nvflsh32.sys
Driver on Windows LOLDrivers vulnerable driver
A known vulnerable driver
T1068Exploitation for Privilege Escalation
10 known samples
4115b7a30061d11a034188c0ec7a2223f3b032c8b3420cfffabf6c4df692920d4710acca9c4a61e2fc6daafb09d72e11b603ef8cd732e12a84274ea9ad6d43be79aa2cedd1b8415ba6d00f4b3601e2363c8bdd07f860a3b8de010f9e5187c0e98162811e8aae05884e8cb84b8dd87c310e5ed5ec588b9023a4d849d558d6ae34835733590a778f48dae1df4e33da8455b89449fed3e04fa19b64bbdcb6a530db9155470dc24449977d1be15a116b08705dd4c113a2eb4ab19a6000749ff4b100b715d5682ab59a0ce3f858e47bf79bdf876a899f618c12c22b27cb1dd4daa8f4c11305fc8da85568b2d41cdf030ce260815fea848af91dc0e01076d461bab919df996d5a06a2e2ecc087569358b1957d500b176ec7ed37031bcee440963d9d80fd94be9ac97f06abe64426933fbee02871d5d181b1d9025daf1aaa92d9342e90From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.