← Back to driver explorer
Driver intelligenceVulnerableVerified
nvoclock.sys
The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.
Known samples 25
5 recorded TRUE · 20 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
nvoclock.sysSample 1 · HVCI FALSE
- MD5
6cc3c3be2de12310a35a6ab2aed141d6- SHA1
09d3ff3c57f5154735e676f2c0a10b5e51336bb3- SHA256
060d25126e45309414b380ee29f900840b689eae4217a8e621563f130c1d457f- Imphash
bec5dc89f030df7a96d19483fad4cc0a- Authentihash MD5
43bc44c551bb06b2052b1b146231a424- Authentihash SHA1
be3c7e94ca552ccae788c14183ab1997f5e22122- Authentihash SHA256
047ce557cc7bb580af457c151233b5114de6efbc9bf5e8c919fab453cebe5fa6- Machine
- I386
- Version
- 6.05.02
- Publisher
- NVIDIA Corp.
nvoclock.sysSample 2 · HVCI TRUE
- MD5
06ffbb2cbf5ac9ef95773b4f5c4c896a- SHA1
9f2b550c58c71d407898594b110a9320d5b15793- SHA256
0fc0644085f956706ea892563309ba72f0986b7a3d4aa9ae81c1fa1c35e3e2d3- Imphash
c590cbf2d6cbf206a2e47e8ed91dd944- Authentihash MD5
4542c85a4f4fe38b28981d4b8035f46b- Authentihash SHA1
094cd9d2b292e15c915dc2f5087a9c8e30d7382e- Authentihash SHA256
283a2e3eb9bad973e2ec439208f1bfb5121f8d9c37019b8a699be212f05964eb- Machine
- I386
- Version
- 3.00.00
- Publisher
- NVidia Corp.
nvoclock.sysSample 3 · HVCI TRUE
- MD5
9ce1b0e5cfa8223cec3be1c7616e9f63- SHA1
96c2e1d7c9a8ad242f8f478e871f645895d3e451- SHA256
16ae28284c09839900b99c0bdf6ce4ffcd7fe666cfd5cfb0d54a3ad9bea9aa9c- Imphash
1b0788bb68804273159b8ace9cba7ea3- Authentihash MD5
c4f1bdfb9ce8e2ded74fc30bb9fb9dcf- Authentihash SHA1
98e3f744f1c5ce862052364d1d38da0d96870e06- Authentihash SHA256
2affa6b703f0491a44d6b7b09dfab83b36ac06979810665aaf7dd2913964c44d- Machine
- I386
- Version
- 6.02.15
- Publisher
- NVidia Corp.
nvoclock.sysSample 4 · HVCI FALSE
- MD5
d1e57c74bafa56e8e2641290d153f4d2- SHA1
007b2c7d72a5a89b424095dbb7f67ff2aeddb277- SHA256
2203bd4731a8fdc2a1c60e975fd79fd5985369e98a117df7ee43c528d3c85958- Imphash
0e0722c16a5ded199f64b26fccd2115a- Authentihash MD5
9a7949af4e2db6971025a87e89af1de8- Authentihash SHA1
0380ce3467b97aa19ca6ab3177651b22a77d9c0e- Authentihash SHA256
717242ad6a3afb6f236890caa44501a4be8d0ab019f028ba2c74d3455f065804- Machine
- AMD64
- Version
- 1, 08, 05, 00
- Publisher
- NVidia Corp.
nvoclock.sysSample 5 · HVCI FALSE
- MD5
efb4ed2040b9b3d408aab8dc15df5a06- SHA1
e0d83953a9efef81ba0fa9de1e3446b6f0a23cc6- SHA256
29f449fca0a41deccef5b0dccd22af18259222f69ed6389beafe8d5168c59e36- Imphash
481d7bb63a8e5eaba756137e6ef22e54- Authentihash MD5
70462e037d6ef7b7b86ee09dd6974129- Authentihash SHA1
e7f478393a69ec3fe0a026584ddc26fd336dc4f0- Authentihash SHA256
73664268a737d071f2c3c67503002db08432953f14771317835b6f080d3daeff- Machine
- I386
- Version
- 5.00.06
- Publisher
- NVidia Corp.
