{"Id":"9a4fb66e-9084-4b21-9d76-a7afbe330606","Tags":["AMDPowerProfiler.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2023-01-09","MitreID":"T1068","CVE":["CVE-2021-26334"],"Category":"vulnerable driver","Commands":{"Command":"sc.exe create AMDPowerProfiler.sys binPath=C:\\windows\\temp\\AMDPowerProfiler.sys     type=kernel && sc.exe start AMDPowerProfiler.sys","Description":"AMD uProf AMDPowerProfiler.sys is affected by CVE-2021-26334. Insufficient access control permits lower-privileged callers to access model-specific registers, which can lead to privilege escalation and ring-0 code execution. AMD addresses the issue in the Windows uProf 3.4.494 release.","OperatingSystem":"Windows 10","Privileges":"User","Usecase":"Elevate privileges"},"Resources":["https://github.com/magicsword-io/LOLDrivers/issues/409","https://github.com/elastic/protections-artifacts/search?q=VulnDriver","https://www.amd.com/en/resources/product-security/bulletin/amd-sb-1016.html","https://nvd.nist.gov/vuln/detail/CVE-2021-26334","https://github.com/fluffycats31/vulnerable-drivers"],"Detection":[{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/0af5ccb3d33a9ba92071c9637be6254030d61998733a5eb3583e865e17844e05.yara"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"},{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"}],"Acknowledgement":{"Handle":"@fluffycats31","Person":"fluffycats31"},"KnownVulnerableSamples":[{"Filename":"AMDPowerProfiler.sys","SHA256":"5f7bf4e385cd44014f389058411374172ecd79d9066abcbbbc59dd84f89b85fb","MD5":"a39771e8edd0e947aa92e1fef441c5f1","SHA1":"fb64b28842c2043214d7f1773cba3d9d5484f77f","Imphash":"dc46830dae0b3da4d2889bb5d44a3f85","Authentihash":{"MD5":"ea95cd42c9d64f2bea50518a131c3bdb","SHA1":"b3a12e2cbb5aab2259229c74183eb29d937dda01","SHA256":"28eca097fd81f4746777518ad1abe19fd5b4c7a27ca03e554148cf7caceb4013"},"RichPEHeaderHash":{"MD5":"99af4977beb6083e6823914f56b4a1a7","SHA1":"3bf061ac0f85c8dede4873ca76f4fbe7bfbf768f","SHA256":"a4fa10be206e6f74b6e86b073768e4aec725fe2343a1005b6a0c018ced3a61a6"},"Sections":{".text":{"Entropy":6.450799307412381,"Virtual Size":"0xafc1"},".rdata":{"Entropy":4.814652995808662,"Virtual Size":"0x14dc"},".data":{"Entropy":1.799087617066737,"Virtual Size":"0x2a38"},".pdata":{"Entropy":4.614161347961814,"Virtual Size":"0xa38"},".gfids":{"Entropy":0.8112781244591328,"Virtual Size":"0x4"},"INIT":{"Entropy":5.34670250686493,"Virtual Size":"0x8e2"},".rsrc":{"Entropy":3.3276191876433785,"Virtual Size":"0x428"},".reloc":{"Entropy":2.584183719779189,"Virtual Size":"0x14"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2019-11-12 00:18:09","Description":"AMD Power Profiling Driver","Company":"Advanced Micro Devices, Inc.","InternalName":"AMDPowerProfiler.sys","OriginalFilename":"AMDPowerProfiler.sys","FileVersion":"6.0.0.0","Product":"AMD uProf","ProductVersion":"3.2.223.0","Copyright":"© 2014-2017 AMD Inc. All rights