Norton Suite Executables[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
Norton Suite Executables.zip
Size 43.2MB
Sample260420-apxdcset4p
SHA256 61deaeefcb24a9610fd41d23359ef6957f7b767f8d9d7181bab07225425cb55c
MD5 71a20d46a98e15ac9e6567b83bf596d7
SHA1 fba4267ae91490b635f9b8a69f37c4e3254349fb
SHA512 70f81fea09d552ff9200f3a12a08b92b4679adc3ed0b23dcafbae1b4fb36fa53df747388a32c27288a50a8160e60e02a949f7f7040e7bc8d2d729f0f6f6a6f74
SSDEEP 786432:U3MexQhwHF2Kx6l+gM44n+tLwDz91famG7Nf0veJNmtT7Mo+od1TjthWR9cWhIRQ:VLqxEM4A+tLwLfam+56eJNq/TBVpwh+Q
TLSH
T128A733B4F36C9ED8C363523DEA996F2BE7C9DC244589F36B1C99D522C0856184E0B3B4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Norton Suite Executables.zip

.zip 43.2MB
AvBugReport.exe

.exe 6.2MB
AvConsent.exe

.exe 646KB
AvDump.exe

.exe 3.8MB
AvEmUpdate.exe

.exe 5.5MB
AvLaunch.exe

.exe 995KB
NortonSvc.exe

.exe 1016KB
NortonUI.exe

.exe 21.5MB
OobeUtil.exe

.exe 1.3MB
RegSvr.exe

.exe 4.3MB
SetupInf.exe

.exe 4.4MB
SupportTool.exe

.exe 11.8MB
VisthAux.exe

.exe 529KB
VpnSvc.exe

.exe 14.3MB
afwServ.exe

.exe 2.6MB
ashCmd.exe

.exe 755KB
ashQuick.exe

.exe 551KB
ashUpd.exe

.exe 699KB
aswAvBootTimeScanShMin.exe

.exe 1.3MB
aswChLic.exe

.exe 328KB
aswEngSrv.exe

.exe 648KB
aswRunDll.exe

.exe 4.4MB
aswidsagent.exe

.exe 7.8MB
devcon.exe

.exe 498KB
firefox_pass.exe

.exe 538KB
nllToolsSvc.exe

.exe 1.0MB
overseer.exe

.exe 3.2MB
sched.exe

.exe 517KB
su_worker.exe

.exe 4.9MB
wa_3rd_party_host_32.exe

.exe 2.3MB
wa_3rd_party_host_64.exe

.exe 2.9MB
wsc_proxy.exe

.exe 74KB

Norton Suite Executables.zip

SHA256 61deaeefcb24a9610fd41d23359ef6957f7b767f8d9d7181bab07225425cb55c
MD5 71a20d46a98e15ac9e6567b83bf596d7
SHA1 fba4267ae91490b635f9b8a69f37c4e3254349fb
SHA512 70f81fea09d552ff9200f3a12a08b92b4679adc3ed0b23dcafbae1b4fb36fa53df747388a32c27288a50a8160e60e02a949f7f7040e7bc8d2d729f0f6f6a6f74
SSDEEP 786432:U3MexQhwHF2Kx6l+gM44n+tLwDz91famG7Nf0veJNmtT7Mo+od1TjthWR9cWhIRQ:VLqxEM4A+tLwLfam+56eJNq/TBVpwh+Q
TLSH
T128A733B4F36C9ED8C363523DEA996F2BE7C9DC244589F36B1C99D522C0856184E0B3B4
MD5 SHA1 SHA512 SSDEEP TLSH

AvBugReport.exe

IMPHASH 5b2aa052d92d834acecd9fbe5df40bb9
SHA256 2b149f11ec969ce162463fc2991a1e18be3f2059efa3ff733b91a06e586e708a
MD5 8ba000cc7232c7b4cc707b49e75a2d3a
SHA1 3496dcd5615ae1a171e2ee83d66d3a88b9eec874
SHA512 bb45e13ed9a5a50e19ce4efbf30e48600e82661f3543329593483f364ba8a84e3a628c1f6f698dfa5aae7704440bcc0f1aa91e048a7380f6d2476f334e60e799
SSDEEP 98304:OcvpcloFoJ6EtRZpnugpmgK2re6rUE13:OcaS6xRZpnugpmgK2re6rn
TLSH
T1F8666C1EBA6E00E9C1BFE1788A47950BEAB17855033597DB66E18E550F13AF09F3E700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

33:23:a3:16:09:c4:69:d6:4a:d3:be:c5:a7:84:fd:44:e2:70:78:bf:f5:d7:54:ec:b8:ce:7e:87:09:6f:5c:6f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Chains

Apr 10, 2026

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Serial Number

40:1c:57:14:6d:ce:58:df:b9:22:21:87:8d:2a:a5:63

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2025 - Jun 10, 2028

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

1893280

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\AvBugReport.pdb

winhttp

WinHttpSetCredentials WinHttpSendRequest WinHttpWriteData WinHttpQueryOption WinHttpAddRequestHeaders WinHttpSetStatusCallback WinHttpCloseHandle WinHttpReceiveResponse WinHttpQueryHeaders WinHttpQueryDataAvailable WinHttpReadData WinHttpOpenRequest WinHttpSetTimeouts WinHttpConnect WinHttpCrackUrl WinHttpGetDefaultProxyConfiguration WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpOpen WinHttpSetOption

bcrypt

BCryptFinalizeKeyPair BCryptGenerateKeyPair BCryptDeriveKey BCryptSetProperty BCryptExportKey BCryptDestroySecret BCryptDestroyKey BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptEncrypt BCryptGenRandom BCryptSecretAgreement BCryptImportKeyPair

rpcrt4

NdrClientCall3 RpcBindingFree RpcStringFreeW RpcBindingFromStringBindingW RpcStringBindingComposeW RpcAsyncInitializeHandle UuidCreate Ndr64AsyncServerCallAll RpcAsyncCancelCall RpcBindingToStringBindingW RpcEpUnregister RpcStringBindingParseW RpcServerUseProtseqEpW RpcObjectSetType RpcServerRegisterIf2 RpcServerUnregisterIfEx RpcImpersonateClient RpcRevertToSelf I_RpcBindingInqLocalClientPID RpcMgmtEpEltInqNextW RpcMgmtEpEltInqBegin RpcIfInqId RpcMgmtEpEltInqDone UuidToStringW UuidFromStringW Ndr64AsyncClientCall NdrServerCallAll NdrServerCall2 NdrAsyncServerCall RpcEpRegisterW RpcAsyncCompleteCall

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW WTSQueryUserToken WTSQuerySessionInformationW

shell32

SHGetKnownFolderPath ord165

ntdll

NtSystemDebugControl RtlLookupFunctionEntry RtlVirtualUnwind NtClose NtCreateWorkerFactory NtQueryInformationProcess NtQuerySystemInformation NtQueryInformationWorkerFactory RtlNtStatusToDosError VerSetConditionMask NtOpenKey NtQueryKey NtDeleteKey RtlCaptureContext RtlDllShutdownInProgress NtSetInformationThread RtlPcToFileHeader RtlUnwindEx RtlUnwind

kernel32

GetProcessHandleCount CreateIoCompletionPort DeviceIoControl ReadProcessMemory TerminateProcess TlsFree TlsAlloc TlsSetValue TlsGetValue SetLastError GetNativeSystemInfo DuplicateHandle GetSystemTimes GetProcessTimes GetFileTime ExpandEnvironmentStringsA GetVersionExW LoadLibraryExW GetOverlappedResult PostQueuedCompletionStatus GetQueuedCompletionStatus WriteFile ReadFile CancelIoEx WaitForMultipleObjects GetTickCount64 VirtualAlloc WerRegisterMemoryBlock WerUnregisterMemoryBlock VirtualFree QueryPerformanceCounter QueryPerformanceFrequency InitOnceExecuteOnce AcquireSRWLockExclusive ReleaseSRWLockExclusive UnmapViewOfFile UnlockFile CreateFileA CreateFileMappingW MapViewOfFile LockFileEx InitializeCriticalSectionEx HeapSize HeapReAlloc DecodePointer HeapDestroy CompareFileTime SetFilePointerEx UnlockFileEx GetFileSizeEx QueryUnbiasedInterruptTime UnregisterWaitEx ReadDirectoryChangesW ProcessIdToSessionId GetFileAttributesExW GetLocaleInfoW ResumeThread ResetEvent GetCurrentThread LocalFree TerminateThread SetThreadPriority InitializeCriticalSectionAndSpinCount QueryThreadCycleTime GetCurrentDirectoryW FindNextFileW WTSGetActiveConsoleSessionId DeleteProcThreadAttributeList K32GetProcessImageFileNameW GetThreadId CreatePipe SetHandleInformation LocalAlloc FlushFileBuffers GetFileInformationByHandle GetFullPathNameW OutputDebugStringA FileTimeToSystemTime GetModuleFileNameW OutputDebugStringW GetSystemInfo ExpandEnvironmentStringsW GetShortPathNameW GetSystemWindowsDirectoryW GetProcessAffinityMask GetLongPathNameW GlobalMemoryStatusEx GetDateFormatW GetTimeFormatW GetExitCodeThread GetDriveTypeW SetFilePointer SetFileAttributesW GetFileSize SetEndOfFile MoveFileExW GetWindowsDirectoryW CreateDirectoryW FindFirstFileExW QueryDosDeviceW GetVolumePathNameW GetVolumeNameForVolumeMountPointW GetVersion SizeofResource LockResource LoadResource FindResourceExW FindResourceW Process32NextW CopyFileW SetFileInformationByHandle GetDiskFreeSpaceExW K32GetMappedFileNameW FindFirstVolumeW FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolWait WaitForThreadpoolWaitCallbacks SystemTimeToFileTime GetSystemTime GetCommandLineW GetCommandLineA GetStdHandle GetConsoleOutputCP ReadConsoleW GetConsoleMode SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType FreeLibraryAndExitThread ExitThread InterlockedPushEntrySList GetStartupInfoW UnhandledExceptionFilter InitializeSListHead GetCPInfo CompareStringEx FindClose GetSystemTimeAsFileTime UpdateProcThreadAttribute InitializeProcThreadAttributeList DeleteFileW CreateFileW FindFirstFileW VerifyVersionInfoW GetExitCodeProcess CreateProcessW GetFileAttributesW FreeLibrary LoadLibraryW GetSystemDirectoryW DeleteCriticalSection InitializeCriticalSection CreateThread LCMapStringEx SetEnvironmentVariableW GetEnvironmentVariableW GetCurrentProcess GetProcessId GetCurrentProcessId DebugBreak FormatMessageW GetCurrentThreadId GetModuleHandleExW GetModuleFileNameA GlobalFree GetProcessHeap HeapAlloc HeapFree EnterCriticalSection LeaveCriticalSection CompareStringW SetErrorMode MultiByteToWideChar SetDllDirectoryW CloseHandle ReleaseMutex WaitForSingleObject GetLastError CreateMutexW GetModuleHandleW GetProcAddress WideCharToMultiByte ExitProcess SetStdHandle FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage Process32FirstW CreateToolhelp32Snapshot GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW GetTimeZoneInformation HeapQueryInformation WriteConsoleW RegisterWaitForSingleObject K32GetProcessMemoryInfo GetThreadTimes OpenProcess EncodePointer WakeConditionVariable IsProcessorFeaturePresent SetFileCompletionNotificationModes CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns TryAcquireSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockShared SleepConditionVariableSRW WakeAllConditionVariable GetLocaleInfoEx WaitForSingleObjectEx GetFileInformationByHandleEx AreFileApisANSI GetStringTypeW InitOnceComplete InitOnceBeginInitialize FormatMessageA InitializeConditionVariable K32EnumProcesses GetThreadPriority OpenThread GetQueuedCompletionStatusEx UnregisterWait GetPriorityClass QueryFullProcessImageNameW CreateEventW GetTickCount VirtualQuery RemoveVectoredExceptionHandler AddVectoredExceptionHandler SetUnhandledExceptionFilter RaiseException FlushInstructionCache VirtualProtect CheckRemoteDebuggerPresent SetEvent Sleep IsDebuggerPresent GetSystemDirectoryA GetModuleHandleA LoadLibraryA SleepEx MoveFileExA GetEnvironmentVariableA

user32

SendMessageW RegisterClassExW GetClassInfoExW EnumWindows GetWindowThreadProcessId SetWindowLongPtrW PostMessageW RegisterWindowMessageW LoadStringW GetSystemMetrics GetGUIThreadInfo SendMessageCallbackW IsHungAppWindow PeekMessageW ShowWindow WaitForInputIdle

advapi32

EqualSid SetSecurityDescriptorDacl RevertToSelf RegCloseKey CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceStatus EventWriteTransfer EventRegister EventUnregister RegCreateKeyExW RegQueryValueExW OpenThreadToken ConvertStringSecurityDescriptorToSecurityDescriptorW GetTokenInformation OpenProcessToken ImpersonateLoggedOnUser ImpersonateSelf CryptReleaseContext CryptGenRandom CryptAcquireContextW RegDeleteTreeW RegDeleteKeyExW RegNotifyChangeKeyValue RegQueryMultipleValuesW RegQueryInfoKeyW RegDeleteValueW RegEnumValueW RegEnumKeyExW RegSetValueExW RegEnumKeyExA RegQueryValueExA RegOpenKeyExA CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptAcquireContextA SystemFunction036 EnumServicesStatusW QueryServiceStatusEx QueryServiceConfigW FreeSid RegOpenKeyExW AddAce InitializeAcl GetLengthSid AllocateAndInitializeSid AdjustTokenPrivileges LookupPrivilegeValueW CheckTokenMembership DuplicateToken LookupAccountSidW DuplicateTokenEx InitializeSecurityDescriptor

ole32

CoInitializeEx CoCreateInstance CoUninitialize CoCreateGuid CLSIDFromString CoTaskMemFree StringFromGUID2

powrprof

CallNtPowerInformation

shlwapi

PathMatchSpecW PathAppendW

fltlib

FilterConnectCommunicationPort FilterLoad FilterSendMessage FilterReplyMessage FilterGetMessage

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

crypt32

CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertFreeCTLContext CertFreeCertificateChain CertFreeCRLContext CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertAddCertificateContextToStore CertFreeCertificateContext

oleaut32

VariantClear SysFreeString VariantInit

iphlpapi

CancelMibChangeNotify2 GetUnicastIpAddressTable FreeMibTable GetBestRoute2 GetAdaptersAddresses Icmp6SendEcho2 Icmp6CreateFile IcmpSendEcho IcmpCreateFile IcmpCloseHandle GetNetworkParams

ws2_32

WSAWaitForMultipleEvents FreeAddrInfoExW WSACleanup getservbyname WSAResetEvent gethostname WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent getsockopt WSAAddressToStringW ntohl WSASetLastError GetAddrInfoW FreeAddrInfoW ntohs getsockname bind htonl recvfrom select sendto connect htons WSAGetLastError ioctlsocket __WSAFDIsSet WSAIoctl setsockopt socket WSAStartup recv closesocket send GetAddrInfoExW

Name

.text

Size

4.2MB

Virtual Size

4.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

500KB

Virtual Size

540KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

212KB

Virtual Size

211KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=223, id=261, version=33138,

count=12, id=259, version=33138,

count=8, id=253, version=34321,

count=19, id=260, version=34321,

count=12, id=259, version=34321,

count=122, id=261, version=34321,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=20, id=260, productName=VS2019 v16.10.3 build 30038, version=30038,

count=179, id=260, version=30154,

count=7, id=260, version=32545,

count=13, productName=Unmarked objects (old),

count=45, id=261, version=32545,

count=9, id=261, version=33520,

count=41, id=260, version=33138,

count=43, id=257, version=33138,

count=661, id=1, productName=Unmarked objects,

count=423, id=265, version=34436,

count=1, id=256, version=34436,

count=1, id=255, version=34436,

count=2, id=151,

count=1, id=258, version=34436,

AvConsent.exe

IMPHASH c01e852aac739b0227f41e587a85b333
SHA256 04f9f7a27319854c10f61df31da295440970b36c4323cc8082218765aff2e105
MD5 fbee4b0d7d3b33bd06855e911246a0fa
SHA1 86507af59f5d32b090c9fad300dd6fa97450d97e
SHA512 a28d337943b0a827b77f1830fa0dfa53289e35a35d967ea3299815e74f47147230882f2512ced17de11a7675764321f1b8b94824d8e8b3f0705a1b5553b10a24
SSDEEP 12288:0/cFp/rafU2tCph0lhSMXlid9Ta0oMskQV:0UFIs2toh0lhSMXlm9Ta0o5kQV
TLSH
T1CEE47B9A7B9902E8C15BF47884574619EB727C204F6292CB67F0CA650FE36E05FBF601
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

9f:b9:4c:12:59:3a:d1:ea:e4:41:91:29:38:7e:a5:fe:5e:ae:91:a1:17:c4:6e:29:78:df:fe:e2:1b:f7:29:99

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Chains

Mar 26, 2026

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Serial Number

40:1c:57:14:6d:ce:58:df:b9:22:21:87:8d:2a:a5:63

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2025 - Jun 10, 2028

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

265936

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\AvConsent.pdb

dwmapi

DwmSetWindowAttribute

wtsapi32

WTSRegisterSessionNotification WTSUnRegisterSessionNotification

dll_loader

?free_dll@dll_loader@asw@@YA_NPEAUHINSTANCE__@@@Z ?load_dll@dll_loader@asw@@YAPEAUHINSTANCE__@@PEB_W0@Z

shell32

SHGetKnownFolderPath

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

kernel32

TerminateProcess WaitForSingleObject GetCurrentThread CreateEventW SetEvent GetSystemInfo QueryPerformanceCounter ExpandEnvironmentStringsW GetSystemDirectoryW VirtualProtect GetEnvironmentVariableW GetWindowsDirectoryW QueryDosDeviceW RaiseException VirtualQuery LoadLibraryExA K32GetMappedFileNameW FindFirstVolumeW FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose GetSystemTimeAsFileTime GetTickCount64 GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeSListHead WakeAllConditionVariable SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive InitOnceComplete InitOnceBeginInitialize MultiByteToWideChar GetLastError LoadLibraryA GetProcAddress GetModuleHandleW LoadLibraryExW GetModuleFileNameW LoadLibraryW WideCharToMultiByte LeaveCriticalSection EnterCriticalSection FreeLibrary MulDiv DeleteCriticalSection InitializeCriticalSection ProcessIdToSessionId GetCurrentProcessId FindFirstFileW FindNextFileW FindClose FormatMessageW SetLastError OutputDebugStringW GetCurrentThreadId IsDebuggerPresent GetModuleFileNameA HeapFree GetModuleHandleExW HeapAlloc GetProcessHeap DebugBreak InitializeCriticalSectionAndSpinCount Sleep CompareStringW CreateFileW CloseHandle GetCurrentProcess ReadFile GetFileSizeEx LockFileEx UnlockFileEx

user32

MoveWindow SetWindowLongPtrW GetWindowRect GetSystemMetrics GetWindowLongPtrW DefWindowProcW SetCursor LoadCursorW DestroyWindow SystemParametersInfoW CreateDialogParamW ShowWindow SetForegroundWindow LoadStringW SetWindowTextW GetDlgItem GetWindowTextW SetDlgItemTextW SetWindowPos LoadImageW GetSysColor GetDC SendDlgItemMessageW SetFocus SetTimer GetFocus PostQuitMessage GetClientRect FillRect DrawIcon SetWindowRgn GetWindowTextLengthW DrawTextW InflateRect GetMessageW IsDialogMessageW TranslateMessage DispatchMessageW OpenDesktopW SetThreadDesktop CloseDesktop ReleaseDC RegisterClassW CreateWindowExW CloseWindow BeginPaint EndPaint

gdi32

PatBlt CreatePatternBrush CreateBitmap SetBitmapBits GetBitmapBits GetObjectW AddFontResourceExW DeleteDC BitBlt CreateCompatibleBitmap CreateCompatibleDC SetTextColor SetBkMode CreateRoundRectRgn RoundRect GetStockObject SelectObject CreateFontW GetDeviceCaps ExtCreatePen CreatePen CreateSolidBrush DeleteObject

advapi32

OpenProcessToken RegQueryValueExW RegOpenKeyExW OpenThreadToken GetTokenInformation RegCloseKey

ole32

CoTaskMemFree

msvcp140

??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z ??7ios_base@std@@QEBA_NXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ _Wcscoll _Wcsxfrm ?id@?$collate@_W@std@@2V0locale@2@A ?is@?$ctype@_W@std@@QEBA_NF_W@Z ?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEB_W_J@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?fail@ios_base@std@@QEBA_NXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?eof@ios_base@std@@QEBA_NXZ _Query_perf_frequency _Query_perf_counter ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?id@?$ctype@_W@std@@2V0locale@2@A ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ _Mbrtowc ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?classic@locale@std@@SAAEBV12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$numpunct@D@std@@2V0locale@2@A ?id@?$ctype@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z _Mtx_lock _Mtx_unlock ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBADD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ??Bid@locale@std@@QEAA_KXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z ?id@?$numpunct@_W@std@@2V0locale@2@A ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?good@ios_base@std@@QEBA_NXZ ?uncaught_exceptions@std@@YAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__RTDynamicCast __current_exception_context __current_exception memset __C_specific_handler __std_exception_destroy __std_exception_copy _purecall __std_terminate __std_type_info_name __RTtypeid wcschr strchr _CxxThrowException memcmp memcpy memmove

api-ms-win-crt-heap-l1-1-0

realloc _callnewh free _set_new_mode calloc malloc

api-ms-win-crt-math-l1-1-0

_fdsign _dsign modf _set_FMA3_enable _get_FMA3_enable _dclass _ldsign __setusermatherr

api-ms-win-crt-runtime-l1-1-0

_configure_wide_argv _initialize_wide_environment _set_app_type _crt_atexit _get_wide_winmain_command_line _invalid_parameter_noinfo_noreturn abort _initterm_e _initterm _register_thread_local_exe_atexit_callback exit _cexit _seh_filter_exe _exit terminate _invalid_parameter_noinfo _errno _register_onexit_function _initialize_onexit_table _c_exit

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf __p__commode _set_fmode

api-ms-win-crt-string-l1-1-0

wcsncmp wcscat_s _wcsnicmp

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

314KB

Virtual Size

314KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

221KB

Virtual Size

221KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

24KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

53KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

AvDump.exe

IMPHASH 9414988740687537bc455013d20ad9ff
SHA256 843cc3d2168484e2a44f37ebd171a32759aac7c2a77767e2c0988c1423cc2010
MD5 ee19d1749bc40499ecbd956eb6e2c830
SHA1 302ef73821c71784767a325509a0d44fbf2045ea
SHA512 453b5d17cb04c096b007197fb2c0b155c863b689c2732e5706b98a76eb12dd41bc87305d18dd33836a6735bcbc5bc7e75def2cb9c06c77878d780aa293c9a982
SSDEEP 49152:qbkA1wsT7W1vAQ4Zmn3OQP5tdZIfsT1lmvKnp78h0GCl2StNtMteAlJv+D0Cc1yR:xA63btr1C
TLSH
T167066B4EBA2D00E9C1BEE17C8A87950BEB713895477597CB66E08E150F53AF09E7E700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

74:81:4a:84:8f:0e:a9:45:6e:de:bf:14:7e:25:3e:63:a1:d1:5c:23:be:e8:02:55:14:12:be:3b:ad:9c:18:7c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Chains

Mar 26, 2026

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Serial Number

40:1c:57:14:6d:ce:58:df:b9:22:21:87:8d:2a:a5:63

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2025 - Jun 10, 2028

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

671152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\avDump.pdb

rpcrt4

RpcStringBindingComposeW UuidCreate UuidFromStringW UuidToStringW RpcMgmtEpEltInqDone RpcIfInqId RpcMgmtEpEltInqBegin RpcMgmtEpEltInqNextW RpcServerUnregisterIfEx RpcServerRegisterIf2 RpcObjectSetType RpcEpRegisterW RpcEpUnregister RpcBindingToStringBindingW RpcAsyncCompleteCall RpcAsyncInitializeHandle RpcAsyncCancelCall Ndr64AsyncClientCall NdrAsyncServerCall Ndr64AsyncServerCallAll RpcStringBindingParseW NdrClientCall3 NdrServerCall2 NdrServerCallAll RpcServerUnregisterIf RpcServerRegisterIfEx RpcServerUseProtseqEpW RpcImpersonateClient RpcRevertToSelf I_RpcBindingInqLocalClientPID RpcStringFreeW RpcBindingFromStringBindingW RpcBindingFree

bcrypt

BCryptEncrypt BCryptCloseAlgorithmProvider BCryptDeriveKey BCryptSecretAgreement BCryptExportKey BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptDestroyKey BCryptFinalizeKeyPair BCryptGenerateKeyPair BCryptImportKeyPair BCryptSetProperty BCryptDestroySecret

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

shell32

ord165 SHGetKnownFolderPath

ntdll

RtlNtStatusToDosError NtClose NtSetInformationThread NtQueryKey NtDeleteKey RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwind VerSetConditionMask NtSystemDebugControl RtlDllShutdownInProgress NtCreateWorkerFactory NtQueryInformationProcess NtQuerySystemInformation NtQueryInformationWorkerFactory RtlPcToFileHeader RtlUnwindEx NtOpenKey

kernel32

CompareStringW FormatMessageW GetCurrentThreadId GetModuleHandleExW GetModuleFileNameA DebugBreak GetOverlappedResult DeviceIoControl CreateIoCompletionPort PostQueuedCompletionStatus GetQueuedCompletionStatus WriteFile ReadFile CancelIoEx GetTickCount64 SetLastError OutputDebugStringW IsDebuggerPresent Sleep SetFilePointerEx UnlockFileEx LockFileEx GetFileSizeEx VirtualAlloc WerRegisterMemoryBlock WerUnregisterMemoryBlock VirtualFree QueryPerformanceCounter QueryPerformanceFrequency InitOnceExecuteOnce GetCurrentProcessId AcquireSRWLockExclusive ReleaseSRWLockExclusive UnmapViewOfFile UnlockFile CreateFileMappingW MapViewOfFile QueryUnbiasedInterruptTime TerminateThread ResumeThread ResetEvent GetTickCount SetThreadPriority GetCurrentProcess LocalFree RaiseException GetThreadTimes InitializeCriticalSectionAndSpinCount QueryThreadCycleTime InitializeProcThreadAttributeList UpdateProcThreadAttribute CreateToolhelp32Snapshot Process32FirstW Process32NextW GetProcessTimes ReadProcessMemory GetThreadId CreateProcessW TerminateProcess GetExitCodeProcess GetPriorityClass ProcessIdToSessionId K32GetProcessMemoryInfo InitializeCriticalSectionEx LoadLibraryW CompareFileTime QueryFullProcessImageNameW FlushFileBuffers DeleteFileW GetFileInformationByHandle GetFullPathNameW OutputDebugStringA FileTimeToSystemTime TlsAlloc TlsGetValue TlsSetValue FreeLibrary LoadLibraryExW GetCurrentThread GetSystemInfo ExpandEnvironmentStringsW GetFileAttributesW GetSystemDirectoryW SetErrorMode VirtualProtect HeapReAlloc GlobalMemoryStatusEx GetEnvironmentVariableW GetThreadPriority GetExitCodeThread TlsFree SetFilePointer SetFileAttributesW SetEndOfFile MoveFileExW GetWindowsDirectoryW DuplicateHandle FindFirstFileW FindClose CreateDirectoryW FindFirstFileExW FindNextFileW QueryDosDeviceW CopyFileW SetFileInformationByHandle GetDiskFreeSpaceExW K32GetMappedFileNameW FindFirstVolumeW FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose VirtualQuery GetSystemTimes WaitForSingleObjectEx FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage ReadConsoleW GetConsoleMode GetConsoleOutputCP GetNativeSystemInfo EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW HeapFree GetProcessHeap HeapAlloc GetModuleFileNameW VerifyVersionInfoW SetConsoleCtrlHandler SetDllDirectoryW GetProcAddress GetModuleHandleW WaitForSingleObject GetProcessId GetNamedPipeServerProcessId GetFileTime CreateFileW MultiByteToWideChar ContinueDebugEvent DebugActiveProcessStop GetFileAttributesExW GetSystemTimeAsFileTime OpenThread DebugBreakProcess SetEvent WaitForDebugEvent DebugSetProcessKillOnExit DebugActiveProcess WideCharToMultiByte VirtualQueryEx GetThreadContext K32GetProcessImageFileNameW K32GetModuleBaseNameW K32EnumProcessModules OpenProcess WaitForMultipleObjects GetLastError CreateEventW CloseHandle LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection SetStdHandle HeapSize HeapQueryInformation WriteConsoleW UnregisterWaitEx ReadDirectoryChangesW WaitForThreadpoolWaitCallbacks FormatMessageA GetStringTypeW AreFileApisANSI GetFileInformationByHandleEx WakeAllConditionVariable SleepConditionVariableSRW ReleaseSRWLockShared AcquireSRWLockShared TryAcquireSRWLockExclusive GetLocaleInfoEx FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork RegisterWaitForSingleObject CloseThreadpoolWork IsProcessorFeaturePresent WakeConditionVariable InitOnceBeginInitialize InitOnceComplete EncodePointer FlsFree GetProcessHandleCount K32EnumProcesses RemoveVectoredExceptionHandler AddVectoredExceptionHandler SetUnhandledExceptionFilter FlushInstructionCache CheckRemoteDebuggerPresent CreateThread DecodePointer LCMapStringEx SetEnvironmentVariableW K32GetPerformanceInfo FlsSetValue FlsGetValue FlsAlloc GetFileType ExitProcess GetCommandLineW GetCommandLineA GetStdHandle FreeLibraryAndExitThread ExitThread InterlockedPushEntrySList GetStartupInfoW UnhandledExceptionFilter InitializeSListHead GetCPInfo CompareStringEx CloseThreadpoolWait SetThreadpoolWait CreateThreadpoolWait LoadLibraryExA

user32

RegisterWindowMessageW LoadStringW SendMessageW PeekMessageW IsHungAppWindow SendMessageCallbackW GetGUIThreadInfo SetWindowLongPtrW PostMessageW GetSystemMetrics RegisterClassExW GetClassInfoExW

advapi32

SetServiceStatus RegisterServiceCtrlHandlerExW QueryServiceConfig2W ChangeServiceConfig2W StartServiceCtrlDispatcherW OpenSCManagerW CryptReleaseContext CryptGenRandom CryptAcquireContextW RegDeleteTreeW RegNotifyChangeKeyValue RegQueryMultipleValuesW RegDeleteKeyExW SetSecurityDescriptorDacl InitializeSecurityDescriptor RegQueryInfoKeyW RegDeleteValueW RegEnumValueW RegEnumKeyExW RegSetValueExW RegCreateKeyExW RegQueryValueExW FreeSid RegOpenKeyExW CheckTokenMembership DuplicateToken StartServiceW AllocateAndInitializeSid ImpersonateSelf AdjustTokenPrivileges LookupPrivilegeValueW RevertToSelf EqualSid OpenProcessToken GetTokenInformation EventUnregister EventRegister EventWriteTransfer RegCloseKey QueryServiceStatus OpenThreadToken CloseServiceHandle ControlService ChangeServiceConfigW CreateServiceW DeleteService OpenServiceW SetThreadToken

ole32

CoTaskMemFree CoCreateGuid

powrprof

CallNtPowerInformation

fltlib

FilterSendMessage FilterGetMessage FilterReplyMessage FilterLoad FilterConnectCommunicationPort

shlwapi

PathAppendW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

856KB

Virtual Size

856KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

430KB

Virtual Size

467KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

117KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

25KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

AvEmUpdate.exe

IMPHASH 9f1a5ff7ae7a84426716ddfa96453e15
SHA256 8eb6170fa73ee93a8ea393101eee234b8d6af5aeae3fc735adce933dac241b76
MD5 0617819d2b47c6b8e885d408dfe87d21
SHA1 d1d439d9b2075f8e9020845ec36745fa89f61b80
SHA512 23a1d4538fecb24f408d79162655bae0dd7707742ddcd68a835aa29e89f08a7eb1004d5fa6a0b1fbc5610930a813f0de6bcb3ce816624275492157b646e06161
SSDEEP 49152:K2dnHZl4y/U4zbCyhhqU+h58XCYJfmyk3Wd8etGdgJELVfIKrxPim98WVTgH0JH1:vUCCyhhjL7xuzcNnndq
TLSH
T1E9467C1E7A6D00E9C1BFE1788A97950AEFB13895033997DB66E08E150F53AF05E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

e2:f2:89:f6:84:f0:b2:99:24:2f:35:95:23:45:66:a3:33:b9:81:19:e0:74:ff:6e:48:ee:a4:ea:29:a6:50:cd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Chains

Mar 26, 2026

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Serial Number

40:1c:57:14:6d:ce:58:df:b9:22:21:87:8d:2a:a5:63

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2025 - Jun 10, 2028

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

2339152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\AvEmUpdate.pdb

winhttp

WinHttpCrackUrl WinHttpConnect WinHttpOpenRequest WinHttpGetProxyForUrl WinHttpSetCredentials WinHttpSetOption WinHttpSendRequest WinHttpWriteData WinHttpReceiveResponse WinHttpQueryHeaders WinHttpReadData WinHttpCloseHandle WinHttpGetIEProxyConfigForCurrentUser WinHttpGetDefaultProxyConfiguration WinHttpQueryOption WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpAddRequestHeaders WinHttpOpen

ws2_32

WSAAddressToStringW inet_ntoa

advapi32

EventWriteTransfer EventUnregister DuplicateToken GetSecurityDescriptorControl GetLengthSid InitializeAcl AddAce EventRegister RegOpenKeyExW RegQueryValueExW RegCloseKey ConvertStringSecurityDescriptorToSecurityDescriptorW RegSetValueExW RegQueryInfoKeyW MakeSelfRelativeSD RegQueryMultipleValuesW InitializeSecurityDescriptor SetSecurityDescriptorDacl ImpersonateLoggedOnUser RegOpenCurrentUser RevertToSelf DuplicateTokenEx AllocateAndInitializeSid CheckTokenMembership FreeSid OpenProcessToken GetTokenInformation EqualSid RegDeleteValueW RegEnumKeyExW RegEnumValueW RegDeleteKeyW OpenThreadToken ImpersonateSelf LookupPrivilegeValueW AdjustTokenPrivileges CreateProcessAsUserW OpenSCManagerW OpenServiceW QueryServiceStatus QueryServiceStatusEx ControlService StartServiceW CloseServiceHandle InitiateSystemShutdownExW RegCreateKeyExW RegNotifyChangeKeyValue RegDeleteKeyExW RegDeleteTreeW CryptAcquireContextW RegFlushKey CryptGenRandom CryptReleaseContext

shell32

ord165 SHGetKnownFolderPath SHGetFolderPathW

ole32

CoInitializeSecurity CoInitializeEx CoTaskMemFree CoUninitialize CoCreateInstance CoCreateGuid

user32

SetWindowLongPtrW SendMessageW RegisterWindowMessageW LoadStringW GetSystemMetrics GetGUIThreadInfo SendMessageCallbackW IsHungAppWindow PeekMessageW RegisterClassExW PostMessageW GetClassInfoExW

oleaut32

VariantClear VariantInit SysFreeString SysStringLen VariantCopy SysAllocString

shlwapi

PathAppendW SHDeleteKeyW

bcrypt

BCryptImportKeyPair BCryptGenerateKeyPair BCryptFinalizeKeyPair BCryptSetProperty BCryptSecretAgreement BCryptDeriveKey BCryptOpenAlgorithmProvider BCryptGenerateSymmetricKey BCryptEncrypt BCryptCloseAlgorithmProvider BCryptDestroyKey BCryptExportKey BCryptDestroySecret

rpcrt4

I_RpcBindingInqLocalClientPID RpcMgmtEpEltInqNextW RpcMgmtEpEltInqBegin RpcIfInqId RpcMgmtEpEltInqDone Ndr64AsyncServerCallAll RpcStringBindingParseW RpcServerRegisterIf2 NdrServerCall2 NdrServerCallAll RpcObjectSetType RpcServerUseProtseqEpW RpcEpRegisterW RpcImpersonateClient RpcAsyncCancelCall RpcEpUnregister RpcBindingToStringBindingW RpcAsyncCompleteCall RpcAsyncInitializeHandle NdrClientCall3 RpcBindingFree RpcBindingFromStringBindingW RpcStringBindingComposeW UuidCreate RpcStringFreeW UuidToStringW UuidFromStringW RpcRevertToSelf Ndr64AsyncClientCall RpcServerUnregisterIfEx NdrAsyncServerCall

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory WTSQuerySessionInformationW WTSQueryUserToken

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

crypt32

CertFreeCertificateContext

ntdll

RtlNtStatusToDosError NtQueryInformationProcess NtSetInformationFile VerSetConditionMask RtlDllShutdownInProgress NtSystemDebugControl RtlLookupFunctionEntry RtlVirtualUnwind NtClose NtCreateWorkerFactory NtQuerySystemInformation NtQueryInformationWorkerFactory NtSetInformationThread NtOpenKey NtQueryKey NtDeleteKey RtlCaptureContext RtlUnwindEx RtlPcToFileHeader RtlUnwind

kernel32

FlsAlloc ExitProcess GetTimeZoneInformation GetLocaleInfoEx FlsGetValue TryAcquireSRWLockExclusive AcquireSRWLockShared IsValidCodePage ReleaseSRWLockShared SleepConditionVariableSRW WakeAllConditionVariable WaitForSingleObjectEx GetStdHandle SetStdHandle GetConsoleOutputCP ReadConsoleW GetConsoleMode GetStringTypeW GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW FormatMessageA FlsSetValue FlsFree GetFileType FreeLibraryAndExitThread ExitThread GetConsoleCP GetCommandLineA InterlockedPushEntrySList GetStartupInfoW InitializeSListHead UnhandledExceptionFilter GetCPInfo CompareStringEx LCMapStringEx EncodePointer WakeConditionVariable HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap GetPrivateProfileIntW GetPrivateProfileStringW K32GetModuleFileNameExW GetCurrentProcess WaitForSingleObject CreateMutexW GetLastError GetModuleFileNameW GetComputerNameW LocalFree SizeofResource LockResource LoadResource FindResourceExW FindResourceW LoadLibraryExW GetProcAddress FreeLibrary SetDllDirectoryW GetModuleHandleW GetCurrentProcessId CloseHandle WideCharToMultiByte SetErrorMode Sleep CreateFileW LoadLibraryW TerminateProcess CompareStringW MultiByteToWideChar LeaveCriticalSection EnterCriticalSection CreateProcessW DuplicateHandle SetEvent CreateEventW GetTempPathW CreateDirectoryW MoveFileExW DeleteFileW WaitForMultipleObjects InitializeCriticalSection ResumeThread DeleteCriticalSection ReadFile WriteFile SetFilePointer GetSystemTime SystemTimeToFileTime GetCommandLineW GetDateFormatW GetTimeFormatW GetVersionExW GetNativeSystemInfo GlobalMemoryStatusEx GetSystemDirectoryW GetFileAttributesExW GetPrivateProfileSectionW HeapQueryInformation RemoveDirectoryW MoveFileW GetFileAttributesW GetTempFileNameW GetLongPathNameW QueryDosDeviceW CreateFileMappingW MapViewOfFile K32GetMappedFileNameW UnmapViewOfFile GetVolumePathNameW CopyFileW SetFileAttributesW SetFilePointerEx GetFileSizeEx SetEndOfFile FlushFileBuffers SetFileTime GetFileInformationByHandle UnlockFile GetSystemTimeAsFileTime FileTimeToSystemTime VerifyVersionInfoW OutputDebugStringW SetConsoleCtrlHandler FreeConsole ReleaseMutex AttachConsole AllocConsole GetTickCount FindFirstFileW FindClose ExpandEnvironmentStringsW GetFileSize GetCurrentThread GetExitCodeProcess DeviceIoControl OpenProcess K32EnumProcesses K32GetProcessImageFileNameW TerminateThread GetLocalTime WritePrivateProfileStringW InitializeCriticalSectionEx DecodePointer GetFullPathNameW GlobalFree CreateWaitableTimerW SetWaitableTimer GetModuleFileNameA GetModuleHandleExW GetCurrentThreadId FormatMessageW DebugBreak VirtualAlloc VirtualFree IsProcessorFeaturePresent ResetEvent ReleaseSemaphore CreateSemaphoreW SetThreadAffinityMask GetProcessId GetEnvironmentVariableW SetEnvironmentVariableW CreateThread InitializeProcThreadAttributeList UpdateProcThreadAttribute IsDebuggerPresent CheckRemoteDebuggerPresent VirtualProtect FlushInstructionCache RaiseException SetUnhandledExceptionFilter AddVectoredExceptionHandler RemoveVectoredExceptionHandler VirtualQuery QueryFullProcessImageNameW GetPriorityClass OpenThread GetThreadPriority GetThreadTimes K32GetProcessMemoryInfo CreateToolhelp32Snapshot Process32FirstW Process32NextW GetProcessHandleCount WriteConsoleW ReadProcessMemory TlsFree TlsAlloc TlsSetValue TlsGetValue SetLastError GetSystemTimes GetProcessTimes GetOverlappedResult PostQueuedCompletionStatus GetQueuedCompletionStatus CancelIoEx GetTickCount64 WerRegisterMemoryBlock WerUnregisterMemoryBlock QueryPerformanceCounter QueryPerformanceFrequency InitOnceExecuteOnce AcquireSRWLockExclusive ReleaseSRWLockExclusive LockFileEx GetFileTime CompareFileTime UnlockFileEx QueryUnbiasedInterruptTime UnregisterWaitEx ReadDirectoryChangesW ProcessIdToSessionId GetLocaleInfoW InitializeCriticalSectionAndSpinCount SetThreadPriority QueryThreadCycleTime GetThreadId WTSGetActiveConsoleSessionId GetSystemInfo GetShortPathNameW GetSystemWindowsDirectoryW GetProcessAffinityMask GetExitCodeThread GetWindowsDirectoryW FindFirstFileExW GetVolumeNameForVolumeMountPointW GetVersion OutputDebugStringA SetFileInformationByHandle GetDiskFreeSpaceExW FindFirstVolumeW FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolWait WaitForThreadpoolWaitCallbacks RegisterWaitForSingleObject GetFileInformationByHandleEx AreFileApisANSI InitOnceComplete InitOnceBeginInitialize LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetConsoleMode ReadConsoleInputW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FindNextFileW FreeLibraryWhenCallbackReturns GetCurrentDirectoryW CreateIoCompletionPort

winmm

timeGetTime

wininet

InternetCanonicalizeUrlW InternetSetOptionW HttpSendRequestExW InternetCrackUrlW InternetConnectW InternetReadFile HttpQueryInfoW HttpEndRequestW InternetWriteFile HttpSendRequestW InternetOpenW InternetCloseHandle HttpAddRequestHeadersW HttpOpenRequestW GopherOpenFileW FtpOpenFileW

cabinet

ord22 ord23 ord20

dnsapi

DnsFree DnsQuery_W

powrprof

CallNtPowerInformation

fltlib

FilterConnectCommunicationPort FilterLoad FilterGetMessage FilterSendMessage FilterReplyMessage

Name

.text

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

462KB

Virtual Size

503KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

167KB

Virtual Size

166KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=222, id=261, version=33138,

count=10, id=259, version=33138,

count=7, id=253, version=34321,

count=19, id=260, version=34321,

count=12, id=259, version=34321,

count=120, id=261, version=34321,

count=37, id=260, version=33138,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=260, version=32545,

count=13, productName=Unmarked objects (old),

count=1, id=263, version=33138,

count=1, id=262, version=33138,

count=44, id=261, version=32545,

count=10, id=257, version=30795,

count=2, id=259, version=33520,

count=9, id=260, version=33520,

count=37, id=257, version=33138,

count=592, id=1, productName=Unmarked objects,

count=416, id=265, version=34436,

count=1, id=256, version=34436,

count=1, id=255, version=34436,

count=2, id=151,

count=1, id=258, version=34436,

AvLaunch.exe

IMPHASH 81d64fc1821cb432d5d092815f3e8d55
SHA256 dc9cdfcd4a52b95828f53274f4751f97e928aeffe6d3851a964dea1c034e4f5f
MD5 bfb4b83df31a42afa6cd924564902078
SHA1 3af4d6063c4c2246d087018c6b1da2781c6b4286
SHA512 f04c0b2465af26e62a28be2f61ce21bc797215926f1fecc1d4a2570ced1cdbe5c6711d4ef8cbd639d2a0958de9740d1a216fbd79984eaca414d81d27350e982a
SSDEEP 12288:i0gSoF7aA9VkKXEu5n/4jph0lhSMXliwfJYrpWcfJ+VjV:iJ7a0VkKXEc/4Vh0lhSMXlPhYrB8VjV
TLSH
T10D255B9EBA1C00D8C5BEE0794967950DEB717C960B2196C7A6F0CE193FA79E01E7E301
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

