CmdID / Files

termdd.sys

Remote Desktop Server Driver file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/ef848b1c-e197-4f98-aa19-4580f41a98b8/

1 known sample

6.1.7601.17514 (win7sp1_rtm.101119-1850) · its entry

83bfa50a528762ec52a011302ac3874636fb7e26628cd7acfbf2bdc9faa8110d

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real termdd.sys?

file version info and known copies

ProductMicrosoft® Windows® Operating System, Microsoft Corporation

DescriptionRemote Desktop Server Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.