{"Id":"214654eb-90c4-48c8-a183-0157e50bf07f","Tags":["MsIo64.sys"],"Verified":"TRUE","Author":"Nasreddine Bencherchali","Created":"2023-05-06","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create MsIo64.sys binPath=C:\\windows\\temp\\MsIo64.sys type=kernel && sc.exe start MsIo64.sys","Description":"","Usecase":"Elevate privileges","Privileges":"kernel","OperatingSystem":"Windows 10"},"Resources":["Internal Research"],"Detection":[{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"}],"Acknowledgement":{"Person":"","Handle":""},"KnownVulnerableSamples":[{"Filename":"MsIo64.sys","MD5":"88a6d84f4f1cc188741271ac1999a4e9","SHA1":"483e58ed495e4067a7c42ca48e8a5f600b14e018","SHA256":"0f035948848432bc243704041739e49b528f35c82a5be922d9e3b8a4c44398ff","Authentihash":{"MD5":"404c94935da4ba9eb3d5eea83c68378c","SHA1":"086e6e37abad257b753c26e8c9e3e181e46b10c3","SHA256":"d55dd56e24df201d1ad2204d565da5e8e6080d895c1ac2873a6afdcbb4c8b8c7"},"Description":"MICSYS IO driver","Company":"MICSYS Technology Co., LTd","InternalName":"MsIo64.sys","OriginalFilename":"MsIo64.sys","FileVersion":"1.3 x64 built by: WinDDK","Product":"MsIo64 Driver Version 1.3","ProductVersion":"1.3 x64","Copyright":"Copyright (c) 2021 MICSYS","MachineType":"AMD64","Imports":["ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["RtlInitUnicodeString","DbgPrint","ZwClose","ZwMapViewOfSection","ObReferenceObjectByHandle","ZwOpenSection","IoDeleteSymbolicLink","ZwUnmapViewOfSection","IofCompleteRequest","IoCreateSymbolicLink","IoCreateDevice","ObfDereferenceObject","IoDeleteDevice","HalTranslateBusAddress"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2021-09-09 19:15:59","ValidTo":"2022-09-01 19:15:59","Signature":"1757782e797188079911866d54bd474a2432707984658c549a407e7fb4e5efa2ba72367a02b382d2116d4c4538836ddcd4616fcd231229df1ae5d0da6b3abe499ee5d8b47a7919940f6bbcbe2575018dca65eef4913e3d38410f2cd6cca3082d9ba2c061173cd828635665f76e8f0f685e03da24290b9d2cae7039da974de7b7e85798ba64cbe9ba34e0308c3bd6b4d68e9723fde74274fd3806fe799d04d6a3835f82d4fefc52088ccda4b4c817116f2f5a99445a3e952d78bc27753e65e97c6271c71ac7c9e3439b847e8984ab06a5904d150223f9ca92bbda86c02663c3f4964da5e106619b6eaff2768143cce9e5a8b0b2cba90e82cd87866d9fd6499c6cfbc96529a18b5653d12b54a6c928693a4e3d197ffbfcce7ed71a909b18d09b4345b24bc25eb8dfa1821a9cd0971ffc7d38a26580e2f118c4ac55bf926d0666b72ad7ba6ec20f0b54d694bc3b8a0dbddda27bd64194da085319841d1ebc9dc067ef72ea064a475bea865828b13077bc8e14e2f7544b90f0045f3cd84bcc0d5a80645a6fb65528e4f768ec775bdb0225399f3c81c0b667714676d0949f9ffaddc8549dc45e5ce4345c4ea7dc0aff4ac510f5527ad94a2181edc4b73bcfde813a83d81ca897854c98712346001a12e5d3bf9a45c807f9b3c7d3e0bb99c035ea54ee39e2c9af4147dbea7aabec85b47192b945e083ddf6061afb901e83b11135d24e","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"330000004de597a775e3157f7b00000000004d","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