{"Id":"e769d1f6-8a38-426f-b5e7-447241204ee1","Tags":["GEDevDrv.SYS"],"Verified":"TRUE","Author":"Takahiro Haruyama","Created":"2023-11-02","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create GEDevDrvSYS binPath= C:\\windows\\temp\\GEDevDrvSYS.sys type=kernel && sc.exe start GEDevDrvSYS","Description":"The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.","OperatingSystem":"Windows 10","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html"],"Detection":[{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"}],"Acknowledgement":{"Handle":"","Person":""},"KnownVulnerableSamples":[{"Company":"GE Intelligent Platforms, Inc.","Date":"","Description":"GE Device Driver","FileVersion":"7.00 (Build 5517)","Filename":"","MD5":"4514a0e8bcab7de4cff55999cdf00cd1","MachineType":"AMD64","OriginalFilename":"GEDevDrv.SYS","Product":"Proficy Machine Edition","ProductVersion":"7.00 (Build 5517)","Publisher":"","SHA1":"faa61346430aedc952d820f7b16b973c9bf133c3","SHA256":"51145a3fa8258aac106f65f34159d23c54b48b6d54ec0421748b3939ab6778eb","Signature":"","Imphash":"c7912c850407aa93c979d95c4f593507","Authentihash":{"MD5":"48b814c2df4c1a15512c8a32b45766ba","SHA1":"ed3f9e742b37a81db447d9d398f3ea26235e05aa","SHA256":"33494ed37d4be23b7de493d5f2c9c31a83a7a834c79a5fd7c2a93c1054f583b1"},"RichPEHeaderHash":{"MD5":"bdd669eb03f684fce92f472d6e23e8f0","SHA1":"81cf571f5981407318f4f16ebe87f4f17fd922b5","SHA256":"7b5b0004422eabd33f23138b420c99feeb3d299134fa91182d665bc4f73c4b17"},"Sections":{".text":{"Entropy":6.250523559581872,"Virtual Size":"0x18e1"},".rdata":{"Entropy":5.103147599531327,"Virtual Size":"0x304"},".data":{"Entropy":0.8631301754097059,"Virtual Size":"0x107c"},".pdata":{"Entropy":3.931084340144605,"Virtual Size":"0x168"},"PAGE":{"Entropy":6.327772052605595,"Virtual Size":"0x1c8b"},"INIT":{"Entropy":5.608071767074674,"Virtual Size":"0x3ee"},".rsrc":{"Entropy":3.3800381473818986,"Virtual Size":"0x3e0"},".reloc":{"Entropy":1.2066155458808279,"Virtual Size":"0x54"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2011-06-01 00:58:31","InternalName":"GE Device Driver","Copyright":"© 2011, GE Intelligent Platforms, Inc.","Imports":["ntoskrnl.exe","WDFLDR.SYS"],"ExportedFunctions":"","ImportedFunctions":["MmBuildMdlForNonPagedPool","MmMapLockedPagesSpecifyCache","IoAllocateMdl","RtlCopyUnicodeString","MmMapIoSpace","MmUnmapIoSpace","IoFreeMdl","KeBugCheckEx","MmUnmapLockedPages","__C_specific_handler","WdfVersionBindClass","WdfVersionBind","WdfVersionUnbind","WdfVersionUnbindClass"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2","ValidFrom":"2007-06-15 00:00:00","ValidTo":"2012-06-14 23:59:59","Signature":"50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"3825d7faf861af9ef490e726b5d65ad5","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"d6c7684e9aaa508cf268335f83afe040","SHA1":"18066d20ad92409c567cdfde745279ff71c75226","SHA256":"a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff","SHA384":"35c249d6ad0261a6229b2a727067ac6ba32a5d24b30b9249051f748c7735fbe2ec2ef26a702c50df1790fbe32a65aee7"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA","ValidFrom":"2003-12-04 00:00:00","ValidTo":"2013-12-03 23:59:59","Signature":"4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"47bf1995df8d524643f7db6d480d31a4","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"518d2ea8a21e879c942d504824ac211c","SHA1":"21ce87d827077e61abddf2beba69fde5432ea031","SHA256":"1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7","SHA384":"53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f"}},{"Subject":"C=CA, ST=Alberta, L=Edmonton, O=GE , OU=Digital ID Class 3 , Microsoft Software Validation v2, OU=Intelligent Platforms, CN=GE ","ValidFrom":"2010-04-08 00:00:00","ValidTo":"2013-04-07 23:59:59","Signature":"606daddb4410cea2602a13f4cf09dd9f7e3a02d740e874e42ef5f07a35d558e14b846c2df6ae7246bd61f883bd9bd9ec5664460e36de7eac97df14700074798e840a8080a70511eb08988459cba7398cdcaf6aff86e226d53eb0c32d1c2178200b44d474847033a7cd3fcb8b5ccc9126d75d35701687c83f16c6d83e1ad99c5394216cde89b2d706a83b353da7d0d1a9939fd37f2d25f85edafeffa7552d67ba4115e2977106d1986470e3eacea1396493a8f346683f2743c83a15033c57f22e6b80eb6ee51951e847f045227089e72bee8c8abc469f64f8f8aef283b4059a3a58eb5695d916c9b73a6587bb4c3ed71882f40a4ee2b9c5b7e0482e075bd8f755","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"696d42a62da190c8cebe0345810f5372","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"cbfc054efc981779e2e5d9f25ff0f537","SHA1":"b8b92324d6493e199f87f074f7b91c9ddab2658a","SHA256":"5996b03c1b8d5ae1fad121a487989abf91ac4ad550540591009183df9cffce29","SHA384":"0171dd207a27c93502245917d4bdda2afcf14ceebc3cf3bff95f1d90a5befe675372a5732f5efe975bec23df6593b97e"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)09, CN=VeriSign Class 3 Code Signing 2009,2 CA","ValidFrom":"2009-05-21 00:00:00","ValidTo":"2019-05-20 23:59:59","Signature":"8b03c0dd94d841a26169b015a878c730c6903c7e42f724b6e4837317047f04109ca1e2fa812febc0ca44e772e050b6551020836e9692e49a516ab43731dca52deb8c00c71d4fe74d32ba85f84ebefa675565f06abe7aca64381a101078457631f3867a030f60c2b35d9df68b6676821b59e183e5bd49a53856e5de41770e580f","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"655226e1b22e18e1590f2985ac22e75c","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"650704c342850095f3288eaf791147d4","SHA1":"4cdc38c800761463749c3cbd94a12f32e49877bf","SHA256":"07b8f662558ec85b71b43a79c6e94698144f4ced2308af21e7ba1e5d461da214","SHA384":"2a271d052213438467d09d60eaa4010c8642fff3eb0070e0cf9969428713c8fdc066b90996d594dd3136f5bd0af5a22a"}},{"Subject":"C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority","ValidFrom":"2006-05-23 17:01:29","ValidTo":"2016-05-23 17:11:29","Signature":"01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"610c120600000000001b","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"53c41bc1164e09e0cd1617a5bf913efd","SHA1":"93c03aac8951d494ecd5696b1c08658541b18727","SHA256":"40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b","SHA384":"f51d4e75ba638f7314cd59b8d6d45f3b34d35ce6986e9d205cd6f333e8e8d8e9c91f636e6bc84731b6661673f40963d8"}}],"Signer":[{"SerialNumber":"696d42a62da190c8cebe0345810f5372","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)09, CN=VeriSign Class 3 Code Signing 2009,2 CA","Version":1}]}],"LoadsDespiteHVCI":"FALSE"},{"Company":"General Electric Company","Date":"","Description":"GE Device Driver","FileVersion":"9.50 (Build 7677)","Filename":"","MD5":"1793e1d4247b29313325d1462dec81e2","MachineType":"AMD64","OriginalFilename":"GEDevDrv.SYS","Product":"Proficy Machine Edition","ProductVersion":"9.50 (Build 