CmdID / Files

ipctype.sys

IPCType Device Driver for 64bit file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/509edc55-1881-4fac-8640-b9c516396505/

1 known sample

1.0.2.0 · its entry

8e2acce10d704c8b511c8b6211a2be5d8e4ade91ebcbda2ac10018e4c0ae99fb

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real ipctype.sys?

file version info and known copies

ProductIPCType Device Driver for 64bit, Digital Electronics Corporation

DescriptionIPCType Device Driver for 64bit

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.