CmdID

CmdID / Files

cpuz.sys

CPUID Driver file version info

Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it

A known vulnerable driver

from LOLDrivers
T1068Exploitation for Privilege Escalation
Its entrieshttps://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/
https://www.loldrivers.io/drivers/16d8962b-cf96-432f-8a43-d41f06828f56/
https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/

102 known samples

Show the 102 samples’ SHA-256 hashes

6.1.7600.16385 built by: WinDDK · its entry

019c2955e380dd5867c4b82361a8d8de62346ef91140c95cb311b84448c0fa4f

6.1.7600.16385 built by: WinDDK · its entry

0484defcf1b5afbe573472753dc2395e528608b688e5c7d1d178164e48e7bed7

6.1.7600.16385 built by: WinDDK · its entry

0d3790af5f8e5c945410929e31d06144a471ac82f828afe89a4758a5bbeb7f9f

6.1.7600.16385 built by: WinDDK · its entry

0e8595217f4457757bed0e3cdea25ea70429732b173bba999f02dc85c7e06d02

6.1.7600.16385 built by: WinDDK · its entry

11a4b08e70ebc25a1d4c35ed0f8ef576c1424c52b580115b26149bd224ffc768

6.1.7600.16385 built by: WinDDK · its entry

11d258e05b850dcc9ecfacccc9486e54bd928aaa3d5e9942696c323fdbd3481b

6.1.7600.16385 built by: WinDDK · its entry

19696fb0db3fcae22f705ae1eb1e9f1151c823f3ff5d8857e90f2a4a6fdc5758

6.1.7600.16385 built by: WinDDK · its entry

1e16a01ef44e4c56e87abfbe03b2989b0391b172c3ec162783ad640be65ab961

6.1.7600.16385 built by: WinDDK · its entry

1ee59eb28688e73d10838c66e0d8e011c8df45b6b43a4ac5d0b75795ca3eb512

6.1.7600.16385 built by: WinDDK · its entry

1f4d4db4abe26e765a33afb2501ac134d14cadeaa74ae8a0fae420e4ecf58e0c

6.1.7600.16385 built by: WinDDK · its entry

2101d5e80e92c55ecfd8c24fcf2202a206a4fd70195a1378f88c4cc04d336f22

6.1.7600.16385 built by: WinDDK · its entry

2298e838e3c015aedfb83ab18194a2503fe5764a862c294c8b39c550aab2f08e

6.1.7600.16385 built by: WinDDK · its entry

26e3bfef255efd052a84c3c43994c73222b14c95db9a4b1fc2e98f1a5cb26e43

6.1.7600.16385 built by: WinDDK · its entry

2a6db9facf9e13d35c37dd468be04bae5f70c6127a9aee76daebddbdec95d486

6.1.7600.16385 built by: WinDDK · its entry

2a9d481ffdc5c1e2cb50cf078be32be06b21f6e2b38e90e008edfc8c4f2a9c4e

6.1.7600.16385 built by: WinDDK · its entry

3301b49b813427fa37a719988fe6446c6f4468dfe15aa246bec8d397f62f6486

6.1.7600.16385 built by: WinDDK · its entry

34bee22c18ddbddbe115cf1ab55cabf0e482aba1eb2c343153577fb24b7226d3

6.1.7600.16385 built by: WinDDK · its entry

368a9c2b6f12adbe2ba65181fb96f8b0d2241e4eae9f3ce3e20e50c3a3cc9aa1

6.1.7600.16385 built by: WinDDK · its entry

3813c1aab1760acb963bcc10d6ea3fddc2976b9e291710756408de392bc9e5d5

6.1.7600.16385 built by: WinDDK · its entry

3e07bb866d329a2f9aaa4802bad04fdac9163de9bf9cfa1d035f5ca610b4b9bf

6.1.7600.16385 built by: WinDDK · its entry

405a99028c99f36ab0f84a1fd810a167b8f0597725e37513d7430617106501f1

6.1.7600.16385 built by: WinDDK · its entry

40da0adf588cbb2841a657239d92f24b111d62b173204b8102dd0e014932fe59

6.1.7600.16385 built by: WinDDK · its entry

45c3d607cb57a1714c1c604a25cbadf2779f4734855d0e43aa394073b6966b26