7677)","Publisher":"","SHA1":"cc3186debacb98e0b0fb40ad82816bea10741099","SHA256":"a369942ce8d4b70ebf664981e12c736ec980dbe5a74585dd826553c4723b1bce","Signature":"","Imphash":"c7912c850407aa93c979d95c4f593507","Authentihash":{"MD5":"35c40570f78b1562c064347f3719bb17","SHA1":"9f5eaab353bf93697eec55b9fac8479968f17e7c","SHA256":"8a228c751d1664b362f10dc7083c223995b976b264da8b7380c51157bed66fbe"},"RichPEHeaderHash":{"MD5":"bdd669eb03f684fce92f472d6e23e8f0","SHA1":"81cf571f5981407318f4f16ebe87f4f17fd922b5","SHA256":"7b5b0004422eabd33f23138b420c99feeb3d299134fa91182d665bc4f73c4b17"},"Sections":{".text":{"Entropy":6.250523559581872,"Virtual Size":"0x18e1"},".rdata":{"Entropy":5.115390589732117,"Virtual Size":"0x304"},".data":{"Entropy":0.8631301754097059,"Virtual Size":"0x107c"},".pdata":{"Entropy":3.935278159601069,"Virtual Size":"0x168"},"PAGE":{"Entropy":6.328704784326926,"Virtual Size":"0x1c8b"},"INIT":{"Entropy":5.609901355100797,"Virtual Size":"0x3ee"},".rsrc":{"Entropy":3.35612534297055,"Virtual Size":"0x3c8"},".reloc":{"Entropy":1.2066155458808279,"Virtual Size":"0x54"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2017-01-24 22:35:14","InternalName":"GE Device Driver","Copyright":"© 2017 General Electric Company","Imports":["ntoskrnl.exe","WDFLDR.SYS"],"ExportedFunctions":"","ImportedFunctions":["MmBuildMdlForNonPagedPool","MmMapLockedPagesSpecifyCache","IoAllocateMdl","RtlCopyUnicodeString","MmMapIoSpace","MmUnmapIoSpace","IoFreeMdl","KeBugCheckEx","MmUnmapLockedPages","__C_specific_handler","WdfVersionBindClass","WdfVersionBind","WdfVersionUnbind","WdfVersionUnbindClass"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=CA, ST=Alberta, L=Edmonton, O=GE Intelligent Platforms Canada Company, CN=GE Intelligent Platforms Canada Company","ValidFrom":"2016-01-29 00:00:00","ValidTo":"2019-01-28 23:59:59","Signature":"4258e9d490c578f2a130124aded7508017af5b46afbfd7484add272fe8acd172d567a78bc3251a0a9ab2b38e309eeb5992106e1de682f383da0e723ff0211edde91c4e2dce334770339ab98fa98e03b985cca1451032aa28ddd244a586cf1b9ad172794cb9169d07a3f339f90ff5f78e3e1e5e6db1c0c2e9aa1b5dec5a9ad5b435e56b55a379c65c2de8c18615eb77d39fd8b39c72ae98d4d87fef13ec8888f4616d613279e61f968af87de8fa954cea66f196ebeaf45fbf77902dcf230e7b34b7dd3defdee49f68ed6c20f5752b2e92e1995fd141d18c3faa1463eed3d62f1becbeae111bdb66b610c64bff7a3dbdfd6a9c349359fd1cce7ff611be6bc51bc3","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"21d1e9203b5d6fc7379869075104849a","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"769eb6a61bfee7586c6fc6d3f8e6980a","SHA1":"a96b34cfe8a09e8dd8c33eafe4b2043abadcd595","SHA256":"f368351de9da350b7cee666ef8e555b979a530f129787ac09cad25f9138954fe","SHA384":"b2ff97a57c966b6488f59a6554e2cc29ca2d74015b44015bdeeb0b66eb3893fd424a79b6fe9066b62843a44c77d05f3c"}},{"Subject":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA","ValidFrom":"2013-12-10 00:00:00","ValidTo":"2023-12-09 23:59:59","Signature":"13851a1e69a937f7a0bda4af7e1d6153fe9d8c5e0ca6751e781723ddfdec1a035539fb7195c7655aa78e30d2445a61db706fda2105c22e73ba49f1d193fe5dc9cd5e03e0899e3f741ed7f7388ba9d6cfbb352f3358a89256d1c84d3b82e6798416fc28b0b147f31da23eee87d9a67fa456a53fad842e29de7cbca8aaa33d0401eaba93a20e502229174c87e43a115fd6a425899b056b2fb4c9014c277b0bac190522a060153fdac9fb4d4c8ffb726777fd2794c7ba350e8849fe8dfd28af4a12bd0db39705de440c15fa362b03dcc15001f1a1115d14e5e2bd274b54be2b845e0fa6c374050aef97c38922b11f77f3bdcd43d4f14ca93fb58b84af64f2d01421","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"3d78d7f9764960b2617df4f01eca862a","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