xhunter1.sys
XIGNCODE3 System Guard file version info
Driver on Windows LOLDrivers vulnerable driver
A known vulnerable driver
Its entrieshttps://www.loldrivers.io/drivers/96ba5e53-6a40-4813-b6f1-ccce31a883cf/
https://www.loldrivers.io/drivers/ed3abb66-c577-44b8-89fa-80d300c82373/
https://www.loldrivers.io/drivers/ed3abb66-c577-44b8-89fa-80d300c82373/
3 known samples
2026.6.1.192 · its entry
44cefb0b3b6516e6731de09a3e2e0eb8b98b02cc3fdf7bb4b22680e93f3cde1e2023.12.7.78 · its entry
0d1fd685dc98d0c193529df3ddde7144d839f56b7b38251fd7039c33c0fcf76010.0.10011.16384 · its entry
e727d0753d2cd0b2f6eeba4cea53aa10b3ff3ed2afeb78f545fcf6d840f85c3eFrom LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real xhunter1.sys?
ProductXIGNCODE3, Wellbia.com Co., Ltd.
DescriptionXIGNCODE3 System Guard
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.