CmdID / Files

windrvr1251.sys

WinDriver Device Driver 12.6.0 file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/d2a619bb-c8c6-4c79-8b6a-8368668bbfb2/

1 known sample

12.5.1 · its entry

d217dbb7738ae0a9b8c054d553c94d9d3de9e08d5e98b007c041f4efe766d241

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real windrvr1251.sys?

file version info and known copies

ProductWinDriver Device Driver (x64), Jungo Connectivity

DescriptionWinDriver Device Driver 12.6.0

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.