CmdID / Files

iOCdrv.sys

Intel(R) Overclocking Device Driver file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/9bf541fb-a68e-41a5-aab2-b939acc22bb1/

1 known sample

6.5.1.31 · its entry

b936c4ba80ccee3b0b3b67fc88c8caa103fcfc47888e976f6d5b6f113d22f41f

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real iOCdrv.sys?

file version info and known copies

ProductIntel(R) Extreme Tuning Utility, Intel Corporation

DescriptionIntel(R) Overclocking Device Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.