AACGUARD-v0[.]0[.]13-b02[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
AACGUARD-v0.0.13-b02.exe
Size 76.6MB
Sample261018-vbpftassbx
SHA256 24ef9b6d2decb7f5970dd4478a35796517e4322341b27c26eb0543ab656c6776
MD5 5bdc55ef01212d25739f4d63d299b25a
SHA1 33fc4f83c322c4fbf74b7259bc748a12a5d13cdf
SHA512 a090a4adb5107641a2fb79ee5b5756c738cbb181ad61942c0869b274aaed6551fc43a519b6f0067e7302f62e90cc4a892230372cdcacf9877e38234ef0755165
SSDEEP 1572864:miaPeH3wzXgXsbY2XFWvFwNhTJzAjAInFLms4twq7JAlw0hsfFCvNbZgymAKBzz7:miaPeXmX6sbYm0mNz+dtwDwmfQvNbZgb
TLSH
T1760833E4C0F18442FCB3CBB58324681317CB562ED97DEB558DBD92832473E93A2A165E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
unpack001/$RESOURCES/AACGUARD/AACGUARD/SQLite.Interop.dll

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
AACGUARD-v0.0.13-b02.exe
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$RESOURCES/AACGUARD/AACGUARD/AAC.exe

File Explorer

AACGUARD-v0.0.13-b02.exe

.exe 76.6MB
$PLUGINSDIR/InstallOptions.dll

.dll 15KB
$PLUGINSDIR/LangDLL.dll

.dll 5KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/ioSpecial.ini

211B
$PLUGINSDIR/modern-wizard.bmp

25KB
$RESOURCES/AACGUARD/AACGUARD/AAC.exe

.exe 183.5MB
$RESOURCES/AACGUARD/AACGUARD/AAC.pdb

197KB
$RESOURCES/AACGUARD/AACGUARD/D3DCompiler_47_cor3.dll

.dll 4.5MB
$RESOURCES/AACGUARD/AACGUARD/PenImc_cor3.dll

.dll 154KB
$RESOURCES/AACGUARD/AACGUARD/PresentationNative_cor3.dll

.dll 1.2MB
$RESOURCES/AACGUARD/AACGUARD/SQLite.Interop.dll

.dll 1.9MB
$RESOURCES/AACGUARD/AACGUARD/vcruntime140_cor3.dll

.dll 121KB
$RESOURCES/AACGUARD/AACGUARD/wpfgfx_cor3.dll

.dll 1.9MB
license.txt

7KB
logo.ico

14KB

AACGUARD-v0.0.13-b02.exe

IMPHASH f4639a0b3116c2cfc71144b88a929cfd
SHA256 24ef9b6d2decb7f5970dd4478a35796517e4322341b27c26eb0543ab656c6776
MD5 5bdc55ef01212d25739f4d63d299b25a
SHA1 33fc4f83c322c4fbf74b7259bc748a12a5d13cdf
SHA512 a090a4adb5107641a2fb79ee5b5756c738cbb181ad61942c0869b274aaed6551fc43a519b6f0067e7302f62e90cc4a892230372cdcacf9877e38234ef0755165
SSDEEP 1572864:miaPeH3wzXgXsbY2XFWvFwNhTJzAjAInFLms4twq7JAlw0hsfFCvNbZgymAKBzz7:miaPeXmX6sbYm0mNz+dtwDwmfQvNbZgb
TLSH
T1760833E4C0F18442FCB3CBB58324681317CB562ED97DEB558DBD92832473E93A2A165E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13650

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW WriteFile CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject SetEnvironmentVariableW

$PLUGINSDIR/InstallOptions.dll

IMPHASH 85f08eb0cbec010ecbc287fa68321173
SHA256 89dd7d646278d8bfc41d5446bdc348b9a9afaa832abf02c1396272bb7ac7262a
MD5 d1eefb07abc2577dfb92eb2e95a975e4
SHA1 0584c2b1807bc3bd10d4b60d2d23eeb0e6832ca2
SHA512 eaffd9940b1df59e95e2adb79b3b6415fff5bf196ebea5fe625a6c52e552a00b44d985a36a8dd9eb33eba2425ffea4244ed07a75d87284ff51ec9f9a5e1ac65e
SSDEEP 192:E6GQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoT311929WtshLAzgSrX8:E6Nt+4t7uJalUnGesY7Lt8nC3/Yosa
TLSH
T186624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E4678565805D78311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11022

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryW GetCurrentDirectoryW GlobalUnlock GlobalLock GetModuleHandleW CloseHandle SetEndOfFile GetPrivateProfileIntW SetFilePointer MultiByteToWideChar ReadFile GetFileSize CreateFileW lstrcmpiW GetPrivateProfileStringW lstrcatW lstrcpynW WritePrivateProfileStringW lstrlenW lstrcpyW GlobalFree WriteFile GlobalAlloc

user32

PtInRect LoadCursorW GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard GetClientRect SetWindowRgn LoadIconW LoadImageW SetWindowLongW CreateWindowExW MapDialogRect SetWindowPos GetWindowRect CreateDialogParamW ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageW TranslateMessage GetMessageW IsDialogMessageW SetCursor DrawTextW GetWindowLongW DrawFocusRect CallWindowProcW PostMessageW MessageBoxW GetSysColor CharNextW wsprintfW GetWindowTextW SetWindowTextW SendMessageW MapWindowPoints

gdi32

SetTextColor CreateCompatibleDC GetObjectW GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderW SHGetDesktopFolder SHGetPathFromIDListW ShellExecuteW

comdlg32

GetOpenFileNameW GetSaveFileNameW CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/LangDLL.dll

IMPHASH fe3375e7e4529b73ba45ab2246b9269b
SHA256 131aa0df90c08dce2eecee46cce8759e9afff04bf15b7b0002c2a53ae5e92c36
MD5 549ee11198143574f4d9953198a09fe8
SHA1 2e89ba5f30e1c1c4ce517f28ec1505294bb6c4c1
SHA512 0fb4cea4fd320381fe50c52d1c198261f0347d6dcee857917169fcc3e2083ed4933beff708e81d816787195cca050f3f5f9c5ac9cc7f781831b028ef5714bec8
SSDEEP 48:S46+/sTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8mWofjLl:z+uPbO5tCZBVEAWyMEFv2Cm9L
TLSH
T1D5C1A370B3D248B9C591413778AB33D36612AE747784504FDB6311AA3820AE7AD3EBC2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5439

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
MD5 192639861e3dc2dc5c08bb8f8c7260d5
SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
TLSH
T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$RESOURCES/AACGUARD/AACGUARD/AAC.exe

IMPHASH 15e45789fcca31fa6d00850cd1a44d5a
SHA256 fa9306aa6043a02e6a945ce988d60f4adc3da6eee265e78f32ad7c3771b7f0f7
MD5 c0f7648918ceacbc9c797c317f71193b
SHA1 67aab195c96b084069d362166c3a9fa5143dfd0d
SHA512 0ac1d56666df8a8236672d0e3ae77e11ca5b72b8ef8889601fd1d4a5b8df1dfcaa46b2e9c1f943eb3c67ac5e0311f27781309927209337f68b1ec7ec13229f3d
SSDEEP 1572864:s+Jjhd0zXulehSaq9XR7yLqp2iGLfztINXbCw9n6O8b:sgJ7aq9XR7yLgjGXtINdO
TLSH
T118988D02A3EC1A55E17BA6B4E6724692D6F0BC525721E1CF0484F90F2E77FD16A36332
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6068704