61:a5:3d:37:db:80:51:34:08:98:29:45:d7:e3:49:6d:98:f8:87:6e:3b:c5:22:88:5f:c5:bb:8e:d3:41:38:90

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Chains

Mar 26, 2026

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Serial Number

40:1c:57:14:6d:ce:58:df:b9:22:21:87:8d:2a:a5:63

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2025 - Jun 10, 2028

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

498576

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\AvLaunch.pdb

bcrypt

BCryptCloseAlgorithmProvider BCryptDestroyKey BCryptSetProperty BCryptImportKeyPair BCryptGenerateKeyPair BCryptDestroySecret BCryptFinalizeKeyPair BCryptExportKey BCryptSecretAgreement BCryptDeriveKey BCryptGenerateSymmetricKey BCryptEncrypt BCryptOpenAlgorithmProvider

shell32

SHGetKnownFolderPath

ntdll

RtlNtStatusToDosError VerSetConditionMask ZwSetInformationProcess ZwQueryInformationProcess NtSetInformationThread RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

kernel32

ReadFile CancelIoEx WaitForMultipleObjects CreateEventW SetEvent GetTickCount64 VirtualAlloc WerRegisterMemoryBlock WerUnregisterMemoryBlock VirtualFree QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimeAsFileTime InitOnceExecuteOnce AcquireSRWLockExclusive ReleaseSRWLockExclusive UnmapViewOfFile UnlockFile CreateFileMappingW MapViewOfFile LockFileEx SetLastError Sleep InitializeCriticalSection DeleteCriticalSection QueryUnbiasedInterruptTime TerminateThread ResetEvent GetTickCount SetThreadPriority GetCurrentThread MultiByteToWideChar LocalFree RaiseException GetThreadTimes InitializeCriticalSectionAndSpinCount QueryThreadCycleTime FreeLibrary UnlockFileEx GetFileSizeEx CreateToolhelp32Snapshot Process32FirstW Process32NextW TerminateProcess FlushFileBuffers DeleteFileW GetFileInformationByHandle GetFullPathNameW OutputDebugStringA FileTimeToSystemTime TlsGetValue WriteFile GetOverlappedResult ExpandEnvironmentStringsW GetFileAttributesW GetSystemDirectoryW GlobalMemoryStatusEx GetEnvironmentVariableW MoveFileExW GetWindowsDirectoryW CreateDirectoryW QueryDosDeviceW SetFileInformationByHandle GetDiskFreeSpaceExW K32GetMappedFileNameW FindFirstVolumeW FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose GetSystemTimes CreateFileW GetQueuedCompletionStatus PostQueuedCompletionStatus CreateIoCompletionPort DeviceIoControl GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter WakeAllConditionVariable InitializeSListHead InitOnceComplete InitOnceBeginInitialize GetLocaleInfoEx EnterCriticalSection LeaveCriticalSection CompareStringW IsDebuggerPresent lstrcmpiW DebugBreak VerifyVersionInfoW WideCharToMultiByte GetModuleHandleW CreateProcessW GetProcessHeap GetCurrentProcessId GetProcAddress HeapAlloc CloseHandle OutputDebugStringW GetLastError FormatMessageW OpenProcess ResumeThread GetCurrentThreadId WaitForSingleObject GetModuleFileNameW GetModuleHandleExW GetCurrentProcess HeapFree FormatMessageA GetModuleFileNameA AreFileApisANSI ReleaseSRWLockShared AcquireSRWLockShared SleepConditionVariableSRW

user32

RegisterClassExW GetClassInfoExW

advapi32

CryptReleaseContext CryptGenRandom CryptAcquireContextW RegQueryInfoKeyW RegQueryValueExW RegOpenKeyExW ImpersonateSelf AdjustTokenPrivileges LookupPrivilegeValueW RevertToSelf OpenProcessToken GetTokenInformation OpenThreadToken RegCloseKey EventUnregister EventRegister EventWriteTransfer QueryServiceStatus OpenServiceW OpenSCManagerW CloseServiceHandle

ole32

CoTaskMemFree

msvcp140

?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEB_W_J@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z _Thrd_join _Thrd_id _Cnd_do_broadcast_at_thread_exit ?is@?$ctype@_W@std@@QEBA_NF_W@Z ?id@?$collate@_W@std@@2V0locale@2@A _Wcsxfrm _Wcscoll ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z _Cnd_signal ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ _Mbrtowc ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Incref@facet@locale@std@@UEAAXXZ ??1_Locinfo@std@@QEAA@XZ ??1_Lockit@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??0_Lockit@std@@QEAA@H@Z ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?id@?$numpunct@_W@std@@2V0locale@2@A ??Bid@locale@std@@QEAA_KXZ ?id@?$numpunct@D@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_lock _Mtx_unlock ?toupper@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?id@?$ctype@_W@std@@2V0locale@2@A ?_Xbad_function_call@std@@YAXXZ ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ _Cnd_broadcast _Cnd_wait ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_ReportUnobservedException@details@Concurrency@@YAXXZ ??0task_continuation_context@Concurrency@@AEAA@XZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z _Cnd_register_at_thread_exit _Cnd_unregister_at_thread_exit ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?good@ios_base@std@@QEBA_NXZ ?uncaught_exceptions@std@@YAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z _Query_perf_counter _Query_perf_frequency ?classic@locale@std@@SAAEBV12@XZ ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?eof@ios_base@std@@QEBA_NXZ ?fail@ios_base@std@@QEBA_NXZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z

msvcp140_atomic_wait

__std_atomic_notify_all_direct __std_atomic_wait_direct

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __RTDynamicCast memcmp memmove __current_exception_context memset __current_exception __C_specific_handler __std_exception_destroy __std_exception_copy _purecall __std_terminate __std_type_info_name __std_type_info_compare __std_type_info_hash __RTtypeid wcschr strchr memchr memcpy

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh _aligned_malloc _aligned_free free realloc malloc calloc

api-ms-win-crt-convert-l1-1-0

_wtoi

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo __p___argc _errno _invalid_parameter_noinfo_noreturn abort terminate _beginthreadex _configure_wide_argv _initialize_wide_environment _set_app_type _get_wide_winmain_command_line _crt_atexit _initterm_e _initterm _register_thread_local_exe_atexit_callback exit _cexit _seh_filter_exe _exit _c_exit _register_onexit_function _initialize_onexit_table __p___wargv

api-ms-win-crt-stdio-l1-1-0

_set_fmode fflush fwrite __p__commode __stdio_common_vswprintf

api-ms-win-crt-math-l1-1-0

_fdsign _set_FMA3_enable _get_FMA3_enable ceilf _dsign __setusermatherr _ldsign

api-ms-win-crt-string-l1-1-0

wcsncmp _wcsnicmp wcscat_s strnlen strcpy_s

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

fltlib

FilterGetMessage FilterSendMessage FilterLoad FilterConnectCommunicationPort FilterReplyMessage

NortonSvc.exe

IMPHASH 710d99dfeff309cb6fb15b434704c836
SHA256 b3311bcf0905ec359e1d93a09bfacf0a1f9a2cc1b3ab7627bfd0e5bcb9114e09
MD5 a5fdeb1672449657be3aeeec4c7d99d6
SHA1 d022b020ed33176a678d377dd4f9853a54f3cac5
SHA512 caa8173be60d6af54ceefef1aed4278e9b6aced96d386cccf896c5a9829b42aff6021a380a4ff617413cb2d3049c8ceaa0e2d584bf30ffa8bf5bcd575609a2fc
SSDEEP 24576:4IQ5D6yLjqR42vGZM0Yu2sXWh0lhSMXlmPMEjhmP5LjV:bQgGMoqsXjK
TLSH
T10A257B4E7B9801E8D0BEE4B48963550AEB717C950F2592DB66E0DE152FE3AF45E3E300
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

9e:37:3b:f5:34:6c:60:46:cb:1c:75:f2:af:bf:f6:e3:85:5c:1e:1f:c8:57:09:8a:4f:52:e2:e9:a3:57:af:1c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Chains

Mar 26, 2026

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Serial Number

40:1c:57:14:6d:ce:58:df:b9:22:21:87:8d:2a:a5:63

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2025 - Jun 10, 2028

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

485424

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\AvastSvc.pdb

wsock32

WSAStartup WSACleanup

shlwapi

PathMatchSpecA PathAppendW

rpcrt4

RpcStringFreeW RpcBindingFromStringBindingW RpcBindingFree NdrClientCall3 RpcStringBindingComposeW UuidCreate

aswcmnbs

secPreventHookDllInjection aswcmnbsDllMain cmnbInit cmnbFree secCreateSharedMutex secSetObjectProtection

dll_loader

?load_dll@dll_loader@asw@@YAPEAUHINSTANCE__@@PEB_W0@Z ?free_dll@dll_loader@asw@@YA_NPEAUHINSTANCE__@@@Z

shell32

SHGetKnownFolderPath ord165

ntdll

NtQueryInformationWorkerFactory NtQuerySystemInformation NtQueryInformationProcess NtClose RtlVirtualUnwind RtlLookupFunctionEntry NtSystemDebugControl VerSetConditionMask RtlDllShutdownInProgress NtOpenKey NtCreateWorkerFactory NtQueryKey NtDeleteKey RtlCaptureContext

kernel32

ReleaseMutex WaitForSingleObject InitializeCriticalSection DeleteCriticalSection DuplicateHandle GetCurrentProcess CreateEventW CloseThreadpoolTimer SetEvent GetCurrentThread CreateThreadpoolTimer TerminateProcess QueueUserWorkItem SetThreadpoolTimer WaitForThreadpoolTimerCallbacks LeaveCriticalSection EnterCriticalSection GetModuleFileNameA HeapFree GetModuleHandleExW FormatMessageW HeapAlloc DebugBreak GetProcessId GetEnvironmentVariableW SetEnvironmentVariableW CreateThread GetSystemDirectoryW LoadLibraryW FreeLibrary GetFileAttributesW CreateProcessW GetExitCodeProcess VerifyVersionInfoW FindFirstFileW CreateFileW DeleteFileW InitializeProcThreadAttributeList UpdateProcThreadAttribute FindClose OutputDebugStringW IsDebuggerPresent CheckRemoteDebuggerPresent FlushInstructionCache SetErrorMode SetUnhandledExceptionFilter AddVectoredExceptionHandler RemoveVectoredExceptionHandler GetTickCount QueryFullProcessImageNameW GetPriorityClass OpenThread GetThreadPriority K32EnumProcesses OpenProcess GetThreadTimes K32GetProcessMemoryInfo CreateToolhelp32Snapshot Process32FirstW Process32NextW GetProcessHandleCount CreateIoCompletionPort DeviceIoControl ReadProcessMemory TlsFree TlsAlloc TlsSetValue TlsGetValue SetLastError GetNativeSystemInfo GetSystemTimes GetProcessTimes GetFileAttributesExW CompareFileTime GetSystemInfo LoadLibraryExA UnlockFileEx LockFileEx GetFileSizeEx ReadFile CompareStringW DeleteProcThreadAttributeList GetThreadId WriteFile CreateDirectoryW ExpandEnvironmentStringsW SetFileAttributesW CopyFileW GetDiskFreeSpaceExW K32GetMappedFileNameW GetWindowsDirectoryW FindFirstVolumeW QueryDosDeviceW FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose GlobalMemoryStatusEx QueryPerformanceCounter WaitForMultipleObjects GetStartupInfoW InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter WakeAllConditionVariable SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive InitOnceComplete InitOnceBeginInitialize AllocConsole AttachConsole Sleep FreeConsole SetConsoleCtrlHandler CloseHandle GetCurrentProcessId GetPrivateProfileStringW RaiseException GetTickCount64 GetExitCodeThread GetCurrentThreadId VirtualProtect VirtualQuery IsBadReadPtr GetModuleHandleA IsBadCodePtr GetProcessHeap GetCommandLineW HeapSetInformation GetModuleFileNameW GetSystemTimeAsFileTime WideCharToMultiByte SetDllDirectoryW LoadLibraryExW GetModuleHandleW GetProcAddress LoadLibraryA GetLastError MultiByteToWideChar

user32

PeekMessageW IsHungAppWindow RegisterPowerSettingNotification UnregisterDeviceNotification UnregisterPowerSettingNotification SendMessageCallbackW GetGUIThreadInfo GetSystemMetrics GetClassInfoExW RegisterClassExW RegisterDeviceNotificationW

advapi32

CryptReleaseContext CryptGenRandom CryptAcquireContextW RegDeleteTreeW RegDeleteKeyExW RegQueryInfoKeyW FreeSid EqualSid AllocateAndInitializeSid ImpersonateSelf AdjustTokenPrivileges LookupPrivilegeValueW StartServiceW QueryServiceStatus OpenThreadToken GetTokenInformation CheckTokenMembership DuplicateToken OpenProcessToken RevertToSelf CloseServiceHandle SetServiceStatus RegisterServiceCtrlHandlerExW ChangeServiceConfig2W QueryServiceConfig2W OpenServiceW OpenSCManagerW StartServiceCtrlDispatcherW RegSetValueExA RegDeleteKeyA RegEnumValueA RegQueryInfoKeyA RegEnumKeyExA RegOpenKeyExA RegQueryValueExA RegCreateKeyExA RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegSetValueExW RegCloseKey RegQueryValueExW RegOpenKeyExW

ole32

CoUninitialize CoTaskMemFree CoInitializeEx

msvcp140

?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z _Query_perf_frequency _Query_perf_counter ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ?id@?$collate@_W@std@@2V0locale@2@A _Wcsxfrm _Wcscoll ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z _Cnd_do_broadcast_at_thread_exit _Thrd_id ?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z _Thrd_join _Thrd_detach ?_Xinvalid_argument@std@@YAXPEBD@Z ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z ?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEB_W_J@Z ?fail@ios_base@std@@QEBA_NXZ _Mbrtowc ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?classic@locale@std@@SAAEBV12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$numpunct@D@std@@2V0locale@2@A ?id@?$ctype@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z _Mtx_lock _Mtx_unlock ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBADD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ??Bid@locale@std@@QEAA_KXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?good@ios_base@std@@QEBA_NXZ ?uncaught_exceptions@std@@YAHXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?id@?$numpunct@_W@std@@2V0locale@2@A ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??Bios_base@std@@QEBA_NXZ ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?id@?$ctype@_W@std@@2V0locale@2@A ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?eof@ios_base@std@@QEBA_NXZ

powrprof

CallNtPowerInformation

vcruntime140_1

__CxxFrameHandler4

vcruntime140

wcschr memset memchr __current_exception __current_exception_context __C_specific_handler_noexcept __std_type_info_compare __std_type_info_name strchr _CxxThrowException memcmp memcpy wcsstr wcsrchr __C_specific_handler __std_exception_destroy __std_exception_copy _purecall __std_terminate memmove

api-ms-win-crt-heap-l1-1-0

calloc free _callnewh malloc realloc _set_new_mode

api-ms-win-crt-math-l1-1-0

_set_FMA3_enable __setusermatherr _ldsign fmod floor ceil _isnan _fdsign _finite _dsign _get_FMA3_enable pow

api-ms-win-crt-runtime-l1-1-0

abort _crt_atexit _register_onexit_function _initialize_onexit_table _beginthreadex _c_exit _exit _seh_filter_exe _invalid_parameter_noinfo_noreturn _cexit _register_thread_local_exe_atexit_callback terminate _initterm _initterm_e exit _errno _invalid_parameter_noinfo _get_wide_winmain_command_line _set_app_type _initialize_wide_environment _configure_wide_argv

api-ms-win-crt-string-l1-1-0

wcsncpy_s isspace ispunct strcpy_s wcscpy_s wcsncmp wcscat_s _wcsnicmp wcsncat_s _stricmp wcsncpy _wcsicmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswscanf _set_fmode __p__commode __stdio_common_vswprintf __stdio_common_vswprintf_s __stdio_common_vsprintf

api-ms-win-crt-convert-l1-1-0

_wtoi _ecvt_s wcstoll _wtoi64 wcstoul wcstol wcstod

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

aswcmnos

cmnosMiniInit

Name

.text

Size

605KB

Virtual Size

604KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

288KB

Virtual Size

288KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

NortonUI.exe

IMPHASH a86d28f652fdd10b5839b47b0255ea4d
SHA256 c3bc51c3331b775ec25be8aa9f134e58659fc23840d7dd73170c52df730e643d
MD5 a1e70ce1a3a57c9f8c39a7eada6ecbe9
SHA1 89f43720b9ede5dee2d817f783fe3006111fc0db
SHA512 4ed6431beb65e69d6cd2c5cd18e7fd94dace030498a6f141f6db7fdbe77f7a5723a503fc9b2eff27ec9806118b6c4f9546b21267810474cf0733c0d257810e9e
SSDEEP 393216:dgyAHupB8mvjD0jIiqtIBoZ4c/XbQqGTyqsWgZ5:uV2h
TLSH
T1BA37390EBA6901E0C1EED4BC8657652ADF307CA107289BDB6DE1BD560FA79F15E39300
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

a1:c0:2c:a8:c5:e0:47:68:de:4a:7d:67:eb:fd:ce:57:45:26:0b:09:b0:46:94:06:19:89:1a:23:62:9a:f3:a5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Chains

Apr 15, 2026

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Serial Number

40:1c:57:14:6d:ce:58:df:b9:22:21:87:8d:2a:a5:63

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2025 - Jun 10, 2028

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

10052816

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\AvastUI.pdb

aavmrpch

AavmRpcTimeCheckFix AavmRpcSubmitFile AavmRpcCreateBinding AavmRpcGetProviderInfoList AavmRpcDestroyBinding AavmRpcPasswordCheck AavmRpcIsPasswordEmpty AavmRpcSetTaskProperty AavmRpcSetTaskPropertyInt AavmRpcAutoSnxToasterResult AavmRpcRemDeserializeToJson AavmRpcSetProperty AavmRpcStringDecrypt AavmRpcSetPropertyInt AavmRpcSetProviderProperty AavmRpcSetProviderPropertyInt AavmRpcSetConnectorSessionId AavmRpcIsProductExpired AavmRpcCreateTask AavmRpcCreateTaskAccordingParam AavmRpcDeleteTask AavmRpcForceDeleteTask AavmRpcCopyTaskDefinition AavmRpcAddCounter AavmRpcChangeExcludedHash AavmRpcRegisterRestartableProcess AavmRpcUnregisterRestartableProcess AavmRpcImexExportSettings AavmRpcIdpScanWallets AavmRpcIdpGetDefaultProtectedPaths AavmRpcIdpCanBePathProtected AavmRpcImexImportSettings AavmRpcImexUnpackPackage AavmRpcSwitchToFree AavmRpcAlphaInsertLicenseFile AavmRpcGetRootKey AavmRpcSetProxySettings AavmRpcBtsSchedule AavmRpcNetAlert AavmRpcGetMailCertificate AavmRpcHttpGet AavmRpcRunComponent AavmRpcProviderStop AavmRpcProviderStart AavmRpcUpdateSessionFlags AavmRpcUpdateScanFlagsByRowId AavmRpcUpdateScanFlags AavmRpcUpdateScanResult AavmRpcDeleteSessionType AavmRpcDeleteSession AavmRpcControlFirewallService AavmRpcAdminActivateLicense AavmRpcAdminConnectionTest AavmRpcAdminServiceTest AavmRpcSafeZoneBrowserStartNg AavmRpcSafeZoneBrowserUiSvcCommand AavmRpcNgUserSessionSetLastInputTime AavmRpcNgUserSessionNotification AavmRpcAutoSnxKillSandboxedGroup AavmRpcBccExecuteCommand AavmRpcRestoredFromChest AavmRpcIsPathSDProtected AavmRpcIdpChestControl AavmRpcTransferDataBlock AavmRpcResetToFactorySettings AavmRpcRunSystemComponent AavmRpcDisableSelfDefense

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

crypt32

CryptStringToBinaryA CryptVerifyTimeStampSignature CryptMemFree CertFindCertificateInStore PFXImportCertStore CryptDecodeObjectEx CertFreeCRLContext CertCreateCertificateContext CertFreeCTLContext CertFindExtension CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertFreeCertificateContext CertEnumCertificatesInStore CertDeleteCertificateFromStore CertCloseStore CryptProtectData CryptUnprotectData CertAddEncodedCertificateToStore CryptBinaryToStringA CertOpenStore CertAddCertificateContextToStore

dnsapi

DnsFree DnsQuery_W

advapi32

ImpersonateLoggedOnUser EventWriteTransfer SetThreadToken EventRegister RegDeleteKeyW RegCreateKeyExW StartServiceW QueryServiceStatusEx RegOpenCurrentUser CryptGenRandom RegOpenKeyExA SetEntriesInAclW ConvertSidToStringSidW LookupAccountNameW IsValidSid GetAce GetLengthSid GetSecurityDescriptorOwner RegOpenKeyExW RegQueryValueExW RegCloseKey RegOpenKeyW RegQueryInfoKeyW RegEnumKeyExW EventUnregister AccessCheck GetSecurityDescriptorDacl GetFileSecurityW CryptReleaseContext CryptDestroyHash CryptGetHashParam CryptHashData CryptCreateHash CryptAcquireContextW GetSecurityInfo AdjustTokenPrivileges LookupPrivilegeValueW ImpersonateSelf OpenThreadToken FreeSid EqualSid AllocateAndInitializeSid RegEnumValueW LookupAccountSidW GetTokenInformation OpenProcessToken CloseServiceHandle QueryServiceConfigW OpenServiceW OpenSCManagerW SetFileSecurityW RegSetValueExW GetUserNameW SetSecurityDescriptorDacl InitializeSecurityDescriptor RegNotifyChangeKeyValue ConvertStringSecurityDescriptorToSecurityDescriptorW RevertToSelf RegEnumKeyExA RegQueryValueExA SystemFunction036 CryptAcquireContextA RegEnumKeyW RegDeleteTreeW RegDeleteKeyExW RegOpenUserClassesRoot RegQueryMultipleValuesW ConvertStringSidToSidW TreeSetNamedSecurityInfoW SetNamedSecurityInfoW GetSecurityDescriptorControl GetSecurityDescriptorGroup EnumServicesStatusW ControlService QueryServiceStatus CreateProcessAsUserW SetTokenInformation CheckTokenMembership DuplicateToken DuplicateTokenEx AddAccessAllowedAce InitializeAcl SetSecurityInfo RegDeleteValueW ConvertSecurityDescriptorToStringSecurityDescriptorW RegGetValueW

wininet

InternetOpenW InternetSetOptionW InternetCanonicalizeUrlW InternetCloseHandle InternetCrackUrlW HttpOpenRequestW HttpSendRequestW InternetConnectW

shell32

SHGetFolderPathW SHChangeNotify ShellExecuteExW SHParseDisplayName ord51 SHGetSpecialFolderLocation SHGetKnownFolderPath SHQueryUserNotificationState SHAppBarMessage SHGetDesktopFolder SHCreateItemFromParsingName ord165 SHGetFileInfoW Shell_NotifyIconGetRect Shell_NotifyIconW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteW ord190 SHOpenFolderAndSelectItems SHGetMalloc SHGetFolderPathA CommandLineToArgvW ord155

ntdll

RtlEqualUnicodeString RtlDeleteCriticalSection RtlLeaveCriticalSection VerSetConditionMask RtlDllShutdownInProgress NtSystemDebugControl RtlLookupFunctionEntry RtlPrefixUnicodeString NtQueryDirectoryFile RtlCompareMemory NtClose NtOpenFile RtlVirtualUnwind NtCreateWorkerFactory RtlIsDosDeviceName_U RtlEnterCriticalSection RtlAllocateHeap NtQueryInformationProcess RtlInitializeCriticalSection RtlFreeHeap RtlNtStatusToDosError RtlSetLastWin32Error RtlInitUnicodeString RtlCaptureContext NtDeleteKey NtQueryKey NtOpenKey NtSetInformationThread NtQueryInformationWorkerFactory NtQuerySystemInformation RtlDosPathNameToNtPathName_U

ws2_32

ntohs gethostname getservbyname __WSAFDIsSet FreeAddrInfoW WSAIoctl setsockopt recv WSAStartup WSACleanup WSAAddressToStringW getsockname ioctlsocket WSASetLastError WSAWaitForMultipleEvents getsockopt WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent GetAddrInfoW recvfrom socket htons bind htonl connect shutdown WSAGetLastError closesocket inet_ntop ntohl FreeAddrInfoExW GetAddrInfoExW InetNtopW InetPtonW send sendto select

rpcrt4

RpcServerUnregisterIf RpcServerRegisterIf2 RpcMgmtStopServerListening NdrServerCall2 NdrServerCallAll I_RpcBindingInqLocalClientPID RpcStringBindingComposeW RpcBindingFromStringBindingW RpcStringFreeW RpcBindingFree RpcSsDestroyClientContext NdrClientCall3 RpcStringBindingComposeA RpcBindingFromStringBindingA RpcServerUseProtseqEpW RpcStringFreeA RpcBindingSetAuthInfoExA RpcAsyncInitializeHandle RpcAsyncCancelCall UuidToStringW RpcServerListen RpcStringBindingParseW UuidFromStringW Ndr64AsyncClientCall RpcAsyncCompleteCall UuidCreate

shlwapi

SHStrDupW PathFileExistsW PathFindFileNameW ord487 ord12 PathAppendW AssocQueryStringW PathMatchSpecW

setupapi

SetupDiGetDeviceInstanceIdW SetupDiEnumDeviceInfo SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyW

ashtask

?aswCloseQuery@@YAKPEAX@Z ?aswGetTaskProperty@@YAKPEB_W0PEA_W_K@Z tskPackerBits ?aswGetNextTask2@@YAKPEAXPEA_WK@Z ?aswGetFirstTask@@YAKPEAPEAXPEA_WK1K@Z tskCreateFriendFileName ARConstructListFromString tskChangeExcludedHash ?aswGetTaskPropertyInt@@YAKPEB_W0PEAH@Z ARDeconstructListFromString tskFriendlyShieldName tskGetPropertyFromFalsePositiveSubmit

aswengldr

avldrUpdatedDefsAvailable uiextFilterUrl2 uiextProcessCmd uiextEventDone avldrCloseModule avlicGetLockData avldrLoadModule avldrCreateHandle uiextPollEvent

aswaux

??0IaswObjectList@@QEAA@PEB_W0@Z ?EnumObjects@IaswObjectList@@QEAAPEAVIaswObject@@AEAPEAX@Z ?GetValue@IaswObject@@QEBA_NPEB_WPEA_W_K0@Z ?DeleteValue@IaswObject@@QEAAXPEB_W@Z ??1IaswObjectList@@QEAA@XZ ?EnumElements@IaswObject@@QEAA_NAEAPEAXPEA_W_KAEAW4aswElementType@1@@Z ?FreeValue@IaswObject@@QEBAXPEA_W@Z ?GetValue@IaswObject@@QEBA_NPEB_WPEAPEA_W0@Z ??1IaswObject@@QEAA@XZ

comctl32

ImageList_GetIconSize ImageList_Destroy ImageList_Draw ord17 InitCommonControlsEx ImageList_AddMasked ImageList_Create

mpr

WNetGetConnectionW

ashbase

notAddEventId notFree notInit basSubmitPropertyArrayToString notEvent basEmptyAvastTempFolder basGetErrorString basFreeLibrary notEventId notRemEvent basInitLibrary

netapi32

NetUserGetInfo NetGetDCName NetLocalGroupEnum NetApiBufferFree NetUserEnum

iphlpapi

CancelMibChangeNotify2 GetNetworkParams IcmpSendEcho GetAdaptersAddresses GetUnicastIpAddressTable GetIfTable2Ex GetIfEntry2 FreeMibTable GetBestRoute2 GetIpForwardTable2 IcmpCloseHandle IcmpCreateFile IcmpSendEcho2Ex Icmp6CreateFile Icmp6SendEcho2

user32

PeekMessageW SetWindowPos SetWindowLongPtrW DefWindowProcW GetWindowLongPtrW MessageBoxW SendMessageW SetWindowRgn GetClientRect MoveWindow GetWindowRect SystemParametersInfoW EndDialog NotifyWinEvent GetSystemMetrics wsprintfW GetActiveWindow SetTimer PostQuitMessage SetForegroundWindow DispatchMessageW TranslateMessage GetMessageW EnableWindow GetParent GetWindow IsWindow LoadStringW OpenClipboard GetClipboardData MsgWaitForMultipleObjects CloseClipboard DrawTextW GetSysColor CreateDialogParamW DestroyWindow GetDlgItem SendDlgItemMessageW SetFocus ShowWindow GetWindowTextLengthW GetWindowTextW FillRect InflateRect GetFocus SetWindowTextW DrawIcon EnumWindows RegisterWindowMessageW GetWindowThreadProcessId IsGUIThread CharLowerW GetDesktopWindow MonitorFromPoint GetLastInputInfo SendInput GetAsyncKeyState UnregisterClassW OffsetRect GetMonitorInfoW IntersectRect LoadBitmapW RegisterClassExW CreateWindowExW DestroyMenu LoadMenuW SetParent SetMenuDefaultItem TrackPopupMenu AllowSetForegroundWindow OpenInputDesktop SetThreadDesktop CloseDesktop ExitWindowsEx ReleaseDC InvalidateRect DialogBoxParamW SetWindowLongW FrameRect MapWindowPoints SetDlgItemTextW ScreenToClient GetDC GetMessagePos GetKeyboardLayoutList GetKeyboardLayout DestroyIcon InSendMessage MonitorFromWindow GetWindowRgn EqualRect EnumChildWindows PostThreadMessageW SetWinEventHook UnhookWinEvent GetClassNameW FindWindowW ActivateKeyboardLayout GetKeyboardLayoutNameW WaitForInputIdle IsHungAppWindow SendMessageTimeoutW PostMessageW SendMessageCallbackW GetGUIThreadInfo EndPaint BeginPaint GetCursorPos TrackMouseEvent OpenDesktopW CreateDesktopW SetClipboardData SwitchDesktop SendNotifyMessageW GetKeyState CopyRect EnumDesktopWindows GetWindowPlacement CopyImage GetCapture AdjustWindowRectEx DefDlgProcW keybd_event IsDialogMessageW GetDlgCtrlID UpdateWindow MonitorFromRect PtInRect RedrawWindow SetRect UnionRect RegisterClassW GetClassInfoExW LoadImageW LoadIconW GetProcessWindowStation GetUserObjectInformationW GetThreadDesktop FindWindowExW IsWindowVisible IsWindowEnabled ModifyMenuW DeleteMenu EnableMenuItem GetSubMenu GetMenuItemID CheckMenuItem InsertMenuW GetWindowLongW SetCursor LoadCursorW GetForegroundWindow CallWindowProcW GetPropW GetAncestor SetPropW EnumDisplayMonitors IsIconic CloseWindow KillTimer ReleaseCapture

ole32

CoTaskMemAlloc PropVariantClear CLSIDFromString StringFromGUID2 OleRun IIDFromString CoTaskMemFree CoInitialize OleUninitialize OleInitialize CoInitializeSecurity CoUninitialize CoCreateInstance CoInitializeEx

oleaut32

SafeArrayCreate SafeArrayLock SafeArrayDestroy LoadTypeLi GetErrorInfo SysAllocStringLen SysAllocString SysStringLen SysFreeString VariantTimeToDosDateTime SafeArrayUnlock VariantInit VariantClear

aswip

?names_from_address@dnsapi@ip@@SAKAEBVaddr@2@AEAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@K@Z ?ping@hlpapi@ip@@SAKVsaddr@2@AEAU_SPingReply@12@EKGEH@Z ?load@hlpapi@ip@@QEAAKXZ ?free@hlpapi@ip@@QEAAKXZ ?getaddrinfo@winsock2@ip@@SAKPEB_WAEAV?$vector@Vaddr@ip@@V?$allocator@Vaddr@ip@@@std@@@std@@0PEAUaddrinfoW@@@Z ?init@dnsapi@ip@@QEAAKXZ ?free@dnsapi@ip@@QEAAKXZ ?free@lib@ip@@QEAAKXZ

winhttp

WinHttpConnect WinHttpSetTimeouts WinHttpOpen WinHttpOpenRequest WinHttpReadData WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpReceiveResponse WinHttpWriteData WinHttpSendRequest WinHttpSetCredentials WinHttpAddRequestHeaders WinHttpSetOption WinHttpCloseHandle WinHttpQueryOption WinHttpGetDefaultProxyConfiguration WinHttpSetStatusCallback WinHttpGetIEProxyConfigForCurrentUser WinHttpQueryHeaders WinHttpGetProxyForUrl

libcrypto-3-x64

X509_STORE_CTX_verify X509_get_serialNumber X509_CRL_get_REVOKED PEM_write_bio_PUBKEY BIO_new_mem_buf d2i_X509_CRL_bio ASN1_STRING_length X509_get_ext_d2i X509_STORE_CTX_new BN_bn2dec PEM_write_bio_X509 d2i_X509 BIO_ctrl X509_free BIO_s_mem BIO_new BIO_free_all AES_cbc_encrypt X509_STORE_CTX_init EVP_DigestInit OPENSSL_sk_pop_free ASN1_STRING_get0_data DIST_POINT_free BIO_write EVP_PKEY_free OPENSSL_sk_value OPENSSL_sk_push EVP_MD_CTX_free AES_set_decrypt_key AES_set_encrypt_key PKCS5_PBKDF2_HMAC_SHA1 HMAC_Final HMAC_Update EVP_sha512 EVP_sha256 EVP_sha1 HMAC_Init_ex HMAC_CTX_new HMAC_CTX_free RAND_bytes HMAC SHA512_Final SHA256_Final SHA1_Final SHA512_Update SHA256_Update SHA1_Update SHA512_Init SHA256_Init SHA1_Init CRYPTO_free PEM_read_bio_PrivateKey X509_STORE_CTX_set_time X509_CRL_free PEM_read_bio_X509 ASN1_INTEGER_to_BN X509_NAME_ENTRY_get_data GENERAL_NAME_get0_value BN_is_zero EVP_DigestUpdate X509_STORE_CTX_get_error BN_free X509_get_pubkey OPENSSL_sk_new_null ASN1_INTEGER_cmp X509_STORE_new X509_STORE_CTX_free X509_REVOKED_get0_serialNumber PEM_read_bio_PUBKEY OPENSSL_sk_num X509_STORE_add_cert EVP_VerifyFinal EVP_MD_CTX_new X509_STORE_free RAND_seed

aswcmnis

GetKeyData sha256Init sha256Update sha256Final DSAVerifySignature ECDSAVerifySignature cyphSimpleCode

aswcmnos

dep_csWait dep_csCreate dep_csDelete dep_strNormalToUnicode dep_osGetCpuCount dep_secGetPublicSecurity dep_fsExistFile dep_csRelease dep_strNormalToNewUnicode dep_strFreeString dep_fsExtractDriveRoot dep_osGetWinVer dep_fsOpenFileX dep_fsGetFileSizeHandle dep_fsCloseFile dep_fsWriteFile dep_fsDeleteFileX cmnosMiniInit dep_fsReadFile

aswcmnbs

?GetTempFile@CStr@root@asw@@QEAAKPEAK@Z DSA_FileVerify fsGetAvastSumpPath fsGetAvastTempFileName fsGetAvastDataPath GetProgramModulePath secIsSelfDefenseEnabled secIsUiProtectionEnabled aswcmnbsDllMain cmnbInit cmnbFree DSA_BlockVerify sha256GenerateFromName secCreateSharedMutex secOpenSharedEvent secIsProcessTrusted GetFileSignatureDetails secSetObjectProtection ?_InitFile@CGenericFile@root@asw@@AEAAXXZ ?_Close@CGenericFile@root@asw@@AEAAKXZ ?InitTempFile@CGenericFile@root@asw@@QEAAKKPEB_WPEAKK@Z ?writein@CGenericFile@root@asw@@QEAA_NPEBX_K@Z ?DeleteFileW@CGenericFile@root@asw@@QEAAK_N0@Z fsGetAvastLogPath fsSetAvastJournalPath GetHardwareIdEx secIsAswSP secCreateSharedEvent secPreventHookDllInjection secIsNamedPipeClientTrusted GetHardwareId secGetProcessTrustLevel secIsRpcClientTrusted fsGetAvastProgramPath

bcrypt

BCryptGenRandom BCryptDeriveKey BCryptCloseAlgorithmProvider BCryptDestroyKey BCryptDestroySecret BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptSecretAgreement BCryptSetProperty BCryptImportKeyPair BCryptGenerateKeyPair BCryptFinalizeKeyPair BCryptExportKey BCryptEncrypt

protobuf

?GetInt64@Reflection@protobuf@google@@QEBA_JAEBVMessage@23@PEBVFieldDescriptor@23@@Z ?GetBool@Reflection@protobuf@google@@QEBA_NAEBVMessage@23@PEBVFieldDescriptor@23@@Z ?GetString@Reflection@protobuf@google@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBVMessage@23@PEBVFieldDescriptor@23@@Z ?message_type@FieldDescriptor@protobuf@google@@QEBAPEBVDescriptor@23@XZ ?MutableMessage@Reflection@protobuf@google@@QEBAPEAVMessage@23@PEAV423@PEBVFieldDescriptor@23@PEAVMessageFactory@23@@Z ?AddString@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?AddInt32@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@H@Z ?AddInt64@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@_J@Z ?AddBool@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@_N@Z ?GetRepeatedString@Reflection@protobuf@google@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBVMessage@23@PEBVFieldDescriptor@23@H@Z ?GetRepeatedBool@Reflection@protobuf@google@@QEBA_NAEBVMessage@23@PEBVFieldDescriptor@23@H@Z ?GetRepeatedInt64@Reflection@protobuf@google@@QEBA_JAEBVMessage@23@PEBVFieldDescriptor@23@H@Z ?GetRepeatedInt32@Reflection@protobuf@google@@QEBAHAEBVMessage@23@PEBVFieldDescriptor@23@H@Z ?FieldSize@Reflection@protobuf@google@@QEBAHAEBVMessage@23@PEBVFieldDescriptor@23@@Z ?ListFields@Reflection@protobuf@google@@QEBAXAEBVMessage@23@PEAV?$vector@PEBVFieldDescriptor@protobuf@google@@V?$allocator@PEBVFieldDescriptor@protobuf@google@@@std@@@std@@@Z ?MergePartialFromCodedStream@MessageLite@protobuf@google@@QEAA_NPEAVCodedInputStream@io@23@@Z ??1CodedInputStream@io@protobuf@google@@QEAA@XZ ?GetOwnedMessageInternal@internal@protobuf@google@@YAPEAVMessageLite@23@PEAVArena@23@PEAV423@0@Z ?Set@ArenaStringPtr@internal@protobuf@google@@QEAAX$$QEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAVArena@34@@Z ?MessageToJsonString@util@protobuf@google@@YA?AVStatus@status_internal@123@AEBVMessage@23@PEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBUJsonPrintOptions@123@@Z ?JsonStringToMessage@util@protobuf@google@@YA?AVStatus@status_internal@123@VStringPiece@stringpiece_internal@23@PEAVMessage@23@AEBUJsonParseOptions@123@@Z ?TypeOnceInit@FieldDescriptor@protobuf@google@@CAXPEBV123@@Z ?SetInt32@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@H@Z ?AllocateAlignedWithCleanup@Arena@protobuf@google@@AEAA?AU?$pair@PEAXPEAUCleanupNode@SerialArena@internal@protobuf@google@@@std@@_KPEBVtype_info@@@Z ?AllocateAlignedWithHook@Arena@protobuf@google@@AEAAPEAX_KPEBVtype_info@@@Z ?Mutable@ArenaStringPtr@internal@protobuf@google@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAVArena@34@@Z ??1ThreadSafeArena@internal@protobuf@google@@QEAA@XZ ?InitializationErrorString@MessageLite@protobuf@google@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?Destroy@ArenaStringPtr@internal@protobuf@google@@QEAAXXZ ?DoneFallback@EpsCopyInputStream@internal@protobuf@google@@AEAA?AU?$pair@PEBD_N@std@@HH@Z ?ReadTagFallback@internal@protobuf@google@@YA?AU?$pair@PEBDI@std@@PEBDI@Z ?VarintParseSlow64@internal@protobuf@google@@YA?AU?$pair@PEBD_K@std@@PEBDI@Z ?WriteVarint@internal@protobuf@google@@YAXI_KPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?InlineGreedyStringParser@internal@protobuf@google@@YAPEBDPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBDPEAVParseContext@123@@Z ?SetInt64@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@_J@Z ?SetBool@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@_N@Z ?SetString@Reflection@protobuf@google@@QEBAXPEAVMessage@23@PEBVFieldDescriptor@23@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?WriteStringMaybeAliasedOutline@EpsCopyOutputStream@io@protobuf@google@@AEAAPEAEIAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAE@Z ?ShutdownProtobufLibrary@protobuf@google@@YAXXZ ?SerializeToString@MessageLite@protobuf@google@@QEBA_NPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?end@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEBA?AV?$RepeatedPtrIterator@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@internal@23@XZ ?begin@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEBA?AV?$RepeatedPtrIterator@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@internal@23@XZ ?ParseFromString@MessageLite@protobuf@google@@QEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SerializeAsString@MessageLite@protobuf@google@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?Get@?$RepeatedField@H@protobuf@google@@QEBAAEBHH@Z ?Add@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAAX$$QEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?AddVarint@UnknownFieldSet@protobuf@google@@QEAAXH_K@Z ?data@?$RepeatedField@H@protobuf@google@@QEBAPEBHXZ ?WriteStringOutline@EpsCopyOutputStream@io@protobuf@google@@AEAAPEAEIAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAE@Z ?MergeFrom@?$RepeatedField@H@protobuf@google@@QEAAXAEBV123@@Z ?MergeFrom@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAAXAEBV123@@Z ?Int32Size@WireFormatLite@internal@protobuf@google@@SA_KAEBV?$RepeatedField@H@34@@Z ?VarintParseSlow32@internal@protobuf@google@@YA?AU?$pair@PEBDI@std@@PEBDI@Z ?PackedInt32Parser@internal@protobuf@google@@YAPEBDPEAXPEBDPEAVParseContext@123@@Z ?SerializeToArray@MessageLite@protobuf@google@@QEBA_NPEAXH@Z ??0?$RepeatedField@H@protobuf@google@@QEAA@PEAVArena@12@@Z ??0?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAA@PEAVArena@12@@Z ??0?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAA@AEBV012@@Z ??1?$RepeatedField@H@protobuf@google@@QEAA@XZ ??1?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAA@XZ ?Add@?$RepeatedField@H@protobuf@google@@QEAAXAEBH@Z ?Clear@?$RepeatedField@H@protobuf@google@@QEAAXXZ ?size@?$RepeatedField@H@protobuf@google@@QEBAHXZ ?Add@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?Get@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z ?AddOutOfLineHelper@RepeatedPtrFieldBase@internal@protobuf@google@@AEAAPEAXPEAX@Z ?Set@ArenaStringPtr@internal@protobuf@google@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAVArena@34@@Z ?GetInt32@Reflection@protobuf@google@@QEBAHAEBVMessage@23@PEBVFieldDescriptor@23@@Z ?EnsureSpaceFallback@EpsCopyOutputStream@io@protobuf@google@@AEAAPEAEPEAE@Z ??1ZeroFieldsBase@internal@protobuf@google@@MEAA@XZ ?CopyImpl@ZeroFieldsBase@internal@protobuf@google@@KAXAEAVMessage@34@AEBV534@@Z ?MergeImpl@ZeroFieldsBase@internal@protobuf@google@@KAXAEAVMessage@34@AEBV534@@Z ?Clear@ZeroFieldsBase@internal@protobuf@google@@UEAAXXZ ?ByteSizeLong@ZeroFieldsBase@internal@protobuf@google@@UEBA_KXZ ?_InternalParse@ZeroFieldsBase@internal@protobuf@google@@UEAAPEBDPEBDPEAVParseContext@234@@Z ?_InternalSerialize@ZeroFieldsBase@internal@protobuf@google@@UEBAPEAEPEAEPEAVEpsCopyOutputStream@io@34@@Z ?ReadSizeFallback@internal@protobuf@google@@YA?AU?$pair@PEBDH@std@@PEBDI@Z ?Next@EpsCopyInputStream@internal@protobuf@google@@AEAAPEBDXZ ?ClearToDefault@ArenaStringPtr@internal@protobuf@google@@QEAAXAEBVLazyString@234@PEAVArena@34@@Z ?Mutable@ArenaStringPtr@internal@protobuf@google@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBVLazyString@234@PEAVArena@34@@Z ?Clear@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAAXXZ ?size@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEBAHXZ ?ClearFallback@UnknownFieldSet@protobuf@google@@AEAAXXZ ?MergeFrom@UnknownFieldSet@protobuf@google@@QEAAXAEBV123@@Z ?AssignDescriptors@internal@protobuf@google@@YA?AUMetadata@23@P6APEBUDescriptorTable@123@XZPEAUonce_flag@std@@AEBU423@@Z ?CopyWithSourceCheck@Message@protobuf@google@@KAXAEAV123@AEBV123@@Z ?MaybeComputeUnknownFieldsSize@Message@protobuf@google@@IEBA_K_KPEAVCachedSize@internal@23@@Z ?UnknownFieldParse@internal@protobuf@google@@YAPEBDIPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBDPEAVParseContext@123@@Z ?FindFieldByNumber@Descriptor@protobuf@google@@QEBAPEBVFieldDescriptor@23@H@Z ?InternalSerializeUnknownFieldsToArray@WireFormat@internal@protobuf@google@@SAPEAEAEBVUnknownFieldSet@34@PEAEPEAVEpsCopyOutputStream@io@34@@Z ?UnknownFieldParse@internal@protobuf@google@@YAPEBD_KPEAVUnknownFieldSet@23@PEBDPEAVParseContext@123@@Z ??0AssignDescriptorsRunner@internal@protobuf@google@@QEAA@PEBUDescriptorTable@123@@Z ?GetTypeName@Message@protobuf@google@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?Clear@Message@protobuf@google@@UEAAXXZ ?IsInitialized@Message@protobuf@google@@UEBA_NXZ ?InitializationErrorString@Message@protobuf@google@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?CheckTypeAndMergeFrom@Message@protobuf@google@@UEAAXAEBVMessageLite@23@@Z ?ByteSizeLong@Message@protobuf@google@@UEBA_KXZ ?_InternalParse@Message@protobuf@google@@UEAAPEBDPEBDPEAVParseContext@internal@23@@Z ?_InternalSerialize@Message@protobuf@google@@UEBAPEAEPEAEPEAVEpsCopyOutputStream@io@23@@Z ?MergeFrom@Message@protobuf@google@@UEAAXAEBV123@@Z ?SpaceUsedLong@Message@protobuf@google@@UEBA_KXZ ?InternalExtend@RepeatedPtrFieldBase@internal@protobuf@google@@AEAAPEAPEAXH@Z ??$DoClear@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@InternalMetadata@internal@protobuf@google@@AEAAXXZ ??$DoMergeFrom@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@InternalMetadata@internal@protobuf@google@@AEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?DestroyProtos@RepeatedPtrFieldBase@internal@protobuf@google@@IEAAXXZ ?InternalWriteMessage@WireFormatLite@internal@protobuf@google@@SAPEAEHAEBVMessageLite@34@HPEAEPEAVEpsCopyOutputStream@io@34@@Z ?ParseMessage@ParseContext@internal@protobuf@google@@QEAAPEBDPEAVMessageLite@34@PEBD@Z ?WriteRawFallback@EpsCopyOutputStream@io@protobuf@google@@AEAAPEAEPEBXHPEAE@Z

