CmdID

iQVW64.SYS

Intel(R) Network Adapter Diagnostic Driver file version info

Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entrieshttps://www.loldrivers.io/drivers/1d2cdef1-de44-4849-80e5-e2fa288df681/
https://www.loldrivers.io/drivers/4dd3289c-522c-4fce-b48e-5370efc90fa1/

20 known samples

Show the 20 samples’ SHA-256 hashes

1.03.2.7 built by: WinDDK · its entry

5f69d6b167a1eeca3f6ac64785c3c01976ee7303171faf998d65852056988683

1.3.2.18 built by: WinDDK · its entry

7cb497abc44aad09a38160d6a071db499e05ff5871802ccc45d565d242026ee7

1.3.2.17 built by: WinDDK · its entry

37c637a74bf20d7630281581a8fae124200920df11ad7cd68c14c26cc12c5ec9

1.3.2.16 built by: WinDDK · its entry

1f8168036d636aad1680dd0f577ef9532dbb2dad3591d63e752b0ba3ee6fd501

1.3.2.13 built by: WinDDK · its entry

5f6547e9823f94c5b94af1fb69a967c4902f72b6e0c783804835e6ce27f887b0

1.03.1.2 built by: WinDDK · its entry

d1f4949f76d8ac9f2fa844d16b1b45fb1375d149d46e414e4a4c9424dc66c91f

1.03.1.0 built by: WinDDK · its entry

de3597ae7196ca8c0750dce296a8a4f58893774f764455a125464766fcc9b3b5

1.03.1.0 built by: WinDDK · its entry

f877296e8506e6a1acbdacdc5085b18c6842320a2775a329d286bac796f08d54

1.03.0.7 built by: WinDDK · its entry

4429f32db1cc70567919d7d47b844a91cf1329a6cd116f582305f3b7b60cd60b

1.03.0.7 built by: WinDDK · its entry

a59c40e7470b7003e8adfee37c77606663e78d7e3f2ebb8d60910af19924d8df

1.03.0.6 built by: WinDDK · its entry

2d2c7ee9547738a8a676ab785c151e8b48ed40fe7cf6174650814c7f5f58513b

1.03.0.4 built by: WinDDK · its entry

19bf0d0f55d2ad33ef2d105520bde8fb4286f00e9d7a721e3c9587b9408a0775

1.03.0.4 built by: WinDDK · its entry

4d0580c20c1ba74cf90d44c82d040f0039542eea96e4bbff3996e6760f457cee

1.03.0.4 built by: WinDDK · its entry

57a389da784269bb2cc0a258500f6dfbf4f6269276e1192619ce439ec77f4572

1.03.0.4 built by: WinDDK · its entry

77c5e95b872b1d815d6d3ed28b399ca39f3427eeb0143f49982120ff732285a9

1.03.0.4 built by: WinDDK · its entry

a566af57d88f37fa033e64b1d8abbd3ffdacaba260475fbbc8dab846a824eff5

1.03.0.4 built by: WinDDK · its entry

b51ddcf8309c80384986dda9b11bf7856b030e3e885b0856efdb9e84064917e5

1.03.0.4 built by: WinDDK · its entry

cff9aa9046bdfd781d34f607d901a431a51bb7e5f48f4f681cc743b2cdedc98c

1.03.0.4 built by: WinDDK · its entry

d74755311d127d0eb7454e56babc2db8dbaa814bc4ba8e2a7754d3e0224778e1

1.03.0.4 built by: WinDDK · its entry

ff115cefe624b6ca0b3878a86f6f8b352d1915b65fbbdc33ae15530a96ebdaa7

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real iQVW64.SYS?

file version info and known copies

ProductIntel(R) iQVW64.SYS, Intel Corporation

DescriptionIntel(R) Network Adapter Diagnostic Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

What detects it

Sigma

Sigma names iQVW64.SYS in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.