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\src\runtime\artifacts\obj\coreclr\windows.x64.Release\Corehost.Static\singlefilehost.pdb

kernel32

ActivateActCtx FindResourceW GetWindowsDirectoryW GetModuleHandleW LoadLibraryExW LoadLibraryExA RtlCaptureContext WideCharToMultiByte GetConsoleOutputCP MapViewOfFileEx SetLastError SetThreadErrorMode RaiseException SetConsoleCtrlHandler DebugBreak FlsAlloc FlsSetValue FlsGetValue GetLocaleInfoEx GetUserDefaultLocaleName FlushProcessWriteBuffers ReadFile CreateNamedPipeA GetCurrentProcess WriteFile WaitForMultipleObjects WaitForSingleObject DuplicateHandle DisconnectNamedPipe CreateEventW CreateFileA CancelIoEx GetOverlappedResult ConnectNamedPipe FlushFileBuffers SetEvent ResetEvent WaitForSingleObjectEx VirtualAlloc VirtualFree VirtualQuery VirtualProtect SleepEx SwitchToThread MultiByteToWideChar SuspendThread ResumeThread LCMapStringEx FormatMessageW LocalFree GetModuleFileNameW GetEnvironmentVariableW CreateFileW GetFullPathNameW HeapAlloc HeapFree CreateFileMappingW HeapCreate GetProcessHeap HeapDestroy VerSetConditionMask VerifyVersionInfoW QueueUserAPC SetThreadPriority GetThreadPriority TlsSetValue TlsAlloc WaitForMultipleObjectsEx SignalObjectAndWait RtlLookupFunctionEntry SetThreadStackGuarantee LocateXStateFeature SetErrorMode RaiseFailFastException GetExitCodeProcess TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter AddVectoredExceptionHandler GetThreadContext SetThreadContext GetEnabledXStateFeatures InitializeContext RtlRestoreContext SetXStateFeaturesMask CopyContext GetModuleHandleExW GetCommandLineW CreateProcessW GetCPInfo ExitProcess OutputDebugStringW RtlInstallFunctionTableCallback GetLogicalProcessorInformationEx SetThreadGroupAffinity GetThreadGroupAffinity GetProcessGroupAffinity UnmapViewOfFile QueryInformationJobObject FlushInstructionCache RtlDeleteFunctionTable AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock InitializeConditionVariable WakeAllConditionVariable AcquireSRWLockShared SleepConditionVariableSRW ReleaseSRWLockShared CreateMemoryResourceNotification WerRegisterRuntimeExceptionModule RtlUnwind CloseThreadpoolTimer CreateThreadpoolTimer SetThreadpoolTimer OpenEventW ExitThread HeapReAlloc TlsGetValue GetFileSize RtlAddFunctionTable CreateSemaphoreExW ReleaseSemaphore GetSystemDefaultLCID GetUserDefaultLCID OutputDebugStringA QueryThreadCycleTime SetFilePointer MapViewOfFile LeaveCriticalSection Sleep RemoveDirectoryW CreateDirectoryW GetEnvironmentStringsW GetSystemTime GetSystemTimeAsFileTime FreeLibrary GetCurrentProcessId GetProcAddress CreateThread GetSystemInfo CloseHandle GetActiveProcessorGroupCount GetCurrentThread GetLastError FreeEnvironmentStringsW GetCurrentThreadId CreateActCtxW GetStdHandle FindNextFileW EnterCriticalSection FindFirstFileExW GetFileSizeEx GetTempPathW FindClose GetFileAttributesW GetConsoleMode GetFileAttributesExW LoadLibraryA GetCurrentDirectoryW WriteConsoleW DeleteCriticalSection CreateFileMappingA GetTickCount64 InitializeCriticalSection QueryPerformanceFrequency QueryPerformanceCounter IsDebuggerPresent GetNumaHighestNodeNumber SetThreadAffinityMask SetThreadIdealProcessorEx GetThreadIdealProcessorEx VirtualAllocExNuma GetNumaProcessorNodeEx VirtualUnlock GetLargePageMinimum IsProcessInJob GetMaximumProcessorGroupCount K32GetProcessMemoryInfo GetLogicalProcessorInformation GlobalMemoryStatusEx RtlVirtualUnwind IsProcessorFeaturePresent InitializeSListHead RtlUnwindEx RtlPcToFileHeader EncodePointer InitializeCriticalSectionAndSpinCount TlsFree TryAcquireSRWLockExclusive GetExitCodeThread GetStringTypeW InitializeCriticalSectionEx DecodePointer SetEnvironmentVariableW GetProcessAffinityMask GetCurrentProcessorNumberEx

advapi32

LookupPrivilegeValueW RegGetValueW SetKernelObjectSecurity RegQueryValueExW RegOpenKeyExW GetSidSubAuthorityCount GetSidSubAuthority GetTokenInformation OpenProcessToken RegCloseKey SetThreadToken RevertToSelf OpenThreadToken EventWrite EventRegister EventWriteTransfer DeregisterEventSource RegisterEventSourceW ReportEventW AdjustTokenPrivileges

ole32

CLSIDFromProgID CoCreateGuid CoTaskMemAlloc CoUnmarshalInterface CoMarshalInterface CoGetMarshalSizeMax CoCreateFreeThreadedMarshaler CoGetClassObject CoGetContextToken CoGetObjectContext CoReleaseMarshalData CoInitializeEx CoRegisterInitializeSpy CoWaitForMultipleHandles CoUninitialize CoRevokeInitializeSpy CoTaskMemFree

oleaut32

GetErrorInfo SetErrorInfo SysFreeString SysStringLen CreateErrorInfo QueryPathOfRegTypeLi LoadTypeLibEx SafeArrayGetVartype VariantChangeType SysAllocString LoadRegTypeLi SysAllocStringLen VariantClear VariantInit VarCyFromDec SafeArrayDestroy SafeArrayAllocDescriptorEx GetRecordInfoFromTypeInfo SafeArraySetRecordInfo SafeArrayAllocData SafeArrayGetElemsize SysStringByteLen SysAllocStringByteLen SafeArrayCreateVector SafeArrayPutElement SafeArrayGetDim SafeArrayGetLBound

user32

MessageBoxW LoadStringW

shell32

ShellExecuteW

api-ms-win-crt-string-l1-1-0

iswspace strncpy iswascii _strnicmp iswupper strncmp strncpy_s towlower wcscat_s _wcsdup wcscpy_s wcsncpy_s isalpha strnlen _strdup wcsncat_s strncat_s strcpy_s towupper _stricmp strcat_s isspace strtok_s strcmp wcsnlen strlen tolower wcsncmp _wcsnicmp _wcsicmp isdigit

api-ms-win-crt-heap-l1-1-0

_callnewh calloc free malloc realloc _set_new_mode _aligned_malloc _aligned_free

api-ms-win-crt-convert-l1-1-0

atoi _ltow_s _wcstoui64 _wtoi wcstoul atol strtoull strtoul _atoi64 strtol

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s __stdio_common_vsnwprintf_s __stdio_common_vswprintf fputwc __stdio_common_vfwprintf __stdio_common_vfprintf ftell fseek __acrt_iob_func fopen __stdio_common_vsprintf setvbuf _setmode _dup _fileno _wfsopen fclose _flushall fwrite __p__commode __stdio_common_vsnprintf_s _set_fmode _write __stdio_common_vsscanf fgets fflush fputs _wfopen