dll_loader

?load_dll@dll_loader@asw@@YAPEAUHINSTANCE__@@PEB_W0@Z ?free_dll@dll_loader@asw@@YA_NPEAUHINSTANCE__@@@Z

gdi32

GetTextAlign SetTextAlign AddFontResourceExW DeleteObject CreateSolidBrush CreatePen CreateFontW SetBkMode SetTextColor GetStockObject CreateCompatibleDC CreateCompatibleBitmap SelectObject RoundRect BitBlt DeleteDC MoveToEx GetObjectW LineTo CreateRectRgn GetRgnBox GetDIBits CreatePatternBrush PatBlt GetTextExtentPointW CreateRoundRectRgn AddFontResourceW CreateBitmap SetBitmapBits GetBitmapBits SetPixel GetDeviceCaps CreateFontIndirectW StretchBlt GetTextExtentPoint32W RemoveFontResourceW

dwmapi

DwmSetWindowAttribute

wtsapi32

WTSFreeMemory WTSQueryUserToken WTSQuerySessionInformationW WTSEnumerateSessionsW

kernel32

InitOnceExecuteOnce WerUnregisterMemoryBlock AcquireSRWLockExclusive ReleaseSRWLockExclusive LoadLibraryExA FlushFileBuffers GlobalAddAtomW WerRegisterMemoryBlock MapViewOfFile GlobalDeleteAtom CreateNamedPipeW ConnectNamedPipe GetQueuedCompletionStatus DisconnectNamedPipe ReadDirectoryChangesW WaitNamedPipeW K32GetProcessImageFileNameW GetTimeFormatW AreFileApisANSI GetFileInformationByHandleEx ReleaseSRWLockShared AcquireSRWLockShared SleepConditionVariableSRW InitOnceBeginInitialize GetDateFormatW K32EnumProcessModules MulDiv GetThreadLocale FreeResource FindResourceExW LocalUnlock GetFullPathNameW CancelIoEx GetOverlappedResult CreateFileMappingW UnlockFile UnmapViewOfFile InitOnceComplete GetSystemTimes ReadProcessMemory CreateIoCompletionPort GetProcessHandleCount K32GetProcessMemoryInfo GetThreadTimes K32EnumProcesses GetThreadPriority OpenThread GetPriorityClass QueryFullProcessImageNameW VirtualQuery RemoveVectoredExceptionHandler AddVectoredExceptionHandler SetUnhandledExceptionFilter InitializeSListHead UnhandledExceptionFilter GetStartupInfoW SetErrorMode RaiseException FlushInstructionCache VirtualProtect CheckRemoteDebuggerPresent UpdateProcThreadAttribute InitializeProcThreadAttributeList SetEnvironmentVariableW GetProcessId SleepEx FindNextVolumeW FindVolumeClose FindFirstVolumeW GlobalFree GetEnvironmentVariableW OutputDebugStringA CreateSemaphoreExW CreateMutexExW OpenSemaphoreW SetThreadLocale SetThreadAffinityMask CreateSemaphoreW IsProcessorFeaturePresent CreateFileA GetVersionExW CreatePipe GetVolumePathNameW GetSystemDefaultLCID GetTimeZoneInformation K32GetModuleFileNameExW OpenProcess FileTimeToLocalFileTime LCMapStringW LocalFileTimeToFileTime SetFilePointerEx GetSystemTime LCIDToLocaleName GetFullPathNameA GetVersionExA CreateDirectoryA GetCurrentDirectoryW SystemTimeToFileTime GetFileType DuplicateHandle GetFileInformationByHandle WritePrivateProfileStringW CancelIo RemoveDirectoryW SetFileAttributesW FindFirstFileExW SetThreadPriority GetTempFileNameW ExpandEnvironmentStringsW CopyFileW WTSGetActiveConsoleSessionId GetComputerNameW VirtualFree VirtualAlloc GetLogicalDriveStringsW GetVolumePathNamesForVolumeNameW GetVolumeNameForVolumeMountPointW GetPrivateProfileStringW GetLongPathNameW GetTempPathW GetUserGeoID GetGeoInfoW GetUserDefaultUILanguage GetSystemDefaultUILanguage GetNativeSystemInfo CreateWaitableTimerA GetModuleHandleA GetSystemInfo TlsFree TlsSetValue TlsGetValue TlsAlloc OpenEventA WaitForMultipleObjectsEx WaitForSingleObjectEx ReleaseSemaphore QueryPerformanceFrequency QueryPerformanceCounter CreateEventA LocalAlloc GetUserDefaultLCID ReleaseMutex ResumeThread GetProcessIdOfThread FindCloseChangeNotification FindNextChangeNotification FindFirstChangeNotificationW CreateMutexW ResetEvent CompareStringW GetProcessTimes LockResource LoadResource SizeofResource FindResourceW VerifyVersionInfoW GetCurrentThread GetExitCodeThread DebugBreak GetProcessHeap HeapAlloc TerminateThread PostQueuedCompletionStatus InitializeCriticalSectionEx WaitForMultipleObjects HeapFree GetModuleFileNameA SetEndOfFile WriteFile SetFilePointer GetFileSize GetLocalTime IsBadReadPtr GetUserDefaultLangID GetModuleFileNameW CreateThread SearchPathW LockFileEx UnlockFileEx LocalFree FormatMessageA FileTimeToSystemTime SystemTimeToTzSpecificLocalTime ReadFile GetFileSizeEx GlobalUnlock GlobalLock GetLocaleInfoEx GetShortPathNameW GetTickCount64 GetFileAttributesW RegisterWaitForSingleObject UnregisterWaitEx CompareFileTime GetFileAttributesExW GetUserDefaultLocaleName GetCommandLineW FindClose FindNextFileW FindFirstFileW GetSystemTimeAsFileTime DeleteFileW FreeLibrary GetTickCount TerminateProcess GlobalMemoryStatusEx CreateEventW LoadLibraryW SetProcessWorkingSetSize SetProcessShutdownParameters GetCurrentProcess SetDllDirectoryW InitializeCriticalSectionAndSpinCount Process32NextW Process32FirstW CreateToolhelp32Snapshot CreateProcessW GetLocaleInfoW SetWaitableTimer CreateWaitableTimerW SetLastError GetSystemDirectoryW GetWindowsDirectoryW DeviceIoControl CreateFileW GetDiskFreeSpaceExW QueryDosDeviceW GetVolumeInformationW GetDriveTypeW GetLogicalDrives CreateDirectoryW GetExitCodeProcess WaitForSingleObject Sleep InitializeCriticalSection QueryUnbiasedInterruptTime GetModuleHandleExW SetEvent OpenEventW IsDebuggerPresent FormatMessageW GetCurrentThreadId OutputDebugStringW GetCurrentProcessId ProcessIdToSessionId OpenMutexW CloseHandle WideCharToMultiByte DeleteCriticalSection EnterCriticalSection LeaveCriticalSection LoadLibraryExW GetModuleHandleW GetProcAddress LoadLibraryA GetLastError MultiByteToWideChar QueryThreadCycleTime DeleteProcThreadAttributeList GetThreadId SetHandleInformation DosDateTimeToFileTime MoveFileExW GetFinalPathNameByHandleW K32GetMappedFileNameW GetSystemDirectoryA MoveFileExA GetEnvironmentVariableA InitializeConditionVariable WakeAllConditionVariable ExpandEnvironmentStringsA UnregisterWait GetQueuedCompletionStatusEx SetFileCompletionNotificationModes GetStringTypeExW

comdlg32

GetSaveFileNameW GetOpenFileNameW

msvcp140

?toupper@?$ctype@_W@std@@QEBA_W_W@Z ?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@AEA_W@Z ?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?_Gninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??_7?$basic_ostream@_WU?$char_traits@_W@std@@@std@@6B@ ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z ?eof@ios_base@std@@QEBA_NXZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?_Random_device@std@@YAIXZ ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z _Strcoll _Strxfrm ?id@?$collate@D@std@@2V0locale@2@A ?_Xinvalid_argument@std@@YAXPEBD@Z ?id@?$collate@_W@std@@2V0locale@2@A _Wcscoll ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?id@?$ctype@_W@std@@2V0locale@2@A ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z _Wcsxfrm ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z _Query_perf_frequency ?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEB_W_J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z _Query_perf_counter ?id@?$numpunct@_W@std@@2V0locale@2@A ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?uncaught_exceptions@std@@YAHXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?_Syserror_map@std@@YAPEBDH@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z _Thrd_detach ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAG@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAN@Z ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@_N@Z ??0_Locinfo@std@@QEAA@HPEBD@Z ?_Getname@_Locinfo@std@@QEBAPEBDXZ ?_Makeloc@_Locimp@locale@std@@CAPEAV123@AEBV_Locinfo@3@HPEAV123@PEBV23@@Z ?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@PEBD4@Z ??0ctype_base@std@@QEAA@_K@Z ??1ctype_base@std@@UEAA@XZ ?_Getctype@_Locinfo@std@@QEBA?AU_Ctypevec@@XZ _Tolower _Toupper ?clear@ios_base@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@PEAV32@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?tellp@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@G@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z ?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z ??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ ?do_out@?$codecvt@_WDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ?pubimbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z ?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?pubsync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z _Cnd_do_broadcast_at_thread_exit _Thrd_join ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ??Bid@locale@std@@QEAA_KXZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ?tolower@?$ctype@D@std@@QEBADD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?c_str@?$_Yarn@D@std@@QEBAPEBDXZ _Mtx_unlock _Mtx_lock ?__ExceptionPtrDestroy@@YAXPEAX@Z ?_Xlength_error@std@@YAXPEBD@Z ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$numpunct@D@std@@2V0locale@2@A ?_Xbad_function_call@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?classic@locale@std@@SAAEBV12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Throw_Cpp_error@std@@YAXH@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Mbrtowc ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?_Winerror_map@std@@YAHH@Z _Xtime_get_ticks ?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z _Cnd_signal _Cnd_wait _Thrd_id ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?toupper@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?toupper@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z _Cnd_broadcast ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z ?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z ?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WPEBUtm@@PEB_W4@Z ?_Getcat@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?id@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ??7ios_base@std@@QEBA_NXZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_J@Z ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ??0task_continuation_context@Concurrency@@AEAA@XZ ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_ReportUnobservedException@details@Concurrency@@YAXXZ _Mtx_trylock _Cnd_register_at_thread_exit _Cnd_unregister_at_thread_exit ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAK@Z ?toupper@?$ctype@D@std@@QEBADD@Z ?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@DD@Z ?_Getcat@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?id@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A _Stolx ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?narrow@?$ctype@D@std@@QEBADDD@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?_Xruntime_error@std@@YAXPEBD@Z ?_XGetLastError@std@@YAXXZ ??Bios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z

msvcp140_atomic_wait

__std_atomic_notify_all_direct __std_atomic_wait_direct __std_tzdb_get_current_zone __std_tzdb_delete_sys_info __std_tzdb_get_time_zones __std_tzdb_delete_time_zones __std_tzdb_get_leap_seconds __std_tzdb_delete_leap_seconds __std_tzdb_delete_current_zone __std_calloc_crt __std_free_crt __std_tzdb_get_sys_info

oleacc

CreateStdAccessibleObject LresultFromObject AccessibleObjectFromWindow

query

LoadIFilter

secur32

LsaGetLogonSessionData LsaFreeReturnBuffer QueryContextAttributesW LsaEnumerateLogonSessions

uxtheme

SetWindowTheme

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__RTDynamicCast __C_specific_handler_noexcept __intrinsic_setjmp __C_specific_handler __std_exception_destroy __std_exception_copy _purecall __std_terminate __std_type_info_name __RTtypeid __current_exception_context strchr __std_type_info_compare wcsstr wcsrchr wcschr _set_se_translator _CxxThrowException memcpy memmove memset strstr strrchr memcmp memchr longjmp __current_exception

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free calloc malloc realloc

api-ms-win-crt-math-l1-1-0

modf __setusermatherr round log2 log10 log ceil asin acos sqrt sin cos fmod _get_FMA3_enable _set_FMA3_enable pow floor _finite ceilf _fdopen atan2 _isnan _dclass _dsign _fdsign _ldsign

api-ms-win-crt-runtime-l1-1-0

_errno strerror_s _initialize_onexit_table _register_onexit_function _register_thread_local_exe_atexit_callback exit _initterm strerror _configure_wide_argv _initterm_e _beginthreadex _invalid_parameter_noinfo _crt_atexit _initialize_wide_environment _set_app_type abort _c_exit _invalid_parameter_noinfo_noreturn _exit _seh_filter_exe _cexit terminate _get_wide_winmain_command_line __p___argc __p___wargv

api-ms-win-crt-stdio-l1-1-0

__p__commode fclose _get_stream_buffer_pointers _ftelli64 _close fwrite fputwc ungetwc _set_fmode ungetc _wfopen __stdio_common_vfwprintf feof fputs fgetc fgetwc fgetpos fopen _fseeki64 fsetpos setvbuf fflush fopen_s fputc fread __stdio_common_vswprintf_s __stdio_common_vswscanf __stdio_common_vsprintf_s _fsopen ftell fseek _sopen_s fgets __acrt_iob_func __stdio_common_vswprintf __stdio_common_vfprintf __stdio_common_vsscanf __stdio_common_vsprintf _get_osfhandle ferror fread_s _wfsopen _wfopen_s _fileno

api-ms-win-crt-convert-l1-1-0

_wcstoui64 _ultow_s _strtoui64 atof atol strtoull wcstoull _i64tow strtoll atoi strtoul strtol _wtoi64 wcstoll _itow _wtol wcstol _itow_s wcstod _ecvt_s wcstombs_s _wtof wcstoul _wtoi mbstowcs_s

api-ms-win-crt-string-l1-1-0

strpbrk iswdigit towlower isspace strncat _strdup _wcsdup tolower strcpy_s strtok wcsncat wcsncmp isalnum strcmp isupper toupper _stricmp wcsnlen isdigit strncpy strspn wcsncpy_s wcscpy_s towupper iswspace strcspn _wcsupr iswpunct strnlen wcsncat_s wcscat_s isalpha isxdigit _wcsicmp iswalpha wcspbrk wcsncpy _wcsnicmp strncmp isprint wcslen

api-ms-win-crt-time-l1-1-0

_mkgmtime64 _localtime64 strftime _gmtime64 _time64 _difftime64 _mktime64 _gmtime64_s wcsftime _localtime32_s

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _fullpath _lock_file _unlink _stat64i32 _wremove _stat64 _waccess _wsplitpath

api-ms-win-crt-utility-l1-1-0

srand qsort rand

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale _wsetlocale

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-multibyte-l1-1-0

_mbschr _mbspbrk _mbsnbcmp _mbsnbcpy_s

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

winmm

timeSetEvent timeKillEvent

Name

.text

Size

13.2MB

Virtual Size

13.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.5MB

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.7MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

535KB

Virtual Size

534KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

173KB

Virtual Size

172KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=24, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=10, id=253, version=34321,

count=10, id=260, version=34321,

count=6, id=259, version=34321,

count=8, id=257, version=34321,

count=20, id=260, productName=VS2019 v16.10.3 build 30038, version=30038,

count=179, id=260, version=30154,

count=3, id=261, productName=VS2019 v16.4.0 build 28314, version=28314,

count=3, id=260, productName=VS2019 v16.4.0 build 28314, version=28314,

count=60, id=261, version=34321,

count=2, id=257, version=32545,

count=2, id=257, version=33520,

count=6, productName=Unmarked objects (old),

count=6, id=257, version=30795,

count=3, id=259, version=33520,

count=20, id=260, version=33520,

count=25, id=260, version=32545,

count=9, id=261, version=32545,

count=57, id=261, version=33520,

count=12, id=260, version=33138,

count=2, id=262, version=33138,

count=60, id=257, version=33138,

count=23, id=257, version=34436,

count=2185, id=1, productName=Unmarked objects,

count=1198, id=265, version=34436,

count=1, id=256, version=34436,

count=1, id=255, version=34436,

count=6, id=151,

count=1, id=258, version=34436,

OobeUtil.exe

IMPHASH c11027497529842f4cea0123c818590f
SHA256 192ac38820198ca769e21a7037477f49b61fa1130e3ede97297c707b142255d4
MD5 67495f6c65877fd19d8040061afa4073
SHA1 ba94bec6da3287f19ab7aa7a81f476b4c0d89f7b
SHA512 4fb4cda96bb63bdc93b20308fa548758d3df9d977591095bd76c66b901553cfc98fb97a301f3a80c404b266494bcbb6dbb6a99a6d8cf08938a1e52a4e7904cad
SSDEEP 24576:8Vgmr8u3OQX/Ms5NvEXNKo84VMh0lhSMXlhH32zn26R3zV:agmY94/35Gx3
TLSH
T165555B1E7A5C40E8C6BED0798557990EEEB13851037597EBA6E8CE091F27AF15E3E300
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Digest

24:f5:93:51:8a:99:52:3b:7f:e9:17:75:e0:16:39:de:94:d4:5c:06:44:88:3e:2c:1c:02:61:c1:9e:4c:cd:e0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Chains

Mar 26, 2026

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Serial Number

40:1c:57:14:6d:ce:58:df:b9:22:21:87:8d:2a:a5:63

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2025 - Jun 10, 2028

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

630352

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\OobeUtil.pdb

bcrypt

BCryptEncrypt BCryptGenerateSymmetricKey BCryptDeriveKey BCryptSecretAgreement BCryptFinalizeKeyPair BCryptGenerateKeyPair BCryptImportKeyPair BCryptSetProperty BCryptOpenAlgorithmProvider BCryptDestroySecret BCryptDestroyKey BCryptExportKey BCryptCloseAlgorithmProvider

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

wtsapi32

WTSQueryUserToken

aswcmnos

cmnosMiniInit

aswcmnbs

secPreventHookDllInjection

dll_loader

?free_dll@dll_loader@asw@@YA_NPEAUHINSTANCE__@@@Z ?load_dll@dll_loader@asw@@YAPEAUHINSTANCE__@@PEB_W0@Z

shell32

SHGetKnownFolderPath ShellExecuteExW ord165

ntdll

VerSetConditionMask NtSystemDebugControl RtlLookupFunctionEntry RtlVirtualUnwind NtClose NtCreateWorkerFactory NtQueryInformationProcess NtQuerySystemInformation NtQueryInformationWorkerFactory RtlNtStatusToDosError RtlCaptureContext NtSetInformationThread RtlDllShutdownInProgress

kernel32

SetDllDirectoryW WideCharToMultiByte GetUserDefaultUILanguage OutputDebugStringW GetCurrentThreadId FormatMessageW IsDebuggerPresent GetModuleFileNameA HeapFree GetModuleHandleExW HeapAlloc GetProcessHeap DebugBreak InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection FreeLibrary GetLocaleInfoEx SetLastError GetCurrentProcessId GetProcessId GetCurrentProcess GetEnvironmentVariableW SetEnvironmentVariableW CreateThread CloseHandle GetSystemDirectoryW LoadLibraryW GetFileAttributesW CreateProcessW WaitForSingleObject GetExitCodeProcess VerifyVersionInfoW FindFirstFileW CreateFileW DeleteFileW InitializeProcThreadAttributeList UpdateProcThreadAttribute GetSystemTimeAsFileTime FindClose SetEvent CheckRemoteDebuggerPresent VirtualProtect FlushInstructionCache RaiseException SetErrorMode SetUnhandledExceptionFilter AddVectoredExceptionHandler RemoveVectoredExceptionHandler VirtualQuery GetTickCount CreateEventW QueryFullProcessImageNameW GetPriorityClass OpenThread GetThreadPriority K32EnumProcesses OpenProcess GetThreadTimes K32GetProcessMemoryInfo CreateToolhelp32Snapshot Process32FirstW Process32NextW GetProcessHandleCount CreateIoCompletionPort DeviceIoControl ReadProcessMemory TerminateProcess TlsFree TlsAlloc TlsSetValue TlsGetValue GetNativeSystemInfo DuplicateHandle GetSystemTimes GetProcessTimes CompareStringW GetOverlappedResult PostQueuedCompletionStatus GetQueuedCompletionStatus WriteFile UnregisterWaitUntilOOBECompleted CancelIoEx WaitForMultipleObjects GetTickCount64 VirtualAlloc WerRegisterMemoryBlock GetProcAddress VirtualFree QueryPerformanceCounter QueryPerformanceFrequency InitOnceExecuteOnce AcquireSRWLockExclusive ReleaseSRWLockExclusive UnmapViewOfFile UnlockFile CreateFileMappingW MapViewOfFile LockFileEx ResumeThread LocalFree UnlockFileEx GetFileSizeEx SetFilePointerEx DeleteProcThreadAttributeList GetCurrentThread CompareFileTime GetSystemInfo LoadLibraryExA CreateDirectoryW FindNextFileW ExpandEnvironmentStringsW SetFileAttributesW CopyFileW GetFileAttributesExW SetEndOfFile SetFilePointer FindFirstFileExW GetDiskFreeSpaceExW K32GetMappedFileNameW GetModuleFileNameW GetWindowsDirectoryW FindFirstVolumeW QueryDosDeviceW FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose GlobalMemoryStatusEx Sleep OOBEComplete RegisterWaitUntilOOBECompleted LoadLibraryExW ReadFile GetModuleHandleW QueryThreadCycleTime InitializeCriticalSectionAndSpinCount SetThreadPriority ResetEvent TerminateThread QueryUnbiasedInterruptTime LoadLibraryA GetLastError MultiByteToWideChar IsProcessorFeaturePresent AreFileApisANSI ReleaseSRWLockShared AcquireSRWLockShared SleepConditionVariableSRW FormatMessageA InitOnceBeginInitialize InitOnceComplete WakeAllConditionVariable InitializeSListHead UnhandledExceptionFilter WerUnregisterMemoryBlock

user32

GetClassInfoExW IsHungAppWindow RegisterClassExW PeekMessageW SendMessageCallbackW GetGUIThreadInfo GetSystemMetrics

advapi32

CryptReleaseContext CryptGenRandom CryptAcquireContextW RegSetValueExW RegDeleteValueW RegCreateKeyExW RegQueryInfoKeyW RegEnumKeyExW RegQueryValueExW FreeSid EqualSid AllocateAndInitializeSid ImpersonateSelf AdjustTokenPrivileges LookupPrivilegeValueW RegLoadKeyW RegOpenKeyExW OpenThreadToken CreateProcessAsUserW SetTokenInformation DuplicateTokenEx GetTokenInformation CheckTokenMembership DuplicateToken OpenProcessToken EventUnregister EventRegister EventWriteTransfer QueryServiceStatus OpenServiceW OpenSCManagerW CloseServiceHandle RevertToSelf RegCloseKey

ole32

CoTaskMemFree

msvcp140

?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ _Query_perf_counter _Query_perf_frequency ?eof@ios_base@std@@QEBA_NXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?fail@ios_base@std@@QEBA_NXZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ?id@?$collate@_W@std@@2V0locale@2@A _Wcsxfrm _Wcscoll ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEB_W_J@Z ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ _Mbrtowc ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?classic@locale@std@@SAAEBV12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$numpunct@D@std@@2V0locale@2@A ?id@?$ctype@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z _Mtx_lock _Mtx_unlock ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBADD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ??Bid@locale@std@@QEAA_KXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ _Cnd_unregister_at_thread_exit ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?id@?$numpunct@_W@std@@2V0locale@2@A _Cnd_register_at_thread_exit ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?id@?$ctype@_W@std@@2V0locale@2@A ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?good@ios_base@std@@QEBA_NXZ ?uncaught_exceptions@std@@YAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??Bios_base@std@@QEBA_NXZ ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ?_Xinvalid_argument@std@@YAXPEBD@Z _Thrd_detach _Thrd_join _Thrd_id _Cnd_do_broadcast_at_thread_exit ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?toupper@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ _Cnd_broadcast _Cnd_wait ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_ReportUnobservedException@details@Concurrency@@YAXXZ ??0task_continuation_context@Concurrency@@AEAA@XZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ

msvcp140_atomic_wait

__std_atomic_notify_all_direct __std_atomic_wait_direct

powrprof

CallNtPowerInformation

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp __RTtypeid __C_specific_handler __std_exception_destroy __std_exception_copy _purecall __std_terminate __std_type_info_name __std_type_info_compare __RTDynamicCast wcschr wcsstr _CxxThrowException memcpy memmove memset strchr __current_exception __current_exception_context __std_type_info_hash __C_specific_handler_noexcept

api-ms-win-crt-heap-l1-1-0

realloc calloc _set_new_mode _callnewh free malloc

api-ms-win-crt-math-l1-1-0

pow _ldsign _finite _isnan ceil floor fmod _fdsign _set_FMA3_enable _get_FMA3_enable _dsign ceilf __setusermatherr

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo terminate _invalid_parameter_noinfo_noreturn _configure_wide_argv _initialize_wide_environment _set_app_type _beginthreadex abort _get_initial_wide_environment __p___wargv __p___argc _errno _crt_atexit _initterm_e _initterm _register_thread_local_exe_atexit_callback exit _cexit _seh_filter_exe _exit _c_exit _register_onexit_function _initialize_onexit_table

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s _set_fmode __p__commode __stdio_common_vswscanf __stdio_common_vswprintf

api-ms-win-crt-string-l1-1-0

wcsncpy_s _wcsnicmp strnlen wcsncat_s strcpy_s wcscat_s wcscpy_s wcsncmp

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

api-ms-win-crt-convert-l1-1-0

_ecvt_s wcstoul _wtoi _wtoi64 wcstod wcstol wcstoll

rpcrt4

RpcBindingFromStringBindingW RpcStringFreeW RpcStringBindingComposeW UuidCreate NdrClientCall3 RpcBindingFree

shlwapi

PathAppendW

fltlib

FilterGetMessage FilterSendMessage FilterLoad FilterConnectCommunicationPort FilterReplyMessage

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

Name

.text

Size

852KB

Virtual Size

851KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

371KB

Virtual Size

370KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

58KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

RegSvr.exe

IMPHASH a4c4241357b9145c548be7c2ac27d8f5
SHA256 efa891940139a84a4b83cf8e5e407cc1074cc2630d7c22101d7e6e4cc563f0e2
MD5 388ba93e3f52a99b88234595b3767199
SHA1 09567c11947c9a60aa011b1dce4cb408b7c73b1d
SHA512 7594ffe4d47902eeb48b428aacbb41c6c78e21401789306b3212b33033636ab6d7369b2edcf9cadcb6ac9dcdd068b9cd7c7dbc2cfefe8043ea2395bdd84116b9
SSDEEP 49152:Q2dwHwl4s80tl/vzCKUeTE0U+ubxfr+lZIUACrzYsXP3NlrtehtNt1+bcTy1cy2b:NE0UXpOy
TLSH
T1D0266C0E7A2D00E9C1BFD13D86A7550AEA717CD94335A3EB69E18E150F53AF09E7A700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

2e:83:77:c7:53:0a:6e:05:f7:9d:34:3b:ab:db:e7:f5:6e:00:5c:95:8c:08:b3:50:af:09:8b:8a:8a:41:43:ee

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Chains

Mar 26, 2026

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Serial Number

40:1c:57:14:6d:ce:58:df:b9:22:21:87:8d:2a:a5:63

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2025 - Jun 10, 2028

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

1726032

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\RegSvr.pdb

rpcrt4

RpcStringBindingParseW RpcSsDestroyClientContext NdrServerCallAll Ndr64AsyncServerCallAll NdrAsyncServerCall Ndr64AsyncClientCall RpcAsyncCancelCall RpcAsyncInitializeHandle RpcAsyncCompleteCall RpcBindingToStringBindingW NdrServerCall2 RpcEpUnregister RpcEpRegisterW RpcServerUseProtseqEpW RpcObjectSetType RpcServerRegisterIf2 RpcServerUnregisterIfEx RpcImpersonateClient RpcRevertToSelf NdrClientCall3 RpcBindingFree RpcStringFreeW RpcBindingFromStringBindingW RpcStringBindingComposeW UuidCreate UuidFromStringW UuidToStringW RpcMgmtEpEltInqDone RpcIfInqId RpcMgmtEpEltInqBegin RpcMgmtEpEltInqNextW I_RpcBindingInqLocalClientPID

bcrypt

BCryptDestroyKey BCryptSetProperty BCryptOpenAlgorithmProvider BCryptImportKeyPair BCryptFinalizeKeyPair BCryptExportKey BCryptDeriveKey BCryptEncrypt BCryptSecretAgreement BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptGenerateKeyPair BCryptDestroySecret

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

shell32

ord165 SHGetKnownFolderPath

ntdll

RtlLookupFunctionEntry NtSystemDebugControl VerSetConditionMask RtlDllShutdownInProgress NtQueryInformationProcess NtQuerySystemInformation NtQueryInformationWorkerFactory RtlNtStatusToDosError NtSetInformationThread RtlVirtualUnwind NtOpenKey NtQueryKey NtDeleteKey NtClose RtlCaptureContext RtlUnwindEx RtlPcToFileHeader NtCreateWorkerFactory

ole32

CoCreateGuid CoTaskMemFree OleUninitialize OleInitialize

advapi32

RegOpenKeyExW InitializeSecurityDescriptor OpenThreadToken EventWriteTransfer RegQueryValueExW CryptReleaseContext CryptGenRandom CryptAcquireContextW RegDeleteTreeW RegNotifyChangeKeyValue RegQueryMultipleValuesW RegSetValueExW RegQueryInfoKeyW RegEnumValueW RegEnumKeyExW RegDeleteValueW RegDeleteKeyExW FreeSid SetSecurityDescriptorDacl AddAce InitializeAcl GetLengthSid AllocateAndInitializeSid ImpersonateSelf AdjustTokenPrivileges LookupPrivilegeValueW RevertToSelf CheckTokenMembership DuplicateToken EqualSid OpenProcessToken GetTokenInformation RegCloseKey EventUnregister EventRegister CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceStatus RegCreateKeyExW

user32

RegisterClassExW GetClassInfoExW IsHungAppWindow SendMessageCallbackW GetGUIThreadInfo GetSystemMetrics LoadStringW SetWindowLongPtrW SendMessageW PostMessageW RegisterWindowMessageW PeekMessageW

kernel32

FormatMessageA GetFileInformationByHandleEx WaitForSingleObjectEx WakeAllConditionVariable SleepConditionVariableSRW TryAcquireSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockShared AreFileApisANSI InitOnceBeginInitialize InitOnceComplete GetLocaleInfoEx FreeLibraryWhenCallbackReturns GetStringTypeW CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork IsProcessorFeaturePresent WakeConditionVariable EncodePointer LCMapStringEx CompareStringEx GetCPInfo InitializeSListHead UnhandledExceptionFilter GetStartupInfoW InterlockedPushEntrySList ExitThread FreeLibraryAndExitThread GetStdHandle ExitProcess FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetConsoleOutputCP GetConsoleMode GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle HeapQueryInformation FindResourceExW GetVersion SetFileTime WriteConsoleW RegisterWaitForSingleObject GetFileSize GetExitCodeThread WideCharToMultiByte MultiByteToWideChar GetModuleHandleW GetProcAddress CreateFileW LoadLibraryExW CloseHandle FreeLibrary GetLastError GetCurrentProcessId GetProcessHeap SetDllDirectoryW GetCommandLineW InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetModuleFileNameA GetModuleHandleExW FormatMessageW GetCurrentThreadId HeapAlloc HeapFree DebugBreak GetProcessId GetCurrentProcess GetEnvironmentVariableW SetEnvironmentVariableW CreateThread GetSystemDirectoryW LoadLibraryW GetFileAttributesW CreateProcessW WaitForSingleObject GetExitCodeProcess VerifyVersionInfoW FindFirstFileW DeleteFileW InitializeProcThreadAttributeList UpdateProcThreadAttribute GetSystemTimeAsFileTime FindClose OutputDebugStringW IsDebuggerPresent Sleep SetEvent CheckRemoteDebuggerPresent VirtualProtect FlushInstructionCache RaiseException SetErrorMode SetUnhandledExceptionFilter AddVectoredExceptionHandler RemoveVectoredExceptionHandler VirtualQuery GetTickCount CreateEventW QueryFullProcessImageNameW GetPriorityClass OpenThread GetThreadPriority K32EnumProcesses OpenProcess GetThreadTimes K32GetProcessMemoryInfo CreateToolhelp32Snapshot Process32FirstW Process32NextW GetProcessHandleCount CreateIoCompletionPort DeviceIoControl ReadProcessMemory TerminateProcess TlsFree TlsAlloc TlsSetValue TlsGetValue SetLastError GetNativeSystemInfo DuplicateHandle GetSystemTimes GetProcessTimes CompareStringW InitializeCriticalSectionEx HeapSize HeapReAlloc DecodePointer HeapDestroy GetFileTime CompareFileTime SetFilePointerEx UnlockFileEx LockFileEx GetFileSizeEx ReadFile QueryUnbiasedInterruptTime UnregisterWaitEx CancelIoEx ReadDirectoryChangesW GetOverlappedResult GetQueuedCompletionStatus WriteFile WaitForMultipleObjects GetTickCount64 ProcessIdToSessionId GetFileAttributesExW GetLocaleInfoW ResumeThread ResetEvent GetCurrentThread LocalFree VirtualAlloc WerRegisterMemoryBlock WerUnregisterMemoryBlock VirtualFree QueryPerformanceCounter QueryPerformanceFrequency InitOnceExecuteOnce AcquireSRWLockExclusive ReleaseSRWLockExclusive UnmapViewOfFile UnlockFile CreateFileMappingW MapViewOfFile InitializeCriticalSectionAndSpinCount TerminateThread SetThreadPriority QueryThreadCycleTime GetThreadId FlushFileBuffers GetFileInformationByHandle GetFullPathNameW OutputDebugStringA FileTimeToSystemTime CreateDirectoryW FindNextFileW ExpandEnvironmentStringsW SetFileAttributesW CopyFileW SetFileInformationByHandle MoveFileExW FindResourceW LoadResource LockResource SizeofResource SetEndOfFile SetFilePointer FindFirstFileExW GetDriveTypeW GetDiskFreeSpaceExW GetVolumePathNameW K32GetMappedFileNameW GetModuleFileNameW GetCurrentDirectoryW GetWindowsDirectoryW GetLongPathNameW GetVolumeNameForVolumeMountPointW FindFirstVolumeW QueryDosDeviceW FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolWait WaitForThreadpoolWaitCallbacks GlobalMemoryStatusEx GetSystemInfo GetVersionExW GetProcessAffinityMask PostQueuedCompletionStatus

powrprof

CallNtPowerInformation

shlwapi

PathAppendW

fltlib

FilterSendMessage FilterGetMessage FilterReplyMessage FilterLoad FilterConnectCommunicationPort

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1022KB

Virtual Size

1021KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

459KB

Virtual Size

497KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

132KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SetupInf.exe

IMPHASH 69274bf09261ce8e9994a53f27271621
SHA256 bca6964f30e7bae45a64562a63152ea912110ac8b9492d9d7d4d210ebbabf8a2
MD5 be2c01e9cf90a0e87fa4c0aae9945fa9
SHA1 3bf423816d3e9092af7919df3cf622dd68c66084
SHA512 bdc969a25570379f4b95e1189e80109a87e45d69a6ae0f5167c544f21c8037fa6dcee6aebf5c056eb8c66a1e2d8c58660d686d6b92c9a9f442cf75c7687ad2f0
SSDEEP 49152:I2dRHjl4y1Mfi3pPX4mgBxDtv1h1QW6CDxJroKGvoq1xtkAgtMtetu+bGcE0Oy+h:b/MHtNIgq
TLSH
T154266C0E7A6D00F9C1BFD17D95A7541AEA717C994339E2EB56E18E050F13AF09E3AB00
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

a1:35:d9:22:12:03:92:1d:d7:05:a4:4d:25:9c:9d:df:b9:e9:b7:0c:33:76:89:73:1b:00:21:71:4b:38:6d:3f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Chains

Mar 26, 2026

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Serial Number

40:1c:57:14:6d:ce:58:df:b9:22:21:87:8d:2a:a5:63

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2025 - Jun 10, 2028

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

1892384

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\SetupInf.pdb

setupapi

SetupCopyOEMInfW SetupUninstallOEMInfW

rpcrt4

RpcEpRegisterW RpcEpUnregister RpcBindingToStringBindingW RpcAsyncCompleteCall RpcAsyncInitializeHandle RpcAsyncCancelCall Ndr64AsyncClientCall RpcServerRegisterIf2 RpcServerUseProtseqEpW NdrAsyncServerCall Ndr64AsyncServerCallAll RpcStringBindingParseW RpcSsDestroyClientContext UuidCreate NdrClientCall3 RpcBindingFree RpcServerUnregisterIfEx NdrServerCall2 RpcObjectSetType RpcImpersonateClient RpcRevertToSelf I_RpcBindingInqLocalClientPID RpcMgmtEpEltInqNextW RpcMgmtEpEltInqBegin NdrServerCallAll RpcIfInqId RpcMgmtEpEltInqDone UuidToStringW UuidFromStringW RpcStringFreeW RpcBindingFromStringBindingW RpcStringBindingComposeW

bcrypt

BCryptSecretAgreement BCryptExportKey BCryptCloseAlgorithmProvider BCryptEncrypt BCryptGenerateSymmetricKey BCryptGenerateKeyPair BCryptDestroySecret BCryptImportKeyPair BCryptSetProperty BCryptOpenAlgorithmProvider BCryptDestroyKey BCryptDeriveKey BCryptFinalizeKeyPair

wintrust

CryptCATAdminEnumCatalogFromHash CryptCATAdminAcquireContext CryptCATAdminReleaseCatalogContext CryptCATAdminReleaseContext CryptCATAdminAddCatalog