reserved.","MachineType":"AMD64","Imports":["AMDPCore.SYS","ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["PcoreAddConfiguration","PcoreUnregister","PcoreGetResourceCount","PcoreIsLoaded","PcoreVersion","PcoreRegister","PcoreRemoveAllConfigurations","KeGetProcessorNumberFromIndex","KeInitializeDpc","KeSetTargetProcessorDpcEx","MmMapIoSpace","MmUnmapIoSpace","KeSetEvent","ExAllocatePoolWithTag","ExFreePoolWithTag","KeInitializeEvent","KeWaitForSingleObject","ExSystemTimeToLocalTime","KeGetCurrentProcessorNumberEx","RtlInitUnicodeString","IoDeleteDevice","IoDeleteSymbolicLink","RtlGetVersion","IoCreateDevice","IofCompleteRequest","MmIsAddressValid","MmUnlockPages","PsRemoveLoadImageNotifyRoutine","ZwOpenSection","ZwUnmapViewOfSection","MmProbeAndLockPages","PsSetLoadImageNotifyRoutine","ObfDereferenceObject","IoAllocateMdl","PsRemoveCreateThreadNotifyRoutine","ZwMapViewOfSection","ObReferenceObjectByHandle","IoFreeMdl","MmMapLockedPagesSpecifyCache","PsSetCreateThreadNotifyRoutine","PsSetCreateProcessNotifyRoutine","ZwClose","IoSizeofWorkItem","ZwQueryVolumeInformationFile","IoQueryFileDosDeviceName","IoInitializeWorkItem","IoQueueWorkItemEx","ObfReferenceObject","IoUninitializeWorkItem","ZwOpenFile","IoIs32bitProcess","KeInsertQueueDpc","KeSetImportanceDpc","DbgPrint","IoCreateSymbolicLink","KeQueryActiveGroupCount","RtlIsNtDdiVersionAvailable","KeQueryActiveProcessorCountEx","ZwCreateFile","ZwWriteFile","__C_specific_handler","strcmp","KeQueryPerformanceCounter","HalAllocateHardwareCounters","HalFreeHardwareCounters"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=US, ST=California, L=Santa Clara, O=Advanced Micro Devices INC., CN=Advanced Micro Devices INC.","ValidFrom":"2019-02-13 00:00:00","ValidTo":"2022-02-13 23:59:59","Signature":"8c521a9a934b3e45eaccd7ed8e301606b9e25215b4914181c8dfb5226b0e0e96df11e24e5d5985637b0ed21b121b6b46cc448cea697a0cb62faccc7cd5ec515797e424cf9e28634da84b95fa2eef52f8b9cc0752b6a161bae0be9f4924d7fd9a8fe5443177f16025dbf020287184581d3b1eed67fa369b80eb66cb70050089965da0bf36d68dd303738ac99edff5b7943ce863c4f3b2833a04576e6a28555c630d91bd4ea9f0ca41c0d97b07240c1059bc4a6cbe58276fede21f22de0ec57efe20b33ee4b2bb35cbfb1e5590193aa35368e728a09d27c3bf8e84815c66e092b91e63d025665756aa8e73f847b5506e6b118dde05bf7d72547ec2146d8b9dec80","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"1885b7e188d8fafd38a43d48967d7488","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"7383bf699bcb229fcf33802fe77d95fc","SHA1":"9b497b4a98173e0e91517daae8e47ca0fce3ff21","SHA256":"79ea901ff84d0e090348148fd3b9be496ee45e0e852ec8582b27c6d46f11b5b0","SHA384":"dc879c437e176bfe1e9de208ba3cef533290598e81031e9210f2a8c0f79a15415106632a881a3d24aadf385c2c6861c6"}},{"Subject":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA","ValidFrom":"2013-12-10 00:00:00","ValidTo":"2023-12-09 23:59:59","Signature":"13851a1e69a937f7a0bda4af7e1d6153fe9d8c5e0ca6751e781723ddfdec1a035539fb7195c7655aa78e30d2445a61db706fda2105c22e73ba49f1d193fe5dc9cd5e03e0899e3f741ed7f7388ba9d6cfbb352f3358a89256d1c84d3b82e6798416fc28b0b147f31da23eee87d9a67fa456a53fad842e29de7cbca8aaa33d0401eaba93a20e502229174c87e43a115fd6a425899b056b2fb4c9014c277b0bac190522a060153fdac9fb4d4c8ffb726777fd2794c7ba350e8849fe8dfd28af4a12bd0db39705de440c15fa362b03dcc15001f1a1115d14e5e2bd274b54be2b845e0fa6c374050aef97c38922b11f77f3bdcd43d4f14ca93fb58b84af64f2d01421","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"3d78d7f9764960b2617df4f01eca862a","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"1f056ff7d5f874984dc605402b7cb042","SHA1":"bdb348353a2203deb4b767914fa1bd7248dd728b","SHA256":"a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