strela | CB_setup[.]exe

resource	yara_rule
static1/unpack001/$PLUGINSDIR/NSIS_SkinCrafter_Plugin.dll	family_strela

resource
unpack001/$PLUGINSDIR/Banner.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/MyLangDLLS3.dll
unpack001/$PLUGINSDIR/MyLangDLLT3.dll
unpack001/$PLUGINSDIR/NSIS_SkinCrafter_Plugin.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/cService.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$TEMP/TemporaryComodoProduct/CSE.exe
unpack001/CBDrvSys.exe

CB_setup.exe

IMPHASH b729b61eb1515fcf7b3e511e4e66258b
SHA256 ae1c457e4968758551c0e99ce62cb87c02b6c134afda6d1d700da3b37a2d7610
MD5 193642adb57aec509ba3fd698a09efd2
SHA1 d9166b6ac1c069f028188357ff40256d7395868c
SHA512 507c9698f6d9b2def0f60641b5eeef5a13a55f0a492af62abae7345b9b01d3cef490a689ff98fe899b2188cb4d3d74b1a655dccf370f31d01ca7fbca2041bc5e
SSDEEP 393216:Es5Q1AuX1FFetKFOfzJyb2omyUw7RLo4WRsyo1fL79UXPj5MXHQqkJGlF:Es52AuXHQagzJk+yUwBo5oHUXPFkQ3K
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

0b:65:62:e8:a4:92:fa:df:9e:14:bc:0e:e7:24:92:c4:8f:ad:a4:11

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Minor OS version

0

Major OS version

5

Entry point

13643

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte MulDiv lstrlenA WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx FindWindowExW GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint IsWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/Banner.dll

IMPHASH beba03bbad1f8d79d5b3c1359e913e0d
SHA256 045bd54299e1cf2d9e68f64e233f30c8a2c455d72645d4a4a9ca8874a7c510ac
MD5 4a90d392c9da5f0b90a75baf67c37e4c
SHA1 73e875dafefaa16def7f77a428a5c131b7b9837e
SHA512 82014b8fb94da3d158ef68a2488eb594bcf27d31132b4bbf2f4c441d00ed9d374d78cd013a1af6c59fd03716bf5c429cddf77c43e1e171df24086b70b7b9a13d
MD5 SHA1 SHA512

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4763

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/InstallOptions.dll

IMPHASH cd90e33ffbc335413a25300c682c83df
SHA256 fa8de036b1d9bb06be383a82041966c73473fc8382d041fb5c1758f991afeae7
MD5 67d8f4d5acdb722e9cb7a99570b3ded1
SHA1 f4a729ba77332325ea4dbdeea98b579f501fd26f
SHA512 03999cc26a76b0de6f7e4e8a45137ee4d9c250366ac5a458110f00f7962158311eea5f22d3ee4f32f85aa6969eb143bdb8f03ca989568764ed2bc488c89b4b7f
SSDEEP 192:CsIZHdT9uwYX94kYd2iCzHR+yK7imphLAykycpKPd5m78ozxGUWumle:CsUHd9GN2d2iwl0impATIPdA78Ov6
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7419

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

lstrcmpiW GetModuleHandleW GlobalLock GlobalUnlock GetCurrentDirectoryW SetCurrentDirectoryW GetPrivateProfileIntW GetPrivateProfileStringW lstrcatW WritePrivateProfileStringW lstrcpynW lstrlenW lstrcpyW GlobalFree GlobalAlloc

user32

OpenClipboard DestroyIcon LoadCursorW DispatchMessageW TranslateMessage GetMessageW IsDialogMessageW ShowWindow SetWindowLongW GetClientRect SetWindowRgn LoadIconW LoadImageW CreateWindowExW MapDialogRect GetClipboardData GetWindowRect CreateDialogParamW EnableMenuItem GetSystemMenu EnableWindow GetDlgItem SetCursor DrawTextW GetWindowLongW DrawFocusRect CallWindowProcW PostMessageW wsprintfW CharNextW MessageBoxW CloseClipboard GetDlgCtrlID MapWindowPoints SetWindowPos PtInRect GetWindowTextW SetWindowTextW SendMessageW DestroyWindow

gdi32

SelectObject CreateRectRgn GetObjectW CombineRgn DeleteObject CreateCompatibleDC GetDIBits SetTextColor

shell32

SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteW SHGetDesktopFolder

comdlg32

GetOpenFileNameW CommDlgExtendedError GetSaveFileNameW

ole32

CoTaskMemFree

$PLUGINSDIR/MyLangDLLS3.dll

IMPHASH e981c0ab92cb1f191bb5e23392e14796
SHA256 dfca83b19ee2fe36479e9c1ceef2eb45b08851236dcf7a958141b1af03d27a21
MD5 7050cd061f2ddac010e3382a57d5ede4
SHA1 a0a1e5e89fb230dfa3c76ee15b0e51abead32282
SHA512 5f8472dd37a1cc1aecad78610b71670989715a15f8911e658ce7da4c4b2d428f866c9e61df30f6660d91dd365b1c055676ef3a3f6ec77d826ef11175a713455e
SSDEEP 48:aYZvMWeApYxYlxamAWHN+EuWkGWBBWAGr9SdLB8mT/59DvZVSA:JyWGSxamjHNDuWRWBBWvmT//RV
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

5444

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/MyLangDLLT3.dll

IMPHASH e981c0ab92cb1f191bb5e23392e14796
SHA256 a959bc1ba7e20880b54e01506630bdbd578e7217ee93ff4505f3f35365eae3ce
MD5 7daf32a01b28aa866efd69b4eb982c80
SHA1 19b3587faab67bb817fe69dd6db28e779a284126
SHA512 8a5afab0b881b76d507611d50807ee22be234c5ccea629bc2117dc8e22b086d4dfc05508e50c483054609f47d84bfd57c423a87699f9a8458411826209f67f29
SSDEEP 48:aYZ7wWeApYxYlxamAWHN+EuWkGWBBWAGr9SdLB8mU59D/ZVSA:JyWGSxamjHNDuWRWBBWvmU/BV
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

5444

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/NSIS_SkinCrafter_Plugin.dll

IMPHASH bb85049d564b3e4f4a130406f4264713
SHA256 ea1552de423ed1768bace344d9a07bf529845c75fe6fc6ce3c4ba91d4aae5409
MD5 2e13e03b7cf2d8c8338bbc3d29fd3e07
SHA1 173e6e67c5315474765dcd303b3214d5600c48ea
SHA512 94220a07aea2f4a45ef6b7566baba5a9ce73e70236bf97fc2489bee50b662f3fd05824d7804dd544eef85d73e69091aaae5de3094f0866bf51521024eb3d168d
SSDEEP 98304:eF0Kg9frmFcqlMZ4vpHfOVlQnzW4Aogn/oXFdAaTZ8GcB7d0:eFFA7t2RHfYlQZJgTamGcBi
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detects Strela Stealer payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

26691

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetModuleFileNameW WideCharToMultiByte SizeofResource LockResource LoadResource FindResourceW GlobalFree lstrcpyW MultiByteToWideChar FreeLibrary GetLastError GetProcAddress LoadLibraryW GetSystemDirectoryW InterlockedDecrement InterlockedIncrement InterlockedExchange InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapFree RtlUnwind RaiseException ExitProcess GetFileAttributesW GetCurrentThreadId GetCommandLineA GetVersionExA LCMapStringA LCMapStringW GetCPInfo HeapAlloc HeapDestroy HeapCreate VirtualFree VirtualAlloc HeapReAlloc IsBadWritePtr TlsAlloc SetLastError TlsFree TlsSetValue TlsGetValue GetModuleHandleA SetUnhandledExceptionFilter WriteFile FlushFileBuffers QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetModuleFileNameA SetFilePointer CloseHandle TerminateProcess GetCurrentProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW UnhandledExceptionFilter GetLocaleInfoA VirtualProtect GetSystemInfo VirtualQuery GetStringTypeA GetStringTypeW GetUserDefaultLCID EnumSystemLocalesA IsValidLocale IsValidCodePage HeapSize IsBadReadPtr IsBadCodePtr GetACP GetOEMCP SetStdHandle ReadFile LoadLibraryA GetLocaleInfoW CreateFileA SetEndOfFile

user32

MessageBoxW

$PLUGINSDIR/Plugin.dll

IMPHASH beb2114478fe878718bcd34fdda6c0d0
SHA256 ea847b3e559321f8825d4339ad503b8082546ad7f9ae1d8373914f2ffaf3e6a2
MD5 67ad13de4800015f22cffaa96e1cdd41
SHA1 542fb5baeea3f3b7ebdc70061790612ae9bfd0dc
SHA512 c2f776d6b4091dcc241ca25d3d1134f7487f6ffd1e58b6108d3dae655cdb949c3ded8a03a952ec33947c61cb0213fde25b79992ca86327e380f30140a881a79b
SSDEEP 49152:sLiFc4XSrTu9TCEl/EswofHbTdTqTDvqPe:IiFc4XSrOHE8fHPe
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

17:bb:3e:37:9e:a2:01:33:96:71:e6:eb:f8:60:53:0a:5c:59:ae:ab

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Minor OS version

0

Major OS version

5

Entry point

1578634

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\emanu_000\Desktop\SetupCheckout\BIN\Win32\Release\Plugin.pdb

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

kernel32

WaitForMultipleObjects Sleep WTSGetActiveConsoleSessionId FreeLibrary LoadLibraryW SetPriorityClass GetPriorityClass SetThreadExecutionState DeviceIoControl FormatMessageW UnmapViewOfFile ResetEvent Process32NextW ProcessIdToSessionId Process32FirstW CreateToolhelp32Snapshot MapViewOfFile OpenFileMappingW GetSystemTime GetVersionExW GetExitCodeThread OpenThread GetExitCodeProcess OpenProcess GetCurrentProcessId GetVolumeInformationW QueryDosDeviceW RemoveDirectoryW SystemTimeToFileTime GetFileTime GetNativeSystemInfo GetVolumePathNameW GetDiskFreeSpaceExW GetFileInformationByHandle CopyFileW DeleteFileW FindVolumeClose FindNextVolumeW FindFirstVolumeW GetVolumePathNamesForVolumeNameW MoveFileW SetFileTime GetComputerNameW GetWindowsDirectoryW GetTickCount FileTimeToSystemTime GetFileSize GetTempPathW ExpandEnvironmentStringsW DeleteCriticalSection InterlockedIncrement InterlockedDecrement SetLastError LeaveCriticalSection EnterCriticalSection CreateFileMappingW GetCurrentThread SetThreadPriority InitializeCriticalSection GetDiskFreeSpaceW DuplicateHandle SetVolumeMountPointW DeleteVolumeMountPointW GetVolumeNameForVolumeMountPointW SetErrorMode HeapCreate FindFirstVolumeA MoveFileExW TerminateProcess CreateProcessW lstrcmpW EnumSystemLanguageGroupsW RaiseException HeapDestroy HeapReAlloc HeapSize WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle FlushFileBuffers CreateProcessA LocalFree lstrlenW OutputDebugStringA GetModuleFileNameW CreateDirectoryW GetFileSizeEx GetFileAttributesW SetFileAttributesW FindFirstFileW FindNextFileW FindClose GetCurrentProcess CreateMutexW OpenMutexW GetSystemInfo CreateFileW GetModuleHandleW GetProcAddress SetFilePointer SetEndOfFile ReadFile GetEnvironmentVariableW HeapAlloc CreateEventW OpenEventW CreateFileA HeapFree GetProcessHeap CreateThread SetEvent SetFilePointerEx WriteFile CloseHandle GetCurrentThreadId WaitForSingleObject ReleaseMutex GetLastError FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetCurrentDirectoryW WideCharToMultiByte lstrcpynW GlobalAlloc GlobalFree lstrcpyW GetLocalTime GetLocaleInfoA GetStringTypeW GetStringTypeA GetConsoleMode GetConsoleCP LoadLibraryA InitializeCriticalSectionAndSpinCount RtlUnwind QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount GetFileAttributesA LCMapStringA GetTimeZoneInformation LCMapStringW IsValidCodePage GetOEMCP GetACP GetCPInfo TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleFileNameA GetStdHandle ExitProcess VirtualAlloc VirtualFree IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCommandLineA MultiByteToWideChar GetSystemTimeAsFileTime CompareStringA CompareStringW SetEnvironmentVariableA FindNextVolumeA

user32

GetSystemMetrics ExitWindowsEx SendMessageW FindWindowExW MessageBoxW wsprintfW wsprintfA GetDesktopWindow

advapi32

IsValidSid RegOpenKeyExW RegCloseKey FreeSid CreateServiceW DeleteService ControlService CreateServiceA OpenSCManagerA StartServiceW OpenServiceA RegQueryInfoKeyW RegGetKeySecurity IsValidSecurityDescriptor RegEnumValueW GetKernelObjectSecurity RegFlushKey ImpersonateLoggedOnUser RevertToSelf RegDeleteValueW CheckTokenMembership OpenSCManagerW OpenServiceW QueryServiceStatusEx CloseServiceHandle GetTokenInformation ConvertSidToStringSidW RegDeleteKeyW DuplicateTokenEx CreateProcessAsUserW GetUserNameW RegEnumKeyW RegCreateKeyExW RegQueryValueExW RegSetValueExW OpenProcessToken SetKernelObjectSecurity LookupPrivilegeValueW AdjustTokenPrivileges InitializeSecurityDescriptor AllocateAndInitializeSid GetLengthSid InitializeAcl AddAccessAllowedAce SetSecurityDescriptorDacl RegOpenKeyW

ole32

CoCreateGuid CoInitializeEx CoInitialize CoUninitialize CoCreateInstance

shell32

SHGetMalloc SHBrowseForFolderW SHCreateDirectoryExW ShellExecuteExW SHFileOperationW SHGetFolderPathW SHGetPathFromIDListW

oleaut32

SafeArrayDestroyData SysFreeString SysStringLen SysAllocString

shlwapi

PathFindExtensionW StrStrW SHCreateStreamOnFileEx

setupapi

SetupCommitFileQueueW SetupCloseFileQueue SetupInstallFromInfSectionW SetupInstallServicesFromInfSectionW SetupCloseInfFile SetupInstallFilesFromInfSectionW SetupOpenInfFileW SetupOpenFileQueue SetupDefaultQueueCallbackW SetupInitDefaultQueueCallbackEx

mpr

WNetAddConnection2W WNetCancelConnectionW WNetCancelConnection2W

winhttp

WinHttpCloseHandle WinHttpSetStatusCallback WinHttpWriteData WinHttpSendRequest WinHttpSetOption WinHttpGetProxyForUrl WinHttpOpenRequest WinHttpConnect WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpOpen WinHttpReceiveResponse

wininet

InternetGetConnectedState FtpCreateDirectoryW InternetGetLastResponseInfoW FtpGetFileSize InternetQueryDataAvailable HttpOpenRequestW HttpSendRequestW InternetCloseHandle InternetReadFile FtpPutFileW FtpDeleteFileW InternetConnectW InternetOpenW FtpRemoveDirectoryW InternetCheckConnectionW InternetFindNextFileW FtpOpenFileW InternetWriteFile FtpFindFirstFileW

urlmon

URLDownloadToFileW

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

crypt32

CertAddEncodedCertificateToStore CertOpenStore CertCloseStore

$PLUGINSDIR/System.dll

IMPHASH 039bcbc605477e8e87ec550c2e60e748
SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
MD5 959ea64598b9a3e494c00e8fa793be7e
SHA1 40f284a3b92c2f04b1038def79579d4b3d066ee0
SHA512 5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64
SSDEEP 192:sRer7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4Sy+Xe:s67Xws4FVWig86/5eCBqSy+Xe
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10085

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/cService.dll

IMPHASH 743fbccc2565a8f9873d1a2f313c7ad9
SHA256 ba9e6519daebd5ba4b9b46bbd03f5bc5bded03d0c64880ad0ed16d52dbd62789
MD5 5bdb316e8d16364561e06249bb89457e
SHA1 21d95c8d86baf08a3e077cf3d3683c3f69aa1ddf
SHA512 550e7554143904a27c49f424666c76dcca0c17a316b0c05f0e775ba8e164f22de095f85ba77a557352794cf8630a235943f2b1db4be7c870b638835bd280f0de
SSDEEP 96:0TbXaUVGsG6H+gqGP1LNT5NI8JXslshW8a69Ekp7fT8seaMT7Wz:07wFa+gHP/dHaig8aZkRfo2MvW
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4111

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/inetc.dll

IMPHASH 083d4dfafb48fcd81858abcba993f56a
SHA256 7749ded2fef94814aaa6b88df2bf3ca1761a89d3e5a6b43f944b21cfc6c10b09
MD5 4eba22ff92acbcd1097f6c93a9a58dad
SHA1 f5a83d5d5f9ffc45b35dd402d35aafb3d60fe07a
SHA512 b02e3cf9b1a97a643b0f185284960c135a17c205c830b86aea6cf8a4459aedbf32393e8dcedd0ff5254fd2c0c3f923211f980a66a174c742d8797d11a9746770
SSDEEP 12288:sDIvvPI8a85hcpHyPnFAx9nTRqq6mmzDvuBc:sDInPI8aZpyWx9nTRqq6mm3
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

32928

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wininet

InternetOpenW InternetCrackUrlW InternetConnectW HttpEndRequestW HttpOpenRequestW HttpAddRequestHeadersW InternetErrorDlg InternetCloseHandle HttpAddRequestHeadersA InternetQueryOptionW InternetSetOptionW InternetSetFilePointer InternetGetLastResponseInfoW FtpOpenFileW FtpCreateDirectoryW HttpQueryInfoW HttpSendRequestExW HttpSendRequestW InternetWriteFile InternetReadFile

comctl32

ord17

kernel32

CompareStringW CompareStringA GetConsoleOutputCP WriteConsoleA SetStdHandle GetConsoleMode GetConsoleCP GetLocaleInfoW GetTimeZoneInformation SetEnvironmentVariableA InterlockedExchange VirtualAlloc HeapReAlloc HeapSize LCMapStringW LCMapStringA SetConsoleCtrlHandler OutputDebugStringW WriteConsoleW InitializeCriticalSectionAndSpinCount FlushFileBuffers lstrlenW WriteFile ReadFile lstrcmpW lstrcpynW GetLastError GlobalFree DeleteFileW CloseHandle SleepEx SetFilePointer GetTickCount lstrcatW GetFileSize CreateFileW lstrcmpiW GetProcAddress LoadLibraryW GlobalAlloc lstrcpyW MulDiv GetModuleHandleW TerminateThread WaitForSingleObject CreateThread CreateFileA WideCharToMultiByte GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetLocaleInfoA GetStringTypeW GetStringTypeA FatalAppExitA LeaveCriticalSection EnterCriticalSection GetDateFormatA GetTimeFormatA FreeLibrary VirtualQuery GetProcessHeap HeapAlloc GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter VirtualFree HeapFree HeapCreate HeapDestroy GetEnvironmentStringsW OutputDebugStringA FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetModuleFileNameA DeleteCriticalSection GetStartupInfoA GetFileType GetStdHandle SetHandleCount ExitProcess GetCurrentThreadId GetCommandLineA IsDebuggerPresent RaiseException DebugBreak MultiByteToWideChar lstrlenA LoadLibraryA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter InterlockedIncrement InterlockedDecrement GetModuleFileNameW RtlUnwind GetACP GetOEMCP GetCPInfo IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThread HeapValidate IsBadReadPtr Sleep

user32

wsprintfA FindWindowExW CreateDialogParamW EnableWindow IsWindowVisible GetMessageW IsDialogMessageW TranslateMessage DispatchMessageW UpdateWindow KillTimer DestroyWindow LoadIconW SetTimer GetWindowRect GetClientRect SystemParametersInfoW SetWindowPos SetDlgItemTextW SendMessageW GetWindowTextW PostMessageW GetDlgItem SendDlgItemMessageW SetWindowTextW GetWindowLongW SetWindowLongW ShowWindow GetParent MessageBoxW IsWindow wsprintfW RedrawWindow

Name

.text

Size

364KB

Virtual Size

364KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

69KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/ioSpecial.ini

SHA256 f220e0548855c5cda34d9f3c457d94b843e994006fb14d23dbf5ba7eda2819b7
MD5 eaba8a94fb0a74924288915ba2ae0ea0
SHA1 972f0e7baf7b3fa6de300a1239dd3eaed9e32d7c
SHA512 e71d12f1ab1496cb88ed016b9e359f2fdf9e15ff7bbf39b93c884d4f1eb7a8ea39559c9481c244897455feca4013e4c61898e477709fc45589f1c4ab5607c9da
MD5 SHA1 SHA512

$PLUGINSDIR/modern-header.bmp

SHA256 f0fe26600c99d01387828c5f417d8fcbce9246df9eeb6e8986c80039a283d7a9
MD5 d1a925b78f508b60b6dc84db6bddf033
SHA1 70f87f72b6596c52d30938b9a414b6c4519a6ca3
SHA512 f8397f65034f4acf8579b55835f55ada92946e973719fda1ce0cc4c54411242b4a9397261af6562bb29945c0eba8a5e51ed99012ba0b0ba8fe78a8f19a59ba97
SSDEEP 3:olNlWnllJ/qWWlSatuWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW2:4mn/JW0aI
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

$TEMP/CBU/ConfigurePage.ini

SHA256 bed2e6112ee01479b3c9d682c87633df0c7479a658c293860e9dfff51a198b62
MD5 14c1edc30d11230a35b25c3933e24e25
SHA1 028a205d3f8e3637955177813a08ba5064bd5e45
SHA512 8e19049627c9e4767daa8d7c16b360d070ef46d26f647c65829b633e4ad4678a1467fadac24d1a890f1606abeff4db7aafacb845c386daab80693c518e1985c3
MD5 SHA1 SHA512

$TEMP/CBU/FinishPage.ini

SHA256 de98e8ea66fc0927d9b85c43cd0ffa6592c5d49863d4d99ba28888c8fb4d933d
MD5 56aa547da787be3328dbf01a5b8dce37
SHA1 e8be3fd34fda7a87104d2ed184d2fc0a250ba1d2
SHA512 48a6e3269cbe91f2da921416ce3f4e2dbbebb2e40ca5f8b1d4b2a1570a9a2608c6ffcfcb6b5b8b0902450f442c4fbbebb4ab3565ba912fdb516c47976e3341bd
MD5 SHA1 SHA512

$TEMP/CBU/Skin.skf

SHA256 235153e93c49d94781bf34e607bc3916a21e9f5d5b94525dfa501648dbd3521f
MD5 b4e0a805f5d029d5e2c42a41a1055e2a
SHA1 a67e52a5e87e4c2706b0c671f0f420640679be5c
SHA512 2c9ae5d527ee4f8e0702455b541d43782b52b03bdd5a5ecb2a71e63a389de6cf1c12708f225bfa72bd15546106491f5dc9a274cb6a82e8aacf04b77fb0ce22d6
SSDEEP 6144:7zm9gFDFg9mm/Czm9gFDFg9mm/83/ee0CE:/PS
MD5 SHA1 SHA512 SSDEEP

$TEMP/CBU/SkinNoIcon.skf

SHA256 edcce9a73fd7baf5d1db59556b78bb5ccae7d231d95d86c75c61dfa481959abc
MD5 db6323ed94654ac4f4b0a4030daba633
SHA1 014a506b6f4498af335c5e26ef1417318d420a1f
SHA512 052064d19c151ba3e1df087e9db74670627722c28e8091387eb6a9e8fd9aaab30c6a28011233d5e5037204b348f093c485b0319cf66d1ea707de15bbe1aaa09d
SSDEEP 3072:izm9gFDFg9mm/KrTzm9gFDFg9mm/hCf1L4tcLC7:izm9gFDFg9mm/+Tzm9gFDFg9mm/oJhC7
MD5 SHA1 SHA512 SSDEEP

$TEMP/CBU/b.bmp

SHA256 548839066494decd9608b901b4aa090f739d4fb5c71c822aca42cc4685fe3086
MD5 fa6c55d7d835f4ea6d75e9f59ebfa0be
SHA1 f1ee2fcdab86a0d93764059efbb2fe9435b9290b
SHA512 daa1c0c1dae7af7f1f23c58128b3d2e1c8ddc0591330f44824aba4c482c093e3803532bb96bd2c076e4b8fc7b4c1b71a6fd5c25eb4328d8ab7b8b262eb8a1c8d
SSDEEP 96:7setnQ6HCfd0anPE1h+XMWi5D+CvXIXQKLiT99d0eU4999gIr:7+S9uMWDfiT99d0eU4999gs
MD5 SHA1 SHA512 SSDEEP

$TEMP/CBU/bottom.bmp

SHA256 aa32f3c5e9f8e6954011b0cc59efb18081d96056f46a35e2d6e53c8d1762b04a
MD5 bb8045f1a6cdcb636bd3fd6ce8565093
SHA1 02814cf5fe0e840e5f5541d9b315dd553aa09944
SHA512 1676b0c6770a60fe7354be88668a67a040cb54cb63c60f0d103129a0892b953fb9ce816655fada2e256718a8e268447cd9b1edd94a623c0e37f3a68214ce30e3
SSDEEP 3:mV1Tl2n1slkXl3lXRpcccccccccccccccccccccccccccccccccccccccccccccl:mVyn1slk1W
MD5 SHA1 SHA512 SSDEEP

$TEMP/CBU/browse.ini

SHA256 2a1272254c16c456ff58185d6f02fb32a379634ee78fc2011a5442cf2e7a5cfb
MD5 c13797c4b5950b271b063bd6b98aebf1
SHA1 f96bfa5cead9c9c677f37ebd00a1875d05592dd3
SHA512 6682b22053a22297d9fa02f3664540775507c3f06effbd64703f8b150aa7203459d5db5a94a47675ce92d341cc353034cd647b80784eb8b78bda895b3f6244b4
MD5 SHA1 SHA512

$TEMP/CBU/content.bmp

SHA256 85a2235886bf51d9c085779cbb5dbf1f1b87e173b41f3d06dcf38b60f0608f84
MD5 2fbfcac8cc6366c80b7c294a0c55aa23
SHA1 82d746841b08a8b786e752bdc00c47e7bd74d508
SHA512 3aa0554a0866185d4afc6f8174bdee273f1eb28f123a5dafe317d7670145ac1f7d85941a9c7ecb9e6ec690abc08935f5749bc14c21c5569d9a599f22114a3c9e
SSDEEP 3:E//XlWnll8EsWWlSatuWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWn:E/sn/8EtW0aI
MD5 SHA1 SHA512 SSDEEP

$TEMP/CBU/dir.bmp

SHA256 c981e019681ea9b6934f4d76f50a1f4d4093a572475ddb13b0a7380d9bdaac81
MD5 16e11f636ab1176bafc4e6317a063b91
SHA1 57a7e54e6208ad93ba8403079d05961ec93d7510
SHA512 2e3deeaae10c3d5b7aeacdada7cf7cc2554d859d89b7d93c7654819a0e564a156de39cc6deb9d48c3d04dfcedfb7f6e41c8056834d00bf25968fc7dccb77ddf3
MD5 SHA1 SHA512

$TEMP/CBU/install.bmp

SHA256 c981e019681ea9b6934f4d76f50a1f4d4093a572475ddb13b0a7380d9bdaac81
MD5 16e11f636ab1176bafc4e6317a063b91
SHA1 57a7e54e6208ad93ba8403079d05961ec93d7510
SHA512 2e3deeaae10c3d5b7aeacdada7cf7cc2554d859d89b7d93c7654819a0e564a156de39cc6deb9d48c3d04dfcedfb7f6e41c8056834d00bf25968fc7dccb77ddf3
MD5 SHA1 SHA512

$TEMP/CBU/license.bmp

SHA256 c981e019681ea9b6934f4d76f50a1f4d4093a572475ddb13b0a7380d9bdaac81
MD5 16e11f636ab1176bafc4e6317a063b91
SHA1 57a7e54e6208ad93ba8403079d05961ec93d7510
SHA512 2e3deeaae10c3d5b7aeacdada7cf7cc2554d859d89b7d93c7654819a0e564a156de39cc6deb9d48c3d04dfcedfb7f6e41c8056834d00bf25968fc7dccb77ddf3
MD5 SHA1 SHA512

$TEMP/CBU/separator.bmp

SHA256 02487e34241c0bebfdc3980df091bd109318922e849a15a0d1b5bb30e875d655
MD5 eaf3740ea0c385181dc0f8318d0aff16
SHA1 494d658137b320ca648e996c65ff1143e160f4c5
SHA512 620e51d66a62921b852ac38a66095b94286f8c975cbf8b55fd71643087ed7966b168a92599dc71de1429fd04528b095fca6838917b94df7f425a5b9e4f0c66db
SSDEEP 3:h/lvlonllv/+lt4+ltu4WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWm:hon/el7+I
MD5 SHA1 SHA512 SSDEEP

$TEMP/CBU/uninstall.bmp

SHA256 c981e019681ea9b6934f4d76f50a1f4d4093a572475ddb13b0a7380d9bdaac81
MD5 16e11f636ab1176bafc4e6317a063b91
SHA1 57a7e54e6208ad93ba8403079d05961ec93d7510
SHA512 2e3deeaae10c3d5b7aeacdada7cf7cc2554d859d89b7d93c7654819a0e564a156de39cc6deb9d48c3d04dfcedfb7f6e41c8056834d00bf25968fc7dccb77ddf3
MD5 SHA1 SHA512

$TEMP/TemporaryComodoProduct/CBU.exe

IMPHASH 80cd553338a09fb6c6debb892c8fbf32
SHA256 442f3b1a6a282dedaf4e39de36af4bcce2c0b0c145d8895c7f236bc8576c84b6
MD5 2c6d19e7d5f91b5ef322df2f30e6ad53
SHA1 2acd52bbe67614ea784899e9a96898bb2d5908ff
SHA512 d5db241a31693128199bbe588c9091c503c81b55bfdf5cb380a83f4a00a783aff3cbca25e03d3f1763f057b6f056c805d0ee093c6022baf08584f5ee3c85ec6f
SSDEEP 98304:GN8nfosYu8Ok2ZPtHGuVGSjk3pH9NOi/59xF:GN8nf9udSelKinxF
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

68:82:05:84:c7:53:fe:ae:4a:f3:a2:82:d2:de:c8:3f:91:86:12:c8

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Minor OS version

0

Major OS version

5

Entry point

4424333

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\emanu_000\Desktop\SetupCheckout\BIN\Win32\Release\GUI.pdb

kernel32

GetSystemTimeAsFileTime ExitProcess ExitThread HeapReAlloc RtlUnwind RaiseException VirtualProtect VirtualAlloc VirtualQuery SetStdHandle GetFileType HeapSize GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetStartupInfoA HeapDestroy VirtualFree QueryPerformanceCounter GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW GetFileAttributesA SetConsoleCtrlHandler LCMapStringA GetTimeFormatA GetDateFormatA GetConsoleCP GetConsoleMode GetStringTypeA GetStringTypeW GetLocaleInfoA CreateProcessA CreateFileA WriteConsoleA GetConsoleOutputCP WriteConsoleW GetCurrentDirectoryA GetDriveTypeA GetFullPathNameA FreeEnvironmentStringsA GetEnvironmentStrings SetEnvironmentVariableA LockResource LoadResource SetConsoleMode ReadConsoleInputA FlushConsoleInputBuffer GlobalMemoryStatus FindResourceW SetLastError GetLastError GetVersion LoadLibraryW GetModuleHandleW GetProcAddress InitializeCriticalSection DeleteCriticalSection MultiByteToWideChar ReleaseMutex WaitForSingleObject EnterCriticalSection LeaveCriticalSection CreateFileW FindFirstFileW FindClose FindNextFileW GetWindowsDirectoryW GetFileAttributesW SetEvent CloseHandle GetVolumeInformationW CreateDirectoryW FreeLibrary CreateThread Sleep FindFirstFileA CopyFileA DeleteFileA GetModuleFileNameW GetSystemTime OpenProcess CreateEventW GetModuleFileNameA GetCurrentThread SetThreadPriority CreateMutexW OpenMutexW WriteFile GetCommandLineW OpenEventW DeleteFileW GetExitCodeThread ResetEvent GetCurrentProcessId InitializeCriticalSectionAndSpinCount TerminateThread lstrcpynW GetVersionExW GetLocalTime TryEnterCriticalSection GetTempPathW MoveFileW MoveFileExW GetPrivateProfileSectionW GetPrivateProfileStringW InterlockedIncrement InterlockedDecrement GlobalLock GlobalUnlock GetDiskFreeSpaceW GetDiskFreeSpaceExW GlobalAlloc GlobalFree FreeResource ResumeThread VerSetConditionMask VerifyVersionInfoW GetEnvironmentVariableW WideCharToMultiByte lstrlenW lstrcpyW WaitForMultipleObjects GetExitCodeProcess FormatMessageW LocalFree LoadLibraryA GetSystemDirectoryA GetFileSize ReadFile GetCurrentProcess GetSystemInfo ExpandEnvironmentStringsW SuspendThread MulDiv HeapAlloc GetProcessHeap HeapFree GetFullPathNameW GetCurrentThreadId HeapCreate OutputDebugStringA SystemTimeToFileTime FileTimeToSystemTime GetTimeZoneInformation CreateToolhelp32Snapshot Process32FirstW Process32NextW DebugActiveProcess WaitForDebugEvent ContinueDebugEvent DebugActiveProcessStop OpenThread GetThreadContext TerminateProcess WTSGetActiveConsoleSessionId ProcessIdToSessionId GetNativeSystemInfo SetThreadExecutionState GetTickCount GetPriorityClass SetPriorityClass SetFilePointerEx SetFileAttributesW GetFileSizeEx SetFilePointer SetEndOfFile SetFileTime GetFileTime FileTimeToLocalFileTime CopyFileW DeviceIoControl QueryDosDeviceW GetLogicalDrives GetVolumePathNamesForVolumeNameW FindFirstVolumeW FindNextVolumeW GetVolumeNameForVolumeMountPointW DeleteVolumeMountPointW SetVolumeMountPointW GetDateFormatW GetTimeFormatW RemoveDirectoryW GetVolumePathNameW OpenFileMappingW MapViewOfFile UnmapViewOfFile GetFileInformationByHandle GetComputerNameW FindVolumeClose SetErrorMode DuplicateHandle FindFirstVolumeA FindNextVolumeA GetDriveTypeW BackupRead BackupSeek SetCurrentDirectoryW CreateFileMappingW DefineDosDeviceW ReadDirectoryChangesW GetOverlappedResult CancelIo GlobalSize GetVersionExA lstrcmpW CompareStringW GlobalDeleteAtom GlobalFindAtomW GlobalAddAtomW GetModuleHandleA lstrlenA InterlockedExchange CompareStringA GetLocaleInfoW lstrcmpA EnumResourceLanguagesW ConvertDefaultLocale LocalAlloc GetThreadLocale FlushFileBuffers LockFile UnlockFile GetProfileIntW GlobalGetAtomNameW TlsGetValue GlobalReAlloc GlobalHandle TlsAlloc TlsSetValue LocalReAlloc TlsFree GlobalFlags WritePrivateProfileStringW GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent SizeofResource

user32

GetWindowThreadProcessId AppendMenuW GetWindowDC PrintWindow GetLayeredWindowAttributes AdjustWindowRectEx CloseClipboard SetClipboardData EmptyClipboard OpenClipboard GetMenuItemCount UpdateWindow GetWindowLongW UnregisterClassW CreateWindowExW RegisterClassW GetClassNameW SetCursor LoadCursorW DestroyCursor CallWindowProcW PeekMessageW MsgWaitForMultipleObjects SetWindowLongW MoveWindow GetWindow GetDlgCtrlID CopyRect TranslateAcceleratorW FrameRect UpdateLayeredWindow LoadBitmapW DestroyAcceleratorTable EqualRect BringWindowToTop EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetLayeredWindowAttributes SetWindowPos EnumChildWindows GetAsyncKeyState SetWindowRgn DrawIcon ShowWindow PtInRect ScreenToClient IsZoomed FlashWindowEx GetClassLongW SetClassLongW SystemParametersInfoW RemoveMenu GetSystemMenu DestroyIcon GetClassInfoW IsIconic SetForegroundWindow FindWindowW PostQuitMessage MessageBoxW SetMenuItemBitmaps LoadImageW SetParent GetClientRect SendMessageW GetFocus DrawFocusRect InflateRect GetClassInfoExW SetScrollInfo SetCapture ReleaseCapture ShowScrollBar GetAncestor GetActiveWindow GetDesktopWindow TrackMouseEvent TabbedTextOutW DrawTextExW GrayStringW GetSysColorBrush DispatchMessageW TranslateMessage GetMessageW FindWindowExW BeginPaint EndPaint ClientToScreen ExitWindowsEx FillRect DrawTextW GetIconInfo DrawIconEx DeleteMenu SetMenuInfo GetSystemMetrics GetSysColor GetWindowRect CreatePopupMenu InsertMenuW ModifyMenuW GetKeyState RedrawWindow CheckMenuItem TrackPopupMenu MessageBoxA GetProcessWindowStation GetUserObjectInformationW GetParent EnableWindow LoadIconW PostMessageW IsWindowVisible InvalidateRect IsWindow GetCursorPos GetDC ReleaseDC SetTimer KillTimer SetRect GetNextDlgGroupItem SetWindowContextHelpId MapDialogRect UnpackDDElParam ReuseDDElParam LoadAcceleratorsW InsertMenuItemW InvalidateRgn CopyAcceleratorTableW MapWindowPoints WindowFromPoint RegisterClipboardFormatW IsRectEmpty PostThreadMessageW IsWindowEnabled GetLastActivePopup GetScrollInfo GetScrollRange SetScrollRange SetMenu ScrollWindow GetMessagePos GetMessageTime UnhookWindowsHookEx DestroyWindow GetTopWindow GetDlgItem SetActiveWindow GetForegroundWindow RemovePropW GetPropW SetPropW CallNextHookEx SetWindowsHookExW GetCapture IsChild WinHelpW SendDlgItemMessageA SendDlgItemMessageW RegisterWindowMessageW IsDialogMessageW SetWindowTextW EndDialog CreateDialogIndirectParamW EnableMenuItem GetMenuCheckMarkDimensions LoadMenuW ValidateRect ShowOwnedPopups CharUpperW SetRectEmpty GetNextDlgTabItem GetScrollPos CharNextW MessageBeep wsprintfW wsprintfA GetSubMenu GetMenuItemID GetMenuStringW GetMenuState GetMenuItemInfoW DestroyMenu SetFocus SetScrollPos GetWindowTextW GetWindowTextLengthW GetWindowPlacement SystemParametersInfoA IntersectRect OffsetRect GetMenu DefWindowProcW

gdi32

GetTextColor GetBkColor GetRgnBox GetMapMode Ellipse LPtoDP DPtoLP CreateEllipticRgn ExtSelectClipRgn ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx GetWindowExtEx GetViewportExtEx MoveToEx LineTo SetMapMode SetGraphicsMode SetStretchBltMode SetBkMode RestoreDC SaveDC CreateRectRgnIndirect SetBkColor SetTextColor GetClipBox CopyMetaFileW GetPixel CreateBitmap Escape ExtTextOutW TextOutW RectVisible PtVisible FillRgn ExcludeClipRect Rectangle CreatePen GetTextExtentPointA GetTextMetricsA CombineRgn GetStockObject CreateFontW CreatePatternBrush DeleteDC DeleteObject SelectObject CreateRoundRectRgn StretchBlt BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateFontIndirectW GetDeviceCaps CreateICW CreateSolidBrush CreateRectRgn GetTextExtentPoint32W GetObjectW

msimg32

TransparentBlt AlphaBlend

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW

advapi32

SetKernelObjectSecurity RegFlushKey RegOpenKeyExW RegisterEventSourceA ReportEventA DeregisterEventSource RegCloseKey RegOpenKeyExA RegQueryValueExA RegDeleteValueA RegSetValueExA RegQueryValueExW RegSetValueExW RegCreateKeyExW RegCreateKeyW RegDeleteValueW RegDeleteKeyW RegQueryInfoKeyW GetUserNameW RegEnumKeyExW RegSetValueW OpenProcessToken RegQueryValueW SetNamedSecurityInfoW SetTokenInformation CreateProcessAsUserW DuplicateTokenEx RevertToSelf IsValidSecurityDescriptor ChangeServiceConfig2W QueryServiceConfigW ImpersonateLoggedOnUser SetServiceStatus RegisterServiceCtrlHandlerExW DeleteService DecryptFileW EncryptFileW WriteEncryptedFileRaw ReadEncryptedFileRaw CloseEncryptedFileRaw OpenEncryptedFileRawW LookupPrivilegeValueW GetKernelObjectSecurity SetSecurityDescriptorDacl AddAccessAllowedAce InitializeAcl GetLengthSid InitializeSecurityDescriptor StartServiceW ControlService CreateServiceW QueryServiceStatusEx CloseServiceHandle OpenServiceW OpenSCManagerW FreeSid CheckTokenMembership AllocateAndInitializeSid LookupAccountSidW ConvertStringSidToSidW RegEnumKeyW ConvertSidToStringSidW IsValidSid GetTokenInformation RegOpenKeyW RegSetKeySecurity RegGetKeySecurity AdjustTokenPrivileges RegEnumValueW

shell32

SHChangeNotify SHCreateDirectoryExW SHFileOperationW ord155 ord716 SHGetDesktopFolder SHGetSpecialFolderLocation SHGetFileInfoW ExtractIconExW DragFinish DragQueryFileW SHGetFolderPathW SHAddToRecentDocs SHGetSpecialFolderPathW Shell_NotifyIconW ShellExecuteExW SHGetFolderPathA SHGetMalloc SHGetPathFromIDListW SHBrowseForFolderW ShellExecuteW

comctl32

_TrackMouseEvent ImageList_GetIcon InitCommonControlsEx

shlwapi

PathStripToRootW UrlUnescapeW PathRemoveFileSpecW PathFindExtensionW UrlEscapeW SHCreateStreamOnFileEx SHGetValueW PathFindFileNameW PathFileExistsW PathIsUNCW

oledlg

OleUIBusyW

ole32

RevokeDragDrop OleIsCurrentClipboard OleFlushClipboard CLSIDFromString CoGetClassObject StgOpenStorageOnILockBytes RegisterDragDrop OleGetClipboard OleDuplicateData CoTaskMemAlloc ReleaseStgMedium StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal CLSIDFromProgID OleUninitialize CoFreeUnusedLibraries OleInitialize CoRevokeClassObject CoRegisterMessageFilter CoSetProxyBlanket CoInitializeSecurity CoTaskMemFree StringFromGUID2 CoInitialize CreateStreamOnHGlobal CoCreateInstance CoUninitialize CoInitializeEx CoCreateGuid CoLockObjectExternal