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-runtime-l1-1-0

_wcserror_s _beginthreadex terminate _errno abort _invalid_parameter_noinfo _register_thread_local_exe_atexit_callback _c_exit __p___wargv __p___argc _exit exit _initterm_e _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _controlfp_s _invoke_watson

api-ms-win-crt-filesystem-l1-1-0

_wremove _wrename

api-ms-win-crt-math-l1-1-0

trunc ilogbf ceil copysignf copysign ceilf round asinh cos cbrt acosh atanh modf acoshf cbrtf atanhf modff asinhf _fdopen fmodf tanhf fmod fmaf __setusermatherr fma floorf acos acosf asin asinf atan atan2 log10 log10f log2 log2f floor expf logf log pow exp coshf powf cosh roundf sin cosf sinf sinh truncf sinhf sqrt sqrtf tan tanf tanh atan2f atanf

api-ms-win-crt-time-l1-1-0

_gmtime64_s _time64 wcsftime

api-ms-win-crt-locale-l1-1-0

_create_locale _free_locale ___lc_codepage_func ___mb_cur_max_func ___lc_locale_name_func setlocale _unlock_locales _lock_locales _configthreadlocale __pctype_func

Name

.text

Size

6.4MB

Virtual Size

6.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.CLR_UEF

Size

512B

Virtual Size

215B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

229KB

Virtual Size

229KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Section

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$RESOURCES/AACGUARD/AACGUARD/D3DCompiler_47_cor3.dll

IMPHASH 743865990ba9629a654f1d23f6ee14f7
SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
MD5 19e527a35241c171d37dc1e6c530053c
SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
TLSH
T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Digest

70:22:96:6a:50:48:c5:aa:70:a0:c4:10:4c:38:4b:fc:0a:0d:7f:3c:bb:a6:e9:7c:00:9c:f9:06:fe:d2:1e:58

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jan 26, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:87:bc:82:6e:85:a1:ae:53:a8:00:00:00:00:00:87

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 8, 2025 - May 6, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:651A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:15:18:03:d3:81:07:26:7c:53:00:01:00:00:02:15

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

1493760

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D3DCompiler_47.pdb

kernel32

WriteFile FreeLibrary Sleep TlsAlloc TlsSetValue HeapDestroy TlsGetValue TlsFree GetFullPathNameW GetFullPathNameA GetEnvironmentVariableA VirtualFree VirtualAlloc GetSystemInfo GetProcAddress LoadLibraryExW SetLastError RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentThreadId GetStdHandle GetFileType GetStartupInfoW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx GetSystemTimeAsFileTime VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ExitProcess GetModuleHandleW GetModuleHandleExW IsValidCodePage GetACP GetOEMCP GetCPInfo SetFilePointerEx ReadFile SetStdHandle GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW RaiseException FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetModuleFileNameW ReadConsoleW HeapSize HeapReAlloc WriteConsoleW QueryPerformanceCounter GetCurrentProcessId InitializeSListHead RtlUnwindEx InterlockedFlushSList RtlPcToFileHeader EncodePointer LocalAlloc LocalFree GetFileSizeEx GetLastError CreateFileW HeapFree GetProcessHeap UnmapViewOfFile GetFileSize CreateFileMappingW MapViewOfFile GetFileAttributesW SetFileAttributesW DeleteFileW SetEndOfFile DeviceIoControl InitializeCriticalSectionAndSpinCount MapViewOfFileEx CreateFileMappingA ExpandEnvironmentStringsW HeapAlloc OutputDebugStringA CloseHandle LeaveCriticalSection EnterCriticalSection lstrcmpiA HeapCreate GetModuleFileNameA CreateFileA DeleteCriticalSection InitializeCriticalSection WideCharToMultiByte FindClose FindFirstFileExW FindNextFileW GetCommandLineA GetCommandLineW GetDriveTypeW GetCurrentDirectoryW SetEvent ResetEvent WaitForSingleObjectEx CreateEventW MultiByteToWideChar GetStringTypeW DisableThreadLibraryCalls

advapi32

CryptDestroyHash CryptAcquireContextW RegQueryValueExA RegEnumKeyExA RegOpenKeyExA CryptGetHashParam CryptCreateHash CryptHashData RegQueryValueExW RegOpenKeyExW RegCloseKey CryptReleaseContext

rpcrt4

UuidCreate

Name

.text

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

fothk

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

916KB

Virtual Size

913KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

64KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

124KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

4KB

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

36KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$RESOURCES/AACGUARD/AACGUARD/PenImc_cor3.dll

IMPHASH 4973eef226ec884d2aa44d1f0ef49fd5
SHA256 007cb9a6781801c5ed071127314d12b40f8778356b1bce4316309a1be8c42c51
MD5 f6d90660727ded4c999ac7e74060bba4
SHA1 4736c8ecb5a65b35a45f9ae9671a88e74d859d77
SHA512 3c4387104fdaf802a4a4619067af4ed07f5cb5f7c1f34ba6abb811d80a1d0d01130049e54e8349d6a6fa2842d37f4a6b1e387911148f5687adc4cb3cf4351011
SSDEEP 3072:grndTvsZbCHO0A3I62EpLgUGhFoD5GqTuE9ZTTml7OMTjkpBygKzsvADnJ07Y4LX:WndDswe3D2yL1D57uEdVinJYN
TLSH
T1D2F33813B69C40ABC029D27E85D70645F772BC111B228BDF2261932E1F7B7D4AE3A395
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:6 windows x64 arch:x64

Digest

a9:ec:9c:24:83:3f:b3:38:84:47:aa:93:71:ba:43:1d:88:e4:0c:8f:18:98:87:fc:ec:9e:96:0d:28:e3:42:be

