TRIXX.sys
Low-Level Driver file version info
Driver on Windows LOLDrivers vulnerable driver
A known vulnerable driver
T1068Exploitation for Privilege Escalation
3 known samples
7.2.0.0 · its entry
69fb21e4c8dbfcab838d53d98ec7357d35e30cbbe5fde9e26457d79242ddd78e3.0.0.0 · its entry
7d39223e7eb902712aeac77c90b9fa00a6e5e56a68d4c542bcc88556a57ba7351.60.0.0 · its entry
6e7b28216c1d7f1dab6e147823c70414df804836701fa43ec686fd7f4a6e573fFrom LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real TRIXX.sys?
ProductLow-Level Driver
DescriptionLow-Level Driver
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.