MyPortIO.sys
Port I/O Driver for Win32/64 file version info
Driver on Windows LOLDrivers vulnerable driver
A known vulnerable driver
T1068Exploitation for Privilege Escalation
2 known samples
3,0,2009,325 · its entry
18bf6cf0224a41058ba3944ff0df9e12fa256c7c353d6fa6132a464cd5db57093,0,2009,325 · its entry
30d5e07d9e88722a5e0eec17d0437b859f782d1c15fc80b5381f3e3eb4221bc7From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real MyPortIO.sys?
ProductNuvoton Port I/O Driver, Nuvoton Technology Corp.
DescriptionPort I/O Driver for Win32/64
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.