iobitunlocker.sys

IObitUnlocker.sys is the kernel driver shipped with IObit Unlocker, a free utility from IObit (the makers of Advanced SystemCare, Driver Booster, and Smart Defrag). The user-facing tool lets you delete, rename, or unlock files held open by other processes, the kind of thing you want when a stuck installer or game launcher will not release a file.

It is on the LOLDrivers list because of CVE-2020-14974 and CVE-2020-14975: the driver exposes an IOCTL (notably 0x222124) that lets any local low-privileged user delete, copy, rename, or terminate any file or process on the system, including ones owned by SYSTEM. Endpoint protection products started flagging the driver as an anti-tampering risk after disclosure.

IObit's family of free PC utilities is widely promoted to casual users as a way to 'speed up' a Windows install, so the driver shows up on consumer machines well outside corporate IT. If you find it, uninstall IObit Unlocker through Windows' Apps and features.

iobitunlocker.sys is listed as a known-vulnerable driver on the public LOLDrivers project. 2 distinct binary hashes matching this filename are on record, meaning multiple versions of the file have been observed.