6.1.7600.16385 built by: WinDDK · its entry

4d19ee789e101e5a76834fb411aadf8229f08b3ece671343ad57a6576a525036

6.1.7600.16385 built by: WinDDK · its entry

4d5059ec1ebd41284b9cea6ce804596e0f386c09eee25becdd3f6949e94139ba

6.1.7600.16385 built by: WinDDK · its entry

5177a3b7393fb5855b2ec0a45d4c91660b958ee077e76e5a7d0669f2e04bcf02

6.1.7600.16385 built by: WinDDK · its entry

523d1d43e896077f32cd9acaa8e85b513bfb7b013a625e56f0d4e9675d9822ba

6.1.7600.16385 built by: WinDDK · its entry

53bd8e8d3542fcf02d09c34282ebf97aee9515ee6b9a01cefd81baa45c6fd3d6

6.1.7600.16385 built by: WinDDK · its entry

572c545b5a95d3f4d8c9808ebeff23f3c62ed41910eb162343dd5338e2d6b0b4

6.1.7600.16385 built by: WinDDK · its entry

58cb5439e34be4ede6d93c463cb0433c99a100a1c06fca777eda751fd72c07bf

6.1.7600.16385 built by: WinDDK · its entry

592f56b13e7dcaa285da64a0b9a48be7562bd9b0a190208b7c8b7d8de427cf6c

6.1.7600.16385 built by: WinDDK · its entry

5b3705b47dc15f2b61ca3821b883b9cd114d83fcc3344d11eb1d3df495d75abe

6.1.7600.16385 built by: WinDDK · its entry

600a2119657973112025db3c0eeab2e69d528bccfeed75f40c6ef50b059ec8a0

6.1.7600.16385 built by: WinDDK · its entry

60b163776e7b95e0c2280d04476304d0c943b484909131f340e3ce6045a49289

6.1.7600.16385 built by: WinDDK · its entry

636b4c1882bcdd19b56370e2ed744e059149c64c96de64ac595f20509efa6220

6.1.7600.16385 built by: WinDDK · its entry

65deb5dca18ee846e7272894f74d84d9391bbe260c22f24a65ab37d48bd85377

6.1.7600.16385 built by: WinDDK · its entry

65e3548bc09dffd550e79501e3fe0fee268f895908e2bba1aa5620eb9bdac52d

6.1.7600.16385 built by: WinDDK · its entry

67734c7c0130dd66c964f76965f09a2290da4b14c94412c0056046e700654bdc

6.1.7600.16385 built by: WinDDK · its entry

68671b735716ffc168addc052c5dc3d635e63e71c1e78815e7874286c3fcc248

6.1.7600.16385 built by: WinDDK · its entry

69640e9209f8e2ac25416bd3119b5308894b6ce22b5c80cb5d5f98f2f85d42ce

6.1.7600.16385 built by: WinDDK · its entry

6befa481e8cca8084d9ec3a1925782cd3c28ef7a3e4384e034d48deaabb96b63

6.1.7600.16385 built by: WinDDK · its entry

6c5c6c350c8dd4ca90a8cca0ed1eeca185ebc67b1100935c8f03eb3032aca388

6.1.7600.16385 built by: WinDDK · its entry

73c03b01d5d1eb03ec5cb5a443714b12fa095cc4b09ddc34671a92117ae4bb3a

6.1.7600.16385 built by: WinDDK · its entry

771015b2620942919bb2e0683476635b7a09db55216d6fbf03534cb18513b20c

6.1.7600.16385 built by: WinDDK · its entry

78d49094913526340d8d0ef952e8fe9ada9e8b20726b77fb88c9fb5d54510663

6.1.7600.16385 built by: WinDDK · its entry

80eeb8c2890f3535ed14f5881baf2f2226e6763be099d09fb8aadaba5b4474c1

6.1.7600.16385 built by: WinDDK · its entry

8688e43d94b41eeca2ed458b8fc0d02f74696a918e375ecd3842d8627e7a8f2b

6.1.7600.16385 built by: WinDDK · its entry

8a0702681bc51419fbd336817787a966c7f92cabe09f8e959251069578dfa881

6.1.7600.16385 built by: WinDDK · its entry

8c95d28270a4a314299cf50f05dcbe63033b2a555195d2ad2f678e09e00393e6

6.1.7600.16385 built by: WinDDK · its entry

8cf0cbbdc43f9b977f0fb79e0a0dd0e1adabe08a67d0f40d727c717c747de775