1","SHA384":"fa2729064b49e0d77540c1ee95d5f74acaf8eaf55197851a3a40383335f8113e51190bc48b552196edf8ac5cf0c89278"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}}],"Signer":[{"SerialNumber":"1885b7e188d8fafd38a43d48967d7488","Issuer":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA","Version":1}]}]},{"Authentihash":{"MD5":"7ed9c787e267b2606441010b65767771","SHA1":"07a5aac8abb0a85822bf792607b9e90914b454dc","SHA256":"e1d3963c55c7ffa96d16e47ec4bbb4e171f828650ce853eb0b83c90ae9c6265a"},"Company":"Advanced Micro Devices, Inc.","Copyright":"© 2021 AMD Inc. All rights reserved.","CreationTimestamp":"2021-07-26 12:06:46","Date":"","Description":"AMD Power Profiling Driver","ExportedFunctions":"","FileVersion":"6.1.0.0","Filename":"AMDPowerProfiler.sys","ImportedFunctions":["PcoreRemoveAllConfigurations","PcoreIsLoaded","PcoreAddConfiguration","PcoreUnregister","PcoreVersion","PcoreRegister","PcoreGetResourceCount","KeGetProcessorNumberFromIndex","KeInitializeDpc","KeSetTargetProcessorDpcEx","MmMapIoSpace","MmUnmapIoSpace","KeQueryActiveGroupCount","KeSetEvent","ExAllocatePoolWithTag","ExFreePoolWithTag","KeInitializeEvent","KeWaitForSingleObject","KeQueryActiveProcessorCountEx","ExSystemTimeToLocalTime","KeGetCurrentProcessorNumberEx","RtlInitUnicodeString","IoDeleteDevice","IoDeleteSymbolicLink","RtlGetVersion","IofCompleteRequest","IoCreateSymbolicLink","MmUnlockPages","PsRemoveLoadImageNotifyRoutine","ZwOpenSection","ZwUnmapViewOfSection","MmProbeAndLockPages","PsSetLoadImageNotifyRoutine","ObfDereferenceObject","IoAllocateMdl","PsRemoveCreateThreadNotifyRoutine","ZwMapViewOfSection","ObReferenceObjectByHandle","IoFreeMdl","MmIsAddressValid","PsSetCreateThreadNotifyRoutine","PsSetCreateProcessNotifyRoutine","ZwClose","IoSizeofWorkItem","ZwQueryVolumeInformationFile","IoQueryFileDosDeviceName","IoInitializeWorkItem","IoQueueWorkItemEx","ObfReferenceObject","IoUninitializeWorkItem","ZwOpenFile","IoIs32bitProcess","MmGetSystemRoutineAddress","ZwSetSecurityObject","IoDeviceObjectType","IoCreateDevice","ObOpenObjectByPointer","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","RtlGetOwnerSecurityDescriptor","RtlGetSaclSecurityDescriptor","SeCaptureSecurityDescriptor","_snwprintf","RtlLengthSecurityDescriptor","SeExports","RtlCreateSecurityDescriptor","_wcsnicmp","wcschr","RtlAbsoluteToSelfRelativeSD","RtlAddAccessAllowedAce","RtlLengthSid","IoIsWdmVersionAvailable","RtlSetDaclSecurityDescriptor","ZwOpenKey","ZwSetValueKey","ZwQueryValueKey","ZwCreateKey","RtlFreeUnicodeString","KeBugCheckEx","KeInsertQueueDpc","KeSetImportanceDpc","DbgPrint","MmMapLockedPagesSpecifyCache","RtlIsNtDdiVersionAvailable","ZwCreateFile","ZwWriteFile","__C_specific_handler","strcmp","KeQueryPerformanceCounter","HalAllocateHardwareCounters","HalFreeHardwareCounters"],"Imports":["AMDPCore.SYS","ntoskrnl.exe","HAL.dll"],"InternalName":"AMDPowerProfiler.sys","MD5":"e4266262a77fffdea2584283f6c4f51d","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"AMDPowerProfiler.sys","Product":"AMD uProf","ProductVersion":"3.4.493.0","Publisher":"","RichPEHeaderHash":{"MD5":"f738aebbde053d70ac80a3e913b2205a","SHA1":"5a6f2f340be31f31d82d22202b4489fc1fb03893","SHA256":"878dda98771551824d963e08ecadef9233c5854b143d5c1d9d42c05620c8cd73"},"SHA1":"b480c54391a2a2f917a44f91a5e9e4590648b332","SHA256":"0af5ccb3d33a9ba92071c9637be6254030d61998733a5eb3583e865e17844e05","Sections":{".text":{"Entropy":6.425434279923185,"Virtual