CmdID

CmdID / Files

netfilter2.sys

WYJSQ WFP Driver (WPP) file version info

Driver on Windows LOLDrivers malicious

A known malicious driver

from LOLDrivers
T1068Exploitation for Privilege Escalation
Its entrieshttps://www.loldrivers.io/drivers/5ad8a3b6-6d20-4c95-8fa7-9a507167ba3c/
https://www.loldrivers.io/drivers/9e0a1bae-6509-41fd-a5bf-dfe6cf388682/

26 known samples

Show the 26 samples’ SHA-256 hashes

1.6.5.7 · its entry

206006a11f233b9ae876952308f6d60d7a75c80b4d530a3e6146a0b4d8cd3e4f

1.5.9.7 built by: WinDDK · its entry

0eace788e09c8d3f793a1fad94d35bcfd233f0777873412cd0c8172865562eec

1.5.9.7 built by: WinDDK · its entry

47e35f474f259314c588af35e88561a015801b52db523eb75fc7eccff8b3be4d

1.5.9.7 built by: WinDDK · its entry

5c54a5cd3386ac14725a07962562e9fdcefbb7be0d19803f9d71de24573de1e3

1.5.9.7 built by: WinDDK · its entry

639ff79f13e40d47b90ecd709699edd10e740cb41451acb95590a68b6352de2b

1.5.9.7 built by: WinDDK · its entry

6703400b490b35bcde6e41ce1640920251855e6d94171170ae7ea22cdd0938c0

1.5.9.7 built by: WinDDK · its entry

8017e618b5a7aa608cc4bce16e4defd6b4e99138c4ba1bdd6ad78e39f035cf59

1.5.9.7 built by: WinDDK · its entry

db1dbb09d437d3e8bed08c88ca43769b4fe8728f68b78ff6f9c8d2557e28d2b1

1.5.9.7 built by: WinDDK · its entry

f488500be4eaafba74b644be95d4c0523297770fb9bb78c449f643ab8d4a05d9

1.5.9.7 · its entry

0f3e7bf7b103613844a38afb574817ddaecd00e4d206d891660dbb0e5dfee04e

1.5.9.7 · its entry

1a0f57a4d7c8137baf24c65d542729547b876979273df7a245aaeea87280c090

1.5.9.7 · its entry

62b14bb308c99132d90646e85bc7d6eb593f38e225c8232f69f24b74a019c176

1.5.9.7 · its entry

65a3e69854c729659281d2c5f8a4c8274ad3606befdcd9e1b79d3262f260bfa1

1.5.9.7 · its entry

71701c5c569ef67391c995a12b21ca06935b7799ed211d978f7877115c58dce0

1.5.9.7 · its entry

81bcd8a3f8c17ac6dc4bad750ad3417914db10aa15485094eef0951a3f72bdbd

1.5.9.7 · its entry

9dbc2a37f53507296cc912e7d354dab4e55541ba821561aa84f74d1bd8346be2

1.5.7.8 built by: WinDDK · its entry

12656fc113b178fa3e6bfffc6473897766c44120082483eb8059ebff29b5d2df

1.5.7.8 built by: WinDDK · its entry

1cd75de5f54b799b60789696587b56a4a793cf60775b81f236f0e65189d863af

1.5.7.8 built by: WinDDK · its entry

7ff8fe4c220cf6416984b70a7e272006a018e5662da3cedc2a88efeb6411b4a4

1.5.7.8 · its entry

f1718a005232d1261894b798a60c73d971416359b70d0e545d7e7a40ed742b71

1.4.9.5 built by: WinDDK · its entry

18b923b169b2c3c7db5cbfda0db0999f04adb2cf6c917e5b1fb2ff04714ecac1

1.4.9.5 built by: WinDDK · its entry

26d67d479dafe6b33c980bd1eed0b6d749f43d05d001c5dcaaf5fcddb9b899fe

1.4.9.5 built by: WinDDK · its entry

2fa78c2988f9580b0c18822b117d065fb419f9c476f4cfa43925ba6cd2dffac3

1.4.9.5 built by: WinDDK · its entry

6a234a2b8eb3844f7b5831ee048f88e8a76e9d38e753cc82f61b234c79fe1660

1.4.9.5 built by: WinDDK · its entry

79e7165e626c7bde546cd1bea4b9ec206de8bed7821479856bdb0a2adc3e3617

1.4.9.5 built by: WinDDK · its entry

edc6e32e3545f859e5b49ece1cabd13623122c1f03a2f7454a61034b3ff577ed

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real netfilter2.sys?

file version info and known copies
Product无忧加速器, 宏图无忧
DescriptionWYJSQ WFP Driver (WPP)

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.