PGPwded.sys
PGPwde NT/Win2k driver file version info
Driver on Windows LOLDrivers vulnerable driver
A known vulnerable driver
T1068Exploitation for Privilege Escalation
5 known samples
11.0.1 (Build 640) · its entry
02579d833200abb641e476468bafd1f07d448f3d232f70cc34e2adad402b5c7511.0.0 (Build 976) · its entry
90c7fe509129a8095319c3d4ce7e867f503321a1d41d23b674dcf2adfd7424fa10.5.0 (Build 1393) · its entry
2bb84d2b3af3d9ee0f2dbcdfe3574a5c576bc2c7dd2a5b3dbcb7784fbc9efec610.4.2 (Build 463) · its entry
5247d4ab237e8fc486ce95d018bd92074b2a8cf1af351cd699a5b4a9355c707110.4.2 (Build 317) · its entry
6dd193dd6d60f08482a85e23d3c434f540fd38488281aea0f87ec5e9a1a8e4d9From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real PGPwded.sys?
ProductSymantec Encryption Desktop, CA, Inc., a Broadcom subsidiary
DescriptionPGPwde NT/Win2k driver
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.