oleaut32

OleCreateFontIndirect SafeArrayDestroy SafeArrayCreate SafeArrayGetDim SafeArrayGetElemsize SafeArrayGetLBound SafeArrayGetUBound SafeArrayAccessData SafeArrayUnaccessData VariantCopy SysAllocStringLen SafeArrayDestroyData VariantChangeType VariantClear VariantInit SysStringLen OleLoadPicture SysAllocString VarUdateFromDate SysFreeString SystemTimeToVariantTime VariantTimeToSystemTime

urlmon

URLDownloadToFileW

dbghelp

MiniDumpWriteDump

setupapi

SetupDiCreateDeviceInfoListExW SetupDiGetClassDevsExW SetupDiClassGuidsFromNameExW SetupDiGetDeviceRegistryPropertyW SetupDiSetDeviceRegistryPropertyW SetupDiCreateDeviceInfoW SetupDiCreateDeviceInfoList SetupDiGetINFClassW SetupDiGetDeviceInstallParamsW SetupDiCallClassInstaller SetupDiSetClassInstallParamsW CM_Get_Device_ID_ExW SetupDiGetDeviceInfoListDetailW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW SetupDiGetDeviceInterfaceDetailW SetupDiOpenDeviceInfoW SetupDiEnumDeviceInfo SetupOpenInfFileW SetupOpenFileQueue SetupCloseInfFile SetupInitDefaultQueueCallbackEx SetupCloseFileQueue SetupInstallFilesFromInfSectionW SetupCommitFileQueueW SetupDefaultQueueCallbackW SetupInstallFromInfSectionW SetupInstallServicesFromInfSectionW

mpr

WNetCancelConnectionW WNetCancelConnection2W WNetOpenEnumW WNetEnumResourceW WNetCloseEnum WNetAddConnection2W

netapi32

NetApiBufferFree NetServerEnum

ws2_32

connect htons getservbyname htonl gethostbyname getservbyport gethostbyaddr WSAGetLastError inet_ntoa send WSAStartup socket WSACleanup ntohs closesocket inet_addr recv gethostname WSASetLastError

winhttp

WinHttpWriteData WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpSetOption WinHttpGetProxyForUrl WinHttpSetStatusCallback WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpConnect WinHttpCloseHandle WinHttpOpen

wininet

InternetSetOptionExW InternetQueryOptionW InternetCanonicalizeUrlW InternetCrackUrlW FtpRenameFileW InternetCheckConnectionA HttpSendRequestW HttpOpenRequestW FtpRemoveDirectoryW FtpCreateDirectoryW FtpGetFileSize InternetGetLastResponseInfoW FtpPutFileW FtpDeleteFileW InternetConnectW InternetWriteFile InternetFindNextFileW FtpFindFirstFileW InternetCheckConnectionW InternetReadFile InternetOpenUrlW HttpQueryInfoW InternetSetStatusCallbackW InternetSetFilePointer InternetQueryDataAvailable InternetCloseHandle FtpOpenFileW InternetGetConnectedState DeleteUrlCacheEntryW InternetOpenW

gdiplus

GdiplusStartup GdiplusShutdown GdipCreateBitmapFromStream GdipFree GdipAlloc GdipCloneImage GdipDisposeImage GdipCreateHBITMAPFromBitmap GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetTextRenderingHint GdipCreateStringFormat GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipCreateFont GdipGetGenericFontFamilySansSerif GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipMeasureString GdipDrawString GdipDeleteFont GdipCreateLineBrushFromRectI GdipFillRectangleI GdipCreatePen1 GdipDeletePen GdipDrawLineI GdipDrawRectangleI GdipReleaseDC GdipGetDC GdipSetStringFormatTrimming GdipFillRectangle GdipGetFamily GdipCreatePath GdipDeletePath GdipAddPathString GdipGetFontSize GdipGetFontStyle GdipSetPenLineJoin GdipDrawPath GdipAddPathRectangle GdipAddPathArcI GdipClosePathFigure GdipCreateHatchBrush GdipFillPath GdipImageSelectActiveFrame GdipDrawImageRectI GdipLoadImageFromStream GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipGetPropertyItemSize GdipGetPropertyItem GdipGetPageUnit GdipSetPageUnit GdipSetPenMode GdipSetStringFormatFlags GdipCreateLineBrushFromRectWithAngleI GdipAddPathLineI GdipFillPie GdipDrawPie GdipSetSolidFillColor GdipDeleteStringFormat GdipResetPath GdipGraphicsClear GdipAddPathPolygonI GdipAddPathEllipseI GdipCreatePathGradientFromPath GdipSetPathGradientCenterColor GdipSetPathGradientSurroundColorsWithCount GdipGetPathGradientPointCount GdipSetPathGradientBlend GdipAddPathArc GdipAddPathLine GdipDrawArcI GdipCreateLineBrushFromRect GdipCreateLineBrushFromRectWithAngle GdipFillEllipseI GdipDrawEllipseI GdipDrawLine

wsock32

inet_ntoa setsockopt shutdown getsockopt

fltlib

FilterDetach FilterAttach FilterSendMessage FilterConnectCommunicationPort FilterLoad