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 4, 2026

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

74160

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\src\wpf\artifacts\bin\PenImc\x64\Release\PenImc_cor3.pdb

kernel32

SetThreadLocale DeleteCriticalSection RaiseException InitializeCriticalSectionEx DecodePointer EncodePointer EnterCriticalSection LeaveCriticalSection WaitForSingleObject ReleaseMutex InitializeCriticalSection CreateEventW GetCurrentProcessId OpenEventW OpenMutexW OpenFileMappingW MapViewOfFile UnmapViewOfFile SetEvent LocalFree SignalObjectAndWait IsWow64Process GetCurrentProcess OutputDebugStringW GetThreadLocale CreateThread QueueUserAPC SetWaitableTimer CancelWaitableTimer CreateActCtxW ActivateActCtx VerSetConditionMask LoadLibraryW InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsDebuggerPresent SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext RtlPcToFileHeader InterlockedFlushSList CreateMutexW CloseHandle GetModuleFileNameW LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar GetLastError lstrcmpiW GetModuleHandleW GetProcAddress FreeLibrary CreateWaitableTimerW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx RtlLookupFunctionEntry GetCurrentThreadId

user32

SetWindowsHookExW CallNextHookEx GetWindowRect EqualRect GetWindow MsgWaitForMultipleObjectsEx IsWindow GetParent GetWindowThreadProcessId CharNextW UnhookWindowsHookEx GetSystemMetrics GetMonitorInfoW MonitorFromWindow GetDesktopWindow PeekMessageW

advapi32

ConvertSidToStringSidW FreeSid EqualSid AllocateAndInitializeSid GetTokenInformation OpenProcessToken RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW

shell32

ShellExecuteExW

ole32

CoTaskMemRealloc CoTaskMemAlloc StringFromGUID2 CoCreateInstance CoTaskMemFree CoLockObjectExternal CoGetApartmentType

oleaut32

SysAllocString UnRegisterTypeLi VarUI4FromStr SysFreeString RegisterTypeLi SysStringLen LoadTypeLi

api-ms-win-crt-string-l1-1-0

strlen strcmp wcscpy_s wcscat_s wcsncmp strcpy_s wcsncpy_s

api-ms-win-crt-heap-l1-1-0

_callnewh malloc free calloc _recalloc realloc

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll _configure_narrow_argv abort _initialize_narrow_environment _invalid_parameter_noinfo terminate _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _cexit _initterm _errno _initterm_e

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf

rpcrt4

NdrCStdStubBuffer_Release CStdStubBuffer_Connect NdrDllCanUnloadNow CStdStubBuffer_IsIIDSupported IUnknown_QueryInterface_Proxy CStdStubBuffer_Disconnect NdrDllGetClassObject NdrDllRegisterProxy CStdStubBuffer_DebugServerRelease NdrOleAllocate CStdStubBuffer_QueryInterface CStdStubBuffer_CountRefs NdrDllUnregisterProxy IUnknown_AddRef_Proxy CStdStubBuffer_AddRef NdrOleFree CStdStubBuffer_DebugServerQueryInterface IUnknown_Release_Proxy CStdStubBuffer_Invoke

Name

.text

Size

81KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.orpc

Size

512B

Virtual Size

201B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$RESOURCES/AACGUARD/AACGUARD/PresentationNative_cor3.dll

IMPHASH 5de612d168dd4f3cbdf371592277147a
SHA256 091609705a031d5832f21548291c2670f06eadd781d465d3e1a5fad3772adc91
MD5 76c57f8f951306b6fe29c83f9844cb6f
SHA1 9aa8c8bf7af042ac0d95f6169d71a5ddd6a0cc4c
SHA512 019050f80430ae459e6fd6ffce5cbff4af49073834169d40083f6a9b22abebac1d605ab8b409449d4313a3bea08bebfc62c9b93905bcc327e8b20016414133c1
SSDEEP 24576:XjOnXauaPQDzcpsVOE4PU5tbg5ChWmAjHSa+YrHAvlFk8TQh6p1zwPwYffvhXYj5:ZuaofcpsQ5PU5ZhWmAjHjAvlF5QhURwA
TLSH
T10A453A22D2E642E5C47FC1B8C646972BFBB1740A131C66DB47608B592F27FE0963E364
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

4b:fe:af:a2:53:ff:e4:61:6c:cd:46:e4:8f:29:47:4e:04:c9:40:e1:4c:1d:6d:50:3f:24:e8:fb:d6:d0:37:c0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 2, 2026

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

5680

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\artifacts\bin\PresentationNative\x64\Release\PresentationNative_cor3.pdb

kernel32

UnhandledExceptionFilter GetCurrentThread GetCurrentProcess TerminateProcess IsProcessorFeaturePresent SetUnhandledExceptionFilter TerminateThread GetProcAddress VerSetConditionMask FreeLibrary GetProcessHeap HeapAlloc HeapFree HeapReAlloc OutputDebugStringW DeleteCriticalSection DisableThreadLibraryCalls LoadLibraryW InitializeCriticalSection InitializeCriticalSectionEx GlobalDeleteAtom DebugBreak OutputDebugStringA IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter LeaveCriticalSection EnterCriticalSection InterlockedFlushSList LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RaiseException EncodePointer SetLastError GetLastError

ntdll

DbgBreakPoint DbgPrompt DbgPrintEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwindEx RtlPcToFileHeader NtQuerySystemInformation

api-ms-win-crt-runtime-l1-1-0

terminate _cexit _crt_atexit abort _execute_onexit_table _initterm _initterm_e _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function

api-ms-win-crt-heap-l1-1-0

malloc free calloc

api-ms-win-crt-string-l1-1-0

iswpunct strlen strcmp wcsncmp strcpy_s

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf

user32

SetWindowLongPtrW SetWindowLongW SetScrollPos SetFocus MapWindowPoints GetWindowTextLengthW GetWindowTextW GetWindowLongPtrW GetWindowLongW GetWindow GetParent GetMenuBarInfo GetKeyboardLayoutList GetAncestor EnableWindow FindWindowExW

