{"Id":"394f49b2-2d78-4d0d-b374-1399695455f3","Tags":["Afd.sys"],"Verified":"TRUE","Author":"Nasreddine Bencherchali","Created":"2024-08-21","MitreID":"T1068","CVE":["CVE-2023-21768","CVE-2026-68820"],"Category":"vulnerable driver","Commands":{"Command":"sc.exe create Afd.sys binPath=C:\\windows\\temp\\Afd.sys type=kernel && sc.exe start Afd.sys","Description":"Windows Ancillary Function Driver (Afd.sys) for WinSock is vulnerable to an Elevation of Privilege Vulnerability.","Usecase":"Elevate privileges","Privileges":"kernel","OperatingSystem":"Windows 10"},"Resources":["https://securityintelligence.com/x-force/patch-tuesday-exploit-wednesday-pwning-windows-ancillary-function-driver-winsock/","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21768","https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/"],"Detection":[],"Acknowledgement":{"Person":"","Handle":""},"KnownVulnerableSamples":[{"Filename":"Afd.sys","Libraries":["ntoskrnl.exe","TDI.SYS","NETIO.SYS","msrpc.sys"],"ImportedFunctions":["RtlEqualUnicodeString","RtlPrefixUnicodeString","RtlAppendUnicodeToString","FsRtlAllocateExtraCreateParameterList","FsRtlAllocateExtraCreateParameter","FsRtlFreeExtraCreateParameterList","FsRtlInsertExtraCreateParameter","IoSetTopLevelIrp","IoCreateFileEx","ObOpenObjectByPointer","ZwClose","ObDereferenceSecurityDescriptor","RtlCompareMemory","ExEnterCriticalRegionAndAcquireResourceShared","KeInitializeEvent","KeWaitForSingleObject","KeResetEvent","PsChargeProcessPoolQuota","PsReturnPoolQuota","IoCreateFile","IoFreeIrp","KeGetCurrentProcessorNumberEx","EtwWriteTransfer","EtwActivityIdControl","ExInitializeRundownProtection","KfRaiseIrql","KeReleaseInStackQueuedSpinLockFromDpcLevel","KeLowerIrql","KeGetCurrentIrql","RtlCompareUnicodeString","ExReleaseResourceLite","ExAcquireResourceExclusiveLite","ExAllocatePool3","RtlCopyUnicodeString","ExAllocatePoolWithTagPriority","MmSizeOfMdl","ExRaiseStatus","IoInitializeIrp","MmBuildMdlForNonPagedPool","IoAllocateErrorLogEntry","_vsnwprintf","PsGetProcessId","IoWriteErrorLogEntry","PsGetProcessExitTime","KeEnterCriticalRegion","ExWaitForRundownProtectionRelease","KeLeaveCriticalRegion","IoSetIoCompletion","ExDeleteResourceLite","RtlInitString","RtlEqualString","IoGetFileObjectGenericMapping","RtlMapGenericMask","SeLockSubjectContext","SeAccessCheck","SeAppendPrivileges","SeFreePrivileges","SeUnlockSubjectContext","SeAssignSecurity","ObLogSecurityDescriptor","KeSetEvent","IoBuildDeviceIoControlRequest","IoAllocateIrp","ExEventObjectType","ProbeForWrite","ExGetPreviousMode","ExRaiseAccessViolation","ExInitializeResourceLite","EtwSetInformation","EtwRegister","MmIsVerifierEnabled","IoCreateDevice","IoAllocateWorkItem","ExInitializeNPagedLookasideList","KeQueryMaximumProcessorCountEx","ExDeleteNPagedLookasideList","ExDeleteLookasideListEx","IoFreeWorkItem","IoDeleteDevice","EtwUnregister","ExUnregisterCallback","IoOpenDriverRegistryKey","ExSubscribeWnfStateChange","ZwQueryValueKey","RtlLengthSid","SeExports","RtlCreateAcl","RtlAddAccessAllowedAce","ObGetObjectSecurity","RtlSetDaclSecurityDescriptor","RtlLengthSecurityDescriptor","SeSetSecurityDescriptorInfo","ObReleaseObjectSecurity","ZwNotifyChangeKey","IoQueueWorkItem","FsRtlFindExtraCreateParameter","PsLookupProcessByProcessId","ObCloseHandle","SeCreateAccessState","SeDeleteAccessState