CmdID

CmdID / Files

nvoclock.sys

NVIDIA System Utility Driver file version info

Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it

A known vulnerable driver

from LOLDrivers
T1068Exploitation for Privilege Escalation
Its entrieshttps://www.loldrivers.io/drivers/3d7da79b-fe34-45cd-a0c9-d4432d40611c/
https://www.loldrivers.io/drivers/837ad058-65f4-4b75-8f21-b842e48db8a5/

26 known samples

Show the 26 samples’ SHA-256 hashes

7.00.00 · its entry

b0dcdbdc62949c981c4fc04ccea64be008676d23506fc05637d9686151a4b77f

6.05.06 · its entry

642857fc8d737e92db8771e46e8638a37d9743928c959ed056c15427c6197a54

6.05.06 · its entry

f4e500a9ac5991da5bf114fa80e66456a2cde3458a3d41c14e127ac09240c114

6.05.02 · its entry

060d25126e45309414b380ee29f900840b689eae4217a8e621563f130c1d457f

6.05.02 · its entry

b8321471be85dc8a67ac18a2460cab50e7c41cb47252f9a7278b1e69d6970f25

6.05.00 · its entry

848b150ffcf1301b26634a41f28deacb5ccdd3117d79b590d515ed49849b8891

6.03.12 · its entry

ae3a6a0726f667658fc3e3180980609dcb31bdbf833d7cb76ba5d405058d5156

6.03.06 · its entry

909f6c4b8f779df01ef91e549679aa4600223ac75bc7f3a3a79a37cee2326e77

6.02.15 · its entry

16ae28284c09839900b99c0bdf6ce4ffcd7fe666cfd5cfb0d54a3ad9bea9aa9c

6.02.15 · its entry

d54ac69c438ba77cde88c6efd6a423491996d4e8a235666644b1db954eb1da9c

5.05.54 · its entry

afda5af5f210336061bff0fab0ed93ee495312bed639ec5db56fbac0ea8247d3

5.05.54 · its entry

b2364c3cf230648dad30952701aef90acfc9891541c7e154e30c9750da213ed1

5.05.47 · its entry

87b4c5b7f653b47c9c3bed833f4d65648db22481e9fc54aa4a8c6549fa31712b

5.05.25 · its entry

3d008e636e74c846fe7c00f90089ff725561cb3d49ce3253f2bbfbc939bbfcb2

5.05.18 · its entry

3cb111fdedc32f2f253aacde4372b710035c8652eb3586553652477a521c9284

5.05.18 · its entry

9bfd24947052bfe9f2979113a7941e40bd7e3a82eaa081a32ad4064159f07c91

5.05.14 · its entry

77da3e8c5d70978b287d433ae1e1236c895b530a8e1475a9a190cdcc06711d2f

5.05.14 · its entry

837d3b67d3e66ef1674c9f1a47046e1617ed13f73ee08441d95a6de3d73ee9f2

5.00.06 · its entry

29f449fca0a41deccef5b0dccd22af18259222f69ed6389beafe8d5168c59e36

5.00.06 · its entry

d633055c7eda26dacfc30109eb790625519fc7b0a3a601ceed9e21918aad8a1b

3.00.00 · its entry

0fc0644085f956706ea892563309ba72f0986b7a3d4aa9ae81c1fa1c35e3e2d3

2.05.09 · its entry

4d777a9e2c61e8b55b3c34c5265b301454bb080abe7ffb373e7800bd6a498f8d

2.00.20 · its entry

a47555d04b375f844073fdcc71e5ccaa1bbb201e24dcdebe2399e055e15c849f

1, 08, 05, 00 · its entry

2203bd4731a8fdc2a1c60e975fd79fd5985369e98a117df7ee43c528d3c85958

1, 00, 00, 00 · its entry

64a8e00570c68574b091ebdd5734b87f544fa59b75a4377966c661d0475d69a5

1, 00, 00, 00 · its entry

d7c90cf3fdbbd2f40fe6a39ad0bb2a9a97a0416354ea84db3aeff6d925d14df8

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real nvoclock.sys?

file version info and known copies
ProductNVIDIA System Utility Driver, NVIDIA Corp.
DescriptionNVIDIA System Utility Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

What detects it

Sigma

Sigma names nvoclock.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.