gdi32

GetTextExtentPoint32W

ole32

CoTaskMemFree CoCreateInstance

oleaut32

VariantInit SysAllocString VariantChangeType VariantClear

CreateDocContext CreateInstalledObjectsInfo CreateTextAnalysisSink CreateTextAnalysisSource DestroyDocContext DestroyInstalledObjectsInfo EnableWindowWrapper FindWindowExWrapper FsAddFigureObstacle FsClearUpdateInfoInPage FsClearUpdateInfoInSubpage FsClearUpdateInfoInSubtrack FsClearUpdateInfoInTableSrv FsCommitFilledRectangle FsCompareSubpages FsCompareSubtrack FsCompareTableSrv FsCreateDocContext FsCreateDummyFootnoteRejector FsCreatePageBottomless FsCreatePageFinite FsCreateSubpageBottomless FsCreateSubpageFinite FsDestroyDocContext FsDestroyFootnoteRejector FsDestroyPage FsDestroyPageBreakRecord FsDestroySubpage FsDestroySubpageBreakRecord FsDestroySubtrack FsDestroySubtrackBreakRecord FsDestroyTableSrv FsDestroyTableSrvBreakRecord FsDuplicateGeometry FsDuplicatePageBreakRecord FsDuplicateSubpageBreakRecord FsDuplicateSubtrackBreakRecord FsDuplicateTableSrvBreakRecord FsFAllFootnotesAllowed FsFFootnoteAllowed FsFormatSubtrackBottomless FsFormatSubtrackFinite FsFormatTableSrvBottomless FsFormatTableSrvFinite FsGetClientHandle FsGetColumnRectangle FsGetEmptySpaces FsGetFigureObstacleData FsGetFloaterFsimethods FsGetIntervals FsGetMaxNumberEmptySpaces FsGetMaxNumberIntervals FsGetNextTick FsGetNumberSubpageFootnotes FsGetNumberSubtrackFootnotes FsGetPageRectangle FsGetShiftOffset FsGetSubpageColumnBalancingInfo FsGetSubpageFootnoteInfo FsGetSubtrackColumnBalancingInfo FsGetSubtrackFootnoteInfo FsGetTableObjFsimethods FsGetTableSrvColumnBalancingInfo FsGetTableSrvFootnoteInfo FsGetTableSrvNumberFootnotes FsJustifySubpage FsQueryAttachedObjectList FsQueryCompositeColumnDetails FsQueryCompositeColumnFootnoteList FsQueryDcpLineVariantsFromCachedTextPara FsQueryEndnoteColumnDetails FsQueryFigureObjectDetails FsQueryFloaterDetails FsQueryFootnoteColumnDetails FsQueryFootnoteColumnTrackList FsQueryHeightDefinedColumnSpanAreaList FsQueryLineCompositeElementList FsQueryLineListComposite FsQueryLineListSingle FsQueryPageDetails FsQueryPageFootnoteColumnList FsQueryPageSectionList FsQuerySectionBasicColumnList FsQuerySectionCompositeColumnList FsQuerySectionDetails FsQuerySectionEndnoteColumnList FsQuerySegmentDefinedColumnSpanAreaList FsQuerySubpageBasicColumnList FsQuerySubpageDetails FsQuerySubpageHeightDefinedColumnSpanAreaList FsQuerySubpageSegmentDefinedColumnSpanAreaList FsQuerySubtrackDetails FsQuerySubtrackParaList FsQueryTableObjCellList FsQueryTableObjDetails FsQueryTableObjFigureCountWord FsQueryTableObjFigureListWord FsQueryTableObjRowDetails FsQueryTableObjRowList FsQueryTableObjTableProperDetails FsQueryTableSrvCellList FsQueryTableSrvRowDetails FsQueryTableSrvRowList FsQueryTableSrvTableDetails FsQueryTextDetails FsQueryTrackDetails FsQueryTrackParaList FsRegisterFloatObstacle FsReleaseGeometry FsResolveOverlap FsRestoreGeometry FsShiftSubtrackVertical FsSynchronizeBottomlessSubtrack FsTransferDisplayInfoSubpage FsTransferDisplayInfoSubtrack FsTransferDisplayInfoTableSrv FsTransformBbox FsTransformPoint FsTransformRectangle FsTransformVector FsUpdateBottomlessPage FsUpdateBottomlessSubpage FsUpdateBottomlessSubtrack FsUpdateBottomlessTableSrv FsUpdateFinitePage GetAncestorWrapper GetFloaterHandlerInfo GetKeyboardLayoutListWrapper GetMenuBarInfoWrapper GetNumberSubstitutionList GetParentWrapper GetScriptAnalysisList GetTableObjHandlerInfo GetTextExtentPoint32Wrapper GetWindowLongPtrWrapper GetWindowLongWrapper GetWindowTextLengthWrapper GetWindowTextWrapper GetWindowWrapper GlobalDeleteAtomWrapper IsPrintPackageTargetSupported IsStartXpsPrintJobSupported IsWindows10OrGreater IsWindows10RS1OrGreater IsWindows10RS2OrGreater IsWindows10RS3OrGreater IsWindows10RS4OrGreater IsWindows10RS5OrGreater IsWindows10TH1OrGreater IsWindows10TH2OrGreater IsWindows7OrGreater IsWindows7SP1OrGreater IsWindows8OrGreater IsWindows8Point1OrGreater IsWindowsServer IsWindowsVistaOrGreater IsWindowsVistaSP1OrGreater IsWindowsVistaSP2OrGreater IsWindowsXPOrGreater IsWindowsXPSP1OrGreater IsWindowsXPSP2OrGreater IsWindowsXPSP3OrGreater LateBoundStartXpsPrintJob LoAcquireBreakRecord LoAcquirePenaltyModule LoCloneBreakRecord LoCreateBreaks LoCreateContext LoCreateLine LoCreateParaBreakingSession LoDestroyContext LoDisplayLine LoDisposeBreakRecord LoDisposeLine LoDisposeParaBreakingSession LoDisposePenaltyModule LoEnumLine LoGetEscString LoGetPenaltyModuleInternalHandle LoQueryLineCpPpoint LoQueryLinePointPcp LoRelievePenaltyResource LoSetBreaking LoSetDoc LoSetTabs LocbkGetObjectHandlerInfo LsDisableSpecialCharacterLigature MILGetClassificationTables MapWindowPointsWrapper NlCreateHyphenator NlDestroyHyphenator NlGetClassObject NlHyphenate NlLoad NlUnload PrintToPackageTarget SetFocusWrapper SetScrollPosWrapper SetWindowLongPtrWrapper SetWindowLongWrapper

$RESOURCES/AACGUARD/AACGUARD/SQLite.Interop.dll

IMPHASH 873d9909aefadae8c618f6256399d92b
SHA256 1111916dc329a13bd627b2cd90c9b2263de9923fd0bb6059c69c52332f360c37
MD5 4930777866b1fdaed2ab80b0fb8793b6
SHA1 e2686b9ac7c3867c644902805142f1f42bae7645
SHA512 d294e9d638fb6d579fdfd69a9f098b2d8087fc6c1c240496cc99804980284352299b52b9a2d6b1d1289ffdc5f5ecf364e67eb32e7b4a9a8ddf20c723f9fa28d5
SSDEEP 49152:tQ/IZ0sF2Ou+pqnX3lJ1nCHmWbk8d7hLJ:tQ/rHnkJ
TLSH
T1B4958D4BB2B400DCD6A7C17CC6475B0BE7B174051754ABDB07A486AA2F23FE516BE328
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

17:2a:11:33:f8:dc:c0:8d:73:a1:34:7b:6f:cc:8d:65:79:e1:d2:a3:2a:86:ce:83:7e:ee:51:71:fb:9e:3f:77:73:2b:28:3d:a9:f9:85:a3:1f:39:2f:1b:f0:d9:f0:3a:b6:70:62:b0:c5:60:9d:9b:4c:71:e1:ac:01:d3:c6:dd

Digest Algorithm

sha512

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

Chains

Sep 28, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

d2:d8:79:fc:4e:a9:37:27:ee:cc:cd:9b:a0:f0:aa:d4:48:d9:95:71

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

Sep 28, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 1, 2021 - Dec 12, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

37020

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\dev\sqlite\dotnet-private\bin\2015\x64\ReleaseNativeOnlyStatic\SQLite.Interop.pdb

mscoree

CorBindToRuntimeEx

wintrust

WinVerifyTrust

kernel32

GetFullPathNameW lstrlenW WriteFile GetDiskFreeSpaceW OutputDebugStringA GetModuleFileNameW SetEnvironmentVariableW LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA GetEnvironmentVariableW SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW lstrlenA GetEnvironmentVariableA WaitForSingleObject CreateFileW GetFileAttributesW GetCurrentThreadId lstrcmpA UnmapViewOfFile HeapValidate lstrcatA HeapSize MultiByteToWideChar Sleep GetTempPathA FormatMessageW GetDiskFreeSpaceA GetLastError GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA EnterCriticalSection LoadLibraryA lstrcatW WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc CloseHandle RaiseException GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress CreateFileMappingA LocalFree LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId GetProcessHeap SystemTimeToFileTime GetModuleHandleW FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW WriteConsoleW lstrcmpiW QueryPerformanceCounter GetTickCount FlushFileBuffers FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW HeapFree HeapCreate TryEnterCriticalSection ReadFile AreFileApisANSI SetEnvironmentVariableA SetStdHandle DisableThreadLibraryCalls MapViewOfFile RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx InterlockedFlushSList SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameA SetFilePointerEx GetConsoleMode ReadConsoleW GetStdHandle GetFileType CompareStringW LCMapStringW GetACP GetTimeZoneInformation GetConsoleCP GetStringTypeW FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA

user32

wsprintfA wsprintfW

advapi32

CryptAcquireContextW CryptEncrypt CryptDecrypt CryptCreateHash CryptDeriveKey CryptHashData CryptDestroyHash CryptReleaseContext CryptDestroyKey