nvoclock.sysSample 6 · HVCI FALSE
- MD5
1033f0849180aac4b101a914bc8c53b4- SHA1
7673cebd15488cbbb4ca65209f92faab3f933205- SHA256
3cb111fdedc32f2f253aacde4372b710035c8652eb3586553652477a521c9284- Imphash
481d7bb63a8e5eaba756137e6ef22e54- Authentihash MD5
8b9ce48f2dfa21fcffbc4a0b73c140b0- Authentihash SHA1
1e4fdfe6750a04756332cc5a5896cd5763c923c7- Authentihash SHA256
1848cb34d16559e3c8232c369d89fc12b5720b58300d8c4c21dade6e3ea8d585- Machine
- I386
- Version
- 5.05.18
- Publisher
- NVidia Corp.
nvoclock.sysSample 7 · HVCI FALSE
- MD5
2e492f14a1087374368562d01cd609aa- SHA1
aaaf565fa30834aba3f29a97fc58d15e372500b5- SHA256
3d008e636e74c846fe7c00f90089ff725561cb3d49ce3253f2bbfbc939bbfcb2- Imphash
236bc37dff7a92a4d25d807cf038e674- Authentihash MD5
6f3a296b03ad9c8758283164aa74ca44- Authentihash SHA1
5227bbd693ab5deace785e29e56803958b8eca61- Authentihash SHA256
647f209aac750ba26bda9836afa5ef1370e4a62b5c331606086b1c4c92e10841- Machine
- AMD64
- Version
- 5.05.25
- Publisher
- NVidia Corp.
nvoclock.sysSample 8 · HVCI FALSE
- MD5
0291ced808eafe406d3d9b56d2fc0c26- SHA1
1da0c712ff42bd9112ac6afadb7c4d3ae2f20fb7- SHA256
4d777a9e2c61e8b55b3c34c5265b301454bb080abe7ffb373e7800bd6a498f8d- Imphash
c590cbf2d6cbf206a2e47e8ed91dd944- Authentihash MD5
96af0b5d7e04dc1beb2cac418027e9ff- Authentihash SHA1
fb6958d7d53e63edeb4cceebab4d12ca70202109- Authentihash SHA256
f72dbb2a818ba47ca03ffbe50d211050210699c25caec3b97ca960d7286d4b6a- Machine
- I386
- Version
- 2.05.09
- Publisher
- NVidia Corp.
nvoclock.sysSample 9 · HVCI FALSE
- MD5
8c1d181480796d7d3366a9381fd7782d- SHA1
7503a1ed7f6fbd068f8c900dd5ddb291417e3464- SHA256
642857fc8d737e92db8771e46e8638a37d9743928c959ed056c15427c6197a54- Imphash
7453e39bd87c63550451ba2fa354dd8e- Authentihash MD5
3c1fead72a47e97d7253bc861f815371- Authentihash SHA1
e0477eead7848c6d4f5437fb04802bd04c9bd0fd- Authentihash SHA256
0ffa2791abaa004489427b2c187b64db87b49aaa0ffb2e576f0c982dbe62c62a- Machine
- AMD64
- Version
- 6.05.06
- Publisher
- NVIDIA Corp.
nvoclock.sysSample 10 · HVCI FALSE
- MD5
de331f863627dc489f547725d7292bbd- SHA1
8c11430372889bae1f91e8d068e2b2ad56dfc6bf- SHA256
64a8e00570c68574b091ebdd5734b87f544fa59b75a4377966c661d0475d69a5- Imphash
0e0722c16a5ded199f64b26fccd2115a- Authentihash MD5
0ac44278542febfa8cb408f96afd98b7- Authentihash SHA1
2d63276eb232457770188f2df6fc67eb41faacd1- Authentihash SHA256
abbf92203a31c93b8e719cdabff1c681921edbaf43cd34da79c86cb5a806757f- Machine
- AMD64
- Version
- 1, 00, 00, 00
- Publisher
- NVidia Corp.
