{"Id":"3ab0d182-6365-47a7-89f4-34121e889503","Tags":["HwOs2Ec10x64.sys","HwOs2Ec.sys","Huawei MateBook"],"Verified":"TRUE","Author":"Michael Haag","Created":"2023-01-09","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create HwOs2Ec10x64.sys binPath=C:\\windows\\temp\\HwOs2Ec10x64.sys     type=kernel && sc.exe start HwOs2Ec10x64.sys","Description":"Huawei HwOs2Ec 1.0.0.1 exposes kernel process termination to administrative callers. In the tracked HwOs2Ec.sys build, IOCTL 0x22400C accepts a four-byte PID, rejects only PID 0 and PID 4, opens the target with full process access, and calls ZwTerminateProcess. Proofpoint observed this exact signed driver deployed by Cruciferra as an alternative BYOVD helper for tampering with endpoint security tools.","OperatingSystem":"Windows 10","Privileges":"Administrator","Usecase":"Terminate protected security processes"},"Resources":["https://github.com/magicsword-io/LOLDrivers/issues/409","https://github.com/fluffycats31/vulnerable-drivers","https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md","https://www.proofpoint.com/us/blog/threat-insight/unpacking-cruciferra-analysis-sophisticated-crypter-service"],"Detection":[{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/bb1135b51acca8348d285dc5461d10e8f57260e7d0c8cc4a092734d53fc40cbc.yara"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"},{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"}],"Acknowledgement":{"Person":"fluffycats31","Handle":"@fluffycats31"},"KnownVulnerableSamples":[{"Authentihash":{"MD5":"20be6af18d3b97968b2a8d5a9513caaa","SHA1":"b6a4ef3babbd79479723b8586ea0e8c7a33d1661","SHA256":"ab494aba56e9ea7b6055ac437f6b678e7239b0fda54bf28019480565a098a6e3"},"Company":"Huawei","Copyright":"Copyright (C) 2016","CreationTimestamp":"2018-03-23 02:56:31","Date":"","Description":"HwOs2Ec","ExportedFunctions":"","FileVersion":"1.0.0.1","Filename":"HwOs2Ec10x64.sys","ImportedFunctions":["IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","IoGetCurrentProcess","InitSafeBootMode","memcpy_s","_wcsnicmp","RtlInitUnicodeString","RtlEqualUnicodeString","RtlCopyUnicodeString","RtlAppendUnicodeToString","KeEnterCriticalRegion","KeLeaveCriticalRegion","ExAllocatePool","ExAllocatePoolWithTag","ExFreePoolWithTag","ExInitializeResourceLite","ExAcquireResourceSharedLite","ExAcquireResourceExclusiveLite","ExReleaseResourceLite","ExDeleteResourceLite","MmProbeAndLockPages","MmMapLockedPagesSpecifyCache","MmUnmapLockedPages","IoAllocateMdl","IoFreeMdl","ObReferenceObjectByHandle","ObfDereferenceObject","ObRegisterCallbacks","ObUnRegisterCallbacks","ZwClose","PsSetCreateProcessNotifyRoutine","ZwOpenProcess","ZwQuerySystemInformation","ZwQueryInformationProcess","ZwAllocateVirtualMemory","ZwFreeVirtualMemory","KeInitializeApc","ZwOpenThread","IofCompleteRequest","PsGetProcessPeb","RtlImageDirectoryEntryToData","KeStackAttachProcess","KeUnstackDetachProcess","__C_specific_handler","PsProcessType","PsThreadType","KeLowerIrql","KfRaiseIrql","MmBuildMdlForNonPagedPool","MmMapIoSpace","MmUnmapIoSpace","MmMapIoSpaceEx","MmAllocateContiguousMemory","MmFreeContiguousMemory","MmGetPhysicalAddress","PsGetThreadId","PsGetThreadProcessId","MmGetSystemRoutineAddress","RtlGetVersion","ZwTerminateProcess","KeInitializeEvent","ExAcquireFastMutex","ExReleaseFastMutex","KeSetEvent","KeWaitForMultipleObjects","KeWaitForSingleObject","PsCreateSystemThread","PsTerminateSystemThread","RtlCompareUnicodeStrings","wcscpy_s","RtlCompareUnicodeString","RtlAppendUnicodeStringToString","ZwCreateFile","ZwOpenKey","ZwQueryValueKey","ObOpenObjectByPointer","ObQueryNameString","IoFileObjectType","KeInsertQueueApc","DbgPrint","HalGetBusDataByOffset"],"Imports":["ntoskrnl.exe","HAL.dll"],"InternalName":"HwOs2Ec","MD5":"37086ae5244442ba552803984a11d6cb","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"HwOs2Ec.sys","Product":"Huawei MateBook","ProductVersion":"1.0.0.1","Publisher":"","RichPEHeaderHash":{"MD5":"1caef52202f244dd7b072a2cbf506293","SHA1":"7261547970d9fc1926cfeee5cab87ba0f4d7b1b6","SHA256":"07adf312a869ff25e9f5bd2e9a5668206089681078b161f1d0c2301205025274"},"SHA1":"dc0e97adb756c0f30b41840a59b85218cbdd198f","SHA256":"bb1135b51acca8348d285dc5461d10e8f57260e7d0c8cc4a092734d53fc40cbc","Sections":{".text":{"Entropy":6.209628301100335,"Virtual Size":"0x2604"},".rdata":{"Entropy":4.403697200697397,"Virtual Size":"0xb34"},".data":{"Entropy":0.30140680731160896,"Virtual Size":"0x27c"},".pdata":{"Entropy":4.330099069591839,"Virtual Size":"0x3d8"},".gfids":{"Entropy":0.8112781244591328,"Virtual Size":"0x4"},"PAGE":{"Entropy":6.294080780063295,"Virtual Size":"0x2160"},"INIT":{"Entropy":5.409627830089687,"Virtual Size":"0xb68"},".rsrc":{"Entropy":3.2265908774923377,"Virtual Size":"0x308"},".reloc":{"Entropy":2.7841837197791888,"Virtual Size":"0x14"}},"Signature":["Huawei Technologies Co., Ltd.","Symantec Class 3 Extended Validation Code Signing CA - G2","VeriSign"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=MSFT, CN=Microsoft Authenticode(tm) Root Authority","ValidFrom":"1995-01-01 08:00:01","ValidTo":"1999-12-31 23:59:59","Signature":"2dc9e2f6129e5d5667fafa4b9a7edc29565c80140228856e26f3cd58da5080c5f819b3a67ce29d6b5f3b8f2274e61804fc4740d87a3f3066f012a4d1eb1de7b6f498ab5322865158ee230976e41d455c4bff4ce302500113cc41a45297d486d5c4fe8383657deabea2683bc1b12998bfa2a5fc9dd384ee701750f30bfa3cefa9278b91b448c845a0e101424b4476041cc219a28e6b2098c4dd02acb4d2a20e8d5db9368e4a1b5d6c1ae2cb007f10f4b295efe3e8ffa17358a9752ca2499585feccda448ac21244d244c8a5a21fa95a8e56c2c37bcf4260dc821ffbce74067ed6f1ac196a4f745cc51566316cc16271910f595b7d2a821adfb1b4d81d37de0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.4","IsCertificateAuthority":true,"SerialNumber":"01","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"d67576f5521d1ccab52e9215e0f9f743","SHA1":"725a5684e8ab40f2155bbd7a4490a3fbb0fa747b","SHA256":"676c4e84e727f5004c10bb52017676f46bd54d69499017e9fd58271ec341d739","SHA384":"92c454a9d235f2087ac03a0889b51bfc96539132ebe14a02a07d9287473a21b0a65886496ef68878df21422318064284"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"OU=Copyright (c) 1997 Microsoft Corp., OU=Microsoft Corporation, CN=Microsoft Root Authority","ValidFrom":"1997-01-10 07:00:00","ValidTo":"2020-12-31 