Size":"0x9f01"},".rdata":{"Entropy":4.825713970701754,"Virtual Size":"0x16fc"},".data":{"Entropy":2.108172298358785,"Virtual Size":"0x2d54"},".pdata":{"Entropy":4.753427592244756,"Virtual Size":"0xb4c"},".gfids":{"Entropy":0.8112781244591328,"Virtual Size":"0x4"},"PAGE":{"Entropy":6.292249475182866,"Virtual Size":"0x1ae4"},"INIT":{"Entropy":5.299563826983875,"Virtual Size":"0xc02"},".rsrc":{"Entropy":3.32176383105506,"Virtual Size":"0x420"},".reloc":{"Entropy":3.3672076092970715,"Virtual Size":"0x2c"}},"Signature":["Advanced Micro Devices Inc.","Sectigo RSA Code Signing CA","USERTrust RSA Certification Authority","Sectigo (AAA)"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=DigiCert, Inc., CN=DigiCert Timestamp 2021","ValidFrom":"2021-01-01 00:00:00","ValidTo":"2031-01-06 00:00:00","Signature":"481cdcb5e99a23bce71ae7200e8e6746fd427251740a2347a3ab92d225c47059be14a0e52781a54d1415190779f0d104c386d93bbdfe4402664ded69a40ff6b870cf62e8f5514a7879367a27b7f3e7529f93a7ed439e7be7b4dd412289fb87a246034efcf4feb76477635f2352698382fa1a53ed90cc8da117730df4f36539704bf39cd67a7bda0cbc3d32d01bcbf561fc75080076bc810ef8c0e15ccfc41172e71b6449d8229a751542f52d323881daf460a2bab452fb5ce06124254fb2dfc929a8734351dabd63d61f5b9bf72e1b4f131df74a0d717e97b7f43f84ebc1e3a349a1facea7bf56cfba597661895f7ea7b48e6778f93698e1cb28da5b87a68a2f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"0d424ae0be3a88ff604021ce1400f0dd","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"c0189c338449a42fe8358c2c1fbecc60","SHA1":"b8ac0ee6875594b80ad86a6df6dd1fa3048c187c","SHA256":"a43de6baf968a942da017b70769fdb65b3cfb1bbca1f9174da26a7d8aae78ec5","SHA384":"76d3a316a5a106050298418cce3beea16100524723d9e3220b0de51bfb6f1c35a5d4c7cd10b358fef7bf94c3e3562150"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Timestamping CA","ValidFrom":"2016-01-07 12:00:00","ValidTo":"2031-01-07 12:00:00","Signature":"719512e951875669cdefddda7caa637ab378cf06374084ef4b84bfcacf0302fdc5a7c30e20422caf77f32b1f0c215a2ab705341d6aae99f827a266bf09aa60df76a43a930ff8b2d1d87c1962e85e82251ec4ba1c7b2c21e2d65b2c1435430468b2db7502e072c798d63c64e51f4810185f8938614d62462487638c91522caf2989e5781fd60b14a580d7124770b375d59385937eb69267fb536189a8f56b96c0f458690d7cc801b1b92875b7996385228c61ca79947e59fc8c0fe36fb50126b66ca5ee875121e458609bba0c2d2b6da2c47ebbc4252b4702087c49ae13b6e17c424228c61856cf4134b6665db6747bf55633222f2236b24ba24a95d8f5a68e52","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"0aa125d6d6321b7e41e405da3697c215","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"8d26184fc613f89aba1cefb30fce1b53","SHA1":"63a7e376bad5ec2e419d514a403bcf46c8d31d95","SHA256":"56b5f0d9db578e3f142921daa387902722a76700375c7e1c4ae0ba004bacaa0c","SHA384":"d8c9691fe9dbe182f07b49b07fbb4f589fa7b38b5c4d21f265d3a2e818f4b1bfb39e03faab2ec05bb10333a99914fb8a"}},{"Subject":"C=US, ST=California, L=Santa Clara, O=Advanced Micro Devices Inc., CN=Advanced Micro Devices Inc.","ValidFrom":"2021-05-11 00:00:00","ValidTo":"2024-05-10 