CmdID / Files

FoxKeDriver64.sys

Foxconn Kernel Driver(64bit) file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/7f52f435-d217-4c13-98a4-4fdc6c8516c8/

1 known sample

1.00.01.03 built by: WinDDK · its entry

eb81e127e7a46c80acdf8a3fc24a350381f24acb06f0fdf9fdcd34ce9b08d084

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real FoxKeDriver64.sys?

file version info and known copies

ProductFoxconn (R) Kernel Driver(64bit), Foxconn (R) Corporation

DescriptionFoxconn Kernel Driver(64bit)

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.