SI01412f750db650ea SI014eca66bae0efcf SI03f1a6ba0377eb3c SI06bed3270468d254 SI06e8a47a5d91ab7a SI06f984fad40a36e4 SI0773159780bced42 SI08382c8853b7dc71 SI084e4b7e555a73d5 SI0920c2cb328dcabe SI09a5cdb44c766bf5 SI0b53a68143cc1b0f SI0c99c4f61c42d9cb SI0d8b78a11ae3c939 SI0fc933ae7753ba2a SI0fe9852cad13a1dd SI0fea42093af2ef7e SI1032fe758291c9d2 SI105ceea23cf3e972 SI1065a8fd0e9b6248 SI10bc187fb9f30400 SI10d93cc2be324ef6 SI1137f75ea606edd8 SI143d2ec51869c9ef SI1533d04dbddc89f3 SI15b0ccb840fe756a SI17025c605e70a4a8 SI1a60c8d9aa240c02 SI1e1b2cd59cde5330 SI20361920d76d1c13 SI21c1a5153dee82e5 SI21eb743aa97dd0a0 SI2290d4ae6120f350 SI23647b3b33c7b67c SI23e355695089fe37 SI25b2c5950dc91a64 SI288d2abca01a7755 SI297152ec74589b2b SI2b2b2dea9ca1acd8 SI2bef45fe52ca72f1 SI2c8c6bc7249e997b SI2ede0f7568749838 SI2f73a7c5ee9a4bdd SI3137cbacf0be79c7 SI3251345d99ccae5f SI34e86fbc7284ac94 SI35e7e93118b77594 SI372316f83587cf39 SI38a6331dd810267b SI3a032e64e8b6efc7 SI3bd6f3f9a8dfd5d8 SI3c633713d45fe153 SI3eae3b91c35710f2 SI43665eba4b112e61 SI46b4330c0025ee35 SI46feee5970000e9a SI4708fc53d48f6341 SI4b3462f62530edcd SI4b9c60f79bb4a586 SI4c7f2fc8244e8e97 SI4cf313784f059362 SI4dd366eb61ea9f19 SI4ea5bb6088373827 SI51c9fdbcfe92d512 SI54d10871821b7413 SI565e3a2f4880c993 SI5705d18b0f1a3f16 SI58c3a3c66c2dcf2e SI5b712222451f3649 SI5c335fd80f71405f SI5d396f2b3045aa28 SI5ea28794c6d3baba SI5fda06c9571a2739 SI60a64636c44dc75a SI60a8499dec5aed14 SI62c552c673d475ad SI639e09cf647bf739 SI63b8d075e85fcd75 SI64d099fc45565bfa SI66b6b72478589163 SI69397763836898ec SI6a0c6e709e15324c SI6a2ad2229e707897 SI6a521ecddeccce0c SI6bcaa289d733b1bd SI6d0a04aa40b1d0be SI6d674df0a026b436 SI6e807adb83cce4fe SI701c20092d6df8f6 SI72523c81bf843ecb SI7373972482ee41d4 SI74a64bc0421f55a1 SI755d1c3c1c833890 SI75ecb3e85adc6d3c SI760cc6e2cdd0a43f SI783606e3653f423b SI78949697388a5e96 SI7a32cdcec151473f SI7b300ecd0b0a9714 SI7b9d330f146f09ff SI7eebc71da5962123 SI815c7f80a3b5eef8 SI81c5f39b42673806 SI822a08b707fe68a4 SI833a819c5aa36754 SI83472c0e48389d38 SI835f126d08482062 SI86247b47ff2290c1 SI8631656e3aea13dc SI86b5369bcd0a5f16 SI87cee07b7057dc04 SI88a3bf730522eeb7 SI8a2dc94877dfc2d1 SI8f56135a54eebe6c SI8fa4445a262be3f3 SI8fdee029b5a476c8 SI907414cd4dd4ccca SI9076e178c2192f17 SI9509afa4eb3cb331 SI974bf1aef20016c3 SI99ab6591e47e8490 SI9b14b0fecb540943 SI9b7a6028d7d86345 SI9bea79209e38cadd SI9beae695f65c8831 SI9c19dd97f212203b SI9c93f804068bab24 SI9ec42a09bc865f9d SI9f5b0dd1908eae02 SI9fa7624fb4a3ef18 SIa1359c7ddb788e81 SIa16fd5b8861b40f7 SIa3cfb4dc038d6b7b SIa3d1a56d33c20e24 SIa435290dc4fed878 SIa7c7aff5999381c9 SIa8d64936cf3d3396 SIa95fe43298017f9c SIa9f630d42a76f7cd SIaa735a3d29d588fc SIab55c0054cb53cce SIadbe0d11829a42f8 SIaec1e040fbe08406 SIaed2151329e04128 SIaf3601f18c86084d SIaf4954b738baecfc SIaffa6236faa54566 SIb508c6bf9beb3e9a SIb59aec3e80324999 SIb74383fac3d1af7f SIb81cef84dc3b0916 SIb874ea750b169d2e SIbab6e4e180a52e70 SIbb99021fa0152f3f SIbc043d214978b5bc SIbc16c60b056f643d SIbcf0a4d41086373a SIc08b73ebfbb13340 SIc277bdfbcf3dff4b SIc2cfa96c9b044069 SIc2e589911405f758 SIc32418368cbcf873 SIc3837aac51e8bbaf SIc3b220bdbc2e5576 SIc4039b7c3e210259 SIc53555cd1701ed0d SIc6194b25761121c0 SIc91b167fae8dfb07 SIcb9cc9ac78fbd1af SIcbadd189048f97ba SIcda1a6f489751edc SIce71c3f8f99ece00 SId078679204df341a SId41f539240319963 SId46029ecf036c63b SId4ba3ad67ad9db4e SId65ac95447641462 SId71afd21d39232f8 SId8b20e53eb8cb070 SIda0d9076505bb3dc SIddef7bd33583175c SIdf1d803f3bd21209 SIe031ee2b91609a9c SIe131f9d31b1382e3 SIe23e3bca0c3096fb SIe28e961eed744765 SIe386f0ab147769f3 SIe6a093425765e588 SIe7f52a8f2a2d8221 SIe8e430baaa1c4f12 SIeae31eec529d37a9 SIeb8dfc915728294f SIec03556e990d20b0 SIec106ab1cd675af2 SIec703e0011ef212b SIee96c99a7ab5b96a SIef44ff86e552c514 SIf11151b3442788f9 SIf19a905eec4b4b07 SIf22f12c8b4a1025a SIf4d4989f6d9d28df SIf573131bc065fe3e SIf575ada1f51bf6c0 SIf7bf6ffc897e797a SIf8ad0e9245ddf3cc SIfadb4b14b2f47129 SIfc98bf629d788180 SIff580cc923329e69 SIffea2854e3834cb4 sqlite3_compress_init sqlite3_cryptoapi_init sqlite3_fts5_init sqlite3_fts_init sqlite3_percentile_init sqlite3_regexp_init sqlite3_sha_init sqlite3_shathree_init sqlite3_totype_init sqlite3_vtshim_init sqlite3_zipfile_init

