hax.sys
HAXM_Driver file version info
Driver on Windows LOLDrivers vulnerable driver
A known vulnerable driver
T1068Exploitation for Privilege Escalation
9 known samples
7.7.0 · its entry
e6d2868eeaaf315c4f022844a2fe55dff7f76445c057b3057024e6fd3365d0207.6.5.3 · its entry
6272aa047c054424f30f09b9ffbc543f4084fa4ac878c7b90d29fbc0502e0e337.6.5 · its entry
c5a1957b8fcdcaa1890889f89629c9a9a3ff6b58d01fa7eb061c50c8213bbf977.5.4 · its entry
7e2e727d71baa430d38988a08b9879bca72cf9fb203dd100e00da2416c87f8b07.5.2 · its entry
df22e797390c7cc401eade8e06d2961aa402801acaaca704ddef7b6c1d4571667.5.1 · its entry
b1b502bfac0509b3c08df2e09ad5b3c6f508a3abf7b85eb025d9b961151d8cb27.4.1 · its entry
d91272678e1adedef58c9f258e032e84c0a2d4e7a101636de6931836add733217.3.2 · its entry
b68e8cd643e9d28bade6867563939de0638cbb3b6e6bbff5933449eacbcb68d96.1.0 built by: WinDDK · its entry
a17b6c35f161f9333eecfd24577d4bf544e228c239d4ce87b093c7e4a77326bdFrom LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real hax.sys?
ProductHAXM, Intel Corporation
DescriptionHAXM_Driver
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.