{"Id":"81a73e57-2e92-4d21-97d3-1c21eb4c3aea","Tags":["LenovoDiagnosticsDriver.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2023-01-09","MitreID":"T1068","CVE":["CVE-2022-3699"],"Category":"vulnerable driver","Commands":{"Command":"sc.exe create LenovoDiagnosticsDriver.sys binPath=C:\\windows\\temp\\LenovoDiagnosticsDriver.sys type=kernel && sc.exe start LenovoDiagnosticsDriver.sys","Description":"Lenovo Diagnostics versions before 4.45 are covered by CVE-2022-3699. The vulnerable driver behavior tracked here is limited to confirmed 1.0.2.0 through 1.0.4.0 LenovoDiagnosticsDriver.sys builds. Their low-user device ACL exposes FILE_ANY_ACCESS IOCTLs 0x222010 and 0x222014, which map caller-selected physical addresses and provide unrestricted physical-memory read and write primitives. Later 3.1.0.0 code removed the write path, denied Builtin Users, and limited reads to allowlisted PCI registers, so that build is not tracked here.","OperatingSystem":"Windows","Privileges":"User","Usecase":"Elevate privileges"},"Resources":["https://github.com/magicsword-io/LOLDrivers/issues/409","https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules","https://nephosec.com/cve-2022-3699-lenovo-diagnostics-driver-eop-arbitrary-r-w/","https://github.com/alfarom256/CVE-2022-3699","https://support.lenovo.com/us/en/solutions/ps500533-lenovo-diagnostics-vulnerabilities","https://nvd.nist.gov/vuln/detail/CVE-2022-3699","https://github.com/fluffycats31/vulnerable-drivers"],"Detection":[{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/f05b1ee9e2f6ab704b8919d5071becbce6f9d0f9d0ba32a460c41d5272134abe.yara"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"},{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"}],"Acknowledgement":{"Person":"Mike Alfaro, fluffycats31","Handle":"alfarom256, @fluffycats31"},"KnownVulnerableSamples":[{"Authentihash":{"MD5":"56b6144e389ce3b1e2a0a96a954aa7d8","SHA1":"6d9543725aca0c9c8f403425952692ccc1d2d7f2","SHA256":"34e6a56c60746c51034b45a7b2a36617205b598d0bbcc695f92404605a0975d5"},"Company":"Lenovo Group Limited (R)","Copyright":"© 2021 Lenovo Group Limited. All rights reserved.","CreationTimestamp":"2022-01-28 12:59:24","Date":"","Description":"Lenovo Diagnostics Driver for Windows 10 and later.","ExportedFunctions":"","FileVersion":"1.0.4.0","Filename":"LenovoDiagnosticsDriver.sys","ImportedFunctions":["MmMapIoSpace","MmUnmapIoSpace","IofCompleteRequest","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","__C_specific_handler","MmGetSystemRoutineAddress","RtlInitUnicodeString","ExFreePoolWithTag","ZwClose","ZwSetSecurityObject","IoDeviceObjectType","IoCreateDevice","ObOpenObjectByPointer","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","ExAllocatePoolWithTag","RtlGetSaclSecurityDescriptor","SeCaptureSecurityDescriptor","_snwprintf","RtlLengthSecurityDescriptor","SeExports","RtlCreateSecurityDescriptor","_wcsnicmp","wcschr","RtlAbsoluteToSelfRelativeSD","RtlAddAccessAllowedAce","RtlLengthSid","IoIsWdmVersionAvailable","RtlSetDaclSecurityDescriptor","ZwOpenKey","ZwSetValueKey","ZwQueryValueKey","ZwCreateKey","RtlFreeUnicodeString","RtlGetOwnerSecurityDescriptor","DbgPrintEx","HalGetBusDataByOffset","HalSetBusDataByOffset"],"Imports":["ntoskrnl.exe","HAL.dll"],"InternalName":"LenovoDiagnosticsDriver.sys","MD5":"b941c8364308990ee4cc6eadf7214e0f","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"LenovoDiagnosticsDriver.sys","Product":"Lenovo