Netfilter.sys
Driver on Windows LOLDrivers vulnerable driver
A known vulnerable driver
T1068Exploitation for Privilege Escalation
16 known samples
Show the 16 samples’ SHA-256 hashes
0123c7f12dd7530d55aee49949ff1fee911c9689bd04591684aa64188258978504a269dd0a03e32e5b2a1c8ab0768791962e040d080d44dc44dab01dd7954f2b16b6be03495a4f4cf394194566bb02061fba2256cc04dcbde5aa6a17e41b765016e68d2fa75a4e04872be42e2b54c041e43ab3409096741690520417e3368aa622da5a055b7b17c69def9f5af54e257c751507e7b6b9a835fcf6245ab90ae75023115b5b1d5511d59cdad75f863d65893304dc098848dcb149b69492f51b31f624ea733bae1b8722841fb4c6cead93c4c4f0b1248ca9a21601b1ce6b95b0686440c45c9b1c764777096b59f99ae524cbd25b88c805187e615c3ed6840f3d4c1563d61549030fcf46ff1dc138122580b4364f0fe99e6b068bc6a3d6903656aff08249e9c0ac0840a36d9a5b9ff3e217198a2f533159acd4bf3d9b0132cc07987093d99a5fbfc888c0a40a18946933121ae110229dcf206b4d17116a57e7cf4dc9bbc58fd69ce5fed6691dd8d2084e9b728add808ffd5ea8b42ac284b686f77d9acfe2dd2cf1eb8b79d3b4ae980cda6fd933979d47c837fda77256a24a41316468e0afb8b937a5907fbe55a1d1cc7574e9304007ef33fa80ff3896e997a1beaf37f3efcf47681d9f96afcbc843a241c21a643b173c48270446f6fe634991a57847f83c357106a7d1d055b5cb75c8414aa3219354deb16ae9ee7efe8ee4c8c670caFrom LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.