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory

shell32

SHGetKnownFolderPath ord165

crypt32

CertDeleteCertificateFromStore CryptMsgClose CertFindCertificateInStore CryptMsgGetParam CryptQueryObject CertAddCertificateContextToStore CertOpenStore CertCloseStore CertFreeCertificateContext

ntdll

RtlDllShutdownInProgress VerSetConditionMask NtSystemDebugControl RtlLookupFunctionEntry RtlVirtualUnwind NtClose NtCreateWorkerFactory NtQueryInformationProcess NtQuerySystemInformation NtQueryInformationWorkerFactory RtlNtStatusToDosError NtSetInformationThread NtOpenKey NtQueryKey NtDeleteKey RtlUnwindEx RtlPcToFileHeader RtlCaptureContext

advapi32

QueryServiceStatus RegCreateKeyExW RegQueryValueExW OpenThreadToken CryptReleaseContext CryptGenRandom CryptAcquireContextW RegDeleteTreeW RegNotifyChangeKeyValue RegQueryMultipleValuesW RegDeleteKeyExW RegQueryInfoKeyW RegDeleteValueW RegEnumKeyExW RegSetValueExW GetSidSubAuthority GetSidSubAuthorityCount FreeSid AddAce InitializeAcl GetLengthSid AllocateAndInitializeSid InitializeSecurityDescriptor RevertToSelf ChangeServiceConfigW EventWriteTransfer QueryServiceConfigW OpenServiceW OpenSCManagerW CloseServiceHandle SetSecurityDescriptorDacl ImpersonateSelf AdjustTokenPrivileges LookupPrivilegeValueW CheckTokenMembership DuplicateToken StartServiceW EqualSid OpenProcessToken GetTokenInformation EventUnregister EventRegister RegCloseKey RegOpenKeyExW RegEnumValueW ConvertStringSecurityDescriptorToSecurityDescriptorW

ole32

CoUninitialize CoInitializeEx CoTaskMemFree CoCreateGuid CoCreateInstance

user32

GetClassInfoExW RegisterClassExW PeekMessageW SetWindowLongPtrW SendMessageW PostMessageW RegisterWindowMessageW IsHungAppWindow SendMessageCallbackW GetGUIThreadInfo GetSystemMetrics LoadStringW

kernel32

AreFileApisANSI GetFileInformationByHandleEx FormatMessageA GetStringTypeW WaitForSingleObjectEx WaitForThreadpoolWaitCallbacks CloseThreadpoolWait CreateThreadpoolWait WakeAllConditionVariable SleepConditionVariableSRW TryAcquireSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockShared InitOnceBeginInitialize InitOnceComplete GetLocaleInfoEx FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork IsProcessorFeaturePresent WakeConditionVariable SetThreadpoolWait FindVolumeClose EncodePointer LCMapStringEx GetVolumePathNamesForVolumeNameW FindNextVolumeW FindFirstVolumeW CompareStringEx GetCPInfo InitializeSListHead UnhandledExceptionFilter GetStartupInfoW InterlockedPushEntrySList ExitThread FreeLibraryAndExitThread GetStdHandle ExitProcess GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation IsValidCodePage K32GetMappedFileNameW GetDiskFreeSpaceExW SetFileInformationByHandle GetACP GetOEMCP CopyFileW GetConsoleOutputCP OutputDebugStringA FlushFileBuffers FileTimeToSystemTime GetConsoleMode GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle HeapQueryInformation WriteConsoleW RegisterWaitForSingleObject FindResourceW WideCharToMultiByte MultiByteToWideChar GetProcAddress GetModuleHandleW CloseHandle FindClose SetLastError GetLastError FindFirstFileW DeviceIoControl CreateFileW GetLocaleInfoW GetPrivateProfileStringW GetWindowsDirectoryW SetFileAttributesW FindNextFileW SetDllDirectoryW GetProcessHeap GetCommandLineW GetVersionExW GetModuleFileNameA HeapFree GetModuleHandleExW GetCurrentThreadId FormatMessageW HeapAlloc DebugBreak GetCurrentProcessId GetProcessId GetCurrentProcess GetEnvironmentVariableW SetEnvironmentVariableW CreateThread InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection GetSystemDirectoryW LoadLibraryW FreeLibrary GetFileAttributesW CreateProcessW WaitForSingleObject GetExitCodeProcess VerifyVersionInfoW DeleteFileW InitializeProcThreadAttributeList UpdateProcThreadAttribute GetSystemTimeAsFileTime OutputDebugStringW IsDebuggerPresent Sleep SetEvent CheckRemoteDebuggerPresent VirtualProtect FlushInstructionCache RaiseException SetErrorMode SetUnhandledExceptionFilter AddVectoredExceptionHandler RemoveVectoredExceptionHandler VirtualQuery GetTickCount CreateEventW QueryFullProcessImageNameW GetPriorityClass OpenThread GetThreadPriority K32EnumProcesses OpenProcess GetThreadTimes K32GetProcessMemoryInfo CreateToolhelp32Snapshot Process32FirstW Process32NextW GetProcessHandleCount CreateIoCompletionPort ReadProcessMemory TerminateProcess TlsFree TlsAlloc TlsSetValue FindResourceExW GetNativeSystemInfo DuplicateHandle GetSystemTimes GetProcessTimes CompareStringW InitializeCriticalSectionEx HeapSize HeapReAlloc DecodePointer HeapDestroy GetFileTime CompareFileTime SetFilePointerEx UnlockFileEx LockFileEx GetFileSizeEx ReadFile QueryUnbiasedInterruptTime UnregisterWaitEx CancelIoEx ReadDirectoryChangesW GetOverlappedResult PostQueuedCompletionStatus GetQueuedCompletionStatus WriteFile WaitForMultipleObjects GetTickCount64 LocalFree ProcessIdToSessionId GetFileAttributesExW LoadLibraryExW ResumeThread ResetEvent GetCurrentThread VirtualAlloc WerRegisterMemoryBlock WerUnregisterMemoryBlock VirtualFree QueryPerformanceCounter QueryPerformanceFrequency InitOnceExecuteOnce AcquireSRWLockExclusive ReleaseSRWLockExclusive UnmapViewOfFile UnlockFile CreateFileMappingW MapViewOfFile InitializeCriticalSectionAndSpinCount TerminateThread SetThreadPriority QueryThreadCycleTime GetThreadId GetSystemInfo ExpandEnvironmentStringsW GetModuleFileNameW GetShortPathNameW GetSystemWindowsDirectoryW GetProcessAffinityMask GetLongPathNameW GlobalMemoryStatusEx GetExitCodeThread GetDriveTypeW SetFilePointer GetFileSize SetEndOfFile MoveFileExW GetFileInformationByHandle SetFileTime GetFullPathNameW CreateDirectoryW GetCurrentDirectoryW FindFirstFileExW QueryDosDeviceW GetVolumePathNameW GetVolumeNameForVolumeMountPointW WriteProcessMemory GetVersion SizeofResource LockResource LoadResource TlsGetValue

powrprof

CallNtPowerInformation

shlwapi

PathAppendW

fltlib

FilterSendMessage FilterConnectCommunicationPort FilterLoad FilterGetMessage FilterReplyMessage

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

Name

.text

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

460KB

Virtual Size

498KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

135KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SupportTool.exe

IMPHASH fe61b14d8fafe5f4b59387aa0a9cfaef
SHA256 ee9641c862b67bfa0e07c53e014b6703dbf6d5ab29d81c2d7c0947f5ff9f03a8
MD5 aae34bf23935b92fa20677308674e19f
SHA1 a69e676a9e4a4068da430972665abf0baf20a663
SHA512 8d4d4d8894f9ec085f796eb076bcf0b1327eb3bb0dad18ee72fbcb8c5cbef35204c364a36042ed0feeaf276efd72afd485824c780535214ea2cd6ce6043128a7
SSDEEP 196608:b7iDQPCRrzXoeE7Al2gQGNdRATUwRICBRkNLDbd:b7iD1RXXoeE7Al2gQkRATUwRICBRkN/
TLSH
T159C69E1EB6A900E8C1BFD17C8A5B8906EBB23855033597DB15E089562F63FF49E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

1a:cf:70:47:67:ae:dd:21:33:92:ae:09:e3:36:65:62:b5:16:03:82:1c:04:b1:67:07:d1:13:b0:e9:b5:27:2d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Chains

Apr 10, 2026

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Serial Number

40:1c:57:14:6d:ce:58:df:b9:22:21:87:8d:2a:a5:63

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2025 - Jun 10, 2028

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

2819824

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\SupportTool.pdb

gdi32

SetViewportOrgEx SetViewportExtEx PolyBezier Polyline Polygon LPtoDP DPtoLP ExtTextOutW ModifyWorldTransform SetWorldTransform GetWorldTransform SetROP2 StretchDIBits SetPolyFillMode SetWindowExtEx GetLayout SetLayout SetMapMode SetGraphicsMode DeleteEnhMetaFile GetEnhMetaFileW PlayEnhMetaFile EnumFontFamiliesExW SetAbortProc StartDocW EndDoc StartPage EndPage SetWindowOrgEx GetTextExtentPoint32W CombineRgn CreateRectRgnIndirect RectInRegion GetNearestPaletteIndex GetPaletteEntries CreatePen ExtCreatePen CreateHatchBrush CreatePatternBrush CreateDIBitmap GetDIBits CreateDIBSection GetDIBColorTable SetDIBColorTable EqualRgn GetRgnBox PtInRegion GetBkColor LineTo MoveToEx GetCharABCWidthsW GetTextExtentExPointW CreateICW CreateDCW GetSystemPaletteEntries CloseEnhMetaFile CreatePalette SetPixel CreateEnhMetaFileW DeleteObject GetEnhMetaFileHeader CreateFontIndirectW GetDeviceCaps GetOutlineTextMetricsW SelectObject GetTextMetricsW CreateRectRgn ExcludeClipRect RealizePalette SelectPalette SetBrushOrgEx GdiFlush CreateCompatibleDC DeleteDC StretchBlt SetStretchBltMode ExtCreateRegion GetRegionData OffsetRgn BitBlt CreateBitmap CreateBitmapIndirect CreateCompatibleBitmap SetBkColor SetBkMode SetTextColor GetStockObject CreateSolidBrush Arc Ellipse ExtFloodFill GetClipBox GetGraphicsMode GetObjectType GetPixel GetViewportExtEx GetWindowExtEx MaskBlt Pie PolyPolygon Rectangle RoundRect SelectClipRgn ExtSelectClipRgn GetObjectW

ole32

CLSIDFromString CoTaskMemFree OleInitialize OleUninitialize RevokeDragDrop CoTaskMemAlloc ReleaseStgMedium CoLockObjectExternal RegisterDragDrop OleSetClipboard StringFromGUID2 OleFlushClipboard OleIsCurrentClipboard CoUninitialize CoCreateInstance CoInitializeEx OleGetClipboard

crypt32

CertGetNameStringA CertFindExtension CryptQueryObject CertAddCertificateContextToStore CertFreeCRLContext CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertOpenSystemStoreW CertFreeCTLContext CertCloseStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertOpenStore CryptUnprotectData CryptProtectData CertEnumCertificatesInStore

iphlpapi

GetAdaptersAddresses CancelMibChangeNotify2 GetUnicastIpAddressTable Icmp6SendEcho2 Icmp6CreateFile IcmpSendEcho2Ex IcmpCreateFile IcmpCloseHandle FreeMibTable GetIpForwardTable2 GetBestRoute2 GetNetworkParams IcmpSendEcho

bcrypt

BCryptSetProperty BCryptImportKeyPair BCryptGenerateKeyPair BCryptFinalizeKeyPair BCryptExportKey BCryptSecretAgreement BCryptDeriveKey BCryptDestroySecret BCryptEncrypt BCryptCloseAlgorithmProvider BCryptDestroyKey BCryptGenRandom BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider

wininet

InternetReadFile InternetSetOptionW InternetOpenW InternetOpenUrlW InternetCloseHandle

user32

SetWindowRgn CreateIconIndirect DestroyCursor SystemParametersInfoW GetScrollInfo SetScrollInfo IsDialogMessageW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetWindow SetParent GetParent GetWindowLongW PtInRect InflateRect FillRect GetSysColor ChildWindowFromPointEx WindowFromPoint MapWindowPoints ScreenToClient ClientToScreen GetCursorPos SetCursorPos GetWindowRect GetClientRect EnableScrollBar ScrollWindow RedrawWindow GetUpdateRgn UpdateWindow GetMenuItemInfoW TrackPopupMenu GetMenuItemCount GetSystemMetrics IsWindowEnabled EnableWindow ReleaseCapture SetCapture GetCapture MapVirtualKeyW VkKeyScanW GetAsyncKeyState GetKeyState GetFocus GetActiveWindow GetWindowTextLengthW HideCaret DrawIconEx RegisterClipboardFormatW GetClipboardFormatNameW DrawStateW GetDesktopWindow wsprintfW PostThreadMessageW SetRect RegisterClassW CreateWindowExW BringWindowToTop PeekMessageW DefWindowProcW DestroyWindow DispatchMessageW MsgWaitForMultipleObjects SetTimer KillTimer DdeInitializeW DdeUninitialize SetFocus IsWindowVisible EndDeferWindowPos SetRectEmpty CopyRect OffsetRect FindWindowExW ChildWindowFromPoint GetComboBoxInfo DdeConnect DdeDisconnect DdePostAdvise DdeNameService DdeClientTransaction DdeCreateDataHandle DdeGetData DdeFreeDataHandle DdeGetLastError DdeCreateStringHandleW DdeQueryStringW DdeFreeStringHandle CreateDialogParamW GetIconInfo GetDC ReleaseDC GetWindowPlacement SetLayeredWindowAttributes FlashWindowEx MoveWindow SetWindowPos IsIconic IsZoomed CreateDialogIndirectParamW GetDialogBaseUnits DrawMenuBar GetSystemMenu EnableMenuItem SetWindowLongW GetWindowLongPtrW SetWindowLongPtrW TranslateMessage RegisterHotKey UnregisterHotKey GetMessagePos GetMessageTime PostQuitMessage CallWindowProcW IsWindow AnimateWindow BeginDeferWindowPos DeferWindowPos GetProcessDefaultLayout GetDlgItem ShowWindow GetMenuState CreateMenu GetWindowThreadProcessId CreatePopupMenu DestroyMenu GetSubMenu InsertMenuW AppendMenuW ModifyMenuW RemoveMenu SetMenuInfo InsertMenuItemW SetMenuItemInfoW CreateAcceleratorTableW DestroyAcceleratorTable TranslateAcceleratorW EnumWindows ValidateRgn IsRectEmpty MessageBeep GetClassNameW GetMessageW ValidateRect GetWindowDC BeginPaint EndPaint UnionRect WaitForInputIdle GetKeyboardLayoutNameW DrawEdge DrawFrameControl CheckMenuItem GetMenuItemID GetSysColorBrush CheckMenuRadioItem ActivateKeyboardLayout GetKeyboardLayoutList IsClipboardFormatAvailable RegisterWindowMessageW SetMenu ChangeDisplaySettingsExW EnumDisplaySettingsW MonitorFromPoint MonitorFromWindow GetMonitorInfoW LoadIconW LoadBitmapW EnumDisplayMonitors DestroyIcon SetCursor LoadCursorW InvalidateRect DrawTextW DrawFocusRect GetDoubleClickTime GetCaretBlinkTime IsMenu LoadImageW GetWindowTextW SetWindowTextW CharLowerW UnregisterClassW FindWindowW SetForegroundWindow keybd_event GetClassInfoExW RegisterClassExW LoadStringW PostMessageW MessageBoxW SendMessageW

shell32

SHGetKnownFolderPath ShellExecuteW ord727 SHGetFolderPathW SHFileOperationW SHGetFileInfoW SHChangeNotify ExtractIconW DragFinish DragAcceptFiles ShellExecuteExW ord6 ExtractIconExW DragQueryFileW DragQueryPoint CommandLineToArgvW ord51

oleaut32

SysFreeString SysAllocString VariantClear VariantInit

advapi32

RegGetValueW RegEnumKeyExA RegQueryValueExA RegOpenKeyExA SystemFunction036 ImpersonateSelf ImpersonateLoggedOnUser CryptAcquireContextA CryptGenRandom RegDeleteTreeW RegDeleteKeyExW RegQueryMultipleValuesW FreeSid EnumServicesStatusW QueryServiceConfigW ControlService AllocateAndInitializeSid LookupAccountSidW DuplicateTokenEx EventUnregister EventRegister RegDeleteValueW RegEnumKeyW OpenProcessToken GetUserNameW OpenThreadToken CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceStatus QueryServiceStatusEx StartServiceW LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegCloseKey RegQueryInfoKeyW RegEnumKeyExW RegEnumValueW RegQueryValueExW RegCreateKeyExW RegSetValueExW RegDeleteKeyW GetTokenInformation EqualSid RevertToSelf CryptAcquireContextW CryptCreateHash CryptReleaseContext CryptHashData CryptDestroyHash CryptGetHashParam RegNotifyChangeKeyValue EventWriteTransfer

winhttp

WinHttpConnect WinHttpSetCredentials WinHttpOpen WinHttpCloseHandle WinHttpSetStatusCallback WinHttpGetIEProxyConfigForCurrentUser WinHttpSetOption WinHttpCrackUrl WinHttpAddRequestHeaders WinHttpSetTimeouts WinHttpGetDefaultProxyConfiguration WinHttpOpenRequest WinHttpReadData WinHttpSendRequest WinHttpWriteData WinHttpReceiveResponse WinHttpQueryHeaders

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW WTSQueryUserToken

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

ntdll

RtlNtStatusToDosError RtlVirtualUnwind RtlLookupFunctionEntry NtSetInformationThread NtDeleteKey RtlCaptureContext NtOpenKey VerSetConditionMask NtQueryKey NtClose

kernel32

QueryDosDeviceW GetVolumeInformationW FindNextVolumeW GetLocalTime GetLocaleInfoW GetWindowsDirectoryW SetLastError CreateThread SleepEx WaitForMultipleObjectsEx ResetEvent SetFilePointerEx SetEndOfFile IsProcessorFeaturePresent ReleaseSemaphore CreateSemaphoreW ResumeThread SetThreadAffinityMask GetCPInfo GetLocaleInfoEx SetThreadLocale SetFilePointer GetFileInformationByHandle GetCurrentDirectoryW LocalFileTimeToFileTime SetErrorMode EnumResourceNamesW GetFileTime GetLongPathNameW GetTempFileNameW GetTempPathW SetCurrentDirectoryW GetFileType GetCommandLineW ExitProcess GetACP GetUserDefaultUILanguage SetThreadPriority TlsAlloc TlsGetValue TlsSetValue TlsFree GetEnvironmentVariableW LoadResource LockResource SizeofResource FindResourceW IsValidCodePage CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentThread RaiseException SetHandleInformation IsBadReadPtr IsBadStringPtrA MulDiv GlobalAlloc GlobalUnlock GlobalLock GlobalSize GlobalHandle GetStdHandle VirtualAlloc WriteConsoleA WriteConsoleW FillConsoleOutputCharacterW GetConsoleScreenBufferInfo SetConsoleCursorPosition ReadConsoleOutputCharacterA GetFileAttributesExW CompareFileTime GetThreadPriority InitializeCriticalSectionAndSpinCount GetThreadTimes QueryThreadCycleTime GetProcessIoCounters InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute K32GetProcessImageFileNameW GetProcessTimes GetPriorityClass K32GetProcessMemoryInfo WTSGetActiveConsoleSessionId QueryFullProcessImageNameW FlushFileBuffers GetFullPathNameW OutputDebugStringA GetDriveTypeW SetFileAttributesW MoveFileExW FindFirstFileExW GetVolumeNameForVolumeMountPointW GetVersion FindResourceExW SetFileInformationByHandle FreeResource K32GetMappedFileNameW GetVolumePathNamesForVolumeNameW GetSystemTimes GetSystemDirectoryA GetModuleHandleA LoadLibraryA MoveFileExA GetEnvironmentVariableA InitializeConditionVariable WakeAllConditionVariable ExpandEnvironmentStringsA RegisterWaitForSingleObject UnregisterWait GetQueuedCompletionStatusEx SetFileCompletionNotificationModes FindVolumeClose ProcessIdToSessionId LoadLibraryExW GetFileSizeEx LockFileEx UnlockFileEx SystemTimeToFileTime FileTimeToSystemTime GetVolumePathNameW CopyFileW GetModuleFileNameW GetVersionExW RemoveDirectoryW CreateDirectoryW ExpandEnvironmentStringsW GetComputerNameW CreatePipe FindClose FindNextFileW FindFirstFileW GetNativeSystemInfo GetTickCount64 SetEvent CreateEventW CancelIoEx ReadFile WriteFile GetQueuedCompletionStatus PostQueuedCompletionStatus CreateIoCompletionPort GetOverlappedResult TerminateProcess VerifyVersionInfoW GetCurrentProcess DeviceIoControl CreateFileW OpenProcess K32GetPerformanceInfo GlobalFree GetCurrentProcessId FreeLibrary LoadLibraryW LocalAlloc WaitForMultipleObjects QueryUnbiasedInterruptTime GetExitCodeProcess GetSystemTimeAsFileTime InitializeCriticalSection CreateProcessW EnterCriticalSection LeaveCriticalSection CompareStringW Sleep FreeConsole GetCommandLineA CreateMutexW CloseHandle GetLogicalDriveStringsW GetStartupInfoW SetUnhandledExceptionFilter FindFirstVolumeW GetSystemInfo GetSystemDirectoryW GlobalMemoryStatusEx MapViewOfFile CreateFileMappingW CreateFileA UnlockFile GetDiskFreeSpaceExW UnhandledExceptionFilter InitializeSListHead SleepConditionVariableSRW AcquireSRWLockShared ReleaseSRWLockShared FormatMessageA InitOnceComplete InitOnceBeginInitialize GetFileInformationByHandleEx AreFileApisANSI UnmapViewOfFile ReleaseSRWLockExclusive AcquireSRWLockExclusive InitOnceExecuteOnce QueryPerformanceFrequency QueryPerformanceCounter VirtualFree WerUnregisterMemoryBlock WerRegisterMemoryBlock GetModuleHandleW GetLastError WideCharToMultiByte MultiByteToWideChar GetFileAttributesW OutputDebugStringW GetCurrentThreadId FormatMessageW IsDebuggerPresent GetTickCount GetPrivateProfileIntW WritePrivateProfileStringW GetPrivateProfileStringW WaitForSingleObject TerminateThread GetSystemTime DeleteFileW LocalFree GetProcAddress GetProcessHeap GetUserDefaultLangID GetModuleFileNameA HeapFree GetModuleHandleExW InitializeCriticalSectionEx HeapSize HeapReAlloc HeapAlloc HeapDestroy DeleteCriticalSection DebugBreak AttachConsole

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW

comdlg32

PrintDlgW ChooseFontW CommDlgExtendedError GetSaveFileNameW GetOpenFileNameW PageSetupDlgW

msvcp140

??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ _Wcscoll _Wcsxfrm ?id@?$collate@_W@std@@2V0locale@2@A ?is@?$ctype@_W@std@@QEBA_NF_W@Z ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??Bios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ _Cnd_signal ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z _Query_perf_frequency _Query_perf_counter ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ _Stolx ?id@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?_Getcat@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@DD@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z ?_Random_device@std@@YAIXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAJ@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z _Mtx_init_in_situ _Mtx_destroy_in_situ ?_Throw_C_error@std@@YAXH@Z ?eof@ios_base@std@@QEBA_NXZ ?fail@ios_base@std@@QEBA_NXZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEB_W_J@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?narrow@?$ctype@D@std@@QEBADDD@Z ?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Throw_Cpp_error@std@@YAXH@Z _Thrd_join _Thrd_id _Cnd_do_broadcast_at_thread_exit ?_Xout_of_range@std@@YAXPEBD@Z ?_Incref@facet@locale@std@@UEAAXXZ ??1_Locinfo@std@@QEAA@XZ ??1_Lockit@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??0_Lockit@std@@QEAA@H@Z ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Xbad_alloc@std@@YAXXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?id@?$numpunct@D@std@@2V0locale@2@A ??Bid@locale@std@@QEAA_KXZ _Thrd_detach ?_Xinvalid_argument@std@@YAXPEBD@Z _Mbrtowc ?id@?$numpunct@_W@std@@2V0locale@2@A ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A _Strxfrm _Strcoll ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?tolower@?$ctype@D@std@@QEBADD@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?classic@locale@std@@SAAEBV12@XZ ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?id@?$ctype@_W@std@@2V0locale@2@A ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Xtime_get_ticks _Mtx_unlock ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ?_Winerror_map@std@@YAHH@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?good@ios_base@std@@QEBA_NXZ ?uncaught_exceptions@std@@YAHXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z ?toupper@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ?_Xbad_function_call@std@@YAXXZ ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ _Cnd_broadcast _Cnd_wait ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_ReportUnobservedException@details@Concurrency@@YAXXZ ??0task_continuation_context@Concurrency@@AEAA@XZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z _Cnd_register_at_thread_exit _Cnd_unregister_at_thread_exit ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z

msvcp140_atomic_wait

__std_atomic_wait_direct __std_atomic_notify_all_direct

uxtheme

GetThemeFont IsThemeActive IsAppThemed IsThemeBackgroundPartiallyTransparent GetThemeBackgroundContentRect DrawThemeBackground CloseThemeData GetThemeMargins GetThemePartSize GetThemeInt GetThemeSysColor SetWindowTheme GetThemeSysFont IsThemePartDefined GetThemeBackgroundExtent GetCurrentThemeName DrawThemeParentBackground GetThemeColor OpenThemeData

urlmon

URLDownloadToFileW

msimg32

AlphaBlend GradientFill

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_type_info_name strchr __std_type_info_compare __RTtypeid __std_exception_destroy memcpy wcsrchr wcsstr __std_exception_copy _purecall __std_terminate __C_specific_handler memset __RTDynamicCast __std_type_info_hash memmove _CxxThrowException __intrinsic_setjmp __current_exception_context __current_exception strrchr memchr memcmp longjmp strstr _set_se_translator wcschr

api-ms-win-crt-heap-l1-1-0

malloc realloc _set_new_mode calloc free _callnewh _aligned_free _aligned_malloc

api-ms-win-crt-runtime-l1-1-0

_errno _invalid_parameter_noinfo _beginthreadex strerror_s terminate exit _invalid_parameter_noinfo_noreturn abort _configure_narrow_argv _initialize_narrow_environment _set_app_type _get_narrow_winmain_command_line _initterm_e _initterm _crt_atexit _register_onexit_function _initialize_onexit_table _c_exit _exit _seh_filter_exe _cexit _register_thread_local_exe_atexit_callback

api-ms-win-crt-math-l1-1-0

__setusermatherr _dsign _ldsign _get_FMA3_enable lround _isnan _dclass _set_FMA3_enable modf fmod atan2 floor ceil sin cos sqrt lroundf floorf ceilf _fdsign _fdopen pow _finite

api-ms-win-crt-stdio-l1-1-0

_pclose __p__commode _set_fmode fgets feof _popen __stdio_common_vswprintf_s fread fputc __stdio_common_vswscanf fflush setvbuf fsetpos _fseeki64 fgetpos fgetc ungetc fgetwc ungetwc fputwc _get_stream_buffer_pointers fclose ftell __stdio_common_vfprintf __acrt_iob_func _sopen_s _fsopen _wsopen_dispatch fwrite __stdio_common_vswprintf_p fseek __stdio_common_vfwprintf fputs __stdio_common_vsscanf __stdio_common_vsprintf_s _get_osfhandle _fileno _open_osfhandle __stdio_common_vswprintf _wfopen _close _read fopen _write _lseeki64 _telli64 __stdio_common_vsprintf clearerr ferror _ftelli64

api-ms-win-crt-convert-l1-1-0

_wtoi atoi _wtoi64 _wtol wcstoul mbstowcs_s wcstod _wcstod_l _itow_s _ultow _ecvt_s strtoul strtol _wcstoi64 atof _wcstoui64 wcstol strtoull strtoll wcstombs_s wcstoll strtod

api-ms-win-crt-utility-l1-1-0

rand qsort bsearch srand

api-ms-win-crt-time-l1-1-0

_mktime64 _time64 _mkgmtime64 wcsftime _get_timezone strftime _gmtime64_s _gmtime64 _localtime64 _tzset

api-ms-win-crt-string-l1-1-0

toupper iswxdigit towlower strncmp iswprint tolower _stricmp wcsncmp wcsnlen wmemcpy_s strcspn isalnum isprint iswspace strspn strpbrk isdigit strnlen wcscat_s wcsncpy_s strncat strcpy_s towupper _wcsicmp _wcsnicmp wcscpy_s wcsncpy iswalnum strncpy strcmp _strdup isspace isalpha wcspbrk iswdigit iswalpha

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _unlink _stat64i32 _stat64 _fullpath _lock_file _wmkdir _wrmdir _wrename _wremove

api-ms-win-crt-locale-l1-1-0

_create_locale _free_locale ___lc_codepage_func setlocale _configthreadlocale

api-ms-win-crt-environment-l1-1-0

_wgetenv getenv _wgetcwd

api-ms-win-crt-multibyte-l1-1-0

_mbsnbcpy_s _mbschr _mbsnbcmp _mbspbrk _mbsinc _ismbcspace _mbscmp

comctl32

ImageList_Draw ImageList_GetIconSize ImageList_Create ImageList_Destroy ImageList_Add ImageList_ReplaceIcon ImageList_SetBkColor ImageList_Replace ImageList_GetImageInfo ord16 ord17 ImageList_GetImageCount

setupapi

SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW SetupDiGetDeviceInstanceIdW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList

ws2_32

setsockopt WSAGetLastError recv shutdown WSACloseEvent WSAIoctl bind htons socket getsockopt WSASetLastError __WSAFDIsSet closesocket WSAStartup WSACleanup inet_ntop WSAWaitForMultipleEvents ntohl FreeAddrInfoExW GetAddrInfoExW GetAddrInfoW connect send sendto select recvfrom WSAResetEvent WSACreateEvent WSAEventSelect WSAEnumNetworkEvents getsockname ioctlsocket gethostname getservbyname FreeAddrInfoW ntohs htonl

shlwapi

PathMatchSpecW SHAutoComplete

dbghelp

MiniDumpWriteDump

fltlib

FilterGetMessage FilterSendMessage FilterLoad FilterConnectCommunicationPort FilterReplyMessage

rpcrt4

RpcStringFreeW UuidToStringW UuidFromStringW RpcEpUnregister

generic

count=8, id=253, version=34321,

count=9, id=260, version=34321,

count=4, id=259, version=34321,

count=8, id=257, version=34321,

count=62, id=261, version=34321,

count=2, id=259, version=33138,

count=26, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=20, id=260, productName=VS2019 v16.10.3 build 30038, version=30038,

count=6, id=260, version=32545,

count=13, productName=Unmarked objects (old),

count=45, id=261, version=32545,

count=204, id=260, version=30154,

count=272, id=261, version=30154,

count=8, id=257, version=30795,

count=1, id=262, version=30795,

count=2, id=259, version=33520,

count=8, id=260, version=33520,

count=12, id=260, version=33138,

count=49, id=257, version=33138,

count=1575, id=1, productName=Unmarked objects,

count=480, id=265, version=34436,

count=1, id=256, version=34436,

count=1, id=255, version=34436,

count=4, id=151,

count=1, id=258, version=34436,

VisthAux.exe

IMPHASH 58ee0144271fc2b7e6626b4fba470727
SHA256 8bcaa503ea86175c8ec6ce340d31f96d9833ca47b3b2fd2c2730c948dd3fd5fd
MD5 c09c509ba8865a8e8af37b813fc6f462
SHA1 921ea03764222c1e361f192f26f87cea12868645
SHA512 f66da59138cbf02f8da627db214d6fbf9825406dea18f5d33c66065ccb7ace62c57afdee4b3efd5e022a92f699974d1782ce2da60521a34b109301f1bacf04dc
SSDEEP 12288:PiZJUGEqTPeph0lhSMXlirOsMjxle0BUV:PdGxch0lhSMXlkOsMjHBUV
TLSH
T107B47B967B9954E8D06BB87444674609EB327C204F2293DB62B0F9391FF35E06EBE701
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

2e:c6:fb:dd:f1:82:c9:bd:40:8e:28:10:93:09:50:bd:8a:e3:35:18:63:dc:35:65:74:35:6d:04:82:6f:48:21

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Chains

Mar 26, 2026

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Serial Number

40:1c:57:14:6d:ce:58:df:b9:22:21:87:8d:2a:a5:63

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2025 - Jun 10, 2028

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

210480

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\VisthAux.pdb

aavmrpch

AavmRpcImexExportSettings AavmRpcDestroyBinding AavmRpcImexImportSettings AavmRpcSetPropertyInt AavmRpcCreateBinding

dll_loader

?free_dll@dll_loader@asw@@YA_NPEAUHINSTANCE__@@@Z ?load_dll@dll_loader@asw@@YAPEAUHINSTANCE__@@PEB_W0@Z

aswcmnis

cyphSimpleCode

aswcmnos

dep_fsDeleteFileX dep_fsWriteFile dep_fsCloseFile dep_fsOpenFileX cmnosMiniInit

aswcmnbs

cmnbInit secIsPathProtectedBySelfProtection fsGetAvastSumpPath secPreventHookDllInjection

shell32

SHGetKnownFolderPath

ntdll

RtlVirtualUnwind NtClose NtOpenKey NtQueryKey NtDeleteKey RtlLookupFunctionEntry RtlCaptureContext

kernel32

GetCommandLineW HeapAlloc HeapFree GetCurrentProcessId GetSystemDirectoryW RaiseException GetSystemInfo VirtualProtect VirtualQuery FreeLibrary LoadLibraryExA GetModuleFileNameA GetModuleHandleExW GetCurrentThreadId FormatMessageW DebugBreak OutputDebugStringW IsDebuggerPresent CompareStringW Sleep SetLastError CloseHandle GetCurrentProcess TerminateProcess WaitForSingleObject GetCurrentThread InitializeCriticalSection DeleteCriticalSection CreateEventW SetEvent LeaveCriticalSection EnterCriticalSection GetFileAttributesW CreateDirectoryW K32GetMappedFileNameW GetModuleFileNameW GetWindowsDirectoryW FindFirstVolumeW QueryDosDeviceW FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose GetSystemTimeAsFileTime QueryPerformanceCounter GetTickCount64 SetSystemTime FileTimeToSystemTime GetProcessHeap WideCharToMultiByte DeleteFileW LoadLibraryExW GetModuleHandleW GetProcAddress LoadLibraryA GetLastError MultiByteToWideChar InitOnceBeginInitialize InitOnceComplete ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable SetDllDirectoryW

user32

GetSystemMetrics

advapi32

OpenSCManagerW OpenServiceW QueryServiceStatus ControlService RegSetValueExW RegDeleteTreeW RegDeleteKeyExW RegCreateKeyExW RegOpenKeyExW RegQueryValueExW FreeSid AllocateAndInitializeSid StartServiceW OpenThreadToken CheckTokenMembership DuplicateToken OpenProcessToken RegCloseKey CloseServiceHandle

ole32

CoTaskMemFree

msvcp140

?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?id@?$ctype@_W@std@@2V0locale@2@A ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?__ExceptionPtrCreate@@YAXPEAX@Z ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ?id@?$numpunct@_W@std@@2V0locale@2@A ?is@?$ctype@_W@std@@QEBA_NF_W@Z ?id@?$collate@_W@std@@2V0locale@2@A _Wcsxfrm ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z _Wcscoll ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ??Bid@locale@std@@QEAA_KXZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ?tolower@?$ctype@D@std@@QEBADD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z _Mtx_unlock _Mtx_lock ?__ExceptionPtrDestroy@@YAXPEAX@Z ?_Xlength_error@std@@YAXPEBD@Z ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$numpunct@D@std@@2V0locale@2@A ?_Xbad_function_call@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?classic@locale@std@@SAAEBV12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z _Mbrtowc ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception __current_exception_context memcpy strchr __RTDynamicCast memmove _CxxThrowException memset __std_terminate _purecall __std_exception_copy __std_exception_destroy __C_specific_handler

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc _callnewh free calloc realloc

api-ms-win-crt-math-l1-1-0

_get_FMA3_enable _fdsign _ldsign _dsign _set_FMA3_enable __setusermatherr

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _errno _cexit exit _register_thread_local_exe_atexit_callback _invalid_parameter_noinfo _initterm _invalid_parameter_noinfo_noreturn _initterm_e terminate _crt_atexit _register_onexit_function _initialize_onexit_table _exit _configure_wide_argv _initialize_wide_environment _set_app_type _c_exit abort _get_wide_winmain_command_line

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswscanf __stdio_common_vswprintf fclose _wfopen __stdio_common_vfwscanf _set_fmode __p__commode

api-ms-win-crt-string-l1-1-0

wcsncmp _wcsnicmp wcscat_s

api-ms-win-crt-convert-l1-1-0

wcstoll wcstoul

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

rpcrt4

NdrClientCall3 RpcBindingFree RpcStringFreeW RpcBindingFromStringBindingW RpcStringBindingComposeW

Name

.text

Size

225KB

Virtual Size

225KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

198KB

Virtual Size

197KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

67KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

VpnSvc.exe

IMPHASH d650223559c4f5e88574040fb3e4a507
SHA256 e212fd6e52f6e663ceeeaefd470de900126c869c07bb3a2da81e88c3e8d585df
MD5 bfa53f3c859d967105d60722d1288a5b
SHA1 efae1bf73b4cc9957b8dfb50472901889a81b12e
SHA512 45a3fa2430fa2907db71f83f126eadd338340818092cd197c95b53fd0d2989fda89a838dd6f9e2b9c0ba5a9f84cca6a518ad6ffc650b292d048b6b698a90ee21
SSDEEP 98304:LrajNsjvhFlNyLziwSaKlFhrS9j3rug1CqDHCShNkvCagvBkQAe:nahWZHNyLzi3aK9rS9j3rug1Cq7s6d
TLSH
T12EE66C1E7A9D01E5C1BED1799647650FEE7178850339E7DB6AE08E060F23AF09E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

9b:aa:e1:73:3b:5b:39:d7:3b:19:88:07:28:f5:77:d7:2a:0b:69:72:6d:36:26:75:82:f1:7d:fa:cb:74:30:f3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Chains

Mar 26, 2026

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Serial Number

40:1c:57:14:6d:ce:58:df:b9:22:21:87:8d:2a:a5:63

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2025 - Jun 10, 2028

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

7919856

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\VpnSvc.pdb

advapi32

OpenSCManagerW OpenServiceW ChangeServiceConfig2W CloseServiceHandle OpenThreadToken OpenProcessToken SetThreadToken RevertToSelf SetKernelObjectSecurity RegCloseKey ConvertStringSecurityDescriptorToSecurityDescriptorW SetEntriesInAclW SetNamedSecurityInfoW GetSecurityInfo GetLengthSid CreateWellKnownSid GetExplicitEntriesFromAclW SystemFunction036 CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash ControlService StartServiceW RegOpenKeyW QueryServiceStatus AllocateAndInitializeSid InitializeAcl RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW SetServiceStatus EqualSid GetTokenInformation AddAce RegQueryValueExW RegCreateKeyExW FreeSid RegNotifyChangeKeyValue CryptReleaseContext CryptGenRandom CryptAcquireContextW RegOpenKeyExW ImpersonateLoggedOnUser EventWriteTransfer EventRegister EventUnregister GetNamedSecurityInfoW DuplicateToken CheckTokenMembership DuplicateTokenEx SetTokenInformation CreateProcessAsUserW ConvertSidToStringSidW LookupAccountSidW LookupPrivilegeValueW AdjustTokenPrivileges ImpersonateSelf GetSecurityDescriptorOwner GetSecurityDescriptorGroup GetSecurityDescriptorDacl GetSecurityDescriptorControl TreeSetNamedSecurityInfoW IsValidSid RegGetValueW RegEnumKeyExA RegQueryValueExA RegOpenKeyExA CryptAcquireContextA RegDeleteTreeW RegOpenUserClassesRoot RegOpenCurrentUser RegQueryMultipleValuesW RegSetValueExW RegQueryInfoKeyW RegEnumValueW RegEnumKeyExW RegDeleteValueW RegDeleteKeyExW RegEnumKeyW TreeResetNamedSecurityInfoW CopySid

aswip

?start@winsock2@ip@@QEAAKAEAUWSAData@@@Z ?init@dnsapi@ip@@QEAAKXZ ?addresses_from_name@dnsapi@ip@@SAKPEB_WAEAV?$vector@Vaddr@ip@@V?$allocator@Vaddr@ip@@@std@@@std@@GK@Z ?free@lib@ip@@QEAAKXZ ?init@lib@ip@@QEAAKXZ ?free@membuffer@ip@@QEAAXXZ ?free@dnsapi@ip@@QEAAKXZ ?find_first@adapter_enumerator@ip@@QEAA_NAEAU_SFindAdapter@2@K@Z ?fill_adapter@adapter_enumerator@ip@@AEAA_NAEAU_SFindAdapter@2@@Z ?find_next_addr@adapter_enumerator@ip@@QEAA_NAEAU_SFindAddress@2@@Z ?cleanup@winsock2@ip@@QEAAKXZ ?recvfrom@winsock2@ip@@SAHAEBVsocket@2@PEADHAEAVsaddr@2@H@Z ?sendto@winsock2@ip@@SAHAEBVsocket@2@PEBDHAEBVsaddr@2@H@Z ?setsockopt@winsock2@ip@@SAKAEBVsocket@2@HHPEBDH@Z ?getsockname@winsock2@ip@@SAKAEBVsocket@2@AEAVsaddr@2@@Z ?bind@winsock2@ip@@SAKAEBVsocket@2@AEBVsaddr@2@@Z ?socket@winsock2@ip@@SAKAEAV02@HHGPEAU_WSAPROTOCOL_INFOW@@IK_N@Z ?closesocket@winsock2@ip@@SAKAEAVsocket@2@@Z

crypt32

CryptQueryObject CryptMsgGetParam CertFindCertificateInStore CryptMsgClose CertEnumCertificatesInStore CryptStringToBinaryA CertAddCertificateContextToStore CryptDecodeObjectEx CertFreeCRLContext CertFreeCTLContext CertFindExtension CertGetNameStringA CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertCloseStore CertOpenStore PFXImportCertStore CryptProtectData CryptUnprotectData CertDeleteCertificateFromStore CryptVerifyTimeStampSignature CryptMemFree CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain

ws2_32

recv setsockopt WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent getsockopt getsockname bind htonl recvfrom select sendto connect htons socket send closesocket GetAddrInfoW FreeAddrInfoW GetAddrInfoExW FreeAddrInfoExW ntohl inet_ntop WSAAddressToStringW InetPtonW InetNtopW WSASetLastError WSAIoctl __WSAFDIsSet ioctlsocket getservbyname gethostname WSAGetLastError WSAStartup WSACleanup ntohs

user32

GetClassInfoExW GetGUIThreadInfo SendMessageCallbackW IsHungAppWindow PeekMessageW CharLowerW AllowSetForegroundWindow RegisterDeviceNotificationW UnregisterDeviceNotification LoadStringW GetDesktopWindow RegisterClassExW GetSystemMetrics

libcrypto-3-x64

OPENSSL_sk_num EVP_PKEY_get_raw_public_key EVP_PKEY_CTX_free SHA512_Final BIO_free_all ASN1_INTEGER_cmp X509_STORE_add_cert BIO_new BIO_s_mem X509_free BIO_ctrl d2i_X509 PEM_write_bio_X509 SHA1_Update BN_bn2dec X509_STORE_CTX_new EVP_VerifyFinal EVP_MD_CTX_new SHA1_Final X509_STORE_CTX_free SHA512_Update X509_STORE_free SHA256_Final X509_STORE_new EVP_PKEY_CTX_new_from_name EVP_PKEY_keygen_init EVP_PKEY_keygen EVP_PKEY_free RAND_seed RAND_bytes HMAC_CTX_free HMAC_CTX_new HMAC_Init_ex EVP_sha1 EVP_sha256 EVP_sha512 HMAC_Update HMAC_Final PKCS5_PBKDF2_HMAC_SHA1 AES_set_encrypt_key AES_set_decrypt_key AES_cbc_encrypt SHA1_Init SHA256_Init X509_get_ext_d2i ASN1_STRING_length d2i_X509_CRL_bio SHA256_Update ASN1_INTEGER_to_BN BIO_new_mem_buf PEM_write_bio_PUBKEY X509_CRL_get_REVOKED X509_get_serialNumber X509_get_pubkey OPENSSL_sk_new_null SHA512_Init X509_STORE_CTX_verify X509_STORE_CTX_init EVP_PKEY_get_raw_private_key EVP_DigestInit OPENSSL_sk_pop_free ASN1_STRING_get0_data PEM_read_bio_PUBKEY X509_REVOKED_get0_serialNumber DIST_POINT_free BN_free X509_STORE_CTX_get_error EVP_DigestUpdate BN_is_zero GENERAL_NAME_get0_value X509_NAME_ENTRY_get_data PEM_read_bio_X509 X509_CRL_free X509_STORE_CTX_set_time PEM_read_bio_PrivateKey CRYPTO_free EVP_MD_CTX_free OPENSSL_sk_push OPENSSL_sk_value BIO_write

aswcmnis

MD5Final sha256Update sha256Final DSAVerifySignature sha256Init GetKeyData sha1Final ECDSAVerifySignature sha1Init MD5Update MD5Init sha1Update

aswcmnos

cmnosInit aswcmnosDllMain cmnosFree cmnosMiniInit

aswcmnbs

ConvertNtPathToDosPath ConvertDosPathToNtPath DSA_FileVerify GetHardwareIdEx DSA_BlockVerify GetHardwareId cmnbFree secCreateSharedMutex secCreateSharedEvent cmnbInit sha256GenerateFromName aswcmnbsDllMain

winhttp

WinHttpOpenRequest WinHttpReadData WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpSetTimeouts WinHttpConnect WinHttpReceiveResponse WinHttpWriteData WinHttpSendRequest WinHttpSetCredentials WinHttpCrackUrl WinHttpAddRequestHeaders WinHttpSetOption WinHttpQueryOption WinHttpCloseHandle WinHttpOpen WinHttpGetProxyForUrl WinHttpGetIEProxyConfigForCurrentUser WinHttpGetDefaultProxyConfiguration

