CmdID

CmdID / Files

HWiNFO32.SYS

HWiNFO32 Kernel Driver file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers
T1068Exploitation for Privilege Escalation
Its entryhttps://www.loldrivers.io/drivers/2225128d-a23f-434a-aaee-69a88ea64fbd/

11 known samples

8.60 built by: WinDDK · its entry

ff1ccef7374a1a5054a6f4437e3e0504b14ed76e17090cc6b1a4ec0e2da427a5

8.50 built by: WinDDK · its entry

7125c9831a52d89d3d59fb28043b67fbe0068d69732da006fabb95550d1fa730

8.30 built by: WinDDK · its entry

6701433861742c08eb50f1e785962378143ad5b6c374ac29118168599f8a0f1c

8.00 built by: WinDDK · its entry

ec9bd7fb90c3a2aa4605bd73fe1f74399e2cda75fd4c5fff84660ad4f797c4fe

7.90 built by: WinDDK · its entry

4ac08a6035cfcafdac712d7c3cf2eef6e10258f14cee6e80e1ef2f71f5045173

7.80 built by: WinDDK · its entry

6e9e9e0b9a23deec5f28dc45f0bbe7423565f037f74be2957e82e5f72c886094

7.70 built by: WinDDK · its entry

7702f240800528d8186e3e6a26e2680486fed65a6fb5a2a000ad12c1fb61a398

7.50 built by: WinDDK · its entry

8dcec67a1f4903981c3e0ab938784c2f241e041e26748e1c22059e0e507cfb37

7.30 built by: WinDDK · its entry

1b17d12076d047e74d15e6e51e10497ad49419bec7fbe93386c57d3efbaadc0b

7.20 built by: WinDDK · its entry

4e54e98df13110aac41f3207e400cce2a00df29ce18c32186e536c1de25a75ce

6.70 built by: WinDDK · its entry

76af3f9fa111d694e37058606f2636430bdd378c85b94f426fbfcd6666ebe6cc

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real HWiNFO32.SYS?

file version info and known copies
ProductHWiNFO32 Kernel Driver, REALiX(tm)
DescriptionHWiNFO32 Kernel Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.