","SeQuerySecurityDescriptorInfo","KeReadStateEvent","KeEnterGuardedRegion","KeLeaveGuardedRegion","KePulseEvent","KeAcquireQueuedSpinLock","KeReleaseQueuedSpinLock","MmAdvanceMdl","KeBugCheckEx","ExpInterlockedFlushSList","ExSystemTimeToLocalTime","RtlTimeToTimeFields","KeInitializeDpc","KeInitializeTimer","KeSetCoalescableTimer","strrchr","KeAcquireSpinLockAtDpcLevel","KeReleaseSpinLockFromDpcLevel","KeInitializeTimerEx","KeFlushQueuedDpcs","IoCompletionObjectType","ExAcquireRundownProtection","IoInitializeMiniCompletionPacket","ExReleaseRundownProtection","IoRemoveIoCompletion","IoCancelMiniCompletionPacket","IoSetIoCompletionEx3","ExAcquireResourceSharedLite","ZwUpdateWnfStateData","PsRegisterSiloMonitor","PsStartSiloMonitor","PsUnregisterSiloMonitor","ExRundownCompleted","PsGetSiloIdentifier","PsCreateSiloContext","PsInsertPermanentSiloContext","PsGetSiloMonitorContextSlot","PsDereferenceSiloContext","PsGetPermanentSiloContext","PsAttachSiloToCurrentThread","PsDetachSiloFromCurrentThread","PsGetCurrentServerSilo","PsGetCurrentProcess","KeSetTimer","KeCancelTimer","IoQueryFileInformation","IoGetRequestorProcess","KeAttachProcess","FsRtlMdlRead","KeDetachProcess","FsRtlMdlReadComplete","IoCancelIrp","ExAllocateFromNPagedLookasideList","ExFreeToNPagedLookasideList","FsRtlCopyRead","MmLockPagableDataSection","IoThreadToProcess","MmSystemRangeStart","ObFindHandleForObject","KeTestSpinLock","RtlIntegerToUnicode","RtlAppendUnicodeStringToString","ObReferenceSecurityDescriptor","KeDelayExecutionThread","IoReuseIrp","IoWMIWriteEvent","IoGetDeviceAttachmentBaseRef","IoFreeErrorLogEntry","ZwCreateEvent","KeWaitForMultipleObjects","ExReleaseResourceForThreadLite","ObfDereferenceObjectWithTag","ObfReferenceObjectWithTag","PsReferenceImpersonationToken","PsDereferenceImpersonationToken","PsReferenceSiloContext","PsGetProcessImageFileName","IoSizeofWorkItem","IoInitializeWorkItem","IoSetIoCompletionEx","MmGetSystemRoutineAddress","IoWMIRegistrationControl","MmLockPagableSectionByHandle","MmUnlockPagableImageSection","WmiTraceMessageVa","IoGetTopLevelIrp","ExReleaseResourceAndLeaveCriticalRegion","ExRegisterCallback","ExEnterCriticalRegionAndAcquireResourceExclusive","ExCreateCallback","RtlInitUnicodeString","RtlCreateSecurityDescriptor","MmIsThisAnNtAsSystem","RtlGetVersion","KeGetRecommendedSharedDataAlignment","InitializeSListHead","KeInitializeSpinLock","ExpInterlockedPopEntrySList","MmMapLockedPages","MmMapLockedPagesSpecifyCache","ExQueueWorkItem","KeInsertQueueApc","KeInitializeApc","IoGetRelatedDeviceObject","IoBuildPartialMdl","IoFreeMdl","MmUnlockPages","ExpInterlockedPushEntrySList","ExQueryDepthSList","ObfReferenceObject","MmProbeAndLockPages","IoAllocateMdl","ExRaiseDatatypeMisalignment","MmUserProbeAddress","IoReleaseCancelSpinLock","KeAcquireInStackQueuedSpinLockAtDpcLevel","IofCompleteRequest","ObfDereferenceObject","IofCallDriver","IoAcquireCancelSpinLock","KeAcquireSpinLockRaiseToDpc","ExInitializeLookasideListEx","ExAllocateFromLookasideListEx","KeReleaseSpinLock","ExFreeToLookasideListEx","KeReleaseInStackQueuedSpinLock","KeAcquireInStackQueuedSpinLock","IoFileObjectType","ObReferenceObjectByHandle","PsGetCurrentProcessId","ExFreePoolWithTag","ExAllocatePool2","PsRevertToSelf","SeImpersonateClientEx","SeCaptureSubjectContextEx","SeReleaseSubjectContext","