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

299KB

Virtual Size

299KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

80KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

156B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$RESOURCES/AACGUARD/AACGUARD/vcruntime140_cor3.dll

IMPHASH 6b799efc51fdd03aa3707013f22955b8
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

16:1c:67:8a:c5:2f:a0:39:a4:a9:0f:75:90:8c:e8:cb:7d:a9:39:8b:9d:1e:9f:21:df:a7:31:d7:8e:36:45:9a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 10, 2025

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

16:1c:67:8a:c5:2f:a0:39:a4:a9:0f:75:90:8c:e8:cb:7d:a9:39:8b:9d:1e:9f:21:df:a7:31:d7:8e:36:45:9a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 10, 2025

CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0d:c4:e7:bb:f4:af:f8:f0:90:00:00:00:00:01:0d

Issuer

CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 15, 2025 - May 15, 2026

Subject

CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:14:9d:fb:c3:1f:1f:63:c3:10:00:00:00:00:00:14

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 1, 2013 - May 1, 2028

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6F1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:fc:18:a0:af:cc:69:5a:87:3a:00:01:00:00:01:fc

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 25, 2024 - Oct 22, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:04:7f:2f:42:2a:73:53:08:de:ea:00:00:00:00:04:7f

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 15, 2025 - May 15, 2026

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:651A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:f5:99:09:94:bc:f1:c6:50:8c:00:01:00:00:01:f5

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 25, 2024 - Oct 22, 2025

Minor OS version

Major OS version

Entry point

66448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb

_CreateFrameInfo _CxxThrowException _FindAndUnlinkFrame _IsExceptionObjectToBeDestroyed _SetWinRTOutOfMemoryExceptionCallback __AdjustPointer __BuildCatchObject __BuildCatchObjectHelper __C_specific_handler __C_specific_handler_noexcept __CxxDetectRethrow __CxxExceptionFilter __CxxFrameHandler __CxxFrameHandler2 __CxxFrameHandler3 __CxxQueryExceptionSize __CxxRegisterExceptionObject __CxxUnregisterExceptionObject __DestructExceptionObject __FrameUnwindFilter __GetPlatformExceptionInfo __NLG_Dispatch2 __NLG_Return2 __RTCastToVoid __RTDynamicCast __RTtypeid __TypeMatch __current_exception __current_exception_context __intrinsic_setjmp __intrinsic_setjmpex __processing_throw __report_gsfailure __std_exception_copy __std_exception_destroy __std_terminate __std_type_info_compare __std_type_info_destroy_list __std_type_info_hash __std_type_info_name __telemetry_main_invoke_trigger __telemetry_main_return_trigger __unDName __unDNameEx __uncaught_exception __uncaught_exceptions __vcrt_GetModuleFileNameW __vcrt_GetModuleHandleW __vcrt_InitializeCriticalSectionEx __vcrt_LoadLibraryExW _get_purecall_handler _get_unexpected _is_exception_typeof _local_unwind _purecall _set_purecall_handler _set_se_translator longjmp memchr memcmp memcpy memmove memset set_unexpected strchr strrchr strstr unexpected wcschr wcsrchr wcsstr

Name

.text

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

fothk

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

504B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

976B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

744B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$RESOURCES/AACGUARD/AACGUARD/wpfgfx_cor3.dll

IMPHASH a7a4bc1cfd4ccd11a03308e5252f02e0
SHA256 ad1c9dbbc2fcc2b274145727e8f04d5adf49a0c9ae4d1a3c33ec969fcd5b4bf1
MD5 b6eebb14edb8b16eb982a731331c759a
SHA1 50c20f74d0e075f30918a59e645edc7d3a7482e3
SHA512 53063c0877430d5f4e730d032a298f61d4591ba0dba4c13765e461489853685aba74244a622f1adf34752b0e677333a2eeff0367f8f479ddb435b7a45ab83a44
SSDEEP 24576:VyRODwFC9CCgNeccEi/aRmE6xdyo2QL5pbhAj7twvEebfaL6kKaij+pblyfU:RwkUNNeco/auxZLPFAjGvEebSL6hhRM
TLSH
T1C6954A4AB6AC40E9D07AE33CD9D7861BF63178151761A3CF23A4479E6F27BD0097A360
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

f9:83:5a:b6:65:06:c6:47:b3:cb:6a:bf:60:8b:85:33:33:86:47:1d:b3:52:83:ce:47:80:b2:d6:c9:2f:5f:32

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 4, 2026

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

334976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\src\wpf\artifacts\bin\wpfgfx\x64\Release\wpfgfx_cor3.pdb

kernel32

WaitForSingleObject CloseHandle CreateEventW CreateThread GetCurrentThreadId ResetEvent TryEnterCriticalSection MulDiv QueryPerformanceCounter Sleep FindResourceW LoadResource LockResource GlobalUnlock QueryPerformanceFrequency InitializeSListHead InterlockedPushEntrySList QueryDepthSList InterlockedFlushSList SleepEx RtlCaptureStackBackTrace IsDebuggerPresent ExitProcess GetProcessHeap HeapAlloc HeapFree HeapReAlloc TerminateThread GetCurrentThread GetCurrentProcessId SetThreadPriority LoadLibraryExW TryAcquireSRWLockExclusive GetLocaleInfoEx LocalFree FormatMessageA GetSystemTimeAsFileTime SleepConditionVariableSRW WakeAllConditionVariable FindClose FindFirstFileW GetSystemDirectoryW SystemTimeToFileTime LoadLibraryA LoadLibraryExA DebugBreak GetModuleFileNameW FreeLibrary OutputDebugStringW LoadLibraryW LeaveCriticalSection GetVersionExW SetEvent EnterCriticalSection DeleteCriticalSection SetLastError InitializeCriticalSectionAndSpinCount GetLastError DisableThreadLibraryCalls IsProcessorFeaturePresent AcquireSRWLockExclusive ReleaseSRWLockExclusive TlsFree TlsSetValue TlsGetValue TlsAlloc RaiseException EncodePointer VirtualQuery VerSetConditionMask VirtualAlloc VirtualFree TerminateProcess GetCurrentProcess CreateFileMappingW MapViewOfFile UnmapViewOfFile SizeofResource GetTickCount WaitForMultipleObjects SetUnhandledExceptionFilter UnhandledExceptionFilter GetSystemInfo GetModuleHandleW GetProcAddress VirtualProtect

advapi32

UnregisterTraceGuids RegQueryValueExW RegCloseKey AllocateLocallyUniqueId RegisterTraceGuidsW GetTraceEnableLevel GetTraceEnableFlags GetTraceLoggerHandle TraceMessage TraceEvent RegOpenKeyExW

