CmdID / Files

SIVX64.sys

System Information Viewer X64 Driver file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/31439f28-4616-4ee1-a6b7-1cf742127909/

1 known sample

V5.85 (V5.85) · its entry

33903e8fa9f0a2acaa4784d645e309b0bd780693824b6c2c5fef257238c77478

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real SIVX64.sys?

file version info and known copies

ProductSIVDRIVER, Ray Hinchliffe

DescriptionSystem Information Viewer X64 Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.