rtkiow10x64.sys
Realtek IO Driver file version info
Driver on Windows LOLDrivers vulnerable driver
A known vulnerable driver
T1068Exploitation for Privilege Escalation
2 known samples
1.009.0709.2020 · its entry
ab8f2217e59319b88080e052782e559a706fa4fb7b8b708f709ff3617124da891.008.0823.2017 · its entry
32e1a8513eee746d17eb5402fb9d8ff9507fb6e1238e7ff06f7a5c50ff3df993From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real rtkiow10x64.sys?
ProductRealtek IO Driver, Realtek
DescriptionRealtek IO Driver
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.