07:00:00","Signature":"95e80bc08df3971835edb80124d87711f35c60329f9e0bcb3e0591888fc93ae621f2f057932cb5a047c862effcd7cc3b3b5aa9365469fe246d3fc9ccaade057cdd318d3d9f10706abbfe124f1869c0fcd043e3115a204fea627bafaa19c82b37252dbe65a1128a250f63a3f7541cf921c9d615f352ac6e433207fd8217f8e5676c0d51f6bdf152c7bde7c430fc203109881d95291a4dd51d02a5f180e003b45bf4b1ddc857ee6549c75254b6b4032812ff90d6f0088f7eb897c5ab372ce47ae4a877e376a000d06a3fc1d2368ae04112a8356a1b6adb35e1d41c04e4a84504c85a33386e4d1c0d62b70aa28cd3d5543f46cd1c55a670db123a8793759fa7d2a0","SignatureAlgorithmOID":"1.2.840.113549.1.1.4","IsCertificateAuthority":true,"SerialNumber":"00c1008b3c3c8811d13ef663ecdf40","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"8b3c3087b7056f5ec5ddba91a1b901f0","SHA1":"10792d184e6eb874504fd0d5ec06cabc0229da56","SHA256":"b0f310311013abfe7a7b41182ad99bc9846bdf91c432d48aa1777208150185a4","SHA384":"7b8d4a70780f1827a39dce0f6d4a32e2ba18d837fc4e4664b98569c346c67cc5c90efbadd53794bc91c41024decab2ff"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Extended Validation Code Signing CA , G2","ValidFrom":"2014-03-04 00:00:00","ValidTo":"2024-03-03 23:59:59","Signature":"3f5b19f3fa13d575382a5aee9f5aa04ca91dc5cc94eede15fef5106ea41ba56483541858c40b28a185c34e74e5ff897cfed5ed3cba719f5602268f162a88feb0a32722ce4be2388e00a63a865f9de53ea8de644941744121fd07c88417da1d653082cb264f39d60427a481b14b49c3238b7e02321827b7ab0bf31872b6a4ee67066f38a6588de0f17e5da460c6a8e5505fe0e8bae28f9958b6b5a0a876f1a2f11c8841727e52979b0a36998d50f701eb3ce7f0226ae5358c63368a1ab1d967665f971aefa8209df02fba6cced9948500f158f17dc97c22b5075d02c6e60bbfab9393ff27188e33367e5734f1c3af04c184f156b3e8878336f8d30a31dc6e2c6d","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"191a32cb759c97b8cfac118dd5127f49","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"788b61bd26da89253179e3de2cdb527f","SHA1":"7d06f16e7bf21bce4f71c2cb7a3e74351451bf69","SHA256":"b3c925b4048c3f7c444d248a2b101186b57cba39596eb5dce0e17a4ee4b32f19","SHA384":"2955e28cb7ec0ea9730b499a0f189f9621eceb02591a9486b583f12bb845885a30d6a871826318a167cc5f06b274e58c"}},{"Subject":"??=CN, ??=Guangdong, ??=Shenzhen, ??=Private Organization, serialNumber=914403001922038216, C=CN, ST=guangdong, L=shenzhen, O=Huawei Technologies Co., Ltd., CN=Huawei Technologies Co., Ltd.","ValidFrom":"2017-12-14 00:00:00","ValidTo":"2019-12-14 23:59:59","Signature":"26d8d72aafae208ca75f86e2d634f131cd47c9531f57dd9d0506dd5f6e51df6baea828f02aa0ae534538921a9bc01af8ed084a8a06a5aa16e5def159a2ea17d84a134aa94467d2016797a2f8e49eb90d1de2e4213b6abd8147b4916f95c7b6c7b9c351cc969c00220c188e6a63806623eabd8fe9780141953a49197cfc1fbf5e39ea1c8f3afc3d792a46786202a7a02b9add0f36ed5125015fab8aded58cc2796b3c2d946b09084fe1547718ba315c53bdeb1d1330306113c6aa141494e11cf0ed3193dace62aef90bb5d6cb65aed548c00983eed016729498079e9ac5931bd33607aa1ee3156967b51963557d977fad2c755e34eb26fc4a249f5d24490d8884","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"45d8f42e053d18c5e90f3febd6e17ad7","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"43be09b45818339b6233a11e2475e003","SHA1":"063e6aeb12a5bf2b6e02ebcda4cd474662a5be18","SHA256":"a71bb69621ea11ab4ce55b9e83589fed52e4273e838fbab7992e024cef88601a","SHA384":"6c8c9e1ab7a6ac3c02c3400d777229f5ee8dbf561f22127c36da5c2b638ad1e90fbb9386271643946a81cb5b8811b9a7"}},{"Subject":"DC=com, DC=microsoft, CN=Microsoft Root Certificate Authority","ValidFrom":"2001-05-09 23:19:22","ValidTo":"2021-05-09 