ApeXArts Recursive Renames 1.4.0 — exact final Windows static review

Executable SHA-256:
 f0645bc9d17f4cf96bd1ab5db17ff39ae39235e0a6aac4861d7d5f5d163836ca
Size: 1,853,440 bytes; AMD64 PE.
This evidence applies only to that executable. Earlier candidate results remain
outside this review directory. This static pass did not upload or execute the
application, change its source, rebuild it, or install any tools.

PE observations (PE-REVIEW.json and PE-HEADERS-IMPORTS.txt):
 - ASLR, high-entropy ASLR and DEP/NX enabled.
 - No section is simultaneously writable and executable; no appended overlay.
 - Embedded certificate table size is zero: this executable is unsigned.
 - 215 named imports from the same 12 OS/compiler-runtime DLLs used by 1.3.0.
 - Checked keyboard-state polling/global-hook imports are absent.
 - No WinHTTP, WinINet, Winsock or URLMon network-client DLL import.
 - Relative to 1.3.0, 16 named imports were added and MessageBoxW was removed.
The additions support current-user SID/SDDL permissions, volume ACL-support and
alternate-stream checks, creating/removing backup directories, streamed-file
seeks, snapshot-name time values, Unicode path comparison and modal controls.
They correspond to the reviewed backup/privacy and native-dialog source paths.
Import absence is a focused static observation, not proof of all possible runtime
behavior. OS access to user-selected UNC/mapped filesystem paths can use networking.

Local static CAPA evidence:
 - Official flare-capa 10.0.0, VivisectFeatureExtractor, Vivisect 1.3.2.
 - Tool tag commit: 85813ebc5b99ccdbe43147e46796d0bd6700f30a.
 - Rules commit: 805f9eaccfb6a4e1ddffc809d71d1e2b5ccc15e5.
 - Signatures from that same tool commit; signature tree:
   5f5496e3f80872e4f07f9b2e3a5c6b2ca046a7a4.
 - Full analyst versions are retained in CAPA-PYTHON-ENVIRONMENT.txt.
 - Analysis uses no network permission, a 180-second limit, and a temporary cache.
The pass completed successfully with 37 total rule matches (including library
rules); 'log keystrokes via polling' did not match. No analysis errors were emitted.
Full results, exact current match addresses and label comparisons are recorded in
CAPA-10.0.0-RESULT.json and CAPA-SUMMARY.json. Static capability labels describe
matched patterns, not proof that a named behavior executed. Earlier releases' and
candidates' address/argument/symbol attributions are not transferred to this
executable. No new symbol build or broad capability attribution was performed.

Backup security validation boundary:
The reviewed source requests a protected current-user-only inheritable DACL at
atomic Windows container creation. Backup children retain private inherited ACLs;
source DACLs are not copied onto them. Source and readback identities are checked,
source bytes are streamed and compared, and Apply revalidates the preview after
backup before creating source-side transaction files.

Separate Wine GUI testing reported no broad Everyone/Users grants on the private
backup copies, but Wine adds SYSTEM and does not round-trip the protected-DACL
flag even on a controlled source fixture. That emulation cannot certify native
Windows ACL enforcement. The backup boundary requires an idle source/destination
and does not guarantee protection against every concurrent or privileged actor.

Limits:
This is local static PE/CAPA evidence, not a fresh VirusTotal scan, antivirus
clearance, vendor reclassification, behavioral sandbox report, or a guarantee of
no vulnerabilities. Previously reported vendor antivirus verdicts remain
unresolved; no vendor approval or signing identity was obtained. VirusTotal's
CAPA/rule versions are unknown and can differ from these pinned local versions.
No external sample submission or vendor contact occurred. Analyst tools remain
under /tmp, separate from the dependency-free application.