SeDeleteClientSecurity","SeCreateClientSecurityFromSubjectContext","IoGetCurrentProcess","EtwWrite","IoIs32bitProcess","__C_specific_handler","PcwUnregister","PcwAddInstance","ExQueryWnfStateData","PcwRegister","TdiCopyMdlToBuffer","TdiReturnChainedReceives","TdiRegisterPnPHandlers","TdiDeregisterPnPHandlers","TdiMatchPdoWithChainedReceiveContext","TdiCopyBufferToMdl","NsiGetAllParameters","NetioNrtIsTrackerDevice","NetioNrtDispatch","NetioSetTriageBlock","NetioNrtStart","NetioTimerWorkItemInitialize","NetioTimerWorkItemStart","NetioTimerWorkItemShutdown","NetioNrtStop","RtlCopyMdlToBuffer","NetioInsertWorkQueue","NetioShutdownWorkQueue","NetioInitializeWorkQueue","NmrProviderDetachClientComplete","NmrWaitForProviderDeregisterComplete","NmrDeregisterProvider","NmrRegisterProvider","NmrClientAttachProvider","NmrClientDetachProviderComplete","NmrWaitForClientDeregisterComplete","NmrDeregisterClient","NmrRegisterClient","GetDefaultCompartmentId","NsiFreeTable","NsiAllocateAndGetTable","NsiRegisterChangeNotificationEx","NsiDeregisterChangeNotification","NsiRegisterChangeNotification","RtlCopyMdlToMdl","RtlCleanupTimerWheelEntry","RtlIndicateTimerWheelEntryTimerStart","RtlInitializeTimerWheelEntry","RtlCleanupTimerWheel","RtlSuspendTimerWheel","RtlInitializeTimerWheel","RtlReturnTimerWheelEntry","RtlGetNextExpiredTimerWheelEntry","RtlUpdateCurrentTimerWheelTick","RpcBindingFree","RpcExceptionFilter","RpcAsyncCompleteCall","RpcBindingBind","RpcBindingSetOption","RpcAsyncInitializeHandle","RpcBindingCreateW","RpcAsyncCancelCall","RpcBindingUnbind","Ndr64AsyncClientCall"],"ExportedFunctions":"","MD5":"e2db558c3996bb34fbf21017f0ce5591","SHA1":"52e287860e0459362e4b655a75795e260eae2964","SHA256":"ebf6be42d39fd5d9361afa43479f883ff8eba97d72f313ece289f78cb51c22f2","Imphash":"b74b53dd1f82c21aab079d727e517ba4","Machine":"AMD64","MagicHeader":"50 45 0 0","CreationTimestamp":"2088-03-13 19:12:25","RichPEHeaderMD5":"65835e7484a7491a762f63b77a6bb191","RichPEHeaderSHA1":"640b40f4d807a33bd8aafa91488fe88bb7cbf382","RichPEHeaderSHA256":"2b22c51196bbb1e4bad252dd6aefaa37e413e8a397d89a3d73b033d8b1e76e88","AuthentihashMD5":"6775bbd47a793d793bcaf0b114b242da","AuthentihashSHA1":"fb0b5d98d1add03004d612831b67353df994a189","AuthentihashSHA256":"a490a57a8f57ae27571629197bb652b0f4c84f9414d09bf6cfe2ee1b175101b4","Sections":{".text":{"Entropy":6.316555704432483,"Virtual Size":"0x4d0e6"},".rdata":{"Entropy":5.477393112040447,"Virtual Size":"0x94e8"},".data":{"Entropy":0.6141306370347898,"Virtual Size":"0xcf0"},".pdata":{"Entropy":5.846676127633439,"Virtual Size":"0x4698"},".idata":{"Entropy":5.014037562551299,"Virtual Size":"0x3086"},"PAGE":{"Entropy":6.278431157168689,"Virtual Size":"0x15c6d"},"PAGEWPP":{"Entropy":5.59045803315903,"Virtual Size":"0x1553"},"PAGESAN":{"Entropy":6.19826528683712,"Virtual Size":"0x461d"},"PAGEWTDI":{"Entropy":6.15544235827631,"Virtual Size":"0x4794"},"fothk":{"Entropy":0.016408464515625623,"Virtual Size":"0x1000"},"PAGEDATA":{"Entropy":3.2533044869654537,"Virtual Size":"0x160"},"INIT":{"Entropy":6.16543195902687,"Virtual Size":"0x1cdc"},"GFIDS":{"Entropy":5.200018479184247,"Virtual Size":"0x614"},".rsrc":{"Entropy":3.920644350753675,"Virtual Size":"0x18d48"},".reloc":{"Entropy":6.0833725224091895,"Virtual Size":"0x4aec"}},"CompanyName":"Microsoft Corporation","FileDescription":"Ancillary