23:28:13","Signature":"c5114d033a60dd5d5211778fb2bb36c8b205bfb4b7a8d8209d5c1303b61c22fa061335b6c863d49a476f2657d255f104b1265fd6a95068a0bcd2b86eccc3e9acdf19cd78ac5974ac663436c41b3e6c384c330e30120da326fe515300ffaf5a4e840d0f1fe46d052e4e854b8d6c336f54d264abbf50af7d7a39a037ed63030ffc1306ce1636d4543b951b51623ae54d17d40539929a27a85baabdecbbbee3208960716c56b3a513d06d0e237e9503ed683df2d863b86b4db6e830b5e1ca944bf7a2aa5d9930b23da7c2516c28200124272b4b00b79d116b70beb21082bc0c9b68d08d3b2487aa9928729d335f5990bdf5de939e3a625a3439e288551db906b0c1896b2dd769c319123684d0c9a0daff2f6978b2e57adaebd70cc0f7bd6317b8391338a2365b7bf285566a1d6462c138e2aabf5166a294f5129c6622106bf2b730922df229f03d3b144368a2f19c2937cbce3820256d7c67f37e24122403088147eca59e97f518d7cfbbd5ef7696effdcedb569d95a042f99758e1d73122d35f59e63e6e2200ea4384b625dbd9f3085668c0646b1d7cecb693a262576e2ed8e7588fc4314926ddde293587f53071705b143c69bd89127deb2ea3fed87f9e825a520a2bc1432bd930889fc810fb898de6a18575337e6c9edb7313646269a52f7dca966d9ff8044d30923d6e211421c93de0c3fd8a6b9d4afdd1a19d9943773fb0da","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"79ad16a14aa0a5ad4c7358f407132e65","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"ca846b34f2abfeea2228098843a0e0c6","SHA1":"391be92883d52509155bfeae27b9bd340170b76b","SHA256":"855920f04434989fc8f601eecd2f79ff93fe51b541d63aa94bef1425cd7d521d","SHA384":"cd8d5f1c2d282098fd92fd831a4ecbec74c4f97ba26ce2a0953cb2c367afb1469c7441554e4ecefe56ef44f281196043"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Code Verification Root","ValidFrom":"2005-11-01 13:46:46","ValidTo":"2025-11-01 13:54:03","Signature":"6142e8eb18c871dc4619696dea0ecd3867ac3ea707f64d163c9e57fbb8b8a7c78709e66357d03d469050f50599c9ca743afb01ad7a4d6aab84e0405357c89cd5043682b8b71ec68799c2d8c7209ec6f23e55f98f744451dd2bb6d014ddc6ded2c5ff85af17b9a075dac60de24576961acb3e53fbe9345b3203236cbfd87e9a3d850fc8153b9d00564fafddb1251ca0cc29661b47ce7b67ef64ef484792de9d145069b85f82a9f2ad932b53efab623237eabf040b46eb1984a6aa49a06dc1ab2d83416ab4d6437bd23b7a0cd26dd00d20dc5bc229a7f8822422160135d81ad64422dc476756a6682effc9669ffb7fb464c61e6776e0312e3ad9730d6799c8f5611e5dc1a7b88f311f38dfe3b3874c4db3c4f6605cacac0da02c02b9eff0a35d27bd967d0dd0d44006d1a4d6cb6eb3d536fe48c8f23826563a206aa4c30048e71829e7aba3ab7c07a47fa56b4aba023f86975db96e5924e07c8fedefc3cfaaaf15513fdff728785deb4d1f5d34089b343b2aa1c891097d53c1ff7d801fe06b28d4b9dd587421b89f2dbd153a4e454a5cc3ac7c07b2d02115b8cf69da14e42c24fb66e5019e1a66b4c4ad4d2bad6062e4e48fea370dcad836dc7fdb207a33c04ad61f2de085ce2ba192d754532061867c3703038cfc4347e4f8488bac1a42ea98825d6253816b534630b2e785abbc189c86965986b61aaffafd4831245c011cbb1c","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"729404101f3e0ca347837fca175a8438","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"ee8df66ce2c464c64bb9a9eb9cbd7e90","SHA1":"f4e3b23c5b3673fb06339c35314279fdee1e003f","SHA256":"6d260763a05a13ab7823c6d584f19e5dab26e8e6b56d305ecc7376cd23f411fb","SHA384":"7cb39e0131ea77825f441568bd91846811955cd0f45d547020173347f4fd3d7dfe5bc4952fa4f9675902c4a869328196"}}],"Signer":[{"SerialNumber":"45d8f42e053d18c5e90f3febd6e17ad7","Issuer":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Extended Validation Code Signing CA , G2","Version":1}]}],"Imphash":"071356ee9d8c7f91cbe8fa3c448286a2","LoadsDespiteHVCI":"TRUE"},{"Filename":"HwOs2Ec.sys","SHA256":"c4e93449453cf67c5d5605bb8f425207a738a242fdb432d720acc32faa74926c","MD5":"63bfd6567f4c704e8ed6530f5cdd704e","SHA1":"080fdb73a6bbc99625c2190730257d1e54723952","Imphash":"dcf524d72961e33f0c6462f869bb6a4a","Authentihash":{"MD5":"620301316b071f339f8ffe7ee4d24990","SHA1":"846c4f2abdbef8492f4478505b205375b0c88159","SHA256":"30de6a51d0a56e8d2b3d37393252eaa16728b6c4747f57153e6b4ca0b6022f56"},"RichPEHeaderHash":{"MD5":"855ca6b69838dec250f7af889ac6ae76","SHA1":"231e021a37a1363050b733c4a35b21a7f04ba53e","SHA256":"88a21f0d4614599d6c8179ee1eb6cf72cb1564aa021fb1950701add96d853357"},"Sections":{".text":{"Entropy":6.357167334949913,"Virtual Size":"0x373a"},".rdata":{"Entropy":4.363297381309785,"Virtual Size":"0xe34"},".data":{"Entropy":1.44161352725558,"Virtual Size":"0x35c"},".pdata":{"Entropy":4.397484052665614,"Virtual Size":"0x480"},"PAGE":{"Entropy":6.259500456839248,"Virtual Size":"0x225d"},"INIT":{"Entropy":5.407548837207753,"Virtual Size":"0xa4c"},".rsrc":{"Entropy":3.3089434332999756,"Virtual Size":"0x370"},".reloc":{"Entropy":3.3942493131687033,"Virtual Size":"0x2c"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2022-02-25 19:25:36","Description":"HwOs2Ec","Company":"Huawei Device Co., Ltd.","InternalName":"HwOs2Ec","OriginalFilename":"HwOs2Ec.sys","FileVersion":"1.0.0.1","Product":"Huawei MateBook","ProductVersion":"1.0.0.1","Copyright":"Copyright © Huawei Device Co., Ltd. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["IofCompleteRequest","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","IoGetCurrentProcess","InitSafeBootMode","memcpy_s","memmove_s","wcscat_s","ExAllocatePoolWithTag","ExFreePoolWithTag","MmMapIoSpace","MmUnmapIoSpace","IoWMIOpenBlock","IoWMIQueryAllData","IoWMIExecuteMethod","ObfDereferenceObject","ZwClose","ZwOpenSection","ZwMapViewOfSection","ZwUnmapViewOfSection","MmGetSystemRoutineAddress","RtlGetVersion","ObReferenceObjectByHandle","ZwTerminateProcess","DbgPrint","__C_specific_handler","PsProcessType","RtlTimeToTimeFields","KeInitializeEvent","ExAcquireFastMutex","ExReleaseFastMutex","ExSystemTimeToLocalTime","PsSetCreateProcessNotifyRoutineEx","KeSetEvent","KeWaitForMultipleObjects","KeWaitForSingleObject","PsCreateSystemThread","PsTerminateSystemThread","wcscpy_s","_wcsnicmp","RtlCompareUnicodeString","RtlAppendUnicodeStringToString","ExAllocatePool","ZwCreateFile","ZwOpenKey","ZwQueryValueKey","ZwQueryInformationProcess","ObOpenObjectByPointer","ObQueryNameString","IoFileObjectType","ZwCreateKey","ZwOpenProcess","RtlInitUnicodeString","ZwSetSecurityObject","IoDeviceObjectType","IoCreateDevice","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","RtlGetOwnerSecurityDescriptor","RtlGetSaclSecurityDescriptor","SeCaptureSecurityDescriptor","_snwprintf","RtlLengthSecurityDescriptor","SeExports","RtlCreateSecurityDescriptor","wcschr","RtlAbsoluteToSelfRelativeSD","RtlAddAccessAllowedAce","RtlLengthSid","IoIsWdmVersionAvailable","RtlSetDaclSecurityDescriptor","ZwSetValueKey","RtlFreeUnicodeString","HalGetBusDataByOffset"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"O=GlobalSign, OU=GlobalSign Root CA , R3, CN=GlobalSign","ValidFrom":"2015-06-04 17:47:53","ValidTo":"2025-06-04 