ntdll

DbgPrintEx RtlClearBits RtlFindClearBitsAndSet RtlSetBits RtlInitializeBitMap DbgPrompt RtlInterlockedFlushSList RtlCaptureContext NtQuerySystemInformation DbgBreakPoint RtlUnwindEx RtlLookupFunctionEntry RtlVirtualUnwind RtlPcToFileHeader

user32

SetLayeredWindowAttributes OffsetRect MonitorFromWindow SystemParametersInfoW EnumDisplaySettingsW GetWindowLongW ClientToScreen GetClientRect InvalidateRect GetWindowRect GetParent GetDC GetWindowDC ScreenToClient UpdateLayeredWindow IsWindow PeekMessageW TranslateMessage DispatchMessageW GetGuiResources MsgWaitForMultipleObjects WindowFromDC GetMonitorInfoW EnumDisplayMonitors EnumDisplayDevicesW ReleaseDC GetDesktopWindow IntersectRect RegisterWindowMessageW PostMessageW IsRectEmpty SetRect EqualRect

gdi32

SetLayout CreateCompatibleDC RealizePalette GetRandomRgn SelectPalette CreatePalette GetSystemPaletteEntries GetDIBits OffsetRgn GetRgnBox SetRectRgn CreateRectRgn GetRegionData RectInRegion CombineRgn CreateRectRgnIndirect SelectObject CreateDIBSection DeleteObject CreateICW GetDeviceCaps DeleteDC BitBlt CreateCompatibleBitmap

ole32

CoInitialize CoCreateInstance PropVariantClear CoTaskMemAlloc PropVariantCopy CoTaskMemFree CoUninitialize

oleaut32

SysAllocString VariantInit VariantClear SysFreeString

d3dcompiler_47_cor3

D3DCompile

api-ms-win-crt-runtime-l1-1-0

_invoke_watson abort terminate _cexit _crt_atexit _seh_filter_dll _configure_narrow_argv _initterm _initialize_onexit_table _register_onexit_function _execute_onexit_table _initialize_narrow_environment _initterm_e

api-ms-win-crt-convert-l1-1-0

_wtoi

api-ms-win-crt-math-l1-1-0

exp cosf _isnan _finite modf fmod cos floorf pow fmodf logf _copysign ceilf atan2f tan sin sinf sqrt sqrtf nextafterf floor

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf

api-ms-win-crt-heap-l1-1-0

malloc free calloc

api-ms-win-crt-string-l1-1-0

strlen strcpy_s wcsncmp strcmp

api-ms-win-crt-utility-l1-1-0

qsort

GetNextPerfElementId IWICColorContext_GetExifColorSpace_Proxy IWICColorContext_GetProfileBytes_Proxy IWICColorContext_GetType_Proxy InteropDeviceBitmap_AddDirtyRect InteropDeviceBitmap_Create InteropDeviceBitmap_Detach InteropDeviceBitmap_GetAsSoftwareBitmap MIL3DCalcProjected2DBounds MILAddRef MILCreateEventProxy MILCreateFactory MILCreateStreamFromStreamDescriptor MILFactoryCreateBitmapRenderTarget MILFactoryCreateMediaPlayer MILFactoryCreateSWRenderTargetForBitmap MILIStreamWrite MILLoadResource MILMediaCanPause MILMediaClose MILMediaGetBufferingProgress MILMediaGetDownloadProgress MILMediaGetMediaLength MILMediaGetNaturalHeight MILMediaGetNaturalWidth MILMediaGetPosition MILMediaHasAudio MILMediaHasVideo MILMediaIsBuffering MILMediaNeedUIFrameUpdate MILMediaOpen MILMediaProcessExitHandler MILMediaSetBalance MILMediaSetIsScrubbingEnabled MILMediaSetPosition MILMediaSetRate MILMediaSetVolume MILMediaShutdown MILMediaStop MILQueryInterface MILRelease MILRenderTargetBitmapClear MILRenderTargetBitmapGetBitmap MILSwDoubleBufferedBitmapAddDirtyRect MILSwDoubleBufferedBitmapCreate MILSwDoubleBufferedBitmapGetBackBuffer MILSwDoubleBufferedBitmapProtectBackBuffer MILUpdateSystemParametersInfo MilChannel_AppendCommandData MilChannel_BeginCommand MilChannel_CloseBatch MilChannel_CommitChannel MilChannel_EndCommand MilChannel_GetMarshalType MilChannel_SetNotificationWindow MilChannel_SetReceiveBroadcastMessages MilCompositionEngine_DeinitializePartitionManager MilCompositionEngine_EnterCompositionEngineLock MilCompositionEngine_ExitCompositionEngineLock MilCompositionEngine_GetComposedEventId MilCompositionEngine_InitializePartitionManager MilCompositionEngine_UpdateSchedulerSettings MilComposition_PeekNextMessage MilComposition_SyncFlush MilComposition_WaitForNextMessage MilConnection_CreateChannel MilConnection_DestroyChannel MilContent_AttachToHwnd MilContent_DetachFromHwnd MilGlyphRun_GetGlyphOutline MilGlyphRun_ReleasePathGeometryData MilPlayer_Create MilPlayer_Process MilResource_CreateCWICWrapperBitmap MilResource_CreateOrAddRefOnChannel MilResource_DuplicateHandle MilResource_GetRefCountOnChannel MilResource_ReleaseOnChannel MilResource_SendCommand MilResource_SendCommandBitmapSource MilResource_SendCommandMedia MilUtility_ArcToBezier MilUtility_CopyPixelBuffer MilUtility_GeometryGetArea MilUtility_GetPointAtLengthFraction MilUtility_GetTileBrushMapping MilUtility_PathGeometryBounds MilUtility_PathGeometryCombine MilUtility_PathGeometryFlatten MilUtility_PathGeometryHitTest MilUtility_PathGeometryHitTestPathGeometry MilUtility_PathGeometryOutline MilUtility_PathGeometryWiden MilUtility_PolygonBounds MilUtility_PolygonHitTest MilVersionCheck MilVisualTarget_AttachToHwnd MilVisualTarget_DetachFromHwnd RenderOptions_EnableHardwareAccelerationInRdp RenderOptions_ForceSoftwareRenderingModeForProcess RenderOptions_IsSoftwareRenderingForcedForProcess SetMilPerfInstrumentationFlags WgxConnection_Create WgxConnection_Disconnect WgxConnection_SameThreadPresent WgxConnection_ShouldForceSoftwareForGraphicsStreamClient WpfGfx_SetDisableBoundsCheckProtection

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

347KB

Virtual Size

346KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

29KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

83KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

AACGUARD-v0.0.13-b02.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-wizard.bmp

$RESOURCES/AACGUARD/AACGUARD/AAC.exe

kernel32

advapi32

ole32

oleaut32

user32

shell32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic

$RESOURCES/AACGUARD/AACGUARD/AAC.pdb

$RESOURCES/AACGUARD/AACGUARD/D3DCompiler_47_cor3.dll

kernel32

advapi32

rpcrt4

generic

$RESOURCES/AACGUARD/AACGUARD/PenImc_cor3.dll

kernel32

user32

advapi32

shell32

ole32

oleaut32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

rpcrt4

generic

$RESOURCES/AACGUARD/AACGUARD/PresentationNative_cor3.dll

kernel32

ntdll

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

user32