wtsapi32

WTSQueryUserToken

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

crypt32

CertAddEncodedCertificateToStore CertOpenStore CertCloseStore

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

??0CBUScriptParser@@QAE@PA_W@Z ??0CDiscFormatData@@QAE@XZ ??0CDiscRecorder@@QAE@XZ ??0UpdateService@@QAE@QA_W0@Z ??0WindowsServiceBase@@QAE@QA_W0@Z ??0_BACKUP_CREATE@@QAE@XZ ??0_BACKUP_RESTORE@@QAE@XZ ??0_CBU_HISTORY_MANAGER@@QAE@P6AXPAXU_CBU_HISTORY_ID@@@Z020@Z ??0_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAE@P6AXPAXU_CBU_SCHEDULE_ID@@@Z0P6AX0U_CBU_PROFILE_ID@@@Z020402040E@Z ??0_NETWORK_BROWSER_CLASS@@QAE@XZ ??1CBUScriptParser@@QAE@XZ ??1CDiscFormatData@@QAE@XZ ??1CDiscRecorder@@QAE@XZ ??1UpdateService@@UAE@XZ ??1WindowsServiceBase@@UAE@XZ ??1_BACKUP_CREATE@@QAE@XZ ??1_BACKUP_RESTORE@@QAE@XZ ??1_CBU_HISTORY_MANAGER@@QAE@XZ ??1_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAE@XZ ??1_COS_CLIENT_OPERATION_CONTROLLER@@QAE@XZ ??1_NETWORK_BROWSER_CLASS@@QAE@XZ ??_FUpdateService@@QAEXXZ ?AbortBackup@_BACKUP_CREATE@@QAEHE@Z ?AbortCheckThread@@YAXPAX@Z ?AbortRecovery@_BACKUP_RESTORE@@QAEHE@Z ?AccessEncryptFile@@YAHPA_WU_BY_HANDLE_FILE_INFORMATION@@PAU_BACKUP_CONTEXT@@PAU_BACKUP_PROGRESS_NEW@@PCHH@Z ?AccessFileRaw@@YAHPAXU_BY_HANDLE_FILE_INFORMATION@@PAU_BACKUP_CONTEXT@@PAU_FILE_BACKUP_VOLUME_INFO@@PAEPAU_BACKUP_PROGRESS_NEW@@PCHPAU_CORE_LOG_HANDLE@@H@Z ?AccessReparsePoint@@YAHPAXPAU_BACKUP_CONTEXT@@PAU_BACKUP_PROGRESS_NEW@@PCHH@Z ?AccessSparseFile@@YAHPAXU_BY_HANDLE_FILE_INFORMATION@@PAU_BACKUP_CONTEXT@@PAEPAU_BACKUP_PROGRESS_NEW@@PCHH@Z ?AccessSparseFileExt@@YAHPAXPAU_FS_FILE_INFO@@PAU_BACKUP_CONTEXT@@PAU_BACKUP_PROGRESS_NEW@@PCHH@Z ?AcquireExclusiveAccess@CDiscRecorder@@QAEHEPA_W@Z ?ActivateCBWLicense@@YAHPA_W00PAPA_W@Z ?AddBackupIDToRunQueue@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHW4_SCHEDULER_AND_PROFILE_MANAGER_ID_TYPE@@PAX@Z ?AddBackupToHistory@_CBU_HISTORY_MANAGER@@QAEHPAV_BACKUP_CREATE@@U_SYSTEMTIME@@1_K2HPAU_CBU_PROFILE_ID@@PAU_CBU_HISTORY_ID@@@Z ?AddInWriteList@@YAHPAPAPA_WPA_KPA_W@Z ?AddKeysToFlush@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@@Z ?AddKeysToFlush@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHPA_W0@Z ?AddNetworkConnection@@YAHPA_WPAU_CONNECTION_INFORMATIONS_@@@Z ?AddPendingOperation@@YAHPA_W@Z ?AddProfileBackup@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHPAV_BACKUP_CREATE@@EEPA_WW4_CBU_GUI_RUN_MODE@@EPAU_CBU_PROFILE_ID@@E@Z ?AddRemountBackup@@YAHXZ ?AddRestoreToHistory@_CBU_HISTORY_MANAGER@@QAEHPAV_BACKUP_RESTORE@@U_SYSTEMTIME@@1HPAU_CBU_HISTORY_ID@@@Z ?AddRunInfoForProfile@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAU_SYSTEMTIME@@PAH@Z ?AddRunInfoForSchedule@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_SCHEDULE_ID@@PAU_SYSTEMTIME@@PAH@Z ?AddScheduledBackup@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@EU_SYSTEMTIME@@GGI_KPA_W3E2PAU_CBU_SCHEDULE_ID@@E@Z ?AddScheduledTask@@YAHEU_SYSTEMTIME@@GGIPA_W1111111EK@Z ?AddSystemTimes@@YAHPAU_SYSTEMTIME@@00@Z ?AddToDate_Milliseconds@@YAHPAU_SYSTEMTIME@@0_K@Z ?AddToDate_Seconds@@YAHPAU_SYSTEMTIME@@0_K@Z ?AllocateWithLineAndFileTag@@YAPAXKKPAD0E@Z ?AlternativeBrowsing@@YAKPAU_ALTERNATIVE_NETWORK_BROWSING_CONTEXT@@@Z ?ApiStatusToText@@YAPA_WH@Z ?AppendCosExclusionFilters@@YAHPAPAPA_WPAK@Z ?ArchiveEngineCompressBuffer@@YAHW4_COMPRESSION_LEVEL@@PAEPAXK2PAK@Z ?ArchiveEngineCompressBufferNonPaged@@YAHW4_COMPRESSION_LEVEL@@PAEPAXK2PAK@Z ?ArchiveEngineCompressBufferPaged@@YAHW4_COMPRESSION_LEVEL@@PAEPAXK2PAK@Z ?ArchiveEngineDecompressBuffer@@YAHPAXK0PAK@Z ?ArchiveEngineDecompressBufferNonPaged@@YAHPAXK0PAK@Z ?ArchiveEngineDecompressBufferPaged@@YAHPAXK0PAK@Z ?AreConnectionInfoRequired@@YAHW4_BACKUP_STORAGE_DESTINATION_TYPE@@PAE@Z ?ArpBrowsing@@YAKPAU_ARP_BROWSING_CONTEXT@@@Z ?AutoSuggest_GetDestinationPathType@@YAHPA_WPAW4_BACKUP_STORAGE_DESTINATION_TYPE@@@Z ?BackupFileFillZero@@YAHPA_WPAU_BACKUP_CONTEXT@@PAU_BACKUP_PROGRESS_NEW@@PCHPAU_CORE_LOG_HANDLE@@H@Z ?BackupFileSystem@@YAHPA_WPAU_BACKUP_CONTEXT@@PAU_BACKUP_PROGRESS_NEW@@PCHPAU_CORE_LOG_HANDLE@@H@Z ?BackupItemSACLsandDACLs@@YAHPAU_FILES_AND_DIRS_TREE_ITEM@@PA_W@Z ?BrowseGlobalNetwork@@YAKPAU_GLOBAL_NETWORK_CONTEXT@@@Z ?BrowseNetwork@@YAKPAU_NETWORK_CONTEXT@@@Z ?BrowseWorkgroup@@YAKPAU_WORKGROUP_CONTEXT@@@Z ?BuildAllAccessSD@@YAPAXPAX@Z ?BuildAutomatedWinPeEnvironment@@YAHQAXPAEP6AHPAU_IMAPI_UPDATE_PROGRESS_INFO@@@ZP6AHH@Z1@Z ?BuildBrowserBackupScriptW@@YAHPAPA_WPAU_FLAGS_BACKUP_BROWSER_CLIENT@@@Z ?BuildBrowserRestoreScriptW@@YAHPAPA_WPAU_FLAGS_RESTORE_BROWSER_CLIENT@@@Z ?BuildFullInstantScanSourcePath@@YAHPAU_BACKUP_CREATE_INFORMATION_DATA@@@Z ?BuildRestrictedSD@@YAPAXPAX@Z ?Burn@CDiscFormatData@@QAEHPAUIStream@@P6AHPAU_IMAPI_UPDATE_PROGRESS_INFO@@@Z@Z ?CAM_account_is_free@@YAHPA_W0PAE@Z ?CBUAutoComplete@@YAHPA_WW4_BACKUP_STORAGE_DESTINATION_TYPE@@PAPAPA_WPAK0EPCHPAPAXE@Z ?CBUAutoSuggest@@YAHW4_BACKUP_TYPE@@W4_BACKUP_SOURCE_TYPE@@W4_BACKUP_STORAGE_DESTINATION_TYPE@@W4_BACKUP_FORMAT_TYPE@@PAXKPA_WPAPA_WE55@Z ?CBUAutoSuggestNew@@YAHPAV_BACKUP_CREATE@@PAPA_WPA_W@Z ?CBUBackupChangePassword@@YAHW4_BACKUP_STORAGE_DESTINATION_TYPE@@PA_WPAU_CONNECTION_INFORMATIONS_@@PAU_PROXY_@@PAXK4KE01231@Z ?CBUCheckIfPartitionMounted@@YAH_WPAE@Z ?CBUConvertDiskSourcePath@@YAHPAXKPAU_VERSION_INFO@@PAPAXPAK@Z ?CBUDecryptSavedData@@YAHPAXKPAU_CBU_MOUNTED_IMAGE_SAVED_INFO@@@Z ?CBUDeserializeSavedData@@YAHPAEKPAU_CBU_MOUNTED_IMAGE_SAVED_INFO@@@Z ?CBUEncryptSavedData@@YAHPAU_CBU_MOUNTED_IMAGE_SAVED_INFO@@PAPAXPAK@Z ?CBUGetBuildCount@@YAHXZ ?CBUGetDataValueFromKey@@YAHPA_W0PAPA_W@Z ?CBUGetEndUserVersionWithBuildNumber@@YAHPA_WPAPA_W@Z ?CBUGetEndUserVersionWithoutBuildNumber@@YAHPA_WPAPA_W@Z ?CBUGetInfoAboutMountedBackup@@YAHPA_WPAU_CBU_MOUNTED_IMAGE_SAVED_INFO@@@Z ?CBUGetInfoAboutMountedBackupByDriveLetter@@YAH_WPAU_CBU_MOUNTED_IMAGE_SAVED_INFO@@PAPA_W@Z ?CBUGetMajorVersion@@YAHXZ ?CBUGetMappedNetworkDrivesLettersFromRegistry@@YAHPAPA_WPAK@Z ?CBUGetMappedNetworkDrivesLettersFromWMI@@YAHPAPA_WPAK@Z ?CBUGetMinorVersion@@YAHXZ ?CBUGetNoOfJobs@@YAHPA_K@Z ?CBUGetReleaseNo@@YAHXZ ?CBUGetViableDriveLetter@@YAHPA_W@Z ?CBUGetXViableDriveLetters@@YAH_KPA_W@Z ?CBULoadMountedInformations@@YAHPAPAPA_WPA_K@Z ?CBUPlugInPartition@@YAHPAU_CBU_IMAGE_MOUNTING_INFO@@_WPAU_BACKUP_PROGRESS_NEW@@@Z ?CBURemoveMountedBackupFromTheRegistry@@YAHPA_W_W@Z ?CBUSaveMountInformations@@YAHPAU_CBU_MOUNTED_IMAGE_SAVED_INFO@@PA_W@Z ?CBUSerializaSavedData@@YAHPAU_CBU_MOUNTED_IMAGE_SAVED_INFO@@PAPAEPAK@Z ?CBUUnplugPartition@@YAH_WPAU_BACKUP_PROGRESS_NEW@@@Z ?CBUVBUSPlugDevice@@YAHPAU_CBU_IMAGE_MOUNTING_INFO@@PAXPAU_SP_DEVICE_INTERFACE_DATA@@PA_KPAU_BACKUP_PROGRESS_NEW@@3@Z ?CBUVBUSUnplugDevice@@YAH_KPAXPAU_SP_DEVICE_INTERFACE_DATA@@PAU_BACKUP_PROGRESS_NEW@@@Z ?CLPS_CheckIfHasSid@@YAHPAE@Z ?CLPS_Download@@YAHPAU_CBU_DOWNLOAD_CLPS_CONTEXT@@@Z ?CLPS_GEEKBUDDY_CheckIfInstalled@@YAHPAE0@Z ?CLPS_GEEKBUDDY_Install@@YAHPAU_CBU_DOWNLOAD_CLPS_CONTEXT@@@Z ?CLPS_GEEKBUDDY_Launch@@YAHPA_W@Z ?CLPS_GEEKBUDDY_LoadLib@@YAHPAPAUHINSTANCE__@@@Z ?COSAdvancedSearch@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHPA_W0PAPAUfs_entity_ex_shared@@PA_KIPCH@Z ?COSCalculateLocalPathProgressSize@@YAHPA_WPA_K1PCHH@Z ?COSCalculateRemotePathProgressSize@@YAHPA_WEHPA_KPCH@Z ?COSCheckDriveState@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHPAEPADPCH@Z ?COSCleanupCobFile@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHHPCH@Z ?COSClientGetBuildCount@@YAHXZ ?COSClientGetMajorVersion@@YAHXZ ?COSClientGetMinorVersion@@YAHXZ ?COSClientGetReleaseNo@@YAHXZ ?COSClientLowDiskSpaceDisplayNotification@@YAH_KPA_W@Z ?COSClientRQDestroy@@YAHXZ ?COSClientRQDisplayNotification@@YAHIHKPAE@Z ?COSClientRQFinishProcessing@@YAHPAU_COS_CLIENT_RQ_HANDLES@@PAPAU_COS_CLIENT_RQ_SHARED_MEM_STRUCT@@@Z ?COSClientRQInitialize@@YAHXZ ?COSClientRQNotifyItemProcessed@@YAHPAU_COS_CLIENT_RQ_HANDLES@@PAU_CBU_PROFILE_ID@@PAT_LARGE_INTEGER@@PAU_SIMPLE_COPY_ITEM_INFO@@@Z ?COSClientRQNotifySyncStateChanged@@YAHW4_SYNC_STATE@@PAU_CBU_PROFILE_ID@@@Z ?COSClientRQReinitializeSyncFolder@@YAHPAU_CBU_PROFILE_ID@@@Z ?COSClientRQReinitializeSyncFolderAsync@@YAHPAU_CBU_PROFILE_ID@@@Z ?COSClientRQShouldProcessRequest@@YAEPAU_COS_CLIENT_RQ_HANDLES@@@Z ?COSCloseFile@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHHPCH@Z ?COSCopyFiles@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHPAU_CopyParams@@_KPCH@Z ?COSCreateFile@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHHHHHPA_WPAHPCH@Z ?COSDeleteFile@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHPA_WPCH@Z ?COSEncryptPassword@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHPA_WPAPA_WPCH@Z ?COSFileShare@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHPA_W0PAPA_WPCH@Z ?COSFileUnshare@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHPA_WPCH@Z ?COSForceRefreshCacheTree@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHH_KPCH@Z ?COSGetAccountState@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHPAW4_COS_ACCOUNT_STATE@@PAEPCH@Z ?COSGetBandwidth@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHPA_K0PCH@Z ?COSGetDiskStat@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHPA_K0PCH@Z ?COSGetEndOfFile@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHHPAEPCH@Z ?COSGetExpirationDate@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHPAU_SYSTEMTIME@@PCH@Z ?COSGetFileDates@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHPA_WPAU_SYSTEMTIME@@1PCH@Z ?COSGetFileOffset@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHHPA_KPCH@Z ?COSGetFileSize@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHPA_WPA_KPCH@Z ?COSGetFileWinAttr@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHPA_WPAKPCH@Z ?COSGetLoggedInUsers@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHPAPAHPAPAPA_WPAKPCH@Z ?COSGetNetworkSpeeds@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHPAK0PCH@Z ?COSGetRegistrationDate@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHPAU_SYSTEMTIME@@PCH@Z ?COSGetSessionAsString@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHPAPA_WPCH@Z ?COSList@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHPA_WPAPAXPA_KPCH@Z ?COSListShares@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHPAPAXPA_KPCH@Z ?COSLoginRequest@@YAHPA_W00EPAHPCH@Z ?COSLoginRequest@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHPA_W00EPAHPCH@Z ?COSLogoutRequest@@YAHHPCH@Z ?COSLogoutRequest@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHPCHE@Z ?COSMkDirectory@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHPA_WPCH@Z ?COSMountDrive@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHPADPCH@Z ?COSMoveFile@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHPA_W0PCH@Z ?COSMoveFileByHandle@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHHPA_WPCH@Z ?COSPathIsDirectory@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHPA_WPAEPCH@Z ?COSQueryFiles@@YAHPAU_COS_FILE_BACKUP_CTX@@PAU_CONNECTION_INFORMATIONS_@@PA_W_KPAPAXPAIPCH@Z ?COSQueryFiles@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHPA_W_KPAPAXPA_KPCH@Z ?COSReadFile@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHHPAPAE_KPA_KPCH@Z ?COSReadFileWithOffset@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHHPAPAE_KPA_K1PCH@Z ?COSRestoreLoginRequest@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHPA_WHPCH@Z ?COSSetAccountState@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHW4_COS_ACCOUNT_STATE@@EPCH@Z ?COSSetBandwidth@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHPA_K0PCH@Z ?COSSetEndOfFile@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHHPCH@Z ?COSSetFileDates@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHPA_WU_SYSTEMTIME@@1PCH@Z ?COSSetFileDispositionInformation@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHHEPCH@Z ?COSSetFilePointer@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHHH_KPCH@Z ?COSSetFileWinAttr@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHPA_WKPCH@Z ?COSSvcConfigFailActions@@YAXXZ ?COSUnmountDrive@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHPCH@Z ?COSWriteFile@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHHPAE_KPA_KPCH@Z ?COSWriteFileWithOffset@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHHPAE_KPA_K1PCH@Z ?COS_OP_CloseFile@@YAHHPAHPCH@Z ?COS_OP_CreateFile@@YAHHHHHHPA_WPAHPCH@Z ?COS_OP_Delete@@YAHHPA_WPCH@Z ?COS_OP_GetDiskStat@@YAHHPA_K0PCH@Z ?COS_OP_GetEndOfFile@@YAHHPAHPAEPCH@Z ?COS_OP_GetFileDates@@YAHHPA_WPAU_SYSTEMTIME@@1PCH@Z ?COS_OP_GetFileOffset@@YAHHPAHPA_KPCH@Z ?COS_OP_GetFileSize@@YAHHPA_WPA_KPCH@Z ?COS_OP_GetFileWinAttr@@YAHHPA_WPAKPCH@Z ?COS_OP_List@@YAHHPA_WPAPAXPAIPCH@Z ?COS_OP_List_Ex@@YAHHPA_W0PAPAUfs_entity_ex_shared@@PAIKPCH@Z ?COS_OP_MkDirectory@@YAHHPA_WPCH@Z ?COS_OP_MkDirectoryEx@@YAHHPA_WPCH@Z ?COS_OP_Move@@YAHHPA_W0PCH@Z ?COS_OP_PathIsDirectory@@YAHHPA_WPAEPCH@Z ?COS_OP_Query_Files@@YAHHPA_W_KPAPAXPAIPCH@Z ?COS_OP_ReadFile@@YAHHPAHPAPAE_KPA_KPCH@Z ?COS_OP_ReadFileWithOffset@@YAHHPAH_KPAPAE1PA_KPCH@Z ?COS_OP_SetEndOfFile@@YAHHPAHPCH@Z ?COS_OP_SetFileDates@@YAHHPA_WU_SYSTEMTIME@@1PCH@Z ?COS_OP_SetFilePointer@@YAHHPAH0_KPCH@Z ?COS_OP_SetFileWinAttr@@YAHHPA_WKPCH@Z ?COS_OP_WriteFile@@YAHHPAHPAE_KPA_KPCH@Z ?COS_OP_WriteFileWithOffset@@YAHHPAH_KPAE1PA_KPCH@Z ?CVDBUSDeserializePlugInInputBuffer@@YAHPAEKPAU_VDBUS_PLUGIN_HARDWARE@@@Z ?CVDBUSDeserializeUnPlugInputBuffer@@YAHPAEKPAU_VDBUS_UNPLUG_HARDWARE@@@Z ?CVDBUSSerializePlugInInputBuffer@@YAHPAU_VDBUS_PLUGIN_HARDWARE@@PAPAEPAK@Z ?CVDBUSSerializeUnPlugInputBuffer@@YAHPAU_VDBUS_UNPLUG_HARDWARE@@PAPAEPAK@Z ?CalculateFreeMemoryPaged@@YAHPAK@Z ?CalculateNextRunTimeForScheduleID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_SCHEDULE_ID@@PAU_SYSTEMTIME@@1@Z ?CalculateRegPathProgressUnits@@YAHPA_WEPA_K@Z ?Calculate_Path_Progress_Size@@YAHPA_WAA_KPCHH_K@Z ?CanEstablishNetConnection@@YAHPAD@Z ?CanPauseResume@_BACKUP_CREATE@@QAEHPAE@Z ?ChangeCurrentUserSyncFolder@@YAHPA_W0@Z ?ChangeDetectorThread@_CBU_HISTORY_MANAGER@@QAEHXZ ?ChangeDetectorThread@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHXZ ?ChangeRestoreDetails@_BACKUP_RESTORE@@QAEHPA_KPAEPAPA_WPAW4_CORE_LOGGING_MODE@@PAW4_BACKUP_PRIORITY_LEVEL@@4PAW4_OPERATION_AFTER_RESTORE_IS_FINISHED@@11@Z ?ChangeVolumeDriveLetter@@YAH_W0@Z ?ChangesFlusherThread@_CBU_HISTORY_MANAGER@@QAEHXZ ?ChangesFlusherThread@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHXZ ?CheckActivePartitionRestoration@@YAHPAX0W4ActiveStatusRestorationType@@PAE@Z ?CheckAndAddToQueueTasksThatWereMissed@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHP6AEU_CBU_SCHEDULE_ID@@@Z@Z ?CheckApiStatusForRestartService@@YAEH@Z ?CheckBackupFormat@@YAHW4_BACKUP_FORMAT_TYPE@@PAPA_W@Z ?CheckCBReparseDriverFunctionality@@YAHXZ ?CheckCBReparseDriverFunctionalityEx@@YAHXZ ?CheckCBVDBusDriverFunctionality@@YAHXZ ?CheckCBVDDriverFunctionality@@YAHXZ ?CheckCOSServiceVersion@@YAHPAPA_W0PAD@Z ?CheckCosLogInState@@YAHPA_W00PAEPAH@Z ?CheckCurrentOpticalMedia@@YAHPAU_OPTICAL_MEDIA_IMAPI_RECORDER_CONTEXT@@PAW4_IMAPI_FORMAT2_DATA_MEDIA_STATE@@PAW4_IMAPI_MEDIA_PHYSICAL_TYPE@@PAPA_W@Z ?CheckDiskDefaultLocation@@YAHPAXKPAE@Z ?CheckDiskDriverFunctionality@@YAHXZ ?CheckFileSystemDriverFunctionality@@YAHXZ ?CheckFilesInUse@@YAHPA_WE@Z ?CheckForRestart@@YAHPAE@Z ?CheckIfDirectoryExists@@YAHPA_WPAH@Z ?CheckIfDriveIsCbuMountedDrive@@YAHDPA_N@Z ?CheckIfFileExists@@YAHPA_WPAE@Z ?CheckIfFileIsDeletePending@@YAHPA_WPAH@Z ?CheckIfFileItemIsReadable@@YAHPAEPA_WPAW4_LOCKED_FILES_TREATMENT_@@@Z ?CheckIfFolderExists@@YAHPA_WPAE@Z ?CheckIfMediaCanBeErased@@YAHPAU_OPTICAL_MEDIA_IMAPI_RECORDER_CONTEXT@@PAE@Z ?CheckIfSessionIsValid@@YAEH@Z ?CheckIfSkypeProfileDirectory@@YAHPA_WPAE@Z ?CheckIfWFPSInstalled@@YAHEPAE@Z ?CheckNetworkConnection@@YAHXZ ?CheckPartitionDefaultLocation@@YAHPAU_NEW_FLAGS_PARTITION_BACKUP_EX@@PAPAEPAH@Z ?CheckPathIfExists@@YAHPA_W@Z ?CheckServiceIsRunning@@YAHPA_WPAE@Z ?CheckSourceType@@YAHW4_BACKUP_SOURCE_TYPE@@PAPA_W@Z ?CheckTokenSystemPrivileges@@YAHPAXPAE@Z ?CheckValidChar@@YAEPAD@Z ?CkeckIfAllItemsInTreeAreSkipped@@YAHPAU_FILES_AND_DIRS_TREE_ITEM@@@Z ?CleanFSVector@@YAHPAU_FSVECTOR@@@Z ?CleanupVC2008RedistributableMess@@YAHXZ ?ClearAllEvents@_CBU_HISTORY_MANAGER@@QAEHE@Z ?ClearAllNativeJobs@@YAHXZ ?ClearBackupConnectionInformations@_BACKUP_CREATE@@QAEXXZ ?ClearBackupDescription@_BACKUP_CREATE@@QAEXXZ ?ClearBackupDestinationPath@_BACKUP_CREATE@@QAEXXZ ?ClearBackupEmailNotificationInformations@_BACKUP_CREATE@@QAEXXZ ?ClearBackupExclusionFilters@_BACKUP_CREATE@@QAEXXZ ?ClearBackupInclusionFilters@_BACKUP_CREATE@@QAEXXZ ?ClearBackupLogfileName@_BACKUP_CREATE@@QAEXXZ ?ClearBackupOpticalDiskDestinationInformation@_BACKUP_CREATE@@QAEXXZ ?ClearBackupParentConnectionInformations@_BACKUP_CREATE@@QAEXXZ ?ClearBackupParentDestinationPath@_BACKUP_CREATE@@QAEXXZ ?ClearBackupPassword@_BACKUP_CREATE@@QAEXXZ ?ClearBackupSourcePath@_BACKUP_CREATE@@QAEXXZ ?ClearBackupTaskToRunAfter@_BACKUP_CREATE@@QAEXXZ ?ClearBackupTaskToRunBefore@_BACKUP_CREATE@@QAEXXZ ?ClearConnectionInformation@_BACKUP_RESTORE@@QAEHXZ ?ClearFSVector@@YAHPAU_FSVECTOR@@@Z ?ClearLogFileName@_BACKUP_RESTORE@@QAEXXZ ?ClearPassword@_BACKUP_RESTORE@@QAEHXZ ?ClearProxyInformation@_BACKUP_RESTORE@@QAEHXZ ?CloseFtpConnection@@YAXPAPAX0@Z ?CollectionContainsSubkey@@YAHPA_WPAPA_WK@Z ?CompareOldTreeElementMethod@@YAHPAX0@Z ?CompareStringPath@@YAHPA_W0H@Z ?CompareTreeElementMethod@@YAHPAX0@Z ?ConnectToFTP@@YAHPAU_PROXY_@@PAU_CONNECTION_INFORMATIONS_@@PAPAX2@Z ?ConvertBackupDiskInformationForNewestVersion@@YAHPAU_VERSION_INFO@@PAXPAPAX@Z ?ConvertBackupPartitionInformationForNewestVersion@@YAHPAU_VERSION_INFO@@PAXPAPAXPAK@Z ?ConvertFormatFromWCharToChar@@YAHPA_WPAD@Z ?ConvertKeyValueData@@YAHPAEKKKKPA_WK@Z ?ConvertNewTreeToOldTree@@YAHPAU_FILES_AND_DIRS_TREE_ITEM@@PAPAU_FILE_SYSTEM_TREE@@@Z ?ConvertRegValToREG_BINARY@@YAHPAEKKKKPA_W@Z ?ConvertRegValToREG_DWORD@@YAHPAEKKPA_W@Z ?ConvertRegValToREG_EXPAND_SZ@@YAHPAEKKKKPA_W@Z ?ConvertRegValToREG_LINK@@YAHPAEKKPA_W@Z ?ConvertRegValToREG_MULTI_SZ@@YAHPAEKKKKPA_W@Z ?ConvertRegValToREG_QWORD@@YAHPAEKKPA_W@Z ?ConvertRegValToREG_SZ@@YAHPAEKKPA_W@Z ?CopyAndAllocConnectionAndProxyInformations@@YAHPAU_CONNECTION_INFORMATIONS_@@PAU_PROXY_@@PAPAU1@PAPAU2@@Z ?CopyAndAllocEmailNotificationInformation@@YAHPAU_BACKUP_EMAIL_NOTIFICATION_INFORMATION@@PAPAU1@@Z ?CopyConnectionInformations@@YAHPAU_CONNECTION_INFORMATIONS_@@PAPAU1@@Z ?CopyEmailInformations@@YAHPAU_EMAIL_INFORMATIONS@@PAPAU1@@Z ?CopyEmailNotificationInformation@@YAHPAU_BACKUP_EMAIL_NOTIFICATION_INFORMATION@@0@Z ?CopyOpticalDiskDestinationInformations2@@YAHPAU_OPTICAL_DESTINATION_INFORMATIONS@@0@Z ?CopyOpticalDiskDestinationInformations@@YAHPAPAU_OPTICAL_DESTINATION_INFORMATIONS@@PAU1@@Z ?CopyProxyInformations@@YAHPAU_PROXY_@@PAPAU1@@Z ?CoreAdjustTokenPrivileges@@YAHPAXPA_WH@Z ?CoreBuildFullPahFromShortPath@@YAHPA_WPAPA_W@Z ?CoreCharToWchar@@YAHPBDPA_W@Z ?CoreCloseEncryptedFileRaw@@YAHPAX@Z ?CoreCloseEvent@@YAHPAU_CORE_EVENT@@@Z ?CoreCloseFile@@YAHPAU_CORE_FILE_HANDLE@@@Z ?CoreCloseLog@@YAHPAU_CORE_LOG_HANDLE@@@Z ?CoreCloseMutex@@YAHPAU_CORE_MUTEX@@@Z ?CoreCloseThreadHandle@@YAHPAU_CORE_THREAD_HANDLE@@@Z ?CoreCloseTokenHandle@@YAHPAPAX@Z ?CoreCreateDirectory@@YAHPA_W@Z ?CoreCreateDirectoryEx@@YAHPA_W@Z ?CoreCreateEvent@@YAHPAU_CORE_EVENT@@@Z ?CoreCreateEventEx@@YAHPAU_CORE_EVENT@@PA_WE@Z ?CoreCreateFile@@YAHPAU_CORE_FILE_HANDLE@@PA_WKKW4_CORE_FILE_CREATE_DISPOSITION@@K@Z ?CoreCreateFileEx@@YAHPAU_CORE_FILE_HANDLE@@PA_WKKW4_CORE_FILE_CREATE_DISPOSITION@@KPAXKKEE@Z ?CoreCreateFileNoVirtual@@YAHPAU_CORE_FILE_HANDLE@@PA_WKKW4_CORE_FILE_CREATE_DISPOSITION@@K@Z ?CoreCreateMutex@@YAHPAU_CORE_MUTEX@@@Z ?CoreCreateMutexEx@@YAHPAU_CORE_MUTEX@@PA_W@Z ?CoreCreatePendingOpsListRegistryKey@@YAHPAU_CORE_KEY_HANDLE@@@Z ?CoreCreateProcessAsUser@@YAHPA_WPAKH@Z ?CoreDebugPrintA@@YAXPADKW4_CORE_LOG_LEVEL@@0ZZ ?CoreDebugPrintW@@YAXPADKW4_CORE_LOG_LEVEL@@PA_WZZ ?CoreDecryptFile@@YAHPA_WK@Z ?CoreDeleteFile@@YAHPA_W@Z ?CoreDeviceIoControl@@YAHPAU_CORE_FILE_HANDLE@@KPAXK1KPAK@Z ?CoreDismountAllHardDiskVolumes@@YAHXZ ?CoreDownloadUrlToFile@@YAHPA_W0EE@Z ?CoreEncryptFile@@YAHPA_W@Z ?CoreFindClose@@YAHPAU_CORE_FIND_HANDLE@@@Z ?CoreFindFirstFile@@YAHPA_WPAU_CORE_FIND_HANDLE@@PAU_WIN32_FIND_DATAW@@@Z ?CoreFindNextFile@@YAHPAU_CORE_FIND_HANDLE@@PAU_WIN32_FIND_DATAW@@@Z ?CoreFormatFileName@@YAHPA_W_K1PAPA_WPAE@Z ?CoreGetCorrectCaseForPath@@YAHPAPA_W@Z ?CoreGetDosDeviceList@@YAHPAPA_WPA_K@Z ?CoreGetDriveLayoutEx@@YAHPA_WPAU_DRIVE_LAYOUT_INFORMATION_EX@@K@Z ?CoreGetFileAttributes@@YAHPA_WPAK@Z ?CoreGetFileContent@@YAHPA_WPAPAXPAKPAXKEE@Z ?CoreGetFileContentPaged@@YAHPA_WPAPAXPAKPAXKEE@Z ?CoreGetFileNameAndMountUsingVirtualDisk@@YAHPA_WEPAPA_W@Z ?CoreGetFileNameVirtualDisk@@YAHPA_WPAPA_W@Z ?CoreGetFileSecurity@@YAHPA_WKPAPAXPAK@Z ?CoreGetFileSize@@YAHPAU_CORE_FILE_HANDLE@@PA_K@Z ?CoreGetFileSizeEx@@YAHPA_WPA_K@Z ?CoreGetFileTime@@YAHPAU_CORE_FILE_HANDLE@@PAT_LARGE_INTEGER@@11@Z ?CoreGetFileTimeEx@@YAHPA_WPAT_LARGE_INTEGER@@11@Z ?CoreGetHardDiskVolumesFromDeviceList@@YAHPA_W_KEPAPAU_CBU_MOUNT_DEVICE_INFORMATIONS@@PA_K@Z ?CoreGetLanguageById@@YAPA_WH@Z ?CoreGetLocalTime@@YAHPAU_SYSTEMTIME@@@Z ?CoreGetModuleFileName@@YAHPAPA_WPAX@Z ?CoreGetRandomNumber@@YAHH@Z ?CoreGetSystemInfo@@YAHPAU_SYSTEM_INFO@@@Z ?CoreGetSystemTime@@YAHPAU_SYSTEMTIME@@@Z ?CoreGetVolumeDatesAndAttributes@@YAHPA_WPAT_LARGE_INTEGER@@11PAK@Z ?CoreGetVolumeInformation@@YAHPA_W0KPAK110KPAE@Z ?CoreGetVolumePathFromPath@@YAHPA_WPAPA_W@Z ?CoreIStringInStringA@@YAHPAD0@Z ?CoreIStringInStringW@@YAHPA_W0@Z ?CoreInitializeLogEx@@YAHPAU_CORE_LOG_HANDLE@@PA_WP6AHPAPA_WPAX@Z3W4_CORE_LOGGING_MODE@@_KP6AH123@Z3W4_CORE_LOG_LEVEL@@EEE@Z ?CoreInstallService@@YAHPA_W00KK@Z ?CoreIntializeRandomizer@@YAHXZ ?CoreIsVolumePath@@YAHPA_WPAE@Z ?CoreKernelTimeToSystemTime@@YAHT_LARGE_INTEGER@@PAU_SYSTEMTIME@@@Z ?CoreLeakDumper@@YAXPAXI@Z ?CoreMemoryAllocNonPaged@@YAPAXK@Z ?CoreMemoryAllocPaged@@YAPAXK@Z ?CoreMemoryAllocZeroFilledBuffer@@YAPAXK@Z ?CoreMemoryAllocZeroFilledBufferNonPaged@@YAPAXK@Z ?CoreMemoryAllocZeroFilledBufferPaged@@YAPAXK@Z ?CoreMemoryAppend@@YAHPAPAXPAXPAKK@Z ?CoreMemoryAppendNonPaged@@YAHPAPAXPAXPAKK@Z ?CoreMemoryAppendPaged@@YAHPAPAXPAXPAKK@Z ?CoreMemoryCat@@YAPAXPAX0KK@Z ?CoreMemoryCatNonPaged@@YAPAXPAX0KK@Z ?CoreMemoryCatPaged@@YAPAXPAX0KK@Z ?CoreMemoryCompare@@YAHQAX0K@Z ?CoreMemoryCompareEx@@YAHQAX0KK@Z ?CoreMemoryCopy@@YAXPAXPBXK@Z ?CoreMemoryDestroy@@YAXPAXK@Z ?CoreMemoryDuplicate@@YAPAXPAXK@Z ?CoreMemoryDuplicateNonPaged@@YAPAXPAXK@Z ?CoreMemoryDuplicatePaged@@YAPAXPAXK@Z ?CoreMemoryICompare@@YAHPAX0K@Z ?CoreMemoryICompareEx@@YAHPAX0KK@Z ?CoreMemoryReallocateBuffer@@YAHPAPAXKK@Z ?CoreMemoryReallocateBufferNonPaged@@YAHPAPAXKK@Z ?CoreMemoryReallocateBufferPaged@@YAHPAPAXKK@Z ?CoreMemoryReallocateVector@@YAHPAPAXKKK@Z ?CoreMemoryReallocateVectorNonPaged@@YAHPAPAXKKK@Z ?CoreMemoryReallocateVectorPaged@@YAHPAPAXKKK@Z ?CoreMemorySet@@YAXPAXEI@Z ?CoreMemorySwitch@@YAXPAX0K@Z ?CoreMountAllHardDiskVolumes@@YAHE@Z ?CoreMountPartition@@YAH_WE@Z ?CoreMoveRenameFile@@YAHPA_W0@Z ?CoreOpenEncryptedFileRaw@@YAHPA_WKPAPAX@Z ?CoreOpenEvent@@YAHPAU_CORE_EVENT@@PA_W@Z ?CoreOpenProcessToken@@YAHPAXKPAPAX@Z ?CorePrintDebugStringA@@YAXPADK00@Z ?CorePrintDebugStringW@@YAXPADKPA_W0@Z ?CoreQueryDirectory@@YAHPA_WPAU_FSVECTOR@@@Z ?CoreQueueDequeue@@YAPAXPAUCORE_QUEUE@@@Z ?CoreQueueEnqueue@@YAHPAUCORE_QUEUE@@PAX@Z ?CoreQueuePeek@@YAPAXPAUCORE_QUEUE@@@Z ?CoreQueueRelease@@YAXPAUCORE_QUEUE@@@Z ?CoreReadEncryptedFileRaw@@YAHP6GKPAEPAXK@Z11@Z ?CoreReadFile@@YAHPAU_CORE_FILE_HANDLE@@PAXKPAK@Z ?CoreReadFileEx@@YAHPAU_CORE_FILE_HANDLE@@PAXK_KPAK@Z ?CoreReadLine@@YAHPAU_CORE_FILE_HANDLE@@PAPAD@Z ?CoreRegCreateKeyEx@@YAHPA_W00KKPAU_SECURITY_ATTRIBUTES@@PAU_CORE_KEY_HANDLE@@PAK@Z ?CoreRegCreateVolatileKey@@YAHPA_W00KKPAU_SECURITY_ATTRIBUTES@@PAU_CORE_KEY_HANDLE@@PAK@Z ?CoreRegDeleteKey@@YAHPA_W0@Z ?CoreRegDeleteTree@@YAHPA_W0@Z ?CoreRegOpenKeyEx@@YAHPA_W0KPAU_CORE_KEY_HANDLE@@@Z ?CoreRemoveGUILogging@@YAHPAU_CORE_LOG_HANDLE@@@Z ?CoreResetEvent@@YAHPAU_CORE_EVENT@@@Z ?CoreResetKeySecurity@@YAHPA_W0EPAXK@Z ?CoreSPrintf@@YAHPADK0ZZ ?CoreSPrintfEx@@YAHPAPADPADZZ ?CoreSWPrintf@@YAHPA_WK0ZZ ?CoreSWPrintfEx@@YAHPAPA_WPA_WZZ ?CoreSetCurrentProcessPriority@@YAHPAW4_BACKUP_PRIORITY_LEVEL@@@Z ?CoreSetEvent@@YAHPAU_CORE_EVENT@@@Z ?CoreSetFileAttributes@@YAHPA_WK@Z ?CoreSetFileContent@@YAHPA_WPAXK1KEE@Z ?CoreSetFilePointer@@YAHPAU_CORE_FILE_HANDLE@@_K@Z ?CoreSetFileSecurity@@YAHPA_WKPAXK@Z ?CoreSetFileSize@@YAHPAU_CORE_FILE_HANDLE@@_K@Z ?CoreSetFileSizeEx@@YAHPA_W_K@Z ?CoreSetFileTime@@YAHPAU_CORE_FILE_HANDLE@@T_LARGE_INTEGER@@11@Z ?CoreSetFileTimeEx@@YAHPA_WT_LARGE_INTEGER@@11@Z ?CoreSetLogWriterCallback@@YAHPAU_CORE_LOG_HANDLE@@P6AHPAPA_WPAX@Z2@Z ?CoreSetThreadExecutionState@@YAHKPAK@Z ?CoreShutdownSystem@@YAHEE@Z ?CoreSleep@@YAH_K@Z ?CoreSleepEx@@YAH_KPCH@Z ?CoreStartService@@YAHPA_W@Z ?CoreStartServiceEx@@YAHPA_W@Z ?CoreStartThread@@YAHPAX0PAU_CORE_THREAD_HANDLE@@@Z ?CoreStopService@@YAHPA_WPCH@Z ?CoreStringAppendA@@YAHPAPADPAD@Z ?CoreStringAppendDecimalNumberA@@YAHPAPAD_K@Z ?CoreStringAppendDecimalNumberW@@YAHPAPA_W_K@Z ?CoreStringAppendHexadecimalNumberA@@YAHPAPAD_K@Z ?CoreStringAppendHexadecimalNumberW@@YAHPAPA_W_K@Z ?CoreStringAppendW@@YAHPAPA_WPA_W@Z ?CoreStringBufferToHexstringA@@YAPADPAXK@Z ?CoreStringBufferToHexstringW@@YAPA_WPAXK@Z ?CoreStringCatA@@YAPADPAD0@Z ?CoreStringCatW@@YAPA_WPA_W0@Z ?CoreStringCatWithDecimalNumberA@@YAPADPAD_J@Z ?CoreStringCatWithDecimalNumberW@@YAPA_WPA_W_J@Z ?CoreStringCatWithHexadecimalNumberA@@YAPADPAD_J@Z ?CoreStringCatWithHexadecimalNumberW@@YAPA_WPA_W_J@Z ?CoreStringCompareA@@YAHPAD0@Z ?CoreStringCompareW@@YAHPA_W0@Z ?CoreStringDuplicateA@@YAPADPAD@Z ?CoreStringDuplicateNonPagedA@@YAPADPAD@Z ?CoreStringDuplicateNonPagedW@@YAPA_WPA_W@Z ?CoreStringDuplicatePagedA@@YAPADPAD@Z ?CoreStringDuplicatePagedW@@YAPA_WPA_W@Z ?CoreStringDuplicateVectorA@@YAPAPADPAPADK@Z ?CoreStringDuplicateVectorNonPagedA@@YAPAPADPAPADK@Z ?CoreStringDuplicateVectorNonPagedW@@YAPAPA_WPAPA_WK@Z ?CoreStringDuplicateVectorPagedA@@YAPAPADPAPADK@Z ?CoreStringDuplicateVectorPagedW@@YAPAPA_WPAPA_WK@Z ?CoreStringDuplicateVectorW@@YAPAPA_WPAPA_WK@Z ?CoreStringDuplicateW@@YAPA_WPA_W@Z ?CoreStringGetAnsiFromWchar@@YAPADPA_W@Z ?CoreStringGetWcharFromAnsi@@YAPA_WPAD@Z ?CoreStringICompareA@@YAHPAD0@Z ?CoreStringICompareReverseA@@YAHQAD0@Z ?CoreStringICompareReverseW@@YAHQA_W0@Z ?CoreStringICompareW@@YAHPA_W0@Z ?CoreStringInStringA@@YAHPAD0@Z ?CoreStringInStringW@@YAHPA_W0@Z ?CoreStringInsertA@@YAHPAPADKPAD@Z ?CoreStringInsertW@@YAHPAPA_WKPA_W@Z ?CoreStringLengthA@@YAKPAD@Z ?CoreStringLengthW@@YAKPA_W@Z ?CoreStringLowercaseA@@YAHPAD0@Z ?CoreStringLowercaseW@@YAHPA_W0@Z ?CoreStringPrependDecimalNumberA@@YAHPAPAD_K@Z ?CoreStringPrependDecimalNumberW@@YAHPAPA_W_K@Z ?CoreStringPrependHexadecimalNumberA@@YAHPAPAD_K@Z ?CoreStringPrependHexadecimalNumberW@@YAHPAPA_W_K@Z ?CoreStringUpcaseA@@YAHPAD0@Z ?CoreStringUpcaseW@@YAHPA_W0@Z ?CoreStringsCatA@@YAPADKPAD0ZZ ?CoreStringsCatExA@@YAPADPAPADK@Z ?CoreStringsCatExW@@YAPA_WPAPA_WK@Z ?CoreStringsCatW@@YAPA_WKPA_W0ZZ ?CoreSystemTimeToKernelTime@@YAHU_SYSTEMTIME@@PAT_LARGE_INTEGER@@@Z ?CoreUnmountAndDeleteVirtualDevice@@YAHPA_W@Z ?CoreUrlEscapeEx@@YAHPA_WPAPA_W@Z ?CoreVersionCompare@@YAH_K0000000@Z ?CoreVirtualDiskMountManage@@YAHPAU_CBU_IMAGE_MOUNTING_INFO@@H_WPAU_CBU_MOUNTED_IMAGE_INFO@@PAU_BACKUP_PROGRESS_NEW@@PAU_CONNECTION_INFORMATIONS_@@PA_K@Z ?CoreWaitForThread@@YAHPAU_CORE_THREAD_HANDLE@@@Z ?CoreWaitForThreadEx@@YAHPAU_CORE_THREAD_HANDLE@@K@Z ?CoreWcharToChar@@YAHPB_WPAD@Z ?CoreWinDeviceIoControl@@YAHPAU_CORE_FILE_HANDLE@@KPAXK1KPAK@Z ?CoreWriteEncryptedFileRaw@@YAHP6GKPAEPAXPAK@Z11@Z ?CoreWriteFile@@YAHPAU_CORE_FILE_HANDLE@@PAXKPAK@Z ?CoreWriteFileEx@@YAHPAU_CORE_FILE_HANDLE@@PAXK_KPAK@Z ?CoreWriteStringToFileA@@YAHPAU_CORE_FILE_HANDLE@@PAD@Z ?CoreWriteStringToFileW@@YAHPAU_CORE_FILE_HANDLE@@PA_W@Z ?CreateDefaultSynchronizedFolderForUser@@YAHPA_W0E@Z ?CreateEmptyRegKey@@YAHPA_W00_K@Z ?CreateFilePrepended@@YAHPAPAXPA_WKKPAU_SECURITY_ATTRIBUTES@@KKPAX@Z ?CreateFilePrepended_COS@@YAHPAPAXPA_WKKPAU_SECURITY_ATTRIBUTES@@KKPAX@Z ?CreateMonitorForSpecificInstantSyncTask@@YAHPAV_CBU_SCHEDULER_AND_PROFILE_MANAGER@@U_CBU_SCHEDULE_ID@@PAPAU2@PAK@Z ?CreateMonitorsForPaths@@YAHU_CBU_SCHEDULE_ID@@PAV_CBU_SCHEDULER_AND_PROFILE_MANAGER@@PA_W2@Z ?CreateOrCheckFirstBackupRegValue@@YAEXZ ?CreateParentDirectories@@YAHPA_W@Z ?CreateRestartKey@@YAHXZ ?CreateVolatileKey@@YAHXZ ?CreateWatchdogGlobalMutex@@YAHPAU_CORE_MUTEX@@U_CBU_SCHEDULE_ID@@@Z ?CreateWatchdogProfileDeletedEvent@@YAHPAU_CORE_EVENT@@U_CBU_SCHEDULE_ID@@@Z ?CustomByteDecrypt@@YAHPAXK@Z ?CustomByteEncrypt@@YAHPAXK@Z ?CustomDeserialize@@YAHU_PATHS_FOR_RESTORE@@PAU_CORE_LOG_HANDLE@@PAU_BACKUP_CONTEXT@@PAU_BACKUP_PROGRESS_NEW@@PCHPAU_CBU_CACHE_INFORMATION@@@Z ?CustomDeserializeNew@@YAHPA_WHPAU_CORE_LOG_HANDLE@@PAU_BACKUP_CONTEXT@@PAU_BACKUP_PROGRESS_NEW@@PCHEPAPAPAU_FILES_AND_DIRS_TREE_ITEM@@PAPAPA_WPAPAU4@PAPA_WPAU_CBU_CACHE_INFORMATION@@@Z ?DateComparison@@YAHU_SYSTEMTIME@@0@Z ?DateFromStringA@@YAHPADPAU_SYSTEMTIME@@@Z ?DateFromStringW@@YAHPA_WPAU_SYSTEMTIME@@@Z ?DateToString@@YAHU_SYSTEMTIME@@PAPA_W@Z ?DateToStringForGui@@YAHU_SYSTEMTIME@@PAPA_W@Z ?DayOfWeekTo3LetterString@@YAPA_WG@Z ?DaysSince_1_Jan_1601_inclusive@@YA_KPAU_SYSTEMTIME@@@Z ?DefaultAllocationFunction@@YAPAXK@Z ?DefaultFreeFunction@@YAXPAX@Z ?DefaultNonPagedAllocationFunction@@YAPAXK@Z ?DefaultPagedAllocationFunction@@YAPAXK@Z ?DelMultiSz@@YAXPAPA_W@Z ?DeleteAllJobs@@YAHXZ ?DeleteBackupByIndex@@YAH_KW4_BACKUP_STORAGE_DESTINATION_TYPE@@PA_WPAXKPAU_CONNECTION_INFORMATIONS_@@PAU_PROXY_@@PAU_CBU_CACHE_INFORMATION@@@Z ?DeleteCBUBackup@@YAHW4_BACKUP_STORAGE_DESTINATION_TYPE@@PA_WPAXKPAU_CONNECTION_INFORMATIONS_@@PAU_PROXY_@@PAU_CBU_CACHE_INFORMATION@@@Z ?DeleteFileTreeInfo@@YAHPAUFileTreeInfo@@@Z ?DeleteFtpFile@@YAHPAU_FTP_FILE_BACKUP_CTX_@@PA_W@Z ?DeleteFtpFolder@@YAHPAXPA_W@Z ?DeleteFtpPath@@YAHPAU_CORE_LOG_HANDLE@@PAXPA_WEPCH3@Z ?DeleteHistoryEventById@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@@Z ?DeletePath@@YAHPAU_CORE_LOG_HANDLE@@PA_WEPCH2E@Z ?DeletePathEx@@YAHPAU_CORE_LOG_HANDLE@@W4_BACKUP_STORAGE_DESTINATION_TYPE@@PA_WEPCH3HPAXE@Z ?DeleteProfileById@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@E@Z ?DeleteScheduleById@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_SCHEDULE_ID@@E@Z ?DeleteScheduledTask@@YAHPA_W@Z ?DeleteService@@YAHPA_W@Z ?DeserializeBackupTree@@YAHPAPAU_FILES_AND_DIRS_TREE_ITEM@@PAU_BACKUP_CONTEXT@@PAU_BACKUP_OFFSET_CONTEXT_HANDLE@@_KPAU_CORE_LOG_HANDLE@@PCHPA_WK@Z ?DeserializeBackupTreeWithFullItemPath@@YAHPAPAU_FILES_AND_DIRS_TREE_ITEM@@PAU_BACKUP_CONTEXT@@PAU_BACKUP_OFFSET_CONTEXT_HANDLE@@_KPAU_CORE_LOG_HANDLE@@PCHPA_WK@Z ?DeserializeCBUImageMountingInfoStruct@@YAHPAXKPAPAU_CBU_IMAGE_MOUNTING_INFO@@@Z ?DeserializeCbuFsMountInfoStruct@@YAHPAXKPAPAUFileSysMountInfo@@@Z ?DeserializeFileSystemBackupSource@@YAHPAU_BACKUP_CONTEXT@@PAU_CORE_LOG_HANDLE@@EPAPAU_FILES_AND_DIRS_TREE_ITEM@@PA_WEEE3PAPA_WKE4PCHPAU_BACKUP_PROGRESS_NEW@@EEPAXKPAEPAU_INTERN_BACKUP_INFORMATION@@EPAU_CBU_CACHE_INFORMATION@@@Z ?DeserializeInformationData@@YAHPA_WPAPAU_BACKUP_RESTORE_INFORMATION_DATA@@@Z ?Deserialize_BACKUP_CREATE@_BACKUP_CREATE@@QAEHPAXK@Z ?DetermineAndNotifyScheduledTasksToRunAsService@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHXZ ?DisablePrintDebugInfo@@YAXXZ ?DisplayErrorEC@@YAXPAU_CORE_LOG_HANDLE@@KH@Z ?DisplayErrorIm@@YAXPAU_CORE_LOG_HANDLE@@KH@Z ?DisplaySuccesEc@@YAXPAU_CORE_LOG_HANDLE@@K@Z ?DoDeleteSvc@WindowsServiceBase@@IAEXXZ ?DoStartSvc@WindowsServiceBase@@IAEXXZ ?DoStopSvc@WindowsServiceBase@@IAEXXZ ?DoesFtpFileExist@@YAHPAXPA_WPAE2@Z ?DoesNetworkFileExist@@YAHPA_W00PAE1@Z ?DoesParameterExists@CBUScriptParser@@QAEEPA_WPAPAXW4PARAM_VALUE_TYPE@1@@Z ?DoesParameterExists@CBUScriptParser@@QAEEW4PARAM_NAME@1@PAPAXW4PARAM_VALUE_TYPE@1@@Z ?DoesRegistryKeyExist@@YAHPA_W00_KPAE@Z ?DoesRegistryValueKeyExist@@YAHPA_W00_K0PAE@Z ?DummySetInit@_BACKUP_CREATE@@QAEXXZ ?DumpCBUDebugInfo@@YAHXZ ?DumpCBUDebugInfoEx@@YAHPAPA_WEE@Z ?EditProfileBackupUsingBackupCreateInfo@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHPAV_BACKUP_CREATE@@U_CBU_PROFILE_ID@@PAE2PAPA_WPAW4_CBU_GUI_RUN_MODE@@@Z ?EjectMedia@CDiscRecorder@@QAEHXZ ?EnableInstantScan@@YAHXZ ?EnablePrintDebugInfo@@YAXXZ ?EnablePrivilege@@YAHPB_WH@Z ?EnforceCleanFSVector@@YAHPAU_FSVECTOR@@@Z ?EnumerateDevices@@YAHPB_W0KHPAPA_WP6AHPAXPAU_SP_DEVINFO_DATA@@K2@Z2@Z ?EnumerateNamedStreams@@YAHPAXPA_WPAU_FSVECTOR@@@Z ?ErrorExit@@YAHPA_W@Z ?EudoraBackup@@YAHPAU_BACKUP_CONTEXT@@PA_WPAU_BACKUP_CREATE_INFORMATION_DATA@@PAU_CORE_LOG_HANDLE@@PAU_BACKUP_PROGRESS_NEW@@HPCHPAU_FLAGS_EMAIL_CLIENT@@1@Z ?EudoraBackupNew@@YAHPAU_BACKUP_CONTEXT@@0PA_WPAU_BACKUP_CREATE_INFORMATION_DATA@@PAU_CORE_LOG_HANDLE@@PAU_BACKUP_PROGRESS_NEW@@HPCHPAU_FLAGS_EMAIL_CLIENT_NEW@@K1PAPAU_FILES_AND_DIRS_TREE_ITEM@@7@Z ?EudoraGetCount@@YAHPAU_BACKUP_PROGRESS_NEW@@PAU_CORE_LOG_HANDLE@@PAU_FLAGS_EMAIL_CLIENT@@PCHPA_W@Z ?EudoraGetCountNew@@YAHPAU_BACKUP_CONTEXT@@PAU_BACKUP_CREATE_INFORMATION_DATA@@PAU_FLAGS_EMAIL_CLIENT_NEW@@KEPA_WPAPAPAU_FILES_AND_DIRS_TREE_ITEM@@PAKPAPAU4@@Z ?Exists@@YAHPA_W@Z ?ExistsAndReturnHandle@@YAHPA_WPAU_CORE_FILE_HANDLE@@@Z ?ExtractBrowserBackupOptionsFromScriptW@@YAHPA_WPAU_FLAGS_BACKUP_BROWSER_CLIENT@@@Z ?ExtractBrowserRestoreOptionsFromScriptW@@YAHPA_WPAU_FLAGS_RESTORE_BROWSER_CLIENT@@@Z ?ExtractFilePath@@YAPA_WPA_W@Z ?ExtractFileTreeFromBackup@@YAHPAU_BACKUP_CONTEXT@@PAPAU_FILES_AND_DIRS_TREE_ITEM@@@Z ?ExtractInstallPathFromShellKey@@YAHPA_W00PAPA_W@Z ?ExtractOperationByDateTimeString@@YAHPA_WPAPA_W@Z ?ExtractOptionsFlat@@YAHPAU_FILES_RESTORE_FLAT_INFO@@KPAU_FILES_RESTORE_INFO@@@Z ?ExtractParametersList@CBUScriptParser@@AAEHPA_W@Z ?ExtractPendingOperation@@YAHPAPA_W@Z ?ExtractPossibleUserIDFromPath@@YAHPA_WPAPA_W@Z ?FBGetVolumeFlags@@YAHPA_WPAK@Z ?FBGetVolumeInfo@@YAHPA_WAAPAU_FILE_BACKUP_VOLUME_INFO@@@Z ?FSExportCallback@@YGKPAEPAXK@Z ?FSImportCallback@@YGKPAEPAXPAK@Z ?FastSSLSendEmail@@YAHPA_W00000F00000W4EMAIL_SECURITY_LAYER@@@Z ?FastSendEmail@@YAHPA_W00000F0000@Z ?FileDiskMount@@YAHIPAU_OPEN_FILE_INFORMATION@@AAPA_WHH@Z ?FileDiskUmount@@YAHDIHHH@Z ?FileExist@@YAHPA_WPAE@Z ?FillFileHeaderBuffer@@YAHPA_WU_BY_HANDLE_FILE_INFORMATION@@QAEAAPAEAAK_K@Z ?FillFileHeaderBufferSizeAndAttributes@@YAHPA_WKKKQAEAAPAEAAK_K@Z ?FindFirstFilePrepend@@YAHPAPAXPA_WPAU_WIN32_FIND_DATAW@@@Z ?FixCTM_2_9_CompatibilityIssue@@YAHXZ ?FolderWatchdog@@YAXPAX@Z ?FormatDriveNtfs@@YAHPA_W0@Z ?FormatWildCard@@YAHPA_WPAPA_W@Z ?FreeConnectionAndProxyInformations@@YAXPAPAU_CONNECTION_INFORMATIONS_@@PAPAU_PROXY_@@@Z ?FreeConnectionInformations2@@YAXU_CONNECTION_INFORMATIONS_@@@Z ?FreeConnectionInformations@@YAXPAPAU_CONNECTION_INFORMATIONS_@@@Z ?FreeEmailInformations@@YAXPAPAU_EMAIL_INFORMATIONS@@@Z ?FreeEmailInformationsEx@@YAXPAU_EMAIL_INFORMATIONS@@@Z ?FreeEmailNotificationInformation@@YAXPAPAU_BACKUP_EMAIL_NOTIFICATION_INFORMATION@@@Z ?FreeEmailNotificationInformationEx@@YAXPAU_BACKUP_EMAIL_NOTIFICATION_INFORMATION@@@Z ?FreeInformationData@@YAXPAPAU_BACKUP_RESTORE_INFORMATION_DATA@@@Z ?FreeLpNetResource@@YAHPAPAU_NETRESOURCEW@@@Z ?FreeNetworkComputerList@@YAHPAPAU_NETWORK_COMPUTERS_LIST@@@Z ?FreeOpticalDiskDestinationInformations2@@YAXU_OPTICAL_DESTINATION_INFORMATIONS@@@Z ?FreeOpticalDiskDestinationInformations@@YAXPAPAU_OPTICAL_DESTINATION_INFORMATIONS@@@Z ?FreeParametersList@CBUScriptParser@@AAEHXZ ?FreePaths@@YAHPAPAPA_W_K@Z ?FreeProgress@@YAXPAU_BACKUP_PROGRESS_NEW@@@Z ?FreeProxy2@@YAXU_PROXY_@@@Z ?FreeProxy@@YAXPAPAU_PROXY_@@@Z ?FreeRestrictedSD@@YAXPAX@Z ?FreeVectorOfIcons@@YAXPAPAU_VECTOR_OF_EVENT_INFO@@@Z ?FtpConnect@@YAHPAU_PROXY_@@PAU_CONNECTION_INFORMATIONS_@@PAPAX2@Z ?FtpCreateFolder@@YAHPAXPA_W@Z ?FtpCreateFolderEx@@YAHPAXPA_W@Z ?FtpGetFiles@@YAHPAXPA_WPAPAPA_WPA_K@Z ?FtpGetFolders@@YAHPAXPA_WPAPAPA_WPA_K@Z ?FtpReconnect@@YAHPAU_PROXY_@@PAU_CONNECTION_INFORMATIONS_@@PAPAX2@Z ?FtpRemoveFile@@YAHPAXPA_W@Z ?FtpValidatePath@@YAHPA_WPAPA_W@Z ?GEEKBUDDY_Download@@YAHPAU_CBU_DOWNLOAD_CLPS_CONTEXT@@@Z ?GetAbortFlag@_BACKUP_CREATE@@QAE?CHXZ ?GetActionAfterRestore@_BACKUP_RESTORE@@QBE?AW4_OPERATION_AFTER_RESTORE_IS_FINISHED@@XZ ?GetAddToHistory@_BACKUP_RESTORE@@QBEEXZ ?GetAddToHistoryFlagByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAE@Z ?GetAllPathsInString@@YAHPA_W_WPA_KPAPAPA_W@Z ?GetAllVolumesInfo@@YAHPAPAPA_W00PAK@Z ?GetAppDataPath@@YAHPAPA_W@Z ?GetAttachementMAXSize@@YAHPAU_EMAIL_INFORMATIONS@@PA_K@Z ?GetBUILDType@@YAPA_WPA_W@Z ?GetBackupAddToHistory@_BACKUP_CREATE@@QAEEXZ ?GetBackupCompressionLevel@_BACKUP_CREATE@@QAE?AW4_COMPRESSION_LEVEL@@XZ ?GetBackupCompressionLevelByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAW4_COMPRESSION_LEVEL@@@Z ?GetBackupCompressionLevelByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAW4_COMPRESSION_LEVEL@@@Z ?GetBackupConnectionCredentialsByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAPAU_CONNECTION_INFORMATIONS_@@@Z ?GetBackupConnectionCredentialsByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAPAU_CONNECTION_INFORMATIONS_@@@Z ?GetBackupConnectionInformations@_BACKUP_CREATE@@QAEHPAPAU_CONNECTION_INFORMATIONS_@@@Z ?GetBackupConnectionInformations@_BACKUP_CREATE@@QAEPAU_CONNECTION_INFORMATIONS_@@XZ ?GetBackupDescription@_BACKUP_CREATE@@QAEHPAPA_W@Z ?GetBackupDescriptionByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAPA_W@Z ?GetBackupDescriptionByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAPA_W@Z ?GetBackupDestinationPath@_BACKUP_CREATE@@QAEHPAPAXPAK@Z ?GetBackupDestinationPath@_BACKUP_RESTORE@@QBEHPAPAXPAK@Z ?GetBackupDestinationPathByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAPAXPAK@Z ?GetBackupDestinationPathByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAPAXPAK@Z ?GetBackupDestinationPathPointer@_BACKUP_RESTORE@@QBEPAXXZ ?GetBackupDestinationPathPtr@_BACKUP_CREATE@@QBEPAXXZ ?GetBackupDestinationPathSize@_BACKUP_CREATE@@QBEKXZ ?GetBackupDestinationType@_BACKUP_RESTORE@@QBE?AW4_BACKUP_STORAGE_DESTINATION_TYPE@@XZ ?GetBackupDiskFreeSpace@_BACKUP_CREATE@@QAEEXZ ?GetBackupDiskFreeSpaceFlagByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAE@Z ?GetBackupDiskFreeSpaceFlagByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAE@Z ?GetBackupDiskPriorityLevel@_BACKUP_CREATE@@QAE?AW4_BACKUP_PRIORITY_LEVEL@@XZ ?GetBackupDiskStepSize@_BACKUP_CREATE@@QAEHPA_K@Z ?GetBackupEmailDestinationInfoByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAPAU_EMAIL_INFORMATIONS@@@Z ?GetBackupEmailDestinationInfoByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAPAU_EMAIL_INFORMATIONS@@@Z ?GetBackupEmailDestinationInformation@_BACKUP_CREATE@@QAEHPAPAU_EMAIL_INFORMATIONS@@@Z ?GetBackupEmailNotificationInfoByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAPAU_BACKUP_EMAIL_NOTIFICATION_INFORMATION@@@Z ?GetBackupEmailNotificationInfoByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAPAU_BACKUP_EMAIL_NOTIFICATION_INFORMATION@@@Z ?GetBackupEmailNotificationInformations@_BACKUP_CREATE@@QAEHPAPAU_BACKUP_EMAIL_NOTIFICATION_INFORMATION@@@Z ?GetBackupEncryptionAlgorithm@_BACKUP_CREATE@@QAEEXZ ?GetBackupEncryptionAlgorithmByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAE@Z ?GetBackupEncryptionAlgorithmByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAE@Z ?GetBackupExclusionAttributes@_BACKUP_CREATE@@QAEKXZ ?GetBackupExclusionFilters@_BACKUP_CREATE@@QAEHPAPAPA_WPAK@Z ?GetBackupExclusionFiltersCount@_BACKUP_CREATE@@QBEKXZ ?GetBackupExclusionFiltersPtr@_BACKUP_CREATE@@QBEPAPA_WXZ ?GetBackupFileVersion@_BACKUP_RESTORE@@QBEHPAU_VERSION_INFO@@@Z ?GetBackupFiltersByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAPAPA_WPAK122@Z ?GetBackupFiltersByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAPAPA_WPAK122@Z ?GetBackupFormatType@_BACKUP_CREATE@@QAE?AW4_BACKUP_FORMAT_TYPE@@XZ ?GetBackupFormatTypeByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAW4_BACKUP_FORMAT_TYPE@@@Z ?GetBackupFormatTypeByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAW4_BACKUP_FORMAT_TYPE@@@Z ?GetBackupFormatedFileName@_BACKUP_CREATE@@QAEHPAPAXPAK@Z ?GetBackupGUID@_BACKUP_RESTORE@@QAE?AU_BACKUP_GUID@@XZ ?GetBackupHashAlgorithm@_BACKUP_CREATE@@QAEHPAE@Z ?GetBackupIgnoreErrors@_BACKUP_CREATE@@QAEHPAE@Z ?GetBackupInclusionFilters@_BACKUP_CREATE@@QAEHPAPAPA_WPAK@Z ?GetBackupInclusionFiltersCount@_BACKUP_CREATE@@QBEKXZ ?GetBackupInclusionFiltersPtr@_BACKUP_CREATE@@QBEPAPA_WXZ ?GetBackupInformation@_BACKUP_CREATE@@QAEHPAW4_BACKUP_TYPE@@PAW4_BACKUP_STORAGE_DESTINATION_TYPE@@PAPAXPAKPAW4_BACKUP_SOURCE_TYPE@@23PAW4_BACKUP_FORMAT_TYPE@@PAW4_COMPRESSION_LEVEL@@PAPAU_EMAIL_INFORMATIONS@@PAPAU_OPTICAL_DESTINATION_INFORMATIONS@@PAEPAPA_WPAW4_CORE_LOGGING_MODE@@PA_K2399PAPAU_CONNECTION_INFORMATIONS_@@PAPAU_PROXY_@@PAPA_WPAPA_W9PAPAPA_W3PAPAPA_W3PA_K9PAPAU_BACKUP_EMAIL_NOTIFICATION_INFORMATION@@9PAPA_WPA_KPAPA_WPAW4_BACKUP_PRIORITY_LEVEL@@PAW4_BACKUP_PRIORITY_LEVEL@@999PAW4_LOCKED_FILES_TREATMENT_@@1PAPA_WPAPAU_CONNECTION_INFORMATIONS_@@PAPAU_PROXY_@@PA_KPAU_BACKUP_GUID@@PAU_BACKUP_GUID@@9PAW4_CUSTOM_BACKUP_SOURCE_TYPE@@999939@Z ?GetBackupInformation@_BACKUP_RESTORE@@QAEH_KPA_KPAW4_BACKUP_TYPE@@PAW4_COMPRESSION_LEVEL@@PAW4_BACKUP_SOURCE_TYPE@@PAU_SYSTEMTIME@@PAU_BACKUP_GUID@@1PAPAXPAKPAW4_BACKUP_STORAGE_DESTINATION_TYPE@@PAU_VERSION_INFO@@PAPA_WPAEPAEPAEPAE1PAPAPA_W8PAPAPA_W81PAPA_W118@Z ?GetBackupIsPasswordProtected@_BACKUP_CREATE@@QAEEXZ ?GetBackupLockedFilesTreatment@_BACKUP_CREATE@@QAE?AW4_LOCKED_FILES_TREATMENT_@@XZ ?GetBackupLogToScreen@_BACKUP_CREATE@@QAEEXZ ?GetBackupLogfileMode@_BACKUP_CREATE@@QAE?AW4_CORE_LOGGING_MODE@@XZ ?GetBackupLogfileMode@_BACKUP_CREATE@@QAEHPAW4_CORE_LOGGING_MODE@@@Z ?GetBackupLogfileName@_BACKUP_CREATE@@QAEHPAPA_W@Z ?GetBackupLogfileName@_BACKUP_CREATE@@QAEPA_WXZ ?GetBackupOpticalDestinationInfoByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAPAU_OPTICAL_DESTINATION_INFORMATIONS@@@Z ?GetBackupOpticalDestinationInfoByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAPAU_OPTICAL_DESTINATION_INFORMATIONS@@@Z ?GetBackupOpticalDiskDestinationInformation@_BACKUP_CREATE@@QAEHPAPAU_OPTICAL_DESTINATION_INFORMATIONS@@@Z ?GetBackupParentConnectionCredentialsByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAPAU_CONNECTION_INFORMATIONS_@@@Z ?GetBackupParentConnectionCredentialsByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAPAU_CONNECTION_INFORMATIONS_@@@Z ?GetBackupParentConnectionInformations@_BACKUP_CREATE@@QAEHPAPAU_CONNECTION_INFORMATIONS_@@@Z ?GetBackupParentConnectionInformations@_BACKUP_CREATE@@QAEPAU_CONNECTION_INFORMATIONS_@@XZ ?GetBackupParentDestinationPath@_BACKUP_CREATE@@QAEPA_WXZ ?GetBackupParentProxyInformations@_BACKUP_CREATE@@QAEHPAPAU_PROXY_@@@Z ?GetBackupParentSnapshotNo@_BACKUP_CREATE@@QAE_KXZ ?GetBackupParentStorageDestinationType@_BACKUP_CREATE@@QAE?AW4_BACKUP_STORAGE_DESTINATION_TYPE@@XZ ?GetBackupPassword@_BACKUP_CREATE@@QAEHPAPAXPAK@Z ?GetBackupPassword@_BACKUP_RESTORE@@QBEHPAPAEPAK@Z ?GetBackupPrioritiesLevelByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAW4_BACKUP_PRIORITY_LEVEL@@1@Z ?GetBackupProcessPriorityLevel@_BACKUP_CREATE@@QAE?AW4_BACKUP_PRIORITY_LEVEL@@XZ ?GetBackupProxyInformations@_BACKUP_CREATE@@QAEHPAPAU_PROXY_@@@Z ?GetBackupRegistrySecurityAttributes@_BACKUP_CREATE@@QAEHPAE@Z ?GetBackupRememberConnectionCredentialsFlagByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAE@Z ?GetBackupRememberConnectionCredentialsFlagByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAE@Z ?GetBackupSavedPasswordByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAPAXPAK@Z ?GetBackupSavedPasswordByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAPAXPAK@Z ?GetBackupScanBefore@_BACKUP_CREATE@@QAEEXZ ?GetBackupShutDownComputerWhenFinished@_BACKUP_CREATE@@QAEEXZ ?GetBackupSimpleCopyCreateSourcePathInDestinationPath@_BACKUP_CREATE@@QAEEXZ ?GetBackupSizeCompressed@_BACKUP_CREATE@@QAE_KXZ ?GetBackupSizesByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PA_K1@Z ?GetBackupSkipUnsafeRegKey@_BACKUP_CREATE@@QAEEXZ ?GetBackupSourcePath@_BACKUP_CREATE@@QAEHPAPAXPAK@Z ?GetBackupSourcePathByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAPAXPAK@Z ?GetBackupSourcePathByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAPAXPAK@Z ?GetBackupSourcePathPointer@_BACKUP_RESTORE@@QBEPAXXZ ?GetBackupSourcePathPtr@_BACKUP_CREATE@@QBEPAXXZ ?GetBackupSourcePathSize@_BACKUP_CREATE@@QBEKXZ ?GetBackupSourceType@_BACKUP_CREATE@@QAE?AW4_BACKUP_SOURCE_TYPE@@XZ ?GetBackupSourceTypeByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAW4_BACKUP_SOURCE_TYPE@@@Z ?GetBackupSourceTypeByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAW4_BACKUP_SOURCE_TYPE@@@Z ?GetBackupSourceTypeCustom@_BACKUP_CREATE@@QAE?AW4_CUSTOM_BACKUP_SOURCE_TYPE@@XZ ?GetBackupSplitSizeByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PA_K@Z ?GetBackupSplitSizeByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PA_K@Z ?GetBackupSplitSizeMB@_BACKUP_CREATE@@QAE_KXZ ?GetBackupStorageDestinationType@_BACKUP_CREATE@@QAE?AW4_BACKUP_STORAGE_DESTINATION_TYPE@@XZ ?GetBackupStorageDestinationTypeByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAW4_BACKUP_STORAGE_DESTINATION_TYPE@@@Z ?GetBackupStorageDestinationTypeByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAW4_BACKUP_STORAGE_DESTINATION_TYPE@@@Z ?GetBackupTaskToRunAfter@_BACKUP_CREATE@@QAEHPAPA_W@Z ?GetBackupTaskToRunBefore@_BACKUP_CREATE@@QAEHPAPA_W@Z ?GetBackupTree@_BACKUP_RESTORE@@QAEH_KPAPAX@Z ?GetBackupType@_BACKUP_CREATE@@QAE?AW4_BACKUP_TYPE@@XZ ?GetBackupType@_BACKUP_CREATE@@QAEHPAW4_BACKUP_TYPE@@@Z ?GetBackupTypeByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAW4_BACKUP_TYPE@@@Z ?GetBackupTypeByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAW4_BACKUP_TYPE@@@Z ?GetBackupUniqueId@_BACKUP_RESTORE@@QAEHPA_K@Z ?GetBackupUseDeduplication@_BACKUP_CREATE@@QAEEXZ ?GetBackupVerifyAfter@_BACKUP_CREATE@@QAEEXZ ?GetBackupWaitForTaskAfterToComplete@_BACKUP_CREATE@@QAEEXZ ?GetBackupWaitForTaskBeforeToComplete@_BACKUP_CREATE@@QAEEXZ ?GetBrowserCheckFuncPtrByIndex@@YAP6AEPAPA_W@ZH@Z ?GetBrowserIndexByStringW@@YAHPA_W@Z ?GetBrowserStringByIndexW@@YAPA_WH@Z ?GetCCloudPurchaseUrl@@YAPA_WXZ ?GetCOSTreeForPreBackup@@YAHHPA_WKPAPAU_FILES_AND_DIRS_TREE_ITEM@@PCH2PAPA_WK3KKEPAU_CORE_LOG_HANDLE@@@Z ?GetCleanRestore@_BACKUP_RESTORE@@QBEHPAE@Z ?GetCloneFriendlyNameFromBackupInfo@@YAHPAX0W4_BACKUP_SOURCE_TYPE@@PAPA_W@Z ?GetCloneOptions@CBUScriptParser@@QAEEPAPAU_NEW_DISK_PARTITION_TRACK0_RESTORE_OPTIONS@@@Z ?GetClosingAppFlag@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHPCH@Z ?GetClusterSize_Native@@YAHPA_WPAK@Z ?GetCommonDirectory@@YAPA_WXZ ?GetComodoBackupAppDataPath@@YAHPAPA_W@Z ?GetComodoCacheAppDataPath@@YAHPAPA_W@Z ?GetCompressionLevelFromString@CBUScriptParser@@SAEPA_WPAW4_COMPRESSION_LEVEL@@@Z ?GetConnectionInformation@_BACKUP_RESTORE@@QBEHPAU_CONNECTION_INFORMATIONS_@@@Z ?GetConnectionInformationPointer@_BACKUP_RESTORE@@QBEPAU_CONNECTION_INFORMATIONS_@@XZ ?GetCorrectDriveLetter@@YAHPA_W_K@Z ?GetCorrectHash@@YAHPADKPAPAD@Z ?GetCosLoggedInState@@YAEXZ ?GetCosOpRqDXCtx@_COS_CLIENT_OPERATION_CONTROLLER@@QAEAAU_COS_OP_RQ_DX_CTX@@XZ ?GetCosWebAppAddress@@YAHPAPA_W@Z ?GetCreateParentDirectories@_BACKUP_RESTORE@@QBEHPAE@Z ?GetCreationOfParentFoldersForSimpleCopyFlag@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAE@Z ?GetCreationOfParentFoldersForSimpleCopyFlag@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAE@Z ?GetCurrentDay@@YAHPAPA_W@Z ?GetCurrentDiscLabel@@YAHPAU_OPTICAL_MEDIA_IMAPI_RECORDER_CONTEXT@@PAPA_W@Z ?GetCurrentHour@@YAHPAPA_W@Z ?GetCurrentMinute@@YAHPAPA_W@Z ?GetCurrentMonth@@YAHPAPA_W@Z ?GetCurrentPhysicalMediaStatus@CDiscFormatData@@QAEHPAW4_IMAPI_FORMAT2_DATA_MEDIA_STATE@@@Z ?GetCurrentPhysicalMediaType@CDiscFormatData@@QAEHPAW4_IMAPI_MEDIA_PHYSICAL_TYPE@@@Z ?GetCurrentSecond@@YAHPAPA_W@Z ?GetCurrentStepPosition@@YA_KPAU_BACKUP_PROGRESS_NEW@@@Z ?GetCurrentUser@@YAHPAPA_WPA_W@Z ?GetCurrentUserDefaultBackupPath@@YAHPA_WPAPA_W@Z ?GetCurrentUserSID@@YAHPAPA_W@Z ?GetCurrentUserSIDEx@@YAHPAPA_W@Z ?GetCurrentYear@@YAHPAPA_W@Z ?GetDataPath@@YAHPA_W000PAPA_W@Z ?GetDate@@YAHKPAPA_W@Z ?GetDateTimeFromString@@YAHPA_WPAU_SYSTEMTIME@@@Z ?GetDateTimeString@@YAHPAU_SYSTEMTIME@@PAPA_W@Z ?GetDayOfWeek@@YAHPAPA_WPAU_SYSTEMTIME@@@Z ?GetDeletePropagationFlagByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAE@Z ?GetDeletePropagationFlagByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAE@Z ?GetDevMultiSz@@YAPAPA_WPAXPAU_SP_DEVINFO_DATA@@K@Z ?GetDiskBackupUnitSizeByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PA_K@Z ?GetDiskBackupUnitSizeByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PA_K@Z ?GetDiskHandleString@@YAPA_WI@Z ?GetDiskInformation@@YAHDPAK0PA_K1PAE2@Z ?GetDiskPartitionStyle@@YAHHPAK@Z ?GetDiskPartitionStyleEx@@YAHPAU_CORE_FILE_HANDLE@@PAK@Z ?GetDiskSizeOccupied@@YAHIPA_K@Z ?GetDiskSizeTotal@@YAHIPA_K@Z ?GetDiskSizeTotal@@YAHPAU_CORE_FILE_HANDLE@@PA_K@Z ?GetDismountProgres@@YAXPAX@Z ?GetDocumentsPath@@YAHPAPA_W@Z ?GetDomainForHostnameW@@YAHPA_WPAPA_W@Z ?GetDriveBusType@@YAHPA_WPAW4_STORAGE_BUS_TYPE@@@Z ?GetDriveGeometry@@YAHPA_WPAU_DISK_GEOMETRY@@@Z ?GetDriveLayout@@YAHPA_WPAU_DRIVE_LAYOUT_INFORMATION@@K@Z ?GetDriveLayoutEx@@YAHPA_WPAU_DRIVE_LAYOUT_INFORMATION_EX@@I@Z ?GetDriveLetter@@YAHPAU_logical_volumes_@@KT_LARGE_INTEGER@@PA_W@Z ?GetDriveLetterAvailableForCOSDrive@@YAHPAD@Z ?GetDriveLetterForVolumeName@@YAHPA_WPAPA_W@Z ?GetDriveLetterFromPartitionInformation@@YA_WPAXK_K1@Z ?GetDriveLetterList@@YAHPAPA_WPAKEEEEEEPA_KKPA_WK@Z ?GetDriveLetterListEx@@YAHPAPA_WPAKEEEEEEPA_KKPA_WK@Z ?GetDriveLetterPathForVolumeGUIDPath@@YAPA_WPAPA_W00KPA_W@Z ?GetDriveSize2K@@YAHPAU_DISK_GEOMETRY@@PA_K@Z ?GetDriveSize@@YAHPA_WPA_K@Z ?GetDriveSizeEx@@YAHPA_WPA_K@Z ?GetDynamicDiskSourcePathFromVolumeList@@YAHPAPAU_FLAGS_VOLUME_BACKUP_RESTORE@@PAKPAPAU_GUI_DYNAMIC_VOLUME_INFO@@KPAE@Z ?GetDynamicDiskVolumeList@@YAHKPAPAPAU_GUI_DYNAMIC_VOLUME_INFO@@PAKPAE@Z ?GetDynamicDiskVolumeTypeString@@YAHEPAPA_W@Z ?GetEcExePath@@YAPA_WPA_W@Z ?GetEmailDestinationOptions@CBUScriptParser@@QAEEPAPAU_EMAIL_INFORMATIONS@@@Z ?GetEmailNotificationOptions@CBUScriptParser@@QAEEPAPAU_BACKUP_EMAIL_NOTIFICATION_INFORMATION@@@Z ?GetEncryptionAlgorithmFromString@CBUScriptParser@@SAEPA_WPAE@Z ?GetEnumKey@@YAHPA_W0000@Z ?GetEnumKey@@YAHPA_W00QAU_FLAGS_INSTANT_MESS@@@Z ?GetEudoraProfiles@@YAHPAPAU_IM_EC_GUI_DISPLAY@@PAK@Z ?GetExclusiveAccessOwner@CDiscRecorder@@QAEHPAPA_W@Z ?GetExtendedApiStatusFromNtStatusError@@YAHJ@Z ?GetExtendedNtStatusErrorFromApiStatus@@YAJH@Z ?GetExtendedSystemErrorFromApiStatus@@YAKH@Z ?GetFileFlagsFromFlagsAndAttributes@@YAHKPAK0@Z ?GetFileNameFromPath@@YAPA_WPA_W@Z ?GetFileNameString@@YAHPA_WPAPA_W@Z ?GetFileNameStringEx@@YAHPAPA_W@Z ?GetFileVersionInfoStructure@@YAHPAU_VERSION_INFO@@PA_W@Z ?GetFindHandleToFolder@@YAHPAXPA_WPAPAXPAU_WIN32_FIND_DATAW@@@Z ?GetFirstScheduledBackupID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHPAU_CBU_SCHEDULE_ID@@@Z ?GetFlagIfDefaultSyncFolder@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAE@Z ?GetForegroundSessionInformation@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHPAHPAPA_W11@Z ?GetFormatType@CBUScriptParser@@QAEEPAW4_BACKUP_FORMAT_TYPE@@@Z ?GetFormatTypeFromString@CBUScriptParser@@SAEPAW4_BACKUP_FORMAT_TYPE@@PA_W@Z ?GetFreeSpaceOnMedia@CDiscFormatData@@QAEHPA_K@Z ?GetFriendlyNameByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAPA_W@Z ?GetFriendlyNameByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAPA_W@Z ?GetFtpTreeForPreBackup@@YAHPAXPA_WKPAPAU_FILES_AND_DIRS_TREE_ITEM@@PCH3PAPA_WK4KKEPAU_CORE_LOG_HANDLE@@@Z ?GetGUICustomSourceTypeSelectionByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAW4_CUSTOM_BACKUP_SOURCE_TYPE@@@Z ?GetGUICustomSourceTypeSelectionByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAW4_CUSTOM_BACKUP_SOURCE_TYPE@@@Z ?GetGUIRunModeByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAW4_CBU_GUI_RUN_MODE@@@Z ?GetGUIRunModeByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAW4_CBU_GUI_RUN_MODE@@@Z ?GetHDDSerialNumber@@YAHPAPAD@Z ?GetHandleToIniFile@@YAHPAU_CORE_FILE_HANDLE@@@Z ?GetHashForBuffer@@YAHEPAXKPAPAXPAK@Z ?GetHashForFile@@YAHPA_WEPAPAXPAKPCH@Z ?GetHashSize@@YAKE@Z ?GetHistoryEventInfoTypeByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAW4_HISTORY_INFO_TYPE@@@Z ?GetHistoryEventTimesInfo@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAU_SYSTEMTIME@@11@Z ?GetHistoryIconForDays@_CBU_HISTORY_MANAGER@@QAEHGGGGGGPAPAU_VECTOR_OF_EVENT_INFO@@@Z ?GetHistoryLastRunResult@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAH@Z ?GetHistoryListOfIDs@_CBU_HISTORY_MANAGER@@QAEHPAPAU_CBU_HISTORY_ID@@PAK@Z ?GetHistoryListOfIDsByRange@_CBU_HISTORY_MANAGER@@QAEHKKPAPAU_CBU_HISTORY_ID@@PAK1@Z ?GetHistoryListOfIDsByRangeAndType@_CBU_HISTORY_MANAGER@@QAEHKKPAPAU_CBU_HISTORY_ID@@PAKW4_HISTORY_INFO_TYPE@@1@Z ?GetHistoryListOfIDsByType@_CBU_HISTORY_MANAGER@@QAEHPAPAU_CBU_HISTORY_ID@@PAKW4_HISTORY_INFO_TYPE@@@Z ?GetHiveSize@@YAHPA_WPA_K@Z ?GetHostByIpThread@@YAKPAU_ARP_COMPUTER_INFO@@@Z ?GetHostnameForAddrW@@YAHPA_WPAPA_W@Z ?GetIMExePath@@YAPA_WPA_W@Z ?GetIdType@@YA?AUIdEntry@@PB_W@Z ?GetIgnoreErrorsDuringBackupFlagByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAE@Z ?GetIgnoreErrorsDuringBackupFlagByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAE@Z ?GetImpersonationSID@@YAHPAPA_W@Z ?GetInclusionExclusionFiltersFromString@CBUScriptParser@@SAEPA_WPAPAPA_WPA_K@Z ?GetIndexAndMonitoringEnableState@@YAHPAE@Z ?GetInstallDirectory@@YAPA_WXZ ?GetInterface@CDiscFormatData@@QAEPAUIDiscFormat2Data@@XZ ?GetIsPasswordProtectedBackupFlagByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAE@Z ?GetIsPasswordProtectedBackupFlagByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAE@Z ?GetLargestPartition@@YAHPA_WKPAPA_W@Z ?GetLastBackupInfoID@_CBU_HISTORY_MANAGER@@QAEHPAU_CBU_HISTORY_ID@@@Z ?GetLastBackupNameToCCloud@_CBU_HISTORY_MANAGER@@QAEHPAPA_W@Z ?GetLastRestoreInfo@_CBU_HISTORY_MANAGER@@QAEHPAU_SYSTEMTIME@@PAPA_W@Z ?GetLastRestoreInfoID@_CBU_HISTORY_MANAGER@@QAEHPAU_CBU_HISTORY_ID@@@Z ?GetLastSystemBackupInfoFriendlyName@_CBU_HISTORY_MANAGER@@QAEHPAU_SYSTEMTIME@@PAPA_W@Z ?GetLastUnmountedFileDiskDriveNumber@@YAHAAI@Z ?GetListOfDiskPartitions@@YAHPAU_logical_volumes_@@HPAKPAPAPA_WPAH222@Z ?GetListOfDiskPartitionsEx@@YAHKPAPAU_GUI_PARTITION_INFO@@PAKPAE2@Z ?GetListOfPhysicalDrives@@YAHPAKPAPAPA_WPAPAK1@Z ?GetListOfPhysicalDrivesSimple@@YAHPAKPAPAK@Z ?GetLockedFilesTreatmentByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAW4_LOCKED_FILES_TREATMENT_@@@Z ?GetLockedFilesTreatmentByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAW4_LOCKED_FILES_TREATMENT_@@@Z ?GetLockedFilesTreatmentFromString@CBUScriptParser@@SAEPA_WPAW4_LOCKED_FILES_TREATMENT_@@@Z ?GetLogFileName@_BACKUP_RESTORE@@QBEHPAPA_W@Z ?GetLogInformationByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAEPAPA_WPAW4_CORE_LOGGING_MODE@@@Z ?GetLogInformationByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAEPAPA_WPAW4_CORE_LOGGING_MODE@@@Z ?GetLogToFileMethod@_BACKUP_RESTORE@@QBE?AW4_CORE_LOGGING_MODE@@XZ ?GetLogToFileStatus@_BACKUP_RESTORE@@QBEEXZ ?GetLogToScreen@_BACKUP_RESTORE@@QBEEXZ ?GetLogicalVolumes@@YAHPAU_logical_volumes_@@@Z ?GetMSOutlook2003Profiles@@YAHPAPAU_IM_EC_GUI_DISPLAY@@PAK@Z ?GetMSOutlook2007Profiles@@YAHPAPAU_IM_EC_GUI_DISPLAY@@PAK@Z ?GetMSOutlook2010Profiles@@YAHPAPAU_IM_EC_GUI_DISPLAY@@PAK@Z ?GetMatrixLength@@YAHPAPA_W_KPA_K@Z ?GetMd5ForCBUFile@@YAHPADPAPADE@Z ?GetMilisecondDiffenceBetweenDates@@YAHPAU_SYSTEMTIME@@0PA_J@Z ?GetMissedTaskActionByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_SCHEDULE_ID@@PAE@Z ?GetMountedFsCbuDriveInfo@@YAHDPAPAUFileSysMountInfo@@@Z ?GetMultiSzIndexArray@@YAPAPA_WPA_W@Z ?GetMultisessionInterfaces@CDiscFormatData@@QAEHPAPAUtagSAFEARRAY@@@Z ?GetMusicPath@@YAHPAPA_W@Z ?GetMustFinishFlag@_CBU_HISTORY_MANAGER@@QAEHPAE@Z ?GetMustFinishFlag@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHPAE@Z ?GetNetworkComputersList@_NETWORK_BROWSER_CLASS@@QAEHPAPAU_NETWORK_COMPUTERS_LIST@@@Z ?GetNewUniqueID@_CBU_HISTORY_MANAGER@@IAEHPAU_CBU_HISTORY_ID@@@Z ?GetNewUniqueID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHPAU_CBU_PROFILE_ID@@PAU_CBU_SCHEDULE_ID@@@Z ?GetNextChunkCallback@_BACKUP_RESTORE@@QBEP6AHPAX@ZXZ ?GetNoOfDaysByMonth@@YAHPAU_SYSTEMTIME@@PAG@Z ?GetNumberOfProcessors@@YAKXZ ?GetOperationToPerformWhenDone@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAW4_OPERATION_AFTER_RESTORE_IS_FINISHED@@@Z ?GetOpticalDeviceList@@YAHPAPAU_OPTICAL_DRIVE_INFO@@PAK@Z ?GetOpticalMediaFreeSpace@@YAHPAU_OPTICAL_MEDIA_IMAPI_RECORDER_CONTEXT@@PA_KPAE@Z ?GetOpticalSupportedWriteSpeeds@@YAHPAU_OPTICAL_MEDIA_IMAPI_RECORDER_CONTEXT@@PAPAJPAK@Z ?GetOsInstanceKey@@YAHPAPAD@Z ?GetOutlookExpresProfiles@@YAHPAPAU_IM_EC_GUI_DISPLAY@@PAK@Z ?GetParamValue@CBUScriptParser@@SAPA_WW4PARAM_NAME@1@@Z ?GetParentBackupGUIDs@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAU_BACKUP_GUID@@1@Z ?GetParentBackupGUIDs@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAU_BACKUP_GUID@@1@Z ?GetParentDestinationInformation@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAW4_BACKUP_STORAGE_DESTINATION_TYPE@@PAPA_WPA_K@Z ?GetParentDestinationInformation@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAW4_BACKUP_STORAGE_DESTINATION_TYPE@@PAPA_WPA_K@Z ?GetParentFolderPath@@YAHPA_WPAPA_W@Z ?GetParentFolderPathEx@@YAHPAPA_W@Z ?GetParentGUIDs@_BACKUP_CREATE@@QAEHPAU_BACKUP_GUID@@0@Z ?GetParentProxyInformationByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAPAU_PROXY_@@@Z ?GetParentProxyInformationByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAPAU_PROXY_@@@Z ?GetPathFromEmailAccount@@YAHPA_W00@Z ?GetPathWithoutFTPPrefix@@YAPA_WPA_W@Z ?GetPhysicalDiskHardwareId@@YAHQA_WPAXPAKK@Z ?GetPhysicalDiskSerialNumber@@YAHQA_WPADPAK@Z ?GetPicturesPath@@YAHPAPA_W@Z ?GetPidginUsers@@YAHPAPAU_IM_EC_GUI_DISPLAY@@PAK@Z ?GetPrioritiesLevelByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAW4_BACKUP_PRIORITY_LEVEL@@1@Z ?GetPriorityLevelFromString@CBUScriptParser@@SAEPA_WPAW4_BACKUP_PRIORITY_LEVEL@@@Z ?GetProductID@CDiscRecorder@@QAEHPAPA_W@Z ?GetProductInstallDirectory@@YAPA_WPA_W@Z ?GetProfileIDToRunForSchedule@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_SCHEDULE_ID@@PAU_CBU_PROFILE_ID@@@Z ?GetProfileIDuint64Value@@YA_KPAU_CBU_PROFILE_ID@@@Z ?GetProfileLastRunResult@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAH@Z ?GetProfileListOfIDs@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHPAPAU_CBU_PROFILE_ID@@PAK@Z ?GetProfileListOfIDsByRange@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHKKPAPAU_CBU_PROFILE_ID@@PAK@Z ?GetProfileNames@@YAHQAU_FLAGS_EMAIL_CLIENT@@PA_W@Z ?GetProfilePathFromProfileName@@YAHPA_W0K0@Z ?GetProfileRevisionNo@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PA_K@Z ?GetProfileRunInformation@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAPAU_SYSTEMTIME@@PAPAHPA_K@Z ?GetProfileTimesInfo@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAU_SYSTEMTIME@@11@Z ?GetProjectCompilationDateAndTime@@YAHPAU_SYSTEMTIME@@@Z ?GetProxyInfoPointer@_BACKUP_RESTORE@@QAEPAU_PROXY_@@XZ ?GetProxyInformationByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAPAU_PROXY_@@@Z ?GetProxyInformationByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAPAU_PROXY_@@@Z ?GetQueueIDHiveAndPath@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHPAXW4_SCHEDULER_AND_PROFILE_MANAGER_ID_TYPE@@EPAPA_W2@Z ?GetRecorderIdByDriveLetter@@YAH_WPAPA_W@Z ?GetRegSubkeysForPath@@YAHPA_WKPAPAPA_WPAK@Z ?GetRegValuesForPath@@YAHPA_WKPAPAPA_WPAK@Z ?GetRegistryBackupSecurityAttributesInfoFlagByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAE@Z ?GetRegistryBackupSecurityAttributesInfoFlagByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAE@Z ?GetRegistryHivesFullPath@@YAHPAPAPA_WPA_K@Z ?GetRegistryHivesSize@@YAHPAPA_W_KPAHPA_K@Z ?GetRegistryHivesTruePath@@YAHPAPAPA_WPA_K@Z ?GetRemainingTrialDays@@YAHPAH0@Z ?GetRememberBackupPasswordFlag@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAE@Z ?GetRestoreDiskUsagePriority@_BACKUP_RESTORE@@QBE?AW4_BACKUP_PRIORITY_LEVEL@@XZ ?GetRestoreFileSecurity@_BACKUP_RESTORE@@QBEEXZ ?GetRestoreOptionsByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAPAXPAK@Z ?GetRestoreOptionsLength@_BACKUP_RESTORE@@QBEKXZ ?GetRestoreOptionsPointer@_BACKUP_RESTORE@@QBEPAXXZ ?GetRestoreProcessPriority@_BACKUP_RESTORE@@QBE?AW4_BACKUP_PRIORITY_LEVEL@@XZ ?GetRestoreSecurityFlagForItemsByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAE@Z ?GetRestoreSourceType@_BACKUP_RESTORE@@QBE?AW4_BACKUP_SOURCE_TYPE@@XZ ?GetRestoredBackupGUIDByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAU_BACKUP_GUID@@@Z ?GetRunEveryXMinutesTasksToRun@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHPAPAU_CBU_SCHEDULE_ID@@PAK@Z ?GetRunResult@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAH@Z ?GetSavFiles@@YAHPAPAPA_WPA_K@Z ?GetScanBeforeCreationFlag@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAE@Z ?GetScanBeforeCreationFlag@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAE@Z ?GetScheduleIDuint64Value@@YA_KPAU_CBU_SCHEDULE_ID@@@Z ?GetScheduleIconForDays@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHGGGGGGPAPAU_VECTOR_OF_EVENT_INFO@@@Z ?GetScheduleLastRunResult@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_SCHEDULE_ID@@PAH@Z ?GetScheduleListOfIDs@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHPAPAU_CBU_SCHEDULE_ID@@PAK@Z ?GetScheduleListOfIDsByRange@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHKKPAPAU_CBU_SCHEDULE_ID@@PAK1@Z ?GetScheduleModeInformationByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_SCHEDULE_ID@@PAEPAU_SYSTEMTIME@@PAG3PAIPA_K5PAPA_W1@Z ?GetScheduleOptions@CBUScriptParser@@QAEEPAEPAU_SYSTEMTIME@@PAIPAG0PAW4_CBU_GUI_RUN_MODE@@PA_K00@Z ?GetScheduleRunInformation@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_SCHEDULE_ID@@PAPAU_SYSTEMTIME@@PAPAHPA_K@Z ?GetScheduleRunNotifiedEvent@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEPAU_CORE_EVENT@@XZ ?GetScheduleTimesInfo@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_SCHEDULE_ID@@PAU_SYSTEMTIME@@111@Z ?GetScheduledTaskInfo@@YAHPA_WPAEPAU_SYSTEMTIME@@PAI32PAHPAG2PAK0K0K0K0K0K0K@Z ?GetSecondDiffenceBetweenDates@@YAHPAU_SYSTEMTIME@@0PA_J@Z ?GetSecondsPassedSince_1_Jan_1601_0_00_inclusive@@YAHPA_KPAU_SYSTEMTIME@@@Z ?GetSerialOld@@YAJPAUIWbemServices@@AAUtagVARIANT@@@Z ?GetServerNameFromPath@@YAPA_WPA_W@Z ?GetServiceName@WindowsServiceBase@@QBEPA_WXZ ?GetServiceNameDisplayed@WindowsServiceBase@@QBEPA_WXZ ?GetServiceStatus@WindowsServiceBase@@QAE?AU_SERVICE_STATUS@@XZ ?GetServiceTerminateEventPtr@WindowsServiceBase@@QAEPAU_CORE_EVENT@@XZ ?GetShowServiceModeNotificationByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAE@Z ?GetShutDownFlag@_BACKUP_CREATE@@QAEEXZ ?GetShutDownFlag@_BACKUP_RESTORE@@QAE?AW4_OPERATION_AFTER_RESTORE_IS_FINISHED@@XZ ?GetShutdownWhenFinishedFlagByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAE@Z ?GetShutdownWhenFinishedFlagByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAE@Z ?GetSkipLockedFiles@_BACKUP_RESTORE@@QBEHPAE@Z ?GetSkypeUsers@@YAHPAPAU_IM_EC_GUI_DISPLAY@@PAK@Z ?GetSnapShotNo@_BACKUP_RESTORE@@QBEHPA_K@Z ?GetSnapshotToRestoreIndex@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PA_K@Z ?GetSourcePathForBrowserFromString@CBUScriptParser@@SAEPA_WPAPAU_FLAGS_BACKUP_BROWSER_CLIENT@@PA_K@Z ?GetSourcePathForCustomRegistryFromString@CBUScriptParser@@SAEPA_WPAPA_WPA_K@Z ?GetSourcePathForDiskFromString@CBUScriptParser@@SAEPA_WPAPAU_NEW_FLAGS_DISK_BACKUP@@PA_K@Z ?GetSourcePathForEmailFromString@CBUScriptParser@@SAEPA_WPAPAU_FLAGS_EMAIL_CLIENT_NEW@@PA_K@Z ?GetSourcePathForFilesAndFoldersFromString@CBUScriptParser@@SAEPA_WPAPA_WPA_K@Z ?GetSourcePathForIMFromString@CBUScriptParser@@SAEPA_WPAPAU_FLAGS_INSTANT_MESS_NEW@@PA_K@Z ?GetSourcePathForPartitionFromString@CBUScriptParser@@SAEPA_WPAPAU_NEW_FLAGS_PARTITION_BACKUP_EX@@PA_K@Z ?GetSourcePathLength@_BACKUP_RESTORE@@QAEHPAK@Z ?GetSourceTypeFromString@CBUScriptParser@@SAEPA_WPAW4_BACKUP_SOURCE_TYPE@@@Z ?GetStepsCount@@YA_KPAU_BACKUP_PROGRESS_NEW@@@Z ?GetStorageDestinationTypeFromString@CBUScriptParser@@SAEPA_WPAW4_BACKUP_STORAGE_DESTINATION_TYPE@@@Z ?GetSupportedMediaType@CDiscFormatData@@QAEHKPAH@Z ?GetSupportedWriteSpeedDescriptors@CDiscFormatData@@QAEHPAPAUtagSAFEARRAY@@@Z ?GetSupportedWriteSpeeds@CDiscFormatData@@QAEHPAPAUtagSAFEARRAY@@@Z ?GetSystemFilePath2K@@YAHPAPAPA_WPA_K@Z ?GetSystemFilePath7@@YAHPAPAPA_WPA_K@Z ?GetSystemFilePathServer2003X64@@YAHPAPAPA_WPA_K@Z ?GetSystemFilePathServer2003X86@@YAHPAPAPA_WPA_K@Z ?GetSystemFilePathVista64@@YAHPAPAPA_WPA_K@Z ?GetSystemFilePathVista@@YAHPAPAPA_WPA_K@Z ?GetSystemFilePathXp64@@YAHPAPAPA_WPA_K@Z ?GetSystemFilePathXp@@YAHPAPAPA_WPA_K@Z ?GetSystemFilePaths@@YAHPAPAPA_WPA_K@Z ?GetTasksToRunBeforeAndAfterBackupForID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAPA_WPAE12@Z ?GetTasksToRunBeforeAndAfterBackupForID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAPA_WPAE12@Z ?GetTheNewSyncPath@@YAHPA_W0PAPA_W@Z ?GetThunderbirdProfiles@@YAHPAPAU_IM_EC_GUI_DISPLAY@@PAK@Z ?GetTime@@YAHPAPA_W@Z ?GetTimePassed@@YAHPAU_SYSTEMTIME@@00@Z ?GetTimePassedString@@YAHPAU_SYSTEMTIME@@PA_WK@Z ?GetTimePassedStringEx@@YAHPAU_SYSTEMTIME@@0PAPA_W@Z ?GetTimePassedStringHMS@@YAHPAU_SYSTEMTIME@@PA_WK@Z ?GetTimeRemaining@@YA?AU_SYSTEMTIME@@PAU_BACKUP_PROGRESS_NEW@@@Z ?GetTimeRemainingString@_BACKUP_CREATE@@QAEHPA_WK@Z ?GetTimeRemainingString@_BACKUP_RESTORE@@QAEHPA_WK@Z ?GetTimeRemainingStringBySeconds@@YAH_JPA_WK@Z ?GetTimeRemainingStringEx@_BACKUP_CREATE@@QAEHPA_WK@Z ?GetTopBackupIDAndRemoveItFromScheduleQueue@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHPAU_CBU_SCHEDULE_ID@@PAU_CBU_PROFILE_ID@@PAW4_SCHEDULER_AND_PROFILE_MANAGER_ID_TYPE@@E@Z ?GetTopIDWithoutRemovingFromQueue@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHPAU_CBU_SCHEDULE_ID@@PAU_CBU_PROFILE_ID@@PAW4_SCHEDULER_AND_PROFILE_MANAGER_ID_TYPE@@EPAPA_W3@Z ?GetTotalSpaceOnMedia@CDiscFormatData@@QAEHPA_K@Z ?GetTotalSupportedMediaTypes@CDiscFormatData@@QAEHPAK@Z ?GetTotalVolumePaths@CDiscRecorder@@QAEHPAK@Z ?GetTransferSpeedAndInfo@_BACKUP_CREATE@@QAEHPAPA_W00@Z ?GetTransferSpeedAndInfo@_BACKUP_RESTORE@@QAEHPAPA_W00@Z ?GetTreeForPath@@YAHPA_WKPAPAU_FILES_AND_DIRS_TREE_ITEM@@W4_LOCKED_FILES_TREATMENT_@@PCH3PAPA_WK4KKEPAU_CORE_LOG_HANDLE@@@Z ?GetTreeFromCBUFile@@YAHW4_TREE_FROM_CBU_PURPOSE@@W4_BACKUP_STORAGE_DESTINATION_TYPE@@PA_WPAXK_KPAPAU_FILES_AND_DIRS_TREE_ITEM@@PAU_BACKUP_OFFSET_CONTEXT_HANDLE@@PA_K7PAU_CONNECTION_INFORMATIONS_@@PAU_PROXY_@@PAU_CBU_CACHE_INFORMATION@@@Z ?GetTreeMetadataFilePath@@YAHPA_WW4_SYNC_TREE_TYPE@@PAPA_W@Z ?GetTreeMetadataSyncDirPath@@YAHPAU_CBU_PROFILE_ID@@PAPA_W@Z ?GetTypeFromString@CBUScriptParser@@SAEPA_WPAW4_BACKUP_TYPE@@@Z ?GetUniqueSoftwareOS_ID@@YAHPAPAXPAK@Z ?GetUnprependedPath@@YAPA_WPA_W@Z ?GetUnprependedPathEx@@YAHPAPA_W@Z ?GetUserModeCurrentToken@@YAHPAPAX@Z ?GetUserPath@@YAHPAPA_WPA_W@Z ?GetUserScheduleId@@YAHPAU_CBU_SCHEDULE_ID@@PAU_CBU_PROFILE_ID@@PA_W@Z ?GetUserSubscriptionInformation@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHPAW4_COS_SUBSCRIPTION_TYPE@@PA_KPAU_SYSTEMTIME@@2PCH@Z ?GetUtcTime@@YAHPAU_SYSTEMTIME@@@Z ?GetValueFromRegKeyBuffer@@YAHPA_W00_K0PAXK@Z ?GetValueFromRegKeyBufferEncrypted@@YAHPA_W00_K0PAPAXPAK@Z ?GetValueFromRegKeyBufferEx@@YAHPA_W00_K0PAPAXPAK@Z ?GetValueFromRegKeyDate@@YAHPA_W00_K0PAU_SYSTEMTIME@@@Z ?GetValueFromRegKeyMultiString@@YAHPA_W00_K0PAPAPA_WPAK@Z ?GetValueFromRegKeyString@@YAHPA_W00_K0PAPA_W@Z ?GetVerifyAfterCreationFlag@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAE@Z ?GetVerifyAfterCreationFlag@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAE@Z ?GetVerifyBeforeRestoreFlagByID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAE@Z ?GetVerifyImage@_BACKUP_RESTORE@@QBEEXZ ?GetViableDisks@@YAH_KEPAPAU_RESTORE_DISK_VIABLE@@PAK@Z ?GetViablePartitions@@YAH_KPAPAU_RESTORE_PARTITION_VIABLE@@PAKPAE@Z ?GetVideosPath@@YAHPAPA_W@Z ?GetVolumePath@CDiscRecorder@@QAEHKPAPA_W@Z ?GetVolumeRestoreToDefaultLocationFlags@@YAHPAU_FLAGS_VOLUME_BACKUP_RESTORE@@PAPAE@Z ?GetWLMUsers@@YAHPAPAU_IM_EC_GUI_DISPLAY@@PAK@Z ?GetWLMailProfiles@@YAHPAPAU_IM_EC_GUI_DISPLAY@@PAK@Z ?GetWMailProfiles@@YAHPAPAU_IM_EC_GUI_DISPLAY@@PAK@Z ?GetWindowsDrive2@@YAHQAD@Z ?GetWindowsDrive@@YAHPA_W@Z ?GetWindowsPath@@YAHPAPA_W@Z ?GetWindowsUserSID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAPA_W@Z ?GetWindowsUserSID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAPA_W@Z ?GetWindowsVersion@@YAHPAE0@Z ?GetYahooUsers@@YAHPAPAU_IM_EC_GUI_DISPLAY@@PAK@Z ?HEXADBGPRINT@@YAXPAX_K@Z ?HRESULT_ToApiStatus@@YAHJ@Z ?HResultToApiStatus@@YAHJ@Z ?HeapMake@@YAHPAU_FSVECTOR@@K@Z ?HeapShiftDown@@YAHPAU_FSVECTOR@@KK@Z ?HeapSort@@YAHPAU_FSVECTOR@@K@Z ?HeapSortCompareASTR@@YAHPAX0@Z ?HeapSortCompareInt@@YAHPAX0@Z ?HeapSortCompareWSTR@@YAHPAX0@Z ?HeapSortElements@@YAHPAXKKP6AH00@Z@Z ?HeapSortElementsNonPaged@@YAHPAXKKP6AH00@Z@Z ?HeapSortElementsPaged@@YAHPAXKKP6AH00@Z@Z ?HeapSortICompareASTR@@YAHPAX0@Z ?HeapSortICompareWSTR@@YAHPAX0@Z ?IgnoreUnsafeRegKey@@YAHPA_W0@Z ?ImpersonateExplorer@@YAHPA_W@Z ?IncreaseCurrentStepPosition@@YAHPAU_BACKUP_PROGRESS_NEW@@_K@Z ?IncreaseStepsCount@@YAHPAU_BACKUP_PROGRESS_NEW@@_K@Z ?Init@CDiscFormatData@@QAEHPAVCDiscRecorder@@PA_WE@Z ?Init@CDiscRecorder@@QAEHPA_W@Z ?InitCloneOptionsDriveLetterFree@@YAHPAXW4_BACKUP_SOURCE_TYPE@@0PAU_NEW_DISK_PARTITION_TRACK0_RESTORE_OPTIONS@@@Z ?InitFSVector@@YAHPAU_FSVECTOR@@@Z ?InitOpticalMediaIMAPICtx@@YAHPAU_OPTICAL_MEDIA_IMAPI_RECORDER_CONTEXT@@PA_W@Z ?InitPartitionDiskRestoreOptions@@YAHPAX0W4_BACKUP_SOURCE_TYPE@@PAU_NEW_DISK_PARTITION_TRACK0_RESTORE_OPTIONS@@E@Z ?InitRestoreOptions2@@YAHPAXW4_BACKUP_SOURCE_TYPE@@PAU_CORE_LOG_HANDLE@@PA_W0PAU_IM_EC_RESTORE_OPTIONS@@@Z ?InitRestoreOptions2New@@YAHPAXW4_BACKUP_SOURCE_TYPE@@PAU_CORE_LOG_HANDLE@@PA_W0KPAPAXPAK@Z ?InitializeAllSharedHandles@@YAHPAU_GLOBAL_MAPPED_SHARED_MEMORY_HANDLES@@@Z ?InitializeAndGetTreeMetadataSyncDirPath@@YAHPAU_CBU_PROFILE_ID@@PAPA_W@Z ?InitializeBackupCreateByHistoryID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAV_BACKUP_CREATE@@PAPAXPAKPAPAU_CONNECTION_INFORMATIONS_@@PAPAU_PROXY_@@45P6AHPAX@Z7@Z ?InitializeBackupCreateByProfileID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAV_BACKUP_CREATE@@PAPAXPAKPAPAU_CONNECTION_INFORMATIONS_@@PAPAU_PROXY_@@45P6AHPAX@Z7@Z ?InitializeBackupRestoreByHistoryID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAV_BACKUP_RESTORE@@PAPAXPAKPAPAU_CONNECTION_INFORMATIONS_@@PAPAU_PROXY_@@P6AHPAX@Z723@Z ?InitializeCOSClientRQHandles@@YAHPAU_COS_CLIENT_RQ_HANDLES@@KEE@Z ?InitializeProgress@@YAHPAU_BACKUP_PROGRESS_NEW@@P6AHPAX_K2EE@Z122@Z ?InsertBackslashForEscapeChars@@YAHPA_WK@Z ?InstallCBUCertificate@@YAHPA_W@Z ?InstallVDBusDriver@@YAHXZ ?InstallVDBusDriverEx@@YAHXZ ?Instance@_COS_CLIENT_OPERATION_CONTROLLER@@SAAAV1@XZ ?IsAdmin@@YAHXZ ?IsAnyBackupQueued@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHEPAEPAU_CBU_SCHEDULE_ID@@PAU_CBU_PROFILE_ID@@PAW4_SCHEDULER_AND_PROFILE_MANAGER_ID_TYPE@@@Z ?IsBETAVersion@@YAEXZ ?IsBackupEstimationThreadRunning@_BACKUP_CREATE@@QAEHXZ ?IsBackupPasswordCorrectForID@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAXKPAE@Z ?IsBackupPasswordCorrectForID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAXKPAE@Z ?IsBackupRunning@_BACKUP_CREATE@@QAEEXZ ?IsBrowsingFinished@_NETWORK_BROWSER_CLASS@@QAEHPAE@Z ?IsCTMInstalled@@YAHPAE@Z ?IsCloudBETAVersion@@YAEXZ ?IsCurrentMediaBlank@CDiscFormatData@@QAEHPAE@Z ?IsCurrentMediaSupported@CDiscFormatData@@QAEHPAVCDiscRecorder@@PAE@Z ?IsCurrentProcessElevated@@YAHPAE@Z ?IsCurrentUserAdmin@@YAEXZ ?IsCurrentUserAdminEx@@YAEXZ ?IsDiskDynamic@@YAHHPAE@Z ?IsDiskDynamicEx@@YAHPAU_CORE_FILE_HANDLE@@PAE@Z ?IsFileInWildCardList@@YAHPA_WPAEPAPA_WK2K@Z ?IsFilePathDrive@@YAHPA_W@Z ?IsFilePathInExclusionList@@YAEPB_WPAPA_WK@Z ?IsHarddiskVolume@@YAHPA_W@Z ?IsInWildCardList@@YAHPA_WPAEPAPA_WK2KKKPA_K@Z ?IsLeapYear@@YAEK@Z ?IsMbrRestored@@YAEPAU_NEW_DISK_PARTITION_TRACK0_RESTORE_OPTIONS@@@Z ?IsMediaBlank@@YAHPAU_OPTICAL_MEDIA_IMAPI_RECORDER_CONTEXT@@PAE@Z ?IsNTFSPath@@YAHPA_WPAH@Z ?IsParameterUnique@CBUScriptParser@@AAEHPA_W@Z ?IsPasswordSavedForHistoryEvent@_CBU_HISTORY_MANAGER@@QAEHU_CBU_HISTORY_ID@@PAE@Z ?IsPasswordSavedForProfile@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAE@Z ?IsProfileRunning@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAE@Z ?IsRegDebuggingEnabled@@YAEXZ ?IsRegisteredAsCOSClient@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHU_COS_CLIENT_ID@@@Z ?IsRestoreRunning@_BACKUP_RESTORE@@QAEEXZ ?IsScheduleRunning@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_SCHEDULE_ID@@PAE@Z ?IsThisSericeModeApplication@@YAEXZ ?IsUacEnabled@@YAHXZ ?IsUserFirstUse@@YAHPA_WPAE@Z ?IsValidCBUScript@CBUScriptParser@@QAEEXZ ?IsValidCoreFileHandle@@YAEPAU_CORE_FILE_HANDLE@@@Z ?IsValidCoreFindHandle@@YAEPAU_CORE_FIND_HANDLE@@@Z ?IsValidCoreStringA@@YAEPAXK@Z ?IsValidCoreStringW@@YAEPAXK@Z ?IsValidCoreThreadHandle@@YAEPAU_CORE_THREAD_HANDLE@@@Z ?IsValidDate@@YAEPAU_SYSTEMTIME@@@Z ?IsValidHistoryId@_CBU_HISTORY_MANAGER@@QAEEU_CBU_HISTORY_ID@@@Z ?IsValidProfileId@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEEU_CBU_PROFILE_ID@@@Z ?IsValidScheduleId@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEEU_CBU_SCHEDULE_ID@@@Z ?IsWildCardInString@@YAHPA_W0PAE@Z ?ListenRunProcessRequestsThreadBody@@YAXPAX@Z ?LoadBackupFromScript@_BACKUP_CREATE@@QAEHPA_WP6AH0PAE@ZP6AH0PAPAXPAK@Z@Z ?LoadCOSConfigFromRegistry@@YAHPAPA_WPAW4_CORE_LOG_LEVEL@@@Z ?LoadWindowsIntoMemory@@YAHXZ ?MainAppStarted@@YAHXZ ?MakeCompletePathFromTree@@YAHPAU_FILES_AND_DIRS_TREE_ITEM@@PAPA_WW4_BACKUP_STORAGE_DESTINATION_TYPE@@PA_W@Z ?MakeECProfilePath@@YAPA_WKPA_W0@Z ?MakeIMUserPath@@YAPA_WKPA_W0@Z ?MapFullCOSRQSharedMemStruct@@YAHPAU_COS_CLIENT_RQ_HANDLES@@PAPAU_COS_CLIENT_RQ_SHARED_MEM_STRUCT@@@Z ?MarkLicenseAsValidated@@YAHXZ ?MicrosoftOutlook2003Backup@@YAHPAU_BACKUP_CONTEXT@@PA_WPAU_BACKUP_CREATE_INFORMATION_DATA@@PAU_CORE_LOG_HANDLE@@PAU_BACKUP_PROGRESS_NEW@@HPCHPAU_FLAGS_EMAIL_CLIENT@@1@Z ?MicrosoftOutlook2003BackupNew@@YAHPAU_BACKUP_CONTEXT@@0PA_WPAU_BACKUP_CREATE_INFORMATION_DATA@@PAU_CORE_LOG_HANDLE@@PAU_BACKUP_PROGRESS_NEW@@HPCHPAU_FLAGS_EMAIL_CLIENT_NEW@@K1PAPAU_FILES_AND_DIRS_TREE_ITEM@@7@Z ?MicrosoftOutlook2003GetCount@@YAHPAU_BACKUP_PROGRESS_NEW@@PAU_CORE_LOG_HANDLE@@PAU_FLAGS_EMAIL_CLIENT@@PCHPA_W@Z ?MicrosoftOutlook2003GetCountNew@@YAHPAU_BACKUP_CONTEXT@@PAU_BACKUP_CREATE_INFORMATION_DATA@@PAU_FLAGS_EMAIL_CLIENT_NEW@@KEPA_WPAPAPAU_FILES_AND_DIRS_TREE_ITEM@@PAKPAPAU4@@Z ?MicrosoftOutlook2007Backup@@YAHPAU_BACKUP_CONTEXT@@PA_WPAU_BACKUP_CREATE_INFORMATION_DATA@@PAU_CORE_LOG_HANDLE@@PAU_BACKUP_PROGRESS_NEW@@HPCHPAU_FLAGS_EMAIL_CLIENT@@1@Z ?MicrosoftOutlook2007BackupNew@@YAHPAU_BACKUP_CONTEXT@@0PA_WPAU_BACKUP_CREATE_INFORMATION_DATA@@PAU_CORE_LOG_HANDLE@@PAU_BACKUP_PROGRESS_NEW@@HPCHPAU_FLAGS_EMAIL_CLIENT_NEW@@K1PAPAU_FILES_AND_DIRS_TREE_ITEM@@7@Z ?MicrosoftOutlook2007GetCount@@YAHPAU_BACKUP_PROGRESS_NEW@@PAU_CORE_LOG_HANDLE@@PAU_FLAGS_EMAIL_CLIENT@@PCHPA_W@Z ?MicrosoftOutlook2007GetCountNew@@YAHPAU_BACKUP_CONTEXT@@PAU_BACKUP_CREATE_INFORMATION_DATA@@PAU_FLAGS_EMAIL_CLIENT_NEW@@KEPA_WPAPAPAU_FILES_AND_DIRS_TREE_ITEM@@PAKPAPAU4@@Z ?MicrosoftOutlook2010BackupNew@@YAHPAU_BACKUP_CONTEXT@@0PA_WPAU_BACKUP_CREATE_INFORMATION_DATA@@PAU_CORE_LOG_HANDLE@@PAU_BACKUP_PROGRESS_NEW@@HPCHPAU_FLAGS_EMAIL_CLIENT_NEW@@K1PAPAU_FILES_AND_DIRS_TREE_ITEM@@7@Z ?MicrosoftOutlook2010GetCountNew@@YAHPAU_BACKUP_CONTEXT@@PAU_BACKUP_CREATE_INFORMATION_DATA@@PAU_FLAGS_EMAIL_CLIENT_NEW@@KEPA_WPAPAPAU_FILES_AND_DIRS_TREE_ITEM@@PAKPAPAU4@@Z ?MonitorServiceByAttachingTh@@YAXPAX@Z ?MonthTo3LetterString@@YAPA_WG@Z ?MountCBUImageAsVirtualDrive@_BACKUP_RESTORE@@QAEHPA_WKE@Z ?MountCbuFileSystemAsVirtualDrive@@YAHPA_W_KPADPAPA_WPAXKPCHPAU_BACKUP_PROGRESS_NEW@@@Z ?MountProgressThread@@YAXPAX@Z ?MultiThreadDecrypt@@YAHEEPAXK0K0@Z ?MultiThreadEncrypt@@YAHEEPAXK0K0@Z ?NativeRenameBOOTSTATFile@@YAHXZ ?NetworkBrowseComputers@@YAHPAPAPA_WPAK@Z ?NetworkBrowseComputers@@YAHPAPAU_INFO_COMPUTER@@PAKP6AHPAU1@PAX@Z3@Z ?NetworkBrowseFiles@@YAHPA_WPAPAU_INFO_FILE@@PAK00@Z ?NetworkBrowseFoldersShare@@YAHPA_WPAPAPA_WPAKE00@Z ?NetworkFreeList@@YAHPAPAPA_WPAK@Z ?NetworkFreeList@@YAHPAPAU_INFO_COMPUTER@@PAK@Z ?NetworkFreeList@@YAHPAPAU_INFO_FILE@@PAK@Z ?NetworkTestConnect@@YAHPA_WPAE00@Z ?NormalizeSizeForUnits@@YAH_JPAPA_W@Z ?NotifyThatBackupIsScheduled@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_SCHEDULE_ID@@@Z ?NtStatusToApiStatus@@YAHJ@Z ?NullFunction@@YAXXZ ?NullFunctionEx@@YAXPAXZZ ?OnClickMount@@YAHPA_WPAXKPAU_CONNECTION_INFORMATIONS_@@P6AH1_K3EE@Z1D@Z ?OpenFTPConnection@@YAHPAU_PROXY_@@PAPAX@Z ?OutlookExpressBackup@@YAHPAU_BACKUP_CONTEXT@@PA_WPAU_BACKUP_CREATE_INFORMATION_DATA@@PAU_CORE_LOG_HANDLE@@PAU_BACKUP_PROGRESS_NEW@@HPCHPAU_FLAGS_EMAIL_CLIENT@@1@Z ?OutlookExpressBackupNew@@YAHPAU_BACKUP_CONTEXT@@0PA_WPAU_BACKUP_CREATE_INFORMATION_DATA@@PAU_CORE_LOG_HANDLE@@PAU_BACKUP_PROGRESS_NEW@@HPCHPAU_FLAGS_EMAIL_CLIENT_NEW@@K1PAPAU_FILES_AND_DIRS_TREE_ITEM@@7@Z ?OutlookExpressGetCount@@YAHPAU_BACKUP_PROGRESS_NEW@@PAU_CORE_LOG_HANDLE@@PAU_FLAGS_EMAIL_CLIENT@@PCHPA_W@Z ?OutlookExpressGetCountNew@@YAHPAU_BACKUP_CONTEXT@@PAU_BACKUP_CREATE_INFORMATION_DATA@@PAU_FLAGS_EMAIL_CLIENT_NEW@@KEPA_WPAPAPAU_FILES_AND_DIRS_TREE_ITEM@@PAKPAPAU4@@Z ?ParseStringBySeparators@@YAKPADPAPAPAD0@Z ?PauseBackup@_BACKUP_CREATE@@QAEHXZ ?PauseRecovery@_BACKUP_RESTORE@@QAEHXZ ?PerformBrowserClientBackup@@YAHPAU_BACKUP_CREATE_INFORMATION_DATA@@@Z ?PerformBrowserClientRestore@@YAHPAU_BACKUP_RESTORE_INFORMATION_DATA@@@Z ?PerformDiagnostics@@YAHPANPAEPA_W2P6AHPAPA_WPAX@Z11@Z ?PerformEmailClientBackup@@YAHPAU_BACKUP_CREATE_INFORMATION_DATA@@@Z ?PerformEmailClientBackupNew@@YAHPAU_BACKUP_CREATE_INFORMATION_DATA@@@Z ?PerformEmailClientRestore@@YAHPAU_BACKUP_RESTORE_INFORMATION_DATA@@@Z ?PerformEmailClientRestoreNew@@YAHPAU_BACKUP_RESTORE_INFORMATION_DATA@@@Z ?PerformIMBackup@@YAHPAU_BACKUP_CREATE_INFORMATION_DATA@@@Z ?PerformIMBackupNew@@YAHPAU_BACKUP_CREATE_INFORMATION_DATA@@@Z ?PerformIMRestore@@YAHPAU_BACKUP_RESTORE_INFORMATION_DATA@@@Z ?PerformIMRestoreNew@@YAHPAU_BACKUP_RESTORE_INFORMATION_DATA@@@Z ?PerformItemContentDeserialization@@YAHPAU_BACKUP_CONTEXT@@PAU_BACKUP_OFFSET_CONTEXT_HANDLE@@PA_KPA_W_K3PAU_CORE_LOG_HANDLE@@E3PAU_FILES_AND_DIRS_TREE_ITEM@@PAEPCHPAU_BACKUP_PROGRESS_NEW@@@Z ?PerformRecoverRegistryHives@@YAHPAU_BACKUP_RESTORE_INFORMATION_DATA@@@Z ?PerformRecoverSystemFiles@@YAHPAU_BACKUP_RESTORE_INFORMATION_DATA@@@Z ?PerformRegistryHivesBackup@@YAHPAU_BACKUP_CREATE_INFORMATION_DATA@@@Z ?PerformSimpleCopyBackupToOpticalMedia_IMAPI@@YAHPAU_BACKUP_CREATE_INFORMATION_DATA@@@Z ?PerformSystemFilesBackup@@YAHPAU_BACKUP_CREATE_INFORMATION_DATA@@@Z ?PidginBackup@@YAHPAU_BACKUP_CONTEXT@@PA_WPAU_BACKUP_CREATE_INFORMATION_DATA@@PAU_CORE_LOG_HANDLE@@PAU_BACKUP_PROGRESS_NEW@@HPCHPAU_FLAGS_INSTANT_MESS@@1@Z ?PidginBackupNew@@YAHPAU_BACKUP_CONTEXT@@0PA_WPAU_BACKUP_CREATE_INFORMATION_DATA@@PAU_CORE_LOG_HANDLE@@PAU_BACKUP_PROGRESS_NEW@@HPCHPAU_FLAGS_INSTANT_MESS_NEW@@K1PAPAU_FILES_AND_DIRS_TREE_ITEM@@7@Z ?PidginGetCount@@YAHPAU_BACKUP_PROGRESS_NEW@@PAU_CORE_LOG_HANDLE@@PAU_FLAGS_INSTANT_MESS@@PCHPA_W@Z ?PidginGetCountNew@@YAHPAU_BACKUP_CONTEXT@@PAU_BACKUP_CREATE_INFORMATION_DATA@@PAU_FLAGS_INSTANT_MESS_NEW@@KEPA_WPAPAPAU_FILES_AND_DIRS_TREE_ITEM@@PAKPAPAU4@@Z ?PrintEncryptedInfoA@@YAHPAD@Z ?PrintEncryptedInfoW@@YAHPA_W@Z ?PrintSystemErrorMessage@@YAXPA_WKH@Z ?PushBackFSVector@@YAHPAU_FSVECTOR@@PA_W@Z ?QueryCOSDirectory@@YAHPAU_COS_FILE_BACKUP_CTX@@PAU_CONNECTION_INFORMATIONS_@@PA_WPAU_FSVECTOR@@PCH@Z ?RadixSortItems@@YAHPAXKKP6A_K0@Z_KW4_SORT_TYPE@@E@Z ?ReInitOpticalMediaIMAPICtx@@YAHPAU_OPTICAL_MEDIA_IMAPI_RECORDER_CONTEXT@@@Z ?ReInitialize@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHE@Z ?ReadHashFromFile@@YAHPAD00PAPAD@Z ?ReadInformationData@@YAHPA_WPAPAU_BACKUP_RESTORE_INFORMATION_DATA@@@Z ?RegDelnodeRecurse@@YAHPA_W0@Z ?RegKeyHasIgnoredSubkeys@@YAFPA_W@Z ?RegKeyHasSubkeys@@YAHPA_WKPAH@Z ?RegKeyHasValues@@YAHPA_WKPAH@Z ?RegPathIsInPathColletion@@YAHPA_W0KPAPA_WK_W@Z ?RegisterAsCOSClient@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHU_COS_CLIENT_ID@@_KEPCH@Z ?Release@_NETWORK_BROWSER_CLASS@@QAEHXZ ?ReleaseAllSharedHandles@@YAXPAU_GLOBAL_MAPPED_SHARED_MEMORY_HANDLES@@@Z ?ReleaseCOSClientRQHandles@@YAHPAU_COS_CLIENT_RQ_HANDLES@@@Z ?ReleaseCollection@@YAHPAPAPA_WK@Z ?ReleaseExclusiveAccess@CDiscRecorder@@QAEHXZ ?ReleaseFileInfoTree@@YAHPAU_FS_FILE_INFO@@@Z ?ReleaseFileSystemTree@@YAHPAU_FILE_SYSTEM_TREE_NODE@@@Z ?ReleaseFilesAndDirsNewTree@@YAHPAPAU_FILES_AND_DIRS_TREE_ITEM@@@Z ?ReleaseFilesAndDirsNewTreeAndMetadata@@YAHPAPAU_FILES_AND_DIRS_TREE_ITEM@@@Z ?ReleaseMountInfoStruct@@YAXPAPAUFileSysMountInfo@@@Z ?ReleaseOpticalDriveList@@YAXPAPAU_OPTICAL_DRIVE_INFO@@K@Z ?ReleaseOpticalMediaIMAPICtx@@YAHPAU_OPTICAL_MEDIA_IMAPI_RECORDER_CONTEXT@@@Z ?ReleaseRegTree@@YAHPAPAU_REGISTRY_TREE@@@Z ?ReleaseRegTreeIterative@@YAHPAPAU_REGISTRY_TREE@@@Z ?ReleaseRegTreeRec@@YAXPAU_REGISTRY_TREE_NODE@@@Z ?RemoveCallback@@YAHPAXPAU_SP_DEVINFO_DATA@@K0@Z ?RemoveFileNameFromPath@@YAHPA_W0@Z ?RemoveFlagForTreeItemAndChilds@@YAHPAU_FILES_AND_DIRS_TREE_ITEM@@K@Z ?RemoveIDFromQueue@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHPAXW4_SCHEDULER_AND_PROFILE_MANAGER_ID_TYPE@@E@Z ?RemoveIndexingAndMonitoring@@YAHXZ ?RemoveKernelFormat@@YAHPAPA_W@Z ?RemoveLastDirectoryFromPath@@YAHPA_W@Z ?RemoveMultipleBackslashFromPathString@@YAHPA_W@Z ?RemoveNetworkConnection@@YAHPA_WE@Z ?RemovePathsForInstantScan@@YAHPA_WE@Z ?RemoveServerNameFromPath@@YAHPAPA_W@Z ?RemoveTokenSystemPrivileges@@YAHPAXPA_W@Z ?RemoveVDBusDriver@@YAHXZ ?RenameCBUBackup@@YAHW4_BACKUP_STORAGE_DESTINATION_TYPE@@PA_W1PAXKPAU_CONNECTION_INFORMATIONS_@@PAU_PROXY_@@PAU_CBU_CACHE_INFORMATION@@@Z ?ReportProductEvent@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHW4_CCLOUD_PROGRAM_MONITOR_EVENTS@@PA_W1111PCH@Z ?ReportSvcStatus@WindowsServiceBase@@IAEXKKK@Z ?RequestCurrentProcessElevation@@YAHPA_W0@Z ?ResetComodoRegistryKeysSecurity@@YAHXZ ?ResetRunInfoForProfile@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@@Z ?ResetWindowsTaskSchedulerInfoForProfileID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@@Z ?ResizeFSVector@@YAHPAU_FSVECTOR@@@Z ?RestoreEncryptFile@@YAHPA_WPAU_BACKUP_CONTEXT@@PAU_BACKUP_PROGRESS_NEW@@PCHPAU_CORE_LOG_HANDLE@@H@Z ?RestoreItemSACLsandDACLs@@YAHPAU_FILES_AND_DIRS_TREE_ITEM@@PA_W@Z ?RestoreSparseFile@@YAHPAU_CORE_FILE_HANDLE@@_KPAU_BACKUP_CONTEXT@@PAU_BACKUP_PROGRESS_NEW@@PCHH@Z ?ResumeBackup@_BACKUP_CREATE@@QAEHXZ ?ResumeRecovery@_BACKUP_RESTORE@@QAEHXZ ?RetrieveBestSupportedOpticalDiscFileSystem@@YA?AW4OPTICAL_MEDIA_FS_TYPE@@XZ ?RetrieveDiskInfoByHardwareId@@YAHPAXKPAU_CORE_FILE_HANDLE@@PAKPA_K@Z ?RetrieveIndexedFiles@@YAHQB_W_KEPAPAXPAK@Z ?RetrieveIndexedFilesCountAndSize@@YAHQB_W_KPA_K2PAE@Z ?RetrieveInstalledBrowserClients@@YAHPAPAU_Node@@@Z ?RetrieveInstalledEmailClients@@YAHPAPAU_Node@@@Z ?RetrieveInstalledInstantMessengers@@YAHPAPAU_Node@@@Z ?RetrievePartitionInfoByHandle@@YAHPAU_CORE_FILE_HANDLE@@PA_K1PAKPAE@Z ?RetrievePartitionInfoByPartitionNumber@@YAHPAU_CORE_FILE_HANDLE@@KPA_K1PAE@Z ?RetrievePartitionInfoByPartitionNumber@@YAHQA_WKPA_K1PAEPAD0@Z ?RetrieveSyncBackupTreeWithFullItemPath@@YAHPAU_CBU_PROFILE_ID@@PAPAU_FILES_AND_DIRS_TREE_ITEM@@@Z ?RetrieveVolumeGUIDFromPartitionInformation@@YAH_K0PAXKPAPA_W@Z ?RetrivePort@@YAHPA_WPAPA_WPAG@Z ?ReturnDriveInfo@@YAHPA_W00@Z ?RevertBOOTSTATFileName@@YAHXZ ?RunBackupProcessAsCurrentUser@@YAHPAXW4_SCHEDULER_AND_PROFILE_MANAGER_ID_TYPE@@@Z ?RunFirstQueuedBackup@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHP6AHPAX_K1EE@Z0P6AHPA_WPAPAXPAK45@ZP6AH345@ZPAV_BACKUP_CREATE@@P6AHPAPA_W0@ZP6AH0@ZP6AH0@ZPAW4_CBU_GUI_RUN_MODE@@PAEPAU_CBU_SCHEDULE_ID@@PAU_CBU_PROFILE_ID@@PAW4_SCHEDULER_AND_PROFILE_MANAGER_ID_TYPE@@0P6A?AW4MALWARE_SCAN_ACTION@@3@Z@Z ?RunSpecificProfileBackup@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@P6AHPAX_K2EE@Z1P6AHPA_WPAPAXPAK56@ZP6AH456@ZPAV_BACKUP_CREATE@@P6AHPAPA_W1@ZP6AH1@ZP6AH1@ZPAW4_CBU_GUI_RUN_MODE@@1P6A?AW4MALWARE_SCAN_ACTION@@4@Z2EPAU_SYSTEMTIME@@PAU6@@Z ?RunSpecificScheduledBackup@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_SCHEDULE_ID@@PAEP6AHPAX_K3EE@Z2P6AHPA_WPAPAXPAK67@ZP6AH567@ZPAV_BACKUP_CREATE@@P6AHPAPA_W2@ZP6AH2@ZP6AH2@ZPAW4_CBU_GUI_RUN_MODE@@2P6A?AW4MALWARE_SCAN_ACTION@@5@Z@Z ?RunningInPEEnvironment@@YAEXZ ?SaveBackupToScript@_BACKUP_CREATE@@QAEHPA_WP6AH0PAE@ZP6AH0PAPAXPAK@Z@Z ?SaveRestoreToScript@_BACKUP_RESTORE@@QAEHPA_WPAXKP6AH0PAE@ZP6AH0PAPAXPAK@Z@Z ?ScheduleForNativeRestore@_BACKUP_RESTORE@@QAEHPAXKP6AHPAPA_W0@ZP6AHXZ@Z ?SearchInCustomString@@YAHPA_W0_WPAE@Z ?SearchInListOfStrings@@YAHPAPA_W_KPA_WPAE@Z ?SearchInWriteList@@YAHPAPA_W_KPA_WPAE@Z ?SearchSubstringInListOfStrings@@YAHPAPA_W_KPA_WPAE@Z ?SendClientKeepAliveSignal@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHPCH@Z ?SendDismountIoctlForPartitionList@@YAHPAU_CBU_MOUNT_DEVICE_INFORMATIONS@@_K@Z ?SendEmail@@YAHPAU_EMAIL_INFORMATIONS@@@Z ?SendMountInfoToReparseDriver@@YAHPAXEPA_WIDT_LARGE_INTEGER@@0K_K@Z ?SendMountIoctlForPartitionList@@YAHPAU_CBU_MOUNT_DEVICE_INFORMATIONS@@_K@Z ?SendMountIoctlForSinglePartition@@YAHPAU_CBU_MOUNT_DEVICE_INFORMATIONS@@@Z ?SendNotificationEmail@_BACKUP_CREATE@@QAEHPAU_BACKUP_EMAIL_NOTIFICATION_INFORMATION@@EPA_W@Z ?SendRunProcessRequestThreadBody@@YAXPAX@Z ?SerializeBackupTree@@YAHPAU_FILES_AND_DIRS_TREE_ITEM@@PAU_BACKUP_CONTEXT@@PAU_CORE_LOG_HANDLE@@PCHEE@Z ?SerializeCBUImageMountingInfoStruct@@YAHPAU_CBU_IMAGE_MOUNTING_INFO@@PAPAXPAK@Z ?SerializeCbuFsMountInfoStruct@@YAHPAUFileSysMountInfo@@PAPAXPAK@Z ?SerializeInformationData@@YAHPA_WPAU_BACKUP_RESTORE_INFORMATION_DATA@@@Z ?SerializeTreeToBackupInAdvance@@YAHPA_WPAU_BACKUP_CONTEXT@@PAU_BACKUP_PROGRESS_NEW@@PAPAU_FILES_AND_DIRS_TREE_ITEM@@W4_LOCKED_FILES_TREATMENT_@@PCHPAPA_WK6KKEPAU3@@Z ?Serialize_BACKUP_CREATE@_BACKUP_CREATE@@QAEHPAPAXPAK@Z ?ServiceTaskNotification@@YAXPAU_SERVICE_TASK_EXECUTION@@@Z ?SetActionAfterRestore@_BACKUP_RESTORE@@QAEHW4_OPERATION_AFTER_RESTORE_IS_FINISHED@@@Z ?SetActualProgressRation@@YAHPAU_BACKUP_PROGRESS_NEW@@_K1@Z ?SetAddToHistory@_BACKUP_RESTORE@@QAEHE@Z ?SetAddToHistoryFlagByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAE@Z ?SetBackupActualType@_BACKUP_CREATE@@QAEHW4_BACKUP_TYPE@@@Z ?SetBackupAddToHistory@_BACKUP_CREATE@@QAEHPAE@Z ?SetBackupCompressionLevel@_BACKUP_CREATE@@QAEHW4_COMPRESSION_LEVEL@@@Z ?SetBackupCompressionLevelByID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAW4_COMPRESSION_LEVEL@@@Z ?SetBackupCompressionLevelByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAW4_COMPRESSION_LEVEL@@@Z ?SetBackupConnectionCredentialsByID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAPAU_CONNECTION_INFORMATIONS_@@PAE@Z ?SetBackupConnectionCredentialsByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAPAU_CONNECTION_INFORMATIONS_@@PAE@Z ?SetBackupConnectionInformations@_BACKUP_CREATE@@QAEHPAU_CONNECTION_INFORMATIONS_@@@Z ?SetBackupDescription@_BACKUP_CREATE@@QAEHPA_W@Z ?SetBackupDescriptionByID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAPA_W@Z ?SetBackupDescriptionByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAPA_W@Z ?SetBackupDestinationPath@_BACKUP_CREATE@@QAEHPAXK@Z ?SetBackupDestinationPath@_BACKUP_RESTORE@@QAEHPAXK@Z ?SetBackupDestinationPathByID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAPAXPAK@Z ?SetBackupDestinationPathByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAPAXPAK@Z ?SetBackupDestinationType@_BACKUP_RESTORE@@QAEHW4_BACKUP_STORAGE_DESTINATION_TYPE@@@Z ?SetBackupDiskFreeSpace@_BACKUP_CREATE@@QAEHE@Z ?SetBackupDiskFreeSpaceFlagByID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAE@Z ?SetBackupDiskFreeSpaceFlagByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAE@Z ?SetBackupDiskPriorityLevel@_BACKUP_CREATE@@QAEHW4_BACKUP_PRIORITY_LEVEL@@@Z ?SetBackupDiskStepSize@_BACKUP_CREATE@@QAEH_K@Z ?SetBackupEmailDestinationInfoByID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAPAU_EMAIL_INFORMATIONS@@@Z ?SetBackupEmailDestinationInfoByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAPAU_EMAIL_INFORMATIONS@@@Z ?SetBackupEmailDestinationInformation@_BACKUP_CREATE@@QAEHPAU_EMAIL_INFORMATIONS@@@Z ?SetBackupEmailNotificationInfoByID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAPAU_BACKUP_EMAIL_NOTIFICATION_INFORMATION@@@Z ?SetBackupEmailNotificationInfoByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAPAU_BACKUP_EMAIL_NOTIFICATION_INFORMATION@@@Z ?SetBackupEmailNotificationInformations@_BACKUP_CREATE@@QAEHPAU_BACKUP_EMAIL_NOTIFICATION_INFORMATION@@@Z ?SetBackupEncryptionAlgorithm@_BACKUP_CREATE@@QAEHPAE@Z ?SetBackupEncryptionAlgorithmByID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAE@Z ?SetBackupEncryptionAlgorithmByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAE@Z ?SetBackupExclusionAttributes@_BACKUP_CREATE@@QAEHK@Z ?SetBackupExclusionFilters@_BACKUP_CREATE@@QAEHPAPA_WK@Z ?SetBackupFiltersByID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAPAPA_WPAK122@Z ?SetBackupFiltersByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAPAPA_WPAK122@Z ?SetBackupFormatType@_BACKUP_CREATE@@QAEHW4_BACKUP_FORMAT_TYPE@@@Z ?SetBackupFormatTypeByID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAW4_BACKUP_FORMAT_TYPE@@@Z ?SetBackupFormatTypeByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAW4_BACKUP_FORMAT_TYPE@@@Z ?SetBackupHashAlgorithm@_BACKUP_CREATE@@QAEHPAE@Z ?SetBackupIgnoreErrors@_BACKUP_CREATE@@QAEHPAE@Z ?SetBackupInclusionFilters@_BACKUP_CREATE@@QAEHPAPA_WK@Z ?SetBackupLockedFilesTreatment@_BACKUP_CREATE@@QAEHPAW4_LOCKED_FILES_TREATMENT_@@@Z ?SetBackupLogToScreen@_BACKUP_CREATE@@QAEHE@Z ?SetBackupLogfileMode@_BACKUP_CREATE@@QAEHPAW4_CORE_LOGGING_MODE@@@Z ?SetBackupLogfileName@_BACKUP_CREATE@@QAEHPA_W@Z ?SetBackupOpticalDestinationInfoByID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAPAU_OPTICAL_DESTINATION_INFORMATIONS@@@Z ?SetBackupOpticalDestinationInfoByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAPAU_OPTICAL_DESTINATION_INFORMATIONS@@@Z ?SetBackupOpticalDiskDestinationInformation@_BACKUP_CREATE@@QAEHPAU_OPTICAL_DESTINATION_INFORMATIONS@@@Z ?SetBackupParentConnectionCredentialsByID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAPAU_CONNECTION_INFORMATIONS_@@PAE@Z ?SetBackupParentConnectionCredentialsByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAPAU_CONNECTION_INFORMATIONS_@@PAE@Z ?SetBackupParentConnectionInformations@_BACKUP_CREATE@@QAEHPAU_CONNECTION_INFORMATIONS_@@@Z ?SetBackupParentDestinationPath@_BACKUP_CREATE@@QAEHPA_W@Z ?SetBackupParentFirstGUID@_BACKUP_CREATE@@QAEHPAU_BACKUP_GUID@@@Z ?SetBackupParentGUID@_BACKUP_CREATE@@QAEHPAU_BACKUP_GUID@@@Z ?SetBackupParentProxyInformations@_BACKUP_CREATE@@QAEHPAU_PROXY_@@@Z ?SetBackupParentShapshopNo@_BACKUP_CREATE@@QAEH_K@Z ?SetBackupParentStorageDestinationType@_BACKUP_CREATE@@QAEHW4_BACKUP_STORAGE_DESTINATION_TYPE@@@Z ?SetBackupPassword@_BACKUP_CREATE@@QAEHPAXI@Z ?SetBackupPassword@_BACKUP_RESTORE@@QAEHPBEK@Z ?SetBackupPasswordInformationByID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAPAXPAKPAE@Z ?SetBackupPasswordInformationByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAPAXPAKPAE@Z ?SetBackupPrioritiesLevelByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAW4_BACKUP_PRIORITY_LEVEL@@1@Z ?SetBackupProcessPriorityLevel@_BACKUP_CREATE@@QAEHW4_BACKUP_PRIORITY_LEVEL@@@Z ?SetBackupProgressCallbackAndContext@_BACKUP_CREATE@@QAEHP6AHPAX_K1EE@Z0@Z ?SetBackupPropagateDelete@_BACKUP_CREATE@@QAEHE@Z ?SetBackupProxyInformations@_BACKUP_CREATE@@QAEHPAU_PROXY_@@@Z ?SetBackupRegistrySecurityAttributes@_BACKUP_CREATE@@QAEHE@Z ?SetBackupRevisionNo@_BACKUP_CREATE@@QAEH_K@Z ?SetBackupScanBefore@_BACKUP_CREATE@@QAEHPAE@Z ?SetBackupShutDownComputerWhenFinished@_BACKUP_CREATE@@QAEHPAE@Z ?SetBackupShutdownCallback@_BACKUP_CREATE@@QAEHP6AHPAX@Z0@Z ?SetBackupSimpleCopyCreateSourcePathInDestinationPath@_BACKUP_CREATE@@QAEHE@Z ?SetBackupSizesByID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PA_K1@Z ?SetBackupSkipUnsafeRegKey@_BACKUP_CREATE@@QAEHE@Z ?SetBackupSourcePath@_BACKUP_CREATE@@QAEHPAXK@Z ?SetBackupSourcePathByID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAPAXPAK@Z ?SetBackupSourcePathByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAPAXPAK@Z ?SetBackupSourceStorageType@_BACKUP_CREATE@@QAEHW4_BACKUP_STORAGE_DESTINATION_TYPE@@@Z ?SetBackupSourceType@_BACKUP_CREATE@@QAEXW4_BACKUP_SOURCE_TYPE@@@Z ?SetBackupSourceTypeByID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAW4_BACKUP_SOURCE_TYPE@@@Z ?SetBackupSourceTypeByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAW4_BACKUP_SOURCE_TYPE@@@Z ?SetBackupSourceTypeCustom@_BACKUP_CREATE@@QAEXW4_CUSTOM_BACKUP_SOURCE_TYPE@@@Z ?SetBackupSplitCallback@_BACKUP_CREATE@@QAEHP6AHPAX@Z@Z ?SetBackupSplitSizeByID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PA_K@Z ?SetBackupSplitSizeByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PA_K@Z ?SetBackupSplitSizeMB@_BACKUP_CREATE@@QAEHPA_K@Z ?SetBackupStorageDestinationType@_BACKUP_CREATE@@QAEXW4_BACKUP_STORAGE_DESTINATION_TYPE@@@Z ?SetBackupStorageDestinationTypeByID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAW4_BACKUP_STORAGE_DESTINATION_TYPE@@@Z ?SetBackupStorageDestinationTypeByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAW4_BACKUP_STORAGE_DESTINATION_TYPE@@@Z ?SetBackupTaskToRunAfter@_BACKUP_CREATE@@QAEHPA_W@Z ?SetBackupTaskToRunBefore@_BACKUP_CREATE@@QAEHPA_W@Z ?SetBackupType@_BACKUP_CREATE@@QAEXW4_BACKUP_TYPE@@@Z ?SetBackupTypeByID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAW4_BACKUP_TYPE@@@Z ?SetBackupTypeByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAW4_BACKUP_TYPE@@@Z ?SetBackupUseDeduplication@_BACKUP_CREATE@@QAEXE@Z ?SetBackupVerifyAfter@_BACKUP_CREATE@@QAEHPAE@Z ?SetBackupWaitForTaskAfterToComplete@_BACKUP_CREATE@@QAEHPAE@Z ?SetBackupWaitForTaskBeforeToComplete@_BACKUP_CREATE@@QAEHPAE@Z ?SetBackupWindowsUserSID@_BACKUP_CREATE@@QAEHPA_W@Z ?SetCOSDefaultConfigInfo@@YAHPAU_CORE_KEY_HANDLE@@E@Z ?SetCleanRestore@_BACKUP_RESTORE@@QAEHE@Z ?SetCloseMedia@CDiscFormatData@@QAEXE@Z ?SetConnectionInformation@_BACKUP_RESTORE@@QAEHPBU_CONNECTION_INFORMATIONS_@@@Z ?SetCosLoggedInState@@YAEE@Z ?SetCreateParentDirectories@_BACKUP_RESTORE@@QAEHE@Z ?SetCreationOfParentFoldersForSimpleCopyFlag@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAE@Z ?SetCreationOfParentFoldersForSimpleCopyFlag@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAE@Z ?SetCurrentStepPosition@@YAHPAU_BACKUP_PROGRESS_NEW@@_K@Z ?SetDeletePropagationFlagByID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAE@Z ?SetDeletePropagationFlagByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAE@Z ?SetDiskBackupUnitSizeByID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PA_K@Z ?SetDiskBackupUnitSizeByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PA_K@Z ?SetEncryptionPassword@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHHPA_WPCH@Z ?SetFlagForTreeItemAndChilds@@YAHPAU_FILES_AND_DIRS_TREE_ITEM@@K@Z ?SetFlagForTreeItemAndChildsThatContainsGivenFlag@@YAHPAU_FILES_AND_DIRS_TREE_ITEM@@KK@Z ?SetFlagToKnowIfDefaultSyncFolder@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAE@Z ?SetFriendlyNameByID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAPA_W@Z ?SetFriendlyNameByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAPA_W@Z ?SetGUICustomSourceTypeSelectionByID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAW4_CUSTOM_BACKUP_SOURCE_TYPE@@@Z ?SetGUICustomSourceTypeSelectionByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAW4_CUSTOM_BACKUP_SOURCE_TYPE@@@Z ?SetGUIRunModeByID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAW4_CBU_GUI_RUN_MODE@@@Z ?SetGUIRunModeByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAW4_CBU_GUI_RUN_MODE@@@Z ?SetHistoryEventInfoTypeByID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAW4_HISTORY_INFO_TYPE@@@Z ?SetHistoryEventTimesInfo@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAU_SYSTEMTIME@@1@Z ?SetIgnoreErrorsDuringBackupFlagByID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAE@Z ?SetIgnoreErrorsDuringBackupFlagByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAE@Z ?SetIncrementalTreeInformation@@YAHPAU_FILES_AND_DIRS_TREE_ITEM@@W4_BACKUP_TYPE@@0PAU_CORE_LOG_HANDLE@@PCH_K44@Z ?SetInitializationInformation@_BACKUP_CREATE@@QAEHXZ ?SetInitializationInformation@_BACKUP_RESTORE@@QAEHW4_BACKUP_FORMAT_TYPE@@W4_BACKUP_STORAGE_DESTINATION_TYPE@@PAXK_KP6AH2@ZEPA_WW4_CORE_LOGGING_MODE@@2KPAU_CONNECTION_INFORMATIONS_@@PAU_PROXY_@@W4_BACKUP_PRIORITY_LEVEL@@9W4_OPERATION_AFTER_RESTORE_IS_FINISHED@@EEE@Z ?SetInitializationInformationEx@_BACKUP_CREATE@@QAEHW4_BACKUP_TYPE@@W4_BACKUP_STORAGE_DESTINATION_TYPE@@PAXKW4_BACKUP_SOURCE_TYPE@@2KW4_BACKUP_FORMAT_TYPE@@W4_COMPRESSION_LEVEL@@P6AH2@ZPAU_EMAIL_INFORMATIONS@@PAU_OPTICAL_DESTINATION_INFORMATIONS@@EPA_WW4_CORE_LOGGING_MODE@@_K2KEEPAU_CONNECTION_INFORMATIONS_@@PAU_PROXY_@@99E6PAPA_WKPAPA_WK_KEPAU_BACKUP_EMAIL_NOTIFICATION_INFORMATION@@E9_K9W4_BACKUP_PRIORITY_LEVEL@@W4_BACKUP_PRIORITY_LEVEL@@EEEW4_LOCKED_FILES_TREATMENT_@@19PAU_CONNECTION_INFORMATIONS_@@PAU_PROXY_@@_KPAU_BACKUP_GUID@@PAU_BACKUP_GUID@@EW4_CUSTOM_BACKUP_SOURCE_TYPE@@EEEE2KE1E@Z ?SetLockedFilesTreatmentByID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAW4_LOCKED_FILES_TREATMENT_@@@Z ?SetLockedFilesTreatmentByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAW4_LOCKED_FILES_TREATMENT_@@@Z ?SetLogFileName@_BACKUP_RESTORE@@QAEHPB_W@Z ?SetLogInformationByID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAEPAPA_WPAW4_CORE_LOGGING_MODE@@@Z ?SetLogInformationByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAEPAPA_WPAW4_CORE_LOGGING_MODE@@@Z ?SetLogToFileMethod@_BACKUP_RESTORE@@QAEHW4_CORE_LOGGING_MODE@@@Z ?SetLogToScreen@_BACKUP_RESTORE@@QAEHE@Z ?SetMissedTaskActionByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_SCHEDULE_ID@@PAE@Z ?SetNextBackupChunkPath@@YAHPAU_BACKUP_CONTEXT@@W4_BACKUP_STORAGE_DESTINATION_TYPE@@PA_WPAU_CONNECTION_INFORMATIONS_@@PAU_PROXY_@@@Z ?SetNextChunkCallback@_BACKUP_RESTORE@@QAEHP6AHPAX@Z@Z ?SetNotificationCallbacks@_CBU_HISTORY_MANAGER@@QAEHP6AXPAXU_CBU_HISTORY_ID@@@Z020PAU2@K@Z ?SetOperationToPerformWhenDone@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAW4_OPERATION_AFTER_RESTORE_IS_FINISHED@@@Z ?SetParentBackupGUIDs@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAU_BACKUP_GUID@@1@Z ?SetParentBackupGUIDs@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAU_BACKUP_GUID@@1@Z ?SetParentDestinationInformation@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAW4_BACKUP_STORAGE_DESTINATION_TYPE@@PAPA_WPA_K@Z ?SetParentDestinationInformation@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAW4_BACKUP_STORAGE_DESTINATION_TYPE@@PAPA_WPA_K@Z ?SetParentProxyInformationByID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAPAU_PROXY_@@@Z ?SetParentProxyInformationByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAPAU_PROXY_@@@Z ?SetPathsForInstantScan@@YAHPA_WE@Z ?SetPrioritiesLevelByID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAW4_BACKUP_PRIORITY_LEVEL@@1@Z ?SetProfileIDForHistoryEvent@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAU_CBU_PROFILE_ID@@@Z ?SetProfileIDToRunForSchedule@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_SCHEDULE_ID@@PAU_CBU_PROFILE_ID@@@Z ?SetProfileLastRunResult@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAH@Z ?SetProfileRevisionNo@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PA_K@Z ?SetProfileTimesInfo@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAU_SYSTEMTIME@@11@Z ?SetProxyInformationByID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAPAU_PROXY_@@@Z ?SetProxyInformationByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAPAU_PROXY_@@@Z ?SetRegistryBackupSecurityAttributesInfoFlagByID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAE@Z ?SetRegistryBackupSecurityAttributesInfoFlagByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAE@Z ?SetRestoreActiveStatus@_BACKUP_RESTORE@@QAEHE@Z ?SetRestoreDiskUsagePriority@_BACKUP_RESTORE@@QAEHW4_BACKUP_PRIORITY_LEVEL@@@Z ?SetRestoreFileSecurity@_BACKUP_RESTORE@@QAEHE@Z ?SetRestoreOptions@_BACKUP_RESTORE@@QAEHPAXK@Z ?SetRestoreOptionsByID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAPAXPAK@Z ?SetRestoreProcessPriority@_BACKUP_RESTORE@@QAEHW4_BACKUP_PRIORITY_LEVEL@@@Z ?SetRestoreProgressCallbackAndContext@_BACKUP_RESTORE@@QAEHP6AHPAX_K1EE@Z0@Z ?SetRestoreSecurityFlagForItemsByID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAE@Z ?SetRestoreSourceType@_BACKUP_RESTORE@@QAEHW4_BACKUP_SOURCE_TYPE@@@Z ?SetRestoredBackupGUIDByID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAU_BACKUP_GUID@@@Z ?SetRunResult@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAH@Z ?SetScanBeforeCreationFlag@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAE@Z ?SetScanBeforeCreationFlag@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAE@Z ?SetScheduleLastRunResult@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_SCHEDULE_ID@@PAH@Z ?SetScheduleModeInformationByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_SCHEDULE_ID@@PAEPAU_SYSTEMTIME@@PAG3PAIPA_K5PAPA_W6@Z ?SetScheduleTimesInfo@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_SCHEDULE_ID@@PAU_SYSTEMTIME@@111@Z ?SetScheduledTaskInfo@@YAHPA_WPAEPAU_SYSTEMTIME@@PAGPAIPAK0000000@Z ?SetShowServiceModeNotificationByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAE@Z ?SetShutDownFlag@_BACKUP_CREATE@@QAEHE@Z ?SetShutDownFlag@_BACKUP_RESTORE@@QAEHW4_OPERATION_AFTER_RESTORE_IS_FINISHED@@@Z ?SetShutdownWhenFinishedFlagByID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAE@Z ?SetShutdownWhenFinishedFlagByID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAE@Z ?SetSkipLockedFiles@_BACKUP_RESTORE@@QAEHE@Z ?SetSnapshotToRestore@_BACKUP_RESTORE@@QAEH_K@Z ?SetSnapshotToRestoreIndex@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PA_K@Z ?SetStepsCount@@YAHPAU_BACKUP_PROGRESS_NEW@@_K@Z ?SetTasksToRunBeforeAndAfterBackupForID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAPA_WPAE12@Z ?SetTasksToRunBeforeAndAfterBackupForID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAPA_WPAE12@Z ?SetTokenSystemPrivileges@@YAHPAXPA_WE@Z ?SetValueToRegKeyBuffer@@YAHPA_W00_K0PAXK@Z ?SetValueToRegKeyBufferEncrypted@@YAHPA_W00_K0PAXK@Z ?SetValueToRegKeyBufferTryString@@YAHPA_W00_K0PAXK@Z ?SetValueToRegKeyDate@@YAHPA_W00_K0U_SYSTEMTIME@@@Z ?SetValueToRegKeyMultiString@@YAHPA_W00_K0PAPA_WK@Z ?SetValueToRegKeyString@@YAHPA_W00_K00@Z ?SetVerifyAfterCreationFlag@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAE@Z ?SetVerifyAfterCreationFlag@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAE@Z ?SetVerifyBeforeRestoreFlagByID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAE@Z ?SetVerifyImage@_BACKUP_RESTORE@@QAEHE@Z ?SetWindowsCorrectPath@@YAHPAPAPA_WPA_K@Z ?SetWindowsUserSID@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAPA_W@Z ?SetWindowsUserSID@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHU_CBU_PROFILE_ID@@PAPA_W@Z ?SetWriteSpeed@CDiscFormatData@@QAEHJ@Z ?Set_CBUNAT_Exe_As_Native_Application@@YAHXZ ?SetupInstallUninstallAllDriversFromPath@@YAHPA_WW4_SETUP_OPERATION_TO_PERFORM@@E@Z ?ShowScheduleRunNotification@@YAHPAV_CBU_SCHEDULER_AND_PROFILE_MANAGER@@U_CBU_SCHEDULE_ID@@E@Z ?SkypeBackup@@YAHPAU_BACKUP_CONTEXT@@PA_WPAU_BACKUP_CREATE_INFORMATION_DATA@@PAU_CORE_LOG_HANDLE@@PAU_BACKUP_PROGRESS_NEW@@HPCHPAU_FLAGS_INSTANT_MESS@@1@Z ?SkypeBackupNew@@YAHPAU_BACKUP_CONTEXT@@0PA_WPAU_BACKUP_CREATE_INFORMATION_DATA@@PAU_CORE_LOG_HANDLE@@PAU_BACKUP_PROGRESS_NEW@@HPCHPAU_FLAGS_INSTANT_MESS_NEW@@K1PAPAU_FILES_AND_DIRS_TREE_ITEM@@7@Z ?SkypeGetCount@@YAHPAU_BACKUP_PROGRESS_NEW@@PAU_CORE_LOG_HANDLE@@PAU_FLAGS_INSTANT_MESS@@PCHPA_W@Z ?SkypeGetCountNew@@YAHPAU_BACKUP_CONTEXT@@PAU_BACKUP_CREATE_INFORMATION_DATA@@PAU_FLAGS_INSTANT_MESS_NEW@@KEPA_WPAPAPAU_FILES_AND_DIRS_TREE_ITEM@@PAKPAPAU4@@Z ?SortOldTreeByTypeAndName@@YAHPAU_FILE_SYSTEM_TREE@@@Z ?SortTreeByItemNames@@YAHPAU_FILES_AND_DIRS_TREE_ITEM@@PAU_CORE_LOG_HANDLE@@_KPCH@Z ?StartBackup@_BACKUP_CREATE@@QAEHP6AHPAPA_WPAX@ZW4_BACKUP_SCHEDULE_MODE@@PAU_SYSTEMTIME@@4PAH_K1PAU_BACKUP_GUID@@70PA_KPAU_CBU_PROFILE_ID@@41P6AH166EE@Z1P6A?AW4MALWARE_SCAN_ACTION@@PA_W@ZPAW4_BACKUP_TYPE@@PA_WEP6AHPA_W01@Z1EE@Z ?StartBackupSizeEstimation@_BACKUP_CREATE@@QAEHP6AHPA_WPAX@Z1@Z ?StartBrowsing@_NETWORK_BROWSER_CLASS@@QAEHXZ ?StartCOSService@@YAHEPAXP6AX0@Z@Z ?StartDriversInPEEnvironment@@YAHXZ ?StartIndexingAndMonitoring@@YAHXZ ?StartInstantSyncMonitoringThreads@@YAHPAV_CBU_SCHEDULER_AND_PROFILE_MANAGER@@PAPAU_CBU_SCHEDULE_ID@@PAK@Z ?StartRecovery@_BACKUP_RESTORE@@QAEHPAXKP6AHPAPA_W0@ZP6AH0@Z00P6AH0_K4EE@Z0@Z ?StartTaskSchedulerService@@YAHXZ ?StartVerify@_BACKUP_RESTORE@@QAEHP6AHPAPA_WPAX@Z1P6AH1_K3EE@Z1E@Z ?StartWritingToReg@@YAXPAX@Z ?StopAllActivity@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHXZ ?StopBackupSizeEstimation@_BACKUP_CREATE@@QAEHXZ ?StopRespNotificatorTh@_COS_CLIENT_OPERATION_CONTROLLER@@QAEHXZ ?StopService@@YAHPA_W@Z ?SubSystemTimes@@YAHPAU_SYSTEMTIME@@00@Z ?SubstractFromDate_Milliseconds@@YAHPAU_SYSTEMTIME@@0_K@Z ?SubstractFromDate_Seconds@@YAHPAU_SYSTEMTIME@@0_K@Z ?SvcCtrlHandlerEx@WindowsServiceBase@@KGXKKPAX0@Z ?SvcInstall@WindowsServiceBase@@IAEXXZ ?SvcMain@WindowsServiceBase@@IAGXKPAPA_W@Z ?SvcWork@UpdateService@@UAEXKPAPA_W@Z ?SyncItemChangesAppend@@YAHPAU_CORE_FILE_HANDLE@@PAU_SIMPLE_COPY_ITEM_INFO@@@Z ?SyncItemChangesCreateItem@@YAHHPAU_FILES_AND_DIRS_TREE_ITEM@@PAPAU_SIMPLE_COPY_ITEM_INFO@@@Z ?SyncItemChangesInitialize@@YAHPAU_CORE_FILE_HANDLE@@PAU_CBU_PROFILE_ID@@EPAT_LARGE_INTEGER@@@Z ?SyncItemChangesReadChange@@YAHPAU_CORE_FILE_HANDLE@@PAPAU_SIMPLE_COPY_ITEM_INFO@@@Z ?SyncSvcConfigFailActions@@YAXXZ ?SynchronizationThreadBody@@YAXPAX@Z ?SystemErrorToApiStatus@@YAHK@Z ?TemporaryRenameBOOTSTATFile@@YAHXZ ?TestIfInstalled@@YAHPAUHKEY__@@PA_W1@Z ?TestPath@@YAHPA_W@Z ?TextSearchInsideBackup@_BACKUP_RESTORE@@QAEHPA_WKPA_KP6AHPAX@ZEEP6AH2_K4EE@Z2@Z ?ThunderbirdBackup@@YAHPAU_BACKUP_CONTEXT@@PA_WPAU_BACKUP_CREATE_INFORMATION_DATA@@PAU_CORE_LOG_HANDLE@@PAU_BACKUP_PROGRESS_NEW@@HPCHPAU_FLAGS_EMAIL_CLIENT@@1@Z ?ThunderbirdBackupNew@@YAHPAU_BACKUP_CONTEXT@@0PA_WPAU_BACKUP_CREATE_INFORMATION_DATA@@PAU_CORE_LOG_HANDLE@@PAU_BACKUP_PROGRESS_NEW@@HPCHPAU_FLAGS_EMAIL_CLIENT_NEW@@K1PAPAU_FILES_AND_DIRS_TREE_ITEM@@7@Z ?ThunderbirdGetCount@@YAHPAU_BACKUP_PROGRESS_NEW@@PAU_CORE_LOG_HANDLE@@PAU_FLAGS_EMAIL_CLIENT@@PCHPA_W@Z ?ThunderbirdGetCountNew@@YAHPAU_BACKUP_CONTEXT@@PAU_BACKUP_CREATE_INFORMATION_DATA@@PAU_FLAGS_EMAIL_CLIENT_NEW@@KEPA_WPAPAPAU_FILES_AND_DIRS_TREE_ITEM@@PAKPAPAU4@@Z ?TransforDestinationPath@@YAHPA_WPAPAPA_WPA_K@Z ?TransformEnvironmentVariableIntoPath@@YAHPA_WPAPA_W@Z ?TransformSourcePath@@YAHPA_WPAPAPA_WPA_K@Z ?Uninitialze@_BACKUP_CREATE@@QAEHXZ ?Uninitialze@_BACKUP_RESTORE@@QAEHXZ ?UninstallVDBusDriverEx@@YAHXZ ?UnmountCbuFileSystemDrive@@YAHDE@Z ?UpdateVDBusDriver@@YAHPA_W@Z ?UtcTimeToLocalTime@@YAHU_SYSTEMTIME@@PAU1@@Z ?ValidateCOSSourcePath@@YAHPA_WE@Z ?ValueNameCounterStart@@YA_KXZ ?VerifyPaths@@YAHPAPAPA_WPA_K@Z ?WaitBackupSizeEstimation@_BACKUP_CREATE@@QAEHXZ ?WaitableTimerDelayFromSeconds@@YA?AT_LARGE_INTEGER@@J@Z ?WarnRegUsersNativeRestoreFortempCommandLine@@YAHXZ ?WideStringToUint64@@YA_KPA_W@Z ?WildCardMatch@@YAHPB_WABUIdEntry@@@Z ?WildCompareHwIds@@YAHPAPA_WABUIdEntry@@@Z ?WindowsLiveMailBackup@@YAHPAU_BACKUP_CONTEXT@@PA_WPAU_BACKUP_CREATE_INFORMATION_DATA@@PAU_CORE_LOG_HANDLE@@PAU_BACKUP_PROGRESS_NEW@@HPCHPAU_FLAGS_EMAIL_CLIENT@@1@Z ?WindowsLiveMailBackupNew@@YAHPAU_BACKUP_CONTEXT@@0PA_WPAU_BACKUP_CREATE_INFORMATION_DATA@@PAU_CORE_LOG_HANDLE@@PAU_BACKUP_PROGRESS_NEW@@HPCHPAU_FLAGS_EMAIL_CLIENT_NEW@@K1PAPAU_FILES_AND_DIRS_TREE_ITEM@@7@Z ?WindowsLiveMailGetCount@@YAHPAU_BACKUP_PROGRESS_NEW@@PAU_CORE_LOG_HANDLE@@PAU_FLAGS_EMAIL_CLIENT@@PCHPA_W@Z ?WindowsLiveMailGetCountNew@@YAHPAU_BACKUP_CONTEXT@@PAU_BACKUP_CREATE_INFORMATION_DATA@@PAU_FLAGS_EMAIL_CLIENT_NEW@@KEPA_WPAPAPAU_FILES_AND_DIRS_TREE_ITEM@@PAKPAPAU4@@Z ?WindowsLiveMessengerBackup@@YAHPAU_BACKUP_CONTEXT@@PA_WPAU_BACKUP_CREATE_INFORMATION_DATA@@PAU_CORE_LOG_HANDLE@@PAU_BACKUP_PROGRESS_NEW@@HPCHPAU_FLAGS_INSTANT_MESS@@1@Z ?WindowsLiveMessengerBackupNew@@YAHPAU_BACKUP_CONTEXT@@0PA_WPAU_BACKUP_CREATE_INFORMATION_DATA@@PAU_CORE_LOG_HANDLE@@PAU_BACKUP_PROGRESS_NEW@@HPCHPAU_FLAGS_INSTANT_MESS_NEW@@K1PAPAU_FILES_AND_DIRS_TREE_ITEM@@7@Z ?WindowsLiveMessengerGetCount@@YAHPAU_BACKUP_PROGRESS_NEW@@PAU_CORE_LOG_HANDLE@@PAU_FLAGS_INSTANT_MESS@@PCHPA_W@Z ?WindowsLiveMessengerGetCountNew@@YAHPAU_BACKUP_CONTEXT@@PAU_BACKUP_CREATE_INFORMATION_DATA@@PAU_FLAGS_INSTANT_MESS_NEW@@KEPA_WPAPAPAU_FILES_AND_DIRS_TREE_ITEM@@PAKPAPAU4@@Z ?WindowsMailBackup@@YAHPAU_BACKUP_CONTEXT@@PA_WPAU_BACKUP_CREATE_INFORMATION_DATA@@PAU_CORE_LOG_HANDLE@@PAU_BACKUP_PROGRESS_NEW@@HPCHPAU_FLAGS_EMAIL_CLIENT@@1@Z ?WindowsMailBackupNew@@YAHPAU_BACKUP_CONTEXT@@0PA_WPAU_BACKUP_CREATE_INFORMATION_DATA@@PAU_CORE_LOG_HANDLE@@PAU_BACKUP_PROGRESS_NEW@@HPCHPAU_FLAGS_EMAIL_CLIENT_NEW@@K1PAPAU_FILES_AND_DIRS_TREE_ITEM@@7@Z ?WindowsMailGetCount@@YAHPAU_BACKUP_PROGRESS_NEW@@PAU_CORE_LOG_HANDLE@@PAU_FLAGS_EMAIL_CLIENT@@PCHPA_W@Z ?WindowsMailGetCountNew@@YAHPAU_BACKUP_CONTEXT@@PAU_BACKUP_CREATE_INFORMATION_DATA@@PAU_FLAGS_EMAIL_CLIENT_NEW@@KEPA_WPAPAPAU_FILES_AND_DIRS_TREE_ITEM@@PAKPAPAU4@@Z ?WriteDump@@YAHPAXKPAU_MINIDUMP_EXCEPTION_INFORMATION@@PA_W@Z ?WriteInformationData@@YAHPA_WPAU_BACKUP_RESTORE_INFORMATION_DATA@@@Z ?XmlApiAppendXMLDeclaration@@YAHPAUIXMLDOMDocument@@@Z ?XmlApiCreateDom@@YAHPAPAUIXMLDOMDocument@@@Z ?XmlApiCreateStartElement@@YAHPAUIXMLDOMDocument@@PA_W11PAPAUIXMLDOMElement@@@Z ?XmlApiCreateSubElement@@YAHPAUIXMLDOMDocument@@PAUIXMLDOMElement@@PA_W22PAPAU2@@Z ?XmlApiDestroyDom@@YAHPAPAUIXMLDOMDocument@@@Z ?XmlApiGetChildElement@@YAHPAUIXMLDOMElement@@PA_WPAPAU1@@Z ?XmlApiGetChildElements@@YAHPAUIXMLDOMElement@@PAPAUIXMLDOMNodeList@@@Z ?XmlApiGetDataWCharStr@@YAHPAUIXMLDOMElement@@PAPA_W@Z ?XmlApiGetDocumentRoot@@YAHPAUIXMLDOMDocument@@PAPAUIXMLDOMElement@@@Z ?XmlApiGetElementByIndex@@YAHPAUIXMLDOMNodeList@@KPAPAUIXMLDOMElement@@@Z ?XmlApiGetElementForNode@@YAXPAUIXMLDOMNode@@PAPAUIXMLDOMElement@@@Z ?XmlApiGetElementName@@YAHPAUIXMLDOMElement@@PAPA_W@Z ?XmlApiGetElementsByTag@@YAHPAUIXMLDOMElement@@PA_W1PAPAUIXMLDOMNodeList@@PAK@Z ?XmlApiGetNextNode@@YAHPAUIXMLDOMNodeList@@PAPAUIXMLDOMNode@@@Z ?XmlApiGetNodeType@@YAHPAUIXMLDOMNode@@PAW4tagDOMNodeType@@@Z ?XmlApiInitialize@@YAHXZ ?XmlApiLoadFromFile@@YAHPA_WPAUIXMLDOMDocument@@@Z ?XmlApiLoadFromString@@YAHPA_WPAUIXMLDOMDocument@@@Z ?XmlApiNodeHasTagName@@YAHPAUIXMLDOMNode@@PA_W1@Z ?XmlApiSaveDOMToString@@YAHPAUIXMLDOMDocument@@PA_WPAI@Z ?XmlApiSaveToFile@@YAHPA_WPAUIXMLDOMDocument@@@Z ?XmlApiSetDataWCharStr@@YAHPAUIXMLDOMDocument@@PAUIXMLDOMElement@@PA_W@Z ?XmlApiSetWCharAttribute@@YAHPAUIXMLDOMDocument@@PAUIXMLDOMElement@@PA_W2@Z ?XmlApiUninitialize@@YAHXZ ?YahooMessengerBackup@@YAHPAU_BACKUP_CONTEXT@@PA_WPAU_BACKUP_CREATE_INFORMATION_DATA@@PAU_CORE_LOG_HANDLE@@PAU_BACKUP_PROGRESS_NEW@@HPCHPAU_FLAGS_INSTANT_MESS@@1@Z ?YahooMessengerBackupNew@@YAHPAU_BACKUP_CONTEXT@@0PA_WPAU_BACKUP_CREATE_INFORMATION_DATA@@PAU_CORE_LOG_HANDLE@@PAU_BACKUP_PROGRESS_NEW@@HPCHPAU_FLAGS_INSTANT_MESS_NEW@@K1PAPAU_FILES_AND_DIRS_TREE_ITEM@@7@Z ?YahooMessengerGetCount@@YAHPAU_BACKUP_PROGRESS_NEW@@PAU_CORE_LOG_HANDLE@@PAU_FLAGS_INSTANT_MESS@@PCHPA_W@Z ?YahooMessengerGetCountNew@@YAHPAU_BACKUP_CONTEXT@@PAU_BACKUP_CREATE_INFORMATION_DATA@@PAU_FLAGS_INSTANT_MESS_NEW@@KEPA_WPAPAPAU_FILES_AND_DIRS_TREE_ITEM@@PAKPAPAU4@@Z ?_CoreCreateAndWaitMutex@@YAHPAPAU_CORE_MUTEX@@PA_WPAKKPAD3@Z ?_CoreMemoryFree@@YAXPAX@Z ?_CoreMemoryFreeVector@@YAXPAPAPAX_K@Z ?_CoreRegCloseKey@@YAHPAU_CORE_KEY_HANDLE@@@Z ?_CoreRegDeleteValue@@YAHPAU_CORE_KEY_HANDLE@@PA_W@Z ?_CoreRegEnumKey@@YAHPAU_CORE_KEY_HANDLE@@KPA_WK@Z ?_CoreRegEnumValue@@YAHPAU_CORE_KEY_HANDLE@@KPA_WPAK2PAE2@Z ?_CoreRegGetKeySecurity@@YAHPAU_CORE_KEY_HANDLE@@KPAXPAK@Z ?_CoreRegQueryKey@@YAHPAU_CORE_KEY_HANDLE@@PA_WPAK2222222PAU_FILETIME@@@Z ?_CoreRegQueryValueEx@@YAHPAU_CORE_KEY_HANDLE@@PA_WPAKPAE2@Z ?_CoreRegSetKeySecurity@@YAHPAU_CORE_KEY_HANDLE@@KPAX@Z ?_CoreRegSetValue@@YAHPAU_CORE_KEY_HANDLE@@PA_WKPBEK@Z ?_CoreReleaseCloseAndFreeMutex@@YAHPAPAU_CORE_MUTEX@@KPAD1@Z ?_XmlApiReportParseError@@YAXPAUIXMLDOMDocument@@PAD@Z ?_XmlApiVariantString@@YAXPA_WPAUtagVARIANT@@@Z ?__internCoreThreadBodyWrapper@@YGXPAU_CORE_INTERN_CONTEXT_WRAPPER@@@Z ?__internCoreWaitForMultipleObjects@@YAHPAPAU_CORE_MUTEX@@KPAPAU_CORE_EVENT@@KPAKW4_CORE_WAIT_TYPE@@2KPAD4@Z ?__internCoreWriteLog@@YAHPADKPAU_CORE_LOG_HANDLE@@PA_W0@Z ?__internCoreWriteLogBuffer@@YAHPAU_CORE_LOG_HANDLE@@PAXKPAK@Z ?__internGetListOfIDs@_CBU_HISTORY_MANAGER@@IAEHPAPAU_CBU_HISTORY_ID@@PAK@Z ?__internGetListOfIDs@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@IAEHPAPAXPAKW4_SCHEDULER_AND_PROFILE_MANAGER_ID_TYPE@@@Z ?__internGetNextRunTimesForScheduleElementByGivenPeriod@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@IAEHU_CBU_SCHEDULE_ID@@EPAU_SYSTEMTIME@@1PAPAU3@PAK@Z ?__internRead@@YAHPAX0KPAK@Z ?__internReadEx@@YAHPAXPAU_MULTTHREAD_ENCRYPTION_ENGINE@@0KT_LARGE_INTEGER@@PAK@Z ?__internReleaseTaggedBuffer@@YAXPAXP6AX0@Z@Z ?__internSetHistoryInfoByBackupCreate@_CBU_HISTORY_MANAGER@@IAEHPAV_BACKUP_CREATE@@U_SYSTEMTIME@@1_K2HU_CBU_HISTORY_ID@@PAU_CBU_PROFILE_ID@@@Z ?__internSetHistoryInfoByBackupRestore@_CBU_HISTORY_MANAGER@@IAEHPAV_BACKUP_RESTORE@@U_SYSTEMTIME@@1HU_CBU_HISTORY_ID@@@Z ?__internWrite@@YAHPAX0KPAK@Z ?__internWriteEx@@YAHPAXPAU_MULTTHREAD_ENCRYPTION_ENGINE@@0KT_LARGE_INTEGER@@PAK@Z ?_internAddKeysToFlush@_CBU_HISTORY_MANAGER@@IAEHPA_W0@Z ?_internCoreReleaseMutex@@YAHPAU_CORE_MUTEX@@KPAD1@Z ?_internCoreWaitForEvent@@YAHPAU_CORE_EVENT@@KPAD1@Z ?_internCoreWaitForMutex@@YAHPAU_CORE_MUTEX@@KPCHKPAD2@Z ?_internCoreWriteLog@@YAHPADKW4_CORE_LOG_LEVEL@@PAU_CORE_LOG_HANDLE@@PA_WZZ ?_internGetIDPath@_CBU_HISTORY_MANAGER@@IAEHU_CBU_HISTORY_ID@@PAPA_W1@Z ?_internGetIDPath@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@IAEHW4_SCHEDULER_AND_PROFILE_MANAGER_ID_TYPE@@PAXPAPA_W2@Z ?_intern_CoreMemoryAlloc@@YAPAXK@Z ?_intern_GetAllVolumesInfo@@YAHPAPAPA_W00PAKE@Z ?_intern_GetInterface@CDiscRecorder@@QAEPAUIDiscRecorder2@@XZ ?_intern_GetVolumePaths@@YAHPA_WPAPA_WPAK@Z ?_intern_RecCalculateRegPathProgressUnits@@YAHPA_W0KEPA_K@Z ?_internalGetGUIDBinaryToString@@YAEPAEPAPAE@Z ?_internalGetGUIDStringToBinary@@YAEPAE0@Z ?checkAllocBreak@@YAXK@Z ?cmdRemove@@YAHPB_W0KHQAPA_W@Z ?cmdUpdate@@YAHPB_W0KHQAPA_W@Z ?encryption_engine_decrypt@@YAHPAUtag_encryption_engine@@PAXK1@Z ?encryption_engine_encrypt@@YAHPAUtag_encryption_engine@@PAXK1@Z ?encryption_engine_general_init@@YAHPAUtag_encryption_engine@@EEPAE@Z ?encryption_engine_general_init_get_hash@@YAHPAUtag_encryption_engine@@EEPAXK1PAK@Z ?encryption_engine_init@@YAHPAUtag_encryption_engine@@EPAXI@Z ?encryption_mode_engine_init@@YAHEPAUtag_encryption_mode_engine@@@Z ?getChangeCounter@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHW4_SCHEDULER_AND_PROFILE_MANAGER_ID_TYPE@@PAXPA_K@Z ?hash_engine_finalize@@YAHPAUtag_hash_engine@@PAXPAK@Z ?hash_engine_init@@YAHPAUtag_hash_engine@@E@Z ?hash_engine_sintax@@YAHEE@Z ?hash_engine_update@@YAHPAUtag_hash_engine@@PAXI@Z ?incrementChangeCounterAndAddKeysToFlush@_CBU_SCHEDULER_AND_PROFILE_MANAGER@@QAEHW4_SCHEDULER_AND_PROFILE_MANAGER_ID_TYPE@@PAX@Z ?isInitalizedMultiThreadEngine@@YAHPAU_MULTTHREAD_ENCRYPTION_ENGINE@@PAE@Z ?multiThreadDecrypt@@YAHPAU_MULTTHREAD_ENCRYPTION_ENGINE@@PAXK1@Z ?multiThreadDecryptWithGivenPassword@@YAHPAU_PASSWORD_INFORMATION@@PAXK1@Z ?multiThreadEncrypt@@YAHPAU_MULTTHREAD_ENCRYPTION_ENGINE@@PAXK1@Z ?multiThreadEncryptWithGivenPassword@@YAHPAU_PASSWORD_INFORMATION@@PAXK1@Z ?multiThreadEncryptionEngineInit@@YAHPAU_MULTTHREAD_ENCRYPTION_ENGINE@@KPAU_PASSWORD_INFORMATION@@@Z ?multiThreadEncryptionEngineInitGetHash@@YAHPAU_MULTTHREAD_ENCRYPTION_ENGINE@@EEKPAEK1PAK@Z ?multiThreadEncryptionEngineInitWithGivenPasswordLength@@YAHPAU_MULTTHREAD_ENCRYPTION_ENGINE@@EEKPAXK@Z ?multiThreadEngineInitWithGivenHash@@YAHPAU_MULTTHREAD_ENCRYPTION_ENGINE@@EKPAEK@Z ?nameEncryptionAlg@@YAPB_WE@Z ?nameHashAlg@@YAPB_WE@Z ?search_and_replace_string@@YAXPA_W00@Z ?stringAppendChar@CBUScriptParser@@CAHPAPA_W_W@Z ?stringAppendString@CBUScriptParser@@CAHPAPA_WPA_W@Z ?stringLen@CBUScriptParser@@CAHPA_W@Z ?wcsistr@@YAPA_WPA_W0@Z