17:47:53","Signature":"6002ac0e090db46a7d590cad66450a180f5ea7255c14f6d35acf9d5e3bc77afc005f6e402b2de1ce6f76ab3cabd9f945cf779052ea21973ad25d3e57ba73ec007577a2754574c76226b054bad5c9c9da6ced66f2ff8b17b27959ca805465da96ca11de2abbc3d43d37fce6fdcb92866eb9ad4d1b68e047d9b08634231cda1ddd6e54edcb0ee17ad54db2a1abceda712fa23e0804ac2a53d713d93c6e338ca7b7b935afa559df305fea3ee8777123f8f9e91edbe214036a8aef64c17be05d56e0e4f2c84ce0d7ef07d3d620fade651998a7c6712b5d94aee9c90b91578690ccde9fd43c1995043efd5c2ba4fc39958fa88787b25bca804fc31638f50eb0edd7caf6fc774477d84ac89d9fff301798d712d590dde53a66e0f12c974799b60f0e56da9b410dc34bd5f0689ccaa5865c866612f23b8304ff46ed2d64d456952b7e799d01831318d568bd91cedd86fb08a0ab0c4564c3d126345e56a26c4c690c8b63ca84187ac573abb352ae8ddce22b03677d862a126f684f6481752d85e5b8ec80059bab3969ee1f316a6a2afb35bd63aac5ee65d3d696a43e99931ebeee3b6c646caecd140afcd88c20a31cf8627fa4c07d1f2c7f3a50c0269396379c8fa51363b473d816ab27487eaafeeb0f487f29989e3b499190f08f3ebadc9f26819d736631a727b6e4a94d04e5ea5331c0fa934a879dfc4a61e063a2ac4f88f4c5781f65","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"330000003b6ac01e2b21e615dc00000000003b","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"b61c1ad0b5d89c8170aaa81f8b6218a3","SHA1":"b84d6a44f86e112ef3ecb55e22527fd37f622de8","SHA256":"60c5e154e6794b6ac214b221c8b62a733eb8794092aa400729bbf88b72748230","SHA384":"be8fab78dcd9709d29c973205e536a3994a93769c7032b72d9ab26106a5e00b5a3497e41baec9cf9824506ca0990ffac"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Trusted Root G4","ValidFrom":"2022-08-01 00:00:00","ValidTo":"2031-11-09 23:59:59","Signature":"70a0bf435c55e7385fa0a3741b3db616d7f7bf5707bd9aaca1872cec855ea91abb22f8871a695422eda488776dbd1a14f4134a7a2f2db738eff4ff80b9f8a1f7f272de24bc5203c84ed02adefa2d56cff9f4f7ac307a9a8bb25ed4cfd143449b4321eb9672a148b499cb9d4fa7060313772744d4e77fe859a8f0bf2f0ba6e9f2343cecf703c787a8d24c401935466a6954b0b8a1568eeca4d53de8b1dcfd1cd8f4775a5c548c6fefa1503dfc760968849f6fcadb208d35601c0203cb20b0ac58a00e4063c59822c1b259f5556bcf27ab6c76ce6f232df47e716a236b22ff12b8542d277ed83ad9f0b68796fd5bd15cac18c34d9f73b701a99f57aa5e28e2b994","SignatureAlgorithmOID":"1.2.840.113549.1.1.12","IsCertificateAuthority":true,"SerialNumber":"0e9b188ef9d02de7efdb50e20840185a","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"21a266bd49f2778b24d13d95641ea6ac","SHA1":"21319f341fdf06bf6a104427afa8b7823b1ea7f3","SHA256":"e933dc68ee65abd1f9b1aa6738eff60a6895d3d8cc4accf0c69069aa3decd757","SHA384":"11533efd6b326a4e065a936de300fe0586a479f93d569d2403bd62c7ad35f1b2199daee3adb510f429c4fc97b4b024e3"}},{"Subject":"C=BE, O=GlobalSign nv,sa, CN=GlobalSign Code Signing Root R45","ValidFrom":"2020-07-28 00:00:00","ValidTo":"2029-03-18 00:00:00","Signature":"acf7cc158b3079a81d0b28881909d71c7ffe86bd7b5a336e0d670e7b62d9e1185cb0bd135d1d23ae39507637aa44fd5f01235986564cccadbc64131430a420a8e03fe89c72dc7ef3d80c23baa82daa3cf6ec9f87310765f539a7518275e1f22f97f6d1e165968364fea11d51fbb5249bf5d27769bc852c5cfa5877d1aea7b10be2d677bba9b4344aa96f3df4f30d955de6f97a45b02517312edbf70f68e6831fa9f7e5d49d988cd3614b2fc3287e7ade930eb47da00a6d92c4b4663f7da758eeacf7ecc30801ab38fc0a1ca9c597b288c8090219f65c9a1af14d6c30d4b306ab0060480d78abcf17ad9293622077756cbdc832b4dc4debd9dfc1909629bdc17f","SignatureAlgorithmOID":"1.2.840.113549.1.1.12","IsCertificateAuthority":true,"SerialNumber":"7803184245708a41cf6f01b8eeb4a954","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"a33260428269bc902bc1cd280e4b1837","SHA1":"254209ca172cffcc67bd2a88996556d2f09538f0","SHA256":"a67411358594f2cf016741a63fd49f36de917f86531b3e3a43eb6a421c654868","SHA384":"fec727af43d1569995cea26e8eb97167165842a5b185304425a92c03b71254c5d51222837515f33e60cb8ed2e8c625ba"}},{"Subject":"C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA","ValidFrom":"2022-03-23 