"1f056ff7d5f874984dc605402b7cb042","SHA1":"bdb348353a2203deb4b767914fa1bd7248dd728b","SHA256":"a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1","SHA384":"fa2729064b49e0d77540c1ee95d5f74acaf8eaf55197851a3a40383335f8113e51190bc48b552196edf8ac5cf0c89278"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}}],"Signer":[{"SerialNumber":"21d1e9203b5d6fc7379869075104849a","Issuer":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA","Version":1}]}],"LoadsDespiteHVCI":"FALSE"},{"Company":"General Electric Company","Date":"","Description":"GE Device Driver","FileVersion":"9.50 (Build 7677)","Filename":"","MD5":"62f8d7f884366df6100c7e892e3d70bf","MachineType":"I386","OriginalFilename":"GEDevDrv.SYS","Product":"Proficy Machine Edition","ProductVersion":"9.50 (Build 7677)","Publisher":"","SHA1":"8589a284f1a087ad5b548fb1a933289781b4cedc","SHA256":"ae73dd357e5950face9c956570088f334d18464cd49f00c56420e3d6ff47e8dc","Signature":"","Imphash":"5f9cf5b0511f3c1129b467d273b921f2","Authentihash":{"MD5":"c2066a8850532d5609348012e72715fa","SHA1":"a236f58a6e3c596360078b96966416a1c66c87d7","SHA256":"d9cbdfc10ba743d5229f7dbb6507b9864012fb58cb253da92962dc611603a73c"},"RichPEHeaderHash":{"MD5":"4f2ad68669103ddc09fe3694d20ed3fe","SHA1":"6a833e9ded09ce2fff014e3f8bc3fb2a6201af92","SHA256":"9a78349e539cf98c0d740a350fd6e63f39721ee8381606e5277089c7810dc257"},"Sections":{".text":{"Entropy":6.4067174061066074,"Virtual Size":"0x16ec"},".rdata":{"Entropy":4.483289851967865,"Virtual Size":"0x1d4"},".data":{"Entropy":0.8104503128192735,"Virtual Size":"0x8e4"},"PAGE":{"Entropy":6.452929394722625,"Virtual Size":"0x1a50"},"INIT":{"Entropy":5.82065238740312,"Virtual Size":"0x3d8"},".rsrc":{"Entropy":3.3523963755382806,"Virtual Size":"0x3c8"},".reloc":{"Entropy":5.970417165409168,"Virtual Size":"0x44c"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2017-01-24 22:35:25","InternalName":"GE Device Driver","Copyright":"© 2017 General Electric Company","Imports":["ntoskrnl.exe","HAL.dll","WDFLDR.SYS"],"ExportedFunctions":"","ImportedFunctions":["RtlUnwind","KeBugCheckEx","KeTickCount","memcpy","MmMapIoSpace","IoAllocateMdl","MmBuildMdlForNonPagedPool","RtlCopyUnicodeString","MmMapLockedPagesSpecifyCache","MmUnmapLockedPages","IoFreeMdl","MmUnmapIoSpace","memset","READ_PORT_USHORT","WRITE_PORT_USHORT","READ_PORT_UCHAR","WRITE_PORT_ULONG","READ_PORT_ULONG","WRITE_PORT_UCHAR","WdfVersionBindClass","WdfVersionUnbindClass","WdfVersionBind","WdfVersionUnbind"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=CA, ST=Alberta, L=Edmonton, O=GE Intelligent Platforms Canada Company, CN=GE Intelligent Platforms Canada Company","ValidFrom":"2016-01-29 00:00:00","ValidTo":"2019-01-28 23:59:59","Signature":"4258e9d490c578f2a130124aded7508017af5b46afbfd7484add272fe8acd172d567a78bc3251a0a9ab2b38e309eeb5992106e1de682f383da0e723ff0211edde91c4e2dce334770339ab98fa98e03b985cca1451032aa28ddd244a586cf1b9ad172794cb9169d07a3f339f90ff5f78e3e1e5e6db1c0c2e9aa1b5dec5a9ad5b435e56b55a379c65c2de8c18615eb77d39fd8b39c72ae98d4d87fef13ec8888f4616d613279e61f968af87de8fa954cea66f196ebeaf45fbf77902dcf230e7b34b7dd3defdee49f68ed6c20f5752b2e92e1995fd141d18c3faa1463eed3d62f1becbeae111bdb66b610c64bff7a3dbdfd6a9c349359fd1cce7ff611be6bc51bc3","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"21d1e9203b5d6fc7379869075104849a","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"769eb6a61bfee7586c6fc6d3f8e6980a","SHA1":"a96b34cfe8a09e8dd8c33eafe4b2043abadcd595","SHA256":"f368351de9da350b7cee666ef8e555b979a530f129787ac09cad25f9138954fe","SHA384":"b2ff97a57c966b6488f59a6554e2cc29ca2d74015b44015bdeeb0b66eb3893fd424a79b6fe9066b62843a44c77d05f3c"}},{"Subject":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA","ValidFrom":"2013-12-10 