Function Driver for WinSock","InternalName":"afd.sys","OriginalFilename":"afd.sys","FileVersion":"10.0.22621.1105 (WinBuild.160101.0800)","ProductName":"Microsoft® Windows® Operating System","LegalCopyright":"© Microsoft Corporation. All rights reserved.","ProductVersion":"10.0.22621.1105","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows","ValidFrom":"2022-05-05 19:23:13","ValidTo":"2023-05-04 19:23:13","Signature":"d9767f52fe0a5596caefe5ab5176340309d5b90d6f25bed7eadb6299aa0c493b6b6e6de70b34bb54c32174f7a90c63b50b063b4289debf28efcea6e292bee015a7a28ed76c0c70271c8229d968d42dca5081bc104a2afe79587897dfc10d5c39ce4826e0cdcc940228765eebf20e36706932db4fc99abb40daeb888c07e72428fc9563ef319802edfdb93fa4a7b92b6533f59bb82e7996af2f0c2975a150674652cb008867f5259fb37cffc549316ee2edd4ecf80e1cb26fd1233d0e9df4a54111dbd3806c16307465bede1fb0cfc12afaa53fec3acf934819d6faee9d9d8de2af1cc283a5d6dd43ebd913e93aefe7a4f931bee26f858817a7d154d45e6d378e","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"330000038b7945c18b0eb687ec00000000038b","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"3571fe0895d4e042d281b85ee58b8094","SHA1":"92770617b04ed48f52556dbbd37302ffee4405b5","SHA256":"eb87b3c06bb677f315d42aae1a9b33c4e0bc04467f812af5224b9ae88ef8ca25","SHA384":"c69afe0ab751676ab08b29d2dc26744375c2b0058dcba2020816571a59a0dd44bbcd50c829eb04bd9553482231c49991"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Production PCA 2011","ValidFrom":"2011-10-19 18:41:42","ValidTo":"2026-10-19 18:51:42","Signature":"14fc7c7151a579c26eb2ef393ebc3c520f6e2b3f101373fea868d048a6344d8a960526ee3146906179d6ff382e456bf4c0e528b8da1d8f8adb09d71ac74c0a36666a8cec1bd70490a81817a49bb9e240323676c4c15ac6bfe404c0ea16d3acc368ef62acdd546c503058a6eb7cfe94a74e8ef4ec7c867357c2522173345af3a38a56c804da0709edf88be3cef47e8eaef0f60b8a08fb3fc91d727f53b8ebbe63e0e33d3165b081e5f2accd16a49f3da8b19bc242d090845f541dff89eaba1d47906fb0734e419f409f5fe5a12ab21191738a2128f0cede73395f3eab5c60ecdf0310a8d309e9f4f69685b67f51886647198da2b0123d812a680577bb914c627bb6c107c7ba7a8734030e4b627a99e9cafcce4a37c92da4577c1cfe3ddcb80f5afad6c4b30285023aeab3d96ee4692137de81d1f675190567d393575e291b39c8ee2de1cde445735bd0d2ce7aab1619824658d05e9d81b367af6c35f2bce53f24e235a20a7506f6185699d4782cd1051bebd088019daa10f105dfba7e2c63b7069b2321c4f9786ce2581706362b911203cca4d9f22dbaf9949d40ed1845f1ce8a5c6b3eab03d370182a0a6ae05f47d1d5630a32f2afd7361f2a705ae5425908714b57ba7e8381f0213cf41cc1c5b990930e88459386e9b12099be98cbc595a45d62d6a0630820bd7510777d3df345b99f979fcb57806f33a904cf77a4621c597e","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"61077656000000000008","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"30a3f0b64324ed7f465e7fc618cb69e7","SHA1":"002de3561519b662c5e3f5faba1b92c403fb7c41","SHA256":"4e80be107c860de896384b3eff50504dc2d76ac7151df3102a4450637a032146","SHA384":"4f9a02c3eac5e83c38074d54c0bf270e03a1d668e0001c9812c509eb08a19075ee778a7630e65598e4608fc66e2d1c66"}}],"Signer":[{"SerialNumber":"330000038b7945c18b0eb687ec00000000038b","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Production PCA 2011","Version":1}]}],"LoadsDespiteHVCI":"TRUE","Authentihash":{"MD5":"6775bbd47a793d793bcaf0b114b242da","SHA1":"fb0b5d98d1add03004d612831b67353df994a189","SHA256":"a490a57a8f57ae27571629197bb652b0f4c84f9414d09bf6cfe2ee1b175101b4"},"RichPEHeaderHash":{"MD5":"65835e7484a7491a762f63b77a6bb191","SHA1":"640b40f4d807a33bd8aafa91488fe88bb7cbf382","SHA256":"2b22c51196bbb1e4bad252dd6aefaa37e413e8a397d89a3d73b033d8b1e76e88"},"Description":"Ancillary Function Driver for WinSock","Company":"Microsoft Corporation","Product":"Microsoft® Windows® Operating System","Copyright":"© Microsoft Corporation. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe","TDI.SYS","NETIO.SYS","msrpc.sys"]},{"Filename":"Afd.sys","Libraries":["ntoskrnl.exe","TDI.SYS","NETIO.SYS","msrpc.sys"],"ImportedFunctions":["RtlEqualUnicodeString","RtlPrefixUnicodeString","RtlAppendUnicodeToString","FsRtlAllocateExtraCreateParameterList","FsRtlAllocateExtraCreateParameter","FsRtlFreeExtraCreateParameterList","FsRtlInsertExtraCreateParameter","IoSetTopLevelIrp","IoCreateFileEx","ObOpenObjectByPointer","ZwClose","ObDereferenceSecurityDescriptor","RtlCompareMemory","ExEnterCriticalRegionAndAcquireResourceShared","KeInitializeEvent","KeWaitForSingleObject","KeResetEvent","PsChargeProcessPoolQuota","PsReturnPoolQuota","IoCreateFile","IoFreeIrp","KeGetCurrentProcessorNumberEx","EtwWriteTransfer","EtwActivityIdControl","ExInitializeRundownProtection","KfRaiseIrql","KeReleaseInStackQueuedSpinLockFromDpcLevel","KeLowerIrql","KeGetCurrentIrql","RtlCompareUnicodeString","ExReleaseResourceLite","ExAcquireResourceExclusiveLite","ExAllocatePool3","RtlCopyUnicodeString","ExAllocatePoolWithTagPriority","MmSizeOfMdl","ExRaiseStatus","IoInitializeIrp","MmBuildMdlForNonPagedPool","IoAllocateErrorLogEntry","_vsnwprintf","PsGetProcessId","IoWriteErrorLogEntry","PsGetProcessExitTime","KeEnterCriticalRegion","ExWaitForRundownProtectionRelease","KeLeaveCriticalRegion","IoSetIoCompletion","ExDeleteResourceLite","RtlInitString","RtlEqualString","IoGetFileObjectGenericMapping","RtlMapGenericMask","SeLockSubjectContext","SeAccessCheck","SeAppendPrivileges","SeFreePrivileges","SeUnlockSubjectContext","SeAssignSecurity","ObLogSecurityDescriptor","KeSetEvent","IoBuildDeviceIoControlRequest","IoAllocateIrp","ExEventObjectType","ProbeForWrite","ExGetPreviousMode","ExRaiseAccessViolation","ExInitializeResourceLite","EtwSetInformation","EtwRegister","MmIsVerifierEnabled","IoCreateDevice","IoAllocateWorkItem","ExInitializeNPagedLookasideList","KeQueryMaximumProcessorCountEx","ExDeleteNPagedLookasideList","ExDeleteLookasideListEx","IoFreeWorkItem","IoDeleteDevice","EtwUnregister","ExUnregisterCallback","IoOpenDriverRegistryKey","ExSubscribeWnfStateChange","ZwQueryValueKey","RtlLengthSid","SeExports","RtlCreateAcl","RtlAddAccessAllowedAce","ObGetObjectSecurity","RtlSetDaclSecurityDescriptor","RtlLengthSecurityDescriptor","SeSetSecurityDescriptorInfo","ObReleaseObjectSecurity","ZwNotifyChangeKey","IoQueueWorkItem","FsRtlFindExtraCreateParameter","PsLookupProcessByProcessId","ObCloseHandle","SeCreateAccessState","SeDeleteAccessState","SeQuerySecurityDescriptorInfo","KeReadStateEvent","KeEnterGuardedRegion","KeLeaveGuardedRegion","KePulseEvent","KeAcquireQueuedSpinLock","KeReleaseQueuedSpinLock","MmAdvanceMdl","KeBugCheckEx","ExpInterlockedFlushSList","ExSystemTimeToLocalTime","RtlTimeToTimeFields","KeInitializeDpc","KeInitializeTimer","KeSetCoalescableTimer","strrchr","KeAcquireSpinLockAtDpcLevel","KeReleaseSpinLockFromDpcLevel","KeInitializeTimerEx","KeFlushQueuedDpcs","IoCompletionObjectType","ExAcquireRundownProtection","IoInitializeMiniCompletionPacket","ExReleaseRundownProtection","IoRemoveIoCompletion","IoCancelMiniCompletionPacket","IoSetIoCompletionEx3","ExAcquireResourceSharedLite","ZwUpdateWnfStateData","PsRegisterSiloMonitor","PsStartSiloMonitor","PsUnregisterSiloMonitor","ExRundownCompleted","PsGetSiloIdentifier","PsCreateSiloContext","PsInsertPermanentSiloContext","PsGetSiloMonitorContextSlot","PsDereferenceSiloContext","PsGetPermanentSiloContext","PsAttachSiloToCurrentThread","PsDetachSiloFromCurrentThread","PsGetCurrentServerSilo","PsGetCurrentProcess","KeSetTimer","KeCancelTimer","IoQueryFileInformation","IoGetRequestorProcess","KeAttachProcess","FsRtlMdlRead","KeDetachProcess","FsRtlMdlReadComplete","IoCancelIrp","ExAllocateFromNPagedLookasideList","ExFreeToNPagedLookasideList","FsRtlCopyRead","MmLockPagableDataSection","IoThreadToProcess","MmSystemRangeStart","ObFindHandleForObject","KeTestSpinLock","RtlIntegerToUnicode","RtlAppendUnicodeStringToString","ObReferenceSecurityDescriptor","KeDelayExecutionThread","IoReuseIrp","IoWMIWriteEvent","IoGetDeviceAttachmentBaseRef","IoFreeErrorLogEntry","ZwCreateEvent","KeWaitForMultipleObjects","ExReleaseResourceForThreadLite","ObfDereferenceObjectWithTag","ObfReferenceObjectWithTag","PsReferenceImpersonationToken","PsDereferenceImpersonationToken","PsReferenceSiloContext","PsGetProcessImageFileName","IoSizeofWorkItem","IoInitializeWorkItem","IoSetIoCompletionEx","MmGetSystemRoutineAddress","IoWMIRegistrationControl","MmLockPagableSectionByHandle","MmUnlockPagableImageSection","WmiTraceMessageVa","IoGetTopLevelIrp","ExReleaseResourceAndLeaveCriticalRegion","ExRegisterCallback","ExEnterCriticalRegionAndAcquireResourceExclusive","ExCreateCallback","RtlInitUnicodeString","RtlCreateSecurityDescriptor","MmIsThisAnNtAsSystem","RtlGetVersion","KeGetRecommendedSharedDataAlignment","InitializeSListHead","KeInitializeSpinLock","ExpInterlockedPopEntrySList","MmMapLockedPages","MmMapLockedPagesSpecifyCache","ExQueueWorkItem","KeInsertQueueApc","KeInitializeApc","IoGetRelatedDeviceObject","IoBuildPartialMdl","IoFreeMdl","MmUnlockPages","ExpInterlockedPushEntrySList","ExQueryDepthSList","ObfReferenceObject","MmProbeAndLockPages","IoAllocateMdl","ExRaiseDatatypeMisalignment","MmUserProbeAddress","IoReleaseCancelSpinLock","KeAcquireInStackQueuedSpinLockAtDpcLevel","IofCompleteRequest","ObfDereferenceObject","IofCallDriver","IoAcquireCancelSpinLock","KeAcquireSpinLockRaiseToDpc","ExInitializeLookasideListEx","ExAllocateFromLookasideListEx","KeReleaseSpinLock","ExFreeToLookasideListEx","KeReleaseInStackQueuedSpinLock","KeAcquireInStackQueuedSpinLock","IoFileObjectType","ObReferenceObjectByHandle","PsGetCurrentProcessId","ExFreePoolWithTag","ExAllocatePool2","PsRevertToSelf","SeImpersonateClientEx","SeCaptureSubjectContextEx","SeReleaseSubjectContext","SeDeleteClientSecurity","SeCreateClientSecurityFromSubjectContext","IoGetCurrentProcess","EtwWrite","IoIs32bitProcess","__C_specific_handler","PcwUnregister","PcwAddInstance","ExQueryWnfStateData","PcwRegister","TdiCopyMdlToBuffer","TdiReturnChainedReceives","TdiRegisterPnPHandlers","TdiDeregisterPnPHandlers","TdiMatchPdoWithChainedReceiveContext","TdiCopyBufferToMdl","NsiGetAllParameters","NetioNrtIsTrackerDevice","NetioNrtDispatch","NetioSetTriageBlock","NetioNrtStart","NetioTimerWorkItemInitialize","NetioTimerWorkItemStart","NetioTimerWorkItemShutdown","NetioNrtStop","RtlCopyMdlToBuffer","NetioInsertWorkQueue","NetioShutdownWorkQueue","NetioInitializeWorkQueue","NmrProviderDetachClientComplete","NmrWaitForProviderDeregisterComplete","NmrDeregisterProvider","NmrRegisterProvider","NmrClientAttachProvider","NmrClientDetachProviderComplete","NmrWaitForClientDeregisterComplete","NmrDeregisterClient","NmrRegisterClient","GetDefaultCompartmentId","NsiFreeTable","NsiAllocateAndGetTable","NsiRegisterChangeNotificationEx","NsiDeregisterChangeNotification","NsiRegisterChangeNotification","RtlCopyMdlToMdl","RtlCleanupTimerWheelEntry","RtlIndicateTimerWheelEntryTimerStart","RtlInitializeTimerWheelEntry","RtlCleanupTimerWheel","RtlSuspendTimerWheel","RtlInitializeTimerWheel","RtlReturnTimerWheelEntry","RtlGetNextExpiredTimerWheelEntry","RtlUpdateCurrentTimerWheelTick","RpcBindingFree","RpcExceptionFilter","RpcAsyncCompleteCall","RpcBindingBind","RpcBindingSetOption","RpcAsyncInitializeHandle","RpcBindingCreateW","RpcAsyncCancelCall","RpcBindingUnbind","Ndr64AsyncClientCall"],"ExportedFunctions":"","MD5":"d9afa784f62d5a2c282074c90f220e35","SHA1":"479120a6b5ef38787d6929b3b3edcd3a46d34bd8","SHA256":"95fd266cc454177901cb58f4d30417c4a7caf29be62bb8649e5b8fca58823600","Imphash":"b74b53dd1f82c21aab079d727e517ba4","Machine":"AMD64","MagicHeader":"50 45 0 0","CreationTimestamp":"1976-07-28 02:22:12","RichPEHeaderMD5":"65835e7484a7491a762f63b77a6bb191","RichPEHeaderSHA1":"640b40f4d807a33bd8aafa91488fe88bb7cbf382","RichPEHeaderSHA256":"2b22c51196bbb1e4bad252dd6aefaa37e413e8a397d89a3d73b033d8b1e76e88","AuthentihashMD5":"6c74f578d1222a9ab04e944b9cf7efbb","AuthentihashSHA1":"7aed7084ba413ec20e198af1e5d1c359e33ca87d","AuthentihashSHA256":"765869c7c04b49e77de313806398472ec90dce45206a6d71e448d4e2e499715d","Sections":{".text":{"Entropy":6.316633040898642,"Virtual Size":"0x4d0e6"},".rdata":{"Entropy":5.479093531078034,"Virtual Size":"0x94e8"},".data":{"Entropy":0.6157309963419519,"Virtual Size":"0xcf0"},".pdata":{"Entropy":5.848408209582979,"Virtual Size":"0x4698"},".idata":{"Entropy":5.014037562551299,"Virtual Size":"0x3086"},"PAGE":{"Entropy":6.278034103814104,"Virtual Size":"0x15c5d"},"PAGEWPP":{"Entropy":5.59045803315903,"Virtual Size":"0x1553"},"PAGESAN":{"Entropy":6.19777947232345,"Virtual Size":"0x461d"},"PAGEWTDI":{"Entropy":6.155752835196813,"Virtual Size":"0x4794"},"fothk":{"Entropy":0.016408464515625623,"Virtual Size":"0x1000"},"PAGEDATA":{"Entropy":3.2533044869654537,"Virtual Size":"0x160"},"INIT":{"Entropy":6.165581478271197,"Virtual Size":"0x1cdc"},"GFIDS":{"Entropy":5.207515500305649,"Virtual Size":"0x614"},".rsrc":{"Entropy":3.920675916540121,"Virtual Size":"0x18d48"},".reloc":{"Entropy":6.081621002877941,"Virtual Size":"0x4ae8"}},"CompanyName":"Microsoft Corporation","FileDescription":"Ancillary Function Driver for WinSock","InternalName":"afd.sys","OriginalFilename":"afd.sys","FileVersion":"10.0.22621.608 (WinBuild.160101.0800)","ProductName":"Microsoft® Windows® Operating System","LegalCopyright":"© Microsoft Corporation. All rights reserved.","ProductVersion":"10.0.22621.608","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows","ValidFrom":"2022-05-05 19:23:15","ValidTo":"2023-05-04 