Diagnostics","ProductVersion":"1.0.4.0","Publisher":"","RichPEHeaderHash":{"MD5":"f9a028999bfd69ee65e86573d56d2de3","SHA1":"ac40538efeecc7ae93b551aa2d861851a798b17f","SHA256":"681234bfceb8f11e214c9d4fbec06523b80744dad37cbef0be64b84fc7dd4da1"},"SHA1":"b89a8eef5aeae806af5ba212a8068845cafdab6f","SHA256":"f05b1ee9e2f6ab704b8919d5071becbce6f9d0f9d0ba32a460c41d5272134abe","Sections":{".text":{"Entropy":6.202281459012431,"Virtual Size":"0x11b6"},".rdata":{"Entropy":4.307397917054479,"Virtual Size":"0xe34"},".data":{"Entropy":2.112180138315051,"Virtual Size":"0x280"},".pdata":{"Entropy":4.122037812300564,"Virtual Size":"0x2dc"},"PAGE":{"Entropy":6.215624893450104,"Virtual Size":"0x1c8c"},"INIT":{"Entropy":5.135213694052921,"Virtual Size":"0x56e"},".rsrc":{"Entropy":3.5035036535702537,"Virtual Size":"0x498"},".reloc":{"Entropy":3.8431390622295667,"Virtual Size":"0x40"}},"Signature":["Lenovo","DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1","DigiCert Trusted Root G4"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1","ValidFrom":"2021-04-29 00:00:00","ValidTo":"2036-04-28 23:59:59","Signature":"3a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e","SignatureAlgorithmOID":"1.2.840.113549.1.1.12","IsCertificateAuthority":true,"SerialNumber":"08ad40b260d29c4c9f5ecda9bd93aed9","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"5d8003a64dfa5a4d88365da1566038cb","SHA1":"79465b56bc7ad55a37bdf633943da8bfc84db228","SHA256":"84bdc82e2f2a7f7aaa782667dac556ffcb2b33240c1f9c0a00a3264526a98332","SHA384":"65b1d4076a89ae273f57e6eeedecb3eae129b4168f76fa7671914cdf461d542255c59d9b85b916ae0ca6fc0fcf7a8e64"}},{"Subject":"C=US, ST=North Carolina, L=Morrisville, O=Lenovo, OU=G14, CN=Lenovo","ValidFrom":"2021-11-22 00:00:00","ValidTo":"2022-03-30 23:59:59","Signature":"640fc986f34aa41e35444a37b92461d4eed33b163b6e4f883d188628bbb07ee70df9a8839fdc34ff36d4622cef4a664c73711efaf6b03c7e5c83138199cdc1a7defb5a39cfe365578d2f7af63f2ceb9e745be37e3c2b8612419f7dd1b37232c42e8d63ed1cdab404a0033145c0590be269777ec6c3234a3ba42a3b225a168485eedd9dc9df15978a9aa884f5ff3fb2514cce184fec8c026426ffd20510a00ef203f521b75b994ab7fb14aec2610d7f873d20cd76e608157421a4ca786e0f2e202dda5ecc96680d2d7a4e43031538752be859691b1935de593356fa32fd1f631fed6c5aa475d92c60ff1047ace01d023642c96813e70f5f496942560e9f09b1a79ab47808dacfe1fd36cc957ef31536287b77f7d602b0dbf015e5f8a30299470569757f72bea7a1ee115f7d34cc29bc5d0f8d0080633370dcf5bce318d117831c8501e56f4aac5feace080c836f864b0c8e5a11178bd3b3c244915eeced7db59c6eb299163f566099e33ff606f45ed608dedbb055e19474b82b31269a61221b875eb36e16738c75190f5a14d0c3bfc7d3fff27d4313e9d3852db215295