"9f0782e89bd41cdd96ec55357457478a","SHA1":"35c2180572baad19019acca1334e6c653699c389","SHA256":"50814710213afec410f26e573d25267a2e21d3d15f158be8a43a666c9cc6fa08","SHA384":"8d48f066b0284071d64bbc556e018824a8388ccd142a56c7b7b04ef6d27cade07da57ac82d8067e18ad64d35af11e2a7"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"330000004de597a775e3157f7b00000000004d","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}],"RichPEHeaderHash":{"MD5":"ca146dde5be4c188affdff2cb309138f","SHA1":"2ccd48af92b211fe134d5fa3c7888b95d648825e","SHA256":"1a49f88636cc1a3ab481d8a17a6bc61de8a93ff1dc8b6253dcc5e3cbcaac827c"},"Sections":{".text":{"Entropy":6.147792604910476,"Virtual Size":"0xcff"},".rdata":{"Entropy":4.478250043699546,"Virtual Size":"0x1a0"},".data":{"Entropy":0.8581604745030629,"Virtual Size":"0x15c"},".pdata":{"Entropy":2.9485276044371007,"Virtual Size":"0x60"},"INIT":{"Entropy":4.7872869058901975,"Virtual Size":"0x262"},".rsrc":{"Entropy":3.385724178395201,"Virtual Size":"0x390"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2022-06-09 03:43:50","Imphash":"8a424cd36ae3eab0d11332ce3b982a02","LoadsDespiteHVCI":"FALSE"},{"Filename":"MsIo32.sys","MD5":"564d84a799db39b381a582a0b2f738c4","SHA1":"fbc6d2448739ddec35bb5d6c94b46df4148f648d","SHA256":"2270a8144dabaf159c2888519b11b61e5e13acdaa997820c09798137bded3dd6","Authentihash":{"MD5":"d7acc8a58b2163f0b070d647e81c49fd","SHA1":"0cb0fd5bea730e4eaaec1426b0c15376ccac6d83","SHA256":"0d0962db9dc6879067270134801ad425c1f3e85b0dc39877c02aaa9c54aca14e"},"Description":"","Company":"","InternalName":"","OriginalFilename":"","FileVersion":"","Product":"","ProductVersion":"","Copyright":"","MachineType":"I386","Imports":["ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["ObfDereferenceObject","ZwUnmapViewOfSection","IofCompleteRequest","MmAllocateNonCachedMemory","MmFreeNonCachedMemory","Ke386SetIoAccessMap","ZwOpenSection","IoGetCurrentProcess","IoCreateSymbolicLink","IoCreateDevice","KeTickCount","ObReferenceObjectByHandle","ZwMapViewOfSection","ZwClose","DbgPrint","RtlInitUnicodeString","IoDeleteSymbolicLink","Ke386IoSetAccessProcess","IoDeleteDevice","WRITE_PORT_USHORT","WRITE_PORT_UCHAR","READ_PORT_ULONG","READ_PORT_USHORT","READ_PORT_UCHAR","HalTranslateBusAddress","WRITE_PORT_ULONG"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Extended Validation Code Signing CA , G2","ValidFrom":"2014-03-04 00:00:00","ValidTo":"2024-03-03 23:59:59","Signature":"3f5b19f3fa13d575382a5aee9f5aa04ca91dc5cc94eede15fef5106ea41ba56483541858c40b28a185c34e74e5ff897cfed5ed3cba719f5602268f162a88feb0a32722ce4be2388e00a63a865f9de53ea8de644941744121fd07c88417da1d653082cb264f39d60427a481b14b49c3238b7e02321827b7ab0bf31872b6a4ee67066f38a6588de0f17e5da460c6a8e5505fe0e8bae28f9958b6b5a0a876f1a2f11c8841727e52979b0a36998d50f701eb3ce7f0226ae5358c63368a1ab1d967665f971aefa8209df02fba6cced9948500f158f17dc97c22b5