NTIOLib.sys

43 known samples

Show the 43 samples’ SHA-256 hashes

1.0.0.3 · its entry

1ddfe4756f5db9fb319d6c6da9c41c588a729d9e7817190b027b38e9c076d219

1.0.0.2 · its entry

2bbe65cbec3bb069e92233924f7ee1f95ffa16173fceb932c34f68d862781250

1.0.0.2 · its entry

3d9e83b189fcf5c3541c62d1f54a0da0a4e5b62c3243d2989afc46644056c8e3

1.0.0.2 · its entry

e68d453d333854787f8470c8baef3e0d082f26df5aa19c0493898bcf3401e39a

1.0.0.01 · its entry

d0bd1ae72aeb5f3eabf1531a635f990e5eaae7fdd560342f915f723766c80889

1.0.0.0 · its entry

101402d4f5d1ae413ded499c78a5fcbbc7e3bae9b000d64c1dd64e3c48c37558

1.0.0.0 · its entry

131d5490ceb9a5b2324d8e927fea5becfc633015661de2f4c2f2375a3a3b64c6

1.0.0.0 · its entry

18776682fcc0c6863147143759a8d4050a4115a8ede0136e49a7cf885c8a4805

1.0.0.0 · its entry

30706f110725199e338e9cc1c940d9a644d19a14f0eb8847712cba4cacda67ab

1.0.0.0 · its entry

3124b0411b8077605db2a9b7909d8240e0d554496600e2706e531c93c931e1b5

1.0.0.0 · its entry

38fa0c663c8689048726666f1c5e019feaa9da8278f1df6ff62da33961891d2a

1.0.0.0 · its entry

39cfde7d401efce4f550e0a9461f5fc4d71fa07235e1336e4f0b4882bd76550e

1.0.0.0 · its entry

3f2fda9a7a9c57b7138687bbce49a2e156d6095dddabb3454ea09737e02c3fa5

1.0.0.0 · its entry

47f0cdaa2359a63ad1389ef4a635f1f6eee1f63bdf6ef177f114bdcdadc2e005

1.0.0.0 · its entry

50d5eaa168c077ce5b7f15b3f2c43bd2b86b07b1e926c1b332f8cb13bd2e0793

1.0.0.0 · its entry

56a3c9ac137d862a85b4004f043d46542a1b61c6acb438098a9640469e2d80e7

1.0.0.0 · its entry

591bd5e92dfa0117b3daa29750e73e2db25baa717c31217539d30ffb1f7f3a52

1.0.0.0 · its entry

6f1ff29e2e710f6d064dc74e8e011331d807c32cc2a622cbe507fd4b4d43f8f4

1.0.0.0 · its entry

7893307df2fdde25371645a924f0333e1b2de31b6bc839d8e2a908d7830c6504

1.0.0.0 · its entry

79e2d37632c417138970b4feba91b7e10c2ea251c5efe3d1fc6fa0190f176b57

1.0.0.0 · its entry

85866e8c25d82c1ec91d7a8076c7d073cccf421cf57d9c83d80d63943a4edd94

1.0.0.0 · its entry

89b0017bc30cc026e32b758c66a1af88bd54c6a78e11ec2908ff854e00ac46be

1.0.0.0 · its entry

9254f012009d55f555418ff85f7d93b184ab7cb0e37aecdfdab62cfe94dea96b

1.0.0.0 · its entry

952199c28332bc90cfd74530a77ee237967ed32b3c71322559c59f7a42187dc4

1.0.0.0 · its entry

9529efb1837b1005e5e8f477773752078e0a46500c748bc30c9b5084d04082e6

1.0.0.0 · its entry

984a77e5424c6d099051441005f2938ae92b31b5ad8f6521c6b001932862add7

1.0.0.0 · its entry

98b734dda78c16ebcaa4afeb31007926542b63b2f163b2f733fa0d00dbb344d8

1.0.0.0 · its entry

99f4994a0e5bd1bf6e3f637d3225c69ff4cd620557e23637533e7f18d7d6cba1

1.0.0.0 · its entry

9c10e2ec4f9ef591415f9a784b93dc9c9cdafa7c69602c0dc860c5b62222e449

1.0.0.0 · its entry

a961f5939088238d76757669a9a81905e33f247c9c635b908daac146ae063499

1.0.0.0 · its entry

a9706e320179993dade519a83061477ace195daa1b788662825484813001f526

1.0.0.0 · its entry

b7a20b5f15e1871b392782c46ebcc897929443d82073ee4dcb3874b6a5976b5d

1.0.0.0 · its entry

c2a4ddcc9c3b339d752c48925d62fc4cc5adbf6fae8fedef74cdd47e88da01f8

1.0.0.0 · its entry

cd4a249c3ef65af285d0f8f30a8a96e83688486aab515836318a2559757a89bb

1.0.0.0 · its entry

cf4b5fa853ce809f1924df3a3ae3c4e191878c4ea5248d8785dc7e51807a512b

1.0.0.0 · its entry

d8b58f6a89a7618558e37afc360cd772b6731e3ba367f8d58734ecee2244a530

1.0.0.0 · its entry

d92eab70bcece4432258c9c9a914483a2267f6ab5ce2630048d3a99e8cb1b482

1.0.0.0 · its entry

e005e8d183e853a27ad3bb56f25489f369c11b0d47e3d4095aad9291b3343bf1

1.0.0.0 · its entry

e3936d3356573ce2e472495cd3ce769f49a613e453b010433dafce5ea498ddc2

1.0.0.0 · its entry

e83908eba2501a00ef9e74e7d1c8b4ff1279f1cd6051707fd51824f87e4378fa

1.0.0.0 · its entry

ef86c4e5ee1dbc4f81cd864e8cd2f4a2a85ee4475b9a9ab698a4ae1cc71fbeb0

1.0.0.0 · its entry

f088b2ba27dacd5c28f8ee428f1350dca4bc7c6606309c287c801b2e1da1a53d

1.0.0.0 · its entry

fd8669794c67b396c12fc5f08e9c004fdf851a82faf302846878173e4fbecb03

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

Sigma names NTIOLib.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.