205f1fb3bb8b9d51f70b5222dddd7398deb6a947065d1b2ecd4eb91d84957b71728d2bbec08c0aec19a8fbb0aea3f7be228dfd87a1ead0d674205d1f9bce65b380395059b4d56c46b470a71562eb5aa2e163e7985e134d54b60e865df4d2229ab35efe7","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"01d4b02045832881e2d7530641135991","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"3452c838cdc0fad2580244b9efd5d8de","SHA1":"f4d9f9525fa79caa80e5ef5b88ea4b07d6e272ad","SHA256":"4d66a4b0e68dc05b77e33ff1c284de96b040b4a6b3fe69326bc6cc2477e70866","SHA384":"fd4fbb32ae0c9b9d6796dd2028d09121a186975991e6008ab1dc57ebbef199ba873f6bc26bd710852ef16d4249856392"}}],"Signer":[{"SerialNumber":"01d4b02045832881e2d7530641135991","Issuer":"C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1","Version":1}]}]},{"Filename":"LenovoDiagnosticsDriver.sys","MD5":"121ee36aea275809e6dca642fa069091","SHA1":"a15049e59691214018ca1a6c063e080ab789422e","SHA256":"279cf7f22d08724fa346b8138a35cda22ff4bb7a6d19d2d44e8905b0e9634dfd","LoadsDespiteHVCI":"FALSE","Imphash":"225e24ee3c4081a16ef32831b70bf8ef","Authentihash":{"MD5":"ee7f812973c3f68005863528be8929cf","SHA1":"16270f2017ed1a0d601084ca4b20d3ea2403d1a4","SHA256":"54e111f07f7bdc0b1ae23acac65381f4d1feb16527ce29091ffc394c7325b824"},"RichPEHeaderHash":{"MD5":"5a4fdaa578bb3b1de71703dd1514a69a","SHA1":"a80de7c0643968fa587dfc186a5164a7fb4343aa","SHA256":"025742de774c4c30c209240fabd850c3b98db5f0c180449e8b56d92fbe5ac621"},"Sections":{".text":{"Entropy":6.216394038362479,"Virtual Size":"0xe42"},".rdata":{"Entropy":4.166857800884967,"Virtual Size":"0xcec"},".data":{"Entropy":2.153299992379607,"Virtual Size":"0x270"},".pdata":{"Entropy":4.006390128333739,"Virtual Size":"0x270"},"PAGE":{"Entropy":6.209551355886413,"Virtual Size":"0x1c8c"},"INIT":{"Entropy":5.02972916403978,"Virtual Size":"0x56e"},".rsrc":{"Entropy":3.517923593975154,"Virtual Size":"0x4a0"},".reloc":{"Entropy":3.5153837769337524,"Virtual Size":"0x34"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2021-08-03 05:55:50","Description":"Lenovo Diagnostics Driver for Windows 10 and later.","Company":"Lenovo Group Limited (R)","InternalName":"LenovoDiagnosticsDriver.sys","OriginalFilename":"LenovoDiagnosticsDriver.sys","FileVersion":"1,00,02,0","Product":"Lenovo Diagnostics","ProductVersion":"1,00,02,0","Copyright":"© 2021 Lenovo Group Limited. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["MmMapIoSpace","MmUnmapIoSpace","IofCompleteRequest","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","__C_specific_handler","MmGetSystemRoutineAddress","RtlInitUnicodeString","ExFreePoolWithTag","ZwClose","ZwSetSecurityObject","IoDeviceObjectType","IoCreateDevice","ObOpenObjectByPointer","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","ExAllocatePoolWithTag","RtlGetSaclSecurityDescriptor","SeCaptureSecurityDescriptor","_snwprintf","RtlLengthSecurityDescriptor","SeExports","RtlCreateSecurityDescriptor","_wcsnicmp","wcschr","RtlAbsoluteToSelfRelativeSD","RtlAddAccessAllowedAce","RtlLengthSid","IoIsWdmVersionAvailable","RtlSetDaclSecurityDescriptor","ZwOpenKey","ZwSetValueKey","ZwQueryValueKey","ZwCreateKey","RtlFreeUnicodeString","RtlGetOwnerSecurityDescriptor","DbgPrintEx","HalGetBusDataByOffset","HalSetBusDataByOffset"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=North Carolina, L=Morrisville, O=Lenovo, OU=G14, CN=Lenovo","ValidFrom":"2021-03-22 00:00:00","ValidTo":"2022-03-30 23:59:59","Signature":"7acfc05e3cc62cd64e7ca090933c35cc013b1bf0dbe0e06ad642d4af2acedc60ef7079c0e6aaebed888d24f5c71a8ba526ad92f6189dc86a16d1a3800a5c522ef432753e68ba373f9caa10ff2135edfdd1599d87aa61d8afb3acbb3ac7bf8ef3416026e3a6ad3d699b555df8574fff34afa0938a962aa19c697bb03c4c6d2e7da2c7ce05e64aba4dbccdb1e96f84ebc8f87eee1628636fb7c85e73646d09b84092c189a2f08b1cd7f359947c294fc25129679e8e0a13bbbb31c69e31145c149cde2c7f886109588df73258ccbb3724f65899050c059ebead84441eaf97a91920335d26571d0baffa61b6a0c4365451a32437970ba3875f225b775ba3f1549557","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"0d7b70a9ac21e07d79e6c5f9120310a2","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"c3ae773af8ea223d66b4f2eea11ef2a2","SHA1":"ef5c3a238c4260a7cc0c058494a18f58a6eb42ce","SHA256":"78c50cba800b5a79e7e0500c9b684be523d0cd97011bc734d5ee5b3c1f16e3ae","SHA384":"c181f6387ee4c315ed87f050007ddeb20fb8feeef326622ce4914a054754448c8e6f91e95fb778b4f9b8e8eb7cfe6e71"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA","ValidFrom":"2013-10-22 12:00:00","ValidTo":"2028-10-22 12:00:00","Signature":"3eec0d5a24b3f322d115c82c7c252976a81d5d1c2d3a1ac4ef3061d77e0b60fdc33d0fc4af8bfdef2adf205537b0e1f6d192750f51b46ea58e5ae25e24814e10a4ee3f718e630e134badd75f4479f33614068af79c464e5cff90b11b070e9115fbbaafb551c28d24ae24c6c7272aa129281a3a7128023c2e91a3c02511e29c1447a17a6868af9ba75c205cd971b10c8fbba8f8c512689fcf40cb4044a513f0e6640c25084232b2368a2402fe2f727e1cd7494596e8591de9fa74646bb2eb6643dab3b08cd5e90dddf60120ce9931633d081a18b3819b4fc6931006fc0781fa8bdaf98249f7626ea153fa129418852e9291ea686c4432b266a1e718a49a6451ef","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"0409181b5fd5bb66755343b56f955008","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"9359496ca4f021408b9d8923cab8b179","SHA1":"2aed40d7759997830870769be250199fd609e40e","SHA256":"e767799478f64a34b3f53ff3bb9057fe1768f4ab178041b0dcc0ff1e210cba65","SHA384":"5cb7e7b4f1dbccd48d10db7e71b6f8c05fcb4bcb0085a6fefcfa0c2148f9a594e59f56ac4304004f3b398e259035c40c"}}],"Signer":[{"SerialNumber":"0d7b70a9ac21e07d79e6c5f9120310a2","Issuer":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA","Version":1}]}]},{"Filename":"LenovoDiagnosticsDriver.sys","MD5":"e0ae49af6741ca8b83b2246cf858f779","SHA1":"69b2f9735ccaf06c5ba3cd5205e5ffff31e08bc1","SHA256":"b4dddea3fed5881aadcc8cce86eb2a50b613b6041bc63477fee4a8e6b0db65f1","LoadsDespiteHVCI":"FALSE","Imphash":"225e24ee3c4081a16ef32831b70bf8ef","Authentihash":{"MD5":"56b6144e389ce3b1e2a0a96a954aa7d8","SHA1":"6d9543725aca0c9c8f403425952692ccc1d2d7f2","SHA256":"34e6a56c60746c51034b45a7b2a36617205b598d0bbcc695f92404605a0975d5"},"RichPEHeaderHash":{"MD5":"f9a028999bfd69ee65e86573d56d2de3","SHA1":"ac40538efeecc7ae93b551aa2d861851a798b17f","SHA256":"681234bfceb8f11e214c9d4fbec06523b80744dad37cbef0be64b84fc7dd4da1"},"Sections":{".text":{"Entropy":6.202281459012431,"Virtual Size":"0x11b6"},".rdata":{"Entropy":4.307397917054479,"Virtual Size":"0xe34"},".data":{"Entropy":2.1121801383150514,"Virtual Size":"0x280"},".pdata":{"Entropy":4.122037812300564,"Virtual Size":"0x2dc"},"PAGE":{"Entropy":6.215624893450104,"Virtual Size":"0x1c8c"},"INIT":{"Entropy":5.135213694052921,"Virtual Size":"0x56e"},".rsrc":{"Entropy":3.5035036535702537,"Virtual Size":"0x498"},".reloc":{"Entropy":3.8431390622295667,"Virtual Size":"0x40"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2022-01-28 10:59:24","Description":"Lenovo Diagnostics Driver for Windows 10 and later.","Company":"Lenovo Group Limited (R)","InternalName":"LenovoDiagnosticsDriver.sys","OriginalFilename":"LenovoDiagnosticsDriver.sys","FileVersion":"1.0.4.0","Product":"Lenovo Diagnostics","ProductVersion":"1.0.4.0","Copyright":"© 2021 Lenovo Group Limited. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["MmMapIoSpace","MmUnmapIoSpace","IofCompleteRequest","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","__C_specific_handler","MmGetSystemRoutineAddress","RtlInitUnicodeString","ExFreePoolWithTag","ZwClose","ZwSetSecurityObject","IoDeviceObjectType","IoCreateDevice","ObOpenObjectByPointer","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","ExAllocatePoolWithTag","RtlGetSaclSecurityDescriptor","SeCaptureSecurityDescriptor","_snwprintf","RtlLengthSecurityDescriptor","SeExports","RtlCreateSecurityDescriptor","_wcsnicmp","wcschr","RtlAbsoluteToSelfRelativeSD","RtlAddAccessAllowedAce","RtlLengthSid","IoIsWdmVersionAvailable","RtlSetDaclSecurityDescriptor","ZwOpenKey","ZwSetValueKey","ZwQueryValueKey","ZwCreateKey","RtlFreeUnicodeString","RtlGetOwnerSecurityDescriptor","DbgPrintEx","HalGetBusDataByOffset","HalSetBusDataByOffset"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1","ValidFrom":"2021-04-29 00:00:00","ValidTo":"2036-04-28 23:59:59","Signature":"3a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e","SignatureAlgorithmOID":"1.2.840.113549.1.1.12","IsCertificateAuthority":true,"SerialNumber":"08ad40b260d29c4c9f5ecda9bd93aed9","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"5d8003a64dfa5a4d88365da1566038cb","SHA1":"79465b56bc7ad55a37bdf633943da8bfc84db228","SHA256":"84bdc82e2f2a7f7aaa782667dac556ffcb2b33240c1f9c0a00a3264526a98332","SHA384":"65b1d4076a89ae273f57e6eeedecb3eae129b4168f76fa7671914cdf461d542255c59d9b85b916ae0ca6fc0fcf7a8e64"}},{"Subject":"C=US, ST=North Carolina, L=Morrisville, O=Lenovo, OU=G14, CN=Lenovo","ValidFrom":"2021-11-22 00:00:00","ValidTo":"2022-03-30 23:59:59","Signature":"640fc986f34aa41e35444a37b92461d4eed33b163b6e4f883d188628bbb07ee70df9a8839fdc34ff36d4622cef4a664c73711efaf6b03c7e5c83138199cdc1a7defb5a39cfe365578d2f7af63f2ceb9e745be37e3c2b8612419f7dd1b37232c42e8d63ed1cdab404a0033145c0590be269777ec6c3234a3ba42a3b225a168485eedd9dc9df15978a9aa884f5ff3fb2514cce184fec8c026426ffd20510a00ef203f521b75b994ab7fb14aec2610d7f873d20cd76e608157421a4ca786e0f2e202dda5ecc96680d2d7a4e43031538752be859691b1935de593356fa32fd1f631fed6c5aa475d92c60ff1047ace01d023642c96813e70f5f496942560e9f09b1a79ab47808dacfe1fd36cc957ef31536287b77f7d602b0dbf015e5f8a30299470569757f72bea7a1ee115f7d34cc29bc5d0f8d0080633370dcf5bce318d117831c8501e56f4aac5feace080c836f864b0c8e5a11178bd3b3c244915eeced7db59c6eb299163f566099e33ff606f45ed608dedbb055e19474b82b31269a61221b875eb36e16738c75190f5a14d0c3bfc7d3fff27d4313e9d3852db215295205f1fb3bb8b9d51f70b5222dddd7398deb6a947065d1b2ecd4eb91d84957b71728d2bbec08c0aec19a8fbb0aea3f7be228dfd87a1ead0d674205d1f9bce65b380395059b4d56c46b470a71562eb5aa2e163e7985e134d54b60e865df4d2229ab35efe7","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"01d4b02045832881e2d7530641135991","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"3452c838cdc0fad2580244b9efd5d8de","SHA1":"f4d9f9525fa79caa80e5ef5b88ea4b07d6e272ad","SHA256":"4d66a4b0e68dc05b77e33ff1c284de96b040b4a6b3fe69326bc6cc2477e70866","SHA384":"fd4fbb32ae0c9b9d6796dd2028d09121a186975991e6008ab1dc57ebbef199ba873f6bc26bd710852ef16d4249856392"}}],"Signer":[{"SerialNumber":"01d4b02045832881e2d7530641135991","Issuer":"C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1","Version":1}]}]},{"Filename":"LenovoDiagnosticsDriver.sys","SHA256":"93cb6b6879fc9fd71b9539265ec3d5d1969cc00cfe2758979a03d7c19cdc0e20","MD5":"a241964e5a88ce4135988ac18e684f3c","SHA1":"8632b636ab472c5b64c06d9a4dd430ff55ddbf77","Imphash":"225e24ee3c4081a16ef32831b70bf8ef","Authentihash":{"MD5":"07df389fae77608be3385555e643df1e","SHA1":"32ce4c31385edeeef7145678d3895101e3130e04","SHA256":"970a4c44b046eff139c9c2ea11ef7ccadcbc93612b41afc0a947cceda0ca5a39"},"RichPEHeaderHash":{"MD5":"6f3ced19f6ac705d85ea03ef3b990dcb","SHA1":"98d16c30e5de189d4acc71d9de35996f658f7f16","SHA256":"b9ee7f2a249720eb45a04fb5cbe9b9ca33342de2c432b89f2023c772c05e68c2"},"Sections":{".text":{"Entropy":6.217833312213398,"Virtual Size":"0x1002"},".rdata":{"Entropy":4.24585739397924,"Virtual Size":"0xd6c"},".data":{"Entropy":2.1121801383150514,"Virtual Size":"0x280"},".pdata":{"Entropy":4.029492987664599,"Virtual Size":"0x2a0"},"PAGE":{"Entropy":6.216842025909382,"Virtual Size":"0x1c8c"},"INIT":{"Entropy":5.137195627507715,"Virtual Size":"0x56e"},".rsrc":{"Entropy":3.518051469656566,"Virtual Size":"0x498"},".reloc":{"Entropy":3.8431390622295667,"Virtual Size":"0x40"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2021-08-09 08:13:23","Description":"Lenovo Diagnostics Driver for Windows 10 and later.","Company":"Lenovo Group Limited (R)","InternalName":"LenovoDiagnosticsDriver.sys","OriginalFilename":"LenovoDiagnosticsDriver.sys","FileVersion":"1,0,3,0","Product":"Lenovo Diagnostics","ProductVersion":"1,0,3,0","Copyright":"© 2021 Lenovo Group Limited. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["MmMapIoSpace","MmUnmapIoSpace","IofCompleteRequest","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","__C_specific_handler","MmGetSystemRoutineAddress","RtlInitUnicodeString","ExFreePoolWithTag","ZwClose","ZwSetSecurityObject","IoDeviceObjectType","IoCreateDevice","ObOpenObjectByPointer","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","ExAllocatePoolWithTag","RtlGetSaclSecurityDescriptor","SeCaptureSecurityDescriptor","_snwprintf","RtlLengthSecurityDescriptor","SeExports","RtlCreateSecurityDescriptor","_wcsnicmp","wcschr","RtlAbsoluteToSelfRelativeSD","RtlAddAccessAllowedAce","RtlLengthSid","IoIsWdmVersionAvailable","RtlSetDaclSecurityDescriptor","ZwOpenKey","ZwSetValueKey","ZwQueryValueKey","ZwCreateKey","RtlFreeUnicodeString","RtlGetOwnerSecurityDescriptor","DbgPrintEx","HalGetBusDataByOffset","HalSetBusDataByOffset"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=North Carolina, L=Morrisville, O=Lenovo, OU=G14, CN=Lenovo","ValidFrom":"2021-03-22 00:00:00","ValidTo":"2022-03-30 23:59:59","Signature":"7acfc05e3cc62cd64e7ca090933c35cc013b1bf0dbe0e06ad642d4af2acedc60ef7079c0e6aaebed888d24f5c71a8ba526ad92f6189dc86a16d1a3800a5c522ef432753e68ba373f9caa10ff2135edfdd1599d87aa61d8afb3acbb3ac7bf8ef3416026e3a6ad3d699b555df8574fff34afa0938a962aa19c697bb03c4c6d2e7da2c7ce05e64aba4dbccdb1e96f84ebc8f87eee1628636fb7c85e73646d09b84092c189a2f08b1cd7f359947c294fc25129679e8e0a13bbbb31c69e31145c149cde2c7f886109588df73258ccbb3724f65899050c059ebead84441eaf97a91920335d26571d0baffa61b6a0c4365451a32437970ba3875f225b775ba3f1549557","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"0d7b70a9ac21e07d79e6c5f9120310a2","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"c3ae773af8ea223d66b4f2eea11ef2a2","SHA1":"ef5c3a238c4260a7cc0c058494a18f58a6eb42ce","SHA256":"78c50cba800b5a79e7e0500c9b684be523d0cd97011bc734d5ee5b3c1f16e3ae","SHA384":"c181f6387ee4c315ed87f050007ddeb20fb8feeef326622ce4914a054754448c8e6f91e95fb778b4f9b8e8eb7cfe6e71"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA","ValidFrom":"2013-10-22 12:00:00","ValidTo":"2028-10-22 12:00:00","Signature":"3eec0d5a24b3f322d115c82c7c252976a81d5d1c2d3a1ac4ef3061d77e0b60fdc33d0fc4af8bfdef2adf205537b0e1f6d192750f51b46ea58e5ae25e24814e10a4ee3f718e630e134badd75f4479f33614068af79c464e5cff90b11b070e9115fbbaafb551c28d24ae24c6c7272aa129281a3a7128023c2e91a3c02511e29c1447a17a6868af9ba75c205cd971b10c8fbba8f8c512689fcf40cb4044a513f0e6640c25084232b2368a2402fe2f727e1cd7494596e8591de9fa74646bb2eb6643dab3b08cd5e90dddf60120ce9931633d081a18b3819b4fc6931006fc0781fa8bdaf98249f7626ea153fa129418852e9291ea686c4432b266a1e718a49a6451ef","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"0409181b5fd5bb66755343b56f955008","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"9359496ca4f021408b9d8923cab8b179","SHA1":"2aed40d7759997830870769be250199fd609e40e","SHA256":"e767799478f64a34b3f53ff3bb9057fe1768f4ab178041b0dcc0ff1e210cba65","SHA384":"5cb7e7b4f1dbccd48d10db7e71b6f8c05fcb4bcb0085a6fefcfa0c2148f9a594e59f56ac4304004f3b398e259035c40c"}}],"Signer":[{"SerialNumber":"0d7b70a9ac21e07d79e6c5f9120310a2","Issuer":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA","Version":1}]}]}]}