075d02c6e60bbfab9393ff27188e33367e5734f1c3af04c184f156b3e8878336f8d30a31dc6e2c6d","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"191a32cb759c97b8cfac118dd5127f49","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"788b61bd26da89253179e3de2cdb527f","SHA1":"7d06f16e7bf21bce4f71c2cb7a3e74351451bf69","SHA256":"b3c925b4048c3f7c444d248a2b101186b57cba39596eb5dce0e17a4ee4b32f19","SHA384":"2955e28cb7ec0ea9730b499a0f189f9621eceb02591a9486b583f12bb845885a30d6a871826318a167cc5f06b274e58c"}},{"Subject":"??=TW, ??=Taiwan, ??=New Taipei, ??=Private Organization, serialNumber=84948057, C=TW, L=New Taipei, O=MICSYS Technology Co., Ltd., CN=MICSYS Technology Co., Ltd.","ValidFrom":"2019-05-21 00:00:00","ValidTo":"2022-05-20 23:59:59","Signature":"0a47cf1ef4f7db7a1839d16d6cf70ab0447bc7a47cc9cf2124024f5f1583c03d411fabd06dddd424db9702178172411dea6503e33b3f488a5d53b30fb4dd2b30456e3880dd32fd4dc39bbb240c450e930c282095d65a061fae6cfd46eb94cdf549d4813cdc468061bc739b76c7a10fe9e8b762727a3a8e440473a1e6b56ac3d92df16ca8331deaf39072ce2a09705bcec87bc508ecea9b274115fff278b15c0e6430ddce6f09311e5d64ca763e70e5cad8eb6127680d12279d78129214cb0857078ab6a1187e112c9b71d1f08fa60e570d9180a901de521222be67be4ad243a9ddbb4af1ef3a5bb1e58556753a8183ed400de32f846e0b49a74de1025d03b7d0","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"49f161119a491d2a3faf4220f09db107","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"b6dc6eecc4959ec6a25ad56ed4bc2451","SHA1":"8c38527fd4e4db39db700ee86431a6670edb9005","SHA256":"3777c0b7223f4d570844461c938b379ba4a49fdfde0a08ea37a7be5c38a39db0","SHA384":"78a64d3b5ad313da9aeaaf82440843670f388b556b5e6d632a0f8fea413108cd7b296214ee90ef3928837f315fb56cea"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}}],"Signer":[{"SerialNumber":"49f161119a491d2a3faf4220f09db107","Issuer":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Extended Validation Code Signing CA , G2","Version":1}]}],"RichPEHeaderHash":{"MD5":"d1c5b39e151846c2dcb30d3116cba10d","SHA1":"ef12b9e4550f27b0c74b09f9f6c4e1cfa6d757f7","SHA256":"ace4fba2c26bcc6e806e2ad3abec8dd0852907ccd429053608e3c639a514d1bc"},"Sections":{".text":{"Entropy":6.282770026975047,"Virtual Size":"0x9f0"},".rdata":{"Entropy":4.257419198996188,"Virtual Size":"0xc3"},".data":{"Entropy":2.5,"Virtual Size":"0x8"},"INIT":{"Entropy":5.4236305547105035,"Virtual Size":"0x32e"},".reloc":{"Entropy":4.3106029983367184,"Virtual Size":"0xe8"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2018-02-12 02:57:28","Imphash":"24b344cd341f8b20003ac85be08df979","LoadsDespiteHVCI":"FALSE"},{"Filename":"MsIo64.sys","MD5":"55a7c51dc2aa959c41e391db8f6b8b4f","SHA1":"bc949bc040333fdc9140b897b0066ef125343ef6","SHA256":"ae42afa9be9aa6f6a5ae09fa9c05cd2dfb7861dc72d4fd8e0130e5843756c471","Authentihash":{"MD5":"3cdda257c661f3c1eb256b61dba8147d","SHA1":"84a45f83a90b1a695ffeb915ea2a197b186857e6","SHA256":"9f3e67f9454cb009716b89c0a296dcde73aa29145b7dcf776b81605932785b91"},"Description":"MICSYS