protobuf

?Mutable@ArenaStringPtr@internal@protobuf@google@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAVArena@34@@Z ?SpaceUsedLong@Message@protobuf@google@@UEBA_KXZ ?MergeFrom@Message@protobuf@google@@UEAAXAEBV123@@Z ?_InternalSerialize@Message@protobuf@google@@UEBAPEAEPEAEPEAVEpsCopyOutputStream@io@23@@Z ?_InternalParse@Message@protobuf@google@@UEAAPEBDPEBDPEAVParseContext@internal@23@@Z ?CheckTypeAndMergeFrom@Message@protobuf@google@@UEAAXAEBVMessageLite@23@@Z ?InitializationErrorString@Message@protobuf@google@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?IsInitialized@Message@protobuf@google@@UEBA_NXZ ?Clear@Message@protobuf@google@@UEAAXXZ ?GetTypeName@Message@protobuf@google@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ??1ThreadSafeArena@internal@protobuf@google@@QEAA@XZ ?InitializationErrorString@MessageLite@protobuf@google@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ??0AssignDescriptorsRunner@internal@protobuf@google@@QEAA@PEBUDescriptorTable@123@@Z ?Destroy@ArenaStringPtr@internal@protobuf@google@@QEAAXXZ ?DoneFallback@EpsCopyInputStream@internal@protobuf@google@@AEAA?AU?$pair@PEBD_N@std@@HH@Z ?ReadTagFallback@internal@protobuf@google@@YA?AU?$pair@PEBDI@std@@PEBDI@Z ?VarintParseSlow32@internal@protobuf@google@@YA?AU?$pair@PEBDI@std@@PEBDI@Z ?InlineGreedyStringParser@internal@protobuf@google@@YAPEBDPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBDPEAVParseContext@123@@Z ?UnknownFieldParse@internal@protobuf@google@@YAPEBD_KPEAVUnknownFieldSet@23@PEBDPEAVParseContext@123@@Z ?EnsureSpaceFallback@EpsCopyOutputStream@io@protobuf@google@@AEAAPEAEPEAE@Z ?WriteStringMaybeAliasedOutline@EpsCopyOutputStream@io@protobuf@google@@AEAAPEAEIAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAE@Z ?InternalSerializeUnknownFieldsToArray@WireFormat@internal@protobuf@google@@SAPEAEAEBVUnknownFieldSet@34@PEAEPEAVEpsCopyOutputStream@io@34@@Z ?MaybeComputeUnknownFieldsSize@Message@protobuf@google@@IEBA_K_KPEAVCachedSize@internal@23@@Z ?CopyWithSourceCheck@Message@protobuf@google@@KAXAEAV123@AEBV123@@Z ?AssignDescriptors@internal@protobuf@google@@YA?AUMetadata@23@P6APEBUDescriptorTable@123@XZPEAUonce_flag@std@@AEBU423@@Z ?MergeFrom@UnknownFieldSet@protobuf@google@@QEAAXAEBV123@@Z ?ClearFallback@UnknownFieldSet@protobuf@google@@AEAAXXZ ?ByteSizeLong@Message@protobuf@google@@UEBA_KXZ ?GenericSwap@internal@protobuf@google@@YAXPEAVMessageLite@23@0@Z ?SerializePartialToArray@MessageLite@protobuf@google@@QEBA_NPEAXH@Z ?ShortDebugString@Message@protobuf@google@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?SerializeToString@MessageLite@protobuf@google@@QEBA_NPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?Add@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?JsonStringToMessage@util@protobuf@google@@YA?AVStatus@status_internal@123@VStringPiece@stringpiece_internal@23@PEAVMessage@23@AEBUJsonParseOptions@123@@Z ?InternalExtend@RepeatedPtrFieldBase@internal@protobuf@google@@AEAAPEAPEAXH@Z ?MessageToJsonString@util@protobuf@google@@YA?AVStatus@status_internal@123@AEBVMessage@23@PEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBUJsonPrintOptions@123@@Z ?Set@ArenaStringPtr@internal@protobuf@google@@QEAAX$$QEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAVArena@34@@Z ?ParseFromArray@MessageLite@protobuf@google@@QEAA_NPEBXH@Z ?end@?$RepeatedField@H@protobuf@google@@QEBA?AV?$RepeatedIterator@$$CBH@internal@23@XZ ?begin@?$RepeatedField@H@protobuf@google@@QEBA?AV?$RepeatedIterator@$$CBH@internal@23@XZ ?Add@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAAX$$QEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?Add@?$RepeatedField@_N@protobuf@google@@QEAAXAEB_N@Z ?Add@?$RepeatedField@N@protobuf@google@@QEAAXAEBN@Z ?Add@?$RepeatedField@_J@protobuf@google@@QEAAXAEB_J@Z ?Add@?$RepeatedField@H@protobuf@google@@QEAAXAEBH@Z ?size@?$RepeatedField@H@protobuf@google@@QEBAHXZ ?end@?$RepeatedField@I@protobuf@google@@QEBA?AV?$RepeatedIterator@$$CBI@internal@23@XZ ?begin@?$RepeatedField@I@protobuf@google@@QEBA?AV?$RepeatedIterator@$$CBI@internal@23@XZ ?empty@?$RepeatedField@I@protobuf@google@@QEBA_NXZ ?ParseFromCodedStream@MessageLite@protobuf@google@@QEAA_NPEAVCodedInputStream@io@23@@Z ?AddOutOfLineHelper@RepeatedPtrFieldBase@internal@protobuf@google@@AEAAPEAXPEAX@Z ??1CodedInputStream@io@protobuf@google@@QEAA@XZ ?SerializeAsString@MessageLite@protobuf@google@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?ParseFromString@MessageLite@protobuf@google@@QEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SerializeToArray@MessageLite@protobuf@google@@QEBA_NPEAXH@Z ?Set@ArenaStringPtr@internal@protobuf@google@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAVArena@34@@Z ?AllocateAlignedWithCleanup@Arena@protobuf@google@@AEAA?AU?$pair@PEAXPEAUCleanupNode@SerialArena@internal@protobuf@google@@@std@@_KPEBVtype_info@@@Z ?Get@?$RepeatedField@H@protobuf@google@@QEBAAEBHH@Z ??1ZeroFieldsBase@internal@protobuf@google@@MEAA@XZ ?CopyImpl@ZeroFieldsBase@internal@protobuf@google@@KAXAEAVMessage@34@AEBV534@@Z ?MergeImpl@ZeroFieldsBase@internal@protobuf@google@@KAXAEAVMessage@34@AEBV534@@Z ?ClearToDefault@ArenaStringPtr@internal@protobuf@google@@QEAAXAEBVLazyString@234@PEAVArena@34@@Z ?Mutable@ArenaStringPtr@internal@protobuf@google@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBVLazyString@234@PEAVArena@34@@Z ?Clear@?$RepeatedField@H@protobuf@google@@QEAAXXZ ?size@?$RepeatedField@_J@protobuf@google@@QEBAHXZ ?Clear@?$RepeatedField@_J@protobuf@google@@QEAAXXZ ?Get@?$RepeatedField@_J@protobuf@google@@QEBAAEB_JH@Z ?size@?$RepeatedField@M@protobuf@google@@QEBAHXZ ?Clear@?$RepeatedField@M@protobuf@google@@QEAAXXZ ?Get@?$RepeatedField@M@protobuf@google@@QEBAAEBMH@Z ?Add@?$RepeatedField@M@protobuf@google@@QEAAXAEBM@Z ?size@?$RepeatedField@N@protobuf@google@@QEBAHXZ ?Clear@?$RepeatedField@N@protobuf@google@@QEAAXXZ ?Get@?$RepeatedField@N@protobuf@google@@QEBAAEBNH@Z ?size@?$RepeatedField@_N@protobuf@google@@QEBAHXZ ?Clear@?$RepeatedField@_N@protobuf@google@@QEAAXXZ ?Get@?$RepeatedField@_N@protobuf@google@@QEBAAEB_NH@Z ?size@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEBAHXZ ?Clear@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAAXXZ ?ClearToEmpty@ArenaStringPtr@internal@protobuf@google@@QEAAXXZ ?MergePartialFromCodedStream@MessageLite@protobuf@google@@QEAA_NPEAVCodedInputStream@io@23@@Z ?Get@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z ??1?$RepeatedField@H@protobuf@google@@QEAA@XZ ??1?$RepeatedField@_J@protobuf@google@@QEAA@XZ ??1?$RepeatedField@M@protobuf@google@@QEAA@XZ ??1?$RepeatedField@N@protobuf@google@@QEAA@XZ ??1?$RepeatedField@_N@protobuf@google@@QEAA@XZ ??1?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAA@XZ ?ParseMessage@ParseContext@internal@protobuf@google@@QEAAPEBDPEAVMessageLite@34@PEBD@Z ?InternalWriteMessage@WireFormatLite@internal@protobuf@google@@SAPEAEHAEBVMessageLite@34@HPEAEPEAVEpsCopyOutputStream@io@34@@Z ?VarintParseSlow64@internal@protobuf@google@@YA?AU?$pair@PEBD_K@std@@PEBDI@Z ??0?$RepeatedField@H@protobuf@google@@QEAA@AEBV012@@Z ??0?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAA@AEBV012@@Z ??0?$RepeatedField@H@protobuf@google@@QEAA@PEAVArena@12@@Z ??0?$RepeatedField@_J@protobuf@google@@QEAA@PEAVArena@12@@Z ??0?$RepeatedField@M@protobuf@google@@QEAA@PEAVArena@12@@Z ??0?$RepeatedField@N@protobuf@google@@QEAA@PEAVArena@12@@Z ??0?$RepeatedField@_N@protobuf@google@@QEAA@PEAVArena@12@@Z ??0?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAA@PEAVArena@12@@Z ?AddVarint@UnknownFieldSet@protobuf@google@@QEAAXH_K@Z ?PackedInt32Parser@internal@protobuf@google@@YAPEBDPEAXPEBDPEAVParseContext@123@@Z ?PackedInt64Parser@internal@protobuf@google@@YAPEBDPEAXPEBDPEAVParseContext@123@@Z ?PackedFloatParser@internal@protobuf@google@@YAPEBDPEAXPEBDPEAVParseContext@123@@Z ?PackedDoubleParser@internal@protobuf@google@@YAPEBDPEAXPEBDPEAVParseContext@123@@Z ?PackedBoolParser@internal@protobuf@google@@YAPEBDPEAXPEBDPEAVParseContext@123@@Z ?Int32Size@WireFormatLite@internal@protobuf@google@@SA_KAEBV?$RepeatedField@H@34@@Z ?Int64Size@WireFormatLite@internal@protobuf@google@@SA_KAEBV?$RepeatedField@_J@34@@Z ?MergeFrom@?$RepeatedField@H@protobuf@google@@QEAAXAEBV123@@Z ?MergeFrom@?$RepeatedField@_J@protobuf@google@@QEAAXAEBV123@@Z ?MergeFrom@?$RepeatedField@M@protobuf@google@@QEAAXAEBV123@@Z ?MergeFrom@?$RepeatedField@N@protobuf@google@@QEAAXAEBV123@@Z ?MergeFrom@?$RepeatedField@_N@protobuf@google@@QEAAXAEBV123@@Z ?MergeFrom@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAAXAEBV123@@Z ?InternalSwap@?$RepeatedField@H@protobuf@google@@QEAAXPEAV123@@Z ?AllocateAlignedWithHook@Arena@protobuf@google@@AEAAPEAX_KPEBVtype_info@@@Z ?DestroyProtos@RepeatedPtrFieldBase@internal@protobuf@google@@IEAAXXZ ?WriteStringOutline@EpsCopyOutputStream@io@protobuf@google@@AEAAPEAEIAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAE@Z ?Clear@ZeroFieldsBase@internal@protobuf@google@@UEAAXXZ ?ByteSizeLong@ZeroFieldsBase@internal@protobuf@google@@UEBA_KXZ ?_InternalParse@ZeroFieldsBase@internal@protobuf@google@@UEAAPEBDPEBDPEAVParseContext@234@@Z ?_InternalSerialize@ZeroFieldsBase@internal@protobuf@google@@UEBAPEAEPEAEPEAVEpsCopyOutputStream@io@34@@Z ?size@?$RepeatedField@I@protobuf@google@@QEBAHXZ ?Clear@?$RepeatedField@I@protobuf@google@@QEAAXXZ ?Get@?$RepeatedField@I@protobuf@google@@QEBAAEBIH@Z ?Add@?$RepeatedField@I@protobuf@google@@QEAAXAEBI@Z ??1?$RepeatedField@I@protobuf@google@@QEAA@XZ ??0?$RepeatedField@I@protobuf@google@@QEAA@PEAVArena@12@@Z ?PackedUInt32Parser@internal@protobuf@google@@YAPEBDPEAXPEBDPEAVParseContext@123@@Z ?UInt32Size@WireFormatLite@internal@protobuf@google@@SA_KAEBV?$RepeatedField@I@34@@Z ?MergeFrom@?$RepeatedField@I@protobuf@google@@QEAAXAEBV123@@Z ?UnknownFieldParse@internal@protobuf@google@@YAPEBDIPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBDPEAVParseContext@123@@Z ?WriteRawFallback@EpsCopyOutputStream@io@protobuf@google@@AEAAPEAEPEBXHPEAE@Z ??$DoMergeFrom@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@InternalMetadata@internal@protobuf@google@@AEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ??$DoClear@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@InternalMetadata@internal@protobuf@google@@AEAAXXZ ?WriteVarint@internal@protobuf@google@@YAXI_KPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?ReadSizeFallback@internal@protobuf@google@@YA?AU?$pair@PEBDH@std@@PEBDI@Z ?Next@EpsCopyInputStream@internal@protobuf@google@@AEAAPEBDXZ ?data@?$RepeatedField@H@protobuf@google@@QEBAPEBHXZ ?ShutdownProtobufLibrary@protobuf@google@@YAXXZ ?DebugString@Message@protobuf@google@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ

dll_loader

?load_dll@dll_loader@asw@@YAPEAUHINSTANCE__@@PEB_W0@Z ?free_dll@dll_loader@asw@@YA_NPEAUHINSTANCE__@@@Z

iphlpapi

if_nametoindex GetUnicastIpAddressTable if_indextoname IcmpSendEcho GetNetworkParams GetIpAddrTable GetIpInterfaceEntry GetAdaptersAddresses Icmp6SendEcho2 Icmp6CreateFile IcmpSendEcho2Ex IcmpCreateFile IcmpCloseHandle GetIpForwardTable2 GetBestRoute2 DeleteIpForwardEntry2 CreateIpForwardEntry2 InitializeIpForwardEntry ConvertInterfaceLuidToGuid ConvertInterfaceAliasToLuid GetAdaptersInfo GetIpForwardTable ConvertInterfaceIndexToLuid CancelMibChangeNotify2 NotifyIpInterfaceChange FreeMibTable GetIfEntry2 GetIfTable2Ex

fwpuclnt

FwpmTransactionCommit0 FwpmTransactionAbort0 FwpmTransactionBegin0 FwpmSubLayerAdd0 FwpmSubLayerDeleteByKey0 FwpmEngineOpen0 FwpmProviderGetByKey0 FwpmFilterDeleteById0 FwpmGetAppIdFromFileName0 FwpmCalloutAdd0 FwpmCalloutDeleteByKey0 FwpmProviderAdd0 FwpmFilterAdd0 FwpmProviderContextAdd1 FwpmFilterDeleteByKey0 FwpmProviderContextDeleteByKey0 FwpmEngineClose0 FwpmFreeMemory0 FwpmSubLayerGetByKey0 FwpmFilterEnum0 FwpmFilterCreateEnumHandle0

dnsapi

DnsQuery_W DnsFree

bcrypt

BCryptGenRandom BCryptEncrypt BCryptGenerateSymmetricKey BCryptDeriveKey BCryptSecretAgreement BCryptExportKey BCryptFinalizeKeyPair BCryptGenerateKeyPair BCryptImportKeyPair BCryptSetProperty BCryptOpenAlgorithmProvider BCryptDestroySecret BCryptDestroyKey BCryptCloseAlgorithmProvider

ole32

CoCreateInstance CoInitializeEx StringFromGUID2 CoUninitialize CoInitialize CLSIDFromString CoTaskMemFree

shell32

CommandLineToArgvW ShellExecuteExW ord165 ShellExecuteW SHGetKnownFolderPath

oleaut32

VariantClear VariantInit SysFreeString VariantTimeToSystemTime SystemTimeToVariantTime SysAllocString

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory WTSQueryUserToken

setupapi

SetupCloseInfFile SetupFindFirstLineW SetupGetStringFieldW SetupDiGetDeviceRegistryPropertyW SetupCopyOEMInfW SetupScanFileQueueW SetupOpenFileQueue SetupDiSetSelectedDriverW SetupDiGetDriverInfoDetailW SetupDiEnumDriverInfoW SetupDiSetDeviceInstallParamsW SetupCloseFileQueue SetupDiEnumDeviceInfo SetupDiGetDevicePropertyW SetupDiGetDeviceInstallParamsW SetupDiSetClassInstallParamsW CM_Get_Device_IDW SetupDiGetDeviceInfoListDetailW SetupDiCallClassInstaller SetupDiSetDeviceRegistryPropertyW SetupDiCreateDeviceInfoW SetupDiGetINFClassW SetupDiDestroyDriverInfoList SetupDiBuildDriverInfoList SetupDiDestroyDeviceInfoList SetupDiCreateDeviceInfoList SetupDiGetClassDevsW SetupOpenInfFileW

ntdll

NtQueryInformationProcess NtDeleteKey NtQueryKey NtOpenKey NtSetInformationThread RtlNtStatusToDosError NtQueryInformationWorkerFactory NtQuerySystemInformation RtlCaptureContext NtCreateWorkerFactory NtClose RtlVirtualUnwind RtlLookupFunctionEntry NtSystemDebugControl RtlDllShutdownInProgress VerSetConditionMask

kernel32

GetThreadId DeleteProcThreadAttributeList QueryThreadCycleTime LocalFileTimeToFileTime GetLocalTime FileTimeToSystemTime GetFileInformationByHandle GetModuleFileNameW SetFilePointer ReleaseSRWLockExclusive AcquireSRWLockExclusive InitOnceExecuteOnce QueryPerformanceFrequency QueryPerformanceCounter MapViewOfFile CreateFileMappingW CreateFileA UnlockFile UnmapViewOfFile WerUnregisterMemoryBlock WerRegisterMemoryBlock GetTickCount64 GetQueuedCompletionStatus PostQueuedCompletionStatus GetSystemTimes DuplicateHandle TlsGetValue TlsSetValue TlsAlloc TlsFree ReadProcessMemory DeviceIoControl CreateIoCompletionPort GetProcessHandleCount Process32NextW Process32FirstW CreateToolhelp32Snapshot K32GetProcessMemoryInfo OpenThread GetPriorityClass QueryFullProcessImageNameW RemoveVectoredExceptionHandler SetUnhandledExceptionFilter SetErrorMode FlushInstructionCache CheckRemoteDebuggerPresent FindClose UpdateProcThreadAttribute InitializeProcThreadAttributeList FindFirstFileW GetFileAttributesW SetEnvironmentVariableW GetEnvironmentVariableW K32EnumProcesses K32GetProcessImageFileNameW VirtualFree VirtualAlloc LCMapStringW GetStringTypeExW SetFilePointerEx GetThreadUILanguage LocaleNameToLCID ResolveLocaleName IsProcessorFeaturePresent WaitForMultipleObjectsEx SleepEx CreateThread GetNativeSystemInfo OpenEventW CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CreateThreadpoolTimer GetCommandLineW FreeConsole AllocConsole AttachConsole SetConsoleCtrlHandler LoadLibraryExA VirtualQuery VirtualProtect GetSystemInfo GetSystemDirectoryW WakeAllConditionVariable SetThreadPriority GetTickCount TerminateThread WTSGetActiveConsoleSessionId GetVolumePathNamesForVolumeNameW GetThreadPriority CreateMutexW GlobalFree ResumeThread VerifyVersionInfoW ReleaseMutex CompareFileTime GetFileAttributesExW GetSystemDefaultLCID GetUserDefaultLCID GetGeoInfoW GetUserGeoID GetUserDefaultLangID GetLocaleInfoW GetSystemPowerStatus GetProcessTimes GetSystemTimeAsFileTime GetComputerNameExA SystemTimeToFileTime GetLocaleInfoEx GetFileSize DeleteFileW SetEndOfFile WriteFile CreateDirectoryW SetLastError CancelIo GetProcessId OpenProcess GetOverlappedResult CancelIoEx GetExitCodeProcess TerminateProcess GetStdHandle SetHandleInformation CreateNamedPipeW CreateProcessW WaitForMultipleObjects WaitForSingleObject ResetEvent SetEvent CreateEventW TryEnterCriticalSection FreeLibrary LoadLibraryW OutputDebugStringW IsDebuggerPresent GetComputerNameW QueryUnbiasedInterruptTime FindResourceW FindResourceExW LoadResource LockResource SizeofResource GetSystemTime GetCurrentProcessId ProcessIdToSessionId GetCurrentProcess GetCurrentThread ReadFile GetFileSizeEx LockFileEx UnlockFileEx CreateFileW RegisterWaitForSingleObject LocalAlloc FindNextFileW RemoveDirectoryW ExpandEnvironmentStringsW SetFileAttributesW CopyFileW SetFileInformationByHandle MoveFileExW FindFirstFileExW GetDiskFreeSpaceExW GetFinalPathNameByHandleW K32GetMappedFileNameW UnregisterWaitEx CompareStringW LocalFree Sleep InitializeCriticalSection CloseHandle DebugBreak GetProcessHeap DeleteCriticalSection HeapDestroy FindVolumeClose GlobalMemoryStatusEx HeapAlloc HeapReAlloc FormatMessageW HeapSize GetCurrentThreadId InitializeCriticalSectionEx HeapFree GetModuleFileNameA GetModuleHandleExW EnterCriticalSection LeaveCriticalSection WideCharToMultiByte LoadLibraryExW GetModuleHandleW GetProcAddress LoadLibraryA GetLastError MultiByteToWideChar SleepConditionVariableCS GetWindowsDirectoryW GetLongPathNameW FindFirstVolumeW QueryDosDeviceW GetThreadTimes FindNextVolumeW GetSystemDirectoryA GetModuleHandleA GetFullPathNameW MoveFileExA ExpandEnvironmentStringsA UnregisterWait GetQueuedCompletionStatusEx SetFileCompletionNotificationModes GetEnvironmentVariableA InitializeCriticalSectionAndSpinCount InitializeConditionVariable AreFileApisANSI GetFileInformationByHandleEx FormatMessageA InitOnceBeginInitialize InitOnceComplete ReleaseSRWLockShared AcquireSRWLockShared SleepConditionVariableSRW InitializeSListHead UnhandledExceptionFilter GetStartupInfoW RaiseException AddVectoredExceptionHandler

winspool.drv

OpenPrinter2W ClosePrinter FindNextPrinterChangeNotification FreePrinterNotifyInfo FindFirstPrinterChangeNotification FindClosePrinterChangeNotification EnumPrinterDriversW EnumPrintersW EnumPortsW

msvcp140

??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z _Thrd_yield _Mtx_trylock ?id@?$ctype@_W@std@@2V0locale@2@A ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z _Query_perf_frequency _Query_perf_counter ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?id@?$numpunct@_W@std@@2V0locale@2@A ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ??Bid@locale@std@@QEAA_KXZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ?tolower@?$ctype@D@std@@QEBADD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?c_str@?$_Yarn@D@std@@QEBAPEBDXZ _Mtx_unlock _Mtx_lock ?__ExceptionPtrDestroy@@YAXPEAX@Z ?_Xlength_error@std@@YAXPEBD@Z ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$numpunct@D@std@@2V0locale@2@A ?_Xbad_function_call@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?classic@locale@std@@SAAEBV12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Throw_Cpp_error@std@@YAXH@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Mbrtowc ??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?swap@?$basic_iostream@DU?$char_traits@D@std@@@std@@IEAAXAEAV12@@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?uncaught_exceptions@std@@YAHXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z ?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEB_W_J@Z _Thrd_detach ?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z ?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ ?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ ?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAN@Z ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@_N@Z ??0_Locinfo@std@@QEAA@HPEBD@Z ?_Getname@_Locinfo@std@@QEBAPEBDXZ ?_Makeloc@_Locimp@locale@std@@CAPEAV123@AEBV_Locinfo@3@HPEAV123@PEBV23@@Z ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z ?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@PEBD4@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEA_K@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAI@Z ?_Random_device@std@@YAIXZ _Cnd_signal ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??0ctype_base@std@@QEAA@_K@Z ??1ctype_base@std@@UEAA@XZ ?_Getctype@_Locinfo@std@@QEBA?AU_Ctypevec@@XZ _Tolower _Toupper ?clear@ios_base@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@PEAV32@@Z ?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEA_J@Z ?toupper@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?toupper@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ _Cnd_unregister_at_thread_exit _Cnd_register_at_thread_exit ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ??0task_continuation_context@Concurrency@@AEAA@XZ ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?get@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@DD@Z ?_Getcat@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?id@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A ?narrow@?$ctype@_W@std@@QEBAD_WD@Z ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??7ios_base@std@@QEBA_NXZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@DD@Z ?_Getcat@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?id@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?narrow@?$ctype@D@std@@QEBADDD@Z _Stolx ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Xruntime_error@std@@YAXPEBD@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAH@Z ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z _Cnd_do_broadcast_at_thread_exit _Thrd_id _Thrd_join ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@N@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_N@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z _Cnd_wait ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z _Cnd_broadcast ?id@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A ?_Getcat@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WPEBUtm@@PEB_W4@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z _Strcoll _Strxfrm ?id@?$collate@D@std@@2V0locale@2@A ?_Xinvalid_argument@std@@YAXPEBD@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z _Xtime_get_ticks ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ _Wcscoll _Wcsxfrm ?id@?$collate@_W@std@@2V0locale@2@A ?is@?$ctype@_W@std@@QEBA_NF_W@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??_7?$basic_ostream@_WU?$char_traits@_W@std@@@std@@6B@ ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ

msvcp140_atomic_wait

__std_atomic_notify_all_direct __std_atomic_wait_direct

secur32

QueryContextAttributesW

powrprof

CallNtPowerInformation

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__RTtypeid _purecall __std_type_info_compare strchr __std_exception_copy __std_exception_destroy wcsstr memcpy memmove __RTDynamicCast __C_specific_handler_noexcept __current_exception_context __current_exception memset strstr __std_type_info_name __std_type_info_hash strrchr __C_specific_handler _CxxThrowException memcmp wcschr __std_terminate memchr

api-ms-win-crt-heap-l1-1-0

calloc realloc _set_new_mode _callnewh free malloc

api-ms-win-crt-math-l1-1-0

fmod floor ceil _isnan _finite _dsign __setusermatherr _fdsign pow ceilf _dclass modf _get_FMA3_enable _set_FMA3_enable round _fdopen _ldsign

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _c_exit _seh_filter_exe strerror _cexit exit _register_thread_local_exe_atexit_callback _initterm _register_onexit_function _get_wide_winmain_command_line _set_app_type _initialize_wide_environment _configure_wide_argv strerror_s _crt_atexit _invalid_parameter_noinfo_noreturn abort _invalid_parameter_noinfo _errno _beginthreadex terminate _exit _initterm_e

api-ms-win-crt-string-l1-1-0

iswdigit strcpy_s isspace _stricmp isprint iswspace _wcsicmp isdigit towupper wcsnlen towlower strncat strspn strpbrk wcscpy_s wcsncpy_s wcsncat_s strnlen isalnum iswprint tolower strncmp wcsncpy strcmp _wcsnicmp strcspn _strdup toupper wcscat_s wcsncmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s __stdio_common_vsprintf ftell _sopen_s fseek __stdio_common_vswprintf fflush setvbuf fsetpos fgets _fseeki64 fgetpos fwrite fopen fread fgetc ungetc _set_fmode __p__commode fputc feof fputs _get_stream_buffer_pointers fclose __stdio_common_vswscanf __stdio_common_vsscanf __stdio_common_vswprintf_s __stdio_common_vfprintf fputwc ungetwc _close __acrt_iob_func _fsopen fgetwc

api-ms-win-crt-time-l1-1-0

wcsftime strftime _localtime64 _time64 _difftime64 _gmtime64_s _mkgmtime64 _gmtime64 _mktime64

api-ms-win-crt-convert-l1-1-0

strtoul strtoull wcstoull atoll wcstoll _ecvt_s wcstol wcstod wcstombs_s _wcstoui64 _wtoi64 strtol atoi wcstoul _wtoi atol mbstowcs_s

api-ms-win-crt-filesystem-l1-1-0

_stat64i32 _stat64 _unlock_file _lock_file _unlink _fullpath

api-ms-win-crt-utility-l1-1-0

qsort rand srand

api-ms-win-crt-multibyte-l1-1-0

_mbspbrk _mbschr _mbsnbcpy_s _mbsnbcmp

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

rpcrt4

RpcStringBindingParseW NdrClientCall3 RpcStringBindingComposeW RpcBindingFree UuidEqual UuidHash UuidCreate UuidToStringW UuidCompare UuidFromStringW RpcBindingFromStringBindingW RpcStringFreeW

shlwapi

PathIsRelativeW PathIsUNCW PathMatchSpecW PathAppendW

fltlib

FilterConnectCommunicationPort FilterLoad FilterSendMessage FilterGetMessage FilterReplyMessage

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

9.8MB

Virtual Size

9.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

395KB

Virtual Size

395KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

240B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

84KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=8, id=253, version=34321,

count=9, id=260, version=34321,

count=4, id=259, version=34321,

count=8, id=257, version=34321,

count=2, id=259, version=33138,

count=26, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=20, id=260, productName=VS2019 v16.10.3 build 30038, version=30038,

count=179, id=260, version=30154,

count=1, id=262, version=33138,

count=4, id=261, version=32545,

count=6, id=257, version=30795,

count=1, id=262, version=30795,

count=2, id=259, version=33520,

count=14, id=260, version=33520,

count=53, id=260, version=32545,

count=1, id=263, version=33138,

count=59, id=261, version=34321,

count=2, id=257, version=32545,

count=2, id=257, version=33520,

count=11, id=260, version=33138,

count=12, id=257, version=34436,

count=49, id=257, version=33138,

count=1531, id=1, productName=Unmarked objects,

count=803, id=265, version=34436,

count=1, id=256, version=34436,

count=1, id=255, version=34436,

count=2, id=151,

count=1, id=258, version=34436,

afwServ.exe

IMPHASH 2cf001379a248f8ede74169c3425bdbd
SHA256 31ee1cc388c7372006f37bc30e656e3478cce5fb84233b8eac43ed1008bbcabd
MD5 1a224d1dc23d886640d160d8d8846c84
SHA1 716020eb010c8f3f879fba76483e4a1fb2ebac8e
SHA512 bda81ae2c69b0df8f68c7e28e3338bdabfb17f38de4e52232b401b70ef4e3c9e18bc83ea44b89e24687e3c7ffaad1464caac40c641bf0cd0cc5395c52184982a
SSDEEP 24576:Aw5AlQi/Si6trQbn9o65ITaqPOra6OMzEVau9O9bnPs4sNRw2h0lhSMXlcYkWnSn:YlQiai6trQBo6SdO5oDcTGwDXkN7/P
TLSH
T14BC55B5EBA6900E5C1AEF0788547640AEF713C850B3996EB66E0CE550FE79F09E7E700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

d2:b6:ef:7c:6c:72:e3:0d:52:f1:eb:a8:07:55:d2:0a:8c:43:58:2c:f5:83:75:df:3e:9e:66:b8:78:44:e5:75

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Chains

Mar 26, 2026

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Serial Number

40:1c:57:14:6d:ce:58:df:b9:22:21:87:8d:2a:a5:63

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2025 - Jun 10, 2028

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

1429952

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\afwServ.pdb

advapi32

RegOpenKeyExW RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegCloseKey RegQueryValueExW RegSetValueExW EventRegister EventUnregister InitializeSecurityDescriptor SetSecurityDescriptorDacl OpenSCManagerW OpenServiceW QueryServiceStatusEx CloseServiceHandle EventWriteTransfer QueryServiceStatus StartServiceW QueryServiceConfigW RegOpenKeyW RevertToSelf OpenThreadToken GetTokenInformation OpenProcessToken EqualSid DuplicateToken CheckTokenMembership LookupPrivilegeValueW AdjustTokenPrivileges ImpersonateSelf RegDeleteTreeW RegDeleteKeyExW RegQueryInfoKeyW RegEnumValueW RegEnumKeyExW RegQueryMultipleValuesW CryptReleaseContext CryptGenRandom CryptAcquireContextW FreeSid AllocateAndInitializeSid

user32

MsgWaitForMultipleObjects DispatchMessageW PeekMessageW RegisterClassExW GetClassInfoExW GetSystemMetrics GetGUIThreadInfo SendMessageCallbackW IsHungAppWindow CharLowerW

libcrypto-3-x64

SHA1_Init SHA512_Init SHA1_Update SHA256_Update SHA512_Update SHA1_Final SHA256_Final SHA512_Final SHA256_Init

rpcrt4

RpcStringBindingComposeW RpcBindingFree I_RpcBindingInqLocalClientPID NdrClientCall3 UuidCreate RpcStringFreeW RpcBindingFromStringBindingW UuidCreateSequential NdrServerCallAll NdrServerCall2

afwcoreclient

?Rules_GetGroups@CAfwCoreClient@@QEAA_NAEAV?$map@VCGUID@@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@U?$less@VCGUID@@@3@V?$allocator@U?$pair@$$CBVCGUID@@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@std@@@3@@std@@@Z ?Rules_LoadGroups@CAfwCoreClient@@QEAAKPEAK@Z ?Rules_GetApps@CAfwCoreClient@@QEAA_NAEAV?$map@VCGUID@@V?$shared_ptr@VCAfwApplication@@@std@@U?$less@VCGUID@@@3@V?$allocator@U?$pair@$$CBVCGUID@@V?$shared_ptr@VCAfwApplication@@@std@@@std@@@3@@std@@@Z ?Count@CAfwAppInfoList@@QEAA_KXZ ??0CAfwCoreClient@@QEAA@XZ ??1CAfwCoreClient@@QEAA@XZ ?Config_GetValue@CAfwCoreClient@@SAPEB_WUXMLNode@@PEB_W11@Z ?Config_SetValue@CAfwCoreClient@@SAKUXMLNode@@PEB_W11@Z ?Rules_DeleteApp@CAfwCoreClient@@QEAAKVCGUID@@_N@Z ?Rules_ReleaseGroupObj@CAfwCoreClient@@QEAAXPEAVCAfwAppGroup@@@Z ?Rules_CreateNewApp@CAfwCoreClient@@QEAAPEAVCAfwApplication@@PEB_W0@Z ?Rules_CreateNewGroup@CAfwCoreClient@@QEAAPEAVCAfwAppGroup@@PEB_W0@Z ?Rules_AddAppIntoGroup@CAfwCoreClient@@QEAAKVCGUID@@0@Z ?Rules_CommitGroupChanges@CAfwCoreClient@@QEAAKXZ ?Rules_CommitAppChange@CAfwCoreClient@@QEAAKPEAVCAfwApplication@@_N@Z ?Get@CAfwAppInfoList@@QEAA_NKAEAW4_EAppPathType@@AEAU_GUID@@AEAPEB_W222@Z ?Rules_DeleteGroup@CAfwCoreClient@@QEAAKVCGUID@@@Z ?ReleaseConnectionInfo@CAfwCoreClient@@QEAA_NPEAVIAfwConnectionCallback@@@Z ?Rules_EnumGroupsGuids@CAfwCoreClient@@QEAAKQEAVCGUID@@K@Z ?Rules_GetPacketRules@CAfwCoreClient@@QEAAKPEAPEAUAFW_PACKET_RULE@@PEA_KVCGUID@@@Z ?Rules_ReleasePacketRulesBuffer@CAfwCoreClient@@QEAAXPEAUAFW_PACKET_RULE@@_K@Z ?Rules_SetPacketRules@CAfwCoreClient@@QEAAKPEAUAFW_PACKET_RULE@@_KVCGUID@@@Z ?Rules_EnumAppList@CAfwCoreClient@@QEAAPEAVCAfwAppInfoList@@K@Z ?ReloadConfigAndRules@CAfwCoreClient@@QEAAKXZ ??1CAfwApplication@@QEAA@XZ ?Rules_GetGroupByGuid@CAfwCoreClient@@QEAAPEAVCAfwAppGroup@@VCGUID@@@Z ?Release@CAfwAppInfoList@@QEAAXXZ ?UpdateConnectionInfo@CAfwCoreClient@@QEAA_NPEAVIAfwConnectionCallback@@@Z

afwrpc

afwFree afwRpcCreateBindingAndConnectUuid afwAlloc afwRpcStopServer afwRpcInitServer afwRpcDisconnect

wsock32

ntohs getservbyport

ashbase

notEventId

aavmrpch

AavmRpcCreateBinding AavmRpcDestroyBinding

wtsapi32

WTSQuerySessionInformationW WTSEnumerateSessionsW WTSFreeMemory

dll_loader

?load_dll@dll_loader@asw@@YAPEAUHINSTANCE__@@PEB_W0@Z ?free_dll@dll_loader@asw@@YA_NPEAUHINSTANCE__@@@Z

shell32

SHGetKnownFolderPath ord165

aswcmnis

sha256Final sha256Init sha256Update

aswcmnos

dep_fsReadFile dep_fsCreateFromHandle dep_fsOpenFile dep_fsGetFileSizeHandle cmnosMiniInit dep_fsCloseFile

aswcmnbs

GetHardwareId ConvertDosPathToNtPath secIsProcessTrusted fsGetAvastLogPath fsGetAvastFwDataPath ConvertDosPathToGuidPathKernel secCreateSharedFileMapping secIsRpcClientTrusted secCreateSharedMutex ConvertNtPathToDosPath ConvertGuidPathDosPath cmnbFree cmnbInit fsGetAvastDataPath secIsServiceProtectionEnabled secIsSelfDefenseEnabled svcServiceStart secOpenSharedEvent svcServiceUninstall svcIsServiceInstalled secPreventHookDllInjection svcServiceInstall secCreateSharedEvent

ntdll

NtQueryInformationWorkerFactory NtQuerySystemInformation NtCreateWorkerFactory RtlLookupFunctionEntry RtlVirtualUnwind NtOpenKey NtQueryKey NtDeleteKey NtSetInformationThread NtSystemDebugControl VerSetConditionMask RtlDllShutdownInProgress NtQueryInformationProcess RtlCaptureContext NtClose

kernel32

ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared SleepConditionVariableSRW InitOnceBeginInitialize InitOnceComplete WakeAllConditionVariable InitializeSListHead UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW CancelIo GetOverlappedResult GlobalMemoryStatusEx FindVolumeClose GetVolumePathNamesForVolumeNameW FindNextVolumeW QueryDosDeviceW FindFirstVolumeW K32GetMappedFileNameW GetDiskFreeSpaceExW CopyFileW SetFileAttributesW ExpandEnvironmentStringsW CreateDirectoryW LoadLibraryExA CompareStringW WriteFile K32GetProcessImageFileNameW DeleteProcThreadAttributeList QueryThreadCycleTime QueryPerformanceCounter QueryPerformanceFrequency ReadFile GetFileSizeEx LockFileEx UnlockFileEx MultiByteToWideChar GetLastError LoadLibraryA GetProcAddress GetModuleHandleW LoadLibraryExW HeapFree HeapAlloc GetProcessHeap SetDllDirectoryW DeleteCriticalSection Sleep GetCurrentThreadId SetEvent CloseHandle FormatMessageW GetModuleHandleExW GetModuleFileNameA DebugBreak WideCharToMultiByte SetLastError InitializeCriticalSectionEx GetModuleFileNameW GetSystemTimeAsFileTime HeapSetInformation SetCurrentDirectoryW QueueUserWorkItem LeaveCriticalSection EnterCriticalSection InitializeCriticalSection InitializeCriticalSectionAndSpinCount GetWindowsDirectoryW RaiseException TerminateProcess GetCurrentProcess QueryUnbiasedInterruptTime OpenThread WaitForSingleObject GetTickCount CreateNamedPipeW CreateEventW CreateThread ReleaseMutex GetCurrentProcessId GetThreadId TerminateThread LoadLibraryW FreeLibrary UnmapViewOfFile ProcessIdToSessionId GetSystemInfo SetThreadPriority MapViewOfFile OpenProcess GetLongPathNameW GetProcessTimes CompareFileTime GetTickCount64 OutputDebugStringW IsDebuggerPresent ResetEvent GetProcessId GetEnvironmentVariableW SetEnvironmentVariableW GetSystemDirectoryW GetFileAttributesW CreateProcessW GetExitCodeProcess VerifyVersionInfoW FindFirstFileW CreateFileW DeleteFileW InitializeProcThreadAttributeList UpdateProcThreadAttribute FindClose CheckRemoteDebuggerPresent VirtualProtect FlushInstructionCache SetErrorMode SetUnhandledExceptionFilter AddVectoredExceptionHandler RemoveVectoredExceptionHandler VirtualQuery QueryFullProcessImageNameW GetPriorityClass GetThreadPriority K32EnumProcesses GetThreadTimes K32GetProcessMemoryInfo CreateToolhelp32Snapshot Process32FirstW Process32NextW GetProcessHandleCount CreateIoCompletionPort DeviceIoControl ReadProcessMemory TlsFree TlsAlloc TlsSetValue TlsGetValue GetNativeSystemInfo DuplicateHandle GetSystemTimes GetFileAttributesExW WaitForMultipleObjects GetCurrentThread LocalFree

ole32

CoCreateInstance CoInitializeEx CoGetObject CoTaskMemFree StringFromGUID2 CoUninitialize

msvcp140

?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z _Thrd_detach _Thrd_join _Thrd_id _Cnd_do_broadcast_at_thread_exit ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??7ios_base@std@@QEBA_NXZ ?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z ?eof@ios_base@std@@QEBA_NXZ ?fail@ios_base@std@@QEBA_NXZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEB_W_J@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ?id@?$collate@_W@std@@2V0locale@2@A _Wcsxfrm _Wcscoll ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?toupper@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ _Mbrtowc ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?classic@locale@std@@SAAEBV12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$numpunct@D@std@@2V0locale@2@A ?id@?$ctype@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z _Mtx_lock _Mtx_unlock ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBADD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ??Bid@locale@std@@QEAA_KXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?good@ios_base@std@@QEBA_NXZ ?uncaught_exceptions@std@@YAHXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?id@?$numpunct@_W@std@@2V0locale@2@A ?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z _Xtime_get_ticks ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?id@?$ctype@_W@std@@2V0locale@2@A ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?toupper@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z _Query_perf_counter _Query_perf_frequency ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??Bios_base@std@@QEBA_NXZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ

msvcp140_atomic_wait

__std_atomic_notify_all_direct __std_atomic_wait_direct

powrprof

CallNtPowerInformation

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove memcpy memcmp _CxxThrowException __std_type_info_compare memset strchr __RTtypeid memchr __current_exception wcschr wcsrchr __C_specific_handler_noexcept __RTDynamicCast __current_exception_context __std_type_info_name __C_specific_handler __std_exception_destroy __std_exception_copy _purecall __std_terminate wcsstr

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc realloc malloc free _callnewh

api-ms-win-crt-math-l1-1-0

ceilf _dsign _fdsign _ldsign _finite _isnan ceil floor fmod _set_FMA3_enable _get_FMA3_enable pow _dclass modf __setusermatherr

api-ms-win-crt-runtime-l1-1-0

_set_app_type abort _errno _get_wide_winmain_command_line _configure_wide_argv _invalid_parameter_noinfo _invalid_parameter_noinfo_noreturn _initterm_e _initterm _register_thread_local_exe_atexit_callback exit _cexit _seh_filter_exe _exit _c_exit _initialize_wide_environment terminate _crt_atexit _initialize_onexit_table _register_onexit_function _beginthreadex

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s fflush __stdio_common_vswscanf fclose __acrt_iob_func __stdio_common_vswprintf fwrite __p__commode _wfopen __stdio_common_vsprintf _set_fmode __stdio_common_vsscanf

api-ms-win-crt-string-l1-1-0

isdigit wcsncpy wcscpy_s wcsncmp towupper _wcsicmp _wcsnicmp _stricmp wcscat_s wcsncat_s wcsncpy_s strcpy_s

api-ms-win-crt-time-l1-1-0

_gmtime64 _time64

api-ms-win-crt-convert-l1-1-0

wcstod _i64tow_s _wtoll strtoll _wtoi _itow_s atoi wcstol wcstoul wcstoll strtoul _wtoi64 _ecvt_s strtol

