CmdID / Files

NGStar.sys

NGStar Driver for Windows 2000/XP/Vista/7 (x64) file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/5b9a202c-0695-532e-9d92-662cedefee07/

1 known sample

1, 0, 2, 11 · its entry

4542b20be7adceb61fa5f538fed8c395951e775dbd7c4a2f7c6aee477c4d924e

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real NGStar.sys?

file version info and known copies

ProductNGStar.sys, NITGEN&COMPANY Co., Ltd.

DescriptionNGStar Driver for Windows 2000/XP/Vista/7 (x64)

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.