IO driver","Company":"MICSYS Technology Co., LTd","InternalName":"MsIo64.sys","OriginalFilename":"MsIo64.sys","FileVersion":"1.3 x64 built by: WinDDK","Product":"MsIo64 Driver Version 1.3","ProductVersion":"1.3 x64","Copyright":"Copyright (c) 2021 MICSYS","MachineType":"AMD64","Imports":["ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["RtlInitUnicodeString","DbgPrint","ZwClose","ZwMapViewOfSection","ObReferenceObjectByHandle","ZwOpenSection","IoDeleteSymbolicLink","ZwUnmapViewOfSection","IofCompleteRequest","IoCreateSymbolicLink","IoCreateDevice","ObfDereferenceObject","IoDeleteDevice","HalTranslateBusAddress"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Extended Validation Code Signing CA , G2","ValidFrom":"2014-03-04 00:00:00","ValidTo":"2024-03-03 23:59:59","Signature":"3f5b19f3fa13d575382a5aee9f5aa04ca91dc5cc94eede15fef5106ea41ba56483541858c40b28a185c34e74e5ff897cfed5ed3cba719f5602268f162a88feb0a32722ce4be2388e00a63a865f9de53ea8de644941744121fd07c88417da1d653082cb264f39d60427a481b14b49c3238b7e02321827b7ab0bf31872b6a4ee67066f38a6588de0f17e5da460c6a8e5505fe0e8bae28f9958b6b5a0a876f1a2f11c8841727e52979b0a36998d50f701eb3ce7f0226ae5358c63368a1ab1d967665f971aefa8209df02fba6cced9948500f158f17dc97c22b5075d02c6e60bbfab9393ff27188e33367e5734f1c3af04c184f156b3e8878336f8d30a31dc6e2c6d","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"191a32cb759c97b8cfac118dd5127f49","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"788b61bd26da89253179e3de2cdb527f","SHA1":"7d06f16e7bf21bce4f71c2cb7a3e74351451bf69","SHA256":"b3c925b4048c3f7c444d248a2b101186b57cba39596eb5dce0e17a4ee4b32f19","SHA384":"2955e28cb7ec0ea9730b499a0f189f9621eceb02591a9486b583f12bb845885a30d6a871826318a167cc5f06b274e58c"}},{"Subject":"??=TW, ??=Taiwan, ??=New Taipei, ??=Private Organization, serialNumber=84948057, C=TW, L=New Taipei, O=MICSYS Technology Co., Ltd., CN=MICSYS Technology Co., Ltd.","ValidFrom":"2019-05-21 00:00:00","ValidTo":"2022-05-20 23:59:59","Signature":"0a47cf1ef4f7db7a1839d16d6cf70ab0447bc7a47cc9cf2124024f5f1583c03d411fabd06dddd424db9702178172411dea6503e33b3f488a5d53b30fb4dd2b30456e3880dd32fd4dc39bbb240c450e930c282095d65a061fae6cfd46eb94cdf549d4813cdc468061bc739b76c7a10fe9e8b762727a3a8e440473a1e6b56ac3d92df16ca8331deaf39072ce2a09705bcec87bc508ecea9b274115fff278b15c0e6430ddce6f09311e5d64ca763e70e5cad8eb6127680d12279d78129214cb0857078ab6a1187e112c9b71d1f08fa60e570d9180a901de521222be67be4ad243a9ddbb4af1ef3a5bb1e58556753a8183ed400de32f846e0b49a74de1025d03b7d0","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"49f161119a491d2a3faf4220f09db107","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"b6dc6eecc4959ec6a25ad56ed4bc2451","SHA1":"8c38527fd4e4db39db700ee86431a6670edb9005","SHA256":"3777c0b7223f4d570844461c938b379ba4a49fdfde0a08ea37a7be5c38a39db0","SHA384":"78a64d3b5ad313da9aeaaf82440843670f388b556b5e6d632a0f8fea413108cd7b296214ee90ef3928837f315fb56cea"}}],"Signer":[{"SerialNumber":"49f161119a491d2a3faf4220f09db107","Issuer":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Extended