00:00:00","ValidTo":"2023-12-09 23:59:59","Signature":"13851a1e69a937f7a0bda4af7e1d6153fe9d8c5e0ca6751e781723ddfdec1a035539fb7195c7655aa78e30d2445a61db706fda2105c22e73ba49f1d193fe5dc9cd5e03e0899e3f741ed7f7388ba9d6cfbb352f3358a89256d1c84d3b82e6798416fc28b0b147f31da23eee87d9a67fa456a53fad842e29de7cbca8aaa33d0401eaba93a20e502229174c87e43a115fd6a425899b056b2fb4c9014c277b0bac190522a060153fdac9fb4d4c8ffb726777fd2794c7ba350e8849fe8dfd28af4a12bd0db39705de440c15fa362b03dcc15001f1a1115d14e5e2bd274b54be2b845e0fa6c374050aef97c38922b11f77f3bdcd43d4f14ca93fb58b84af64f2d01421","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"3d78d7f9764960b2617df4f01eca862a","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"1f056ff7d5f874984dc605402b7cb042","SHA1":"bdb348353a2203deb4b767914fa1bd7248dd728b","SHA256":"a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1","SHA384":"fa2729064b49e0d77540c1ee95d5f74acaf8eaf55197851a3a40383335f8113e51190bc48b552196edf8ac5cf0c89278"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}}],"Signer":[{"SerialNumber":"21d1e9203b5d6fc7379869075104849a","Issuer":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA","Version":1}]}],"LoadsDespiteHVCI":"FALSE"},{"Company":"GE Intelligent Platforms, Inc.","Date":"","Description":"GE Device Driver","FileVersion":"7.00 (Build 5517)","Filename":"","MD5":"328a2cb2da464b0c2beb898ff9ae9f3a","MachineType":"I386","OriginalFilename":"GEDevDrv.SYS","Product":"Proficy Machine Edition","ProductVersion":"7.00 (Build 5517)","Publisher":"","SHA1":"adf9328e60c714ff0b98083bcf2f4ee2d58b960b","SHA256":"cac5dc7c3da69b682097144f12a816530091d4708ca432a7ce39f6abe6616461","Signature":"","Imphash":"5f9cf5b0511f3c1129b467d273b921f2","Authentihash":{"MD5":"ac9499fe14d8b42cda567660f3d081df","SHA1":"30d5627753948f533ef45636a0a845d1accd82e3","SHA256":"1dcdd1efab9abc25f4227b37f76da295a6dc4cf810875ba34ee1d465eb709b70"},"RichPEHeaderHash":{"MD5":"4f2ad68669103ddc09fe3694d20ed3fe","SHA1":"6a833e9ded09ce2fff014e3f8bc3fb2a6201af92","SHA256":"9a78349e539cf98c0d740a350fd6e63f39721ee8381606e5277089c7810dc257"},"Sections":{".text":{"Entropy":6.4067174061066074,"Virtual Size":"0x16ec"},".rdata":{"Entropy":4.4686510323905075,"Virtual Size":"0x1d4"},".data":{"Entropy":0.8104503128192735,"Virtual Size":"0x8e4"},"PAGE":{"Entropy":6.455861127735065,"Virtual Size":"0x1a4e"},"INIT":{"Entropy":5.82048122262467,"Virtual Size":"0x3d8"},".rsrc":{"Entropy":3.3763993969036354,"Virtual Size":"0x3e0"},".reloc":{"Entropy":5.96284808819353,"Virtual Size":"0x44c"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2011-06-01 00:58:39","InternalName":"GE Device Driver","Copyright":"© 2011, GE Intelligent Platforms, Inc.","Imports":["ntoskrnl.exe","HAL.dll","WDFLDR.SYS"],"ExportedFunctions":"","ImportedFunctions":["RtlUnwind","KeBugCheckEx","KeTickCount","memcpy","MmMapIoSpace","IoAllocateMdl","MmBuildMdlForNonPagedPool","RtlCopyUnicodeString","MmMapLockedPagesSpecifyCache","MmUnmapLockedPages","IoFreeMdl","MmUnmapIoSpace","memset","READ_PORT_USHORT","WRITE_PORT_USHORT","READ_PORT_UCHAR","WRITE_PORT_ULONG","READ_PORT_ULONG","WRITE_PORT_UCHAR","WdfVersionBindClass","WdfVersionUnbindClass","WdfVersionBind","WdfVersionUnbind"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2","ValidFrom":"2007-06-15 