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

aswip

?from_addr@macaddr@ip@@QEAAKAEBVaddr@2@PEBV32@@Z ?names_from_address@dnsapi@ip@@SAKAEBVaddr@2@AEAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@K@Z ?init@dnsapi@ip@@QEAAKXZ ?free@dnsapi@ip@@QEAAKXZ ?cleanup@winsock2@ip@@QEAAKXZ ?free@lib@ip@@QEAAKXZ ?fill_adapter@adapter_enumerator@ip@@AEAA_NAEAU_SFindAdapter@2@@Z ?free@membuffer@ip@@QEAAXXZ ?init@lib@ip@@QEAAKXZ ?start@winsock2@ip@@QEAAKAEAUWSAData@@@Z ?find_first@adapter_enumerator@ip@@QEAA_NAEAU_SFindAdapter@2@K@Z

iphlpapi

SetTcpEntry GetTcpTable

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

shlwapi

PathAppendW

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

575KB

Virtual Size

574KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

144KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

70KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

352B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

103KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ashCmd.exe

IMPHASH 93dbf242f054ce450257218d8d046758
SHA256 f46b6c80c6f616df7af147dd8fc703cfcab615e5b7c7edf9943aa757108529f1
MD5 a6aca920a459ac6671277b666247f8d1
SHA1 c54b92bc3f2563a7f0a22b226ff847fdf2cc1a04
SHA512 c2bfa8b7dfa9c837e69108ad1888878a5266bcf99d7b784726665884e3835f595d8096e0c80eb0850b7838ce67083cd30ca4ecafae22e1a0d63f411a80448e2e
SSDEEP 12288:RC+MuC49uLmJnUIVdph0lhSMXli2Y23opovmV:RCdM9umnUs/h0lhSMXldY23opovmV
TLSH
T1C4F4AD1B775C13E9E16EC1B88853851AFA7278A5036697DB26E0CD560F23AF02F3E701
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

24:80:b2:b7:2e:f5:cf:41:e8:24:1d:87:5c:07:67:da:29:8f:07:cf:31:e2:e7:00:e2:6f:8f:7a:27:47:fb:fd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Chains

Mar 26, 2026

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Serial Number

40:1c:57:14:6d:ce:58:df:b9:22:21:87:8d:2a:a5:63

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2025 - Jun 10, 2028

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

284672

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\ashCmd.pdb

ashtask

tskFreeLibrary tskInitActionContext tskCreateReportFileName tskAddAreaEx tskFreeData tskFreeAreas tskGetPhysMemoryStatus tskLogResult tskUpdateStatistics tskCopyResult tskVirusAction tskAddNetAlert tskNetAlert tskFreeNetAlert tskFreeResult tskGetVPSLabel tskExecData tskProcessData ?aswFindTaskByName@@YAKPEB_WPEA_W_K@Z tskInitLibrary tskAddArea tskProcessAreas

user32

LoadStringW RegisterClassExW GetClassInfoExW

ashbase

notEventId basGetErrorStringEx basFreeLibrary basInitLibrary basGetErrorType

aswcmnos

dep_fsOpenFile dep_fsGetFileSizeHandle dep_fsReadFileEx cmnosMiniInit dep_fsExistFile dep_strNormalToUnicode dep_fsCloseFile dep_memHeapCreate dep_memHeapDestroy dep_memHeapAlloc dep_memHeapReAlloc dep_memHeapFree dep_strUtf8ToUnicode

aswcmnbs

cmdlineGetValueShort cmdlineClose cmdlineGetParameterValid cmdlineInitFromConsole fsGetAvastDataPath ?AddFilePart@CStr@root@asw@@QEAAKPEB_W0@Z fsGetAvastProgramPath cmdlineInitialize secPreventHookDllInjection cmdlineAddParameterDefinition cmdlineGetWrongParameterCount cmdlineGetParameterDetails cmdlineGetParameterCount cmdlineGetWrongParameter iniGetPrivateProfileInt cmdlineGetRawParameter cmdlineGetRawCount

dll_loader

?load_dll@dll_loader@asw@@YAPEAUHINSTANCE__@@PEB_W0@Z ?free_dll@dll_loader@asw@@YA_NPEAUHINSTANCE__@@@Z

shell32

SHGetKnownFolderPath

ntdll

RtlVirtualUnwind RtlCaptureContext RtlLookupFunctionEntry

kernel32

ReleaseSRWLockExclusive GetTickCount64 GetEnvironmentVariableW QueryPerformanceCounter AcquireSRWLockExclusive SleepConditionVariableSRW InitOnceBeginInitialize InitOnceComplete WakeAllConditionVariable UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead MultiByteToWideChar GetLastError LoadLibraryA GetProcAddress GetModuleHandleW LoadLibraryExW SetConsoleTextAttribute HeapAlloc GetProcessHeap HeapFree PulseEvent GetStdHandle WaitForSingleObject GetNumberOfConsoleInputEvents ReadConsoleInputW SetConsoleCtrlHandler CreateEventW WideCharToMultiByte Beep Sleep GetTickCount CompareStringW LeaveCriticalSection EnterCriticalSection WriteConsoleW GetConsoleOutputCP SetConsoleOutputCP GetConsoleScreenBufferInfo FillConsoleOutputAttribute FillConsoleOutputCharacterW SetConsoleWindowInfo SetConsoleCursorPosition ScrollConsoleScreenBufferW WriteConsoleOutputCharacterW WriteConsoleOutputAttribute ReadConsoleOutputCharacterW ReadConsoleOutputAttribute GetConsoleMode GetCPInfoExW GetLocaleInfoW FreeLibrary SetThreadLocale InitializeCriticalSection DeleteCriticalSection GetModuleFileNameA GetModuleHandleExW FormatMessageW GetCurrentThreadId DebugBreak SetLastError OutputDebugStringW IsDebuggerPresent GetSystemDirectoryW RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA GetComputerNameW CloseHandle GetCurrentProcess CreateFileW GetCurrentProcessId TerminateProcess ReadFile UnlockFileEx LockFileEx GetFileSizeEx ExpandEnvironmentStringsW K32GetMappedFileNameW GetModuleFileNameW GetWindowsDirectoryW FindFirstVolumeW QueryDosDeviceW FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose SetEvent GetSystemTimeAsFileTime

ole32

CoTaskMemFree

msvcp140

?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z _Wcscoll ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z _Mbrtowc ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?classic@locale@std@@SAAEBV12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$numpunct@D@std@@2V0locale@2@A ?id@?$ctype@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z _Mtx_lock _Mtx_unlock ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBADD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ??Bid@locale@std@@QEAA_KXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?id@?$numpunct@_W@std@@2V0locale@2@A ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ _Wcsxfrm ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?good@ios_base@std@@QEBA_NXZ ?uncaught_exceptions@std@@YAHXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?id@?$ctype@_W@std@@2V0locale@2@A ?tolower@?$ctype@_W@std@@QEBA_W_W@Z _Query_perf_counter _Query_perf_frequency ?eof@ios_base@std@@QEBA_NXZ ?fail@ios_base@std@@QEBA_NXZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEB_W_J@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ?id@?$collate@_W@std@@2V0locale@2@A

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception memset _CxxThrowException __current_exception_context memcpy __C_specific_handler memmove __std_exception_destroy __std_exception_copy _purecall __std_terminate __std_type_info_name wcsrchr wcschr strchr

api-ms-win-crt-heap-l1-1-0

malloc free realloc _set_new_mode _callnewh calloc

api-ms-win-crt-math-l1-1-0

_fdsign _ldsign _dsign _set_FMA3_enable _get_FMA3_enable __setusermatherr

api-ms-win-crt-runtime-l1-1-0

__p___wargv _initterm_e _initterm _register_thread_local_exe_atexit_callback exit _cexit _seh_filter_exe _exit _c_exit _get_initial_wide_environment _invalid_parameter_noinfo_noreturn _beginthreadex _set_app_type _initialize_onexit_table _register_onexit_function _crt_atexit terminate _initialize_wide_environment __p___argc _errno _invalid_parameter_noinfo abort _configure_wide_argv

api-ms-win-crt-string-l1-1-0

wcsncmp _wcsnicmp _wcsicmp _wcsdup wcsncpy strncpy wcscat_s wcscpy_s strcpy_s _wcsupr

api-ms-win-crt-time-l1-1-0

_time64 _wctime64

api-ms-win-crt-convert-l1-1-0

_ultow

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf _set_fmode __acrt_iob_func __stdio_common_vfwprintf __p__commode __stdio_common_vswprintf_s

api-ms-win-crt-locale-l1-1-0

_wsetlocale _configthreadlocale

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW

Name

.text

Size

302KB

Virtual Size

301KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

215KB

Virtual Size

215KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

205KB

Virtual Size

209KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ashQuick.exe

IMPHASH 23b8bf45e3071c603ff7b2b5d8bfde07
SHA256 baca8d98b504c71d0f4280fd5abdd474d7605687df7eecb3a278ebe68bf9ba7f
MD5 c08ccbdf4a065f7d0daa9ac5d0be6d19
SHA1 77bc6bd24aa9f9763e9d198c2ca84567ef1cb6e1
SHA512 7690a20c62cb95b9fcd857f27c6eba208a2c499fec72a9db33a6517f1fcfeaf3460a66a72f8b915f857c7f2beaa71f50f9d6dd70c096da6a039d4038f91daa8d
SSDEEP 12288:RW3C821tTnZ89ph0lhSMXliXuNd77JpGJV:RWj21Fn6fh0lhSMXlkuNd77PGJV
TLSH
T1D1C46B9A3B8504E8E06BB87844634609EB717C204F6293DB62B5F9351FF36E16DBE701
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

83:5d:b1:2d:06:70:35:95:01:1d:88:9f:8c:82:b8:1b:ff:3b:9f:78:dd:7e:75:f0:f4:96:4e:49:5a:db:bc:f4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Chains

Mar 26, 2026

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Serial Number

40:1c:57:14:6d:ce:58:df:b9:22:21:87:8d:2a:a5:63

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2025 - Jun 10, 2028

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

226640

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\ashQuick.pdb

ashtask

tskAddAreaEx tskInitLibrary tskProcessData tskFreeAreas tskSetActions tskExecData tskFreeData tskFreeLibrary tskVirusAction

dll_loader

?free_dll@dll_loader@asw@@YA_NPEAUHINSTANCE__@@@Z ?load_dll@dll_loader@asw@@YAPEAUHINSTANCE__@@PEB_W0@Z

shell32

SHGetKnownFolderPath

advapi32

RegQueryValueExW RegCloseKey RegOpenKeyExW

user32

LoadStringW GetClassInfoExW RegisterClassExW MessageBoxIndirectW

aswengldr

avscanGetScanProgress

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

aswcmnos

cmnosMiniInit

aswcmnbs

secPreventHookDllInjection usnOpenTracker usnSaveAll usnCloseTracker

kernel32

GetTickCount64 GetEnvironmentVariableW QueryPerformanceCounter GetSystemTimeAsFileTime SetEvent CreateEventW FindVolumeClose SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetVolumePathNamesForVolumeNameW FindNextVolumeW QueryDosDeviceW InitOnceBeginInitialize InitOnceComplete WakeAllConditionVariable UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead GetStartupInfoW CompareStringW MultiByteToWideChar GetLastError LoadLibraryA GetProcAddress GetModuleHandleW LoadLibraryExW SetDllDirectoryW WaitForSingleObject GetProcessHeap HeapReAlloc HeapAlloc GetFileAttributesW MapViewOfFile HeapFree UnmapViewOfFile WideCharToMultiByte FreeLibrary InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetModuleFileNameA GetModuleHandleExW FormatMessageW GetCurrentThreadId DebugBreak SetLastError OutputDebugStringW IsDebuggerPresent GetSystemDirectoryW RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA Sleep CloseHandle GetCurrentProcess CreateFileW GetCurrentProcessId TerminateProcess ReadFile UnlockFileEx LockFileEx GetFileSizeEx ExpandEnvironmentStringsW K32GetMappedFileNameW GetModuleFileNameW GetWindowsDirectoryW FindFirstVolumeW

ole32

CoTaskMemFree

msvcp140

?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEB_W_J@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ?id@?$collate@_W@std@@2V0locale@2@A _Wcsxfrm _Wcscoll ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z ??1facet@locale@std@@MEAA@XZ _Mbrtowc ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?classic@locale@std@@SAAEBV12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$numpunct@D@std@@2V0locale@2@A ?id@?$ctype@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z _Mtx_lock _Mtx_unlock ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBADD@Z ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ??Bid@locale@std@@QEAA_KXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?id@?$ctype@_W@std@@2V0locale@2@A ?id@?$numpunct@_W@std@@2V0locale@2@A ?tolower@?$ctype@_W@std@@QEBA_W_W@Z _Query_perf_counter _Query_perf_frequency ?eof@ios_base@std@@QEBA_NXZ ?fail@ios_base@std@@QEBA_NXZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove _CxxThrowException __C_specific_handler __std_exception_destroy __std_exception_copy _purecall __std_terminate wcschr __std_type_info_name strchr memset __current_exception __current_exception_context memcpy

api-ms-win-crt-heap-l1-1-0

free _set_new_mode _callnewh calloc realloc malloc

api-ms-win-crt-math-l1-1-0

_ldsign _fdsign _set_FMA3_enable _get_FMA3_enable _dsign __setusermatherr

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo _errno _initterm_e _initterm _register_thread_local_exe_atexit_callback exit _cexit _seh_filter_exe _exit _c_exit _set_app_type _initialize_wide_environment _configure_wide_argv _get_wide_winmain_command_line _initialize_onexit_table _register_onexit_function _crt_atexit terminate _invalid_parameter_noinfo_noreturn abort

api-ms-win-crt-convert-l1-1-0

wcstoul

api-ms-win-crt-string-l1-1-0

wcscat_s wcsncmp _wcsicmp _wcsnicmp strcpy_s

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode __stdio_common_vswprintf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

244KB

Virtual Size

244KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

199KB

Virtual Size

198KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

67KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

984B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ashUpd.exe

IMPHASH 31d855e2722594b0007e72ed223ce5d3
SHA256 a8109c46fc254ae13d30fd9545467f32e0d2734c6bac46a32ab3c1f489e593b7
MD5 32d2aafb2cc40e474f921bbe9a63ccf0
SHA1 027678c80b66751cefa54dd20addf5bc9532e5c5
SHA512 5e789389f35165970b58e09d6279e26969dd0ad1160ca3bc0c161ea1e8305b359e925e041ac0eff9f9de90b514e1305f1a8c405b594f1a1e130f9fb9032729ac
SSDEEP 12288:5lepvuspcRCV70wuph0lhSMXligCkJel7Ep3lLV:5k+RCF0wkh0lhSMXl7CTl7UlLV
TLSH
T1ABE46B5ABE9900E8D16EF4754963192AEB727C550F2192DB62F0CE250FE3AE45F7E300
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

3a:b5:3e:fc:4f:04:a1:dd:0b:71:50:91:95:81:90:33:80:08:ec:9f:49:be:59:0e:db:de:8b:46:32:76:dc:e2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Chains

Mar 26, 2026

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Serial Number

40:1c:57:14:6d:ce:58:df:b9:22:21:87:8d:2a:a5:63

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2025 - Jun 10, 2028

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

335872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\ashUpd.pdb

ashtask

tskFreeLibrary tskInitLibrary

rpcrt4

RpcBindingFromStringBindingW RpcStringFreeW RpcSsDestroyClientContext RpcStringBindingComposeW NdrClientCall3

advapi32

RegQueryValueExW RegCreateKeyExW RegSetValueExW RegCloseKey InitiateSystemShutdownExW RegDeleteTreeW RegDeleteKeyExW RegOpenKeyExW RegQueryInfoKeyW RegEnumValueW RegEnumKeyExW RegQueryMultipleValuesW CryptReleaseContext CryptGenRandom CryptAcquireContextW

dll_loader

?load_dll@dll_loader@asw@@YAPEAUHINSTANCE__@@PEB_W0@Z ?free_dll@dll_loader@asw@@YA_NPEAUHINSTANCE__@@@Z

shell32

SHGetKnownFolderPath

aswcmnos

dep_secSetPrivilege cmnosMiniInit

aswcmnbs

secPreventHookDllInjection GetHardwareId

ntdll

NtOpenKey NtDeleteKey NtQueryKey RtlCaptureContext NtClose RtlVirtualUnwind RtlLookupFunctionEntry

kernel32

GetModuleHandleW LoadLibraryExW SetDllDirectoryW GetModuleFileNameW Sleep HeapAlloc GetProcessHeap HeapFree InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection WideCharToMultiByte GetModuleFileNameA GetModuleHandleExW FormatMessageW GetCurrentThreadId DebugBreak CloseHandle SetLastError GetFileAttributesExW CompareFileTime FreeLibrary WaitForSingleObject GetCurrentProcessId TerminateProcess OutputDebugStringW IsDebuggerPresent GetSystemDirectoryW RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA CreateFileW UnlockFileEx LockFileEx GetFileSizeEx ReadFile CompareStringW GetCurrentProcess WriteFile CreateEventW SetEvent GetFileAttributesW CreateDirectoryW ExpandEnvironmentStringsW GetDiskFreeSpaceExW K32GetMappedFileNameW GetWindowsDirectoryW FindFirstVolumeW QueryDosDeviceW FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose LoadLibraryA GlobalMemoryStatusEx GetSystemTimes QueryPerformanceCounter GetTickCount64 GetEnvironmentVariableW GetLastError MultiByteToWideChar GetProcAddress InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter WakeAllConditionVariable SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive InitOnceComplete InitOnceBeginInitialize GetSystemTimeAsFileTime

ole32

CoTaskMemFree

msvcp140

?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?id@?$numpunct@_W@std@@2V0locale@2@A ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?id@?$ctype@_W@std@@2V0locale@2@A ?_Xinvalid_argument@std@@YAXPEBD@Z ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z _Query_perf_counter _Query_perf_frequency ?eof@ios_base@std@@QEBA_NXZ ?fail@ios_base@std@@QEBA_NXZ ?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEB_W_J@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ?id@?$collate@_W@std@@2V0locale@2@A _Wcsxfrm _Wcscoll ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z ??Bid@locale@std@@QEAA_KXZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ?tolower@?$ctype@D@std@@QEBADD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z _Mtx_unlock _Mtx_lock ?__ExceptionPtrDestroy@@YAXPEAX@Z ?_Xlength_error@std@@YAXPEBD@Z ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$numpunct@D@std@@2V0locale@2@A ?_Xbad_function_call@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?classic@locale@std@@SAAEBV12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Throw_Cpp_error@std@@YAXH@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Mbrtowc ?c_str@?$_Yarn@D@std@@QEBAPEBDXZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate _purecall __std_exception_copy __std_exception_destroy __C_specific_handler __std_type_info_name _CxxThrowException memcpy memmove memset _set_se_translator wcschr __current_exception_context __current_exception strchr

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh free malloc calloc realloc

api-ms-win-crt-math-l1-1-0

_get_FMA3_enable _ldsign _fdsign __setusermatherr _dsign _set_FMA3_enable

api-ms-win-crt-runtime-l1-1-0

abort _configure_wide_argv _initialize_wide_environment _invalid_parameter_noinfo _invalid_parameter_noinfo_noreturn terminate _crt_atexit _register_onexit_function _initialize_onexit_table _c_exit _exit _seh_filter_exe _cexit exit _register_thread_local_exe_atexit_callback _initterm _initterm_e __p___argc __p___wargv _get_initial_wide_environment _set_app_type _errno

api-ms-win-crt-string-l1-1-0

wcscat_s wcsncmp _wcsnicmp _wcsicmp strcpy_s

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vswprintf __stdio_common_vfwprintf __acrt_iob_func _set_fmode

api-ms-win-crt-convert-l1-1-0

_wtoi wcstoul wcstoll wcstol _wtoi64

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

user32

RegisterClassExW GetClassInfoExW

Name

.text

Size

368KB

Virtual Size

368KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

228KB

Virtual Size

228KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

aswAvBootTimeScanShMin.exe

IMPHASH 44f77d8583c4934cb44d7789359f6f8c
SHA256 f8f2700f13d407a92dddc4ba604df20e54462e345054c7055c9aa083d06e9ebc
MD5 80356632b9b773725b3bfa37225f8ecc
SHA1 fbb95b7d671249b9569cfc15a5b6cb28d0327025
SHA512 07fb6a9e1f47d512fb19734e4925ca56584ba55a99f216c5cf31cd1d8b2cd3603461e203b3a8955e7fb0b0f1af95fbdfb05df309beb51b6c15e551f8e1a7e34b
SSDEEP 24576:Z4cgFnQ+7oiNN5z3/W6di4fAWbh0lhSMXlzr2TrZAV:Z4cmciNN5z3+Nf
TLSH
T1AE556C5A7A9C24E4C1BEE0758773468AEB317C514B61C6CB66E0DE150FABAE07D7E300
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

1b:a9:6c:04:9d:d3:95:f7:68:6e:8e:15:4b:41:4f:91:58:f0:61:1e:fd:ca:99:22:70:1a:5e:a1:5a:03:e8:02

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Chains

Mar 26, 2026

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Serial Number

40:1c:57:14:6d:ce:58:df:b9:22:21:87:8d:2a:a5:63

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2025 - Jun 10, 2028

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

473712

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\aswAvBootTimeScanShMin.pdb

comctl32

InitCommonControlsEx

shell32

SHGetKnownFolderPath

ntdll

NtQueryKey NtOpenKey RtlNtStatusToDosError NtSetInformationThread NtClose VerSetConditionMask RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind NtDeleteKey RtlPcToFileHeader RtlUnwindEx RtlUnwind

kernel32

GetTickCount GetFileAttributesW CreateDirectoryW OutputDebugStringW IsDebuggerPresent GetFileAttributesExW GetLocaleInfoW LoadLibraryExW FreeLibrary WaitForSingleObject GetCurrentProcessId TerminateProcess Sleep VerifyVersionInfoW GetExitCodeProcess CreateProcessW ResumeThread WaitForMultipleObjects GetCurrentThread GetThreadPriority GetCurrentProcess InitializeCriticalSectionAndSpinCount LocalFree RaiseException GetThreadTimes TerminateThread SetThreadPriority QueryPerformanceFrequency GetSystemTimeAsFileTime QueryPerformanceCounter QueryThreadCycleTime InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute ExpandEnvironmentStringsW GetModuleFileNameW GetSystemDirectoryW VirtualProtect GetFileInformationByHandle GlobalMemoryStatusEx GetEnvironmentVariableW GetExitCodeThread TlsAlloc TlsFree TlsSetValue TlsGetValue SetEndOfFile MoveFileExW GetWindowsDirectoryW FindClose GetFullPathNameW FindFirstFileExW FindNextFileW QueryDosDeviceW GetLogicalDrives GetVolumePathNameW GetVolumeNameForVolumeMountPointW FlushFileBuffers OutputDebugStringA SetFileInformationByHandle GetDiskFreeSpaceExW K32GetMappedFileNameW FindFirstVolumeW FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose GetSystemTimes GetTickCount64 FreeLibraryAndExitThread ExitThread CreateThread InterlockedPushEntrySList GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeSListHead GetCPInfo CompareStringEx LCMapStringEx EncodePointer WaitForSingleObjectEx WakeConditionVariable InitOnceComplete InitOnceBeginInitialize TryAcquireSRWLockExclusive SetFilePointer WriteFile QueryUnbiasedInterruptTime ReadFile GetFileSizeEx SetFilePointerEx CompareFileTime InitializeCriticalSection HeapReAlloc HeapSize CompareStringW LockFileEx UnlockFileEx EnterCriticalSection LeaveCriticalSection DeleteFileW MultiByteToWideChar CreateFileW DeleteVolumeMountPointW SetVolumeMountPointW DebugBreak WideCharToMultiByte GetModuleHandleW GetProcessHeap DeleteCriticalSection GetProcAddress DecodePointer HeapAlloc GetLastError FormatMessageW GetCurrentThreadId InitializeCriticalSectionEx HeapFree GetModuleFileNameA GetModuleHandleExW ResetEvent CreateEventW SetEvent CloseHandle SetLastError GetStdHandle ExitProcess GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleOutputCP GetConsoleMode ReadConsoleW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle HeapQueryInformation WriteConsoleW RegisterWaitForSingleObject FileTimeToSystemTime GetStringTypeW SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive

user32

MessageBoxA MsgWaitForMultipleObjectsEx PostQuitMessage PeekMessageW TranslateMessage DispatchMessageW GetClassInfoExW RegisterWindowMessageW DefWindowProcW DestroyWindow SendMessageW GetClientRect ShowWindow CreateWindowExW GetSystemMetrics RegisterClassExW LoadCursorW

gdi32

GetStockObject

advapi32

RegDeleteTreeW RegDeleteKeyExW CryptReleaseContext CryptGenRandom CryptAcquireContextW RegQueryInfoKeyW RegSetValueExW RegCloseKey RegOpenKeyExW CloseServiceHandle CreateServiceW ChangeServiceConfigW StartServiceW QueryServiceStatus OpenServiceW OpenSCManagerW RevertToSelf EqualSid OpenProcessToken GetTokenInformation OpenThreadToken RegQueryValueExW RegCreateKeyExW

ole32

CoTaskMemFree

rpcrt4

RpcEpUnregister UuidFromStringW

shlwapi

PathMatchSpecW

Name

.text

Size

780KB

Virtual Size

780KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

345KB

Virtual Size

345KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

49KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

99KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

aswChLic.exe

IMPHASH e5a6dc568314d7b731ae80ac7e387619
SHA256 91fdcb78e13ec9b9c1048509adefb0e0dc71be3f8ea0b2f27f752081cdd87e78
MD5 d149f44448bb5443dbd14eb9056227a9
SHA1 82b66ddc1d96ab0cf1ee10539f148df577bcbb13
SHA512 6780e793d044787636f563256cf66b1210a394cdab7cd33dafd27a54a20df63e6de6579d3bd57733826147e736a6517b266ca051b3c29a53a1a2eaf699d99ffb
SSDEEP 6144:IimMxDXvFSGhDH/K7ph0lhSMXlBXBWfo8femLiJGJoKV:O4SGdKph0lhSMXl+j12KV
TLSH
T13E6469C67F96A8DCE80ABC744467164CEB327C208F1292DB6275D9252FE35D1ADFE201
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

0a:8a:1d:71:e9:16:37:37:a5:32:dc:53:32:02:52:23:a8:4c:d8:ae:50:a5:94:48:e5:6e:e1:20:42:61:6c:20

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Chains

Mar 26, 2026

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Serial Number

40:1c:57:14:6d:ce:58:df:b9:22:21:87:8d:2a:a5:63

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2025 - Jun 10, 2028

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

93280

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\aswChLic.pdb

ntdll

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind

kernel32

GetProcessHeap WideCharToMultiByte DebugBreak OutputDebugStringW IsDebuggerPresent CompareStringW SetLastError GetCurrentProcess FormatMessageW InitializeSListHead FreeLibrary LeaveCriticalSection EnterCriticalSection GetTickCount64 DeleteCriticalSection InitializeCriticalSection RaiseException HeapAlloc SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentThreadId GetModuleHandleExW HeapFree GetModuleFileNameA SetDllDirectoryW GetModuleHandleW ExitProcess GetProcAddress GetCommandLineW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive

user32

AllowSetForegroundWindow GetWindowThreadProcessId SendMessageW FindWindowW

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey

shell32

CommandLineToArgvW

msvcp140

?id@?$numpunct@_W@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Incref@facet@locale@std@@UEAAXXZ _Mbrtowc ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??1_Locinfo@std@@QEAA@XZ ??1_Lockit@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??0_Lockit@std@@QEAA@H@Z ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??Bid@locale@std@@QEAA_KXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Xbad_alloc@std@@YAXXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xbad_function_call@std@@YAXXZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler memcpy __current_exception __current_exception_context _purecall _CxxThrowException __std_terminate memset __std_exception_destroy __std_exception_copy memmove

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _seh_filter_exe _exit _c_exit _initterm_e _get_wide_winmain_command_line _invalid_parameter_noinfo_noreturn _initialize_onexit_table _register_onexit_function _crt_atexit _invalid_parameter_noinfo terminate _errno _configure_wide_argv _set_app_type _initterm _initialize_wide_environment

api-ms-win-crt-heap-l1-1-0

_set_new_mode free _callnewh malloc calloc

api-ms-win-crt-math-l1-1-0

_dsign _fdsign _set_FMA3_enable __setusermatherr _ldsign _get_FMA3_enable

api-ms-win-crt-stdio-l1-1-0

_set_fmode __stdio_common_vswprintf __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

aswEngSrv.exe

IMPHASH 4467db7154ebd902efa92805aad48d61
SHA256 25da74be23eb400ab8061621e1a7d04df7e756e198de394bde2393635b0e14f4
MD5 a93d70ea333887aa9b24225a540927f7
SHA1 608eaadc8373c19455915697c78f5f861d4f8bea
SHA512 dee07233bf15db05c6650cf97566a46ed6de979655903b1fe04e667c67d6ae3c06fc33e2d8b3599afcf439858f06b06da409d63da75a9fd8b4989598db23ed1b
SSDEEP 6144:tsDy0kQd+RwXKkHJW7mUaEDNtxx22MTibp4DfkrAe87Zep70Ghld/ZTmtEx+gphw:lHSy1DN922Myptp1285RYV
TLSH
T1C3E429416BE810D9D5BBF63986A7852AFF717C201F2286DB8560CA790FE36E46D7D300
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

d7:14:b1:3b:da:ec:11:9c:9a:50:e3:02:f3:e2:61:91:34:85:71:f7:a4:66:ca:ba:b8:96:6e:1b:42:b0:07:12

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Chains

Mar 26, 2026

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Serial Number

40:1c:57:14:6d:ce:58:df:b9:22:21:87:8d:2a:a5:63

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2025 - Jun 10, 2028

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

346032

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\aswEngSrv.pdb

ntdll

RtlVirtualUnwind RtlSetDaclSecurityDescriptor RtlLengthSid RtlCaptureContext ZwFsControlFile ZwOpenThreadTokenEx ZwOpenProcessTokenEx ZwDuplicateObject NtQueryInformationToken RtlAddAccessAllowedAce ZwCreateNamedPipeFile RtlCreateAcl RtlCreateSecurityDescriptor LdrGetProcedureAddress LdrLoadDll ZwWriteFile ZwReadFile ZwWaitForSingleObject ZwWaitForMultipleObjects ZwResetEvent ZwClose ZwSetEvent RtlLeaveCriticalSection ZwCreateEvent RtlInitializeCriticalSection RtlEnterCriticalSection RtlDeleteCriticalSection RtlNtStatusToDosErrorNoTeb VerSetConditionMask ZwQueryInformationProcess RtlLookupFunctionEntry RtlGetVersion

aswcmnos

dep_fsCloseFile dep_fsCreateFromHandle

aswcmnbs

fsGetAvastLogPath

kernel32

GetProcAddress GetModuleHandleW IsBadWritePtr GetSystemDirectoryW LoadLibraryW FreeLibrary IsBadReadPtr VirtualProtect SetUnhandledExceptionFilter EnterCriticalSection GetCurrentProcess VirtualAlloc SetThreadPriority LeaveCriticalSection InitializeCriticalSection GetCurrentThreadId SuspendThread ResumeThread Sleep GetCurrentThread GetThreadPriority CloseHandle GetSystemInfo VirtualProtectEx GetThreadContext GetCurrentProcessId FlushInstructionCache LockFileEx OpenThread GetModuleFileNameW QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimeAsFileTime InitOnceExecuteOnce CancelIo SetLastError GetLastError CancelIoEx CreateThread WideCharToMultiByte VerifyVersionInfoW GetTickCount FlushFileBuffers CreateFileA SleepConditionVariableSRW UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead WriteFile WerRegisterMemoryBlock WerUnregisterMemoryBlock VirtualFree WakeAllConditionVariable AcquireSRWLockExclusive VirtualQuery ReleaseSRWLockExclusive MapViewOfFile CreateFileMappingW UnlockFile UnmapViewOfFile

advapi32

EventUnregister EventRegister EventWriteTransfer

ole32

GetClassFile

msvcp140

?_Throw_Cpp_error@std@@YAXH@Z _Mtx_lock _Mtx_unlock

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy _CxxThrowException memcpy memset __current_exception_context _purecall __C_specific_handler __std_terminate __current_exception __std_exception_copy wcsrchr wcsstr memcmp memmove

api-ms-win-crt-runtime-l1-1-0

_exit exit _initterm_e _initterm _c_exit _register_thread_local_exe_atexit_callback _initialize_wide_environment _configure_wide_argv terminate _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _get_wide_winmain_command_line _wassert

api-ms-win-crt-heap-l1-1-0

_callnewh malloc _set_new_mode free

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf __p__commode _set_fmode

api-ms-win-crt-string-l1-1-0

wcsnlen strnlen

api-ms-win-crt-convert-l1-1-0

wcstoull

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

ws2_32

WSASetLastError

bcrypt

BCryptGenerateSymmetricKey BCryptDeriveKey BCryptSecretAgreement BCryptExportKey BCryptFinalizeKeyPair BCryptGenerateKeyPair BCryptImportKeyPair BCryptSetProperty BCryptEncrypt BCryptCloseAlgorithmProvider BCryptDestroyKey BCryptDestroySecret BCryptOpenAlgorithmProvider

aswRunDll.exe

IMPHASH 222c98d7633752a3a49f2f0b1419ed11
SHA256 96bc2b3f32b79e2a82af88d3075c4c890938040f8c276c9388888f25baaaf368
MD5 f85c68873791e9d2f3751b18db853e83
SHA1 064afe3832488fe96289c705f12f7f6a93aa07b6
SHA512 402017be41b3a804dc9fa7040931225266c17a132a843f0a5868bdc6e8f6bcb59daaa1b0bfc56c70025175d814b7f440a7b7ba46e9456b7ececed81a868892fc
SSDEEP 49152:z2dBHFl4nnInMtC+aLj7Ev+dkWfL73+WpmXoJXqSWoKKwjm7NAiRfd+dnakAgtMi:gTD73QXoPdo
TLSH
T170267C0E7A2D00E9D1FFD13D9667550AEA717C994339A2EB59E18E190F13BF09E3A700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

f7:e4:7d:e0:3e:03:16:1a:d8:c9:e5:1c:27:e2:b1:93:ee:8f:bf:fb:8f:f9:1a:00:e5:50:53:18:9e:e7:ac:12

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Chains

Mar 26, 2026

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Serial Number

40:1c:57:14:6d:ce:58:df:b9:22:21:87:8d:2a:a5:63

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2025 - Jun 10, 2028

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

1884400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\RunDll.pdb

winhttp

WinHttpGetDefaultProxyConfiguration WinHttpGetIEProxyConfigForCurrentUser

rpcrt4

Ndr64AsyncServerCallAll NdrAsyncServerCall NdrServerCall2 RpcStringBindingParseW Ndr64AsyncClientCall RpcAsyncCancelCall RpcAsyncInitializeHandle RpcAsyncCompleteCall NdrClientCall3 RpcSsDestroyClientContext RpcBindingFree RpcStringFreeW RpcBindingFromStringBindingW RpcStringBindingComposeW UuidCreate NdrServerCallAll RpcBindingToStringBindingW RpcEpUnregister RpcEpRegisterW RpcServerUseProtseqEpW RpcObjectSetType RpcServerRegisterIf2 RpcServerUnregisterIfEx RpcImpersonateClient RpcRevertToSelf I_RpcBindingInqLocalClientPID RpcMgmtEpEltInqNextW RpcMgmtEpEltInqBegin RpcIfInqId RpcMgmtEpEltInqDone UuidFromStringW UuidToStringW

bcrypt

BCryptGenerateSymmetricKey BCryptEncrypt BCryptSecretAgreement BCryptExportKey BCryptFinalizeKeyPair BCryptGenerateKeyPair BCryptCloseAlgorithmProvider BCryptDeriveKey BCryptSetProperty BCryptOpenAlgorithmProvider BCryptDestroySecret BCryptDestroyKey BCryptImportKeyPair

wtsapi32

WTSEnumerateSessionsW WTSQuerySessionInformationW WTSFreeMemory WTSQueryUserToken

shell32

ord165 SHGetKnownFolderPath

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW RegDeleteKeyExW RegQueryMultipleValuesW RegQueryInfoKeyW RegDeleteValueW RegEnumKeyExW RegSetValueExW RegEnumValueW FreeSid RegOpenKeyExW AddAce InitializeAcl GetLengthSid AllocateAndInitializeSid AdjustTokenPrivileges LookupPrivilegeValueW ImpersonateSelf RevertToSelf ImpersonateLoggedOnUser RegNotifyChangeKeyValue RegCloseKey CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceStatus RegCreateKeyExW RegQueryValueExW RegDeleteTreeW CryptAcquireContextW OpenThreadToken CryptGenRandom InitializeSecurityDescriptor SetSecurityDescriptorDacl DuplicateTokenEx CheckTokenMembership EventWriteTransfer EventRegister EventUnregister GetTokenInformation OpenProcessToken EqualSid CryptReleaseContext DuplicateToken

user32

SendMessageW SetWindowLongPtrW RegisterWindowMessageW LoadStringW GetClassInfoExW RegisterClassExW PostMessageW GetGUIThreadInfo SendMessageCallbackW IsHungAppWindow PeekMessageW GetSystemMetrics

ole32

CoTaskMemFree CoCreateGuid

ntdll

NtQueryInformationWorkerFactory RtlVirtualUnwind RtlLookupFunctionEntry NtSystemDebugControl VerSetConditionMask RtlDllShutdownInProgress RtlNtStatusToDosError NtSetInformationThread NtCreateWorkerFactory NtOpenKey NtQueryKey NtQueryInformationProcess NtDeleteKey RtlCaptureContext NtQuerySystemInformation RtlPcToFileHeader NtClose RtlUnwindEx

kernel32

CloseThreadpoolWork SubmitThreadpoolWork FlsFree CreateThreadpoolWork FreeLibraryWhenCallbackReturns GetLocaleInfoEx InitOnceBeginInitialize InitOnceComplete LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStringTypeW GetFileType GetConsoleOutputCP GetConsoleMode GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle HeapQueryInformation WriteConsoleW AreFileApisANSI GetFileInformationByHandleEx FormatMessageA WaitForSingleObjectEx RegisterWaitForSingleObject WakeAllConditionVariable SleepConditionVariableSRW TryAcquireSRWLockExclusive FlsSetValue ReleaseSRWLockShared AcquireSRWLockShared IsProcessorFeaturePresent ResetEvent FlsGetValue FlsAlloc ExitProcess GetStdHandle FreeLibraryAndExitThread ExitThread InterlockedPushEntrySList GetStartupInfoW UnhandledExceptionFilter InitializeSListHead GetCPInfo CompareStringEx LCMapStringEx EncodePointer WakeConditionVariable WideCharToMultiByte MultiByteToWideChar EnterCriticalSection LeaveCriticalSection CompareStringW GetModuleHandleW GetProcAddress CloseHandle GetLastError GetCurrentProcessId SetDllDirectoryW GetProcessHeap CreateFileW GetCommandLineW HeapFree HeapAlloc InitializeCriticalSection DeleteCriticalSection GetModuleFileNameA GetModuleHandleExW FormatMessageW GetCurrentThreadId DebugBreak GlobalFree GetProcessId GetCurrentProcess GetEnvironmentVariableW SetEnvironmentVariableW CreateThread GetSystemDirectoryW LoadLibraryW FreeLibrary GetFileAttributesW CreateProcessW WaitForSingleObject GetExitCodeProcess VerifyVersionInfoW FindFirstFileW DeleteFileW InitializeProcThreadAttributeList UpdateProcThreadAttribute GetSystemTimeAsFileTime FindClose OutputDebugStringW IsDebuggerPresent Sleep SetEvent CheckRemoteDebuggerPresent VirtualProtect FlushInstructionCache RaiseException SetErrorMode SetUnhandledExceptionFilter AddVectoredExceptionHandler RemoveVectoredExceptionHandler VirtualQuery GetTickCount CreateEventW QueryFullProcessImageNameW GetPriorityClass OpenThread GetThreadPriority K32EnumProcesses OpenProcess GetThreadTimes K32GetProcessMemoryInfo CreateToolhelp32Snapshot Process32FirstW Process32NextW GetProcessHandleCount CreateIoCompletionPort DeviceIoControl ReadProcessMemory TerminateProcess TlsFree TlsAlloc TlsSetValue TlsGetValue SetLastError GetNativeSystemInfo DuplicateHandle GetSystemTimes GetProcessTimes InitializeCriticalSectionEx HeapSize HeapReAlloc DecodePointer HeapDestroy GetFileTime CompareFileTime SetFilePointerEx UnlockFileEx LockFileEx GetFileSizeEx ReadFile QueryUnbiasedInterruptTime UnregisterWaitEx CancelIoEx ReadDirectoryChangesW GetOverlappedResult PostQueuedCompletionStatus GetQueuedCompletionStatus WriteFile WaitForMultipleObjects GetTickCount64 LocalFree ProcessIdToSessionId GetFileAttributesExW GetLocaleInfoW LoadLibraryExW ResumeThread GetCurrentThread VirtualAlloc WerRegisterMemoryBlock WerUnregisterMemoryBlock VirtualFree QueryPerformanceCounter QueryPerformanceFrequency InitOnceExecuteOnce AcquireSRWLockExclusive ReleaseSRWLockExclusive UnmapViewOfFile UnlockFile CreateFileMappingW MapViewOfFile InitializeCriticalSectionAndSpinCount TerminateThread SetThreadPriority QueryThreadCycleTime GetThreadId WTSGetActiveConsoleSessionId FlushFileBuffers GetFileInformationByHandle GetFullPathNameW OutputDebugStringA FileTimeToSystemTime GetModuleFileNameW GetSystemInfo GetVersionExW ExpandEnvironmentStringsW GetShortPathNameW GetSystemWindowsDirectoryW GetProcessAffinityMask GetLongPathNameW GlobalMemoryStatusEx GetExitCodeThread GetDriveTypeW SetFilePointer SetFileAttributesW GetFileSize SetEndOfFile MoveFileExW GetWindowsDirectoryW SetFileTime CreateDirectoryW GetCurrentDirectoryW FindFirstFileExW FindNextFileW QueryDosDeviceW GetVolumePathNameW GetVolumeNameForVolumeMountPointW WriteProcessMemory GetVersion SizeofResource LockResource LoadResource FindResourceExW FindResourceW CopyFileW SetFileInformationByHandle GetDiskFreeSpaceExW K32GetMappedFileNameW FindFirstVolumeW FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolWait WaitForThreadpoolWaitCallbacks

powrprof

CallNtPowerInformation

shlwapi

PathAppendW

fltlib

FilterReplyMessage FilterGetMessage FilterConnectCommunicationPort FilterSendMessage FilterLoad

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

Name

.text

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

460KB

Virtual Size

498KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

135KB

Virtual Size

135KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

aswidsagent.exe

IMPHASH b222b55f20ba561bb60fc2971d301471
SHA256 d6e1070aa6b565c516a21cef083b06d4c622b6ddbab58a3565cf8b393b0ccb17
MD5 17e20e908355af1b9d99ce8e1e1cf5b5
SHA1 adec35df4b7ae579c42aab2894c43724e2c347bc
SHA512 47fefa89848e21f7f27c10132c3d5cd1d7b798dde59e527b4153b52479766d063dcb4db8d90b855cf9f061c3cc6a49284b7cc769739ac5cdeb770a96ef713648
SSDEEP 49152:1OQcWoqhJevVQmOvD8Cfe5XXTYSbk3bz5f6uHap+kWxDw5n4Vu8Uws2vbZQoZvkD:pojQmOrPf6ubUlLQMh62a3HowGN9
TLSH
T13986192D7A6C10E8D7AEF079A693650AEF703CA10F1D96D7B5D08D190BE6AF05E3D210
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Digest

bf:c4:b3:db:8a:b5:a3:5b:9d:00:dd:7c:fe:68:6a:a2:f7:3b:97:d7:19:52:f9:d9:15:88:ce:cf:f6:af:2f:b9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Chains

