cyvrlpc.sys
Cortex XDR LPC Driver file version info
Driver on Windows LOLDrivers malicious
A known malicious driver
T1068Exploitation for Privilege Escalation
Its entrieshttps://www.loldrivers.io/drivers/85f8ad5b-c5aa-468b-99f3-4b0aacfaa724/
https://www.loldrivers.io/drivers/c2e98102-2055-48f0-9449-3e7a7f2c0ffe/
https://www.loldrivers.io/drivers/c2e98102-2055-48f0-9449-3e7a7f2c0ffe/
2 known samples
8.2.2.49708 · its entry
05f8f514d1367aca856564af5443a75f47d22a30ce63f0b024a41e6b9553a5278.2.2.49708 · its entry
2cd7a0c4e8d24404c92e4ed8539b2136028a8ca663f3432e417b00665493e13fFrom LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real cyvrlpc.sys?
ProductCortex XDR™ Advanced Endpoint Protection, Palo Alto Networks, Inc.
DescriptionCortex XDR LPC Driver
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.