Validation Code Signing CA , G2","Version":1}]}],"RichPEHeaderHash":{"MD5":"ca146dde5be4c188affdff2cb309138f","SHA1":"2ccd48af92b211fe134d5fa3c7888b95d648825e","SHA256":"1a49f88636cc1a3ab481d8a17a6bc61de8a93ff1dc8b6253dcc5e3cbcaac827c"},"Sections":{".text":{"Entropy":5.985349255484258,"Virtual Size":"0xdb5"},".rdata":{"Entropy":4.508056386696043,"Virtual Size":"0x1a8"},".data":{"Entropy":0.4975521352521052,"Virtual Size":"0x11c"},".pdata":{"Entropy":3.087778287293878,"Virtual Size":"0x60"},"INIT":{"Entropy":4.784008217365608,"Virtual Size":"0x262"},".rsrc":{"Entropy":3.388654065082743,"Virtual Size":"0x390"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2021-04-15 00:18:47","Imphash":"8a424cd36ae3eab0d11332ce3b982a02","LoadsDespiteHVCI":"TRUE"},{"Filename":"MsIo64.sys","MD5":"de711decdd763a73098372f752bf5a1c","SHA1":"663803d7ab5aff28be37c2e7e8c7b98b91c5733e","SHA256":"cfcf32f5662791f1f22a77acb6dddfbc970fe6e99506969b3ea67c03f67687ab","Authentihash":{"MD5":"a108434c7016659eca85bc755687c9d1","SHA1":"5b030639b3e83f945ea610eead115b213bb436f6","SHA256":"555ebe7901706dbf801b5dbda6660002d3b36e5c669ec98ccfc6884a7481c56e"},"Description":"MICSYS IO driver","Company":"MICSYS Technology Co., LTd","InternalName":"MsIo64.sys","OriginalFilename":"MsIo64.sys","FileVersion":"1.2 x64 built by: WinDDK","Product":"MsIo64 Driver Version 1.2","ProductVersion":"1.2 x64","Copyright":"Copyright (c) 2019 MICSYS","MachineType":"AMD64","Imports":["ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["RtlInitUnicodeString","DbgPrint","ZwClose","ZwMapViewOfSection","ObReferenceObjectByHandle","ZwOpenSection","IoDeleteSymbolicLink","ZwUnmapViewOfSection","IofCompleteRequest","IoCreateSymbolicLink","IoCreateDevice","ObfDereferenceObject","IoDeleteDevice","HalTranslateBusAddress"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2019-06-05 18:34:00","ValidTo":"2020-06-03 18:34:00","Signature":"312314217055afc1a5751181c7d2d7619b23ba17166e6ae6f358b16921c925c6e3b75c31b93035f357c154fe4d347019e927db1957193b741e3371b46f4d6212b3bec972d6ff2297e8b1f2391f840045471ee31c524d4f5bf1cae4a32b73f6e48f51f777bb5b8a726db2a387c7c8df42289540f4f3d27b37d4ab4854efba809021879f3257d5670d70003a51d62bbc68e345a769f37ccb3ad336b7b3c494f5d56ef8300228d29835e5129b070742a220f83b6c9d5e2589cf2e7a1f7b59cfc81cda3232fc2fa448d736db546dc4b274cad3da83433deaa3eb9919b23ad08dc4055a8026711adcfccdb47d7a7c1adb2671ecc7198a786973807699a0ee236a46771f88913b769693b0b8ce9b002a40c2aa426edfd9a98368f89817b0d174458a390e11628e21f77e751431fae13831228e0e357610a24d89806d85390e9b3831792f62688bf04f91ee9a854b252452de7e752f39e57765a09a4ff41ae96144593a8a99688c6c9ad6b9fcaba1189ef2372b99e96db3fe6402b0e125b17f36c6f70fc1eb83257ce639b6c691a9ec031dddb9fa6536bb8e6080c9db976533f4ddfb73309b6498543cc94d3283d43668d614dd60a4fe707eb3b871da3204c534c8cc73cbc66aeb36cefd765439eef68d7ee9c515eb617f051a72097d0a25003df2dceccc9a0c4be1fd27e473955cc83ee9dba626748b1cb723c3b1c8b8ebc59321a0f5","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"33000000319479a318f5522d06000000000031","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"5b81fd0f706522a8d7c9f2957283c0b4","SHA1":"84d894599653a8ed0e0b2802db3197dc177908cc","SHA256":"4fa629304df4287c97ae5b7e481974316e9daf776b0cdeffab1671e7dca68fb4","SHA384":"0b89dc122fc7ebf80881a5047ffbbcb0bec30636516aff4f43307e2a925a476cabfc26e2cc392ad748d655f6ec4c8b75"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"33000000319479a318f5522d06000000000031","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}],"RichPEHeaderHash":{"MD5":"ca146dde5be4c188affdff2cb309138f","SHA1":"2ccd48af92b211fe134d5fa3c7888b95d648825e","SHA256":"1a49f88636cc1a3ab481d8a17a6bc61de8a93ff1dc8b6253dcc5e3cbcaac827c"},"Sections":{".text":{"Entropy":5.955984889090057,"Virtual Size":"0xd25"},".rdata":{"Entropy":4.1696966334987575,"Virtual Size":"0x174"},".data":{"Entropy":0.4975521352521052,"Virtual Size":"0x11c"},".pdata":{"Entropy":3.1449604398835636,"Virtual Size":"0x60"},"INIT":{"Entropy":4.784008217365608,"Virtual Size":"0x262"},".rsrc":{"Entropy":3.371121078414638,"Virtual Size":"0x390"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2020-01-19 22:35:15","Imphash":"8a424cd36ae3eab0d11332ce3b982a02","LoadsDespiteHVCI":"FALSE"},{"Filename":"MsIo64.sys","MD5":"61b068b10abfa0776f3b96a208d75bf9","SHA1":"1de9f25d189faa294468517b15947a523538ce9d","SHA256":"d636c011b8b2896572f5de260eb997182cc6955449b044a739bd19cbe6fdabd2","Authentihash":{"MD5":"aedaf6ec0809d26c9dc2f41754095790","SHA1":"2c7e97bafd3bc518778d78cfc5157d069714bc18","SHA256":"5f39b84cb5132d4facff213c630b05ec97ef9d83b93579530152310d63945762"},"Description":"MICSYS IO driver","Company":"MICSYS Technology Co., LTd","InternalName":"MsIo64.sys","OriginalFilename":"MsIo64.sys","FileVersion":"1.3 x64 built by: WinDDK","Product":"MsIo64 Driver Version 1.3","ProductVersion":"1.3 x64","Copyright":"Copyright (c) 2021 MICSYS","MachineType":"AMD64","Imports":["ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["RtlInitUnicodeString","DbgPrint","ZwClose","ZwMapViewOfSection","ObReferenceObjectByHandle","ZwOpenSection","ObfDereferenceObject","IoDeleteSymbolicLink","__C_specific_handler","IofCompleteRequest","ProbeForWrite","ProbeForRead","IoCreateSymbolicLink","IoCreateDevice","ZwUnmapViewOfSection","IoDeleteDevice","HalTranslateBusAddress"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2022-06-07 18:08:05","ValidTo":"2023-06-01 