AsIO3.sys
AsIO3 Driver file version info
Driver on Windows LOLDrivers vulnerable driver
A known vulnerable driver
T1068Exploitation for Privilege Escalation
10 known samples
1.02.28 · its entry
383df3b803ea69e16de314c82c2099283e746a6865cc4488ac927510ab5ada9c1.02.12 · its entry
cc442919294d81400674bb9e1b68ce8f9e5aafed7f45d548862ce167d487d59f26453afb1f808f64bec87a2532a9361b696c0ed501d6b973a1f1b5ae152a4d402d195cd4400754cc6f6c3f8ab1fe31627932c3c1bf8d5d0507c292232d1a239669dc4782060178762305b17c353efc1508a2a6edd9baf124286f380f51f5daed71ff60722231c7641ad593756108cf6779dbaad21c7b08065fb1d4e225eab14d7b0f442ac0bb183906700097d65aed0b4b9d8678f9a01aca864854189fe368e77e3b0b8d3e430074109d85729201d7c34bc5b918c0bcb9f64ce88c5e37e1a456b6fd51e1f57a03006953e84fd56cc2821cc19e7c77c0474e1110aabaacaf03dfc344e92a6d06155a217a9af7b4b35e6653665eec6569292e7b2e70f3a3027646From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real AsIO3.sys?
ProductAsIO3, Asustek Computer Inc.
DescriptionAsIO3 Driver
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.