23:59:59","Signature":"8444e268ff381c9148985f408e5cc1453a560c9dd94d2a6cfa01dd7f2adc8af633053d2c79027db4f185f477b0d5db8b362b37dbd0d258823831ace7058baf3feb80a9eb2de9dd886bcf390fae9b586fc833e63db5c6a07019f35a9fce6899502852737b32d25ea7832c3786df0642d21622e56c0b0171e96f9520d07f73950376ff555bcf9c8a55bf4f86c088b58e2cb625a0ef4680ed7281f09a40c7be9f69cba77a6967030e39b2cfa46692698ced9e5347dd7056b476545c3442f934cb2c30cb986afabd29a9a9e2eb28c5bd6ee47dabf5ef587f850ea49b124eb868aac68de949616d08f875192b93388549c7327a3ef085e287d5a743810c151b250c64","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"535091e6cab13af393b51ead0825f627","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"f2f60243e26dcdf4729d28b1beb55f01","SHA1":"a23ac91136dd79d77b93b12c813e0c6669ed9f4d","SHA256":"192ee517f8ae928808632422a6461613d65ee324fa58d2f099a27a3d0da9ca6b","SHA384":"beb93a1ff1715564a418ecb07cee42465dbf9c76cc703e7088bdafb2099b003afa0c335bcd15d318dcb2bf8519c199da"}},{"Subject":"C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority","ValidFrom":"2019-03-12 00:00:00","ValidTo":"2028-12-31 23:59:59","Signature":"188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95","SignatureAlgorithmOID":"1.2.840.113549.1.1.12","IsCertificateAuthority":true,"SerialNumber":"3972443af922b751d7d36c10dd313595","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"3f5b269ded03667a7bad47c1885062b0","SHA1":"0f01247aaf8b46e3617880e0f5f5dfac696ed7a3","SHA256":"593e2d49a74023555526aef9b7422b19e5b8b167391b6dee5ed292b1ca23a74c","SHA384":"13baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9"}},{"Subject":"C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Code Signing CA","ValidFrom":"2018-11-02 00:00:00","ValidTo":"2030-12-31 23:59:59","Signature":"4d6350ed47344a61a4dbde6a2a8c9bf100001e1d627b3ad732c2f6b3e063b3fb6100889a1b6d1007044fbeb8ea897822eb0f46ecf3465e40468912f40b775a9c2a413afcd6f4ebe7f7159533c3a18328b7de2fe494f78533832d4a4048bf9ac24f4ab18f24f4b38137d3b764b0a6236a596852425fff04ebe174657908f5a993de6b71409996ba78f1b9c8e2c30816b1ab635ac815806d745e4a757ea5b8c36cb5cfdf4a79875cc7404d6335f630d3cfb50a0e0b047fa04baebba3a5d08400933e535d34a50035696cbe9f2025100d19fb509061be398f7a8e4df69f0e1efe075112668326194895ce4ac9c17ff33a059bf96fdf887fc0239ed21e437a4531c19c4da9f059b25919e86a8d290402777c4b4bcd70be3ab2555a783ebcbb6f0310257715348af936cc4392e4ba4ff1629328255729fb5119c7a125406a8457c6b29db1bc1c0ada7c677e7d2ee9284c187ec47b3141719a4b29ec0b3d5750d2caddfd9e0551e54478dd01deb175980d5424fdf04ee3e2f883bd72bacb3d3aeef05e1792686dc861f9a6f12a0a0ba5b9f49eee983205859eebf98329d3c62c7dbd3a772e8b3742a06a82ed3b4aaa9410a4e10df817c5b65a79331892e3b575f8a1e98e0a251ee41ef19f5a8723ff9fa4519efb398011cddbb5c4a7a8806fe553d4e0e3a2c2d25b1afa32262d6a57701c3ca4582ea3f35b4b07dc3259f387a71a6d58","SignatureAlgorithmOID":"1.2.840.113549.1.1.12","IsCertificateAuthority":true,"SerialNumber":"1da248306f9b2618d082e0967d33d36a","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"c1eabfb5994258ad955adb7c2df165e6","SHA1":"fa33b3c00cebc469b269220d9eab26926c9b8ad8","SHA256":"70dffac37eb787b2198816982c7d44f541d2e39a7dac069d37b367dc9f354b32","SHA384":"20adc5b59cb532e215f01ba09a9c745898c206555613512fea7c295ccfd17ced4fe2c5bc3274ca8a270fc68799b8343c"}}],"Signer":[{"SerialNumber":"535091e6cab13af393b51ead0825f627","Issuer":"C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Code Signing CA","Version":1}]}],"Imphash":"1422b8d354b95d9cd880c8726df45dfc","LoadsDespiteHVCI":"FALSE"},{"Filename":"AMDPowerProfiler.sys","MD5":"e70ab7b9b9929ffd730556555045f3c6","SHA1":"ca7c1ef1c832149315c8ca349cb1ae1387021c4b","SHA256":"1e6f08a686be2e28469b2d71d8567f2023ddbd65bd65618fc7bbac16d39e04d5","LoadsDespiteHVCI":"FALSE","Imphash":"dc46830dae0b3da4d2889bb5d44a3f85","Authentihash":{"MD5":"a7cb389d261dc8ee419a95a49515e8a2","SHA1":"9cdc47be68320edf0e131b88dcf0130bcebcdd45","SHA256":"760e04785b220ef3b141e414b9f3d6cbfeaf1a113e0ec697660ddf06b00c4405"},"RichPEHeaderHash":{"MD5":"99af4977beb6083e6823914f56b4a1a7","SHA1":"3bf061ac0f85c8dede4873ca76f4fbe7bfbf768f","SHA256":"a4fa10be206e6f74b6e86b073768e4aec725fe2343a1005b6a0c018ced3a61a6"},"Sections":{".text":{"Entropy":6.447401117413264,"Virtual Size":"0xae51"},".rdata":{"Entropy":4.839584236250367,"Virtual Size":"0x14b4"},".data":{"Entropy":1.799087617066737,"Virtual Size":"0x2a28"},".pdata":{"Entropy":4.597562501176203,"Virtual Size":"0xa14"},".gfids":{"Entropy":0.8112781244591328,"Virtual Size":"0x4"},"INIT":{"Entropy":5.347797592615007,"Virtual Size":"0x8e2"},".rsrc":{"Entropy":3.3219852850774334,"Virtual Size":"0x428"},".reloc":{"Entropy":2.584183719779189,"Virtual Size":"0x14"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2019-06-10 07:18:46","Description":"AMD Power Profiling Driver","Company":"Advanced Micro Devices, Inc.","InternalName":"AMDPowerProfiler.sys","OriginalFilename":"AMDPowerProfiler.sys","FileVersion":"6.0.0.0","Product":"AMD uProf","ProductVersion":"3.0.278.0","Copyright":"© 2014-2017 AMD Inc. All rights reserved.","MachineType":"AMD64","Imports":["AMDPCore.SYS","ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["PcoreAddConfiguration","PcoreUnregister","PcoreGetResourceCount","PcoreIsLoaded","PcoreVersion","PcoreRegister","PcoreRemoveAllConfigurations","KeGetProcessorNumberFromIndex","KeInitializeDpc","KeSetTargetProcessorDpcEx","MmMapIoSpace","MmUnmapIoSpace","KeSetEvent","ExAllocatePoolWithTag","ExFreePoolWithTag","KeInitializeEvent","KeWaitForSingleObject","ExSystemTimeToLocalTime","KeGetCurrentProcessorNumberEx","RtlInitUnicodeString","IoDeleteDevice","IoDeleteSymbolicLink","RtlGetVersion","IoCreateDevice","IofCompleteRequest","MmIsAddressValid","MmUnlockPages","PsRemoveLoadImageNotifyRoutine","ZwOpenSection","ZwUnmapViewOfSection","MmProbeAndLockPages","PsSetLoadImageNotifyRoutine","ObfDereferenceObject","IoAllocateMdl","PsRemoveCreateThreadNotifyRoutine","ZwMapViewOfSection","ObReferenceObjectByHandle","IoFreeMdl","MmMapLockedPagesSpecifyCache","PsSetCreateThreadNotifyRoutine","PsSetCreateProcessNotifyRoutine","ZwClose","IoSizeofWorkItem","ZwQueryVolumeInformationFile","IoQueryFileDosDeviceName","IoInitializeWorkItem","IoQueueWorkItemEx","ObfReferenceObject","IoUninitializeWorkItem","ZwOpenFile","IoIs32bitProcess","KeInsertQueueDpc","KeSetImportanceDpc","DbgPrint","IoCreateSymbolicLink","KeQueryActiveGroupCount","RtlIsNtDdiVersionAvailable","KeQueryActiveProcessorCountEx","ZwCreateFile","ZwWriteFile","__C_specific_handler","strcmp","KeQueryPerformanceCounter","HalAllocateHardwareCounters","HalFreeHardwareCounters"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2","ValidFrom":"2012-12-21 00:00:00","ValidTo":"2020-12-30 23:59:59","Signature":"03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"7e93ebfb7cc64e59ea4b9a77d406fc3b","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"d0785ad36e427c92b19f6826ab1e8020","SHA1":"365b7a9c21bd9373e49052c3e7b3e4646ddd4d43","SHA256":"c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff","SHA384":"eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"}},{"Subject":"C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4","ValidFrom":"2012-10-18 00:00:00","ValidTo":"2020-12-29 23:59:59","Signature":"783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0ecff438c8febf356e04d86a981b1a50","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"e9d38360b914c8863f6cba3ee58764d3","SHA1":"4cba8eae47b6bf76f20b3504b98b8f062694a89b","SHA256":"88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976","SHA384":"e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"}},{"Subject":"C=US, ST=California, L=Santa Clara, O=Advanced Micro Devices INC., CN=Advanced Micro Devices INC.","ValidFrom":"2019-02-13 00:00:00","ValidTo":"2022-02-13 23:59:59","Signature":"8c521a9a934b3e45eaccd7ed8e301606b9e25215b4914181c8dfb5226b0e0e96df11e24e5d5985637b0ed21b121b6b46cc448cea697a0cb62faccc7cd5ec515797e424cf9e28634da84b95fa2eef52f8b9cc0752b6a161bae0be9f4924d7fd9a8fe5443177f16025dbf020287184581d3b1eed67fa369b80eb66cb70050089965da0bf36d68dd303738ac99edff5b7943ce863c4f3b2833a04576e6a28555c630d91bd4ea9f0ca41c0d97b07240c1059bc4a6cbe58276fede21f22de0ec57efe20b33ee4b2bb35cbfb1e5590193aa35368e728a09d27c3bf8e84815c66e092b91e63d025665756aa8e73f847b5506e6b118dde05bf7d72547ec2146d8b9dec80","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"1885b7e188d8fafd38a43d48967d7488","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"7383bf699bcb229fcf33802fe77d95fc","SHA1":"9b497b4a98173e0e91517daae8e47ca0fce3ff21","SHA256":"79ea901ff84d0e090348148fd3b9be496ee45e0e852ec8582b27c6d46f11b5b0","SHA384":"dc879c437e176bfe1e9de208ba3cef533290598e81031e9210f2a8c0f79a15415106632a881a3d24aadf385c2c6861c6"}},{"Subject":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA","ValidFrom":"2013-12-10 00:00:00","ValidTo":"2023-12-09 23:59:59","Signature":"13851a1e69a937f7a0bda4af7e1d6153fe9d8c5e0ca6751e781723ddfdec1a035539fb7195c7655aa78e30d2445a61db706fda2105c22e73ba49f1d193fe5dc9cd5e03e0899e3f741ed7f7388ba9d6cfbb352f3358a89256d1c84d3b82e6798416fc28b0b147f31da23eee87d9a67fa456a53fad842e29de7cbca8aaa33d0401eaba93a20e502229174c87e43a115fd6a425899b056b2fb4c9014c277b0bac190522a060153fdac9fb4d4c8ffb726777fd2794c7ba350e8849fe8dfd28af4a12bd0db39705de440c15fa362b03dcc15001f1a1115d14e5e2bd274b54be2b845e0fa6c374050aef97c38922b11f77f3bdcd43d4f14ca93fb58b84af64f2d01421","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"3d78d7f9764960b2617df4f01eca862a","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"1f056ff7d5f874984dc605402b7cb042","SHA1":"bdb348353a2203deb4b767914fa1bd7248dd728b","SHA256":"a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1","SHA384":"fa2729064b49e0d77540c1ee95d5f74acaf8eaf55197851a3a40383335f8113e51190bc48b552196edf8ac5cf0c89278"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}}],"Signer":[{"SerialNumber":"1885b7e188d8fafd38a43d48967d7488","Issuer":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA","Version":1}]}]}]}