00:00:00","ValidTo":"2037-03-22 23:59:59","Signature":"7d598ec093b66f98a94422017e66d6d82142e1b0182e104d13cf3053cebf18fbc7505de24b29fb708a0daa2969fc69c1cf1d07e93e60c8d80be55c5bd76d87fa842025343167cdb612966fc4504c621d0c0882a816bda956cf15738d012225ce95693f4777fb727414d7ffab4f8a2c7aab85cd435fed60b6aa4f91669e2c9ee08aace5fd8cbc6426876c92bd9d7cd0700a7cefa8bc754fba5af7a910b25de9ff285489f0d58a717665daccf072a323fac0278244ae99271bab241e26c1b7de2aebf69eb1799981a35686ab0a45c9dfc48da0e798fbfba69d72afc4c7c1c16a71d9c6138009c4b69fcd878724bb4fa349b9776691f1729ce94b0252a7377e9353ac3b1d08490f94cd397addff256399272c3d3f6ba7f166c341cd4fb6409b212140d0b71324cddc1d783ae49eade5347192d7266be43873aba6014fbd3f3b78ad4cadfbc4957bed0a5f33398741787a38e99ce1dd23fd1d28d3c7f9e8f1985ffb2bd87ef2469d752c1e272c26db6f157b1e198b36b893d4e6f2179959ca70f037bf9800df20164f27fb606716a166badd55c03a2986b098a02bed9541b73ad5159831b462090f0abd81d913febfa4d1f357d9bc04fa82de32df0489f000cd5dc2f9d0237f000be4760226d9f0657642a6298709472be67f1aa4850ffc9896f655542b1f80fac0f20e2be5d6fba92f44154ae7130e1ddb37381aa12bf6edd67cfc","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"073637b724547cd847acfd28662a5e5b","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"e4b8ad9932ff9205f580cf8fb2afbb86","SHA1":"5301f7044d78bf94dd2b6e4871083a17fdba1dcc","SHA256":"c3d01499a5d1d2f71e0f44e78fbfa4b8aadb43dd4f226401e0c1d7a6d53357fa","SHA384":"84b5f399da5a4f4387269adfd951ef7d2197c29552ed2d2e449060664c3825d6bdb2acc3e563d999e54652f7384f445e"}},{"Subject":"C=US, O=DigiCert, CN=DigiCert Timestamp 2022 , 2","ValidFrom":"2022-09-21 00:00:00","ValidTo":"2033-11-21 23:59:59","Signature":"55aa2a1af346f378573730fc75e34fd68523f1fcf995399b25e6f7728a98c377d464fc15fb36c249512c7888635509463900fc69d4ca9b29fba33fc0c9009b131db09889dc78f2cd7c85cd539daf62e26166a3142a45874a98422b50fc1bb59e083009fae42dd7098979f909e688ce7d1bb86aa29bc1536009e8a3b89dd7ad1f1cb8ec9841f0f60e80fbe4ffdf9d10a7eb00ba5f4a8f1a3a52b4eabf0949153536599a0f54d2b21b7f7e5e09ad76548a746dcad205672b76ebff98b226953819884414e50a59a26be7223e4421d23f1cc09bed7c48b2d8920c914f3c6694af5d0253eb9ee29ee4d31f8601649c00c2e95a74750d3de17988bf1c0197c9192380d7365a5f9616b1630cc646403bce5d35d4593e439a18aec3c9cbc3fb9b135f6ab5c7e0f305c359df27622bde41c953b9ff341067f62632987bfe5c42948194829dac0a8bc64b154ad3989045603380e023def803a4f64547e5ceb8034247e841367177adfda2e897744e2eda1e1d8c5ac81e9ad5c2f0c622a84f9bbdd81c9a51c42f9af65fa72797ba962e8557c060e778567f6aefc2959a4b1102c8829cc91a057cba71b54e7a996cf4e89ed45a98c89fbf8dbb185c43f5d02ae8e262ee7804dbbdd1fb5b0aa8707ef0978478e308035d472c63a825389701d23f3adae5e5f6e69bdc7e2cccff174c4d00a2d8d6010eb88beee6e07255892c271961f677018c","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"0c4d69724b94fa3c2a4a3d2907803d5a","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"812cb8ca0c79b318780ec5128ad13c1d","SHA1":"3f8047d078307123301e50a25e9afb0dc4b6843d","SHA256":"0c0b121e6f807bc22d4e0f4945634c22eca7e4d5ca58a1526a40e918a35c1d79","SHA384":"86aab81948499b3c90833253a853e7b3fd82ccf7b65b35806831ab60814bfc6ad8848c990df262a1c89b6fc4267dad81"}},{"Subject":"C=BE, O=GlobalSign nv,sa, CN=GlobalSign GCC R45 