CmdID / Files

hp64vision.sys

hpvhd 64bit support driver file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/da6709ab-3b7a-445d-9a47-e8b4141d4133/

1 known sample

2.0.0.0 built by: WinDDK · its entry

c1e11e2012216b54b2aad1be37b469d328f39b09352c66e8c74e6032ec858b96

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real hp64vision.sys?

file version info and known copies

ProductHP Vision Hardware Diagnostics, Windows (R) Codename Longhorn DDK provider

Descriptionhpvhd 64bit support driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.