nvoclock.sysSample 11 · HVCI FALSE
- MD5
8cc5a4045a80a822cbc1e9eadff8e533- SHA1
b0aede5a66e13469c46acbc3b01ccf038acf222c- SHA256
77da3e8c5d70978b287d433ae1e1236c895b530a8e1475a9a190cdcc06711d2f- Imphash
481d7bb63a8e5eaba756137e6ef22e54- Authentihash MD5
9ebe5f6ad14b7db78ab94bedcd6ad55f- Authentihash SHA1
fddcb8952f5f44ddae6201b08ddaa94537470669- Authentihash SHA256
cec5964d7e32c52439d5eb660fa97827b619a7da9f3264f0c9fa4b69e3cb7cc1- Machine
- I386
- Version
- 5.05.14
- Publisher
- NVidia Corp.
nvoclock.sysSample 12 · HVCI FALSE
- MD5
eda6e97b453388bb51ce84b8a11d9d13- SHA1
b3f5185d7824ea2c2d931c292f4d8f77903a4d2a- SHA256
837d3b67d3e66ef1674c9f1a47046e1617ed13f73ee08441d95a6de3d73ee9f2- Imphash
236bc37dff7a92a4d25d807cf038e674- Authentihash MD5
5e14fb93c03d2802155852d87eff5957- Authentihash SHA1
dd43c641a714705142f01324cd31931f819a722e- Authentihash SHA256
f3fc8f8dddbd471fa2d5deb292552876b3c737b09149307f901e38b53cd62648- Machine
- AMD64
- Version
- 5.05.14
- Publisher
- NVidia Corp.
nvoclock.sysSample 13 · HVCI FALSE
- MD5
34e55ccceec34a8567c8b95d662ba886- SHA1
2365a66c1eddfcf8385d9ff38ba8bd5f6f2e4fc2- SHA256
848b150ffcf1301b26634a41f28deacb5ccdd3117d79b590d515ed49849b8891- Imphash
236bc37dff7a92a4d25d807cf038e674- Authentihash MD5
17b5e7af1f9c888b67219147718ecbe2- Authentihash SHA1
9d6e6ca45e0b610b60feffe65715f0fa567b97a3- Authentihash SHA256
35ad05063e2b44b2e606464f12405b954ac8bc8417fa9732ba13365dbe26f90b- Machine
- AMD64
- Version
- 6.05.00
- Publisher
- NVIDIA Corp.
nvoclock.sysSample 14 · HVCI FALSE
- MD5
9dd414590e695ea208139c23db8a5aa3- SHA1
2fa92d3739735bc9ac4dc38f42d909d97cc5c2a8- SHA256
87b4c5b7f653b47c9c3bed833f4d65648db22481e9fc54aa4a8c6549fa31712b- Imphash
481d7bb63a8e5eaba756137e6ef22e54- Authentihash MD5
10eb0609a990adc1d0d2c9a09e4ea31b- Authentihash SHA1
8546586f7825c49876f2e0c52ba55f545b4e03bd- Authentihash SHA256
7c8d7bb3a272afe7fb737bd165fe9bd8f8187f1835289eb66d471cdced74e950- Machine
- I386
- Version
- 5.05.47
- Publisher
- NVidia Corp.
nvoclock.sysSample 15 · HVCI TRUE
- MD5
d396332f9d7b71c10b3b83da030690f0- SHA1
df177a0c8c1113449f008f8e833105344b419834- SHA256
909f6c4b8f779df01ef91e549679aa4600223ac75bc7f3a3a79a37cee2326e77- Imphash
1b0788bb68804273159b8ace9cba7ea3- Authentihash MD5
516711a6410e6bef7b533babf31a6193- Authentihash SHA1
417ae5f63bd26857db2b374e6ef1f60b66910db7- Authentihash SHA256
fb79b99db91dc965263bd2c10ec0f58c6b8f282e0273f40c4249831b74ffec3a- Machine
- I386
- Version
- 6.03.06
- Publisher
- NVIDIA Corp.