$TEMP/TemporaryComodoProduct/COSService.exe

IMPHASH c740524eb385f826473fe59c84232ee4
SHA256 c62fce59e46f7fb2311ba66bb147dda8c67ee09918456319e3ff79749e3ca912
MD5 3ba14b96288f0528628e5c16345ea557
SHA1 26d1ebd32bdf71da55ea06b5efb0eae839227590
SHA512 074c31956e3b85628682bb39d79b2d048522a2429b5d88406d6cf9d0f4ba842a9fe9ebfd659490b77e86649f3c5ab8e05e7e08bc35ac672c9ed7ebc18aabaa71
SSDEEP 24576:fVKC+sZlMnPTEkL+Ba/Ne4tDPtb9NbpunZSDvPoLOXMZMoj+gu3tVVdyJFqZjVra:9Kj+DrZV7cTahOTQjQEdR1KVlSTtiqp
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

58:3a:03:c8:ac:74:2b:17:3a:47:42:5c:d6:5f:75:00:18:75:7d:b3

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Minor OS version

0

Major OS version

5

Entry point

2444205

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\emanu_000\Desktop\SetupCheckout\BIN\Win32\Release\COSService.pdb

kernel32

OpenProcess GetExitCodeProcess GetVolumeInformationW QueryDosDeviceW GetLogicalDrives DefineDosDeviceW RemoveDirectoryW GetDiskFreeSpaceExW CopyFileW DeleteFileW GetFileInformationByHandle GetVolumePathNameW HeapCreate GetFileTime SetThreadExecutionState SetPriorityClass GetPriorityClass MoveFileW GetVolumePathNamesForVolumeNameW FindNextVolumeW FindVolumeClose FindFirstVolumeW GetComputerNameW GetDiskFreeSpaceW SetErrorMode SetVolumeMountPointW DeleteVolumeMountPointW GetVolumeNameForVolumeMountPointW DuplicateHandle FindNextVolumeA FindFirstVolumeA SetFileTime GetTempPathW WideCharToMultiByte FileTimeToSystemTime GetFileSize GetWindowsDirectoryW ExpandEnvironmentStringsW InitializeCriticalSection DeleteCriticalSection SetLastError InterlockedIncrement InterlockedDecrement SetThreadPriority GetCurrentThread LeaveCriticalSection EnterCriticalSection GetCurrentProcessId GetExitCodeThread OpenThread lstrcmpiW DeleteFileA MultiByteToWideChar HeapDestroy HeapReAlloc CreateWaitableTimerW CompareStringW CompareStringA CreateFileA GetConsoleOutputCP WriteConsoleA SetWaitableTimer LoadLibraryW FreeLibrary GetNativeSystemInfo FormatMessageW CreateFileMappingW GetVersionExW Sleep DeviceIoControl GetTickCount SystemTimeToFileTime WaitForMultipleObjects lstrlenW LocalFree OpenFileMappingW MapViewOfFile UnmapViewOfFile ResetEvent GetSystemTime WTSGetActiveConsoleSessionId CreateToolhelp32Snapshot Process32FirstW ProcessIdToSessionId Process32NextW CreateDirectoryW FindFirstFileW FindClose FindNextFileW SetFileAttributesW GetFileAttributesW OutputDebugStringA GetCurrentProcess SetFilePointer SetEndOfFile GetFileSizeEx WriteFile CreateEventW OpenEventW CreateThread ReadFile SetFilePointerEx GetModuleHandleW GetProcAddress CloseHandle GetSystemInfo CreateFileW GetEnvironmentVariableW GetCurrentThreadId HeapAlloc GetProcessHeap HeapFree CreateMutexW OpenMutexW SetStdHandle FlushFileBuffers GetLocaleInfoA GetStringTypeW GetStringTypeA GetConsoleMode GetConsoleCP LoadLibraryA InitializeCriticalSectionAndSpinCount QueryPerformanceCounter GetStartupInfoA SetHandleCount GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetTimeZoneInformation LCMapStringA LCMapStringW IsValidCodePage GetOEMCP GetACP GetCPInfo TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleFileNameA ExitProcess VirtualAlloc VirtualFree IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess RaiseException GetStdHandle GetFileType WriteConsoleW GetSystemTimeAsFileTime RtlUnwind SetEvent GetModuleFileNameW GetLastError WaitForSingleObject ReleaseMutex GetLocalTime HeapSize SetEnvironmentVariableA

user32

ExitWindowsEx GetDesktopWindow wsprintfA GetSystemMetrics

advapi32

SetTokenInformation RegCreateKeyExW RegOpenKeyExW RegCloseKey RegQueryValueExW FreeSid SetSecurityDescriptorDacl RegOpenKeyW ControlService SetServiceStatus RegisterServiceCtrlHandlerW DeleteService CreateServiceW StartServiceCtrlDispatcherW RegGetKeySecurity IsValidSecurityDescriptor RegQueryInfoKeyW GetKernelObjectSecurity RegEnumValueW OpenServiceW RegDeleteValueW RegFlushKey GetUserNameW ConvertStringSidToSidW LookupAccountSidW CheckTokenMembership DuplicateTokenEx CreateProcessAsUserW ImpersonateLoggedOnUser RegDeleteKeyW RevertToSelf OpenSCManagerW CloseServiceHandle StartServiceW QueryServiceStatusEx RegEnumKeyW GetTokenInformation IsValidSid ConvertSidToStringSidW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken SetKernelObjectSecurity InitializeSecurityDescriptor AllocateAndInitializeSid GetLengthSid InitializeAcl AddAccessAllowedAce RegSetValueExW

ole32

CoCreateGuid CoInitializeEx CoUninitialize CoCreateInstance CoInitialize

shell32

SHFileOperationW ShellExecuteW SHGetFolderPathW SHChangeNotify SHCreateDirectoryExW ShellExecuteExW

oleaut32

SafeArrayDestroyData SysFreeString SysAllocString

shlwapi

PathFindExtensionW SHCreateStreamOnFileEx

mpr

WNetCancelConnectionW WNetCancelConnection2W WNetAddConnection2W

winhttp

WinHttpReceiveResponse WinHttpReadData WinHttpQueryDataAvailable WinHttpGetProxyForUrl WinHttpSetOption WinHttpOpen WinHttpConnect WinHttpOpenRequest WinHttpSendRequest WinHttpWriteData WinHttpSetStatusCallback WinHttpCloseHandle WinHttpQueryHeaders

wininet

InternetCheckConnectionW InternetGetConnectedState InternetCloseHandle InternetWriteFile FtpPutFileW FtpOpenFileW InternetFindNextFileW FtpFindFirstFileW InternetReadFile InternetConnectW InternetOpenW InternetGetLastResponseInfoW FtpDeleteFileW InternetQueryDataAvailable HttpSendRequestW FtpRemoveDirectoryW FtpGetFileSize HttpOpenRequestW FtpCreateDirectoryW

fltlib

FilterConnectCommunicationPort FilterGetMessage FilterReplyMessage FilterLoad FilterDetach FilterAttach

wtsapi32

WTSQueryUserToken

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$TEMP/TemporaryComodoProduct/CSE.exe

IMPHASH b4a4301399b7b0da2d591adbaa38eaf5
SHA256 4904e78d4c43e14529d792d0006c149c1f5ab69234e1e78abb54632428a92662
MD5 31937c9febacc5d52e75e9833ec43301
SHA1 adc6023befe1b2016c82f3d1b5a78d74a2cf5e11
SHA512 a527b0b8b6a886038b45347a3889ef48893faa859293ac4ddf52d188ffcdecc7b29e20f6816adb329d369bef9da69d6053b98c4f8cca762cf70728045ba88f15
SSDEEP 98304:nkBVg73kpKhFPPrOoeGVaKzGTeQQ2Lr1KM:nkBVg73kpKhFPPrOoeiw
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

1806928

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\emanu_000\Desktop\SetupCheckout\BIN\Win32\Release\CSE.pdb

kernel32

GlobalReAlloc GlobalHandle TlsAlloc TlsSetValue LocalReAlloc TlsFree WritePrivateProfileStringW GlobalFlags GetStartupInfoW GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapReAlloc RtlUnwind RaiseException ExitProcess ExitThread HeapSize SetStdHandle GetFileType GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetStartupInfoA TlsGetValue VirtualFree QueryPerformanceCounter VirtualAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW GetTimeZoneInformation LCMapStringA InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode GetStringTypeA GetStringTypeW GetLocaleInfoA WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEnvironmentVariableA lstrlenA LocalAlloc FlushFileBuffers GetModuleHandleA GlobalFindAtomW CompareStringW LoadLibraryA GetVersionExA GlobalAddAtomW SuspendThread ResumeThread GlobalDeleteAtom ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW CompareStringA InterlockedExchange lstrcmpW MulDiv FreeResource GlobalFree GlobalUnlock GlobalLock GlobalAlloc TerminateThread FindFirstVolumeA FindNextVolumeA SetErrorMode GetVolumeNameForVolumeMountPointW DeleteVolumeMountPointW SetVolumeMountPointW DuplicateHandle GetDiskFreeSpaceW InitializeCriticalSection SetThreadPriority GetCurrentThread CreateFileMappingW EnterCriticalSection LeaveCriticalSection SetLastError InterlockedDecrement InterlockedIncrement DeleteCriticalSection QueryDosDeviceW ExpandEnvironmentStringsW GetCurrentProcessId OpenProcess GetExitCodeProcess OpenThread GetExitCodeThread GetTempPathW GetFileSize FileTimeToSystemTime GetTickCount GetWindowsDirectoryW WideCharToMultiByte GetComputerNameW SetFileTime MoveFileW GetVolumePathNamesForVolumeNameW FindFirstVolumeW FindNextVolumeW FindVolumeClose GetDiskFreeSpaceExW RemoveDirectoryW DeleteFileW CopyFileW GetFileInformationByHandle FormatMessageW DeviceIoControl SetThreadExecutionState GetPriorityClass SetPriorityClass HeapCreate GetVolumePathNameW GetNativeSystemInfo LoadLibraryW GetFileTime GetVolumeInformationW SystemTimeToFileTime FreeLibrary Sleep WaitForMultipleObjects GetSystemTime OpenFileMappingW MapViewOfFile WTSGetActiveConsoleSessionId CreateToolhelp32Snapshot Process32FirstW ProcessIdToSessionId Process32NextW LocalFree lstrlenW ResetEvent UnmapViewOfFile GetVersionExW MultiByteToWideChar OutputDebugStringA GetLocalTime GetModuleFileNameW CreateDirectoryW GetFileSizeEx GetFileAttributesW SetFileAttributesW FindFirstFileW FindNextFileW FindClose GetCurrentProcess OpenMutexW GetSystemInfo CreateFileW GetModuleHandleW GetProcAddress SetFilePointer SetEndOfFile ReadFile GetEnvironmentVariableW HeapAlloc CreateEventW OpenEventW HeapFree GetProcessHeap CreateThread SetEvent SetFilePointerEx WriteFile GetCurrentThreadId WaitForSingleObject ReleaseMutex CloseHandle FindResourceW LoadResource LockResource SizeofResource GetLastError CreateMutexW

user32

WindowFromPoint GrayStringW DrawTextExW TabbedTextOutW SetWindowTextW IsDialogMessageW RegisterWindowMessageW SendDlgItemMessageW SendDlgItemMessageA WinHelpW GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW GetForegroundWindow GetTopWindow GetMessageTime GetMessagePos MapWindowPoints ScrollWindow SetMenu GetScrollRange UpdateWindow CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW GetSysColor ScreenToClient SetScrollInfo DefWindowProcW CallWindowProcW GetMenu SetWindowLongW SetWindowPos SystemParametersInfoA GetWindowPlacement GetWindowTextW GetScrollPos SetScrollPos UnhookWindowsHookEx GetWindowThreadProcessId GetLastActivePopup SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW PeekMessageW ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions ModifyMenuW EnableMenuItem CheckMenuItem GetActiveWindow SetActiveWindow CreateDialogIndirectParamW DestroyWindow GetDlgItem IsWindowEnabled EndDialog PostQuitMessage PostMessageW GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu AdjustWindowRectEx ClientToScreen EndPaint BeginPaint GetCursorPos GetWindow GetDlgCtrlID TranslateAcceleratorW UpdateLayeredWindow EndDeferWindowPos BeginDeferWindowPos MessageBoxW DestroyAcceleratorTable DeferWindowPos EqualRect DrawIcon GetNextDlgTabItem DestroyMenu GetSysColorBrush UnregisterClassW GetKeyState GetScrollInfo SystemParametersInfoW GetWindowTextLengthW GetWindowDC SetWindowRgn PrintWindow LoadCursorW DestroyCursor SetCursor DestroyIcon ReleaseDC EnumChildWindows GetFocus LoadBitmapW GetWindowLongW DrawTextW DrawFocusRect FillRect IsWindow CopyRect PtInRect GetParent GetWindowRect InvalidateRect DrawIconEx GetDC BringWindowToTop EnableWindow SendMessageW wsprintfA GetDesktopWindow ExitWindowsEx GetSystemMetrics IsWindowVisible RedrawWindow GetClientRect LoadIconW ShowWindow IsIconic SetForegroundWindow SetFocus

gdi32

MoveToEx LineTo ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx Escape ExtTextOutW TextOutW RectVisible PtVisible CreatePen SetMapMode SetGraphicsMode SetStretchBltMode SetBkMode RestoreDC SaveDC SetBkColor SetTextColor GetClipBox CreateBitmap GetTextExtentPointA GetTextMetricsA GetDeviceCaps CreateICW CreateFontIndirectW SelectObject DeleteDC CombineRgn CreateRectRgn CreateRoundRectRgn GetObjectW ExcludeClipRect GetStockObject CreateSolidBrush CreateCompatibleDC CreateCompatibleBitmap Rectangle CreateFontW GetTextExtentPoint32W BitBlt DeleteObject StretchBlt CreatePatternBrush FillRgn

msimg32

AlphaBlend TransparentBlt

winspool.drv

DocumentPropertiesW OpenPrinterW ClosePrinter

advapi32

CloseServiceHandle RegOpenKeyExW RegQueryValueW RegSetKeySecurity EncryptFileW OpenEncryptedFileRawW WriteEncryptedFileRaw CloseEncryptedFileRaw DecryptFileW ImpersonateLoggedOnUser RevertToSelf RegQueryInfoKeyW RegGetKeySecurity IsValidSecurityDescriptor RegEnumValueW GetKernelObjectSecurity RegFlushKey DuplicateTokenEx CreateProcessAsUserW RegDeleteValueW OpenSCManagerW OpenServiceW QueryServiceStatusEx RegCloseKey GetUserNameW RegDeleteKeyW IsValidSid ConvertSidToStringSidW RegEnumKeyW GetTokenInformation CheckTokenMembership RegOpenKeyW RegCreateKeyExW RegQueryValueExW RegSetValueExW OpenProcessToken SetKernelObjectSecurity LookupPrivilegeValueW AdjustTokenPrivileges InitializeSecurityDescriptor AllocateAndInitializeSid GetLengthSid InitializeAcl AddAccessAllowedAce SetSecurityDescriptorDacl FreeSid

shell32

SHGetPathFromIDListW SHGetMalloc ShellExecuteW SHFileOperationW SHGetFolderPathW ShellExecuteExW SHCreateDirectoryExW SHBrowseForFolderW

comctl32

InitCommonControlsEx _TrackMouseEvent

shlwapi

PathFindExtensionW PathFindFileNameW SHCreateStreamOnFileEx

ole32

CoUninitialize CoInitializeEx CoCreateInstance CoInitialize CoCreateGuid CreateStreamOnHGlobal

oleaut32

SafeArrayDestroyData SysFreeString SysAllocString VariantClear VariantChangeType VariantInit

mpr

WNetAddConnection2W WNetCancelConnectionW WNetCancelConnection2W

winhttp

WinHttpOpen WinHttpReadData WinHttpReceiveResponse WinHttpQueryHeaders WinHttpQueryDataAvailable WinHttpConnect WinHttpOpenRequest WinHttpGetProxyForUrl WinHttpSetOption WinHttpSendRequest WinHttpWriteData WinHttpSetStatusCallback WinHttpCloseHandle

wininet

FtpRemoveDirectoryW FtpDeleteFileW InternetCloseHandle InternetFindNextFileW FtpFindFirstFileW InternetWriteFile FtpOpenFileW FtpPutFileW InternetReadFile InternetConnectW InternetOpenW InternetCheckConnectionW HttpSendRequestW HttpOpenRequestW InternetQueryDataAvailable FtpGetFileSize InternetGetLastResponseInfoW FtpCreateDirectoryW InternetGetConnectedState

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

gdiplus

GdipAddPathPolygonI GdipAddPathEllipseI GdipCreatePathGradientFromPath GdipSetPathGradientCenterColor GdipSetPathGradientSurroundColorsWithCount GdipGetPathGradientPointCount GdipCreateLineBrushFromRectI GdipAddPathArc GdipResetPath GdipAddPathLine GdipDrawArcI GdipCreateLineBrushFromRect GdiplusStartup GdipSetPathGradientBlend GdipGraphicsClear GdiplusShutdown GdipCreateBitmapFromStream GdipCloneImage GdipDisposeImage GdipCreateHBITMAPFromBitmap GdipAddPathLineI GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetTextRenderingHint GdipAlloc GdipFree GdipCreateFont GdipGetGenericFontFamilySansSerif GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipMeasureString GdipDeleteFont GdipReleaseDC GdipGetDC GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipDrawString GdipGetFamily GdipCreatePath GdipDeletePath GdipAddPathString GdipGetFontSize GdipGetFontStyle GdipCreatePen1 GdipDeletePen GdipSetPenLineJoin GdipDrawPath GdipAddPathRectangle GdipAddPathArcI GdipClosePathFigure GdipCreateHatchBrush GdipFillPath GdipGetPageUnit GdipSetPageUnit GdipSetPenMode GdipDrawLineI GdipSetStringFormatFlags GdipCreateLineBrushFromRectWithAngleI GdipFillRectangleI

$TEMP/TemporaryComodoProduct/GUIlang.dll

SHA256 8f4c5c4e83e45531505836a6665e0566142099a01cdd4cebdc4a40c2a3d31603
MD5 fed55523c06f4e5ff6b2b81d8f322a09
SHA1 6b985e4ca3e6a4847fe1ade0a5a502582935361e
SHA512 f0057d0d5d9e395b2c44408db2fb7cf60c39eed0922cefb508bcb66f6851d143beec734fd56523040cb02aa1e3221f684639849cae380b9e0b7a3d53fd824b39
SSDEEP 3072:X7du2EuMkw1R6t5Zjzz9FJ+rML0NYBqV1vdtM6MJyFK0F5+kKYz3BKwpNdOk7r1K:LduhuM5yt7z9FgrMLmjvdtM6MJyFK0FC
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

03:64:9d:27:9f:d2:27:d8:16:df:4a:02:92:33:fc:81:33:c6:a0:76

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\emanu_000\Desktop\SetupCheckout\BIN\Win32\Release\GUILANG.pdb

$TEMP/TemporaryComodoProduct/GUIlang_CHI.dll

SHA256 e0cd9fbe9fe2059ccb8065a30c78a590a4678bf74641d0a9b951c8bd60eb0a8d
MD5 de8eb072ee57d3f2dc7223f736a0d96a
SHA1 990534d6c8487e6223086c8166135a6fc368d5de
SHA512 9c2cc1712a07f98621d18c6d43f855a7b28b29386db3c3a0ec069cd85a9623ebc0bc18f97ff171093043e316e9e7a017663ec3ea8e98edfc419681ec3c38a8e2
SSDEEP 3072:FvSNMNGkW6t5Zjzz9FJLrML0NYBqV1vdtM6MJyFK0F5+kKYz3BKwpNdOk7r1cp9s:NSNMM6t7z9FFrMLmjvdtM6MJyFK0F5+4
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

eb:7e:9b:d7:d9:86:df:92:21:f4:5f:4a:ec:8f:5a:f9:af:7a:f9:cf

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\emanu_000\Desktop\SetupCheckout\BIN\Win32\Release\GUILANG_CHI.pdb

