CmdID / Files

TcIo.sys

TwinCAT IO Server file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/12998ebb-8c74-4e44-89a2-2a71c0f6e92b/

1 known sample

3.1.0.2104 · its entry

e0c58531501d6176ed0f632addca977616b0dab460f32f0a5909d21f828fc63b

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real TcIo.sys?

file version info and known copies

ProductBeckhoff TwinCAT, Beckhoff Automation GmbH

DescriptionTwinCAT IO Server

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.