HwOs2Ec.sys

HwOs2Ec file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entrieshttps://www.loldrivers.io/drivers/3ab0d182-6365-47a7-89f4-34121e889503/
https://www.loldrivers.io/drivers/e4098d7e-78b3-4da1-96cb-68b27f245e02/

3 known samples

1.0.0.1 · its entry

b179e1ab6dc0b1aee783adbcad4ad6bb75a8a64cb798f30c0dd2ee8aaf43e6de

1.0.0.1 · its entry

bb1135b51acca8348d285dc5461d10e8f57260e7d0c8cc4a092734d53fc40cbc

1.0.0.1 · its entry

c4e93449453cf67c5d5605bb8f425207a738a242fdb432d720acc32faa74926c

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real HwOs2Ec.sys?

file version info and known copies

ProductHuawei MateBook, Huawei

DescriptionHwOs2Ec

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.