CodeSigning CA 2020","ValidFrom":"2020-07-28 00:00:00","ValidTo":"2030-07-28 00:00:00","Signature":"08887226c6affaac5f06c0aa8c90dad0b2c0a297ff6e13321654fd3ef430119f8f98f99b52ddf2a216eed97895a69a7c61b804b5f8ebcbf4611133f66525b711428bd8696ec7ff95b48143a97eaebf82d64dcc11a383716a105e1905a7e76c7f56f4a85cc34e09ad596bb8f97ea52eb8fcde0ec2a0fbb004d4131bc727a9b9aa2d313bcf464c9deb4cecbc2e9cf187a37f38695f414067f6537dea41ef8e3dfba9d4113846df3cebf6cd22bd13cdf0e1e6e533a0be3ce478d51bcc20f23073b0221cf684d69b5c0002e128524bff124b40eaeeb01a06069e84e6e7f0db8446fb73d92b42b6c95734c716c0a6eb21b9aa0ef7fedbcaebbc17cbb867ebe33e4fdba994866455c9090ac0d904714a114b5a64c3bc7878ad4c4726650799d5cd3660a13353b3f67b2ad589403c71a5abf89959fde39b924bdd05bd0b0c78062bcf53d8bd129a5b2786853f91bee078807354dfa71d672b6ab6ae4d89802408527050f301ff44ae2f9ae0e14908e1e15bd738d19e0a8a9d94279bcaa3b9dbe2366ae36fb95862e036783601fac1a7897a2653a35cbbd2b2eb8acb63082ffe1ef35629e2359bd8ffe9a5bd6d4b592c892c2f52bbb52990da4347bc72ddbcd9bf80c1dcb0abb44b1d58363764eb9be185179a29a2fde608d292ffa0f87ce1e9a7d1308e5f26502bc7a2e297778aefd84d3e26eb994060f33c670cb608722935538134dc","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"77bd0e03a1b708f854ab067210d90447","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"3ac895a2c335c262c99974d6dbbac0b7","SHA1":"f6bd87a060c0a15c54ee2dbf0f698ab43d8e1462","SHA256":"b8b44319d788ea6ec3e7dea27fab059d25e3c4dcf09fcd1c67be7faed44a6b02","SHA384":"7a53befc061bab1086eafefc9e2e3ff7912594c831e18d76b1a1a58f27c6e7d7edba342776b87089d607f8ca5592a5b3"}},{"Subject":"C=CN, ST=Guangdong, L=Dongguan, O=Huawei Device Co., Ltd., OU=IT Dept., CN=Huawei Device Co., Ltd.","ValidFrom":"2022-06-17 03:33:13","ValidTo":"2023-04-09 08:30:19","Signature":"0c4c6249c7618aebece43e89cfb04a61dc27d1ffdf68675349a411f5d3c1f8596d9c5157696fcda93828b804d094d9cfad0e73eef7df791ee99157e8e03324c0bf5da51648f72cbc552d7aec9e48fd4bc7006edbd826831ffe95ddf6d372d8cb8fd7afe071678cd2069149317d67acf76169a4a86f286c753d99694a769d52e52bbffb1626adb7e3427d4c768974bf86d12cdb330f2dda4bfa623715f5d3cc76b1d2d8df933482a20150b0e0bcfa2cf24f6c7f665a8ddac0f8af47ec6afcdec2e4aefca23ecbf8039ed2288f880475554a5dca8ac6f7538a22dde36f0813d9dbd2fc40f7a94b496b08bb7db903fe12bafa167a9a9db0a76046bab0e688f907e145b8d082d0d1fd41cfae01117fc5f5593bafb809ba37df0b38ea1364911210a36e4ae41ae188ca9519e464d9c55f3c69f059319254ebfe271cb91e48ac4d3ceaae8f67964c8badeb47f8ffb7fdd093b636ad373fc2cbd592dbd53a0634b0559818d1c325f1118f94375f67b6fbabddc095bde83eb253974ae87bed9269165552a0863581c0ec6e2494b63b875e9de9c19c87dbb2cf8c0c500a1f8f3526fb9377fae805c3a2e13c2e5f75ec599de8dec88fbe1079aa982d56a4e787bc9087da407f6f77462a21d0a85226247a4a25b5b818d843151aa313de7be35d03374b9785e3f475725d6bffb2fe454094d9f6b18e2476d438a6cdb56a9b0f80c0305e861f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"41c888cd480408c6a6defe9e","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"134a4a23784bdb29a00c8ccc937a9a2f","SHA1":"c7d3094f44b8fdb806ade61f4e3770b1a931e9f1","SHA256":"feb000473e49a6a7d536c65548a7f10f43e68ec07f169566ebdf5f42b1da0608","SHA384":"77f3d890b65e131a474903cffd84794e21f22aa0c7ad6fff9e065e3fd3fe0e93f5a64b7cb7c93d5a46eec62d897b240f"}}],"Signer":[{"SerialNumber":"41c888cd480408c6a6defe9e","Issuer":"C=BE, O=GlobalSign nv,sa, CN=GlobalSign GCC R45 CodeSigning CA 2020","Version":1}]}]}]}