19:23:15","Signature":"7aa4402e28e909a6f7ff198a87c8f546fd868da5adf65529e8ced9b8ff16f56d03704671b64454a21437cdc6b47d83ea130e55b30ed223fda526676f6034a0d649e924cdf96d3c26386378d2ab91da329e3ddecbfe21c7f32764df6409a7f82f67c90ab5d9d7c167376487b3579fc1d99201098d2124f91f6558fb03285a49159fcc6d6ff6f8bbbc51f5209689963bebbc504c08089fa7c13e3bbae4f3c77a3a083548f8c95a1504b66fd5cfa658f9353ca231fd085e94f9bdb9bf68e302cae1bb6d483f97b5d4a2d26486fcab72ebe5fd0b555066edd3d894531f836130e309ccf4e98d1b44950efb0812a2190d4b0df3c5bf7ee8123a1d57410cd797dc0ccf","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"330000038db0bfe1b0ca33b3d400000000038d","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"74a1035aa6d38ec0a7a35a6d143cc612","SHA1":"62c5627f7d38759edce84eace5ae41fc7a54d6f8","SHA256":"b6319137740477c564fb2beb1d50929a333f092aa362ce5129085a2c9d4bf489","SHA384":"c1ae78e5eaf17704167b756f79d0b923e662fd113fbb2c593f3df8c0e1f92c8363ffb5d423f78a7a5494b01934eefea7"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Production PCA 2011","ValidFrom":"2011-10-19 18:41:42","ValidTo":"2026-10-19 18:51:42","Signature":"14fc7c7151a579c26eb2ef393ebc3c520f6e2b3f101373fea868d048a6344d8a960526ee3146906179d6ff382e456bf4c0e528b8da1d8f8adb09d71ac74c0a36666a8cec1bd70490a81817a49bb9e240323676c4c15ac6bfe404c0ea16d3acc368ef62acdd546c503058a6eb7cfe94a74e8ef4ec7c867357c2522173345af3a38a56c804da0709edf88be3cef47e8eaef0f60b8a08fb3fc91d727f53b8ebbe63e0e33d3165b081e5f2accd16a49f3da8b19bc242d090845f541dff89eaba1d47906fb0734e419f409f5fe5a12ab21191738a2128f0cede73395f3eab5c60ecdf0310a8d309e9f4f69685b67f51886647198da2b0123d812a680577bb914c627bb6c107c7ba7a8734030e4b627a99e9cafcce4a37c92da4577c1cfe3ddcb80f5afad6c4b30285023aeab3d96ee4692137de81d1f675190567d393575e291b39c8ee2de1cde445735bd0d2ce7aab1619824658d05e9d81b367af6c35f2bce53f24e235a20a7506f6185699d4782cd1051bebd088019daa10f105dfba7e2c63b7069b2321c4f9786ce2581706362b911203cca4d9f22dbaf9949d40ed1845f1ce8a5c6b3eab03d370182a0a6ae05f47d1d5630a32f2afd7361f2a705ae5425908714b57ba7e8381f0213cf41cc1c5b990930e88459386e9b12099be98cbc595a45d62d6a0630820bd7510777d3df345b99f979fcb57806f33a904cf77a4621c597e","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"61077656000000000008","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"30a3f0b64324ed7f465e7fc618cb69e7","SHA1":"002de3561519b662c5e3f5faba1b92c403fb7c41","SHA256":"4e80be107c860de896384b3eff50504dc2d76ac7151df3102a4450637a032146","SHA384":"4f9a02c3eac5e83c38074d54c0bf270e03a1d668e0001c9812c509eb08a19075ee778a7630e65598e4608fc66e2d1c66"}}],"Signer":[{"SerialNumber":"330000038db0bfe1b0ca33b3d400000000038d","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Production PCA 2011","Version":1}]}],"LoadsDespiteHVCI":"TRUE","Authentihash":{"MD5":"6c74f578d1222a9ab04e944b9cf7efbb","SHA1":"7aed7084ba413ec20e198af1e5d1c359e33ca87d","SHA256":"765869c7c04b49e77de313806398472ec90dce45206a6d71e448d4e2e499715d"},"RichPEHeaderHash":{"MD5":"65835e7484a7491a762f63b77a6bb191","SHA1":"640b40f4d807a33bd8aafa91488fe88bb7cbf382","SHA256":"2b22c51196bbb1e4bad252dd6aefaa37e413e8a397d89a3d73b033d8b1e76e88"},"Description":"Ancillary Function Driver for WinSock","Company":"Microsoft Corporation","Product":"Microsoft® Windows® Operating System","Copyright":"© Microsoft Corporation. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe","TDI.SYS","NETIO.SYS","msrpc.sys"]}]}