nvoclock.sysSample 16 · HVCI FALSE
- MD5
b5192270857c1f17f7290acbaadf097d- SHA1
45328110873640d8fed9fc72f7d2eadd3d17ceae- SHA256
9bfd24947052bfe9f2979113a7941e40bd7e3a82eaa081a32ad4064159f07c91- Imphash
236bc37dff7a92a4d25d807cf038e674- Authentihash MD5
47365241aae4ce7574b32e30250a08d5- Authentihash SHA1
610f7e1df10894ac22fc14486658bd152c1b537d- Authentihash SHA256
978a1e937dd4c03eb2f2a55a0ed8b14294c5c175584ebf85bd20b889bdc9378c- Machine
- AMD64
- Version
- 5.05.18
- Publisher
- NVidia Corp.
nvoclock.sysSample 17 · HVCI TRUE
- MD5
e84605c8e290de6b92ce81d2f6a175d2- SHA1
0a89a6f6f40213356487bfcfb0b129e4f6375180- SHA256
a47555d04b375f844073fdcc71e5ccaa1bbb201e24dcdebe2399e055e15c849f- Imphash
0555907292d07d9f78205416eb1924d3- Authentihash MD5
249edfd8542e921535738c447fe1d954- Authentihash SHA1
ce931d8ffec4869a0863924c1b84d5bcc86f27d7- Authentihash SHA256
8b6251a1883c5ed03ecdead8322e7d8105d075fef160abfe763d5873484b2a27- Machine
- I386
- Version
- 2.00.20
- Publisher
- NVidia Corp.
nvoclock.sysSample 18 · HVCI FALSE
- MD5
cceb3a7e3bd0203c807168b393a65a74- SHA1
bd3e1d5aacac6406a7bcea3b471bbfa863efbc3d- SHA256
ae3a6a0726f667658fc3e3180980609dcb31bdbf833d7cb76ba5d405058d5156- Imphash
236bc37dff7a92a4d25d807cf038e674- Authentihash MD5
984a1e67c2d9102baba161af7f2c7dc5- Authentihash SHA1
dbf3588cd34c2730a4a2a3d7dbf12fdce1169722- Authentihash SHA256
2ddcca718ae393cf1d3fd57ddd648484b97c95086bc1c77c6e00d8cd86d60bd8- Machine
- AMD64
- Version
- 6.03.12
- Publisher
- NVIDIA Corp.
nvoclock.sysSample 19 · HVCI FALSE
- MD5
241a095631570a9cef4f126c87605c60- SHA1
d496a8d3e71eaacd873ccef1d1f6801e54959713- SHA256
afda5af5f210336061bff0fab0ed93ee495312bed639ec5db56fbac0ea8247d3- Imphash
236bc37dff7a92a4d25d807cf038e674- Authentihash MD5
4bdf9ad93233463f415034725788ae43- Authentihash SHA1
f8fe56435f0d964d8fd1ee4b7c05bc68fd032a41- Authentihash SHA256
c0a60e07b06033497ded62ed49fbf3eb3d8fe750eebc3f0c332f5d84ab17e045- Machine
- AMD64
- Version
- 5.05.54
- Publisher
- NVidia Corp.
nvoclock.sysSample 20 · HVCI TRUE
- MD5
61d6b1c71ad94f8485e966bebc36d092- SHA1
72a5ac213ec1681d173bee4f1807c70a77b41bf6- SHA256
b2364c3cf230648dad30952701aef90acfc9891541c7e154e30c9750da213ed1- Imphash
1b0788bb68804273159b8ace9cba7ea3- Authentihash MD5
c048567c1a013164e8c4be5cbb16e73a- Authentihash SHA1
c2fdc70a7a7d832520ffa572825265ff7bd978d3- Authentihash SHA256
14a0a9fe317192b54fda1516f46af78e6aabac0cf050bf18ec1e5ddaefd8e051- Machine
- I386
- Version
- 5.05.54
- Publisher
- NVidia Corp.
