CmdID / Files

HWiNFO64I.SYS

HWiNFO IA64 Kernel Driver file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/080a834f-3e19-4cae-b940-a4ecf901db28/

1 known sample

8.72 · its entry

33c6c622464f80a8d8017a03ff3aa196840da8bb03bfb5212b51612b5cf953dc

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real HWiNFO64I.SYS?

file version info and known copies

ProductHWiNFO IA64 Kernel Driver, REALiX(tm)

DescriptionHWiNFO IA64 Kernel Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.