CmdID / Files

SeasunProtect.sys

Game Protect file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/3a9ea9a6-e5e3-439a-b892-1f78dd990099/

1 known sample

1.2.6.1 · its entry

507b07b0dc0e638b65b4a4d11a462b35439c746d42337b9888927bf994176102

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real SeasunProtect.sys?

file version info and known copies

ProductSeasunProtect, Chengdu Westhouse Interactive Entertainment Ltd.

DescriptionGame Protect

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.