nvoclock.sysSample 21 · HVCI FALSE
- MD5
2eec12c17d6b8deeeac485f47131d150- SHA1
228b1ff5cd519faa15d9c2f8cfefd7e683bc3f2b- SHA256
b8321471be85dc8a67ac18a2460cab50e7c41cb47252f9a7278b1e69d6970f25- Imphash
7453e39bd87c63550451ba2fa354dd8e- Authentihash MD5
d946955440f474be87d88cc5d8cf0252- Authentihash SHA1
2a84776f7912799753358cba07e23f25b7191c9f- Authentihash SHA256
5f5243c9d9638a23ccf0e32f54c585e5688a4a853ff04898281fa23697aaec34- Machine
- AMD64
- Version
- 6.05.02
- Publisher
- NVIDIA Corp.
nvoclock.sysSample 22 · HVCI FALSE
- MD5
edfa69e9132a56778d6363cd41843893- SHA1
0a5ef5b72e621a639860c03f1cac499567082f39- SHA256
d54ac69c438ba77cde88c6efd6a423491996d4e8a235666644b1db954eb1da9c- Imphash
236bc37dff7a92a4d25d807cf038e674- Authentihash MD5
da2a882bdc691526975b88e83bba5b9d- Authentihash SHA1
96bff1ce988224e1bd7fdff981feb35cb8af278c- Authentihash SHA256
6c049aff27517fe269517b07bdc8ef1e7b26e1e76276b02dc5a9688901a88de3- Machine
- AMD64
- Version
- 6.02.15
- Publisher
- NVidia Corp.
nvoclock.sysSample 23 · HVCI FALSE
- MD5
7f9128654c3def08c28e0e13efff0fee- SHA1
a45687965357036df17b8ff380e3a43a8fbb2ca9- SHA256
d633055c7eda26dacfc30109eb790625519fc7b0a3a601ceed9e21918aad8a1b- Imphash
236bc37dff7a92a4d25d807cf038e674- Authentihash MD5
eb49b04c44903ee1cedc83c5fcd2f837- Authentihash SHA1
d35e1e29c0124adb3dbbe490190d196b1f1e7425- Authentihash SHA256
ba182292c25044e9abc89bcd2a846a4cd74485ce0c26413e5a859c516f9d89e2- Machine
- AMD64
- Version
- 5.00.06
- Publisher
- NVidia Corp.
nvoclock.sysSample 24 · HVCI FALSE
- MD5
546db985012d988e4482acfae4a935a8- SHA1
e9d7d7d42fd534abf52da23c0d6ec238cefde071- SHA256
d7c90cf3fdbbd2f40fe6a39ad0bb2a9a97a0416354ea84db3aeff6d925d14df8- Imphash
0e0722c16a5ded199f64b26fccd2115a- Authentihash MD5
5b9870e1fedcea0462b9ecc3013f8134- Authentihash SHA1
fe761bee648d4a1c9fd8c1646323a692df957c42- Authentihash SHA256
b3183d87a902db1bbdaecb37291b9d37c032ce9dfacbe4b36cc3032f5a643ab4- Machine
- I386
- Version
- 1, 00, 00, 00
- Publisher
- NVidia Corp.
nvoclock.sysSample 25 · HVCI FALSE
- MD5
96c5900331bd17344f338d006888bae5- SHA1
d2c7aa9b424015f970fe7506ae5d1c69a8ac11f6- SHA256
f4e500a9ac5991da5bf114fa80e66456a2cde3458a3d41c14e127ac09240c114- Imphash
bec5dc89f030df7a96d19483fad4cc0a- Authentihash MD5
b6c58fc97881883e9e2ca091f43eb29d- Authentihash SHA1
c768ae4c7155e9b06f16ab0b528bc3664b627763- Authentihash SHA256
221369498ae77e0ff60ce2f59de6ef2bbb01aca8cd55d7a8487760068f5a544a- Machine
- I386
- Version
- 6.05.06
- Publisher
- NVIDIA Corp.
Recorded command
sc.exe create nvoclocksys binPath= C:\windows\temp\nvoclocksys.sys type=kernel && sc.exe start nvoclocksysElevate privileges · Privileges: kernel · OS: Windows 10