CmdID / Files

IoManager.sys

IoManager Application file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/2ad22816-46de-45b5-999b-864944635e0a/

1 known sample

1, 0, 0, 32 · its entry

d7833a5d77ab264572458a51226000190857f1b5807c556e23e18c39bb950ca6

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real IoManager.sys?

file version info and known copies

ProductCompal IoManager Application, COMPAL ELECTRONIC INC.

DescriptionIoManager Application

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.