Mar 26, 2026

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Serial Number

40:1c:57:14:6d:ce:58:df:b9:22:21:87:8d:2a:a5:63

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2025 - Jun 10, 2028

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

628544

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\aswidsagent.pdb

dll_loader

?load_dll@dll_loader@asw@@YAPEAUHINSTANCE__@@PEB_W0@Z ?free_dll@dll_loader@asw@@YA_NPEAUHINSTANCE__@@@Z

bcrypt

BCryptCloseAlgorithmProvider BCryptDestroyKey BCryptEncrypt BCryptGenerateSymmetricKey BCryptDeriveKey BCryptSecretAgreement BCryptExportKey BCryptFinalizeKeyPair BCryptGenerateKeyPair BCryptImportKeyPair BCryptDestroySecret BCryptSetProperty BCryptImportKey BCryptDecrypt BCryptOpenAlgorithmProvider

winhttp

WinHttpQueryDataAvailable WinHttpGetProxyForUrl WinHttpOpenRequest WinHttpGetDefaultProxyConfiguration WinHttpCrackUrl WinHttpQueryOption WinHttpSetOption WinHttpSetTimeouts WinHttpConnect WinHttpOpen WinHttpCloseHandle WinHttpReadData WinHttpGetIEProxyConfigForCurrentUser WinHttpWriteData WinHttpQueryHeaders WinHttpReceiveResponse WinHttpAddRequestHeaders WinHttpSendRequest WinHttpSetCredentials

wtsapi32

WTSQueryUserToken WTSFreeMemory WTSEnumerateSessionsW

shell32

ord165 SHGetPathFromIDListW SHGetKnownFolderPath

ntdll

RtlEqualUnicodeString RtlOpenCurrentUser ZwQueryValueKey RtlReAllocateHeap NtSetInformationThread ZwAllocateUuids ZwQueryInformationFile RtlInitAnsiString RtlIsDosDeviceName_U RtlLocalTimeToSystemTime RtlSystemTimeToLocalTime RtlTimeFieldsToTime ZwOpenSymbolicLinkObject ZwDeviceIoControlFile ZwQuerySymbolicLinkObject ZwDuplicateToken ZwQueryObject ZwCreateFile ZwQueryVolumeInformationFile ZwFsControlFile LdrGetDllHandle RtlExpandEnvironmentStrings_U RtlCreateUnicodeString LdrLoadDll LdrUnloadDll LdrGetProcedureAddress RtlGetFullPathName_U RtlDllShutdownInProgress ZwWaitForMultipleObjects ZwSetInformationObject ZwQueryInstallUILanguage ZwSuspendProcess ZwQuerySystemInformation RtlFreeHeap RtlAllocateHeap ZwOpenKey RtlGetDaclSecurityDescriptor RtlCreateSecurityDescriptor RtlSetGroupSecurityDescriptor ZwSetSecurityObject RtlEqualSid ZwQuerySecurityObject ZwOpenFile RtlCreateAcl RtlAddAccessDeniedAceEx ZwReadFile ZwWriteFile ZwSetInformationFile ZwQueryAttributesFile ZwQueryKey ZwEnumerateValueKey ZwCreateKey ZwLoadKey ZwNotifyChangeKey ZwSetInformationToken ZwSaveKey ZwEnumerateKey ZwUnloadKey ZwQueryDirectoryFile ZwUnmapViewOfSection ZwCreateSection ZwMapViewOfSection ZwResumeProcess ZwFlushVirtualMemory ZwOpenDirectoryObject RtlDeleteCriticalSection RtlInitializeCriticalSection ZwReleaseSemaphore ZwCreateSemaphore RtlCopySid RtlValidSecurityDescriptor RtlGetGroupSecurityDescriptor RtlLengthSid ZwOpenThreadToken RtlGetOwnerSecurityDescriptor RtlAddAccessAllowedAceEx RtlFreeUnicodeString RtlGetAce RtlGetSaclSecurityDescriptor RtlSetDaclSecurityDescriptor RtlSetOwnerSecurityDescriptor RtlSetSaclSecurityDescriptor ZwQueryVirtualMemory ZwResetEvent ZwSetEvent ZwCreateEvent ZwOpenProcess RtlLeaveCriticalSection ZwAdjustPrivilegesToken ZwOpenProcessToken RtlEnterCriticalSection ZwQueryInformationToken RtlGetCurrentDirectory_U ZwCreateNamedPipeFile RtlQueryEnvironmentVariable_U VerSetConditionMask RtlGetNativeSystemInformation ZwReadVirtualMemory ZwResumeThread ZwClose NtSystemDebugControl RtlLookupFunctionEntry RtlVirtualUnwind NtClose NtCreateWorkerFactory NtQueryInformationProcess NtQuerySystemInformation NtQueryInformationWorkerFactory RtlNtStatusToDosError RtlInitUnicodeString ZwDelayExecution ZwTerminateProcess RtlDosPathNameToNtPathName_U NtOpenKey NtQueryKey NtDeleteKey ZwFlushBuffersFile ZwReleaseMutant RtlCaptureContext RtlCreateUserThread RtlCompareUnicodeString ZwSetInformationThread ZwQueryInformationThread ZwQueryInformationProcess CsrClientCallServer ZwDuplicateObject RtlExitUserThread ZwTerminateThread ZwWaitForSingleObject RtlDowncaseUnicodeChar RtlUpcaseUnicodeChar ZwCancelIoFile RtlTimeToTimeFields RtlxOemStringToUnicodeSize RtlUnicodeStringToOemString RtlOemStringToUnicodeString NlsMbOemCodePageTag RtlxUnicodeStringToOemSize RtlUnicodeStringToAnsiString RtlxUnicodeStringToAnsiSize RtlxAnsiStringToUnicodeSize RtlUpcaseUnicodeString NlsMbCodePageTag RtlAnsiStringToUnicodeString

kernel32

SetEvent CheckRemoteDebuggerPresent FlushInstructionCache SetErrorMode SetUnhandledExceptionFilter AddVectoredExceptionHandler RemoveVectoredExceptionHandler GetTickCount CreateEventW QueryFullProcessImageNameW GetPriorityClass OpenThread GetThreadPriority K32EnumProcesses OpenProcess GetThreadTimes K32GetProcessMemoryInfo CreateToolhelp32Snapshot Process32FirstW Process32NextW GetProcessHandleCount CreateIoCompletionPort DeviceIoControl ReadProcessMemory TerminateProcess TlsFree TlsAlloc TlsSetValue TlsGetValue SetLastError GetNativeSystemInfo DuplicateHandle GetSystemTimes GetProcessTimes CompareStringW GetOverlappedResult PostQueuedCompletionStatus GetQueuedCompletionStatus WriteFile ReadFile CancelIoEx WaitForMultipleObjects GetTickCount64 VirtualAlloc WerRegisterMemoryBlock WerUnregisterMemoryBlock VirtualFree QueryPerformanceCounter QueryPerformanceFrequency InitOnceExecuteOnce AcquireSRWLockExclusive ReleaseSRWLockExclusive UnmapViewOfFile UnlockFile CreateFileMappingW MapViewOfFile LockFileEx GlobalFree UnlockFileEx GetFileSizeEx ResumeThread ProcessIdToSessionId GetCurrentThread LocalFree LocalAlloc WTSGetActiveConsoleSessionId InitializeCriticalSectionEx CompareFileTime K32GetMappedFileNameW GetModuleFileNameW GetWindowsDirectoryW CreateDirectoryW ExpandEnvironmentStringsW SetFileAttributesW CopyFileW IsDebuggerPresent GetFileAttributesExW GetLogicalDrives GetDriveTypeW GetDiskFreeSpaceExW GetVolumePathNameW GetVolumeNameForVolumeMountPointW FindFirstVolumeW QueryDosDeviceW FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose GlobalMemoryStatusEx WakeAllConditionVariable GlobalAddAtomW CreateSemaphoreW GlobalDeleteAtom GetSystemTimeAsFileTime UpdateProcThreadAttribute InitializeProcThreadAttributeList DeleteFileW CreateFileW FindFirstFileW VerifyVersionInfoW GetExitCodeProcess WaitForSingleObject CreateProcessW GetFileAttributesW LoadLibraryW InitOnceComplete InitOnceBeginInitialize CloseHandle CreateThread Sleep OutputDebugStringW SetEnvironmentVariableW GetEnvironmentVariableW GetCurrentProcess GetProcessId GetCurrentProcessId LoadLibraryExA FreeLibrary VirtualQuery VirtualProtect GetSystemInfo RaiseException GetSystemDirectoryW DebugBreak HeapFree HeapAlloc GetCurrentThreadId FormatMessageW GetProcessHeap GetModuleHandleExW GetModuleFileNameA LeaveCriticalSection EnterCriticalSection DeleteCriticalSection GetLocaleInfoEx FormatMessageA SleepConditionVariableSRW AcquireSRWLockShared ReleaseSRWLockShared AreFileApisANSI UnhandledExceptionFilter IsProcessorFeaturePresent InitializeCriticalSection WideCharToMultiByte LoadLibraryExW GetModuleHandleW GetProcAddress LoadLibraryA GetLastError MultiByteToWideChar LocalReAlloc FindClose WaitForMultipleObjectsEx SetConsoleCtrlHandler GetConsoleWindow GetLogicalDriveStringsW QueryThreadCycleTime CreateMutexW InitializeCriticalSectionAndSpinCount SetThreadPriority ResetEvent TerminateThread QueryUnbiasedInterruptTime InitializeSListHead

ole32

CoInitializeEx CoUninitialize CoSetProxyBlanket CoCreateInstance CLSIDFromString CoInitializeSecurity CoTaskMemFree

msvcp140

_Mbrtowc ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?classic@locale@std@@SAAEBV12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$numpunct@D@std@@2V0locale@2@A ?id@?$ctype@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z _Mtx_lock _Mtx_unlock ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBADD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ??Bid@locale@std@@QEAA_KXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?good@ios_base@std@@QEBA_NXZ ?uncaught_exceptions@std@@YAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?id@?$numpunct@_W@std@@2V0locale@2@A ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??Bios_base@std@@QEBA_NXZ ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?id@?$ctype@_W@std@@2V0locale@2@A ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ?_Xinvalid_argument@std@@YAXPEBD@Z _Thrd_detach _Thrd_join _Thrd_id _Cnd_do_broadcast_at_thread_exit ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?toupper@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ _Cnd_broadcast _Cnd_wait ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_ReportUnobservedException@details@Concurrency@@YAXXZ ??0task_continuation_context@Concurrency@@AEAA@XZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z _Cnd_register_at_thread_exit _Cnd_unregister_at_thread_exit ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z _Query_perf_counter _Query_perf_frequency ?eof@ios_base@std@@QEBA_NXZ ?fail@ios_base@std@@QEBA_NXZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEB_W_J@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ?id@?$collate@_W@std@@2V0locale@2@A _Wcsxfrm _Wcscoll ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z _Lock_shared_ptr_spin_lock _Unlock_shared_ptr_spin_lock _Xtime_get_ticks ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z

msvcp140_atomic_wait

__std_atomic_wait_direct __std_atomic_notify_all_direct

powrprof

CallNtPowerInformation

netapi32

NetApiBufferFree NetShareGetInfo

virtdisk

GetStorageDependencyInformation

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strrchr _purecall longjmp _CxxThrowException memset __current_exception_context __current_exception wcsstr __std_exception_copy memcpy memchr _set_se_translator wcschr __std_exception_destroy __C_specific_handler __C_specific_handler_noexcept __std_terminate memmove __RTDynamicCast __std_type_info_name __intrinsic_setjmp strstr strchr __RTtypeid __std_type_info_hash __std_type_info_compare memcmp

api-ms-win-crt-heap-l1-1-0

free _callnewh calloc malloc _set_new_mode realloc

api-ms-win-crt-math-l1-1-0

_finite _isnan __setusermatherr ceil tan _dsign floor _get_FMA3_enable _set_FMA3_enable fmod _ldsign frexp ldexp log log10 pow sin _fdsign sqrt acos asin atan2 ceilf cos exp expf

api-ms-win-crt-runtime-l1-1-0

system abort _initialize_wide_environment _set_app_type _beginthreadex terminate _get_initial_wide_environment _invalid_parameter_noinfo _errno _invalid_parameter_noinfo_noreturn __p___wargv strerror __p___argc _initterm_e _initterm _register_thread_local_exe_atexit_callback exit _cexit _seh_filter_exe _exit _c_exit _initialize_onexit_table _register_onexit_function _configure_wide_argv _crt_atexit

api-ms-win-crt-stdio-l1-1-0

fopen __acrt_iob_func getc __stdio_common_vfprintf feof _set_fmode __p__commode __stdio_common_vsprintf fwrite _ftelli64 _fseeki64 fread fflush ferror __stdio_common_vswprintf_s fclose __stdio_common_vswscanf fgets ungetc _popen setvbuf tmpfile _pclose clearerr __stdio_common_vswprintf tmpnam freopen

api-ms-win-crt-string-l1-1-0

isgraph iscntrl iswalpha isalnum isupper wcsnlen ispunct isalpha islower strcpy_s _wcsnicmp wcscpy_s wcsncpy_s wcsncat_s iswprint strspn strpbrk strcoll tolower toupper wcscat_s wcsncmp isxdigit isspace isdigit strnlen strncmp

api-ms-win-crt-convert-l1-1-0

strtol wcstol _wtoi64 _wtoi _wcstoui64 wcstoul wcstod _ecvt_s wcstoll strtod

api-ms-win-crt-time-l1-1-0

wcsftime _mktime64 _localtime64 _gmtime64 clock _time64 _difftime64 strftime

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv _create_locale ___lc_codepage_func _free_locale setlocale

rpcrt4

RpcBindingFree NdrClientCall3 RpcStringFreeW RpcBindingFromStringBindingW UuidCreate RpcStringBindingComposeW

shlwapi

PathAppendW

advapi32

ImpersonateSelf QueryServiceStatusEx EnumServicesStatusW QueryServiceConfigW FlushTraceW RevertToSelf SetSecurityInfo ProcessTrace OpenTraceW EnableTraceEx2 EnableTrace StopTraceW StartTraceW CloseTrace StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW CryptReleaseContext CryptGenRandom CryptAcquireContextW RegSetValueExW RegDeleteValueW RegDeleteTreeW RegDeleteKeyExW RegCreateKeyExW RegOpenKeyExW RegQueryInfoKeyW RegEnumValueW RegEnumKeyExW RegQueryValueExW RegCloseKey RegQueryMultipleValuesW FreeSid EqualSid ImpersonateLoggedOnUser LookupAccountSidW CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceStatus EventWriteTransfer EventRegister EventUnregister OpenProcessToken DuplicateToken CheckTokenMembership GetTokenInformation DuplicateTokenEx OpenThreadToken LookupPrivilegeValueW AdjustTokenPrivileges SetEntriesInAclW AllocateAndInitializeSid GetLengthSid GetSecurityInfo

user32

PeekMessageW IsHungAppWindow GetSystemMetrics GetGUIThreadInfo UnregisterDeviceNotification RegisterDeviceNotificationW RegisterClassExW GetClassInfoExW SendMessageCallbackW

aswcmnis

sha256Final sha256Update sha256Init BZ2_bzCompress BZ2_bzCompressInit BZ2_bzCompressEnd BZ2_bzDecompressEnd BZ2_bzDecompress BZ2_bzDecompressInit

aswcmnos

cmnosFree cmnosInit aswcmnosDllMain cmnosMiniInit

aswcmnbs

cmnbFree GetHardwareId cmnbInit aswcmnbsDllMain secIsProcessTrusted

protobuf

?UnknownFieldParse@internal@protobuf@google@@YAPEBDIPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBDPEAVParseContext@123@@Z ?ParseMessage@ParseContext@internal@protobuf@google@@QEAAPEBDPEAVMessageLite@34@PEBD@Z ?WriteVarint@internal@protobuf@google@@YAXI_KPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?end@?$RepeatedField@I@protobuf@google@@QEBA?AV?$RepeatedIterator@$$CBI@internal@23@XZ ?begin@?$RepeatedField@I@protobuf@google@@QEBA?AV?$RepeatedIterator@$$CBI@internal@23@XZ ?ParseFromZeroCopyStream@MessageLite@protobuf@google@@QEAA_NPEAVZeroCopyInputStream@io@23@@Z ?data@?$RepeatedField@I@protobuf@google@@QEBAPEBIXZ ?empty@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEBA_NXZ ?begin@?$RepeatedField@_K@protobuf@google@@QEAA?AV?$RepeatedIterator@_K@internal@23@XZ ?end@?$RepeatedField@_K@protobuf@google@@QEAA?AV?$RepeatedIterator@_K@internal@23@XZ ?erase@?$RepeatedField@_K@protobuf@google@@QEAA?AV?$RepeatedIterator@_K@internal@23@V?$RepeatedIterator@$$CB_K@523@@Z ?Add@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAAX$$QEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?Add@?$RepeatedField@_K@protobuf@google@@QEAAXAEB_K@Z ?ClearToEmpty@ArenaStringPtr@internal@protobuf@google@@QEAAXXZ ?PackedFixed32Parser@internal@protobuf@google@@YAPEBDPEAXPEBDPEAVParseContext@123@@Z ?PackedSInt32Parser@internal@protobuf@google@@YAPEBDPEAXPEBDPEAVParseContext@123@@Z ?SInt32Size@WireFormatLite@internal@protobuf@google@@SA_KAEBV?$RepeatedField@H@34@@Z ?size@?$RepeatedField@_K@protobuf@google@@QEBAHXZ ?Clear@?$RepeatedField@_K@protobuf@google@@QEAAXXZ ??1?$RepeatedField@_K@protobuf@google@@QEAA@XZ ??0?$RepeatedField@_K@protobuf@google@@QEAA@PEAVArena@12@@Z ?PackedUInt64Parser@internal@protobuf@google@@YAPEBDPEAXPEBDPEAVParseContext@123@@Z ?UInt64Size@WireFormatLite@internal@protobuf@google@@SA_KAEBV?$RepeatedField@_K@34@@Z ?MergeFrom@?$RepeatedField@_K@protobuf@google@@QEAAXAEBV123@@Z ?PackedEnumParser@internal@protobuf@google@@YAPEBDPEAXPEBDPEAVParseContext@123@@Z ?data@?$RepeatedField@_K@protobuf@google@@QEBAPEB_KXZ ?WriteStringOutline@EpsCopyOutputStream@io@protobuf@google@@AEAAPEAEIAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAE@Z ?VerifyUTF8@internal@protobuf@google@@YA_NVStringPiece@stringpiece_internal@23@PEBD@Z ?VerifyUtf8String@WireFormatLite@internal@protobuf@google@@SA_NPEBDHW4Operation@1234@0@Z ?DestroyProtos@RepeatedPtrFieldBase@internal@protobuf@google@@IEAAXXZ ?InternalExtend@RepeatedPtrFieldBase@internal@protobuf@google@@AEAAPEAPEAXH@Z ?WriteStringMaybeAliasedOutline@EpsCopyOutputStream@io@protobuf@google@@AEAAPEAEIAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAE@Z ?EnsureSpaceFallback@EpsCopyOutputStream@io@protobuf@google@@AEAAPEAEPEAE@Z ?size@?$RepeatedField@H@protobuf@google@@QEBAHXZ ?InternalWriteMessage@WireFormatLite@internal@protobuf@google@@SAPEAEHAEBVMessageLite@34@HPEAEPEAVEpsCopyOutputStream@io@34@@Z ?Clear@?$RepeatedField@H@protobuf@google@@QEAAXXZ ?WriteRawFallback@EpsCopyOutputStream@io@protobuf@google@@AEAAPEAEPEBXHPEAE@Z ?VarintParseSlow64@internal@protobuf@google@@YA?AU?$pair@PEBD_K@std@@PEBDI@Z ?VarintParseSlow32@internal@protobuf@google@@YA?AU?$pair@PEBDI@std@@PEBDI@Z ?InlineGreedyStringParser@internal@protobuf@google@@YAPEBDPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBDPEAVParseContext@123@@Z ??0?$RepeatedField@H@protobuf@google@@QEAA@PEAVArena@12@@Z ?PackedInt32Parser@internal@protobuf@google@@YAPEBDPEAXPEBDPEAVParseContext@123@@Z ?ReadTagFallback@internal@protobuf@google@@YA?AU?$pair@PEBDI@std@@PEBDI@Z ?Int32Size@WireFormatLite@internal@protobuf@google@@SA_KAEBV?$RepeatedField@H@34@@Z ?DoneFallback@EpsCopyInputStream@internal@protobuf@google@@AEAA?AU?$pair@PEBD_N@std@@HH@Z ?MergeFrom@?$RepeatedField@H@protobuf@google@@QEAAXAEBV123@@Z ?InternalSwap@?$RepeatedField@H@protobuf@google@@QEAAXPEAV123@@Z ?Destroy@ArenaStringPtr@internal@protobuf@google@@QEAAXXZ ??1?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAA@XZ ?InitializationErrorString@MessageLite@protobuf@google@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?Get@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z ?Clear@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAAXXZ ?size@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEBAHXZ ?Mutable@ArenaStringPtr@internal@protobuf@google@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAVArena@34@@Z ?AllocateAlignedWithHook@Arena@protobuf@google@@AEAAPEAX_KPEBVtype_info@@@Z ?AllocateAlignedWithCleanup@Arena@protobuf@google@@AEAA?AU?$pair@PEAXPEAUCleanupNode@SerialArena@internal@protobuf@google@@@std@@_KPEBVtype_info@@@Z ?Init@ThreadSafeArena@internal@protobuf@google@@AEAAXXZ ?data@?$RepeatedField@H@protobuf@google@@QEBAPEBHXZ ?size@?$RepeatedField@I@protobuf@google@@QEBAHXZ ?Clear@?$RepeatedField@I@protobuf@google@@QEAAXXZ ?Get@?$RepeatedField@H@protobuf@google@@QEBAAEBHH@Z ??1?$RepeatedField@I@protobuf@google@@QEAA@XZ ??0?$RepeatedField@I@protobuf@google@@QEAA@PEAVArena@12@@Z ?PackedUInt32Parser@internal@protobuf@google@@YAPEBDPEAXPEBDPEAVParseContext@123@@Z ?UInt32Size@WireFormatLite@internal@protobuf@google@@SA_KAEBV?$RepeatedField@I@34@@Z ?MergeFrom@?$RepeatedField@I@protobuf@google@@QEAAXAEBV123@@Z ?InternalSwap@?$RepeatedField@I@protobuf@google@@QEAAXPEAV123@@Z ?end@?$RepeatedField@H@protobuf@google@@QEBA?AV?$RepeatedIterator@$$CBH@internal@23@XZ ?begin@?$RepeatedField@H@protobuf@google@@QEBA?AV?$RepeatedIterator@$$CBH@internal@23@XZ ?Add@?$RepeatedField@I@protobuf@google@@QEAAXAEBI@Z ?Get@?$RepeatedField@I@protobuf@google@@QEBAAEBIH@Z ??1LogMessage@internal@protobuf@google@@QEAA@XZ ?ReadSizeFallback@internal@protobuf@google@@YA?AU?$pair@PEBDH@std@@PEBDI@Z ?Next@EpsCopyInputStream@internal@protobuf@google@@AEAAPEBDXZ ?ShutdownProtobufLibrary@protobuf@google@@YAXXZ ??0?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAA@PEAVArena@12@@Z ?MergeFrom@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAAXAEBV123@@Z ??$DoMergeFrom@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@InternalMetadata@internal@protobuf@google@@AEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ??$DoClear@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@InternalMetadata@internal@protobuf@google@@AEAAXXZ ??0LogMessage@internal@protobuf@google@@QEAA@W4LogLevel@23@PEBDH@Z ??6LogMessage@internal@protobuf@google@@QEAAAEAV0123@PEBD@Z ??4LogFinisher@internal@protobuf@google@@QEAAXAEAVLogMessage@123@@Z ?ParseFromArray@MessageLite@protobuf@google@@QEAA_NPEBXH@Z ?AddOutOfLineHelper@RepeatedPtrFieldBase@internal@protobuf@google@@AEAAPEAXPEAX@Z ?SerializeToArray@MessageLite@protobuf@google@@QEBA_NPEAXH@Z ?Add@?$RepeatedField@H@protobuf@google@@QEAAXAEBH@Z ?GetOwnedMessageInternal@internal@protobuf@google@@YAPEAVMessageLite@23@PEAVArena@23@PEAV423@0@Z ?ParsePartialFromArray@MessageLite@protobuf@google@@QEAA_NPEBXH@Z ?SerializePartialToArray@MessageLite@protobuf@google@@QEBA_NPEAXH@Z ?Add@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?Set@ArenaStringPtr@internal@protobuf@google@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAVArena@34@@Z ?end@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEBA?AV?$RepeatedPtrIterator@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@internal@23@XZ ?begin@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEBA?AV?$RepeatedPtrIterator@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@internal@23@XZ ??1ThreadSafeArena@internal@protobuf@google@@QEAA@XZ ??1?$RepeatedField@H@protobuf@google@@QEAA@XZ

fltlib

FilterLoad FilterSendMessage FilterGetMessage FilterReplyMessage FilterConnectCommunicationPort

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

oleaut32

SafeArrayGetUBound SafeArrayUnaccessData SafeArrayDestroy VariantInit SysAllocString SafeArrayGetLBound SysFreeString VariantClear SafeArrayAccessData

ws2_32

WSAAddressToStringW

iphlpapi

GetAdaptersInfo GetAdaptersAddresses

mpr

WNetGetUniversalNameW

crypt32

CertFreeCertificateContext

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-filesystem-l1-1-0

remove rename

Name

.text

Size

5.6MB

Virtual Size

5.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

230KB

Virtual Size

289KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

228KB

Virtual Size

227KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

295KB

Virtual Size

294KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=3, id=253, version=34321,

count=9, id=260, version=34321,

count=4, id=259, version=34321,

count=8, id=257, version=34321,

count=2, id=259, version=33138,

count=4, id=260, version=33138,

count=24, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=262, version=33138,

count=3, id=261, version=32545,

count=2, id=257, version=32545,

count=57, id=261, version=34321,

count=9, id=257, version=34436,

count=31, id=260, version=32545,

count=44, id=257, version=33138,

count=1154, id=1, productName=Unmarked objects,

count=696, id=265, version=34436,

count=1, id=256, version=34436,

count=1, id=255, version=34436,

count=2, id=151,

count=1, id=258, version=34436,

devcon.exe

IMPHASH d5fccdbc3c757a9878314da80387111d
SHA256 0de0017e4479ac90e17392b3a6564d1cdc912bcf324a4faca0e1bbf31b55a86f
MD5 050d44f75dd105d236017aa0a146bd41
SHA1 4885bb7fc362e0ae8166b3ad4d3b768717fc2fd4
SHA512 803e25db813569d291aa48cb5fbce6518adb6d2670d6b9d7bc2b01dd166ee8570e5626ff9be42ca31e48b2e24af9ff2b7bf53f6102b27476c01b26d8dc6428da
SSDEEP 6144:rWB4/a2FNo+6HdPhzlioNdbMLu86NGntF1ux3VcsIWlY1fV:rWMhvo+YdPhz4EdbPNgt/GlAfV
TLSH
T129B46D0273E405A9E1B7E63CC9724621DAB378515B34D78F03ACC27A0F63B909D7AB61
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

2f:ad:da:43:3f:ad:d7:26:a7:ff:41:4e:c2:bc:b3:05:77:3c:51:33:f1:4e:b1:de:39:9e:28:86:ca:7e:88:13

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=NortonLifeLock Inc.,OU=Norton Product Engineering - CM,O=NortonLifeLock Inc.,L=Tempe,ST=Arizona,C=US

Chains

Nov 30, 2023

CN=NortonLifeLock Inc.,OU=Norton Product Engineering - CM,O=NortonLifeLock Inc.,L=Tempe,ST=Arizona,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=NortonLifeLock Inc.,OU=Norton Product Engineering - CM,O=NortonLifeLock Inc.,L=Tempe,ST=Arizona,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0e:4d:67:f6:43:16:c9:2a:3b:7a:17:cc:46:97:6a:8f

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2021 - Jul 27, 2036

Subject

CN=NortonLifeLock Inc.,OU=Norton Product Engineering - CM,O=NortonLifeLock Inc.,L=Tempe,ST=Arizona,C=US

Serial Number

0e:2a:45:8a:fc:78:a2:ea:6d:04:8a:e1:92:fe:94:c6

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 17, 2022 - Aug 16, 2025

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

33008

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\work\41badc437ecbc8f9\devcon\vanilla\x64\Release\devcon.pdb

kernel32

LocalFree FormatMessageW FileTimeToSystemTime GetCurrentProcess WriteConsoleW CreateFileW ReadConsoleW ReadFile CloseHandle LoadLibraryW GetProcAddress FreeLibrary GetWindowsDirectoryW GetLastError GetFullPathNameW GetFileAttributesW FindNextFileW FindFirstFileW GetDateFormatW FindClose HeapReAlloc HeapSize SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetConsoleCtrlHandler GetProcessHeap GetStringTypeW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW OutputDebugStringW SetStdHandle GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW HeapFree HeapAlloc GetCurrentThread GetCommandLineW GetCommandLineA GetModuleHandleExW ExitProcess GetModuleFileNameW WriteFile GetStdHandle EncodePointer LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwind DeleteCriticalSection LeaveCriticalSection RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList RtlPcToFileHeader RaiseException SetLastError EnterCriticalSection

user32

CharNextW LoadStringW

advapi32

InitiateSystemShutdownExW RegQueryValueExW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken OpenServiceW OpenSCManagerW CloseServiceHandle RegSetValueExW RegDeleteValueW RegCloseKey

ole32

CLSIDFromString

setupapi

CM_Get_Next_Res_Des_Ex CM_Get_Res_Des_Data_Ex CM_Get_First_Log_Conf_Ex CM_Free_Res_Des_Handle CM_Free_Log_Conf_Handle SetupDiGetDriverInstallParamsW SetupDiSetDeviceInstallParamsW SetupDiOpenDevRegKey SetupDiDestroyDriverInfoList SetupDiGetDriverInfoDetailW SetupDiSetSelectedDriverW SetupDiEnumDriverInfoW SetupDiBuildDriverInfoList SetupScanFileQueueW SetupCloseFileQueue SetupOpenFileQueue SetupGetStringFieldW SetupFindFirstLineW SetupCloseInfFile SetupOpenInfFileW SetupDiGetDeviceRegistryPropertyW SetupDiOpenDeviceInfoW SetupDiCreateDeviceInfoListExW CM_Reenumerate_DevNode_Ex CM_Locate_DevNode_ExW CM_Get_DevNode_Status_Ex CM_Get_Res_Des_Data_Size_Ex CM_Disconnect_Machine CM_Connect_MachineW SetupDiClassGuidsFromNameExW SetupDiClassNameFromGuidExW SetupDiSetClassInstallParamsW SetupDiGetDeviceInstallParamsW SetupDiSetDeviceRegistryPropertyW SetupDiOpenClassRegKeyExW SetupDiCallClassInstaller SetupDiGetClassDescriptionExW SetupDiBuildClassInfoListExW SetupDiGetINFClassW SetupDiGetClassDevsExW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiCreateDeviceInfoW SetupDiGetDeviceInfoListDetailW SetupDiCreateDeviceInfoList SetupCopyOEMInfW CM_Get_Device_ID_ExW

Name

.text

Size

336KB

Virtual Size

336KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

78KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

46KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

firefox_pass.exe

IMPHASH 1e724900ce94545a3e6bc165e5655236
SHA256 1cfb607e23b7cf790b7c99bc22fdd9f0e39c6175924327ec8e510e2767c99a97
MD5 1f1215281381258ac1e7eb7c0d7592d0
SHA1 275cb82cae803af2fbe9b8927c8dcf060b4fb781
SHA512 6c600cace26686d59402f359caffdb8dc0c96702b58aa1dbddc99e7f98e29378073ddc4c119ebde40d7802d4af1a674e433947450622ff2ed14f65375b959559
SSDEEP 12288:4ycdOfnCyLmblph0lhSMXliwXZvK2vyXO1V:4XwCyKb3h0lhSMXl/XZvK2v4O1V
TLSH
T1EEC4BE1F776847E4E16EC07888579A0AFA727891038297DF27E4DA2A1F536E12D3F701
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

a4:2a:ca:b9:87:77:91:0e:44:d6:fc:2e:32:67:a8:28:f4:c5:1d:b6:88:ce:69:a2:ac:96:10:4a:af:48:18:2e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Chains

Mar 26, 2026

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Serial Number

40:1c:57:14:6d:ce:58:df:b9:22:21:87:8d:2a:a5:63

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2025 - Jun 10, 2028

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

213808

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\firefox_pass.pdb

dll_loader

?free_dll@dll_loader@asw@@YA_NPEAUHINSTANCE__@@@Z ?load_dll@dll_loader@asw@@YAPEAUHINSTANCE__@@PEB_W0@Z

protobuf

??$DoClear@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@InternalMetadata@internal@protobuf@google@@AEAAXXZ ??$DoMergeFrom@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@InternalMetadata@internal@protobuf@google@@AEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?DestroyProtos@RepeatedPtrFieldBase@internal@protobuf@google@@IEAAXXZ ?EnsureSpaceFallback@EpsCopyOutputStream@io@protobuf@google@@AEAAPEAEPEAE@Z ?VarintParseSlow64@internal@protobuf@google@@YA?AU?$pair@PEBD_K@std@@PEBDI@Z ?InternalWriteMessage@WireFormatLite@internal@protobuf@google@@SAPEAEHAEBVMessageLite@34@HPEAEPEAVEpsCopyOutputStream@io@34@@Z ?ParseMessage@ParseContext@internal@protobuf@google@@QEAAPEBDPEAVMessageLite@34@PEBD@Z ?ShutdownProtobufLibrary@protobuf@google@@YAXXZ ?WriteStringMaybeAliasedOutline@EpsCopyOutputStream@io@protobuf@google@@AEAAPEAEIAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAE@Z ?UnknownFieldParse@internal@protobuf@google@@YAPEBDIPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBDPEAVParseContext@123@@Z ?InlineGreedyStringParser@internal@protobuf@google@@YAPEBDPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBDPEAVParseContext@123@@Z ?ReadTagFallback@internal@protobuf@google@@YA?AU?$pair@PEBDI@std@@PEBDI@Z ?DoneFallback@EpsCopyInputStream@internal@protobuf@google@@AEAA?AU?$pair@PEBD_N@std@@HH@Z ?Destroy@ArenaStringPtr@internal@protobuf@google@@QEAAXXZ ?InitializationErrorString@MessageLite@protobuf@google@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ??1ThreadSafeArena@internal@protobuf@google@@QEAA@XZ ?Mutable@ArenaStringPtr@internal@protobuf@google@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAVArena@34@@Z ?Set@ArenaStringPtr@internal@protobuf@google@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAVArena@34@@Z ?AllocateAlignedWithHook@Arena@protobuf@google@@AEAAPEAX_KPEBVtype_info@@@Z ?AllocateAlignedWithCleanup@Arena@protobuf@google@@AEAA?AU?$pair@PEAXPEAUCleanupNode@SerialArena@internal@protobuf@google@@@std@@_KPEBVtype_info@@@Z ?Set@ArenaStringPtr@internal@protobuf@google@@QEAAX$$QEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAVArena@34@@Z ?SerializeAsString@MessageLite@protobuf@google@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?AddOutOfLineHelper@RepeatedPtrFieldBase@internal@protobuf@google@@AEAAPEAXPEAX@Z ?ParseFromString@MessageLite@protobuf@google@@QEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?InternalExtend@RepeatedPtrFieldBase@internal@protobuf@google@@AEAAPEAPEAXH@Z ?WriteRawFallback@EpsCopyOutputStream@io@protobuf@google@@AEAAPEAEPEBXHPEAE@Z

ntdll

RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext

kernel32

InitOnceBeginInitialize InitOnceComplete ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW SetDllDirectoryW MultiByteToWideChar GetLastError LoadLibraryA GetProcAddress GetModuleHandleW LoadLibraryExW GetCurrentProcessId InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection WideCharToMultiByte CloseHandle CreateFileW GetFileSizeEx ReadFile GetSystemDirectoryW RaiseException GetSystemInfo VirtualProtect VirtualQuery FreeLibrary LoadLibraryExA GetFileAttributesW SetLastError Sleep ExpandEnvironmentStringsW HeapFree GetProcessHeap GetCurrentProcess UnlockFileEx LockFileEx MapViewOfFile UnmapViewOfFile OpenFileMappingW K32GetMappedFileNameW GetModuleFileNameW GetWindowsDirectoryW GetCurrentThreadId FormatMessageW IsDebuggerPresent GetModuleFileNameA GetModuleHandleExW HeapAlloc DebugBreak FindFirstVolumeW QueryDosDeviceW FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose CreateEventW SetEvent WaitForSingleObject GetSystemTimeAsFileTime QueryPerformanceCounter GetTickCount64 InitializeSListHead

advapi32

RegQueryValueExW RegEnumKeyExW RegOpenKeyExW RegCloseKey

ole32

CoTaskMemFree

msvcp140

??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ _Mbrtowc ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?classic@locale@std@@SAAEBV12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$numpunct@D@std@@2V0locale@2@A ?id@?$ctype@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z _Mtx_lock _Mtx_unlock ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBADD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ??Bid@locale@std@@QEAA_KXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?id@?$numpunct@_W@std@@2V0locale@2@A ?uncaught_exceptions@std@@YAHXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??7ios_base@std@@QEBA_NXZ ?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?id@?$ctype@_W@std@@2V0locale@2@A ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?id@?$collate@_W@std@@2V0locale@2@A _Wcsxfrm _Wcscoll ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEB_W_J@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?good@ios_base@std@@QEBA_NXZ _Query_perf_counter _Query_perf_frequency ?eof@ios_base@std@@QEBA_NXZ ?fail@ios_base@std@@QEBA_NXZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __C_specific_handler memset __current_exception memmove memcpy memcmp _CxxThrowException strchr __std_terminate _purecall __std_exception_copy __std_exception_destroy

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc _callnewh calloc realloc free

api-ms-win-crt-math-l1-1-0

_set_FMA3_enable modf _dclass _ldsign _fdsign _dsign __setusermatherr _get_FMA3_enable

api-ms-win-crt-runtime-l1-1-0

_errno abort _configure_wide_argv _invalid_parameter_noinfo _initterm_e _initialize_wide_environment terminate _crt_atexit _register_onexit_function _initialize_onexit_table _c_exit _exit _seh_filter_exe _cexit exit _register_thread_local_exe_atexit_callback _initterm _invalid_parameter_noinfo_noreturn _get_wide_winmain_command_line _set_app_type

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vswprintf _set_fmode

api-ms-win-crt-string-l1-1-0

wcscat_s wcsncmp _wcsnicmp

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

shell32

SHGetKnownFolderPath SHGetSpecialFolderPathW

api-ms-win-crt-convert-l1-1-0

wcstol

Name

.text

Size

276KB

Virtual Size

275KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

215KB

Virtual Size

214KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

nllToolsSvc.exe

IMPHASH 03d29a381a3c8c8547f2977e817ac742
SHA256 e2e82e2a949741693c9479a1807db9493079b3b7bda46f4be3d94fb852167816
MD5 17d09e1e19734922f745053a268026da
SHA1 0f7115c93c810499581813477c06ab9e7aa56bfc
SHA512 7f9704366c9f1d23da16faa268338df2ae7210c6df54e9a608d180310d6257ab299a8ad4a0ed60d00b7d5fa689dad132bc41fe2dd9fe81bd2a6887cbf9e20aaa
SSDEEP 24576:UqL/K7zsxAldF0LRgcshih0lhSMXlaFQPFmPbUm/pPNV:tL/edh8Em
TLSH
T1E0355B4E7B9811E4D07EE4B88963450AEF317C964B2542D777E8CE162FA3AE45A7F300
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

ef:7f:8d:08:f4:a7:9e:50:5e:30:3c:28:61:01:33:d4:19:46:23:59:2b:9a:c5:e0:0d:3c:12:cc:04:3f:a9:d3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Chains

Mar 26, 2026

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Serial Number

40:1c:57:14:6d:ce:58:df:b9:22:21:87:8d:2a:a5:63

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2025 - Jun 10, 2028

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

478272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\aswToolsSvc.pdb

user32

GetGUIThreadInfo GetClassInfoExW RegisterClassExW GetSystemMetrics SendMessageCallbackW IsHungAppWindow PeekMessageW UnregisterPowerSettingNotification UnregisterDeviceNotification RegisterPowerSettingNotification RegisterDeviceNotificationW

wsock32

WSAStartup WSACleanup

shlwapi

PathMatchSpecA PathAppendW

aswcmnbs

cmnbInit secSetObjectProtection secCreateSharedMutex cmnbFree aswcmnbsDllMain secPreventHookDllInjection

dll_loader

?free_dll@dll_loader@asw@@YA_NPEAUHINSTANCE__@@@Z ?load_dll@dll_loader@asw@@YAPEAUHINSTANCE__@@PEB_W0@Z

ntdll

RtlLookupFunctionEntry NtSystemDebugControl VerSetConditionMask RtlDllShutdownInProgress RtlVirtualUnwind NtClose NtCreateWorkerFactory NtQueryInformationProcess NtQuerySystemInformation NtQueryInformationWorkerFactory RtlCaptureContext NtQueryKey NtDeleteKey NtOpenKey

kernel32

AllocConsole WaitForMultipleObjects ReleaseMutex WaitForSingleObject InitializeCriticalSection DuplicateHandle GetCurrentProcess CreateEventW CloseThreadpoolTimer SetEvent GetCurrentThread CreateThreadpoolTimer TerminateProcess QueueUserWorkItem SetThreadpoolTimer WaitForThreadpoolTimerCallbacks LeaveCriticalSection EnterCriticalSection GetProcessId GetEnvironmentVariableW SetEnvironmentVariableW CreateThread GetSystemDirectoryW LoadLibraryW FreeLibrary GetFileAttributesW CreateProcessW GetExitCodeProcess VerifyVersionInfoW FindFirstFileW DeleteFileW InitializeProcThreadAttributeList UpdateProcThreadAttribute FindClose OutputDebugStringW IsDebuggerPresent CheckRemoteDebuggerPresent FlushInstructionCache SetErrorMode SetUnhandledExceptionFilter AddVectoredExceptionHandler RemoveVectoredExceptionHandler GetTickCount QueryFullProcessImageNameW GetPriorityClass OpenThread GetThreadPriority K32EnumProcesses OpenProcess GetThreadTimes K32GetProcessMemoryInfo CreateToolhelp32Snapshot Process32FirstW Process32NextW GetProcessHandleCount CreateIoCompletionPort ReadProcessMemory TlsFree TlsAlloc TlsSetValue TlsGetValue SetLastError GetNativeSystemInfo GetSystemTimes GetProcessTimes GetFileAttributesExW CompareFileTime GetSystemInfo LoadLibraryExA UnlockFileEx LockFileEx GetFileSizeEx ReadFile CompareStringW DeleteProcThreadAttributeList GetThreadId WriteFile CreateDirectoryW ExpandEnvironmentStringsW SetFileAttributesW CopyFileW GetDiskFreeSpaceExW K32GetMappedFileNameW GetWindowsDirectoryW FindFirstVolumeW QueryDosDeviceW FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose GlobalMemoryStatusEx QueryPerformanceCounter Sleep GetStartupInfoW InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter WakeAllConditionVariable SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive InitOnceComplete InitOnceBeginInitialize MultiByteToWideChar GetLastError LoadLibraryA GetProcAddress GetModuleHandleW LoadLibraryExW CreateFileW CloseHandle AttachConsole DeviceIoControl GetModuleFileNameA HeapFree GetModuleHandleExW InitializeCriticalSectionEx GetCurrentThreadId FormatMessageW HeapAlloc DeleteCriticalSection GetProcessHeap WideCharToMultiByte DebugBreak SetDllDirectoryW GetSystemTimeAsFileTime GetModuleFileNameW HeapSetInformation GetCommandLineW IsBadCodePtr GetModuleHandleA IsBadReadPtr VirtualQuery VirtualProtect GetExitCodeThread GetTickCount64 RaiseException GetPrivateProfileStringW GetCurrentProcessId SetConsoleCtrlHandler FreeConsole

msvcp140

?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?good@ios_base@std@@QEBA_NXZ ?uncaught_exceptions@std@@YAHXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??Bios_base@std@@QEBA_NXZ ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?id@?$ctype@_W@std@@2V0locale@2@A ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ?_Xinvalid_argument@std@@YAXPEBD@Z _Thrd_detach _Thrd_join ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z _Cnd_do_broadcast_at_thread_exit ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z _Query_perf_counter _Query_perf_frequency ?eof@ios_base@std@@QEBA_NXZ ?fail@ios_base@std@@QEBA_NXZ ?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEB_W_J@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ?id@?$collate@_W@std@@2V0locale@2@A _Wcsxfrm _Wcscoll ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?id@?$numpunct@_W@std@@2V0locale@2@A ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ??Bid@locale@std@@QEAA_KXZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ?tolower@?$ctype@D@std@@QEBADD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z _Mtx_unlock _Mtx_lock ?__ExceptionPtrDestroy@@YAXPEAX@Z ?_Xlength_error@std@@YAXPEBD@Z ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$numpunct@D@std@@2V0locale@2@A ?_Xbad_function_call@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?classic@locale@std@@SAAEBV12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Throw_Cpp_error@std@@YAXH@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?__ExceptionPtrCreate@@YAXPEAX@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z _Mbrtowc _Thrd_id

powrprof

CallNtPowerInformation

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler_noexcept __current_exception_context _purecall __current_exception memchr _CxxThrowException wcschr memset memmove memcpy memcmp __std_exception_copy strchr __std_type_info_name __std_type_info_compare wcsstr wcsrchr __std_exception_destroy __C_specific_handler __std_terminate

