LnvMSRIO.sys
Lenovo filter driver file version info
Driver on Windows LOLDrivers vulnerable driver
A known vulnerable driver
T1068Exploitation for Privilege Escalation
10 known samples
3.1.0.36 · its entry
7023f08c9f99076a5fb82a0f661847e2951800f095fca1793a0e6bd9c949b4783.1.0.35 · its entry
245b6ab442a7d53dc30ece28e1c6de727c019669385877cbe929b81aa1a2ad2f3.1.0.29 · its entry
977d3b78bdf5723430e2e21cf1eb515a2335a0e370c76fa2dda4315ba062f4293.0.2.70 · its entry
9eee4b43ee454fae44e661265de3025561a59060e8969aaeecce79784794ca4d3.0.2.60 · its entry
072ca56c765c937358d3e79c9ecd803c40283a0c32fc4c78e08ea1709d7a832f3.0.2.46 · its entry
348e7fc97dd20b3db056e3971020da107aa6e82d99be9f04c2d2170f8f39cd583.0.2.46 · its entry
ec18a0839ff1354dce451926d573e72ce4b2a78782cfceb5b0084e90e77f32203.0.2.45 · its entry
e76638b04f49ce7b01ed2b6ef66b2ac0e6a02643f8513344b71dfcb4aea13c793.0.2.34 · its entry
b529b658315577e49b9432ec046263a7feca2d3440aea295937350bc974098c43.0.2.28 · its entry
358b54bdda20c7459d29857fb815548c00751ef486eed90e3f2e835b0bb42cc4From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real LnvMSRIO.sys?
ProductLenovo filter driver, Lenovo
DescriptionLenovo filter driver
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.