00:00:00","ValidTo":"2012-06-14 23:59:59","Signature":"50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"3825d7faf861af9ef490e726b5d65ad5","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"d6c7684e9aaa508cf268335f83afe040","SHA1":"18066d20ad92409c567cdfde745279ff71c75226","SHA256":"a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff","SHA384":"35c249d6ad0261a6229b2a727067ac6ba32a5d24b30b9249051f748c7735fbe2ec2ef26a702c50df1790fbe32a65aee7"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA","ValidFrom":"2003-12-04 00:00:00","ValidTo":"2013-12-03 23:59:59","Signature":"4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"47bf1995df8d524643f7db6d480d31a4","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"518d2ea8a21e879c942d504824ac211c","SHA1":"21ce87d827077e61abddf2beba69fde5432ea031","SHA256":"1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7","SHA384":"53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f"}},{"Subject":"C=CA, ST=Alberta, L=Edmonton, O=GE , OU=Digital ID Class 3 , Microsoft Software Validation v2, OU=Intelligent Platforms, CN=GE ","ValidFrom":"2010-04-08 00:00:00","ValidTo":"2013-04-07 23:59:59","Signature":"606daddb4410cea2602a13f4cf09dd9f7e3a02d740e874e42ef5f07a35d558e14b846c2df6ae7246bd61f883bd9bd9ec5664460e36de7eac97df14700074798e840a8080a70511eb08988459cba7398cdcaf6aff86e226d53eb0c32d1c2178200b44d474847033a7cd3fcb8b5ccc9126d75d35701687c83f16c6d83e1ad99c5394216cde89b2d706a83b353da7d0d1a9939fd37f2d25f85edafeffa7552d67ba4115e2977106d1986470e3eacea1396493a8f346683f2743c83a15033c57f22e6b80eb6ee51951e847f045227089e72bee8c8abc469f64f8f8aef283b4059a3a58eb5695d916c9b73a6587bb4c3ed71882f40a4ee2b9c5b7e0482e075bd8f755","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"696d42a62da190c8cebe0345810f5372","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"cbfc054efc981779e2e5d9f25ff0f537","SHA1":"b8b92324d6493e199f87f074f7b91c9ddab2658a","SHA256":"5996b03c1b8d5ae1fad121a487989abf91ac4ad550540591009183df9cffce29","SHA384":"0171dd207a27c93502245917d4bdda2afcf14ceebc3cf3bff95f1d90a5befe675372a5732f5efe975bec23df6593b97e"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)09, CN=VeriSign Class 3 Code Signing 2009,2 CA","ValidFrom":"2009-05-21 00:00:00","ValidTo":"2019-05-20 23:59:59","Signature":"8b03c0dd94d841a26169b015a878c730c6903c7e42f724b6e4837317047f04109ca1e2fa812febc0ca44e772e050b6551020836e9692e49a516ab43731dca52deb8c00c71d4fe74d32ba85f84ebefa675565f06abe7aca64381a101078457631f3867a030f60c2b35d9df68b6676821b59e183e5bd49a53856e5de41770e580f","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"655226e1b22e18e1590f2985ac22e75c","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"650704c342850095f3288eaf791147d4","SHA1":"4cdc38c800761463749c3cbd94a12f32e49877bf","SHA256":"07b8f662558ec85b71b43a79c6e94698144f4ced2308af21e7ba1e5d461da214","SHA384":"2a271d052213438467d09d60eaa4010c8642fff3eb0070e0cf9969428713c8fdc066b90996d594dd3136f5bd0af5a22a"}}],"Signer":[{"SerialNumber":"696d42a62da190c8cebe0345810f5372","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)09, CN=VeriSign Class 3 Code Signing 2009,2 CA","Version":1}]}],"LoadsDespiteHVCI":"FALSE"}]}