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode calloc malloc realloc free

api-ms-win-crt-math-l1-1-0

fmod floor pow _set_FMA3_enable _get_FMA3_enable ceil _isnan _dsign __setusermatherr _fdsign _ldsign _finite

api-ms-win-crt-runtime-l1-1-0

exit _beginthreadex _crt_atexit _exit _seh_filter_exe _cexit _register_thread_local_exe_atexit_callback _initterm _initterm_e _errno _get_wide_winmain_command_line _invalid_parameter_noinfo _invalid_parameter_noinfo_noreturn terminate _set_app_type _initialize_wide_environment _c_exit _configure_wide_argv abort _register_onexit_function _initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s __stdio_common_vsprintf __stdio_common_vswprintf __p__commode _set_fmode __stdio_common_vswscanf

api-ms-win-crt-string-l1-1-0

_stricmp _wcsnicmp _wcsicmp wcsncpy_s wcsncpy ispunct wcscat_s isspace wcscpy_s wcsncmp wcsncat_s strcpy_s

api-ms-win-crt-convert-l1-1-0

_wtoi wcstod _wtoi64 wcstol _ecvt_s wcstoll wcstoul

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

rpcrt4

RpcStringBindingComposeW RpcBindingFromStringBindingW RpcStringFreeW RpcBindingFree NdrClientCall3 UuidCreate

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges ImpersonateSelf RegOpenKeyExW RegQueryValueExW AllocateAndInitializeSid EqualSid FreeSid RegQueryInfoKeyW RegCloseKey RegSetValueExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCreateKeyExA RegQueryValueExA RegDeleteKeyExW RegDeleteTreeW CryptAcquireContextW CryptGenRandom CryptReleaseContext StartServiceW QueryServiceStatus OpenThreadToken GetTokenInformation CheckTokenMembership DuplicateToken OpenProcessToken RevertToSelf CloseServiceHandle SetServiceStatus RegisterServiceCtrlHandlerExW ChangeServiceConfig2W QueryServiceConfig2W OpenServiceW OpenSCManagerW StartServiceCtrlDispatcherW RegSetValueExA RegDeleteKeyA RegEnumValueA RegQueryInfoKeyA RegEnumKeyExA RegOpenKeyExA

shell32

SHGetKnownFolderPath ord165

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

ole32

CoUninitialize CoInitializeEx CoTaskMemFree

aswcmnos

cmnosMiniInit

Name

.text

Size

605KB

Virtual Size

605KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

289KB

Virtual Size

288KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

103KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

overseer.exe

IMPHASH 6b50fa4afb110932926c715745b36948
SHA256 410d17ea921933b655cd9d9920f139220ac332ace0707f4bfd61299f9b25b098
MD5 af942c03b0c3b03e4024cae2163a318a
SHA1 da7503c52e4159bd800c91f3b2ff7e2c70d30263
SHA512 42914231d7866863b9582e64f9486e015c1b0a741dbcd5e26a9406b3b20d7a80d9495f55e522568cd28282e087b84572aa707074f787f284373bfabb5113ecaa
SSDEEP 49152:62dZHtl4OFlptT1oHpwtUgsETPojnFXWYJsEEi1nSTIbDcc/0YIUApBKCrzLJ673:/jtQgeFoi1nSTIbDccuzd6j
TLSH
T160F57B5E7AAC00E8C1BFD0388547960BEAB17895873597DB66E0CE261F53AF15E3E700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

18:b9:18:d7:81:91:a2:0e:86:cc:20:e6:eb:4f:55:63:00:31:7d:28:ab:c8:ab:a1:fd:ee:20:74:75:e8:ca:3d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Chains

Apr 9, 2026

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Serial Number

40:1c:57:14:6d:ce:58:df:b9:22:21:87:8d:2a:a5:63

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2025 - Jun 10, 2028

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

1124176

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BUILD\work\3ec84b7238d5b18a\BUILDS\Release\x64\overseer.pdb

bcrypt

BCryptEncrypt BCryptGenerateSymmetricKey BCryptGenRandom BCryptCloseAlgorithmProvider BCryptSecretAgreement BCryptExportKey BCryptFinalizeKeyPair BCryptGenerateKeyPair BCryptImportKeyPair BCryptSetProperty BCryptOpenAlgorithmProvider BCryptDestroySecret BCryptDestroyKey BCryptDeriveKey

advapi32

RegQueryMultipleValuesW RegDeleteKeyExW RegDeleteTreeW CryptAcquireContextW CryptGenRandom CryptReleaseContext CryptAcquireContextA CryptGetHashParam OpenSCManagerW OpenServiceW QueryServiceStatusEx CloseServiceHandle ConvertStringSecurityDescriptorToSecurityDescriptorW RegCreateKeyExW RegSetValueExW RegCloseKey QueryServiceStatus EventWriteTransfer EventRegister EventUnregister CryptCreateHash CryptHashData CryptDestroyHash SystemFunction036 RegOpenKeyExA RegQueryValueExA RegEnumKeyExA RegQueryInfoKeyW RegDeleteValueW RegEnumValueW RegEnumKeyExW RegQueryValueExW OpenThreadToken GetTokenInformation OpenProcessToken EqualSid RevertToSelf ControlService StartServiceW ConvertStringSidToSidW FreeSid RegOpenKeyExW LookupPrivilegeValueW AdjustTokenPrivileges ImpersonateSelf AllocateAndInitializeSid LookupAccountSidW

user32

GetClassInfoExW RegisterClassExW LoadStringW CharLowerW

wtsapi32

WTSQuerySessionInformationW WTSEnumerateSessionsW WTSFreeMemory

oleaut32

VariantClear VariantInit SysAllocString SysFreeString

ole32

CoCreateInstance CoUninitialize CoInitializeEx CoTaskMemFree

shell32

SHGetKnownFolderPath ShellExecuteExW

shlwapi

PathIsRootW PathMatchSpecW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

ntdll

RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlNtStatusToDosError NtDeleteKey NtQueryKey NtOpenKey NtSetInformationThread NtClose VerSetConditionMask RtlUnwind

kernel32

ReadConsoleW GetOEMCP GetACP IsValidCodePage GetConsoleMode GetConsoleOutputCP GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW FlsFree GetTickCount64 GetLastError OpenProcess CloseHandle TerminateProcess MultiByteToWideChar WideCharToMultiByte GetFullPathNameW GetFileAttributesW GetFileAttributesExW GetComputerNameW OpenMutexW GetProcessTimes CreateToolhelp32Snapshot Process32FirstW Process32NextW OutputDebugStringW GetCurrentThreadId FormatMessageW IsDebuggerPresent GetModuleHandleW FindResourceW LoadResource SizeofResource GetSystemPowerStatus GetCurrentProcessId SetDllDirectoryW GetProcAddress LocalFree CreateMutexW HeapSetInformation SetPriorityClass GetCurrentProcess CreateFileW FlushFileBuffers MoveFileExW CopyFileW GetFinalPathNameByHandleW ReleaseMutex GetCommandLineW WaitForSingleObject SetLastError GetLocaleInfoA GetModuleFileNameA HeapFree GetModuleHandleExW InitializeCriticalSectionEx HeapSize HeapReAlloc HeapAlloc DecodePointer HeapDestroy DeleteCriticalSection GetProcessHeap DebugBreak CompareStringW LeaveCriticalSection EnterCriticalSection GetOverlappedResult DeviceIoControl CreateIoCompletionPort PostQueuedCompletionStatus GetQueuedCompletionStatus WriteFile ReadFile CancelIoEx WaitForMultipleObjects CreateEventW SetEvent VirtualAlloc WerRegisterMemoryBlock WerUnregisterMemoryBlock VirtualFree QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimeAsFileTime AcquireSRWLockExclusive ReleaseSRWLockExclusive UnmapViewOfFile UnlockFile CreateFileA CreateFileMappingW MapViewOfFile LockFileEx Sleep GetExitCodeProcess ResumeThread UnlockFileEx GetFileSizeEx InitializeCriticalSection QueryUnbiasedInterruptTime TerminateThread ResetEvent GetTickCount SetThreadPriority GetCurrentThread RaiseException GetThreadTimes InitializeCriticalSectionAndSpinCount QueryThreadCycleTime SetEndOfFile SetFilePointerEx InitializeProcThreadAttributeList FlsAlloc UpdateProcThreadAttribute K32GetProcessImageFileNameW CreateProcessW ProcessIdToSessionId VerifyVersionInfoW WTSGetActiveConsoleSessionId FileTimeToSystemTime LoadLibraryW CompareFileTime QueryFullProcessImageNameW DeleteFileW GetFileInformationByHandle OutputDebugStringA TlsAlloc TlsGetValue TlsSetValue FreeLibrary CreateSemaphoreW ReleaseSemaphore GetSystemInfo GetVersionExW ExpandEnvironmentStringsW GetModuleFileNameW FlsGetValue LoadLibraryExW GetSystemDirectoryW VirtualProtect GlobalMemoryStatusEx GetEnvironmentVariableW GetDateFormatW GetTimeFormatW GetExitCodeThread TlsFree GetDriveTypeW SetFilePointer SetFileAttributesW GetFileSize GetWindowsDirectoryW DuplicateHandle FindFirstFileW FindClose SetFileTime CreateDirectoryW GetCurrentDirectoryW FindFirstFileExW FindNextFileW QueryDosDeviceW GetVolumePathNameW GetVolumeNameForVolumeMountPointW WriteProcessMemory GetVersion LockResource FindResourceExW SetEnvironmentVariableW IsProcessorFeaturePresent SetThreadAffinityMask SetFileInformationByHandle GetDiskFreeSpaceExW K32GetMappedFileNameW FindFirstVolumeW FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose GetSystemTimes GetSystemDirectoryA GetModuleHandleA LoadLibraryA FormatMessageA SleepEx MoveFileExA GetEnvironmentVariableA InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable CreateThread ExpandEnvironmentStringsA UnregisterWait GetQueuedCompletionStatusEx SetFileCompletionNotificationModes GetCommandLineA FlsSetValue SystemTimeToTzSpecificLocalTime AreFileApisANSI GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW ReleaseSRWLockShared AcquireSRWLockShared WaitForSingleObjectEx WriteConsoleW HeapQueryInformation GetLocaleInfoEx CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns InitOnceComplete InitOnceBeginInitialize TryAcquireSRWLockExclusive SetStdHandle DeleteProcThreadAttributeList EncodePointer LCMapStringEx CompareStringEx SleepConditionVariableSRW GlobalFree GetCPInfo InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW InterlockedPushEntrySList ExitThread FreeLibraryAndExitThread GetStdHandle ExitProcess GetFileType InitOnceExecuteOnce PeekNamedPipe

fltlib

FilterLoad FilterSendMessage FilterGetMessage FilterReplyMessage FilterConnectCommunicationPort

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertFreeCTLContext CertAddCertificateContextToStore CertFreeCRLContext CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore

ws2_32

getsockopt WSACloseEvent bind connect sendto getservbyname getsockname recv setsockopt send WSASetLastError WSACreateEvent WSAEnumNetworkEvents WSAEventSelect recvfrom gethostname WSAResetEvent WSAWaitForMultipleEvents ntohl closesocket htons socket WSAGetLastError ioctlsocket htonl select __WSAFDIsSet ntohs WSAStartup WSACleanup WSAIoctl

winhttp

WinHttpCrackUrl WinHttpGetProxyForUrl WinHttpCloseHandle WinHttpOpen

iphlpapi

CancelMibChangeNotify2 GetUnicastIpAddressTable FreeMibTable GetAdaptersAddresses GetBestRoute2 if_nametoindex

Name

.text

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

697KB

Virtual Size

696KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

77KB

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

115KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

53KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=215, id=261, version=33138,

count=4, id=253, version=34321,

count=18, id=260, version=34321,

count=10, id=259, version=34321,

count=120, id=261, version=34321,

count=12, id=259, version=33138,

count=36, id=260, version=33138,

count=20, id=260, productName=VS2019 v16.10.3 build 30038, version=30038,

count=6, id=260, version=32545,

count=196, id=260, version=30154,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=6, id=257, version=30795,

count=2, id=259, version=33520,

count=8, id=260, version=33520,

count=13, productName=Unmarked objects (old),

count=1, id=262, version=33138,

count=3, id=261, version=32545,

count=29, id=257, version=33138,

count=564, id=1, productName=Unmarked objects,

count=258, id=265, version=34436,

count=1, id=256, version=34436,

count=1, id=255, version=34436,

count=2, id=151,

count=1, id=258, version=34436,

sched.exe

IMPHASH 3eb93c10ba566d1f6dcf22a0321a96b5
SHA256 2f405f404995e4be2dfe423fec6c7c0d7ef79f2d9a5f03190e0fd926f797778d
MD5 94402154f77901bf500a54657ffbb485
SHA1 3233d6b33000314f2b888c567cae997520af749d
SHA512 947815117e4738f38d7e86eefe1e90b2e1c6de03cae9988059b2d6c9f43f1b3896c3fb2a266ae3921e11a711b77be47f90f55b86f5fb58af3560244abcfb9a01
SSDEEP 12288:Thxedz32tfCJ7ph0lhSMXliT33VvQolPj0V:ThyziCJ9h0lhSMXlc33VvQoRj0V
TLSH
T19BB48C9A7B9544E8D01BB87844674A0DEB327C204F6293CB66F1E9351FE35E46EBE301
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

3e:9b:37:7d:cc:f5:7f:07:e5:23:18:11:3c:1f:7a:27:7a:b4:8b:30:7a:1e:44:58:aa:ce:e8:0e:f4:19:0e:ac

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Chains

Mar 26, 2026

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Serial Number

40:1c:57:14:6d:ce:58:df:b9:22:21:87:8d:2a:a5:63

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2025 - Jun 10, 2028

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

217120

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\sched.pdb

aswengldr

avldrCreateHandle avldrLoadModule avldrCloseModule BtsSchedule

dll_loader

?free_dll@dll_loader@asw@@YA_NPEAUHINSTANCE__@@@Z ?load_dll@dll_loader@asw@@YAPEAUHINSTANCE__@@PEB_W0@Z

shell32

SHGetKnownFolderPath

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind RtlCaptureContext

kernel32

IsDebuggerPresent Sleep CompareStringW UnlockFileEx LockFileEx GetFileSizeEx GetCurrentProcess GetCurrentProcessId TerminateProcess WaitForSingleObject GetSystemDirectoryW RaiseException GetSystemInfo VirtualProtect VirtualQuery FreeLibrary LoadLibraryExA SetLastError GetModuleFileNameW GetWindowsDirectoryW ExpandEnvironmentStringsW FindFirstVolumeW QueryDosDeviceW FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose CreateEventW SetEvent GetSystemTimeAsFileTime QueryPerformanceCounter GetEnvironmentVariableW GetTickCount64 DebugBreak HeapFree HeapAlloc GetCurrentThreadId FormatMessageW GetModuleHandleExW GetModuleFileNameA LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection WideCharToMultiByte ReadFile GetFileSize CreateFileW GetPrivateProfileIntW GetProcessHeap CloseHandle SetDllDirectoryW LoadLibraryExW GetModuleHandleW GetProcAddress LoadLibraryA GetLastError MultiByteToWideChar ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW InitOnceBeginInitialize InitOnceComplete WakeAllConditionVariable UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead OutputDebugStringW K32GetMappedFileNameW

user32

RegisterClassExW GetClassInfoExW

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey

ole32

CoTaskMemFree

msvcp140

??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEB_W_J@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ?id@?$collate@_W@std@@2V0locale@2@A _Wcsxfrm _Wcscoll ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z ?tolower@?$ctype@D@std@@QEBADD@Z _Mbrtowc ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?classic@locale@std@@SAAEBV12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$numpunct@D@std@@2V0locale@2@A ?id@?$ctype@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z _Mtx_lock _Mtx_unlock ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ??Bid@locale@std@@QEAA_KXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?id@?$numpunct@_W@std@@2V0locale@2@A ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?id@?$ctype@_W@std@@2V0locale@2@A ?tolower@?$ctype@_W@std@@QEBA_W_W@Z _Query_perf_counter _Query_perf_frequency ?eof@ios_base@std@@QEBA_NXZ ?fail@ios_base@std@@QEBA_NXZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove _CxxThrowException __C_specific_handler __std_exception_destroy __std_exception_copy _purecall __std_terminate wcschr __std_type_info_name strchr memset memcpy __current_exception __current_exception_context

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc _callnewh realloc

api-ms-win-crt-math-l1-1-0

_ldsign _fdsign _set_FMA3_enable _get_FMA3_enable _dsign __setusermatherr

api-ms-win-crt-runtime-l1-1-0

_set_app_type _errno _invalid_parameter_noinfo _get_initial_wide_environment __p___wargv __p___argc _configure_wide_argv abort _invalid_parameter_noinfo_noreturn _initterm_e _initterm _register_thread_local_exe_atexit_callback exit _cexit _seh_filter_exe _exit _c_exit _initialize_wide_environment terminate _crt_atexit _initialize_onexit_table _register_onexit_function

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf __p__commode _set_fmode __stdio_common_vfwprintf __acrt_iob_func

api-ms-win-crt-string-l1-1-0

_wcsdup wcsncmp strcpy_s _wcsicmp wcscat_s _wcsnicmp

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

aswcmnos

cmnosMiniInit

Name

.text

Size

230KB

Virtual Size

230KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

195KB

Virtual Size

195KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

944B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

su_worker.exe

IMPHASH eac217fb63c4521544c2f536471566fe
SHA256 c48e54a2e3b50ca8351304942153bfcda30426e66831a497a5cadb359f84b903
MD5 38afd0acd4a8754b662e4faf5b81be96
SHA1 1afbcba095e9a6d83b771ad515d3b93f811a4803
SHA512 f015f675038022ad44e23cf87d72a01fd34dfdc4b2f1277f71a3db701c1239c41f30c2d0d03f1cdbd8fc0f4de7b0679d18dbccdef1e50e56462004baf6cbf783
SSDEEP 49152:h2d6H0l4Jc/CG4qdWmIuvZYAVJk9e0GErEGcCrixZEitNl6dB+NNObgAgtMteotp:l/JemrixZEitNl6dBWiC5+Q
TLSH
T11E366B1EBA6D01E5C1BED13D8687940BEBB17895033997DB66E08E550F53AF0AE3E700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

f9:07:84:a7:92:93:0a:76:32:d3:d6:9b:db:b8:81:10:51:d1:5a:e1:d2:1c:c3:9a:8b:77:8d:ad:10:29:c9:57

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Chains

Apr 10, 2026

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Serial Number

40:1c:57:14:6d:ce:58:df:b9:22:21:87:8d:2a:a5:63

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2025 - Jun 10, 2028

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

2258752

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\su_worker.pdb

ole32

CoCreateGuid CoInitializeEx CoTaskMemFree CoCreateInstance CoUninitialize StringFromGUID2 CoInitialize

libwaapi

wa_api_invoke wa_api_register_handler wa_api_unregister_handler wa_api_setup wa_api_free wa_api_teardown

winhttp

WinHttpGetProxyForUrl WinHttpCloseHandle WinHttpSendRequest WinHttpReceiveResponse WinHttpTimeFromSystemTime WinHttpAddRequestHeaders WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpReadData WinHttpOpen WinHttpQueryHeaders WinHttpSetOption WinHttpConnect WinHttpOpenRequest

userenv

ExpandEnvironmentStringsForUserW

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory WTSQueryUserToken WTSEnumerateSessionsW

shell32

SHGetKnownFolderPath ExtractIconW

version

VerQueryValueW GetFileVersionInfoW VerQueryValueA GetFileVersionInfoSizeW

ntdll

NtOpenKey NtDeleteKey RtlNtStatusToDosError NtSetInformationThread NtClose VerSetConditionMask NtQueryKey RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

kernel32

ReleaseSemaphore FindClose FindFirstFileW FindNextFileW GetFileInformationByHandle FileTimeToSystemTime SetEndOfFile GetFileTime CompareFileTime UnlockFileEx LockFileEx GetFileSizeEx ReadFile QueryUnbiasedInterruptTime SetLastError CancelIoEx ReadDirectoryChangesW GetOverlappedResult Sleep ResetEvent GetCurrentThread FreeLibrary InitializeCriticalSectionAndSpinCount GetThreadPriority GetCurrentProcess WaitForMultipleObjects TerminateThread ResumeThread GetTickCount SetThreadPriority LocalFree RaiseException GetThreadTimes QueryPerformanceFrequency GetSystemTimeAsFileTime QueryPerformanceCounter QueryThreadCycleTime WTSGetActiveConsoleSessionId OpenProcess K32GetProcessImageFileNameW GetThreadId TerminateProcess VerifyVersionInfoW CreateMutexW ReleaseMutex GetSystemInfo GetVersionExW ExpandEnvironmentStringsW GetModuleFileNameW GetFileAttributesW GetSystemDirectoryW VirtualAlloc VirtualFree GlobalMemoryStatusEx GetEnvironmentVariableW TlsGetValue SetFilePointer DeleteFileW SetFileAttributesW GetWindowsDirectoryW CreateThread MapViewOfFile UnmapViewOfFile GetFileAttributesExW GetFullPathNameW CreateDirectoryW FindFirstFileExW QueryDosDeviceW FlushFileBuffers OutputDebugStringA SetFileInformationByHandle GetDiskFreeSpaceExW K32GetMappedFileNameW FindFirstVolumeW FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolWait WaitForThreadpoolWaitCallbacks GetSystemTimes GetTickCount64 ExpandEnvironmentStringsA UnregisterWait CreateIoCompletionPort GetQueuedCompletionStatusEx PostQueuedCompletionStatus SetFileCompletionNotificationModes FormatMessageW CreateEventW SetEvent GetCurrentThreadId UnregisterWaitEx MoveFileExW HeapAlloc HeapFree CompareStringW GetModuleHandleW GetProcessHeap GetProcAddress GetLastError WaitForSingleObject CreateWaitableTimerW CloseHandle CancelWaitableTimer SetWaitableTimer GetSystemTime SystemTimeToFileTime GetModuleHandleExW InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentProcessId GetCommandLineW ProcessIdToSessionId MultiByteToWideChar WideCharToMultiByte InitializeConditionVariable GetEnvironmentVariableA MoveFileExA CreateFileA LoadLibraryA GetModuleHandleA GetSystemDirectoryA SleepEx RegisterWaitForSingleObject GlobalFree GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeSListHead WakeAllConditionVariable AreFileApisANSI GetFileInformationByHandleEx InitOnceBeginInitialize InitOnceComplete FormatMessageA GetLocaleInfoEx ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive CreateSemaphoreW SetFilePointerEx WriteFile CreateFileW GetThreadLocale DebugBreak GetModuleFileNameA InitializeCriticalSectionEx IsDebuggerPresent CreateFileMappingW OutputDebugStringW AcquireSRWLockShared SleepConditionVariableSRW

user32

LoadStringW SetWindowLongPtrW GetClassInfoExW RegisterClassExW SendMessageW PostMessageW RegisterWindowMessageW

advapi32

RegQueryValueExA CryptGetHashParam CryptCreateHash CryptHashData CryptReleaseContext CryptGenRandom CryptAcquireContextW RegDeleteTreeW RegDeleteKeyExW RegNotifyChangeKeyValue RegQueryMultipleValuesW RegQueryInfoKeyW RegDeleteValueW RegEnumValueW RegEnumKeyExW RegSetValueExW RegCreateKeyExW RegQueryValueExW FreeSid CryptDestroyHash SystemFunction036 RegOpenKeyExA RegEnumKeyExA RegCloseKey OpenThreadToken InitializeSecurityDescriptor SetSecurityDescriptorDacl GetTokenInformation OpenProcessToken EqualSid RevertToSelf DuplicateTokenEx CryptAcquireContextA AllocateAndInitializeSid RegOpenKeyExW

msvcp140

?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_lock _Mtx_unlock ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Incref@facet@locale@std@@UEAAXXZ ??1_Locinfo@std@@QEAA@XZ ??1_Lockit@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??0_Lockit@std@@QEAA@H@Z ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Xbad_alloc@std@@YAXXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?id@?$numpunct@D@std@@2V0locale@2@A ??Bid@locale@std@@QEAA_KXZ ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?good@ios_base@std@@QEBA_NXZ ?uncaught_exceptions@std@@YAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Xout_of_range@std@@YAXPEBD@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z _Mbrtowc ?is@?$ctype@_W@std@@QEBA_NF_W@Z ?id@?$ctype@_W@std@@2V0locale@2@A ?classic@locale@std@@SAAEBV12@XZ ?id@?$numpunct@_W@std@@2V0locale@2@A ?id@?$collate@_W@std@@2V0locale@2@A _Wcsxfrm _Wcscoll ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?_Xbad_function_call@std@@YAXXZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z ??Bios_base@std@@QEBA_NXZ ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?_Xinvalid_argument@std@@YAXPEBD@Z _Xtime_get_ticks ?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z _Query_perf_counter _Query_perf_frequency ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?widen@?$ctype@_W@std@@QEBA_WD@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@F@Z ?id@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A ?_Getcat@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WPEBUtm@@PEB_W4@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_J@Z ?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z _Mtx_trylock ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ?tolower@?$ctype@D@std@@QEBADD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?id@?$ctype@D@std@@2V0locale@2@A ?eof@ios_base@std@@QEBA_NXZ ?fail@ios_base@std@@QEBA_NXZ ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEB_W_J@Z ?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAGXZ _Cnd_register_at_thread_exit _Cnd_broadcast _Cnd_wait _Cnd_unregister_at_thread_exit ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z ?_Random_device@std@@YAIXZ ??7ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z _Cnd_signal _Thrd_join _Thrd_id _Cnd_do_broadcast_at_thread_exit ?_Xlength_error@std@@YAXPEBD@Z

msvcp140_atomic_wait

__std_atomic_wait_direct __std_atomic_notify_all_direct

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memchr strstr strrchr __std_terminate __current_exception __current_exception_context __C_specific_handler __RTDynamicCast __std_exception_copy __std_exception_destroy wcschr _purecall strchr __std_type_info_name __RTtypeid __std_type_info_compare _CxxThrowException memcmp memcpy memmove memset

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _register_onexit_function _initialize_onexit_table _c_exit terminate _seh_filter_exe _cexit exit _register_thread_local_exe_atexit_callback _initterm _initterm_e _get_wide_winmain_command_line strerror_s _set_app_type _initialize_wide_environment _configure_wide_argv _errno _invalid_parameter_noinfo _exit _invalid_parameter_noinfo_noreturn _beginthreadex abort

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh _aligned_malloc realloc calloc free _aligned_free malloc

api-ms-win-crt-math-l1-1-0

_ldsign _dsign _get_FMA3_enable _set_FMA3_enable _fdopen _dclass _fdsign modf ceilf __setusermatherr

api-ms-win-crt-string-l1-1-0

strcpy_s strcspn strncat strncmp _stricmp strspn strpbrk wcscpy_s tolower wcsncmp wcsncpy_s strcmp towlower _wcsnicmp _strdup wcscat_s

api-ms-win-crt-convert-l1-1-0

mbstowcs_s strtod strtoll strtoull wcstoull wcstombs_s _wtoi strtol atoi wcstol wcstoll wcstoul strtoul

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale ___lc_codepage_func

api-ms-win-crt-stdio-l1-1-0

fgetpos fwrite fread __acrt_iob_func fgetc ungetc fputs fsetpos fflush feof fseek ftell __stdio_common_vswscanf fputc _get_stream_buffer_pointers _fsopen _sopen_s _set_fmode fclose fgets __stdio_common_vsnwprintf_s __p__commode _fseeki64 __stdio_common_vswprintf _close __stdio_common_vsprintf setvbuf fopen

api-ms-win-crt-time-l1-1-0

strftime _time64 _gmtime64 _gmtime64_s

api-ms-win-crt-filesystem-l1-1-0

_stat64i32 _fullpath _lock_file _unlock_file _stat64 _unlink

api-ms-win-crt-utility-l1-1-0

rand qsort srand

rpcrt4

I_RpcBindingInqLocalClientPID RpcBindingFree RpcMgmtEpEltInqDone RpcIfInqId RpcStringBindingParseW RpcStringBindingComposeW UuidFromStringW UuidToStringW Ndr64AsyncServerCallAll NdrAsyncServerCall NdrServerCall2 NdrServerCallAll NdrClientCall3 Ndr64AsyncClientCall RpcAsyncCancelCall RpcBindingFromStringBindingW RpcAsyncInitializeHandle RpcAsyncCompleteCall RpcBindingToStringBindingW RpcStringFreeW RpcEpUnregister RpcEpRegisterW RpcServerUseProtseqEpW RpcObjectSetType RpcServerRegisterIf2 RpcServerUnregisterIfEx RpcMgmtEpEltInqBegin RpcRevertToSelf RpcImpersonateClient RpcMgmtEpEltInqNextW

crypt32

CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryA PFXImportCertStore CryptDecodeObjectEx CertFreeCRLContext CertAddCertificateContextToStore CertFreeCTLContext CertFindExtension CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertCloseStore CertGetCertificateChain CertFreeCertificateChain CertOpenStore

api-ms-win-crt-multibyte-l1-1-0

_mbschr _mbspbrk _mbsnbcmp _mbsnbcpy_s

api-ms-win-crt-environment-l1-1-0

getenv

secur32

QueryContextAttributesW

dnsapi

DnsQuery_W DnsFree

bcrypt

BCryptGenRandom

ws2_32

WSAEventSelect WSAWaitForMultipleEvents WSAGetLastError WSAStartup __WSAFDIsSet select ioctlsocket ntohl WSAResetEvent closesocket htonl gethostname recvfrom WSASetLastError setsockopt sendto getservbyname htons send recv getsockname getsockopt connect WSAIoctl ntohs WSACloseEvent WSACreateEvent bind InetPtonW InetNtopW WSACleanup socket WSAEnumNetworkEvents

iphlpapi

GetBestRoute2 GetAdaptersAddresses FreeMibTable GetUnicastIpAddressTable CancelMibChangeNotify2

generic

count=7, id=253, version=34321,

count=10, id=260, version=34321,

count=6, id=259, version=34321,

count=8, id=257, version=34321,

count=57, id=261, version=34321,

count=1, id=260, version=33138,

count=26, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=20, id=260, productName=VS2019 v16.10.3 build 30038, version=30038,

count=179, id=260, version=30154,

count=7, id=260, version=32545,

count=5, productName=Unmarked objects (old),

count=3, id=261, version=32545,

count=2, id=257, version=24247,

count=37, id=257, version=33138,

count=891, id=1, productName=Unmarked objects,

count=274, id=265, version=34436,

count=1, id=256, version=34436,

count=1, id=255, version=34436,

count=1, id=151,

count=1, id=258, version=34436,

wa_3rd_party_host_32.exe

IMPHASH 83c29741528b924ea746ff65958d9c15
SHA256 046d113b4882c116efa95078e1482fc4b15a293082bda4f8cbd8e0152b0e3405
MD5 72524fbe8d7976c86c96e9568d217378
SHA1 583f64d8df09155e6fe810dee70d2d272c0923fa
SHA512 8d9e51f4fa2b7c8dbf9e99967448125ae44e0cf7a7df8c78a5cc77d99731deaa829d2d63f93cb7a4b207b1eb8bd79f6ebf601ac81eead34143c3d05489b5d584
SSDEEP 49152:bQ1vqAPtfPHQRTG+gJaFT8bxEfXrsKPU6z0WVKVGrMtl7ZCvjhakxB:kUAPtnLKPUK0WDYK/
TLSH
T141B5AE13F6D38171FCA24075D17E7BAA483C7AA0073194CBE2D05F6E69725C26A36B1E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

2a:e3:ac:95:57:6c:3a:dd:02:b7:de:b2:ae:27:14:51:9f:ce:af:3b:d0:d4:01:c3:e9:c1:58:31:3a:21:2a:12

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Chains

Nov 5, 2025

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Serial Number

40:1c:57:14:6d:ce:58:df:b9:22:21:87:8d:2a:a5:63

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2025 - Jun 10, 2028

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

1363584

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wa_3rd_party_host_32.pdb

kernel32

GetTempPathA FormatMessageW GetDiskFreeSpaceA GetLastError GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc CloseHandle RaiseException GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress LocalFree LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId GetProcessHeap SystemTimeToFileTime GetModuleHandleW FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers InitializeCriticalSectionEx GetTickCount64 DecodePointer SizeofResource GetModuleHandleExW GetModuleFileNameW LocalAlloc FreeResource LockResource LoadResource FindResourceW Sleep LoadLibraryExW GetWindowsDirectoryW GetEnvironmentStringsW GetCurrentDirectoryW SetCurrentDirectoryW FindFirstFileW FindNextFileW FindClose FileTimeToSystemTime GetFileTime GetVolumeNameForVolumeMountPointW GetLogicalDriveStringsW GetDriveTypeW DeviceIoControl GetSystemWindowsDirectoryW lstrcpyW CreateEventW SetEvent WaitForMultipleObjects CreateNamedPipeW OpenProcess CreateThread GetOverlappedResult ConnectNamedPipe GetExitCodeProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW DisconnectNamedPipe CreateDirectoryW GetCurrentProcess CreateProcessW CopyFileW SetLastError lstrcpynW GetLocaleInfoW TerminateProcess GetTempFileNameW ExpandEnvironmentStringsW GetVersionExW GetTimeZoneInformation GetSystemDirectoryW ReleaseMutex CreateMutexA VirtualAlloc VirtualFree VirtualQuery WriteConsoleW ReadConsoleW SetStdHandle MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetCurrentThreadId GetFileAttributesW CreateFileW WaitForSingleObject CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile AreFileApisANSI GetFullPathNameA SetFilePointer InitializeCriticalSection LeaveCriticalSection LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW EnterCriticalSection HeapFree HeapCreate TryEnterCriticalSection ReadFile SetErrorMode FreeEnvironmentStringsW FindFirstFileExW SetEnvironmentVariableW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP GetOEMCP GetACP IsValidCodePage GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetCommandLineW GetCommandLineA GetStdHandle ExitProcess ExitThread RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualProtect UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SwitchToThread SignalObjectAndWait GetModuleHandleA FreeLibraryAndExitThread UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent ResetEvent IsDebuggerPresent GetStartupInfoW InitializeSListHead GetStringTypeW DuplicateHandle GetCurrentThread GetExitCodeThread GetNativeSystemInfo QueryPerformanceFrequency EncodePointer QueueUserWorkItem InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CompareStringW LCMapStringW GetCPInfo CreateTimerQueue GetThreadTimes LoadLibraryExA

user32

PostThreadMessageW wsprintfW

advapi32

OpenSCManagerW EqualSid AllocateAndInitializeSid FreeSid CheckTokenMembership QueryServiceStatus OpenServiceW RegCloseKey RegEnumKeyExW RegOpenKeyExW RegQueryValueExW CloseServiceHandle GetSidSubAuthorityCount GetSidSubAuthority GetTokenInformation AccessCheck GetFileSecurityW DuplicateToken MapGenericMask LookupPrivilegeValueW AdjustTokenPrivileges RegSaveKeyW OpenProcessToken

ole32

CoSetProxyBlanket CoUninitialize CoInitializeEx CoCreateInstance IIDFromString CLSIDFromString CoAddRefServerProcess CoReleaseServerProcess OleRun

oleaut32

GetErrorInfo VariantTimeToSystemTime VariantClear SafeArrayCreateVector SafeArrayCreate SafeArrayLock VariantCopy SafeArrayPutElement SysAllocString SysFreeString SafeArrayGetDim SysStringLen SysAllocStringLen SafeArrayDestroy VariantInit SafeArrayGetElement SafeArrayUnlock

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

shlwapi

StrStrIW

wininet

HttpSendRequestW InternetConnectW InternetCloseHandle InternetOpenW InternetSetOptionW InternetReadFile HttpOpenRequestW

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

431KB

Virtual Size

431KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

32KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

75KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

wa_3rd_party_host_64.exe

IMPHASH 57d3a8e28e26c45e7cd42483a201c4b0
SHA256 07ae56f04c90e344fb76d4063aa81acb9733d1fe8164f3e5c163656e764bd3aa
MD5 9bd301bf2d7a939aff2bf0ae9bebfc51
SHA1 30bced0e22e50df7657109b5fbcd771bd87f0807
SHA512 68647c1162aefa9ba9cb8f11f70c513d71f40897ea130043361253405ea9f47b4d8759a274a20fb9b0a02629faacaa07df0fad4b37428816fab8eee22f803718
SSDEEP 49152:ZelthmFqTqvgLjRuEcmb6rjVl7DmRRhAh/QecnR75SQ:0lKATu0jRueyFQe4V
TLSH
T118D58D0767EA01F8D9B7C278C5526507E6B138451735ABEF0160C76E2F33AE14A7B32A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

09:82:5d:60:84:6e:d6:ea:23:98:31:e2:36:05:b6:ae:41:f0:85:6d:4f:e2:f9:0a:a6:6b:40:c0:5e:22:1e:f3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Chains

Nov 5, 2025

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Serial Number

40:1c:57:14:6d:ce:58:df:b9:22:21:87:8d:2a:a5:63

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2025 - Jun 10, 2028

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

1585472

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wa_3rd_party_host_64.pdb

kernel32

GetTempPathA FormatMessageW GetDiskFreeSpaceA GetLastError GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc CloseHandle RaiseException GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress LocalFree LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId GetProcessHeap SystemTimeToFileTime GetModuleHandleW FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers InitializeCriticalSectionEx GetTickCount64 DecodePointer SizeofResource GetModuleHandleExW GetModuleFileNameW LocalAlloc FreeResource LockResource LoadResource FindResourceW Sleep LoadLibraryExW GetWindowsDirectoryW GetEnvironmentStringsW GetCurrentDirectoryW SetCurrentDirectoryW FindFirstFileW FindNextFileW FindClose FileTimeToSystemTime GetFileTime GetVolumeNameForVolumeMountPointW GetLogicalDriveStringsW GetDriveTypeW DeviceIoControl GetSystemWindowsDirectoryW lstrcpyW CreateEventW SetEvent WaitForMultipleObjects CreateNamedPipeW OpenProcess CreateThread GetOverlappedResult ConnectNamedPipe GetExitCodeProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW DisconnectNamedPipe CreateDirectoryW GetCurrentProcess CreateProcessW CopyFileW SetLastError lstrcpynW GetLocaleInfoW TerminateProcess GetTempFileNameW ExpandEnvironmentStringsW GetVersionExW GetTimeZoneInformation GetSystemDirectoryW ReleaseMutex CreateMutexA VirtualAlloc VirtualFree VirtualQuery WriteConsoleW ReadConsoleW SetStdHandle MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetCurrentThreadId GetFileAttributesW CreateFileW WaitForSingleObject CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer AreFileApisANSI InitializeCriticalSection LeaveCriticalSection LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW EnterCriticalSection HeapFree HeapCreate TryEnterCriticalSection ReadFile SetErrorMode FreeEnvironmentStringsW FindFirstFileExW SetEnvironmentVariableW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP GetOEMCP GetACP IsValidCodePage GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetCommandLineW GetCommandLineA GetStdHandle ExitProcess ExitThread RtlUnwindEx UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualProtect UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SwitchToThread SignalObjectAndWait GetModuleHandleA FreeLibraryAndExitThread RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent ResetEvent IsDebuggerPresent GetStartupInfoW InitializeSListHead GetStringTypeW DuplicateHandle GetCurrentThread GetExitCodeThread GetNativeSystemInfo QueryPerformanceFrequency RtlPcToFileHeader EncodePointer QueueUserWorkItem InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CompareStringW LCMapStringW GetCPInfo CreateTimerQueue GetThreadTimes LoadLibraryExA

user32

PostThreadMessageW wsprintfW

advapi32

RegQueryValueExW EqualSid AllocateAndInitializeSid FreeSid CheckTokenMembership QueryServiceStatus OpenServiceW RegCloseKey RegEnumKeyExW RegOpenKeyExW CloseServiceHandle OpenSCManagerW GetSidSubAuthorityCount GetSidSubAuthority GetTokenInformation AccessCheck GetFileSecurityW DuplicateToken MapGenericMask LookupPrivilegeValueW AdjustTokenPrivileges RegSaveKeyW OpenProcessToken

ole32

CoSetProxyBlanket CoUninitialize CoInitializeEx CoCreateInstance IIDFromString CLSIDFromString CoAddRefServerProcess CoReleaseServerProcess OleRun

oleaut32

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

shlwapi

StrStrIW

wininet

HttpSendRequestW InternetConnectW InternetCloseHandle InternetOpenW InternetSetOptionW InternetReadFile HttpOpenRequestW

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

683KB

Virtual Size

682KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

43KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

100KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gehcont

Size

512B

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

wsc_proxy.exe

IMPHASH 25d328e990242d57aadda37b34326c2c
SHA256 ae291ab3259cdba264fc548bcb950cad6cb2e77f859df0f50bc26264f7e9817c
MD5 38ba4f68c389f80a401ef9a9646af975
SHA1 cb3db09c4bb8c9a3231ff96c398174bfe849edfa
SHA512 a23efb870454e003976a8f76f516622c735df0cf263c16b895edfb6d68939c58f3fa4d3367f8475ce27a385c54b79ee8551db90063a825c67ff89c1f9ce1dfc5
SSDEEP 768:NuUNv6ZnOIJaHQBMb7hQpZNw+vnAyAcTtrWs+QPxWEVDSQPxWEvez:AM6SQBFbw+oy/tt9Px1Pxgz
TLSH
T1DA7306D15F83288DE8237D7010A766ADCF507D228C72C292D23AE9350BE76E5E6DF095
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

PE Signature issue

Digest

cf:5c:af:8d:da:67:0d:d4:53:07:54:5f:be:49:04:cb:07:b6:8a:2e:96:62:db:2d:b3:48:01:4d:42:bb:1b:85

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=NortonLifeLock Inc.,O=NortonLifeLock Inc.,L=Tempe,ST=Arizona,C=US

Chains

Jan 16, 2023

CN=NortonLifeLock Inc.,O=NortonLifeLock Inc.,L=Tempe,ST=Arizona,C=US

Digest

cf:5c:af:8d:da:67:0d:d4:53:07:54:5f:be:49:04:cb:07:b6:8a:2e:96:62:db:2d:b3:48:01:4d:42:bb:1b:85

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=NortonLifeLock Inc.,OU=Norton Product Engineering - CM,O=NortonLifeLock Inc.,ST=Arizona,C=US

Chains

Jan 16, 2023

CN=NortonLifeLock Inc.,OU=Norton Product Engineering - CM,O=NortonLifeLock Inc.,ST=Arizona,C=US

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Serial Number

9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - May 24, 2036

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 22, 2015 - Jul 22, 2025

Subject

CN=NortonLifeLock Inc.,OU=Norton Product Engineering - CM,O=NortonLifeLock Inc.,ST=Arizona,C=US

Serial Number

04:23:d1:81:c8:98:7b:3e:dd:3f:95:13:b5:eb:2e:b2

Issuer

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 25, 2022 - Feb 24, 2025

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=NortonLifeLock Inc.,O=NortonLifeLock Inc.,L=Tempe,ST=Arizona,C=US

Serial Number

0d:47:f2:7e:d3:04:2d:49:58:26:ba:74:d9:40:ee:a4

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 21, 2022 - Oct 20, 2023

Minor OS version

Major OS version

Entry point

4176

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BUILD\work\db284eccbc051fcc\BUILDS\Release\x64\wsc_proxy.pdb