6.1.7600.16385 built by: WinDDK · its entry

8d57e416ea4bb855b78a2ff3c80de1dfbb5dc5ee9bfbdddb23e46bd8619287e2

6.1.7600.16385 built by: WinDDK · its entry

8d6febd54ce0c98ea3653e582f7791061923a9a4842bd4a1326564204431ca9f

6.1.7600.16385 built by: WinDDK · its entry

900dd68ccc72d73774a347b3290c4b6153ae496a81de722ebb043e2e99496f88

6.1.7600.16385 built by: WinDDK · its entry

922d23999a59ce0d84b479170fd265650bc7fae9e7d41bf550d8597f472a3832

6.1.7600.16385 built by: WinDDK · its entry

955dac77a0148e9f9ed744f5d341cb9c9118261e52fe622ac6213965f2bc4cad

6.1.7600.16385 built by: WinDDK · its entry

9a523854fe84f15efc1635d7f5d3e71812c45d6a4d2c99c29fdc4b4d9c84954c

6.1.7600.16385 built by: WinDDK · its entry

a072197177aad26c31960694e38e2cae85afbab070929e67e331b99d3a418cf4

6.1.7600.16385 built by: WinDDK · its entry

a11cf43794ea5b5122a0851bf7de08e559f6e9219c77f9888ff740055f2c155e

6.1.7600.16385 built by: WinDDK · its entry

a3975db1127c331ba541fffff0c607a15c45b47aa078e756b402422ef7e81c2c

6.1.7600.16385 built by: WinDDK · its entry

aebcbfca180e372a048b682a4859fd520c98b5b63f6e3a627c626cb35adc0399

6.1.7600.16385 built by: WinDDK · its entry

b01ebea651ec7780d0fe88dd1b6c2500a36dacf85e3a4038c2ca1c5cb44c7b5d

6.1.7600.16385 built by: WinDDK · its entry

b0f6cd34717d0cea5ab394b39a9de3a479ca472a071540a595117219d9a61a44

6.1.7600.16385 built by: WinDDK · its entry

b4c07f7e7c87518e8950eb0651ae34832b1ecee56c89cdfbd1b4efa8cf97779f

6.1.7600.16385 built by: WinDDK · its entry

b738eab6f3e32cec59d5f53c12f13862429d3db6756212bbcd78ba4b4dbc234c

6.1.7600.16385 built by: WinDDK · its entry

b7aa4c17afdaff1603ef9b5cc8981bed535555f8185b59d5ae13f342f27ca6c5

6.1.7600.16385 built by: WinDDK · its entry

b8ffe83919afc08a430c017a98e6ace3d9cbd7258c16c09c4f3a4e06746fc80a

6.1.7600.16385 built by: WinDDK · its entry

b9695940f72e3ed5d7369fb32958e2146abd29d5895d91ccc22dfbcc9485b78b

6.1.7600.16385 built by: WinDDK · its entry

bac709c49ddee363c8e59e515f2f632324a0359e932b7d8cb1ce2d52a95981aa

6.1.7600.16385 built by: WinDDK · its entry

bc8cb3aebe911bd9b4a3caf46f7dda0f73fec4d2e4e7bc9601bb6726f5893091

6.1.7600.16385 built by: WinDDK · its entry

c3e150eb7e7292f70299d3054ed429156a4c32b1f7466a706a2b99249022979e

6.1.7600.16385 built by: WinDDK · its entry

c50f8ab8538c557963252b702c1bd3cee4604b5fc2497705d2a6a3fd87e3cc26

6.1.7600.16385 built by: WinDDK · its entry

c673f2eed5d0eed307a67119d20a91c8818a53a3cb616e2984876b07e5c62547

6.1.7600.16385 built by: WinDDK · its entry

c7f64b27cd3be5af1c8454680529ea493dfbb09e634eec7e316445ad73499ae0

6.1.7600.16385 built by: WinDDK · its entry

c8f0bb5d8836e21e7a22a406c69c01ba7d512a808c37c45088575d548ee25caa

6.1.7600.16385 built by: WinDDK · its entry

d0543f0fdc589c921b47877041f01b17a534c67dcc7c5ad60beba8cf7e7bc9c6

6.1.7600.16385 built by: WinDDK · its entry

d366cbc1d5dd8863b45776cfb982904abd21d0c0d4697851ff54381055abcfc8

6.1.7600.16385 built by: WinDDK · its entry

da617fe914a5f86dc9d657ef891bbbceb393c8a6fea2313c84923f3630255cdb

6.1.7600.16385 built by: WinDDK · its entry

