
174c8d771d31d70fc95448e961a395f5ceb7658f0cc381a718fb3b854cde4efe6415b01fbe1e2694547c472f3fad6e17ffb33efdfb44a89cbb623cbd4f731f2a69a9c8f3134130617f3bbe19a7221752d98f029763cd2d9100fec4680333ed16e78f14d0adf4c5599b09d3995f84d265dbea20fc25112a9c3227b7a35910ca90f83560719a0054cb9911811372d0fcb2d8b3704d30c5503cd0aeeccda3dc6b4bfb0dbc3b9c897b7571b94fb2203ffb1ac0facfe366b2cb1f91904ea5335018f0From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real BioNTdrv.sys?
ProductParagon System Utilities, Paragon Software GmbH
DescriptionA part of Paragon System Utilities
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.