$TEMP/TemporaryComodoProduct/GUIlang_CZE.dll

SHA256 f32ccbe6ae2c9e0b3ca12a3fc16229385e3f542fcdfc7f94e97901e91932fbd8
MD5 be2104381cf88aaa233f5037492f4ec9
SHA1 653c6b094c8c6d9cd70f9586cf730249dce7d994
SHA512 ffa11e9af64b89495ed389178a001a7d4519a68d7e246876373f5251cbdb7506cf90bcb4d6b856da3b6b60959e046c1a36469bda27c410c2fb4f426d710f4dbe
SSDEEP 3072:X3du2EuMkw1R6t5Zjzz9FJhrML0NYBqV1vdtM6MJyFK0F5+kKYz3BKwpNdOk7r13:nduhuM5yt7z9FvrMLmjvdtM6MJyFK0Ff
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

9d:28:c4:a8:3e:7d:5b:57:3b:11:9d:84:22:35:a6:f6:50:cc:38:2c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\emanu_000\Desktop\SetupCheckout\BIN\Win32\Release\GUILANG_CZE.pdb

$TEMP/TemporaryComodoProduct/GUIlang_DE.dll

SHA256 c2f46a310173fa4cb86fcbe01a1e9b2420e19facc922bdc32c5f86ce92c97859
MD5 5e7d3b644652d2248026900a9301f82e
SHA1 78c7443512b69c3621103a23e34fcab32c70f514
SHA512 931c87f3e7364a711ae1e44bd9e53dba34123a6acd74aa10c8f2b9d5a7714f370262d8b35234b9daa23f6f592315165d3a0121cb42aaa3e33a7ece422aa2985f
SSDEEP 3072:fKB7MqAhTwT5teMQLGt3jdUqG0cDC5M9/GC+6nvi2aHk+xMUp+D0o7Mspcc8U/rx:HKMvNB6rMLgjvdtM6MJyFK0F5+kKYz3O
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

0b:74:da:f0:40:83:35:cd:2b:6e:98:d6:07:5d:ee:5a:c7:70:38:61

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\emanu_000\Desktop\SetupCheckout\BIN\Win32\Release\GUILANG_DE.pdb

$TEMP/TemporaryComodoProduct/GUIlang_DU.dll

SHA256 6274f9e1e8c162fa14ed279df8b7c6906d5420265b8cf6297658405a737a6d1a
MD5 ca0cb76207254ccb6e6cff6376dddb28
SHA1 08f72fd97dead5c5664d5dce8528bd92cf09b9ab
SHA512 bf59c39e9fc202bd097966620cd215bdec1a68ec445ee2b79eaa96f658ed252c3a1653920bae2c3c1982f4a2859c9c73196ec18d514c251e0998837646375b28
SSDEEP 3072:DjrI4OZeQJMLt0z6NZZjTT9ErULMr1tLIlVGbIMq13kYK0F5+kKYz3BKwpNdOk7/:Xrx8JM5VN7T9EoLMrOQbIMq13kYK0F5b
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

53:06:da:3e:e6:78:2c:aa:70:2a:5f:21:5b:85:e4:94:4a:22:f7:5b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\emanu_000\Desktop\SetupCheckout\BIN\Win32\Release\GUILANG_DU.pdb

$TEMP/TemporaryComodoProduct/GUIlang_ESP.dll

SHA256 023bff70cd098e0292b36bdc435c91fab440e6f7d8e32a7856d3716e198b5c0c
MD5 b44eef1d7943f9d68803acb17e9b56ba
SHA1 1dd0f94ac1f686f292bc02c63c83406524908e37
SHA512 b7f89157e3195fbe77374ba19bff13ac9fe37907aea5400403e3ab88c99f65bd6a318fb857de55aa895553aff3dda28c69096ec746de9f1371631b563bbb72a0
SSDEEP 3072:yaV/fMQKt1FNuZWsT9EJOLMr1tLINVGbIMq13kYK0F5+kKYz3BKwpNdOk7r1cp91:vfMrNGT9EsLMrGQbIMq13kYK0F5+kKYC
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

94:c0:52:17:f4:4e:17:62:87:d8:1b:6b:1f:2c:6e:3b:7c:3a:b4:01

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\emanu_000\Desktop\SetupCheckout\BIN\Win32\Release\GUILANG_ESP.pdb

$TEMP/TemporaryComodoProduct/GUIlang_EST.dll

SHA256 7468bfba669f77d34b33ad36a884b20409d2d481a5b50c8158009e965532ae48
MD5 998e65361c7081396d6f88992a050a10
SHA1 be9ecd4c85cba9530902a8eb341b26a48fac42ec
SHA512 06861b2b010a5e0460c594bc54312cd17afb51ac3e838b332e1d09601fdbeda1a7f156a17fb6d3fff59012acdf56b89e8236707300ec3a5af0ce08cd2c5c001e
SSDEEP 1536:PwgKRWm6BZrzTNLBj49uz5Fv5MlUdOk7r1cp9zhKB:Pwt67rzTNLBj49uz5Fv51dOk7r1cp9wB
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

b4:49:98:4e:62:2a:2b:16:e5:60:af:7d:3e:6d:ba:13:b0:51:31:36

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\emanu_000\Desktop\SetupCheckout\BIN\Win32\Release\GUILANG_EST.pdb

$TEMP/TemporaryComodoProduct/GUIlang_FIN.dll

SHA256 6f54661b44533d5cc61f7bca016c5ca779999160e4c699a245217b41da180be1
MD5 9edb571c7503fc8c9c3da8fc8d13d09e
SHA1 3a123dda09fd602ac15468a13d1edef77b435180
SHA512 65159ea9fc9b743cf78221a40684095165537d0bfcba456ce8c0eed831ac1db8e449c95dafff4191918d0d08ab8ed881f3d7b15eb9b90a6939a1815808546c28
SSDEEP 3072:GmEhTBjeaEHyv1gjNF7WSgM/Y0ygR4UDRpwDzbWmTeAJQjkMdVCVIe9dOk7r1cp3:HRJDMDDmkOk7r1q3
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

ae:13:64:25:6f:fa:98:e7:8f:ee:50:55:f7:a6:97:39:49:2d:71:be

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\emanu_000\Desktop\SetupCheckout\BIN\Win32\Release\GUILANG_FIN.pdb

$TEMP/TemporaryComodoProduct/GUIlang_FRA.dll

SHA256 a11be0b4f12f50d4a648acbfa198ab113992ae472706b63b4fec7d902bfb73dc
MD5 a164ebd2a65093ccb18c1647eab617ec
SHA1 3c2953ff96298ef5c9b4e2458947ad5c0d4c92b5
SHA512 c0c23d797ddc6f54e92028b513c7f106287a60166ce51515f68ba7df247094969c4862c14f0202dba787140b53d27853c5887171afd468d97cb85508511eefbf
SSDEEP 1536:dRhVbizi4TysEOatKiyrowUyYDC2ekhm0:d5bb4TysEOt46Z0
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

fd:9d:3a:58:b3:64:4e:76:86:08:c7:5c:e5:47:3f:a2:8d:20:3f:14

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\emanu_000\Desktop\SetupCheckout\BIN\Win32\Release\GUILANG_FRA.pdb

$TEMP/TemporaryComodoProduct/GUIlang_HUN.dll

SHA256 4eab06cb0e4efd7e056264d212ca7fd0194f044894dbe4aaaa53580ba970440d
MD5 1a67fc9fbe59682d66e39b5bb18e7752
SHA1 dc4b74e6e4fc2c3f393c7c37d1371e2f1a7c658d
SHA512 fe8d0aaf1a42926d4371c448bd433abcb5ca6e12f2716d3b5e9e2f312565fe42f0fe5aabf5f902c17e172b2bb3dbb9bd13a3d2b44677ce5b9b0d99b94d44dd9b
SSDEEP 3072:jAVLpS5STFVq01OMm4kJPpFoKLmX3jkAcLZTVEgsJuh7uoKGcEa6j11yAOrOKldQ:92MF5+kKYz3Bh5Ok7r1qW
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

11:3b:dd:1a:4f:61:35:7a:63:e4:46:c4:1c:cf:21:2c:14:31:38:4f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\emanu_000\Desktop\SetupCheckout\BIN\Win32\Release\GUILANG_HUN.pdb

$TEMP/TemporaryComodoProduct/GUIlang_ITA.dll

SHA256 11f55b4c524b4351a61781c7b68879cae66cc4c43c85af1aa23ad155407e25af
MD5 92672bc49fe91c901fb2fac3891a350e
SHA1 cf5ebd8ef0af1d11e2fee2dcb7a71bda7bc3ca25
SHA512 8f9b5b14f4e407df0fe7f63a7c9341f8a52ff4c3065b3a5de03928bd497e8543e494f32bedf3fe71d55e88ec66f3526942b16bf458ae6b64d985944b0c6b7da4
SSDEEP 1536:BS7zofehS26VHQVuUsavPPba0lUdOk7r1cp93hp:B7qV6VQVuUssHbaNdOk7r1cp9X
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

8e:2f:03:5e:5d:88:d9:f2:b9:36:81:33:15:2e:9e:20:b1:c9:8b:0e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\emanu_000\Desktop\SetupCheckout\BIN\Win32\Release\GUILANG_ITA.pdb

$TEMP/TemporaryComodoProduct/GUIlang_JAP.dll

SHA256 0dc8b41cb025a47e6a92b9810a42d885dacf3fc882029e244ff7147ba8baf6ef
MD5 1342775b9de7db289685685fc4278787
SHA1 b32d835944f1b7875e34768a4dd5501bd5d5c903
SHA512 d750a8a49c4b2d122d9e42063c24931438ecca7a43fb20015819bb35dcbbb510ff7c10eaed227211ea3388f4548ff1a74631b8d2ff8cdf578249f9426426578e
SSDEEP 3072:k0LOYMOWeMSAFMFNujWTT9EJnLMr1tLIbVGbIMq13kYK0F5+kKYz3BKwpNdOk7ro:1LO/eMxKNzT9EZLMrIQbIMq13kYK0F5I
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

11:78:0f:52:45:ba:1d:6a:f9:62:a0:ed:da:25:ed:11:89:0a:4c:80

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\emanu_000\Desktop\SetupCheckout\BIN\Win32\Release\GUILANG_JAP.pdb

$TEMP/TemporaryComodoProduct/GUIlang_KOR.dll

SHA256 406e5f7f200b7e3efc00c08d1555978c586ce965bbd4d1cdbc31e933e9d79a25
MD5 2aa172e41c6e0db6d4dbe2e82c49a1fe
SHA1 ef202d00624c04efce903dbee1aa4cd27210e9a8
SHA512 5ee6dd73d63c190c62b15c98a83dc7770536d3f1bd46b2dca293793b07bb94e273367ad3abd4d3def8485cb6a951d93320c9f8986b27563ab9d11593b9d82448
SSDEEP 3072:ABWYxMW5of0CgHT8MLMr1tLIgVGbIMq13kYK0F5+kKYz3BKwpNdOk7r1cp9V:WxMW5Y02MLMrjQbIMq13kYK0F5+kKYzu
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

e1:ed:2c:bf:d8:f3:13:c2:57:32:55:7d:12:3e:df:78:95:f1:0c:54

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\emanu_000\Desktop\SetupCheckout\BIN\Win32\Release\GUILANG_KOR.pdb

$TEMP/TemporaryComodoProduct/GUIlang_POL.dll

SHA256 fd7edd8b6efb67a3ae35225ff0bf56ef4deb1bd0a3dd3765c3c12b8d06b9b62b
MD5 f49e7280504c51fb8572208c614cde8b
SHA1 0160e93da1ede0f0e3f2eeb09a70f7d0255ce259
SHA512 bc3889359816bd22fea6aa63ebe59b18ae1e53f664f2bb4d961293d6ed277a78f9f381b5855b128d588b1f4b69b3629d5229bfa27e96c675b7807be4136e96a3
SSDEEP 768:Cns2e/MH8sZhbPB/t2ENAYw9JnAiONxJWcYHvN7fKy8efiGCOWLgJObGV5y0g9F5:XEmuJWzHsTxgMHAe0lUdOk7r1cp9ZhI
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

a1:5d:6f:8b:e7:45:c5:5d:55:9a:2b:32:c9:df:a8:85:26:19:3d:30

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\emanu_000\Desktop\SetupCheckout\BIN\Win32\Release\GUILANG_POL.pdb

$TEMP/TemporaryComodoProduct/GUIlang_POR.dll

SHA256 c51767853b11a9e2abb982a9c5abeb4dbdbf541bcfe9ca2d3e23b700412177cd
MD5 edb952cc7a5cc4a0524c77b06e0f4077
SHA1 3b8ad61e0b3162d2d8ca01ed8845e432edaa127e
SHA512 0be0e6b243a36380401563eb2ebaf9d1e199583ff7a9873277f69cbca37c3e2be544f27d88a1d6a96db610e6d462d75cf8d395d43ecc223bc92fbb0ec3c65c2d
SSDEEP 1536:7gNYXrvXSBj5PHPHs0LGN/u5DEm0LW3b68yhi:7gSvX+hdiC
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

c7:a3:ba:19:24:e7:e2:62:c3:ec:0f:1a:23:b0:40:ff:dc:72:cc:c2

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\emanu_000\Desktop\SetupCheckout\BIN\Win32\Release\GUILANG_POR.pdb

$TEMP/TemporaryComodoProduct/GUIlang_RO.dll

SHA256 9560c6f2c4023a95097215f9731d48e262379bacbafc67940beca5423ad2a124
MD5 a02edcca25f3f4e9f852e9ce494ec7b3
SHA1 70a7573d971507a2d973ed8ade2fc66d1082c180
SHA512 23387a4a2b1de2bd873eaa5edf70e2e7feaa858c869208bd0ef18eb0deac6ce568a2e78f4758bd9eece728ae4bb7103feece26e31b8064f4e59f8676a6dfd205
SSDEEP 3072:GECcF9FAXG3rMYT+7g9SSuVbGNloOl6JMLMrGtLIuDbIMq13kCThF5+kKYzx1Xgu:3CcF9FAXG3rMO+7g9SSuVCNloOl6WLMZ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

85:d5:0f:ed:45:b2:df:54:1b:64:01:37:0b:dd:a8:39:99:d2:d5:44

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\emanu_000\Desktop\SetupCheckout\BIN\Win32\Release\GUILANG_RO.pdb

$TEMP/TemporaryComodoProduct/GUIlang_RU.dll

SHA256 caa8783c236bb05930399ea0da7ff7ba9a80f07ad27662881af7be44ab83426f
MD5 c4e200e1ccae9b347dd272d77670a718
SHA1 e45562a616581f92dccd964f5e583232cabda245
SHA512 fe184b540648d6c0d73b02e66876e07ba7c211515960125eb15626ca5472ecf218811f674179062218ead22dd5d9786546ccac8d3584aa171553e5db2c22df67
SSDEEP 768:CnF7IB2jUKYJBoZbUTFPvgPYshGP/+G1UBs39w+Yu6UFUOk7r1cp9Exhp:uBrigPYshG/pduOk7r1cp94hp
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

d0:23:5f:4b:37:14:c0:9a:57:e9:c5:14:fe:82:10:95:38:37:d4:b8

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\emanu_000\Desktop\SetupCheckout\BIN\Win32\Release\GUILANG_RU.pdb

$TEMP/TemporaryComodoProduct/GUIlang_SLO.dll

SHA256 a61e7718efd99540bc74b5f481a84406c2a6ecb815805f5184a6247d852047e9
MD5 38b60e917a863839b19ab7707033641c
SHA1 45bf18975a3b1c1f5df67f955308ba957fa76bc4
SHA512 315e85479bbb6469774fe30c7b31e8e8048b4c8e89253a76011122cc29ce519d3908c3c473305cba7280f07c6e4ddece83a899514f000a014213e7c9d793d11f
SSDEEP 3072:3oSxvMQPcFNuZWsT9EJ9LMr1tLIeVGbIMq13kYK0F5+kKYz3BKwpNdOk7r1cp9j:DvMQP8NGT9E/LMrVQbIMq13kYK0F5+k6
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

c6:2f:49:e1:7e:1c:f2:a2:a8:85:ec:70:db:54:52:40:af:34:cc:2c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\emanu_000\Desktop\SetupCheckout\BIN\Win32\Release\GUILANG_SLO.pdb

$TEMP/TemporaryComodoProduct/GUIlang_SWE.dll

SHA256 e655da6ccb05d7123bfa7284971126447d6eca427348c52341c12a193230ba3c
MD5 d2a7df03a8cbc6266f8645209f5a4d03
SHA1 77cc9cc8e9405e8096f42357bf11c310beb32045
SHA512 09f1e47d41a83d3163ee6ac4e605b35fd571e28895696120c6ab50f0b169b91424f60a0ac57c5e1cfff194b8424665669b3914a3b3714d54c0ab06dfa2ef87d1
SSDEEP 1536:tz/pAc28rGFITfhCJuSod8bIMq13kVElUdOk7r1cp9Vh5E:t6cJrGFehg7oybIMq13kfdOk7r1cp9m
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

9c:bb:46:6c:32:70:b4:eb:46:45:36:5f:df:8b:04:2d:ee:9c:8f:31

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\emanu_000\Desktop\SetupCheckout\BIN\Win32\Release\GUILANG_SWE.pdb

$TEMP/TemporaryComodoProduct/GUIlang_TUR.dll

SHA256 55772e39a7a6a64af77323d653ad7c80c95f04b0b609fda44711ce5a9f965726
MD5 e8f43a810be45d8a4bee657126f9406c
SHA1 281a727932e6f8aba8b50e35f47a79c93d93601e
SHA512 15ca436d623be292eea0af569f1c5805b6d3610eae5fe4d651a3619f32715036f06abf128a0be5c22c9cfa61a515c5e8d180b4be3fe30757a600da3257da10e4
SSDEEP 3072:cgq/0DwmC4135zexdKdxNQZKp26HpKrZwF+OXzgkllTKGK0BdLFvbzopz4pi9tDB:sC/QB
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

24:e7:95:eb:cb:af:44:a9:0a:11:21:bf:bc:27:4d:3c:8a:4e:11:bc

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\emanu_000\Desktop\SetupCheckout\BIN\Win32\Release\GUILANG_TUR.pdb

$TEMP/TemporaryComodoProduct/ProxyDetector.exe

IMPHASH f7a43f7bb29a0009cc3e8de1893d2431
SHA256 cb1d06d5dc06b471f791fb852c004881f521c4da8680a477f69d2bab086442a9
MD5 c325b89447080f02e70382d0d5e3bb45
SHA1 e8665ae3b2e2ce0720edfd8b53c01d850b967784
SHA512 85b51003f2335dc1ddc9240793b2147ae4de1d426ce1df89ebd82f48a4f0a35edea092f0108b203b114fa3edcb314b1ca3b6b7c52de7c900ede0a1e2659ca077
SSDEEP 1536:VE2aQNZeJRCd1Hu2AKJLIZP93OLWk3oN9LQd5nb2D6hz:a2SydOoLSKIQd5nb2Ds
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

06:b5:95:02:55:5c:73:3a:d9:28:55:86:a0:ff:3a:fe:3a:d2:e3:64

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Minor OS version

0

Major OS version

5

Entry point

14300

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\emanu_000\Desktop\SetupCheckout\BIN\Win32\Release\ProxyDetector.pdb

kernel32

CreateMutexW FindResourceExW FindResourceW LoadResource WaitForSingleObject SizeofResource GetLastError LockResource ReleaseMutex CloseHandle MapViewOfFile UnmapViewOfFile OpenFileMappingW RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap CreateFileA FlushFileBuffers GetLocaleInfoA GetStringTypeW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc RtlUnwind SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage MultiByteToWideChar LoadLibraryA InitializeCriticalSectionAndSpinCount SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW LCMapStringA LCMapStringW GetStringTypeA

winhttp

WinHttpReceiveResponse WinHttpQueryAuthSchemes WinHttpSetCredentials WinHttpOpenRequest WinHttpOpen WinHttpQueryHeaders WinHttpCloseHandle WinHttpConnect WinHttpSendRequest WinHttpGetIEProxyConfigForCurrentUser

credui

CredUIPromptForCredentialsW

$TEMP/TemporaryComodoProduct/ShellExtension.dll

IMPHASH 4887e0f32aee5f871f3c579f5268fd50
SHA256 b58313a180e2d7ed6df3b8eb2923c72484a6a291a07ab78b2900ca1ed43c7b0a
MD5 d8eb06cf312bb6e64bae7bdf8fa36830
SHA1 207dac72a7eaa54e4a3400be1f56b805638fa20f
SHA512 6fc468115e17c73924457ad1a9a2dbb68b89f42e55a2fb59a4deeedcc55ee601992cb8840ebfd259c552ccb3219e09cb2a6025b07d198eda4cd2559283fa42d8
SSDEEP 49152:D+x1gtek+TqBmckuAakg6IQOoeqUtzp5EB4MXuxT2NTgTJT01Pt7eGb8EH:wdkQucYAeqU1pTMX4Gb8a
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

PE Signature issue

Digest

7f:07:47:23:0e:f2:14:b9:0c:f4:31:73:37:75:61:ed:f1:5f:7c:cc

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Minor OS version

0

Major OS version

5

Entry point

3492712

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\emanu_000\Desktop\SetupCheckout\BIN\Win32\Release\ShellExtension.pdb

shlwapi

UrlUnescapeW PathRemoveExtensionW PathFindFileNameW PathStripToRootW PathIsUNCW PathMatchSpecW PathFindExtensionW SHCreateStreamOnFileEx UrlEscapeW PathIsDirectoryW PathRemoveFileSpecW

comctl32

DestroyPropertySheetPage CreatePropertySheetPageW _TrackMouseEvent InitCommonControlsEx

kernel32

CompareStringA GetLocaleInfoW lstrcmpA EnumResourceLanguagesW ConvertDefaultLocale GlobalDeleteAtom SuspendThread GlobalAddAtomW GetVersionExA LoadLibraryA CompareStringW GlobalFindAtomW GetModuleHandleA GetStringTypeExW FlushFileBuffers LockFile UnlockFile GetFullPathNameW GetShortPathNameW FileTimeToLocalFileTime LocalAlloc LocalFileTimeToFileTime TlsGetValue GlobalReAlloc GlobalHandle TlsAlloc TlsSetValue LocalReAlloc TlsFree GlobalGetAtomNameW GetAtomNameW lstrlenA GetPrivateProfileIntW WritePrivateProfileStringW GetPrivateProfileStringW GlobalFlags RtlUnwind TerminateProcess UnhandledExceptionFilter InterlockedExchange IsDebuggerPresent GetSystemTimeAsFileTime GetCommandLineA HeapReAlloc ExitProcess ExitThread HeapSize SetStdHandle GetFileType GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringA LCMapStringW GetStdHandle GetModuleFileNameA FatalAppExitA VirtualFree VirtualAlloc HeapDestroy GetTimeZoneInformation SetHandleCount GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter SetConsoleCtrlHandler InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode GetStringTypeA GetStringTypeW GetTimeFormatA GetDateFormatA GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetCurrentDirectoryA SetCurrentDirectoryA GetDriveTypeA GetFullPathNameA WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEnvironmentVariableA lstrcmpW GlobalSize MulDiv ResumeThread CreateProcessW lstrcpyW FreeResource GlobalAlloc GlobalFree GetThreadLocale SetThreadLocale LockResource RaiseException GetExitCodeProcess OpenThread GetExitCodeThread GetCurrentProcessId GetCurrentThread SetThreadPriority InterlockedDecrement CreateFileMappingW InterlockedIncrement ExpandEnvironmentStringsW GetWindowsDirectoryW GetFileSize FileTimeToSystemTime GetTickCount GetTempPathW SetFileTime FindFirstVolumeA FindNextVolumeA DuplicateHandle GetVolumeNameForVolumeMountPointW DeleteVolumeMountPointW SetVolumeMountPointW SetErrorMode GetDiskFreeSpaceW GetComputerNameW FindFirstVolumeW FindVolumeClose FindNextVolumeW GetVolumePathNamesForVolumeNameW MoveFileW GetPriorityClass SetPriorityClass SetThreadExecutionState FormatMessageW OpenProcess GetLogicalDrives DeviceIoControl GetFileInformationByHandle DeleteFileW CopyFileW GetDiskFreeSpaceExW RemoveDirectoryW HeapCreate SystemTimeToFileTime GetVolumePathNameW GetNativeSystemInfo LocalFree OpenFileMappingW MapViewOfFile UnmapViewOfFile WTSGetActiveConsoleSessionId CreateToolhelp32Snapshot Process32FirstW ProcessIdToSessionId Process32NextW GetFileTime CreateDirectoryW SetFileAttributesW GetFileAttributesW SetFilePointer SetEndOfFile GetFileSizeEx WriteFile ReadFile SetFilePointerEx GetSystemInfo GetEnvironmentVariableW CreateThread GetCurrentThreadId CreateMutexW OpenMutexW SetEvent HeapAlloc GetProcessHeap HeapFree OpenEventW GetVersionExW GetCurrentProcess WaitForSingleObject ReleaseMutex GetLocalTime OutputDebugStringA GetSystemTime GetProcAddress lstrcmpiW LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSection GetModuleHandleW SetLastError GetModuleFileNameW FreeLibrary LoadLibraryW FindNextFileW CreateFileW CreateEventW CloseHandle Sleep ReadDirectoryChangesW WaitForMultipleObjects GetOverlappedResult ResetEvent CancelIo WideCharToMultiByte lstrlenW lstrcpynA GetVersion GlobalLock GlobalUnlock lstrcpynW GetCurrentDirectoryW SetCurrentDirectoryW GetLastError GetVolumeInformationW QueryDosDeviceW FindFirstFileW FindClose SetUnhandledExceptionFilter

user32

SetCapture LockWindowUpdate GetDCEx UnionRect SetParent GetSystemMenu IsRectEmpty KillTimer SetTimer UnpackDDElParam ReuseDDElParam GetMenuBarInfo ReleaseCapture LoadAcceleratorsW InsertMenuItemW BringWindowToTop SetRectEmpty GetDialogBaseUnits DeleteMenu GetSysColorBrush UnregisterClassW GetKeyNameTextW WindowFromPoint GetMenuItemInfoW CharUpperW InflateRect GrayStringW DrawTextExW TabbedTextOutW RegisterWindowMessageW LoadIconW SendDlgItemMessageA WinHelpW IsChild GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW GetForegroundWindow GetTopWindow UnhookWindowsHookEx GetMessageTime GetMessagePos MapWindowPoints ScrollWindow TrackPopupMenuEx TrackPopupMenu SetMenu SetScrollRange GetScrollRange SetScrollPos GetScrollPos SetForegroundWindow ShowScrollBar UpdateWindow CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW GetSysColor ScreenToClient SetScrollInfo SetWindowPlacement DefWindowProcW GetMenu OffsetRect IntersectRect SystemParametersInfoA GetWindowPlacement SetActiveWindow CreateDialogIndirectParamW DestroyWindow LoadBitmapW DestroyMenu CreatePopupMenu SetMenuItemBitmaps EndDialog LoadMenuW GetWindowThreadProcessId GetLastActivePopup ShowOwnedPopups SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW PeekMessageW ValidateRect GetMenuCheckMarkDimensions ModifyMenuW EnableMenuItem CheckMenuItem PostQuitMessage GetMenuState GetMenuStringW AppendMenuW GetMenuItemID GetSubMenu RemoveMenu GetWindowTextLengthW GetWindowTextW SetWindowPos ScrollWindowEx SetFocus IsWindowEnabled ShowWindow IsDialogMessageW IsDlgButtonChecked SetDlgItemTextW SetDlgItemInt GetDlgItemInt CheckRadioButton CheckDlgButton DrawIcon BeginPaint EndPaint ClientToScreen AdjustWindowRectEx GetNextDlgTabItem GetKeyState GetWindowDC PrintWindow GetAncestor GetActiveWindow LoadCursorW PostMessageW DrawTextW DrawFocusRect FillRect PtInRect DestroyCursor SetCursor LoadImageW GetIconInfo DrawIconEx DestroyIcon EnumChildWindows GetFocus GetScrollInfo IsWindow InsertMenuW MessageBoxW wsprintfW CharNextW GetSystemMetrics ExitWindowsEx GetDesktopWindow wsprintfA SetWindowTextW EnableWindow GetDlgItem GetDlgItemTextW SendDlgItemMessageW SetWindowLongW GetWindowLongW SendMessageW DeferWindowPos DestroyAcceleratorTable EndDeferWindowPos BeginDeferWindowPos FrameRect TranslateAcceleratorW GetWindowRect SystemParametersInfoW GetMenuItemCount OpenClipboard EmptyClipboard SetClipboardData CloseClipboard GetCursorPos CallWindowProcW UpdateLayeredWindow GetParent FindWindowW RedrawWindow IsWindowVisible InvalidateRect ReleaseDC GetDC GetClientRect SetWindowRgn IsIconic EqualRect CopyRect SetRect GetDlgCtrlID GetWindow MoveWindow MapVirtualKeyW

gdi32

StretchDIBits GetCharWidthW GetTextMetricsW DPtoLP PatBlt GetBkColor SetRectRgn CreateRectRgnIndirect CreateHatchBrush ExtCreatePen PlayMetaFile EnumMetaFile GetObjectType SelectPalette CreateDIBPatternBrushPt ExtSelectClipRgn GetMapMode FillRgn CreatePen CreateRectRgn CombineRgn GetTextExtentPointA GetTextMetricsA CopyMetaFileW PolyBezierTo PolylineTo PolyDraw ArcTo GetCurrentPositionEx ScaleWindowExtEx SetWindowExtEx OffsetWindowOrgEx SetWindowOrgEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx Escape ExtTextOutW TextOutW RectVisible PtVisible StartDocW GetPixel GetWindowExtEx GetViewportExtEx SelectClipPath GetClipRgn SelectClipRgn SetColorAdjustment SetArcDirection SetMapperFlags SetTextCharacterExtra SetTextJustification SetTextAlign MoveToEx LineTo OffsetClipRgn IntersectClipRect SetMapMode ModifyWorldTransform SetWorldTransform SetGraphicsMode SetStretchBltMode SetROP2 SetPolyFillMode SetBkMode RestoreDC SaveDC SetBkColor SetTextColor GetClipBox GetDCOrgEx CreateBitmap CreateDCW DeleteObject DeleteDC BitBlt SelectObject CreateCompatibleBitmap CreateSolidBrush CreatePatternBrush CreateFontIndirectW GetObjectW CreateRoundRectRgn CreateCompatibleDC StretchBlt GetTextExtentPoint32W CreateICW GetDeviceCaps ExcludeClipRect GetStockObject CreateFontW Rectangle PlayMetaFileRecord

msimg32

TransparentBlt AlphaBlend

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter OpenPrinterW DocumentPropertiesW

advapi32

RegSetValueExW RegQueryValueW RegSetValueW RegCreateKeyW RegOpenKeyW RegGetKeySecurity IsValidSecurityDescriptor GetKernelObjectSecurity RegEnumValueW DuplicateTokenEx CreateProcessAsUserW OpenSCManagerW OpenServiceW CloseServiceHandle QueryServiceStatusEx RegFlushKey GetUserNameW ConvertStringSidToSidW LookupAccountSidW ImpersonateLoggedOnUser RevertToSelf CheckTokenMembership IsValidSid ConvertSidToStringSidW RegEnumKeyW LookupPrivilegeValueW AdjustTokenPrivileges SetKernelObjectSecurity InitializeSecurityDescriptor AllocateAndInitializeSid GetLengthSid InitializeAcl RegQueryValueExW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegEnumKeyExW RegQueryInfoKeyW GetTokenInformation OpenProcessToken FreeSid SetSecurityDescriptorDacl AddAccessAllowedAce

shell32

ShellExecuteExW DragFinish ExtractIconW SHBindToParent SHGetMalloc SHGetSpecialFolderLocation SHGetDesktopFolder ord716 ord155 SHGetFileInfoW ExtractIconExW SHCreateDirectoryExW SHFileOperationW SHGetFolderPathW SHChangeNotify ShellExecuteW DragQueryFileW

ole32

ReadFmtUserTypeStg OleRegGetUserType WriteClassStg WriteFmtUserTypeStg CLSIDFromString CoDisconnectObject OleDuplicateData SetConvertStg CreateStreamOnHGlobal StringFromGUID2 CoCreateGuid CoUninitialize CoInitialize CoCreateInstance CoInitializeEx CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree ReleaseStgMedium ReadClassStg CreateBindCtx StringFromCLSID CoTreatAsClass

oleaut32

VarBstrFromDate VarDecFromStr VarBstrFromDec VarBstrFromCy VarCyFromStr SysReAllocStringLen VarDateFromStr SystemTimeToVariantTime VariantTimeToSystemTime SafeArrayDestroyDescriptor SafeArrayDestroy SafeArrayUnlock SafeArrayLock VarUI4FromStr SysFreeString SysAllocString SafeArrayDestroyData LoadRegTypeLi LoadTypeLi SysStringLen RegisterTypeLi UnRegisterTypeLi SysAllocStringByteLen SysStringByteLen SafeArrayPutElement SysAllocStringLen VariantClear VariantChangeType VariantInit SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetUBound SafeArrayGetLBound SafeArrayGetElemsize SafeArrayGetDim SafeArrayCreate SafeArrayRedim VariantCopy SafeArrayAllocData SafeArrayAllocDescriptor SafeArrayCopy SafeArrayGetElement SafeArrayPtrOfIndex

mpr

WNetAddConnection2W WNetCancelConnectionW WNetCancelConnection2W

winhttp

WinHttpReceiveResponse WinHttpReadData WinHttpQueryHeaders WinHttpQueryDataAvailable WinHttpGetProxyForUrl WinHttpSetOption WinHttpOpen WinHttpConnect WinHttpOpenRequest WinHttpSendRequest WinHttpWriteData WinHttpSetStatusCallback WinHttpCloseHandle

wininet

GopherFindFirstFileW HttpQueryInfoW InternetSetStatusCallbackW InternetSetFilePointer HttpEndRequestW HttpSendRequestExW GopherGetAttributeW FtpCommandW GopherCreateLocatorW GopherOpenFileW InternetOpenUrlW InternetErrorDlg FtpGetFileW FtpGetCurrentDirectoryW FtpSetCurrentDirectoryW InternetCloseHandle InternetFindNextFileW FtpFindFirstFileW FtpGetFileSize FtpOpenFileW InternetReadFile InternetWriteFile InternetConnectW InternetOpenW FtpPutFileW InternetQueryDataAvailable HttpSendRequestW HttpOpenRequestW FtpDeleteFileW InternetCheckConnectionW FtpRemoveDirectoryW InternetGetLastResponseInfoW FtpCreateDirectoryW InternetGetConnectedState InternetCrackUrlW InternetCanonicalizeUrlW InternetQueryOptionW InternetSetOptionExW InternetSetCookieW InternetGetCookieW FtpRenameFileW HttpAddRequestHeadersW

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

gdiplus

GdipDrawArcI GdipGraphicsClear GdipSetPathGradientBlend GdipGetPathGradientPointCount GdipCreateLineBrushFromRect GdipSetPathGradientCenterColor GdipCreatePathGradientFromPath GdipAddPathPolygonI GdipAddPathEllipseI GdipAddPathArc GdipSetPathGradientSurroundColorsWithCount GdipGetDC GdipAddPathLineI GdipAddPathLine GdipResetPath GdipCreateLineBrushFromRectI GdipFillPie GdipDrawPie GdipSetPenColor GdiplusStartup GdiplusShutdown GdipFree GdipAlloc GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipCreateFromHDC GdipDeleteGraphics GdipSetTextRenderingHint GdipSetSmoothingMode GdipDrawString GdipMeasureString GdipCreateFont GdipCreateFontFamilyFromName GdipGetGenericFontFamilySansSerif GdipDeleteFontFamily GdipDeleteFont GdipCreateBitmapFromStream GdipCreateBitmapFromStreamICM GdipDisposeImage GdipCloneImage GdipCreateHBITMAPFromBitmap GdipSetStringFormatTrimming GdipSetPenWidth GdipReleaseDC GdipCreateHatchBrush GdipCreatePen1 GdipDeletePen GdipSetPenLineJoin GdipCreatePath GdipDeletePath GdipClosePathFigure GdipAddPathArcI GdipAddPathRectangle GdipAddPathString GdipDrawPath GdipFillPath GdipGetFamily GdipGetFontStyle GdipGetFontSize GdipCreateLineBrushFromRectWithAngleI GdipSetPenMode GdipSetStringFormatFlags GdipSetPageUnit GdipGetPageUnit GdipDrawLineI GdipDrawRectangleI GdipFillRectangleI GdipSetSolidFillColor

$TEMP/TemporaryComodoProduct/SynchronizationService.exe

IMPHASH cc39cc1382553f64395b82c285dbd816
SHA256 88d928f455d4ca077c672ba94ac25c1dccf5dcbceb48b2459cbb2da7e37241ed
MD5 122b5b2aa6bb1f9ffe382a481cd38877
SHA1 10f4da307e1c9996ea66da0b1836018cd3bcdc84
SHA512 2023139f323be83b54c7704ebe4102b1559595b9681412a9c1c98dfa9bb446bfce4ec00c762e109b3f2d27e68e851a9e4e03da3d716e4b30984049ab8d0c89e7
SSDEEP 49152:j8yekwpFgoRwvjzCMQ266FWEu7cKjWNCVKAmDNpxT8eWEMF4NrhQ:4yekwpFgoWKMxWEu7czgVKxDVMr
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

3c:04:d4:4a:e9:36:f5:fb:9e:7c:57:02:61:19:7a:42:8f:59:15:b4

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Minor OS version

0

Major OS version

5

Entry point

1707284

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\emanu_000\Desktop\SetupCheckout\BIN\Win32\Release\SynchronizationService.pdb

kernel32

lstrlenW SetThreadPriority GetTempPathW GetFileSizeEx FindFirstFileA OpenMutexW GetLastError SetLastError GetProcAddress MoveFileW CopyFileA EnterCriticalSection GetDiskFreeSpaceW FindClose ResetEvent GetLocalTime Process32FirstW OpenThread ProcessIdToSessionId CreateFileMappingW GetExitCodeThread CreateEventW RemoveDirectoryW QueryDosDeviceW DeviceIoControl GetSystemInfo WaitForMultipleObjects GetModuleFileNameA Process32NextW WTSGetActiveConsoleSessionId lstrcmpiW CancelIo ContinueDebugEvent OpenFileMappingW FindNextFileW CreateToolhelp32Snapshot GetFileTime WaitForDebugEvent OpenEventW DeleteCriticalSection GetCurrentThreadId OutputDebugStringA DuplicateHandle FindFirstVolumeA ReleaseMutex GetDiskFreeSpaceExW CloseHandle GetWindowsDirectoryW FindFirstVolumeW GetVolumeNameForVolumeMountPointW DeleteFileW GetCurrentProcessId GetFileInformationByHandle LocalFree FindNextVolumeA GetSystemTime SetFileAttributesW DeleteFileA GetVolumeInformationW CreateThread ExpandEnvironmentStringsW HeapDestroy HeapReAlloc HeapSize GetEnvironmentVariableW GetDateFormatW GetThreadContext GetFileSize CreateMutexW SetPriorityClass GetOverlappedResult CreateFileW GetTimeZoneInformation GetModuleFileNameW ReadFile FileTimeToSystemTime TerminateProcess GetFileAttributesW GetVolumePathNamesForVolumeNameW FindNextVolumeW GetTimeFormatW GetExitCodeProcess HeapCreate LeaveCriticalSection DeleteVolumeMountPointW GetVersionExW FormatMessageW CopyFileW Sleep LoadLibraryW WideCharToMultiByte OpenProcess GetVolumePathNameW GetPriorityClass InitializeCriticalSection WriteFile GetWindowsDirectoryA SetFileTime GetProcessHeap GetCurrentThread ReadDirectoryChangesW GetTickCount GetModuleHandleW SetThreadExecutionState SetEvent GetComputerNameW SetVolumeMountPointW WaitForSingleObject CreateDirectoryW HeapFree SetFilePointerEx GetCurrentProcess InterlockedDecrement SystemTimeToFileTime InterlockedIncrement HeapAlloc FreeLibrary SetErrorMode SetEndOfFile DebugActiveProcessStop FindFirstFileW GetNativeSystemInfo FindVolumeClose SetFilePointer GetCurrentDirectoryA GetFullPathNameA SetConsoleMode ReadConsoleInputA GetDriveTypeA FileTimeToLocalFileTime FlushConsoleInputBuffer GetVersionExA GlobalMemoryStatus MapViewOfFile UnmapViewOfFile MoveFileExA CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetEnvironmentVariableA CompareStringW CompareStringA LoadLibraryA DebugActiveProcess InitializeCriticalSectionAndSpinCount GetLocaleInfoA GetStringTypeW GetStringTypeA SetStdHandle RtlUnwind FlushFileBuffers GetConsoleMode GetConsoleCP GetModuleHandleA SetConsoleCtrlHandler QueryPerformanceCounter GetStartupInfoA SetHandleCount GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW RaiseException LCMapStringW LCMapStringA ExitProcess VirtualAlloc VirtualFree TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP GetACP GetCPInfo IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetSystemTimeAsFileTime MultiByteToWideChar GetVersion GetFileType GetStdHandle

user32

GetDesktopWindow ExitWindowsEx GetProcessWindowStation MessageBoxA wsprintfA GetSystemMetrics wsprintfW GetUserObjectInformationW

advapi32

ConvertSidToStringSidW CloseServiceHandle OpenProcessToken DeleteService OpenSCManagerW StartServiceCtrlDispatcherW GetUserNameW OpenServiceW GetTokenInformation RegEnumKeyW GetKernelObjectSecurity RegisterEventSourceA ReportEventA DeregisterEventSource RegSetValueExW RegCloseKey RegCreateKeyExW AdjustTokenPrivileges RegFlushKey ControlService CheckTokenMembership GetLengthSid IsValidSecurityDescriptor RegisterServiceCtrlHandlerW RegOpenKeyExW FreeSid IsValidSid RevertToSelf RegEnumValueW AddAccessAllowedAce QueryServiceStatusEx SetServiceStatus AllocateAndInitializeSid InitializeAcl SetKernelObjectSecurity RegDeleteValueW ImpersonateLoggedOnUser DuplicateTokenEx StartServiceW RegGetKeySecurity LookupPrivilegeValueW SetSecurityDescriptorDacl RegDeleteKeyW SetTokenInformation InitializeSecurityDescriptor RegQueryInfoKeyW RegOpenKeyW CreateProcessAsUserW RegQueryValueExW RegQueryValueExA CreateServiceW

ole32

CoUninitialize CoInitializeEx CoInitialize CoCreateInstance CoCreateGuid

shell32

ShellExecuteExA SHGetFolderPathW ShellExecuteExW SHCreateDirectoryExW SHFileOperationW

oleaut32

SafeArrayDestroyData SysFreeString SysAllocString

shlwapi

PathFindExtensionW SHCreateStreamOnFileEx

dbghelp

MiniDumpWriteDump

mpr

WNetCancelConnectionW WNetAddConnection2W WNetCancelConnection2W

ws2_32

ntohs gethostbyname WSAStartup ioctlsocket send WSASetLastError recv shutdown closesocket htons htonl socket setsockopt connect gethostname getsockopt WSAGetLastError getservbyname

winhttp

WinHttpOpen WinHttpQueryDataAvailable WinHttpSetStatusCallback WinHttpQueryHeaders WinHttpCloseHandle WinHttpConnect WinHttpWriteData WinHttpSendRequest WinHttpSetOption WinHttpReceiveResponse WinHttpReadData WinHttpOpenRequest WinHttpGetProxyForUrl

wininet

InternetCloseHandle InternetGetLastResponseInfoW FtpFindFirstFileW InternetCheckConnectionW InternetOpenW FtpDeleteFileW InternetFindNextFileW InternetQueryDataAvailable InternetOpenUrlW FtpGetFileSize InternetGetConnectedState HttpOpenRequestW FtpRemoveDirectoryW FtpCreateDirectoryW HttpSendRequestW InternetWriteFile InternetConnectW InternetReadFile FtpOpenFileW FtpPutFileW