ded2927f9a4e64eefd09d0caba78e94f309e3a6292841ae81d5528cab109f95d

6.1.7600.16385 built by: WinDDK · its entry

deecbcd260849178de421d8e2f177dce5c63cf67a48abb23a0e3cf3aa3e00578

6.1.7600.16385 built by: WinDDK · its entry

df0dcfb3971829af79629efd036b8e1c6e2127481b3644ccc6e2ddd387489a15

6.1.7600.16385 built by: WinDDK · its entry

e0b5a5f8333fc1213791af5c5814d7a99615b3951361ca75f8aa5022c9cfbc2b

6.1.7600.16385 built by: WinDDK · its entry

e51ec2876af3c9c3f1563987a9a35a10f091ea25ede16b1a34ba2648c53e9dfc

6.1.7600.16385 built by: WinDDK · its entry

e58bbf3251906ff722aa63415bf169618e78be85cb92c8263d3715c260491e90

6.1.7600.16385 built by: WinDDK · its entry

ee45fd2d7315fd039f3585a66e7855ba4af9d4721e1448e602623de14e932bbe

6.1.7600.16385 built by: WinDDK · its entry

ef1abc77f4000e68d5190f9e11025ea3dc1e6132103d4c3678e15a678de09f33

6.1.7600.16385 built by: WinDDK · its entry

f74ffd6916333662900cbecb90aca2d6475a714ce410adf9c5c3264abbe5732c

6.1.7600.16385 built by: WinDDK · its entry

f7e0cca8ad9ea1e34fa1a5e0533a746b2fa0988ba56b01542bc43841e463b686

6.1.7600.16385 built by: WinDDK · its entry

f8d6ce1c86cbd616bb821698037f60a41e129d282a8d6f1f5ecdd37a9688f585

6.1.7600.16385 built by: WinDDK · its entry

fb1183ef22ecbcc28f9c0a351c2c0280f1312a0fdf8a9983161691e2585efc70

6.1.7600.16385 built by: WinDDK · its entry

ff987c30ce822d99f3b4b4e23c61b88955f52406a95e6331570a2a13cbebc498

6.0.6000.16386 built by: WinDDK · its entry

2ef7df384e93951893b65500dac6ee09da6b8fe9128326caad41b8be4da49a1e

6.0.6000.16386 built by: WinDDK · its entry

49329fa09f584d1960b09c1b15df18c0bc1c4fdb90bf48b6b5703e872040b668

6.0.6000.16386 built by: WinDDK · its entry

6001c6acae09d2a91f8773bbdfd52654c99bc672a9756dc4cb53dc2e3efeb097

6.0.6000.16386 built by: WinDDK · its entry

79440da6b8178998bdda5ebde90491c124b1967d295db1449ec820a85dc246dd

6.0.6000.16386 built by: WinDDK · its entry

84c5f6ddd9c90de873236205b59921caabb57ac6f7a506abbe2ce188833bbe51

6.0.6000.16386 built by: WinDDK · its entry

8e5aef7c66c0e92dfc037ee29ade1c8484b8d7fadebdcf521d2763b1d8215126

6.0.6000.16386 built by: WinDDK · its entry

8e92aacd60fca1f09b7257e62caf0692794f5d741c5d1eec89d841e87f2c359c

6.0.6000.16386 built by: WinDDK · its entry

ac1af529c9491644f1bda63267e0f0f35e30ab0c98ab1aecf4571f4190ab9db4

6.0.6000.16386 built by: WinDDK · its entry

dbb457ae1bd07a945a1466ce4a206c625e590aee3922fa7d86fbe956beccfc98

6.0.6000.16386 built by: WinDDK · its entry

eaa5dae373553024d7294105e4e07d996f3a8bd47c770cdf8df79bf57619a8cd

5.2.3790.0 built by: WinDDK · its entry

3871e16758a1778907667f78589359734f7f62f9dc953ec558946dcdbe6951e3

5.2.3790.0 built by: WinDDK · its entry

be683cd38e64280567c59f7dc0a45570abcb8a75f1d894853bbbd25675b4adf7

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real cpuz.sys?

file version info and known copies
ProductCPUID service, CPUID
DescriptionCPUID Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

What detects it

Sigma

Sigma names cpuz.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.