18:08:05","Signature":"0915e1bc394d6afd2453e27c2cb0907bb3a569ca2f39bc8e430a355013bd29a2aa0f8d724499e05b94f919195e917a198a754a790c8f4f49ebeea699d62e4b97b18055d6872b13e5c3866e8617fafb65a59cf0c463f75b45f870595677ecdda4ae3562b0f4a30d09626cef7f4e20e77385bd4e4db94fc77088d698236e92e1440cef351a1f3bff256df13c1a14b5c6787dad23e1e28d4148b69b3a92fe692bed7db3feb760db45fe1700983b834ab7805ba6105fdf94d5e0833679fae2fc051d745c6fab49c8aa9044d92da8c26fe7c87a9268bd1211117298b391752c08f98ffaa3731bbca891a83a0bdb9d94546d1bab380ade386213b3833327f48b9ff29971732bfe5810b51569da90676b459f8f6341ef9ff11f96f44f58181ef7ffe3ff19ba7874ad2e8c4faa9f8d1c5cd698bbdab1658f5f234f64a0063ecaa346f16e58690dea8c52e02733560027155457863b38775e24f30176cadd0d2738b4d90f2e4f688e25bc908a5fb1057be8372e58dc7c018b4663588fb1ab36855c09e54924951cff3b29810339efca415995a577e7db9d8b43c79b0bcb888b3647c7b28b9599bf0cbc7683e0e68c610d0071e79a3f1b4160dcfcb3002478ccc6bbf0c6dd27893169825f7b50356e01ea77aeae1b534d8c8801eda6bc60682a7b3a78b8b74eddb75044a789e7c4fd8f27ac8050196a7b1de4b5ac2e2b268c568534f75ca9","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"330000005635887ede1882ef76000000000056","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"b2247e5539fb97f429f20b17b38c4bcb","SHA1":"a3b745afc365e9ddf6abdb2f52f76f1714c0461c","SHA256":"e0c84b42e07e8f56ed8dcd2103e98cd43816cf2e05a27b8ff09fdccccfbcffaa","SHA384":"70e84fe31ec8f61d70755ec61ba53db7741610d7348247c97796147dcaa77a55bc3887cedf16eb0a2f32867670d007c1"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"330000005635887ede1882ef76000000000056","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}],"RichPEHeaderHash":{"MD5":"feef182f5e6f350d0f0fbf6ac45c2460","SHA1":"69770e51d1449ed5f85d3758d01cdc9a1a0e7827","SHA256":"8dca05c1af4dd5e09c431a0bb260dd3287443231d8c55b15b02ed4257e312cec"},"Sections":{".text":{"Entropy":6.149721231513278,"Virtual Size":"0xe1f"},".rdata":{"Entropy":4.310768861955645,"Virtual Size":"0x1e8"},".data":{"Entropy":0.8603296914633027,"Virtual Size":"0x15c"},".pdata":{"Entropy":2.9836116206272116,"Virtual Size":"0x60"},"INIT":{"Entropy":4.834422659066408,"Virtual Size":"0x2b2"},".rsrc":{"Entropy":3.388654065082743,"Virtual Size":"0x390"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2023-04-05 21:54:11","Imphash":"12a08688ec92616a8b639d85cc13a3ed","LoadsDespiteHVCI":"FALSE"},{"Filename":"MsIo64.sys","MD5":"8663ab852d5194d55f37dc68789c9f0b","SHA1":"1713e57ec78402e61b0bf43e9bbb1a6f0ce24678","SHA256":"a7261f13f11c3b845c27cfeeb1cdc6a9400090cebd8e5adbf8c506c1fd9811de","Signature":["Microsoft Windows Hardware Compatibility Publisher"],"Date":"07:36 AM 12/11/2023","Publisher":"Microsoft Windows Hardware Compatibility Publisher","Company":"MICSYS","Description":"MICSYS IO driver","Product":"MsIo64 Driver Version 1.3","ProductVersion":"1.3 x64","FileVersion":"1.3 x64 built by: WinDDK","MachineType":"AMD64","OriginalFilename":"MsIo64.sys","InternalName":"MsIo64.sys","Copyright":"Copyright (c) 2021 MICSYS","Imphash":"12a08688ec92616a8b639d85cc13a3ed"}]}