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

$TEMP/TemporaryComodoProduct/VSS_s2003.dll

IMPHASH e420df96679cf3b1c1804f2e93559c85
SHA256 0c5f23da225534643082e93ca6453016f98f3b7c84cf46a93e83cc692a0ea976
MD5 9c25c7cbd42db23b68e95a249cb217cb
SHA1 d376e12e228433eb877dc9d20556a78a0e3876c7
SHA512 04ae4baf03dd5d5d6858534e63d3d70360f3ce67d3e4c85a685ebc4c925505dad1c801e88b1cc34ea69fe89efc7645fdc621076cecf65281c6cae00d3a16ab23
SSDEEP 768:nhZylFxQeMWnx2+rCXGtCIdnLbSPGA0/xbxNHTAQ11uBm5cyQpClxhO4:nhwlFxpBFztpnLbSPGAwbxNb95c2hO4
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

de:1f:7d:01:51:a2:2b:c3:c2:21:ea:ec:7c:85:ca:c5:58:0e:1a:78

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Minor OS version

0

Major OS version

5

Entry point

6565

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\emanu_000\Desktop\SetupCheckout\BIN\Win32\Release\VSS_s2003.pdb

$TEMP/TemporaryComodoProduct/VSS_vista.dll

IMPHASH e420df96679cf3b1c1804f2e93559c85
SHA256 18e9a002fe1639afa13ec1feda219c5d62aafe6a3ed1b06332063f48d2a6f6ab
MD5 f397f5ee0007989c41e5ab01a86dbcac
SHA1 ae0e5949666ab5afe2124dacfc49604f2b4054ce
SHA512 8cfed9df7236fa3caa3412c1f9f8c399cd90d2e540643b0dd41696278dde8a9d9c7f6a6a26711d92679243a2fc14df27927e35bc852b7937aa8637c503c87d1e
SSDEEP 768:7hZylFxQeMWnx2+rCXGtCIdnLbSPGA0/xbxNHTA411dBm5LybpCSxhT:7hwlFxpBFztpnLbSPGAwbxNze5L+hT
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

47:00:2e:5e:99:79:bc:35:a5:35:91:a2:3b:5e:79:54:4c:22:f0:8f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Minor OS version

0

Major OS version

5

Entry point

6565

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\emanu_000\Desktop\SetupCheckout\BIN\Win32\Release\VSS_vista.pdb

$TEMP/TemporaryComodoProduct/VSS_xp.dll

IMPHASH e420df96679cf3b1c1804f2e93559c85
SHA256 3bfd1378081cae4b2eb44fd86d9945d98d38aced5621a9df78f8d9db94305417
MD5 ae1a59b96362e063cd71d61849bea69d
SHA1 a450fa5a212bb3e99dc4633220839f75214b53e1
SHA512 6d0db96575c7064d142ee82644f3ab3e193ecec8deb1d1e4eaa2f2ee1bafd8f6187fe5ff7706693628c998cff63c0e9f0cbf94fdeac7128a707a3e35dfe907fc
SSDEEP 768:aeZylVxgeAWkx2+rCEGtCIdnLbImCSe/xbx+TAs11pBm5TiKXeGxhL/M:aewlVx5WFKtpnLbImbibx+a5TDhLE
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

0c:64:1c:59:b2:b8:4d:f5:d2:9a:07:f8:ef:0d:70:f4:b8:bb:7c:3b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Minor OS version

0

Major OS version

5

Entry point

6549

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\emanu_000\Desktop\SetupCheckout\BIN\Win32\Release\VSS_xp.pdb

$TEMP/TemporaryComodoProduct/WdfCoInstaller01009.dll

IMPHASH a17af54bf9d379152b9c377204b35eb9
SHA256 a4d2797024d89515adedd204a521dddbfed32698b01bbb7cf99a127791fe64c7
MD5 353b65efb529cbd9bb1aade8f54aed8c
SHA1 48cdf541a1c28d9b074a24a67f23d89e6a205d2b
SHA512 b1f81ca556638d4a4355023213fa9d2315fb49f34af3204bbd8f9f95faa65cd846c464a3adf1718ec2574a2c99467495ef86e13f4b60315529eb54066e285fff
SSDEEP 24576:AjG90oN2lj11mk/22yYzGrarZRm4X5Uh6rVh5LdfBwOyCSQM1fFhSWRAx:UGtN2h1120R7m4XShYVxfBwrC21fXSn
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

a0:d0:3c:75:d3:6f:1f:f2:27:b2:62:bc:3a:a0:87:77:e7:35:12:f0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Comodo Security Solutions\, Inc.,L=Jersey City,ST=New Jersey,C=US

Chains

Apr 13, 2010

Minor OS version

1

Major OS version

6

Entry point

56899

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

WdfCoInstaller01009.pdb

msvcrt

_amsg_exit _initterm _XcptFilter _wcsnicmp malloc free _wtoi _wcsicmp _ultow _stricmp memset memcpy _vsnwprintf

setupapi

SetupCloseInfFile SetupOpenInfFileW SetupOpenLog SetupDiGetDriverInfoDetailW SetupLogErrorW SetupCloseLog CM_Set_DevNode_Problem_Ex SetupDiGetDeviceInstallParamsW SetupDiSetDeviceInstallParamsW SetupPromptReboot SetupDiGetActualSectionToInstallW SetupGetLineCountW SetupFindFirstLineW SetupGetStringFieldW SetupFindNextMatchLineW SetupDiGetSelectedDriverW

kernel32

GetModuleFileNameW SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter RtlUnwind InterlockedCompareExchange Sleep InterlockedExchange LoadLibraryExW ExpandEnvironmentStringsW CreateProcessW WaitForSingleObject TerminateProcess GetExitCodeProcess SetLastError FindResourceW LoadResource LockResource SizeofResource WriteFile RemoveDirectoryW CreateDirectoryW FindFirstFileW DeleteFileW FindNextFileW FindClose CreateFileW GetFileInformationByHandle FileTimeToSystemTime CloseHandle FormatMessageW GetLocalTime OutputDebugStringW LoadLibraryW FreeLibrary lstrlenA WideCharToMultiByte GetWindowsDirectoryW LocalAlloc LocalFree VerSetConditionMask VerifyVersionInfoW GetLastError GetProcAddress GetModuleHandleW GlobalFree

advapi32

OpenSCManagerW ChangeServiceConfigW QueryServiceConfigW RegFlushKey RegSetValueExW RegCreateKeyExW RegQueryValueExW DeleteService OpenServiceW QueryServiceStatusEx CloseServiceHandle RegOpenKeyExW RegCloseKey

crypt32

CertGetCertificateContextProperty

wintrust

WTHelperProvDataFromStateData WTHelperGetProvSignerFromChain WTHelperGetProvCertFromChain WinVerifyTrust

shell32

CommandLineToArgvW

user32

IsCharAlphaW IsCharAlphaNumericW LoadStringW

ole32

CoTaskMemFree

$TEMP/TemporaryComodoProduct/bdisk.cat

SHA256 16c811a7a194cb65e74afdd9c9282586e964d565d44be43fbf3c5d1166278077
MD5 a18e113361ade2353324ebed495d2fd8
SHA1 8dc3f27ab2ac1d70056490c9d7914dec7102d35d
SHA512 4c59839d9a80587186badfc62781f157c0ddafdf9cc8852dae2c88a27fe6a06b5d5514a70555ac6764ff465ecedd33a0ada8eecce5fd7de7733e75e337506ba1
SSDEEP 96:UUGaj2mjm2h46oUMisY8LP4wEz7yMhtjv9cC4dLddSbTLTKb41ltNxg23rRa29xO:2ajpqfHix8iyMrj6938LWM1rg2syHmv
MD5 SHA1 SHA512 SSDEEP

$TEMP/TemporaryComodoProduct/bdisk.inf

SHA256 4ef4b60ac8137a8266b36ad40333a00e539058fa27d5295bf31f1cea1fd6cd19
MD5 158888c8c23f169366ea86afc641d51d
SHA1 26187fb3194b1cecc339c3a07d990adc713e3e1e
SHA512 d300fc182707cf3930304361f9672d00412512b223becfda46c73f4e34cdee03de0286f0bc59d0034de6740caad9689bb4b4d1d314aa38797e0a4979c883da63
MD5 SHA1 SHA512

$TEMP/TemporaryComodoProduct/bdisk.sys

IMPHASH ad498c1dcd1b39acbfab19f91e4648a2
SHA256 f88d9deb62a239e4b73034606779dc7b2c9b09eee61cbe40cf6c39a67dbc3086
MD5 bb00d8cb8a0bf6a191bdbfaec921b0a4
SHA1 2b6b7f1baeff69edfc1d8193cfe5a7201d528f32
SHA512 02981559b816b07e19eefad93eadd7bd5bca2db04a84a07f83b9a74c91baa8d30f888c5f1fa20705a559f7f1fc4ae8bd68f6571a546bf657c96ab15431e39bff
SSDEEP 1536:ByMnrjzzVDgMmgJ9fV8S+wvaLBvFPnToIfEPIOr5Wrd+:ByMnXzzFgxAV8RMaNvFfTBfEBr3
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

b4:ab:e1:4d:0c:a3:b7:97:66:82:6f:ed:33:5e:b7:7a:82:c0:28:80

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

33:00:00:00:36:7b:02:ea:cd:06:50:7a:73:00:00:00:00:00:36

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 15, 2013 - Aug 15, 2023

Minor OS version

1

Major OS version

6

Entry point

67646

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\users\emanu_000\desktop\setupcheckout\bin\BDisk\fre_wxp_x86\i386\BDisk.pdb

Name

.text

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

INIT

Size

1024B

Virtual Size

946B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

952B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$TEMP/TemporaryComodoProduct/cbreparse.cat

SHA256 7652c9e277b7227257ff8a62c395b89bccb0b3f3a1722bb093c03e8fd3a5f197
MD5 14e1c804ec3a7c1b90d757e34082fb30
SHA1 d3267c15a48ffc2f1d8a86d77d6378125a776f97
SHA512 a65e763c9ebe704478c8247ae282ec7169a8b4e19fbbf47747aa88793865bdc9172606e8e8e43e616f07dea92bc5ecec6bda2c83098e5798adf505c8351d9f93
SSDEEP 192:itBNqfHix8iyMrj6938LWM1rg2syHSl5y:iKCxMMC18KHy
MD5 SHA1 SHA512 SSDEEP

$TEMP/TemporaryComodoProduct/cbreparse.inf

SHA256 5c1d4f906d8bfc8a332e8b9e931cd3d4e3ea8bba0e342a76f255f63ecf8e85e6
MD5 f85e99f0b59eb9d5936efee8ed55d4eb
SHA1 fea41fcfc7c7a3aade3f761cd318b595f8f9e9cd
SHA512 540a73fd09a19d74ef5040e44dd1b63cedaa4c9aaa6e4b35f45d704251b4839d3a5333e0d7f46c95bb88d0c0646f92d26d02d7415cb1015684e5818af8cd9fc6
MD5 SHA1 SHA512

$TEMP/TemporaryComodoProduct/cbreparse.sys

IMPHASH ac0709eda76ae351a85b9cce7c00195a
SHA256 ab5c9250ab9741ba0b9b867838fa5381e8fd6f965d70a871f617f06b37c15088
MD5 54514292779318b9e43b6c848f795772
SHA1 5064355cf403959d56d5a3a2ecfb92efe32ad79c
SHA512 c7de99b1a0ffcbdbfe2a71e4657dc6635e347f9a0b483b942bc2b4b5aa4b39c0468aa13605500a9036d557841ab6de3b2aebad1410830b458a314924e5c8839f
SSDEEP 12288:d8VH13pLXfJiKS6Huh9v41y/vIQOaZTOuX0:e13pLXhb69vMopTO3
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

39:2f:2d:91:72:98:a5:e0:48:73:8c:ad:11:57:f0:e3:df:b9:40:c9

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

33:00:00:00:36:7b:02:ea:cd:06:50:7a:73:00:00:00:00:00:36

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 15, 2013 - Aug 15, 2023

Minor OS version

1

Major OS version

6

Entry point

546513

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\users\emanu_000\desktop\setupcheckout\bin\CBReparseMinifilter\fre_wxp_x86\i386\CBReparse.pdb

ntoskrnl.exe

CcPurgeCacheSection MmFlushImageSection CcFlushCache ExReleaseResourceLite ExAcquireResourceExclusiveLite DbgPrint ObfDereferenceObject _wcsicmp ZwClose KeReleaseMutex wcsrchr _allshl KeInitializeMutex wcsstr ZwOpenKey RtlInitUnicodeString ZwQueryValueKey ZwSetValueKey KeSetEvent PsTerminateSystemThread ObReferenceObjectByHandle IofCompleteRequest ZwReadFile ZwWriteFile ZwSetInformationFile ZwSetSecurityObject ZwQueryDirectoryFile ZwCreateFile ZwQueryVolumeInformationFile ZwQueryInformationFile ZwFsControlFile ZwDeviceIoControlFile MmMapLockedPagesSpecifyCache MmForceSectionClosed RtlUnicodeStringToInteger IoDeleteDevice IoDeleteSymbolicLink RtlSetDaclSecurityDescriptor IoCreateSymbolicLink IoCreateDevice KeTickCount KeBugCheckEx towupper _aullshr _aulldiv ZwQueryInformationThread KeNumberProcessors KeWaitForSingleObject ExSystemTimeToLocalTime KeQuerySystemTime _alldiv _allrem _aulldvrm _aullrem _allmul _alldvrm memcpy ExFreePoolWithTag memset ExAllocatePoolWithTag _vsnwprintf _vsnprintf PsCreateSystemThread KeInitializeEvent RtlUnwind

fltmgr.sys

FltStartFiltering FltBuildDefaultSecurityDescriptor FltCreateCommunicationPort FltFreeSecurityDescriptor FltAllocateContext FltSetInstanceContext FltGetVolumeProperties FltLockUserBuffer FltCreateFile FltClose FltParseFileNameInformation FltSendMessage FltGetFileNameInformation FltReleaseFileNameInformation FltGetInstanceContext FltReleaseContext FltCloseCommunicationPort FltUnregisterFilter FltCloseClientPort FltSetCallbackDataDirty FltRegisterFilter

Name

.text

Size

487KB

Virtual Size

487KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

960B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$TEMP/TemporaryComodoProduct/cbufs.cat

SHA256 1e306729eff8849f7e947ccaf5ed3f91526fa52c759a4f564faa7383a41d132b
MD5 192ddb85cd33aafa3b50a5b290d86e30
SHA1 df0f084dc46758956b6cda1903b5b52d899a04e8
SHA512 6012f8e360a6f74ed44ff29eb79ea9a39e2912b5fda943875b35836410d1da4e4ceccf2d69a562688fa304284006acbab90016d77deacae55071741337625371
SSDEEP 96:UInAQmjm2h46oUMisY8LP4wEz7yMhtjv9cC4dLddSbTLTKb41ltNxg23rRa29xh5:vnALqfHix8iyMrj6938LWM1rg2syHz+6
MD5 SHA1 SHA512 SSDEEP

$TEMP/TemporaryComodoProduct/cbufs.inf

SHA256 fcba17b6408b65e96f675760b9989ec83944894e2bb84ee76998f702b20812ab
MD5 0688dc38fec48977ae654fe4ec1beb57
SHA1 256a7dc73cf5f2e8ae36f3e19c3b448b7df6b3b9
SHA512 56174a131691ad72fc5aa99c399aa4afa589043df84a1ed8198d7cffce376ce89eb7996407e94d0c344d3570b9b05d456ddf54b7a40f137683f59f885c59ee7a
MD5 SHA1 SHA512

$TEMP/TemporaryComodoProduct/cbufs.sys

IMPHASH 065543bdec12c744289075522527863a
SHA256 16c9e2a1033dcb764eebfca5c14dd91593472f30d6f81cd46c38a3ff4a3ad90f
MD5 3569990d104cedd124e93c383dc8d58a
SHA1 f601bb4575ff73bfdbfb515af727040cb888623d
SHA512 2fd15a83f826205c40bbe3f92731f735ea97c43bef77550af03157ff4122e1f8da0dbbc09fe52cff8116302275ec21a24a1923d0fe66d713fe9208a19652812a
SSDEEP 6144:6zGS02ZUpxwabYgCDFcI5P/ykt2k2dDcai8v0axlFfTBcd0p4LML:6zGS0hpb7CDFcINfV9QTOd8rL
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

e4:39:28:17:2d:51:6a:66:00:e5:a2:70:72:08:8f:8b:64:cc:46:a3

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

33:00:00:00:36:7b:02:ea:cd:06:50:7a:73:00:00:00:00:00:36

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 15, 2013 - Aug 15, 2023

Minor OS version

1

Major OS version

6

Entry point

257686

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\users\emanu_000\desktop\setupcheckout\bin\CBUfs\fre_wxp_x86\i386\CBUFS.pdb

ntoskrnl.exe

memset ExFreePoolWithTag memcpy _allmul wcsstr _aullrem _aulldvrm _allrem _alldiv ExSystemTimeToLocalTime KeQuerySystemTime KeWaitForSingleObject KeNumberProcessors ZwQueryInformationThread _aullshr towupper MmGetSystemRoutineAddress RtlInitUnicodeString PsGetVersion IofCallDriver KeReleaseMutex KeSetEvent ExQueueWorkItem IoAttachDeviceToDeviceStack KeDelayExecutionThread ObfDereferenceObject ObfReferenceObject IoBuildDeviceIoControlRequest RtlEqualUnicodeString ObQueryNameString wcschr ZwClose ZwQueryInformationFile IoCreateFileSpecifyDeviceObjectHint DbgPrint ExAllocatePoolWithTag KeTickCount _aulldiv IofCompleteRequest IoDeleteDevice IoDetachDevice MmMapLockedPagesSpecifyCache _allshl KeInitializeMutex IoCreateDevice PsTerminateSystemThread ObReferenceObjectByHandle PsCreateSystemThread ZwCreateFile ZwReadFile ZwWriteFile ZwSetInformationFile ZwQueryDirectoryFile ZwFsControlFile ZwDeviceIoControlFile IoGetDeviceObjectPointer _itow RtlCompareUnicodeString ZwSetSecurityObject ZwSetValueKey ZwOpenKey ExDeletePagedLookasideList IoUnregisterFsRegistrationChange KeSetPriorityThread KeGetCurrentThread ZwQueryValueKey _wcsicmp wcsrchr IoRegisterFsRegistrationChange ExInitializePagedLookasideList KeBugCheckEx _vsnprintf _vsnwprintf KeQueryTimeIncrement KeInitializeEvent IoFreeIrp RtlVolumeDeviceToDosName RtlCopyUnicodeString ExAllocateFromPagedLookasideList ExFreeToPagedLookasideList IoAllocateIrp RtlAppendUnicodeStringToString IoGetTopLevelIrp RtlAppendUnicodeToString RtlUnwind

hal

ExReleaseFastMutex KeGetCurrentIrql ExAcquireFastMutex

Name

.text

Size

187KB

Virtual Size

187KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

960B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$TEMP/TemporaryComodoProduct/cbunat.exe

IMPHASH ea744cf53a95a397109eab452cdf26d7
SHA256 e30d6b95132b0ddd8065b450179979bb6291327f981d5cd1749ec7ed2e56bffd
MD5 5f94a29a23b104f8d3360aff46009d55
SHA1 1ae996e7a006fae2d9420cc3acc44d7031db3497
SHA512 83e6e1f5c0a10ee16bab15aac89d73a9363cb051ca1b6e763e559a4c921e9202c974f62531e6ca81a77cf6940a3e438ca92b2aa98e7b6343cf605dcbad9da917
SSDEEP 12288:nTOFWHz+QN1JpbMKv24GYWnjfrXBFfas/7EP8ODXT0SuXq7W:nTOGztJpbMLYsfysqXlW
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

95:6e:4b:fe:ec:5d:6f:a2:b1:35:95:b1:25:5e:23:d0:c6:89:1c:b5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Minor OS version

1

Major OS version

6

Entry point

793763

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\users\emanu_000\desktop\setupcheckout\bin\Native\fre_wxp_x86\i386\cbunat.pdb

$TEMP/TemporaryComodoProduct/cbvd.cat

SHA256 82c4f57b23140304014e32c24ceecebc9d9d947eca3cc8124457f644314aaaaa
MD5 3b455ee229a5def37ba735f45a893d17
SHA1 4538d31cbe86df2ec85e8489d8c90eed4777989c
SHA512 d6c4920a1aefd606839424d56b33767c498a8ce4c402c8fb8fd4d0f9cf6322a436d388ddd4d618ef8a1c66c53606549a7f49547c577c3e0e24fa9b11c5096384
SSDEEP 192:7Uy2TqfHix8iyMrj6938LWM1rg2syHbySob:oSCxMMC18zg
MD5 SHA1 SHA512 SSDEEP

$TEMP/TemporaryComodoProduct/cbvd.inf

SHA256 09651b4999386493d0e2c57416c1385f9233b1215ae33189eda02ea9acbab12d
MD5 1527990aa7923fbac63da446497299bb
SHA1 80b0a7549a3551b0df6f7a27a63eb1ff448ca77e
SHA512 04f306484df7d330a152cb646fec5b15d8d184a73e1c50a167c412fd5ed42d982537c5e9dcdb7fb21c7902e71910c9d2e28c7a391145da4c0a3df12824509027
MD5 SHA1 SHA512

$TEMP/TemporaryComodoProduct/cbvd.sys

IMPHASH 616d4b8192d81b00e2e64feeb2946ba0
SHA256 419bcaa2dae458a254425047e4467179888d2c554a873e4ab03da327bf79051e
MD5 28ce29f34e3260abd14ea9a0e6231bb3
SHA1 65ff1d0dce46cbf39b5d548c4319614408a8f470
SHA512 3fd73d416d00661fd2c8c691bd07388dd6c8c43279a57336e528b88ec91c454661083f8adcae85145ca41d49a9d9ba1fda118c1d610ef411d5f956c1850df85f
SSDEEP 12288:8Iaxonp8+5kaD95hxt+P9oJdifQS2c7LtdGw9JUxP2moRfTONk97pXm:/Fnp8+5k+7Y9oJdifQS2c7LtdGtUTOIY
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

bb:5e:50:3e:fd:da:fb:b5:36:56:f6:6d:55:85:99:03:9a:e6:d6:24

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

33:00:00:00:36:7b:02:ea:cd:06:50:7a:73:00:00:00:00:00:36

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 15, 2013 - Aug 15, 2023

Minor OS version

1

Major OS version

6

Entry point

545303

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\users\emanu_000\desktop\setupcheckout\bin\VirtualDisk\fre_wxp_x86\i386\CBVD.pdb

Name

.text

Size

486KB

Virtual Size

486KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

912B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$TEMP/TemporaryComodoProduct/cos-core-lib.dll

IMPHASH 94966ee85e39c9188e96726151ee749d
SHA256 dea3cca3dcfb246479c03162ebd30e87ea147633d81e0438b084355313a31c41
MD5 d2d1524714bfef21cb4ee20ea5660870
SHA1 27ff0074b27683b071459a7577c8381509621d77
SHA512 cfee50eb62e5480b18d0a6f2fc1de489f5fa14371560e27c38ff9e66278cf9b43731bd432ae96e0e6232537a856cacc88c548680a9b955b9d58451687d8c686a
SSDEEP 24576:VBWjyb9n5lPmm6mNlQE/GRKTO0uTOuTObTOFTOqTOpoYNj:zN6C/GUTFuTvTmTwTrTOoYNj
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

bc:3c:d3:4b:69:e3:52:4f:cf:00:84:e5:d7:4c:60:1a:bb:e4:1e:08

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Minor OS version

0

Major OS version

5

Entry point

752348

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\emanu_000\Desktop\SetupCheckout\BIN\Win32\Release\cos-core-lib.pdb

winhttp

WinHttpCrackUrl WinHttpOpen WinHttpSetTimeouts WinHttpConnect WinHttpCloseHandle WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpReadData

kernel32

CreateMutexW HeapFree GetProcessHeap HeapAlloc GetCurrentThreadId GetEnvironmentVariableW CreateFileW GetSystemInfo CloseHandle GetProcAddress GetModuleHandleW SetFilePointerEx ReadFile CreateThread OpenEventW CreateEventW SetEvent WriteFile GetFileSizeEx SetEndOfFile SetFilePointer OpenMutexW GetFileAttributesW SetFileAttributesW FindNextFileW FindClose FindFirstFileW CreateDirectoryW CreateSemaphoreW ResetEvent GetSystemTime Sleep ReleaseSemaphore FileTimeToSystemTime SystemTimeToFileTime WideCharToMultiByte MultiByteToWideChar InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetModuleFileNameW GetLastError WaitForSingleObject ReleaseMutex GetLocalTime OutputDebugStringA WriteConsoleA GetConsoleOutputCP SetStdHandle CreateFileA GetCurrentProcess GetLocaleInfoA RtlUnwind RaiseException TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent WriteConsoleW GetFileType GetStdHandle GetCommandLineA VirtualFree VirtualAlloc HeapReAlloc HeapCreate HeapDestroy ExitProcess GetModuleFileNameA GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError LoadLibraryW SetHandleCount GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetConsoleCP GetConsoleMode FlushFileBuffers GetModuleHandleA HeapSize InitializeCriticalSectionAndSpinCount LoadLibraryA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

advapi32

RegOpenKeyW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken SetKernelObjectSecurity InitializeSecurityDescriptor AllocateAndInitializeSid GetLengthSid InitializeAcl AddAccessAllowedAce SetSecurityDescriptorDacl FreeSid RegQueryValueExW RegCloseKey RegOpenKeyExW RegCreateKeyExW RegSetValueExW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

cos_accept_request cos_add_user_to_group cos_advanced_search cos_cancel_request cos_clean_file_versions cos_cleanup cos_close_file cos_close_file_ex cos_commit_file_version cos_confirm_install cos_copy_files cos_create_group cos_decline_request cos_delete_from_addressbook cos_delete_from_employees cos_delete_groups cos_encrypt_password cos_encrypt_password_wchar cos_end_of_file cos_free cos_get_MD5_table cos_get_all_attributes cos_get_attribute_names cos_get_attributes cos_get_bandwidth cos_get_disk_stat cos_get_drive_state_for_session cos_get_everyone_with_share_on_file_and_possible_targets cos_get_expiration_date cos_get_file_dates cos_get_file_encryption_data cos_get_file_size cos_get_incoming_requests cos_get_last_change_date cos_get_library_version cos_get_local_account_state cos_get_network_speeds cos_get_new_session_for_loggedin_user cos_get_offset_file cos_get_outgoing_requests cos_get_owned_groups cos_get_owned_groups_relative_to_user cos_get_proxy cos_get_referral_bonus cos_get_registration_date cos_get_server_version cos_get_session_by_id cos_get_session_by_username cos_get_sessions_and_usernames cos_get_sessions_with_mounted_drive cos_get_user_information cos_import_to_addressbook cos_import_to_employees cos_init cos_json_add_group_member cos_json_create_group cos_json_delete_group cos_json_download_proxy_addtask cos_json_download_proxy_deltask cos_json_download_proxy_status cos_json_download_proxy_taskslist cos_json_get_groups cos_json_keepalive cos_json_list_group_members cos_json_list_public_shares cos_json_login cos_json_logout cos_json_public_share cos_json_public_unshare cos_json_remove_group_member cos_json_request cos_json_share_user_resource cos_json_unshare_user_resource cos_leave_share cos_list cos_list_addressbook cos_list_employees cos_list_file_versions cos_list_owned_groups cos_list_users_from_group cos_login cos_login_ns cos_logout cos_make_directory cos_manage_user_groups cos_move cos_move_by_handle cos_move_files cos_notify_install cos_notify_uninstall cos_open_file cos_open_file_version cos_path_is_directory cos_ping_server cos_query_files cos_read_file cos_read_file_with_offset cos_relogin cos_remove cos_remove_file_version cos_remove_files cos_remove_users_from_group cos_rename_group cos_search cos_seek_file cos_set_account_state cos_set_attributes cos_set_bandwidth cos_set_drive_state_for_session cos_set_end_of_file cos_set_file_dates cos_set_log_level cos_set_proxy cos_unshare_file cos_update_shares cos_write_file cos_write_file_with_offset

$TEMP/TemporaryComodoProduct/vdbus.cat

SHA256 fb78d1c918c9bb8cb154f37b05223afa847caf2fca2a6db9a952d6ff99ee4184
MD5 94a8701a81cbfb6048341c48a4a038f6
SHA1 88df72f91c5ed155bd374bf0ef85e64964f2c16f
SHA512 c4ef3e85850d2772f9c5bba9cd246c614e17007176371f6a1b58f3619c83619774d84da8c120ed3a5ff96838a33143feae6ff060989aedcf05e7168cc57eda94
SSDEEP 192:284e3eLv+fHix8iyMrj6938LWM1rg2syHQb1sM:9/CxMMC18xM
MD5 SHA1 SHA512 SSDEEP

$TEMP/TemporaryComodoProduct/vdbus.inf

SHA256 cc453a541eebb34e2cbbb5753802d991d35e5ca5526aa7fd2db5de5746654e38
MD5 56cdc11bcc86ff6022a153b0f2900b26
SHA1 f28ab0ce8269d781cb7eac4b40e0a4e93a8f4f7f
SHA512 9f3139770e394d63dd22006c9567f953159239f289d66972ecf39be296f37825605dbbc5fad200a663d6e570f257959cd062a1121a756216a4063c80c829ae52
MD5 SHA1 SHA512

$TEMP/TemporaryComodoProduct/vdbus.sys

IMPHASH cf3f4b9a6409d28185b9a128e9ee5678
SHA256 04511d6045811968ce8a4141e13f63151c440fe63ae924aec9152ad3ff64834f
MD5 28a9058838b27f1d944f803ff8987f23
SHA1 2532da2cfc7f514ec3a4cf66641fd6f8a0e27b00
SHA512 a27544e56d47cdac73993afaaf85f02ec27cef11c54b1ea0f82e6cffc7d9a1975425c925b6b76fc289fe7c99bf8a18e0c0f190011287efa226880826f9ac9a50
SSDEEP 12288:hTDgdpQWpIcdZqA+K1+tHsX49Q12IkZIEt4nKFkdzR8sTOHMTOm8TOY8TO83:edpQwncg1bX4q12IkZIEt4nKFkdzRTOq
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

e9:09:7f:d8:c2:79:22:aa:9e:a6:e3:de:10:a0:e1:5f:ed:7b:3b:93

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

33:00:00:00:36:7b:02:ea:cd:06:50:7a:73:00:00:00:00:00:36

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 15, 2013 - Aug 15, 2023

Minor OS version

1

Major OS version

6

Entry point

460372

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\users\emanu_000\desktop\setupcheckout\bin\VirtualDiskBus\fre_wxp_x86\i386\vdbus.pdb

Name

.text

Size

512KB

Virtual Size

512KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

150KB

Virtual Size

150KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

INIT

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

976B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$TEMP/TemporaryComodoProduct/version.ini

SHA256 1dc5d9529ad2e7ab9ea336c7a87a9ca14196bfd31475a5dca8b5aadd926d2ed3
MD5 11d6bd34cbd385ee39c0ce0dd71440cb
SHA1 e9e8f6d3e237354278650910a96e82832bba83bd
SHA512 52f4de987023fce4764c3d5f2efa42862771dde80826b7d8edc62e502eef295ca26babb2c26c529951758e748b7e3fb466bc15f446a5084824ba6898d2ef17ea
SSDEEP 192:AYbkVq0u7m4qlqGmY8DanZ+FhntjCIyhU7mk:A/U0UsLGanZijCIyhs
MD5 SHA1 SHA512 SSDEEP

CBDrvSys.exe

IMPHASH 06694565e94cd10f48e1e4b90bc04bc2
SHA256 f73d7716d252cb33b6c2e036221d68f661426ef02cbf6d8da739f3432a016eb2
MD5 de8112cae8237646b783ee9db76a342d
SHA1 b0171d4e0ccf3effd6bf3886944931dce2fb00c3
SHA512 cc9e2b923ca48097fa1a5bc1427420f66dba8ada89dcb361318b7114a81ca66ec27e44762113c03ef5e1a8531115ef720ce089751f9f17d6a8bbed86e523b383
SSDEEP 768:CMhT5+KybRpnE8K74kca7NeAylubhkt4U2BZB82BSOe9oKSJ2SLD0BEZWkZQ:Ce+KY04RMxylGkt4ZF4O7WL
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

25748

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\cb\trunk\current\test\emanuelsescu\devcon\objfre_wxp_x86\i386\devcon.pdb

advapi32

InitiateSystemShutdownExW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegQueryValueExW RegCloseKey RegDeleteValueW RegSetValueExW CloseServiceHandle OpenServiceW OpenSCManagerW

kernel32

LocalFree FormatMessageW CloseHandle GetCurrentProcess GetLastError lstrlenW GetDateFormatW FileTimeToSystemTime FreeLibrary GetProcAddress LoadLibraryW GetFileAttributesW GetFullPathNameW FindClose FindNextFileW FindFirstFileW GetWindowsDirectoryW UnhandledExceptionFilter TerminateProcess GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter GetModuleHandleA SetUnhandledExceptionFilter InterlockedCompareExchange Sleep InterlockedExchange

msvcrt

fputws fputs __iob_func ??3@YAXPAX@Z memset _controlfp ?terminate@@YAXXZ __set_app_type __p__fmode __p__commode __setusermatherr _amsg_exit _initterm exit _XcptFilter _exit _cexit __wgetmainargs wprintf wcsrchr _wcsicmp _wcsnicmp iswalpha towupper towlower wcschr ??2@YAPAXI@Z

ntdll

RtlUnwind

ole32

CLSIDFromString

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo CM_Get_Device_ID_ExW SetupDiGetDeviceInfoListDetailW SetupDiGetINFClassW SetupDiCreateDeviceInfoList SetupDiCreateDeviceInfoW SetupDiBuildClassInfoListExW SetupDiClassNameFromGuidExW SetupCopyOEMInfW SetupDiSetDeviceRegistryPropertyW CM_Connect_MachineW CM_Locate_DevNode_ExW CM_Reenumerate_DevNode_Ex CM_Disconnect_Machine SetupDiSetClassInstallParamsW SetupOpenInfFileW SetupFindFirstLineW SetupGetStringFieldW SetupDiGetClassDescriptionExW SetupCloseInfFile SetupDiOpenClassRegKeyExW SetupDiGetDriverInstallParamsW SetupDiSetSelectedDriverW SetupOpenFileQueue SetupDiCallClassInstaller SetupScanFileQueueW SetupCloseFileQueue SetupDiGetDeviceInstallParamsW SetupDiSetDeviceInstallParamsW SetupDiBuildDriverInfoList SetupDiEnumDriverInfoW SetupDiOpenDevRegKey SetupDiGetDriverInfoDetailW SetupDiDestroyDriverInfoList CM_Get_First_Log_Conf_Ex CM_Free_Log_Conf_Handle CM_Get_Next_Res_Des_Ex CM_Free_Res_Des_Handle CM_Get_Res_Des_Data_Size_Ex CM_Get_Res_Des_Data_Ex CM_Get_DevNode_Status_Ex SetupDiClassGuidsFromNameExW SetupDiCreateDeviceInfoListExW SetupDiGetClassDevsExW SetupDiOpenDeviceInfoW SetupDiGetDeviceRegistryPropertyW

user32

LoadStringW CharNextW CharPrevW

cacert.pem

SHA256 e1cf37e6595a9c19543082ceba71df63fc9da0298cbb6476d088efd14738087e
MD5 324371bf8fba00ebe5328d8c850f55b0
SHA1 9715f0492b6bb9e210afe9c7b557f26fa01e8026
SHA512 ff2dc47bb9b1d964d12badda456d2d9d7bbee3fe269f234654fb47cb2967ddaff8c164802005ccad87c56906251219d58c75b8218677118b43aeeacdf811ce6c
MD5 SHA1 SHA512

cakey.pem

SHA256 4e0ba4d59d8406eadc3ff788e04e00c2dc9a7cb016e338ec57a55aec40b792cd
MD5 0397a7cb737beb364b5cfd86c17c3a75
SHA1 f9e2c932980077ecef7cb02f5dbbbdb3bd69c283
SHA512 c846b26e94f9aa199c4779e4409e4f24c9c1442e897ca2b076401f55514318d0d34511e62ab9b65c736fbdab91c1fd2bfdf7659939f6f9105efdedfb7cdbb1f5
MD5 SHA1 SHA512

crosscer.cer

SHA256 81c9977e201e163ff225d216e6aafc2cb9169a2a1a52d1b07cdd2143c2ac1be1
MD5 f8c26a142ec0b711608fa52eed26d630
SHA1 e73c45be88c6fbe7562d8b9d1b7e4fe03e29811d
SHA512 4791c0f03085391f13a73b60ab375b00888f16adeb07560cbdab3bf04cb93ef4889509a7921b504b9b41b438a6e8b7fd7dc98b675fe776e7bb9be94ca106749a
MD5 SHA1 SHA512

lpslib.dll

IMPHASH dffeb55675037ef26f53f4261af8038b
SHA256 88686cbbcf1d1af120e8217699fca32c875ffa8000bcfc98f0d505d37132a5ae
MD5 8d76fcc96befd056ee7b9ce884fb08d5
SHA1 27dda2c8f5ea1586d6207afb6e8c6a5a2126cf61
SHA512 69c5ecd8a05239d4e0ebfc4200e1b736d6e13a1429e187b64ecc618d88ed873cde1e5e46e26fc57246e6e435431aad0d059bbdb72c1236b80464109ebec1e960
SSDEEP 24576:HEWS1/wuXdtxURyQ10UvKpt/Ty3TynTybTyVTyC9RqsoKa:kWS1YutTIylxphT+TqTuTwTV9IsoKa
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

ee:b2:b1:ff:81:0a:f3:9e:6a:12:b7:a7:ed:cf:b7:a5:6d:fa:52:9b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Chains

Oct 7, 2014

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Serial Number

39:f5:1f:f0:58:83:bd:41:16:16:bf:a6:2c:1c:74:ef

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2014 - Apr 1, 2015

Minor OS version

0

Major OS version

5

Entry point

462567

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\Projects\ComodoSupportDesk\2.1\src\lps-client\bin\Win32\Release\lpslib.pdb

ws2_32

select __WSAFDIsSet getsockopt ioctlsocket connect inet_ntoa WSAStartup getaddrinfo WSAGetLastError htons shutdown setsockopt WSACleanup recv socket freeaddrinfo WSASetLastError closesocket send

kernel32

CreateFileA SetEvent CreateEventW WaitForMultipleObjects CloseHandle TryEnterCriticalSection WaitForSingleObject InitializeCriticalSection LeaveCriticalSection EnterCriticalSection ResetEvent DeleteCriticalSection CreateThread SetLastError GetLastError GetCurrentThreadId GetVersion GetStdHandle FindFirstFileA FindClose GetTickCount QueryPerformanceCounter GetCurrentProcessId GlobalMemoryStatus FreeLibrary GetProcAddress LoadLibraryA GetVersionExA FlushConsoleInputBuffer GetCurrentDirectoryA GetFullPathNameA SetStdHandle GetTimeZoneInformation GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW InitializeCriticalSectionAndSpinCount WriteConsoleA GetConsoleOutputCP GetLocaleInfoW WriteConsoleW CompareStringA CompareStringW SetEnvironmentVariableA CreateFileW SetEndOfFile GetFileType HeapAlloc InterlockedIncrement InterlockedDecrement Sleep HeapFree GetProcessHeap TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapReAlloc GetCommandLineA GetSystemTimeAsFileTime FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeA SetConsoleCtrlHandler ReadConsoleInputA SetConsoleMode GetConsoleMode RaiseException RtlUnwind MultiByteToWideChar LCMapStringA WideCharToMultiByte LCMapStringW GetCPInfo HeapCreate HeapDestroy VirtualFree VirtualAlloc GetModuleHandleW ExitProcess WriteFile GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree HeapSize SetHandleCount GetStartupInfoA ReadFile GetConsoleCP FlushFileBuffers SetFilePointer FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleHandleA GetACP GetOEMCP IsValidCodePage

user32

MessageBoxA GetDesktopWindow GetProcessWindowStation GetUserObjectInformationW

advapi32

ReportEventA DeregisterEventSource RegCloseKey RegOpenKeyExW RegQueryValueExW RegisterEventSourceA

Sharing

General

Malware Config

Signatures

File Explorer

CB_setup.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/Banner.dll

kernel32

user32

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/MyLangDLLS3.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/MyLangDLLT3.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/NSIS_SkinCrafter_Plugin.dll

kernel32

user32

generic

$PLUGINSDIR/Plugin.dll

PE Signature issue

version

kernel32

user32

advapi32

ole32

shell32

oleaut32

shlwapi

setupapi

mpr

winhttp

wininet

urlmon

wtsapi32

userenv

crypt32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/cService.dll

kernel32

user32

advapi32

generic

$PLUGINSDIR/inetc.dll

wininet

comctl32

kernel32

user32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp