b5902737cff8946ebc43771a47eca5237b2c6cdc

Sharing

Copy URL

Twitter E-mail

General

Target

b5902737cff8946ebc43771a47eca5237b2c6cdc
Size

17.4MB
MD5

7b1c74e08d42757792cb935800da1e75
SHA1

b5902737cff8946ebc43771a47eca5237b2c6cdc
SHA256

4daaba19d412cdf3838a0c373cdc9b7cfc26423723307482e4b0f946909c726e
SHA512

821978f8ae4f5397813adde7a52f8e9a1791e78b7d33a6825e4e6576ae3d0ffd3fdfac8f05bfbc0d0c84813991097e7c2a15f98c7e4b8eee19696466440eac4b
SSDEEP

393216:xsCdwI+MshEZaynVkpk/7Q8BpuiiJKhMFUV28tP33+NM4:AASICshMFE28tvuNM4

Score

N/A

Malware Config

Signatures

Files

b5902737cff8946ebc43771a47eca5237b2c6cdc
.zip
OBS-project/OBS.zip
.zip
OBS/Configuration/About/UserDeviceRegistration.Ngc.dll
.dll windows x64

58add1a59f0b3955b5aa1b2a8eb503d1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_onexit
__dllonexit
memcmp
_unlock
_lock
__CxxFrameHandler3
__C_specific_handler
_initterm
malloc
_vsnwprintf
_amsg_exit
memcpy_s
wcsstr
_callnewh
_XcptFilter
free
_purecall
memset

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsGetStringLen
HSTRING_UserUnmarshal64
WindowsStringHasEmbeddedNull
WindowsCreateString
WindowsDuplicateString
WindowsCreateStringReference
WindowsConcatString
HSTRING_UserUnmarshal
HSTRING_UserMarshal64
WindowsGetStringRawBuffer
WindowsIsStringEmpty
HSTRING_UserSize
HSTRING_UserMarshal
HSTRING_UserFree64
HSTRING_UserSize64
HSTRING_UserFree

api-ms-win-core-com-l1-1-0

CoWaitForMultipleHandles
StringFromGUID2
CoCreateInstance
CoGetCallContext
CoGetCallerTID
CoCreateGuid
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW
GetRestrictedErrorInfo
SetRestrictedErrorInfo
RoOriginateError
RoTransformError

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseSemaphore
CreateMutexExW
CreateEventExW
InitializeSRWLock
CreateEventW
ReleaseMutex
WaitForSingleObject
CreateSemaphoreExW
SetEvent

rpcrt4

CStdStubBuffer_DebugServerRelease
UuidFromStringW
CStdStubBuffer_IsIIDSupported
RpcStringFreeW
UuidToStringW
IUnknown_Release_Proxy
UuidIsNil
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
NdrOleAllocate
NdrStubCall3
IUnknown_QueryInterface_Proxy
NdrStubForwardingFunction
CStdStubBuffer_Invoke
NdrDllCanUnloadNow
NdrCStdStubBuffer2_Release
NdrDllGetClassObject

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient20
ObjectStublessClient15
ObjectStublessClient23
CStdStubBuffer2_Disconnect
ObjectStublessClient24
ObjectStublessClient13
ObjectStublessClient18
CStdStubBuffer2_QueryInterface
ObjectStublessClient19
ObjectStublessClient22
CStdStubBuffer2_CountRefs
NdrProxyForwardingFunction4
NdrProxyForwardingFunction5
ObjectStublessClient6
ObjectStublessClient8
ObjectStublessClient9
ObjectStublessClient11
ObjectStublessClient26
ObjectStublessClient17
ObjectStublessClient10
CStdStubBuffer2_Connect
ObjectStublessClient14
ObjectStublessClient12
ObjectStublessClient7
ObjectStublessClient16
ObjectStublessClient25
ObjectStublessClient21
NdrProxyForwardingFunction3

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceExecuteOnce
SleepConditionVariableSRW
WakeAllConditionVariable

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetModuleFileNameA
GetProcAddress
GetModuleHandleW
LoadStringW
FreeLibrary

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
OpenProcessToken
OpenThreadToken
TerminateProcess
GetCurrentThread
GetProcessId
GetCurrentProcessId
GetCurrentProcess

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
RaiseException
GetLastError
SetUnhandledExceptionFilter
SetLastError

ntdll

LdrDisableThreadCalloutsForDll
RtlImageNtHeader

api-ms-win-security-base-l1-1-0

GetLengthSid
CopySid
GetTokenInformation

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWriteTransfer
EventRegister

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegCloseKey
RegCreateKeyExW

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

crypt32

CertFreeCertificateContext
CertVerifySubjectCertificateContext

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
RoReportFailedDelegate

api-ms-win-core-winrt-l1-1-0

RoUninitialize
RoGetActivationFactory
RoInitialize
RoActivateInstance

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-console-l3-2-0

GetConsoleWindow

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

twinapi.appcore

ord2
ord3

cryptngc

NgcGetUserIdKeyCertificate

webauthn

WebAuthNCtapResetDevice

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

winhttp

WinHttpCrackUrl

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 105KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/UserLanguageProfileCallback.dll
.dll windows x64

9fbb5428188490fcba695d25153e2fbc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

memcpy
malloc
memmove
_CxxThrowException
_XcptFilter
??1type_info@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_onexit
__dllonexit
??0exception@@QEAA@AEBQEBDH@Z
_unlock
__CxxFrameHandler3
_lock
_callnewh
_vsnprintf_s
__C_specific_handler
_initterm
free
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
_purecall
??3@YAXPEAX@Z
memcpy_s
_vsnwprintf
_amsg_exit
memset

api-ms-win-core-com-l1-1-0

CoCreateInstance

api-ms-win-core-synch-l1-1-0

CreateEventW
CreateMutexExW
ReleaseMutex
ReleaseSemaphore
OpenEventW
WaitForSingleObject
OpenSemaphoreW
CreateSemaphoreExW
WaitForSingleObjectEx

oleaut32

SysFreeString
SysAllocString
VariantClear

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetProcAddress
GetModuleFileNameA
GetModuleHandleExW

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceBeginInitialize
InitOnceComplete

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-winrt-string-l1-1-0

WindowsStringHasEmbeddedNull
WindowsGetStringRawBuffer
WindowsDeleteString

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventWriteTransfer
EventRegister
EventUnregister

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-winrt-l1-1-0

RoUninitialize
RoInitialize

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-security-capability-l1-1-0

CapabilityCheck

bcp47langs

GetUserLanguagesForUser
GetUserLanguages
GetSerializedUserLanguageProfile

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

OnUserProfileChanged

Sections

.text
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 464B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/UserMgrProxy.dll
.dll windows x64

9dc04c3e7ed68c06caaafe76e1c4a956

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
__C_specific_handler
?terminate@@YAXXZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBD@Z
_lock
_unlock
__CxxFrameHandler3
__dllonexit
??0exception@@QEAA@AEBQEBDH@Z
_onexit
_initterm
??1type_info@@UEAA@XZ
_vsnprintf_s
malloc
memcmp
_XcptFilter
?what@exception@@UEBAPEBDXZ
_purecall
??3@YAXPEAX@Z
free
_callnewh
wcschr
_set_errno
_get_errno
_vscwprintf
_CxxThrowException
memcpy
memmove
memcpy_s
_vsnwprintf
_amsg_exit
memset

ntdll

RtlIsMultiSessionSku
RtlNtStatusToDosError
NtSetSecurityObject
RtlCreateSecurityDescriptor
NtQuerySecurityObject
RtlFreeHeap
RtlSetDaclSecurityDescriptor
RtlInitUnicodeString
RtlAddAce
RtlGetAce
RtlCreateAcl
RtlAllocateHeap
RtlLengthSid
RtlQueryInformationAcl
RtlGetDaclSecurityDescriptor
RtlAddAccessAllowedAce
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlCapabilityCheck

rpcrt4

NdrOleFree
CStdStubBuffer_Invoke
NdrClientCall3
I_RpcExceptionFilter
RpcBindingFree
RpcBindingSetAuthInfoExW
RpcStringFreeW
RpcBindingFromStringBindingW
RpcStringBindingComposeW
NdrStubForwardingFunction
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
CStdStubBuffer_CountRefs
CStdStubBuffer_QueryInterface
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
CStdStubBuffer_Connect
CStdStubBuffer_IsIIDSupported
NdrCStdStubBuffer2_Release
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
NdrStubCall3
IUnknown_QueryInterface_Proxy

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetProcAddress
LoadLibraryExW
LoadLibraryExA
GetModuleHandleExW
GetModuleFileNameA
FreeLibrary

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
ReleaseSRWLockShared
CreateEventExW
LeaveCriticalSection
ReleaseMutex
OpenSemaphoreW
SetEvent
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
EnterCriticalSection
ReleaseSemaphore
InitializeSRWLock
AcquireSRWLockExclusive
CreateMutexExW
AcquireSRWLockShared
WaitForSingleObject
WaitForSingleObjectEx
CreateSemaphoreExW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
RaiseException
SetLastError
UnhandledExceptionFilter
GetLastError

api-ms-win-core-winrt-string-l1-1-0

HSTRING_UserMarshal
HSTRING_UserMarshal64
HSTRING_UserSize64
WindowsIsStringEmpty
WindowsDuplicateString
HSTRING_UserUnmarshal
HSTRING_UserUnmarshal64
WindowsGetStringRawBuffer
HSTRING_UserSize
HSTRING_UserFree64
WindowsCreateStringReference
WindowsCreateString
WindowsCompareStringOrdinal
WindowsStringHasEmbeddedNull
HSTRING_UserFree
WindowsDeleteString

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoWaitForMultipleHandles
CoCreateInstance
CoGetStandardMarshal
CoSwitchCallContext
CoReleaseMarshalData
CoCopyProxy
CoSetProxyBlanket
PropVariantClear
CreateStreamOnHGlobal
CoTaskMemFree
CoRevertToSelf
CoImpersonateClient
CoCreateFreeThreadedMarshaler

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
TerminateProcess
OpenThreadToken
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
OpenProcessToken

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo
RoOriginateError
GetRestrictedErrorInfo
RoTransformError
RoOriginateErrorW

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
InitOnceExecuteOnce
WakeAllConditionVariable
Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetSystemInfo

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient11
CStdStubBuffer2_CountRefs
ObjectStublessClient3
ObjectStublessClient25
ObjectStublessClient24
ObjectStublessClient26
ObjectStublessClient23
ObjectStublessClient21
ObjectStublessClient16
CStdStubBuffer2_Disconnect
ObjectStublessClient7
ObjectStublessClient17
ObjectStublessClient19
ObjectStublessClient15
ObjectStublessClient13
CStdStubBuffer2_QueryInterface
ObjectStublessClient20
ObjectStublessClient18
ObjectStublessClient14
CStdStubBuffer2_Connect
NdrProxyForwardingFunction3
NdrProxyForwardingFunction4
ObjectStublessClient10
ObjectStublessClient9
ObjectStublessClient8
ObjectStublessClient12
ObjectStublessClient6
ObjectStublessClient22
NdrProxyForwardingFunction5

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoInitialize
RoUninitialize
RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-1

RoReportFailedDelegate
IsErrorPropagationEnabled
RoGetMatchingRestrictedErrorInfo

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-security-base-l1-1-0

GetTokenInformation
CreateWellKnownSid
EqualSid
GetAce

api-ms-win-core-heap-l2-1-0

LocalReAlloc
LocalFree
LocalAlloc

api-ms-win-security-base-l1-2-0

CheckTokenMembershipEx

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-largeinteger-l1-1-0

MulDiv

api-ms-win-shcore-stream-winrt-l1-1-0

CreateStreamOverRandomAccessStream
CreateRandomAccessStreamOverStream

api-ms-win-core-memory-l1-1-0

VirtualProtect
VirtualQuery

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

combase

ord148

oleaut32

SysAllocString
VariantClear
SysFreeString
VariantInit

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegGetValueW
RegCloseKey

api-ms-win-core-file-l1-1-0

ReadFile
CreateFileW
GetFileSizeEx

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 107KB - Virtual size: 107KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 143KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 232B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/cs-CZ/WWAHost.exe.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 20KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/cs-CZ/cdosys.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 46KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/cs-CZ/comctl32.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/cs-CZ/comdlg32.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 56KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/cs-CZ/fms.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 13KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/cs-CZ/mlang.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/cs-CZ/msimsg.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 82KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/cs-CZ/msprivs.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/cs-CZ/windows.ui.xaml.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/cs-CZ/xpsfilt.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/cs-CZ/xpsrchvw.exe.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/da-DK/WWAHost.exe.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 19KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/da-DK/cdosys.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 46KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/da-DK/comctl32.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/da-DK/comdlg32.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 56KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/da-DK/fms.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 13KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/da-DK/mlang.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/da-DK/msimsg.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 81KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/da-DK/msprivs.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/da-DK/windows.ui.xaml.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/da-DK/xpsfilt.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/da-DK/xpsrchvw.exe.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/et-EE/WWAHost.exe.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/et-EE/comctl32.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/et-EE/comdlg32.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 55KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/et-EE/fms.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 13KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/et-EE/mlang.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/et-EE/msimsg.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 77KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/et-EE/twinapi.dll
.dll windows x64

b5f032e3add6955597b3d696440a0b3e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_vsnwprintf
memcpy
memcmp
_CxxThrowException
_callnewh
memmove
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
malloc
_amsg_exit
_XcptFilter
free
memcpy_s
??1type_info@@UEAA@XZ
__CxxFrameHandler3
_purecall
??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBV0@@Z
realloc
?terminate@@YAXXZ
memset

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolQueueTask
SHTaskPoolAllowThreadReuse

api-ms-win-shcore-stream-winrt-l1-1-0

CreateRandomAccessStreamOverStream

shlwapi

PathFindFileNameW
ord219
ord204

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleFileNameW
GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExW
DisableThreadLibraryCalls
LoadStringW

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
InitializeCriticalSectionEx
ReleaseSemaphore
AcquireSRWLockShared
EnterCriticalSection
DeleteCriticalSection
WaitForSingleObject
ResetEvent
CreateMutexExW
CreateSemaphoreExW
CreateEventW
WaitForSingleObjectEx
CreateEventExW
SetEvent
WaitForMultipleObjectsEx
OpenSemaphoreW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeSRWLock
ReleaseSRWLockShared
ReleaseMutex

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventWriteTransfer
EventSetInformation
EventRegister
EventUnregister

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-eventing-classicprovider-l1-1-0

RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableFlags
TraceMessage
GetTraceEnableLevel

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThread
OpenProcessToken
OpenThread
OpenThreadToken

api-ms-win-core-localization-l1-2-0

ResolveLocaleName
GetLocaleInfoW
FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-synch-l1-2-0

InitOnceInitialize
WakeByAddressSingle
Sleep
WakeAllConditionVariable
WaitOnAddress
InitOnceBeginInitialize
SleepConditionVariableSRW
InitOnceComplete
InitOnceExecuteOnce

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-debug-l1-1-1

CheckRemoteDebuggerPresent

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
WaitForThreadpoolWorkCallbacks
CloseThreadpoolWork
CloseThreadpoolTimer
CreateThreadpoolWork
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
SetThreadpoolTimer
CloseThreadpoolWait
CreateThreadpoolWait
CreateThreadpoolTimer
SubmitThreadpoolWork

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegGetValueW
RegCloseKey
RegQueryInfoKeyW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-heap-l2-1-0

LocalReAlloc
LocalFree
LocalAlloc

api-ms-win-core-atoms-l1-1-0

GlobalGetAtomNameW

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
CreateTimerQueueTimer

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

combase

ord90
ord140
ord157

ntdll

wcschr
NtQueryInformationToken
RtlInitUnicodeString
RtlAllocateHeap
RtlNtStatusToDosErrorNoTeb
RtlCompareUnicodeString
RtlFreeHeap
RtlNtStatusToDosError
iswalnum
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlSubscribeWnfStateChangeNotification
RtlQueryWnfStateData
memmove_s
NtQueryWnfStateData
NtQuerySystemInformation
_vsnprintf_s
wcsrchr

user32

SystemParametersInfoW
SetPropW
ord2521
CallNextHookEx
GetGUIThreadInfo
GetKeyboardLayout
MonitorFromPoint
GetKeyboardState
UnhookWindowsHookEx
SetWindowsHookExW
RegisterWindowMessageW
MonitorFromWindow
IntersectRect
GetPropW
SetFocus
ToUnicodeEx
GetWindowDpiAwarenessContext
CopyIcon
GetFocus
SendMessageTimeoutW
GetClientRect
SetParent
GetClassNameW
MapWindowPoints
GetParent
SendMessageW
GetWindowThreadProcessId
DefWindowProcA
DefWindowProcW
DestroyIcon
IsWindowUnicode
GetKeyState
SetWindowLongPtrW
CreateWindowInBandEx
ShowWindow
GetWindowLongPtrW
SetWindowPos
GetWindowRect
MsgWaitForMultipleObjectsEx
PeekMessageW
PostQuitMessage
GetClassInfoExW
TranslateMessage
GetWindowCompositionAttribute
CopyRect
SetCursor
GetAncestor
LoadCursorW
DispatchMessageW
GetDesktopWindow
PostMessageW
SetRect
CreateWindowExW
FillRect
SetThreadDpiAwarenessContext
EnumWindows
EndPaint
RegisterClassExW
SetKeyboardState
MonitorFromRect
IsRectEmpty
GetMonitorInfoW
GetForegroundWindow
BeginPaint

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-sysinfo-l1-2-0

GetProductInfo

api-ms-win-core-kernel32-legacy-l1-1-0

MulDiv

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
GetMetroMode

Sections

.text
Size: 417KB - Virtual size: 417KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 139KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 776B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/et-EE/txflog.dll
.dll windows x64

a38eaff52a1b599a2bdbbd7bdc71557f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

__dllonexit
exp
_local_unwind
_onexit
?terminate@@YAXXZ
_unlock
_lock
_initterm
_wstrtime
memset
wcsrchr
_wcsicmp
_waccess
_vsnwprintf
_wstrdate
_XcptFilter
__CxxFrameHandler3
malloc
free
_beginthreadex
_amsg_exit
_vsnprintf
__C_specific_handler
_purecall
memcpy
sqrt

ntdll

RtlDelete
RtlSplay
RtlDllShutdownInProgress
RtlDeleteCriticalSection
RtlInitializeCriticalSectionAndSpinCount
RtlNtStatusToDosError
RtlInitUnicodeString
RtlVirtualUnwind
RtlLookupFunctionEntry
NtQueryVolumeInformationFile
NtCreateFile
NtOpenFile
NtClose
NtFlushBuffersFile
NtSetInformationFile
NtQueryInformationFile
NtWriteFile
NtWaitForSingleObject
NtReadFile
RtlCaptureContext

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoCreateGuid
CoCreateInstance
CoUninitialize
CoGetMalloc
CoTaskMemAlloc
StringFromGUID2
CoGetObjectContext
CoInitializeEx

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
RaiseException

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
InitializeCriticalSection
ResetEvent
SetEvent
CreateSemaphoreExW
CreateEventW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
ReleaseSemaphore

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-0

TlsAlloc
TlsGetValue
OpenProcessToken
GetExitCodeProcess
GetCurrentProcessId
GetCurrentThreadId
TlsSetValue
TlsFree
TerminateProcess
GetCurrentProcess
CreateThread
SetThreadPriority
CreateProcessW
SetThreadToken
GetCurrentThread
OpenThreadToken

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemInfo
GetLocalTime
GetTickCount

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
GetModuleFileNameW
LoadResource
GetProcAddress
FindResourceExW
LoadStringW
GetModuleHandleW
FreeLibraryAndExitThread
LockResource
FreeLibrary

api-ms-win-core-io-l1-1-0

CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
OutputDebugStringA
DebugBreak
IsDebuggerPresent

api-ms-win-core-file-l1-1-0

FindClose
DeleteFileW
SetFileAttributesW
FindNextFileW
FindFirstFileW
CreateDirectoryW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-processthreads-l1-1-1

GetThreadContext

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
CreateTimerQueueTimer
ChangeTimerQueueTimer

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllGetClassObject

Sections

.text
Size: 86KB - Virtual size: 86KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 548B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/et-EE/txfw32.dll
.dll windows x64

10e28fda6d5f10b41592073aa2af5c55

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_XcptFilter
memcpy
__C_specific_handler
_initterm
malloc
free
_amsg_exit
memset

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

clfsw32

DeleteLogMarshallingArea
CreateLogMarshallingArea
CreateLogFile
ReadNextLogRecord
TerminateReadLog
ReadLogRecord

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

Exports

Exports

TxfGetThreadMiniVersionForCreate
TxfLogCreateFileReadContext
TxfLogCreateRangeReadContext
TxfLogDestroyReadContext
TxfLogReadRecords
TxfLogRecordGetFileName
TxfLogRecordGetGenericType
TxfReadMetadataInfo
TxfSetThreadMiniVersionForCreate

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 336B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/et-EE/umcRes.dll
.dll windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 180KB - Virtual size: 180KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/et-EE/umdmxfrm.dll
.dll windows x64

3f70031ee8634318be6993dd403faf8d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
memset

kernel32

QueryPerformanceCounter
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
DisableThreadLibraryCalls
Sleep
TerminateProcess

Exports

Exports

GetXformInfo

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 492B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/et-EE/umpnpmgr.dll
.dll windows x64

e10138abbfd0907a6d5fbe97291962bb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

memcpy
memmove
_initterm
malloc
free
_amsg_exit
_XcptFilter
wcschr
toupper
_vsnprintf
_resetstkoflw
wcsstr
_vsnwprintf
wcsrchr
__C_specific_handler
memset

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
NtSetInformationFile
NtQueryInformationFile
NtSetValueKey
NtQueryValueKey
NtCreateKey
NtOpenKey
RtlFreeUnicodeString
RtlFormatCurrentUserKeyPath
NtQuerySystemInformation
RtlGetVersion
EtwEventSetInformation
RtlVirtualUnwind
EtwEventRegister
RtlInitUnicodeString
RtlDeleteSecurityObject
RtlNtStatusToDosError
NtSetInformationThread
NtClose
RtlNewSecurityObject
RtlCreateAndSetSD
NtOpenThreadToken
RtlImpersonateSelf
RtlAdjustPrivilege
RtlFreeHeap
RtlReAllocateHeap
RtlAllocateHeap
RtlDestroyHeap
RtlPublishWnfStateData
RtlNtStatusToDosErrorNoTeb
EtwEventWriteTransfer
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwTraceMessage
EtwEventUnregister

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-file-l1-1-0

FindClose
FileTimeToLocalFileTime
GetFileSize
FlushFileBuffers
SetFilePointer
GetFileInformationByHandle
DeleteFileW
GetFileAttributesW
SetFileAttributesW
WriteFile
FindNextFileW
CreateFileW
SetEndOfFile
GetFullPathNameW
CreateDirectoryW
FindFirstFileW

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapReAlloc
HeapFree

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
LoadLibraryExW
GetProcAddress
LoadStringW
GetModuleFileNameA

api-ms-win-core-localization-l1-2-0

LCMapStringW

api-ms-win-core-memory-l1-1-0

MapViewOfFile
UnmapViewOfFile
CreateFileMappingW

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineA
ExpandEnvironmentStringsW

api-ms-win-core-processthreads-l1-1-0

CreateProcessW
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
OpenThreadToken
ProcessIdToSessionId
QueueUserAPC
GetCurrentProcess
CreateThread
GetExitCodeProcess
GetCurrentThread

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegDeleteTreeW
RegCreateKeyExW
RegSetValueExW
RegNotifyChangeKeyValue
RegDeleteValueW
RegCloseKey

api-ms-win-core-string-l1-1-0

CompareStringW
CompareStringOrdinal
WideCharToMultiByte

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
WaitForMultipleObjectsEx
ReleaseMutex
EnterCriticalSection
LeaveCriticalSection
CreateEventW
WaitForSingleObjectEx
SetEvent
CreateMutexW
ResetEvent
OpenEventW
InitializeCriticalSection
SleepEx

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetSystemTimeAsFileTime
GetSystemTime
GetSystemInfo
GetSystemWindowsDirectoryW
GetTickCount64
GetTickCount
GetLocalTime

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-security-base-l1-1-0

AccessCheckAndAuditAlarmW
InitializeSecurityDescriptor
DuplicateTokenEx
MapGenericMask
SetSecurityDescriptorDacl
GetLengthSid
GetTokenInformation
InitializeAcl
AddAccessAllowedAceEx

api-ms-win-service-core-l1-1-0

SetServiceStatus
RegisterServiceCtrlHandlerExW

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem
UnregisterWaitEx

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

api-ms-win-service-private-l1-1-1

I_ScRegisterPreshutdownRestart

api-ms-win-core-file-l2-1-0

CreateHardLinkW
MoveFileExW

rpcrt4

RpcImpersonateClient
I_RpcBindingIsClientLocal
I_RpcBindingInqLocalClientPID
RpcServerInterfaceGroupDeactivate
RpcBindingToStringBindingW
RpcStringBindingParseW
I_RpcMapWin32Status
RpcServerInterfaceGroupCreateW
RpcServerInterfaceGroupActivate
RpcServerInterfaceGroupClose
NdrServerCall2
NdrAsyncServerCall
NdrServerCallAll
Ndr64AsyncServerCallAll
RpcStringFreeW
RpcRevertToSelf
RpcAsyncCompleteCall

kernelbase

WTSGetServiceSessionId

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

PlugPlayServiceMain
ServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/et-EE/umpo-overrides.dll
.dll windows x64

ec0047a82ddaaa7dce1fad02384da049

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_initterm
__C_specific_handler
toupper
_XcptFilter
malloc
free
_amsg_exit
memcpy_s
memmove

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlAllocateHeap
RtlFreeHeap

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventUnregister
EventRegister
EventProviderEnabled
EventWriteTransfer

api-ms-win-core-heap-l2-1-0

LocalAlloc

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
ReleaseSRWLockExclusive

Exports

Exports

UmpoGetPowerSettingOverrides

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 372B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/et-EE/umpo.dll
.dll windows x64

b048e1144e9f744ca04da12875fb7ceb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-crt-private-l1-1-0

_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__seh_filter_dll
memmove
_o__wcsicmp
_o_toupper
__C_specific_handler
_o__configure_narrow_argv
_o__cexit
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
wcsstr
wcsrchr
memcpy

ntdll

RtlDeleteElementGenericTableAvl
RtlInitializeGenericTableAvl
EtwEventRegister
EtwEventWrite
EtwEventUnregister
RtlLengthSid
RtlAllocateHeap
NtQueryInformationProcess
EtwEventEnabled
RtlCreateHeap
RtlFreeHeap
NtQueryInformationToken
RtlIsMultiSessionSku
RtlCopySid
RtlIsStateSeparationEnabled
RtlGetPersistedStateLocation
NtAlpcSendWaitReceivePort
NtAlpcDisconnectPort
NtSetIRTimer
AlpcInitializeMessageAttribute
TpWaitForAlpcCompletion
RtlLookupElementGenericTableAvl
RtlInsertElementGenericTableAvl
RtlEnumerateGenericTableAvl
NtAlpcQueryInformation
NtClose
RtlInitUnicodeString
NtAlpcCancelMessage
NtAlpcConnectPort
TpReleaseAlpcCompletion
TpAllocAlpcCompletion
ZwAlpcCancelMessage
RtlWakeAddressAll
ZwAlpcDisconnectPort
ZwAlpcSendWaitReceivePort
ZwAlpcQueryInformation
RtlWaitOnAddress
ZwAlpcConnectPort
ZwClose
vDbgPrintEx
RtlCompareMemory
DbgPrint
RtlNtStatusToDosError
RtlUnsubscribeWnfNotificationWaitForCompletion
NtPowerInformation
RtlAllocateWnfSerializationGroup
NtQueryWnfStateData
RtlPublishWnfStateData
NtQuerySystemTime
RtlSubscribeWnfStateChangeNotification
NtCreateIRTimer
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
AlpcGetMessageAttribute
RtlDestroyHeap

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
InitializeSRWLock
WaitForSingleObject
CreateEventW
ReleaseSRWLockExclusive
SetEvent
AcquireSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared

api-ms-win-security-base-l1-1-0

CreateWellKnownSid
RevertToSelf
ImpersonateLoggedOnUser
GetLengthSid
FreeSid
AllocateAndInitializeSid
AdjustTokenPrivileges
CheckTokenMembership
AccessCheck

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentThreadId
GetProcessId
TlsSetValue
TlsFree
OpenThreadToken
TlsGetValue
TerminateProcess
TlsAlloc
OpenProcessToken
GetCurrentThread
GetCurrentProcessId

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-file-l1-1-0

FindFirstFileW
RemoveDirectoryW
FindNextFileW
DeleteFileW
CreateDirectoryW
FindClose

api-ms-win-core-registry-l1-1-0

RegDeleteTreeW
RegFlushKey
RegSetValueExW
RegCreateKeyExW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegDeleteKeyExW
RegCloseKey
RegLoadAppKeyW
RegDeleteValueW
RegEnumValueW
RegQueryValueExW
RegGetValueW

rpcrt4

UuidFromStringW
RpcStringFreeW
UuidEqual
I_RpcOpenClientProcess
UuidCreate
UuidToStringW
NdrServerCall2
RpcServerUnregisterIfEx
RpcRevertToSelf
RpcImpersonateClient
RpcServerRegisterIf3
I_RpcBindingIsClientLocal
NdrServerCallAll
RpcServerUseProtseqEpW

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-service-core-l1-1-0

SetServiceStatus
RegisterServiceCtrlHandlerExW

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventSetInformation
EventUnregister
EventProviderEnabled
EventWriteTransfer

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetVersionExW

api-ms-win-core-path-l1-1-0

PathCchAppend

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
GetProcAddress
FreeLibrary
LoadLibraryExW
DisableThreadLibraryCalls

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolWait
CloseThreadpool
CreateThreadpool
WaitForThreadpoolWaitCallbacks

api-ms-win-core-timezone-l1-1-0

SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-service-private-l1-1-0

I_ScSendPnPMessage
I_QueryTagInformation

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

kernelbase

WTSIsServerContainer
Sleep
WTSGetServiceSessionId

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

PtrUmpoFullPowerPlanSupportDisabled
PtrUmpoOnAcPower
PtrUmpoProviderHandle
PtrUmpoSchemeLock
UmpoAllocate
UmpoAlpcSendPowerMessage
UmpoFree
UmpoGetActiveScheme
UmpoInternalCloseUserPowerKey
UmpoInternalConvertGuidToString
UmpoInternalDataAccessorToString
UmpoInternalGetKeyValueGuid
UmpoInternalOpenGUIDSubKey
UmpoInternalOpenUserPowerKey
UmpoMain
UmpoNotificationHandler
UmpoNotifyKernelAllPowerPolicyChanged
UmpoSendKernelPowerPolicyNotification
UmpoWriteToUserPowerKey

Sections

.text
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 744B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/et-EE/umpoext.dll
.dll windows x64

83a048ec045e5883965d8f7f52c7c678

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

__C_specific_handler
free
malloc
_initterm
memcmp
_XcptFilter
__CxxFrameHandler3
_vsnwprintf
swprintf_s
memmove
wcscpy_s
memcpy
_amsg_exit
_wcsdup
_purecall
toupper
_callnewh
memset

ntdll

EtwEventWrite
DbgPrint
RtlUnsubscribeWnfStateChangeNotification
RtlWakeAddressAll
RtlSubscribeWnfStateChangeNotification
RtlWaitOnAddress
RtlQueryWnfStateData
RtlNtStatusToDosError
RtlAllocateWnfSerializationGroup
RtlUnsubscribeWnfNotificationWaitForCompletion
EtwEventRegister
EtwEventUnregister
NtQueryWnfStateData
NtPowerInformation
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-threadpool-l1-2-0

CallbackMayRunLong
WaitForThreadpoolIoCallbacks
WaitForThreadpoolTimerCallbacks
StartThreadpoolIo
CancelThreadpoolIo
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks
IsThreadpoolTimerSet
CloseThreadpoolTimer
SubmitThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolIo
CreateThreadpoolWork
CreateThreadpoolCleanupGroup
CreateThreadpoolIo

api-ms-win-core-io-l1-1-0

DeviceIoControl
GetOverlappedResult
CancelIoEx

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
DeleteCriticalSection
ReleaseSRWLockExclusive
InitializeSRWLock
SetEvent
EnterCriticalSection
CreateEventW
AcquireSRWLockExclusive
ReleaseSRWLockShared
InitializeCriticalSection
AcquireSRWLockShared
WaitForSingleObject

api-ms-win-core-file-l1-1-0

CreateFileW
ReadFile
GetFileAttributesW

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventUnregister
EventProviderEnabled
EventRegister
EventEnabled
EventSetInformation

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegGetValueW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteTreeW
RegCloseKey
RegCopyTreeW
RegQueryValueExW

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-devices-config-l1-1-1

CM_Get_Device_Interface_List_SizeW
CM_Register_Notification
CM_Get_Device_Interface_ListW
CM_Unregister_Notification

api-ms-win-power-setting-l1-1-0

PowerSettingRegisterNotification
PowerSettingUnregisterNotification

rpcrt4

UuidFromStringW
UuidEqual

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
FreeLibrary
GetModuleFileNameA
DisableThreadLibraryCalls
GetProcAddress
LoadStringW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-sysinfo-l1-1-0

GetSystemTime
GetLocalTime
GetTickCount
GetTickCount64
GetSystemTimeAsFileTime

api-ms-win-core-com-l1-1-0

CoUninitialize
CoInitializeEx
CoCreateInstance
CoTaskMemFree

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-kernel32-legacy-l1-1-0

WTSGetActiveConsoleSessionId
MoveFileW

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-devices-query-l1-1-0

DevCloseObjectQuery
DevCreateObjectQuery

api-ms-win-core-perfcounters-l1-1-0

PerfDeleteInstance
PerfCreateInstance
PerfSetULongLongCounterValue
PerfSetULongCounterValue
PerfStartProviderEx
PerfStopProvider
PerfSetCounterSetInfo

api-ms-win-security-grouppolicy-l1-1-0

LeaveCriticalPolicySectionInternal
RegisterGPNotificationInternal
EnterCriticalPolicySectionInternal
UnregisterGPNotificationInternal

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

powrprof

PowerSetBrightnessAndTransitionTimes

umpo

UmpoFree
PtrUmpoProviderHandle
PtrUmpoSchemeLock
UmpoWriteToUserPowerKey
UmpoGetActiveScheme
UmpoSendKernelPowerPolicyNotification
UmpoAllocate
PtrUmpoOnAcPower
UmpoInternalGetKeyValueGuid
UmpoInternalDataAccessorToString
UmpoNotifyKernelAllPowerPolicyChanged
UmpoInternalOpenGUIDSubKey
UmpoInternalOpenUserPowerKey
UmpoInternalCloseUserPowerKey
UmpoInternalConvertGuidToString
PtrUmpoFullPowerPlanSupportDisabled
UmpoNotificationHandler
UmpoAlpcSendPowerMessage

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-path-l1-1-0

PathCchAppend

api-ms-win-eventing-controller-l1-1-0

StopTraceW
EnableTraceEx2
StartTraceW
ControlTraceW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-eventing-tdh-l1-1-0

TdhGetProperty

api-ms-win-shell-shdirectory-l1-1-0

ord290

dxgi

CreateDXGIFactory1

Exports

Exports

DllMain
ExtensionInit

Sections

.text
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/et-EE/umpowmi.dll
.dll regsvr32 windows x64

b1843b6aca4830d3aae6709ec156a199

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
malloc
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
wcscpy_s
__C_specific_handler
wcscspn
memmove_s
wcsrchr
free
wcsspn
wcsstr
wcschr
_vscwprintf
vswprintf_s
_wtoi
_CxxThrowException
_XcptFilter
_amsg_exit
__CxxFrameHandler3
_initterm
_wcsicmp
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_errno
realloc
_lock
memcpy_s
_unlock
__dllonexit
_onexit
_callnewh
memset

ntdll

RtlCaptureContext
DbgPrint
RtlFreeHeap
RtlAllocateHeap
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleFileNameW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegSetValueExW
RegDeleteKeyExW
RegCreateKeyExW

oleaut32

SysAllocStringLen
SafeArrayGetUBound
SysAllocString
SafeArrayUnlock
SafeArrayGetLBound
SafeArrayLock
SafeArrayCreate
VariantInit
SysFreeString
VariantCopy
VariantClear
SafeArrayDestroy

rpcrt4

UuidToStringW
RpcStringFreeW
UuidFromStringW

api-ms-win-power-setting-l1-1-0

PowerWriteACValueIndex
PowerWriteDCValueIndex
PowerSetActiveScheme
PowerGetActiveScheme

api-ms-win-core-com-l1-1-0

CoRevertToSelf
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoTaskMemAlloc
CoInitializeEx
CoImpersonateClient

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
GetLastError

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-threadpool-l1-2-0

SubmitThreadpoolWork
CreateThreadpoolWork
WaitForThreadpoolWorkCallbacks
CloseThreadpoolIo
CancelThreadpoolIo
StartThreadpoolIo
WaitForThreadpoolIoCallbacks
CreateThreadpoolIo
CloseThreadpoolWork

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockShared
WaitForSingleObject
InitializeCriticalSection
DeleteCriticalSection
InitializeSRWLock
CreateEventW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
AcquireSRWLockShared
SetEvent

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

powrprof

PowerSettingAccessCheckEx
PowerReadPossibleValue
PowerIsSettingRangeDefined
PowerEnumerate
PowerReadPossibleFriendlyName
PowerReadValueMax
PowerReadValueUnitsSpecifier
PowerReadACValueIndex
PowerReadValueMin
PowerReadDCValueIndex
PowerReadFriendlyName
PowerReadValueIncrement
PowerReadDescription

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-file-l1-1-0

CreateFileW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-devices-config-l1-1-1

CM_Unregister_Notification
CM_Register_Notification

api-ms-win-devices-query-l1-1-0

DevCreateObjectQuery
DevCloseObjectQuery

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 424B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/et-EE/umrdp.dll
.dll windows x64

379e4eaa15aabf7f0d46ccc0e0eb561d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

wcschr
rand
srand
time
memcpy_s
_vsnwprintf
_purecall
wcsstr
_initterm
_wcsicmp
memcpy
_unlock
__C_specific_handler
wcsrchr
malloc
_callnewh
_lock
free
_XcptFilter
_amsg_exit
__CxxFrameHandler3
memmove
_onexit
__dllonexit
memset

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetVersionExW
GetSystemWindowsDirectoryW
GetTickCount

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
DeleteCriticalSection
CancelWaitableTimer
ResetEvent
WaitForSingleObject
SetWaitableTimer
SetEvent
CreateEventW
InitializeCriticalSection
EnterCriticalSection
WaitForMultipleObjectsEx

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExA
GetProcAddress
LoadStringW
FreeLibrary

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
OpenThreadToken
GetCurrentProcessId
CreateThread
GetCurrentThreadId
GetCurrentThread
GetCurrentProcess

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-security-base-l1-1-0

CheckTokenMembership
GetSidSubAuthorityCount
IsValidAcl
AllocateAndInitializeSid
GetSidIdentifierAuthority
CreateWellKnownSid
GetSidSubAuthority
GetLengthSid
IsValidSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ImpersonateLoggedOnUser
RevertToSelf
EqualSid
FreeSid
AddAccessAllowedAceEx
CopySid
GetTokenInformation

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
HeapReAlloc

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-io-l1-1-0

DeviceIoControl
GetOverlappedResult

api-ms-win-core-file-l1-1-0

ReadFile
GetFileSize
CreateFileW
DeleteFileW
WriteFile
QueryDosDeviceW

api-ms-win-core-io-l1-1-1

CancelIo

api-ms-win-core-synch-l1-2-1

CreateWaitableTimerW

api-ms-win-core-registry-l1-1-0

RegOpenUserClassesRoot
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyExW
RegQueryValueExW
RegGetValueW
RegCloseKey
RegDeleteValueW
RegNotifyChangeKeyValue
RegOpenCurrentUser

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

ntdll

RtlInsertElementGenericTable
RtlMultiByteToUnicodeN
EtwEventWriteFull
EtwTraceMessage
NtCreateFile
EtwEventWrite
RtlOpenCurrentUser
RtlNtStatusToDosError
NtMakePermanentObject
NtMakeTemporaryObject
NtClose
NtQuerySymbolicLinkObject
NtOpenSymbolicLinkObject
NtCreateSymbolicLinkObject
RtlInitUnicodeString
NtQueryInformationProcess
EtwEventActivityIdControl
DbgPrint
RtlEnumerateGenericTable
RtlInitializeGenericTable
RtlDeleteElementGenericTable
RtlLookupElementGenericTable
RtlEnumerateGenericTableWithoutSplaying
EtwEventRegister
RtlGetSuiteMask
EtwEventUnregister
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle

advapi32

EventActivityIdControl
TraceMessage

user32

UnregisterDeviceNotification
PostMessageW
DispatchMessageW
PeekMessageW
MsgWaitForMultipleObjectsEx
PostThreadMessageW
UnregisterClassW
RegisterClassExW
GetClassInfoExW
DestroyWindow
CreateWindowExW
DefWindowProcW
RegisterDeviceNotificationW

winspool.drv

SetPrinterW
DeletePrinter
ClosePrinter
FindFirstPrinterChangeNotification
FindClosePrinterChangeNotification
FindNextPrinterChangeNotification
OpenPrinterW
EnumPrintersW
SetPrinterDataW
GetPrinterDataW
ord203
GetPrinterW
EnumPrinterDriversW
FreePrinterNotifyInfo

kernel32

TlsSetValue
SleepEx
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
InitializeCriticalSectionEx
CloseThreadpoolCleanupGroupMembers
CreateThreadpoolCleanupGroup
SetThreadpoolThreadMaximum
CreateThreadpool
CloseThreadpool
CloseThreadpoolCleanupGroup
CancelIoEx
WaitForMultipleObjects
GetThreadId
ResumeThread
ProcessIdToSessionId
ReadFileEx
GetModuleHandleW
QueueUserAPC
WaitForSingleObjectEx
lstrcmpiW
DeleteTimerQueueTimer
CreateTimerQueueTimer
FreeLibraryAndExitThread
GetProcessHeap
GetModuleHandleExW
GetTickCount64
ReleaseSemaphore
VerifyVersionInfoW
UnregisterWait
TlsAlloc
GetSystemInfo
SwitchToThread
CreateSemaphoreW
TlsGetValue
TlsFree
OpenThread

api-ms-win-devices-config-l1-1-1

CM_Get_DevNode_Status

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventWriteTransfer

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

newdev

DiUninstallDevice

Exports

Exports

ServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 252KB - Virtual size: 252KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/et-EE/unattend.dll
.dll windows x64

c38f6f7a1e0a52ca06e3d827f7ff779c

Code Sign

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03-07-2018 20:45

Not After

26-07-2019 20:45

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:95:14:4f:d4:6a:b0:9d:5c:75:d5:fe:68:c0:0e:ef:69:57:4a:0b:e4:5d:8e:94:3e:8f:e4:49:f4:5c:86:46
Signer

Actual PE Digest

4e:95:14:4f:d4:6a:b0:9d:5c:75:d5:fe:68:c0:0e:ef:69:57:4a:0b:e4:5d:8e:94:3e:8f:e4:49:f4:5c:86:46

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

13-01-2023 12:41
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

msvcrt

memcmp
memcpy
memmove
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
free
_callnewh
towupper
malloc
_purecall
_vscwprintf
iswspace
wcsrchr
_vsnprintf
_wcsicmp
_vsnwprintf
memcpy_s
wcschr
wcstol
_wcsnicmp
wcstoul
iswdigit
memset

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
NtWaitForSingleObject
NtCreateFile
RtlNtStatusToDosError
RtlFreeHeap
RtlInitializeCriticalSection
RtlRaiseStatus
NtYieldExecution
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject
RtlDosPathNameToNtPathName_U_WithStatus
NtQueryObject
NtOpenFile
NtClose
RtlReAllocateHeap
RtlInitUnicodeString
RtlVirtualUnwind
RtlAllocateHeap
RtlDeleteCriticalSection
NtWriteFile

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleFileNameW
FreeLibrary
GetProcAddress
LoadLibraryExW

api-ms-win-core-string-l1-1-0

CompareStringW

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc
HeapReAlloc

api-ms-win-core-errorhandling-l1-1-0

RaiseException
GetLastError
SetLastError
SetErrorMode
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-com-l1-1-0

CreateStreamOnHGlobal

api-ms-win-core-file-l1-1-0

GetFullPathNameW
GetFileAttributesW
GetFileSize
CreateFileW
ReadFile
GetDriveTypeW
GetVolumeInformationW
QueryDosDeviceW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

Exports

Exports

DllCanUnloadNow
DllMain
UnattendAddResults
UnattendCleanup
UnattendCtxAddOrModifyNodeText
UnattendCtxBeginModify
UnattendCtxCancelModify
UnattendCtxCleanup
UnattendCtxCommitModify
UnattendCtxCompareNodes
UnattendCtxDeserialize
UnattendCtxDeserializeBuffer
UnattendCtxDeserializeFile
UnattendCtxDeserializeString
UnattendCtxDeserializeWithResults
UnattendCtxEnumGet
UnattendCtxEnumOrderedSubNodes
UnattendCtxGetCount
UnattendCtxGetCountByNode
UnattendCtxGetEnumValue
UnattendCtxGetEnumValueByNode
UnattendCtxGetExpandedString
UnattendCtxGetExpandedStringByNode
UnattendCtxGetFlag
UnattendCtxGetFlagByNode
UnattendCtxGetLong
UnattendCtxGetLongByNode
UnattendCtxGetNodeAttr
UnattendCtxGetNodeChild
UnattendCtxGetNodeValue
UnattendCtxGetRootNode
UnattendCtxGetShowUI
UnattendCtxGetShowUIFromNode
UnattendCtxGetString
UnattendCtxGetStringByNode
UnattendCtxGetUlong
UnattendCtxGetUlongByNode
UnattendCtxOpenNode
UnattendCtxOpenNodeByNode
UnattendCtxPrettyPrint
UnattendCtxRemoveAttr
UnattendCtxRemoveNode
UnattendCtxReplaceMatchedNodesWithText
UnattendCtxReplaceNode
UnattendCtxSerialize
UnattendCtxSerializeSettingsStream
UnattendCtxSerializeToBuffer
UnattendCtxSerializeToBufferFromNode
UnattendCtxSerializeToStream
UnattendCtxSerializeToStreamFromNode
UnattendCtxSetNodeName
UnattendCtxSetString
UnattendCtxSetStringByNode
UnattendCtxSpliceTrees
UnattendDeserializeWithResults
UnattendEnumFree
UnattendFindAnswerFile
UnattendFindAnswerFileSkipPantherFolder
UnattendFindAnswerFileWithResults
UnattendFindFileFromCmdLine
UnattendFormatPath
UnattendFreeNode
UnattendFreeResults
UnattendFreeSetting
UnattendGetCount
UnattendGetFirstFailingSetting
UnattendGetFlag
UnattendGetImplicitContext
UnattendGetString
UnattendIsNodeValid
UnattendIsPassUnusedInCtx
UnattendMarkPassUsedInCtx
UnattendUsedPassesExistInCtx

Sections

.text
Size: 158KB - Virtual size: 157KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 580B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/et-EE/unenrollhook.dll
.dll windows x64

83333eaafea91d169251812bbf1f923a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

enterpriseresourcemanager

EnterpriseResourceManagerStore_DeleteResource

msvcrt

??_V@YAXPEAX@Z
_vsnwprintf
memcpy_s
??1type_info@@UEAA@XZ
_onexit
__dllonexit
?terminate@@YAXXZ
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
__CxxFrameHandler3
_free_locale
_get_current_locale
__crtLCMapStringW
_wcsdup
sprintf_s
abort
memset
_ismbblead
___mb_cur_max_func
calloc
___lc_codepage_func
___lc_handle_func
__pctype_func
__uncaught_exception
setlocale
_unlock
_lock
_errno
memmove
memcpy
_CxxThrowException
??0exception@@QEAA@AEBQEBDH@Z
_callnewh
malloc
free
wcschr
??0exception@@QEAA@AEBQEBD@Z
?what@exception@@UEBAPEBDXZ
??0bad_cast@@QEAA@AEBV0@@Z
??0bad_cast@@QEAA@PEBD@Z
??1bad_cast@@UEAA@XZ
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
_purecall
??3@YAXPEAX@Z
_wcsicmp

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlIsStateSeparationEnabled

oleaut32

SysAllocString
VariantClear
VariantInit

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventSetInformation
EventWriteTransfer

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleFileNameA
LoadLibraryExW
GetModuleHandleExW
GetModuleHandleW
DisableThreadLibraryCalls
GetProcAddress

api-ms-win-core-registry-l1-1-0

RegEnumValueW
RegCloseKey
RegEnumKeyExW
RegQueryValueExW
RegOpenKeyExW
RegQueryInfoKeyW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-com-l1-1-0

CoUninitialize
CoInitializeEx
CoCreateInstance

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetSystemTime

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-string-l1-1-0

GetStringTypeW
WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-synch-l1-1-0

CreateMutexExW
LeaveCriticalSection
DeleteCriticalSection
EnterCriticalSection
ReleaseSRWLockExclusive
CreateSemaphoreExW
InitializeCriticalSectionEx
WaitForSingleObject
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseMutex
AcquireSRWLockExclusive
ReleaseSemaphore

api-ms-win-core-synch-l1-2-0

Sleep
WakeAllConditionVariable
SleepConditionVariableSRW

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-handle-l1-1-0

CloseHandle

rpcrt4

UuidCreate

dmcmnutils

UnicodeToMB

Exports

Exports

EnterpriseResourceManager_UnenrollHook

Sections

.text
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 640B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/et-EE/unimdm.tsp
.dll windows x64

25389a3fa69c8cfbf5135ec3d63e07d6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

swprintf_s
sprintf_s
strpbrk
strncpy_s
sscanf_s
isxdigit
strchr
_wcsicmp
_XcptFilter
_amsg_exit
free
malloc
_initterm
wcscpy_s
wcsncpy_s
memcmp
strcat_s
vsprintf_s
strcpy_s
__C_specific_handler
memcpy
memset

advapi32

RegOpenKeyW
RegQueryInfoKeyW
RegEnumKeyExA
RegCreateKeyExW
RegSetValueExW
RegOpenKeyA
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExW

kernel32

RtlLookupFunctionEntry
RtlCaptureContext
LocalFree
LocalAlloc
CreateProcessW
AllocConsole
RtlVirtualUnwind
FreeConsole
GetStdHandle
SetConsoleTextAttribute
GetProcessHeap
HeapDestroy
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
DelayLoadFailureHook
ResolveDelayLoadedAPI
SleepEx
WriteConsoleA
CompareStringW
HeapFree
GetCurrentThreadId
LoadLibraryW
HeapAlloc
GetProcAddress
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetLastError
SetEvent
DeleteCriticalSection
MultiByteToWideChar
ReadFile
CancelIo
WriteFile
WaitForMultipleObjects
WaitForSingleObject
CreateEventW
Sleep
WaitCommEvent
CloseHandle
CreateThread
GetOverlappedResult
SetCommMask
GlobalLock
GetCurrentProcessId
WideCharToMultiByte
SetCommTimeouts
GlobalUnlock
lstrlenW
lstrlenA
lstrcmpiW
SetWaitableTimer
CreateWaitableTimerW
lstrcmpA
CancelWaitableTimer
QueueUserAPC
GetSystemTime
GetTickCount
GetModuleFileNameW
OpenProcess
DeviceIoControl
ResetEvent
SetThreadPriority
ResumeThread
lstrcmpW
TryEnterCriticalSection
DisableThreadLibraryCalls

user32

CallWindowProcW
GetWindowRect
SetActiveWindow
SetWindowTextW
OpenClipboard
SetSysColors
CloseClipboard
MapWindowPoints
MoveWindow
GetKeyState
GetClipboardData
GetClientRect
IsClipboardFormatAvailable
GetParent
InvalidateRect
CreateDialogParamW
SetDlgItemTextW
GetForegroundWindow
GetMessageW
GetDialogBaseUnits
GetDlgItem
SetFocus
SendDlgItemMessageW
LoadStringW
GetWindowLongPtrW
SendMessageW
SetWindowLongPtrW
SetForegroundWindow
OpenWindowStationW
GetProcessWindowStation
PostQuitMessage
GetUserObjectInformationW
LoadCursorW
LoadIconW
TranslateMessage
OpenInputDesktop
SetProcessWindowStation
RegisterClassW
IsDialogMessageW
DispatchMessageW
CloseDesktop
IsWindow
GetThreadDesktop
SetThreadDesktop
CreateWindowExW
CloseWindowStation
DestroyWindow
PostMessageW
DefWindowProcW

uniplat

ord210
ord211
ord104
ord214
ord116
ord215
ord216

Exports

Exports

TSPI_lineAccept
TSPI_lineAddToConference
TSPI_lineAnswer
TSPI_lineBlindTransfer
TSPI_lineClose
TSPI_lineCloseCall
TSPI_lineCloseMSPInstance
TSPI_lineCompleteCall
TSPI_lineCompleteTransfer
TSPI_lineConditionalMediaDetection
TSPI_lineCreateMSPInstance
TSPI_lineDevSpecific
TSPI_lineDevSpecificFeature
TSPI_lineDial
TSPI_lineDrop
TSPI_lineForward
TSPI_lineGatherDigits
TSPI_lineGenerateDigits
TSPI_lineGenerateTone
TSPI_lineGetAddressCaps
TSPI_lineGetAddressID
TSPI_lineGetAddressStatus
TSPI_lineGetCallAddressID
TSPI_lineGetCallInfo
TSPI_lineGetCallStatus
TSPI_lineGetDevCaps
TSPI_lineGetDevConfig
TSPI_lineGetID
TSPI_lineGetIcon
TSPI_lineGetLineDevStatus
TSPI_lineGetNumAddressIDs
TSPI_lineHold
TSPI_lineMSPIdentify
TSPI_lineMakeCall
TSPI_lineMonitorDigits
TSPI_lineMonitorMedia
TSPI_lineMonitorTones
TSPI_lineNegotiateExtVersion
TSPI_lineNegotiateTSPIVersion
TSPI_lineOpen
TSPI_linePark
TSPI_linePickup
TSPI_linePrepareAddToConference
TSPI_lineReceiveMSPData
TSPI_lineRedirect
TSPI_lineReleaseUserUserInfo
TSPI_lineRemoveFromConference
TSPI_lineSecureCall
TSPI_lineSelectExtVersion
TSPI_lineSendUserUserInfo
TSPI_lineSetAppSpecific
TSPI_lineSetCallData
TSPI_lineSetCallParams
TSPI_lineSetCallQualityOfService
TSPI_lineSetCallTreatment
TSPI_lineSetCurrentLocation
TSPI_lineSetDefaultMediaDetection
TSPI_lineSetDevConfig
TSPI_lineSetLineDevStatus
TSPI_lineSetMediaControl
TSPI_lineSetMediaMode
TSPI_lineSetStatusMessages
TSPI_lineSetTerminal
TSPI_lineSetupConference
TSPI_lineSetupTransfer
TSPI_lineSwapHold
TSPI_lineUncompleteCall
TSPI_lineUnhold
TSPI_lineUnpark
TSPI_phoneClose
TSPI_phoneDevSpecific
TSPI_phoneGetButtonInfo
TSPI_phoneGetData
TSPI_phoneGetDevCaps
TSPI_phoneGetDisplay
TSPI_phoneGetExtensionID
TSPI_phoneGetGain
TSPI_phoneGetHookSwitch
TSPI_phoneGetID
TSPI_phoneGetIcon
TSPI_phoneGetLamp
TSPI_phoneGetRing
TSPI_phoneGetStatus
TSPI_phoneGetVolume
TSPI_phoneNegotiateExtVersion
TSPI_phoneNegotiateTSPIVersion
TSPI_phoneOpen
TSPI_phoneSelectExtVersion
TSPI_phoneSetButtonInfo
TSPI_phoneSetData
TSPI_phoneSetDisplay
TSPI_phoneSetGain
TSPI_phoneSetHookSwitch
TSPI_phoneSetLamp
TSPI_phoneSetRing
TSPI_phoneSetStatusMessages
TSPI_phoneSetVolume
TSPI_providerCreateLineDevice
TSPI_providerCreatePhoneDevice
TSPI_providerEnumDevices
TSPI_providerFreeDialogInstance
TSPI_providerGenericDialogData
TSPI_providerInit
TSPI_providerShutdown
TSPI_providerUIIdentify
TUISPI_lineConfigDialog
TUISPI_lineConfigDialogEdit
TUISPI_phoneConfigDialog
TUISPI_providerConfig
TUISPI_providerGenericDialog
TUISPI_providerGenericDialogData
TUISPI_providerInstall
TUISPI_providerRemove
WinDbgExtensionDllInit
uhelp
version

Sections

.text
Size: 148KB - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/et-EE/unimdmat.dll
.dll windows x64

3f7240b3d994ded3f69b8fe20dada4e9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_initterm
malloc
free
_amsg_exit
_XcptFilter
isxdigit
wcscat_s
isprint
isdigit
vsprintf_s
sprintf_s
memcpy
memcmp
__C_specific_handler
strcat_s
memmove
wcscpy_s
strcpy_s
toupper
memset

advapi32

RegEnumValueA
RegCreateKeyExW
RegSetValueExW
RegSetValueExA
RegOpenKeyExA
RegQueryValueExW
RegCloseKey
RegOpenKeyA
RegQueryValueExA

kernel32

UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
lstrcmpiA
SetUnhandledExceptionFilter
ClearCommError
SetCommTimeouts
SetupComm
GetCommProperties
GetDefaultCommConfigA
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DelayLoadFailureHook
ResolveDelayLoadedAPI
ReadFileEx
LoadLibraryA
WriteFileEx
GetLastError
PurgeComm
lstrlenA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
HeapAlloc
lstrcmpA
HeapFree
CloseHandle
GetLocalTime
WriteFile
CreateFileA
GetFileSize
SetFilePointer
ReadFile
SetEndOfFile
GetSystemDirectoryA
GetCommModemStatus
GetTickCount
GetCommState
SetCommState
GetCommConfig
Sleep
WaitForSingleObjectEx
GetOverlappedResult
SetEvent
SetCommMask
EscapeCommFunction
GetProcessHeap
DisableThreadLibraryCalls
GetProcAddress
FreeLibrary
HeapDestroy
SetCommConfig
HeapReAlloc
DuplicateHandle
GetCurrentProcess
CreateEventA
ResetEvent
WaitForSingleObject
lstrlenW
CreateFileW

ntdll

RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

uniplat

ord115
ord104
ord110
ord105
ord100
WinntIsWorkstation
ord111
ord213
ord212
ord106
ord108
ord113
ord116
ord109
ord114
ord101
ord107

Exports

Exports

UmAbortCurrentModemCommand
UmAnswerModem
UmCloseModem
UmDeinitializeModemDriver
UmDialModem
UmDuplicateDeviceHandle
UmGenerateDigit
UmGetDiagnostics
UmHangupModem
UmInitModem
UmInitializeModemDriver
UmIssueCommand
UmLogDiagnostics
UmLogStringA
UmMonitorModem
UmOpenModem
UmSetPassthroughMode
UmSetSpeakerPhoneState
UmWaveAction

Sections

.text
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/et-EE/uniplat.dll
.dll windows x64

53d31dc643b9e50a5ffb190f72105c36

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_initterm
malloc
free
_amsg_exit
_XcptFilter
__C_specific_handler
memset

kernel32

GetCurrentThreadId
ResolveDelayLoadedAPI
DelayLoadFailureHook
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
Sleep
WaitForSingleObject
SetEvent
ResetEvent
ExitThread
CreateEventW
CreateThread
CloseHandle
HeapAlloc
HeapFree
ReadFileEx
WriteFileEx
QueueUserAPC
GetLastError
DeviceIoControl
GetOverlappedResult
InitializeCriticalSection
DisableThreadLibraryCalls
GetProcessHeap
DeleteCriticalSection
HeapDestroy
WaitForSingleObjectEx
SetThreadPriority
LocalAlloc
LocalFree
CompareStringW
CreateWaitableTimerW
SetWaitableTimer
CancelWaitableTimer
SetLastError
QueryPerformanceCounter
GetCurrentProcessId
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetTickCount
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

ntdll

RtlNtStatusToDosError
NtDeviceIoControlFile

user32

TranslateMessage
DispatchMessageW
MsgWaitForMultipleObjects
PeekMessageW
CreateWindowExW
RegisterClassW
RegisterDeviceNotificationW
SetWindowLongPtrW
BeginPaint
GetClientRect
EndPaint
GetWindowLongPtrW
UnregisterDeviceNotification
DestroyWindow
PostQuitMessage
DefWindowProcW
LoadIconW
LoadCursorW

cfgmgr32

CMP_WaitNoPendingInstallEvents

Exports

Exports

AllocateOverStructEx
CallBeginning
CallEnding
CancelUnimodemTimer
CreateOverStructPool
CreateUnimodemTimer
DestroyOverStructPool
FreeOverStruct
FreeUnimodemTimer
MonitorHandle
ReinitOverStruct
ResetCallCount
SetUnimodemTimer
StartMonitorThread
StopMonitorThread
StopMonitoringHandle
SyncDeviceIoControl
UmPlatformDeinitialize
UmPlatformInitialize
UnimodemDeviceIoControlEx
UnimodemNotifyTSP
UnimodemQueueUserAPC
UnimodemReadFileEx
UnimodemWaitCommEventEx
UnimodemWriteFileEx
WinntIsWorkstation

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/et-EE/windows.ui.xaml.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/et-EE/xpsrchvw.exe.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 81KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/fi-FI/TlsBrand.dll
.dll windows x64

4adb4c7a14eb99ade524f48656475075

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_onexit
__dllonexit
_unlock
_lock
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
wcsstr
??0exception@@QEAA@AEBQEBDH@Z
malloc
free
wcstol
_vsnwprintf
memmove_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
wcschr
?what@exception@@UEBAPEBDXZ
swscanf_s
_wcsicmp
wcstok
_purecall
memcpy_s
__CxxFrameHandler3
__C_specific_handler
memset

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

winbrand

BrandingFormatString

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
LoadStringW
GetModuleHandleExA
FreeLibrary

api-ms-win-core-heap-l2-1-0

LocalFree
GlobalFree
LocalAlloc

oleaut32

SysAllocString
VariantClear
VariantInit
SysFreeString

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoInitializeEx
CoUninitialize

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-file-l1-1-0

CreateFileW
GetTempFileNameW
DeleteFileW

api-ms-win-core-errorhandling-l1-1-0

GetLastError
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId

user32

GetSystemMetrics
UnregisterClassA

kernel32

WriteFile
SizeofResource
LockResource
FindResourceExW
LoadResource

winhttp

WinHttpSetTimeouts
WinHttpSendRequest
WinHttpGetIEProxyConfigForCurrentUser
WinHttpCloseHandle
WinHttpQueryOption
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpOpen
WinHttpAddRequestHeaders
WinHttpQueryHeaders
WinHttpReadData
WinHttpConnect
WinHttpGetProxyForUrl
WinHttpOpenRequest
WinHttpSetOption

api-ms-win-core-heap-l1-1-0

HeapDestroy
HeapReAlloc
HeapSize
HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection

Exports

Exports

??0ICALDetails@@QEAA@AEBV0@@Z
??0ICALDetails@@QEAA@XZ
??0ICALStringDetails@@QEAA@AEBV0@@Z
??0ICALStringDetails@@QEAA@XZ
??0IRDSProductDetails@@QEAA@AEBV0@@Z
??0IRDSProductDetails@@QEAA@XZ
??0IW2K3ADPUCALDetails@@QEAA@AEBV0@@Z
??0IW2K3ADPUCALDetails@@QEAA@XZ
??0IWMICALDetails@@QEAA@AEBV0@@Z
??0IWMICALDetails@@QEAA@XZ
??1ICALDetails@@UEAA@XZ
??1ICALStringDetails@@UEAA@XZ
??1IRDSProductDetails@@UEAA@XZ
??1IW2K3ADPUCALDetails@@UEAA@XZ
??1IWMICALDetails@@UEAA@XZ
??4ICALDetails@@QEAAAEAV0@AEBV0@@Z
??4ICALStringDetails@@QEAAAEAV0@AEBV0@@Z
??4IRDSProductDetails@@QEAAAEAV0@AEBV0@@Z
??4IW2K3ADPUCALDetails@@QEAAAEAV0@AEBV0@@Z
??4IWMICALDetails@@QEAAAEAV0@AEBV0@@Z
??_7ICALDetails@@6B@
??_7ICALStringDetails@@6B@
??_7IRDSProductDetails@@6B@
??_7IW2K3ADPUCALDetails@@6B@
??_7IWMICALDetails@@6B@
?GetAccessRights@IRDSProductDetails@@UEAAJPEAGPEAK1@Z
?GetProductFromAccessRights@IRDSProductDetails@@UEAAJKKPEAPEAG@Z
?IsTestHookValid@IRDSProductDetails@@UEAAHPEAK@Z
CALDetailsCreator
CALStringDetailsCreator
CRetailCALCreator
CWMICALDetailsCreator
CleanupRDLSConfig
GetCALVersion
GetCALVersionStrings
GetConversionVersionStrings
GetRdlsSupportedFeatureMask
LicBrandFormatString
LoadRDLSConfig
RDSGetCALVersionString
RDSGetCurrentVersion
RDSGetOSVersionString
RDSGetProductAccessRights
RDSProductDetailsCreator
UpdateRDLSConfig
W2K3ADPUCALDetailsCreator

Sections

.text
Size: 115KB - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 464B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/fi-FI/TokenBroker.dll
.dll windows x64

03c361ec4d4c1b2a09f33702171bcb06

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-string-l1-1-0

wcscmp
wcscspn
memset

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__itow_s
_o__lock_file
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__unlock_file
_o__wcsicmp
memmove
_o__wsplitpath_s
_o_fclose
_o_fflush
_o_fgetc
_o_fgetpos
_o_fgetwc
_o_fputwc
_o_free
_o_fsetpos
_o_fwrite
_o_iswspace
_o_malloc
_o_realloc
_o_setvbuf
_o_terminate
_o_tolower
_o_toupper
_o_towlower
_o_ungetc
_o_ungetwc
_o_wcscat_s
_o_wcscpy_s
_o_wcstoul
__C_specific_handler
_CxxThrowException
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o__fseeki64
_o__execute_onexit_table
_o__errno
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__wcsnicmp
__std_terminate
wcsstr
__CxxFrameHandler3
memcmp
memcpy

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleW
FreeLibrary
GetModuleHandleExW
GetModuleFileNameA

api-ms-win-security-base-l1-1-0

MakeAbsoluteSD
FreeSid
AllocateAndInitializeSid
InitializeSid
GetSidLengthRequired
GetSidSubAuthority
SetTokenInformation
GetLengthSid
IsWellKnownSid
AccessCheck
CreateWellKnownSid
ImpersonateLoggedOnUser
GetTokenInformation
DuplicateTokenEx
RevertToSelf

api-ms-win-core-processthreads-l1-1-0

OpenThreadToken
GetCurrentThread
GetCurrentThreadId
OpenProcessToken
GetProcessId
TlsSetValue
TlsGetValue
TlsAlloc
GetCurrentProcessId
TlsFree
InitializeProcThreadAttributeList
SetThreadToken
CreateProcessAsUserW
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
GetCurrentProcess
TerminateProcess

api-ms-win-core-synch-l1-1-0

CreateSemaphoreExW
ResetEvent
LeaveCriticalSection
InitializeCriticalSectionEx
WaitForSingleObject
DeleteCriticalSection
ReleaseSemaphore
EnterCriticalSection
ReleaseMutex
CreateEventW
CreateEventExW
ReleaseSRWLockExclusive
SetEvent
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseSRWLockShared
CreateMutexExW
WaitForMultipleObjectsEx
AcquireSRWLockShared
TryAcquireSRWLockExclusive
InitializeSRWLock
InitializeCriticalSectionAndSpinCount

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
SetLastError
RaiseException
GetLastError
UnhandledExceptionFilter

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringLen
WindowsDeleteString
WindowsConcatString
WindowsGetStringRawBuffer
WindowsDuplicateString
WindowsCompareStringOrdinal
WindowsCreateStringReference
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsCreateString
WindowsSubstringWithSpecifiedLength

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
CloseThreadpool
SetThreadpoolTimer
CloseThreadpoolWork
CreateThreadpool
FreeLibraryWhenCallbackReturns
WaitForThreadpoolTimerCallbacks
SubmitThreadpoolWork
CreateThreadpoolTimer
WaitForThreadpoolWorkCallbacks
CreateThreadpoolWork

api-ms-win-core-winrt-l1-1-0

RoUninitialize
RoRegisterActivationFactories
RoInitialize
RoRevokeActivationFactories
RoGetActivationFactory
RoActivateInstance

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
RoOriginateErrorW
RoTransformError
SetRestrictedErrorInfo
GetRestrictedErrorInfo

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-service-core-l1-1-0

SetServiceStatus
RegisterServiceCtrlHandlerExW

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventProviderEnabled
EventActivityIdControl
EventSetInformation
EventWriteTransfer

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-processthreads-l1-1-1

OpenProcess
IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetTickCount64
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InitializeSListHead

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegSetValueExW
RegDeleteValueW
RegCreateKeyExW
RegGetValueW
RegQueryValueExW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle
InitOnceComplete
Sleep
InitOnceExecuteOnce
InitOnceBeginInitialize

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW
ExpandEnvironmentStringsW

api-ms-win-core-file-l1-1-0

CompareFileTime
GetFileSizeEx
FindFirstFileW
SetFileInformationByHandle
FindNextFileW
SetFilePointer
ReadFile
CreateDirectoryW
WriteFile
GetFileTime
SetEndOfFile
FindClose
CreateFileW

api-ms-win-core-winrt-error-l1-1-1

RoReportFailedDelegate
IsErrorPropagationEnabled
RoOriginateLanguageException
RoGetMatchingRestrictedErrorInfo

api-ms-win-core-sysinfo-l1-2-0

GetProductInfo

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem

ntdll

RtlAcquireResourceExclusive
RtlReleaseResource
RtlDeleteResource
RtlDosPathNameToRelativeNtPathName_U
RtlReleaseRelativeName
NtClose
NtCreateFile
ZwQueryWnfStateData
RtlEqualSid
RtlNtStatusToDosError
RtlInitializeResource
NtQueryWnfStateData
RtlFreeSid
RtlIsMultiSessionSku
RtlPublishWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfStateChangeNotification
RtlLoadString
RtlQueryWnfStateData
RtlGetDeviceFamilyInfoEnum
RtlIsMultiUsersInSessionSku
wcsnlen
RtlSetEnvironmentVar
RtlFreeHeap
NtQueryInformationToken
RtlAllocateHeap
DbgPrint

tokenbinding

TokenBindingGenerateID

api-ms-win-security-capability-l1-1-0

CapabilityCheck

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindFileNameW
PathFileExistsW

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolQueueTask
SHTaskPoolAllowThreadReuse

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

combase

ord68
ord157
ord90
ord69
ord66
ord67

api-ms-win-appmodel-runtime-l1-1-1

GetPackageFamilyNameFromToken
GetPackageFullNameFromToken

msvcp_win

?_Getcat@?$codecvt@GDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXXZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?_Gndec@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG0@Z
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@_K@Z
_Mtx_lock
?_Throw_C_error@std@@YAXH@Z
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
_Cnd_broadcast
_Xtime_get_ticks
_Cnd_timedwait
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_current_owns
?_Xlength_error@std@@YAXPEBD@Z
?widen@?$ctype@G@std@@QEBAGD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBGHH@Z
?unshift@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?id@?$ctype@G@std@@2V0locale@2@A
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
_Mtx_destroy_in_situ
_Mtx_init_in_situ
_Cnd_init_in_situ
_Cnd_destroy_in_situ
?_Xbad_function_call@std@@YAXXZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
??Bid@locale@std@@QEAA_KXZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_BADOFF@std@@3_JB
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGXZ
?_Gninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?in@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
?uncaught_exception@std@@YA_NXZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?flags@ios_base@std@@QEBAHXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
?good@ios_base@std@@QEBA_NXZ
?pbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
_Mtx_unlock

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-security-base-l1-2-0

CheckTokenMembershipEx

api-ms-win-core-string-l2-1-0

CharLowerW

api-ms-win-core-winrt-propertysetprivate-l1-1-1

RoCreatePropertySetSerializer

api-ms-win-service-private-l1-1-0

I_QueryTagInformation

api-ms-win-security-base-private-l1-1-1

CreateAppContainerToken

api-ms-win-appmodel-state-l1-2-0

OpenStateExplicit
GetStateRootFolder
CloseState

api-ms-win-core-largeinteger-l1-1-0

MulDiv

api-ms-win-shcore-stream-winrt-l1-1-0

CreateStreamOverRandomAccessStream
CreateRandomAccessStreamOverStream

Exports

Exports

ServiceMain

Sections

.text
Size: 984KB - Virtual size: 984KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 375KB - Virtual size: 374KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/fi-FI/TtlsAuth.dll
.dll regsvr32 windows x64

1e124a8e4918ce86be781bd22796a8b3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

abort
_free_locale
_get_current_locale
__crtLCMapStringW
__crtCompareStringW
_wcsdup
_ismbblead
___mb_cur_max_func
memcmp
___lc_codepage_func
___lc_handle_func
__pctype_func
setlocale
___lc_collate_cp_func
strnlen
strcat_s
strcpy_s
strncat_s
strchr
_vsnwprintf
sscanf_s
wcschr
strstr
atol
swprintf_s
_wcsicmp
??0bad_cast@@QEAA@AEBV0@@Z
??0bad_cast@@QEAA@PEBD@Z
??1bad_cast@@UEAA@XZ
realloc
_errno
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_callnewh
calloc
wcsncpy_s
malloc
free
wcscat_s
__C_specific_handler
wcscpy_s
memcpy_s
??_V@YAXPEAX@Z
_purecall
??3@YAXPEAX@Z
memset
__CxxFrameHandler3
strcmp

api-ms-win-eventing-classicprovider-l1-1-0

UnregisterTraceGuids
GetTraceEnableFlags
TraceMessage
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceLoggerHandle

api-ms-win-security-base-l1-1-0

GetTokenInformation
CheckTokenMembership
RevertToSelf
ImpersonateLoggedOnUser

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
RaiseException
GetLastError
UnhandledExceptionFilter

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventWriteTransfer
EventRegister
EventUnregister

oleaut32

VarUI4FromStr

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
LoadLibraryExW
SizeofResource
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadResource
FindResourceExW
DisableThreadLibraryCalls
LoadStringW

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
InitializeCriticalSectionEx
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection

api-ms-win-core-com-l1-1-0

StringFromGUID2
CoTaskMemAlloc
CoCreateInstance
CoImpersonateClient
CoTaskMemRealloc
CoTaskMemFree
CoRevertToSelf

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegSetValueExW
RegDeleteValueW
RegEnumKeyExW
RegQueryValueExW
RegOpenKeyExW
RegUnLoadKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegLoadKeyW

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
CreateThread
OpenThreadToken
GetCurrentProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTime
GetTickCount
GetComputerNameExW
GetSystemTimeAsFileTime

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

eappprxy

EapHostPeerSetResponseAttributes
EapHostPeerProcessReceivedPacket
EapHostPeerInitialize
EapHostPeerGetIdentity
EapHostPeerGetSendPacket
EapHostPeerGetResponseAttributes
EapHostPeerFreeRuntimeMemory
EapHostPeerGetUIContext
EapHostPeerEndSession
EapHostPeerBeginSession
EapHostPeerFreeEapError
EapHostPeerUninitialize
EapHostPeerSetUIContext
EapHostPeerGetResult

ntdll

RtlGetPersistedStateLocation
RtlCreateUnicodeStringFromAsciiz
WinSqmSetDWORD
RtlNtStatusToDosError
RtlFreeUnicodeString
RtlInitString

sspicli

GetUserNameExW
DecryptMessage
AcquireCredentialsHandleW
InitializeSecurityContextW
LsaCallAuthenticationPackage
FreeContextBuffer
EncryptMessage
LsaLookupAuthenticationPackage
LsaFreeReturnBuffer
DeleteSecurityContext
SetContextAttributesW
QueryContextAttributesW
LsaRegisterLogonProcess
LsaDeregisterLogonProcess

crypt32

CertOpenStore
CryptProtectData
CertGetEnhancedKeyUsage
CertGetCertificateContextProperty
CertGetCertificateChain
CertFreeCertificateContext
CertVerifyTimeValidity
CertCloseStore
CryptUnprotectData
CertFindCertificateInStore
CertGetNameStringW
CertDuplicateCertificateContext
CertVerifySubjectCertificateContext
CertCompareCertificateName
CertVerifyCertificateChainPolicy
CertFindExtension
CryptBinaryToStringW
CryptDecodeObjectEx

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-file-l1-1-0

CompareFileTime

api-ms-win-security-credentials-l1-1-0

CredUnprotectW
CredIsProtectedW
CredWriteA

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

samlib

SamiEncryptPasswords

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
EapPeerFreeErrorMemory
EapPeerFreeMemory
EapPeerGetInfo

Sections

.text
Size: 181KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/fi-FI/TtlsCfg.dll
.dll windows x64

cd6393322d3948d18c83044b16615350

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

isalnum
_free_locale
_get_current_locale
__crtLCMapStringW
__crtCompareStringW
_wcsdup
realloc
abort
memchr
tolower
isspace
memset
isdigit
___mb_cur_max_func
calloc
___lc_codepage_func
_initterm
___lc_handle_func
__C_specific_handler
??0exception@@QEAA@AEBQEBDH@Z
__uncaught_exception
memmove
memcpy
_CxxThrowException
setlocale
_unlock
_lock
_callnewh
___lc_collate_cp_func
_XcptFilter
_ismbblead
_amsg_exit
strchr
_snwprintf_s
__CxxFrameHandler3
??1type_info@@UEAA@XZ
malloc
_errno
wcscspn
_onexit
wcscpy_s
memcpy_s
ldexp
sprintf_s
free
localeconv
??0exception@@QEAA@AEBV0@@Z
__pctype_func
__dllonexit
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_purecall
strcspn
??0bad_cast@@QEAA@AEBV0@@Z
??0bad_cast@@QEAA@PEBD@Z
??1bad_cast@@UEAA@XZ
??_V@YAXPEAX@Z
??3@YAXPEAX@Z

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
LoadStringW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte
GetStringTypeW

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSectionEx

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetComputerNameExW
GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

eappcfg

EapHostPeerGetMethodProperties
EapHostPeerFreeErrorMemory
EapHostPeerFreeMemory
EapHostPeerQueryUIBlobFromInteractiveUIInputFields
EapHostPeerQueryInteractiveUIInputFields
EapHostPeerQueryUserBlobFromCredentialInputFields
EapHostPeerQueryCredentialInputFields
EapHostPeerConfigBlob2Xml
EapHostPeerInvokeInteractiveUI
EapHostPeerInvokeIdentityUI
EapHostPeerCredentialsXml2Blob
EapHostPeerConfigXml2Blob

eappprxy

EapHostPeerGetEncryptedPassword
EapHostPeerInitialize

api-ms-win-core-heap-l2-1-0

LocalFree

sspicli

GetUserNameExW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-com-l1-1-0

CoCreateInstance

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

EapPeerConfigBlob2Xml
EapPeerConfigXml2Blob
EapPeerCreateMethodConfiguration
EapPeerCredentialsXml2Blob
EapPeerFreeErrorMemory
EapPeerFreeMemory
EapPeerGetConfigBlobAndUserBlob
EapPeerGetIdentityPageGuid
EapPeerGetMethodProperties
EapPeerGetNextPageGuid
EapPeerInvokeConfigUI
EapPeerInvokeIdentityUI
EapPeerInvokeInteractiveUI
EapPeerQueryCredentialInputFields
EapPeerQueryInteractiveUIInputFields
EapPeerQueryUIBlobFromInteractiveUIInputFields
EapPeerQueryUserBlobFromCredentialInputFields

Sections

.text
Size: 152KB - Virtual size: 152KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/fi-FI/TtlsExt.dll
.dll regsvr32 windows x64

ac9d687d697dfa320dcf9753d39f3765

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_CxxThrowException
??3@YAXPEAX@Z
??1bad_cast@@UEAA@XZ
??0bad_cast@@QEAA@PEBD@Z
??0bad_cast@@QEAA@AEBV0@@Z
strchr
___lc_collate_cp_func
setlocale
__pctype_func
___lc_handle_func
___lc_codepage_func
memcmp
___mb_cur_max_func
_ismbblead
memset
_wcsdup
__crtCompareStringW
__crtLCMapStringW
_get_current_locale
_free_locale
abort
memcpy
memmove
_XcptFilter
??0exception@@QEAA@AEBQEBD@Z
_amsg_exit
_initterm
_callnewh
calloc
wcscspn
_wcsicmp
_wtol
_errno
wcsncmp
wcsncpy_s
malloc
realloc
free
_purecall
?terminate@@YAXXZ
wcscat_s
wcscpy_s
memcpy_s
??_V@YAXPEAX@Z
__C_specific_handler
__CxxFrameHandler3
_lock
_unlock
__dllonexit
_onexit
??1type_info@@UEAA@XZ
??0exception@@QEAA@AEBQEBDH@Z
__RTDynamicCast

ntdll

RtlCaptureContext
RtlNtStatusToDosError
RtlInitString
RtlLookupFunctionEntry
RtlVirtualUnwind

oleaut32

VarUI4FromStr

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
LoadStringW
LoadLibraryExW
GetModuleHandleW
SizeofResource
GetModuleFileNameW
LoadResource
LockResource
DisableThreadLibraryCalls
FindResourceExW
FreeLibrary

sspicli

GetUserNameExW
LsaLookupAuthenticationPackage
LsaConnectUntrusted

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection

api-ms-win-core-com-l1-1-0

CoTaskMemFree
StringFromGUID2
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegDeleteValueW
RegCloseKey

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
GetLastError

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

crypt32

CertCloseStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore
CertGetNameStringW
CertFindCertificateInStore
CertVerifyTimeValidity
CertEnumCertificatesInStore

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThreadId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemTime
GetComputerNameExW
GetTickCount

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

eappcfg

EapHostPeerGetMethods
EapHostPeerFreeErrorMemory
EapHostPeerInvokeConfigUI
EapHostPeerFreeMemory

eappprxy

EapHostPeerInitialize
EapHostPeerGetEncryptedPassword

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
TtlsExt_EapPeerInvokeConfigUI
TtlsExt_FreeMemoryExt
TtlsExt_GetConfigCacheOnlyCertValidation
TtlsExt_GetConfigForceNotDomainJoined
TtlsExt_GetContextData
TtlsExt_GetUserCredentials
TtlsExt_InvokeNonEapMethodUI
TtlsExt_InvokeServerAuthentication
TtlsExt_ShowHelp

Sections

.text
Size: 125KB - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 608B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/fi-FI/WWAHost.exe.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 20KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/fi-FI/cdosys.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 46KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/fi-FI/comctl32.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/fi-FI/comdlg32.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 57KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/fi-FI/fms.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/fi-FI/mlang.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/fi-FI/msimsg.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 79KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/fi-FI/msprivs.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/fi-FI/svsvc.dll
.dll windows x64

4017383f3c7ccc134002d37a3e731cf7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

__C_specific_handler
_initterm
malloc
_amsg_exit
_XcptFilter
free
realloc
memset

advapi32

LookupPrivilegeValueW
RegisterServiceCtrlHandlerExW
AdjustTokenPrivileges
RegCloseKey
SetServiceStatus
RegCreateKeyExW
RegSetValueExW
OpenProcessToken
RegOpenKeyExW
RegQueryValueExW

kernel32

QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Sleep
WaitForSingleObject
GetCurrentProcess
DeviceIoControl
FreeLibrary
CreateFileW
CreateEventW
GetLastError
SetEvent
CloseHandle
LoadLibraryW
GetProcAddress
TerminateProcess

ntdll

DbgPrint

Exports

Exports

ServiceCtrlHandler
ServiceMain

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/fi-FI/sysmon.ocx
.dll regsvr32 windows x64

6db58da94d65ed09259054bd22c998b4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

floor
log10
memcpy
memset
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_initterm
_amsg_exit
_XcptFilter
realloc
wcschr
__CxxFrameHandler3
malloc
towlower
_wtoi64
wcsrchr
_wtoi
swscanf_s
wcsspn
wcscspn
strstr
_resetstkoflw
wcsstr
wcstok
_purecall
_vsnwprintf
?name@type_info@@QEBAPEBDXZ
__C_specific_handler
free
pow

atl

ord41
ord30

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WinSqmAddToAverageDWORD
WinSqmSetDWORD
WinSqmAddToStream
WinSqmIncrementDWORD

kernel32

HeapFree
CreateFileW
lstrcmpiW
ActivateActCtx
DeactivateActCtx
LoadLibraryW
FindActCtxSectionStringW
CreateActCtxW
SetLastError
GetModuleFileNameW
GetModuleHandleExW
QueryActCtxW
OutputDebugStringA
GetProcAddress
GlobalAlloc
GlobalLock
GlobalUnlock
GetProfileIntW
ResetEvent
WideCharToMultiByte
GetProcessHeap
MultiByteToWideChar
lstrcmpW
GetCommandLineW
GlobalFree
FindFirstFileW
FindClose
GetFileSize
ReadFile
WriteFile
GetComputerNameW
GetDateFormatW
GetTimeFormatW
FileTimeToSystemTime
CompareStringW
MulDiv
FormatMessageW
FreeLibrary
GetLocaleInfoW
GetNumberFormatW
FindResourceW
LoadResource
LockResource
ExpandEnvironmentStringsW
SetCurrentDirectoryW
GetVersionExW
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
HeapReAlloc
HeapAlloc
CloseHandle
SetThreadPriority
CreateThread
CreateEventW
SetEvent
SystemTimeToFileTime
GetLocalTime
lstrlenW
GetTickCount
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetLastError
lstrlenA

advapi32

RegOpenKeyExW
RegCloseKey
RegCreateKeyExW
EventRegister
EventUnregister
EventWrite
RegQueryValueExW

user32

GetSysColor
MessageBoxW
IsRectEmpty
CopyRect
GetSystemMetrics
GetFocus
DrawFrameControl
DrawTextW
DrawFocusRect
MoveWindow
GetKeyState
SetRectEmpty
LoadStringW
DrawEdge
SetDlgItemInt
SendDlgItemMessageW
GetDlgItemInt
SetWindowLongPtrW
LoadMenuW
EnableMenuItem
GetSubMenu
TrackPopupMenu
DestroyMenu
LoadAcceleratorsW
IsChild
IsWindowEnabled
TranslateMessage
DispatchMessageW
TranslateAcceleratorW
UnionRect
OpenClipboard
GetClipboardData
CloseClipboard
EmptyClipboard
SetClipboardData
SystemParametersInfoW
EnableWindow
GetDlgItemTextW
SetPropW
GetPropW
RemovePropW
CreateDialogParamW
GetAncestor
GetDialogBaseUnits
GetWindow
IsDialogMessageW
SetDlgItemTextW
CheckRadioButton
FrameRect
GetWindowLongW
LoadBitmapW
GetScrollPos
SetScrollRange
GetScrollRange
ScrollWindow
SetScrollPos
UpdateWindow
IsDlgButtonChecked
PtInRect
CreatePopupMenu
InsertMenuItemW
MapWindowPoints
TrackPopupMenuEx
GetActiveWindow
GetWindowLongPtrW
EndPaint
BeginPaint
SetCursor
ReleaseCapture
KillTimer
SetTimer
SetCapture
InvalidateRect
SetWindowPos
IntersectRect
InflateRect
EqualRect
CreateWindowExW
LoadCursorW
RegisterClassW
ShowWindow
SetParent
SetFocus
RegisterClipboardFormatW
SetRect
DestroyWindow
GetDesktopWindow
GetDC
CheckDlgButton
ReleaseDC
FillRect
OffsetRect
GetClientRect
GetWindowDC
SendMessageW
GetDlgItem
SetForegroundWindow
PostMessageW
SetWindowLongW
DefWindowProcW
GetParent
ClientToScreen
IsWindow
GetWindowRect
UnregisterClassW
IsWindowVisible

gdi32

SetMapMode
CloseMetaFile
DeleteMetaFile
RectVisible
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
GetStockObject
CreateBitmap
GetTextExtentPoint32W
SetTextAlign
SetBkMode
GetTextExtentPointW
Polyline
CreatePen
CreatePatternBrush
DeleteDC
GetTextFaceW
SelectObject
CreateCompatibleBitmap
CreateMetaFileW
CreateDCW
GetTextMetricsW
LineTo
DeleteObject
CreateRectRgn
CombineRgn
SetTextColor
SelectClipRgn
GetClipBox
PatBlt
SetBkColor
Rectangle
LPtoDP
SaveDC
RestoreDC
ExtTextOutW
CreateCompatibleDC
GetDeviceCaps
GetObjectW
CreateFontIndirectW
CreateSolidBrush
GdiFlush
TextOutW
CreateDIBSection
MoveToEx

ole32

ReleaseStgMedium
CreateStreamOnHGlobal
CreateDataAdviseHolder
WriteFmtUserTypeStg
CoGetMalloc
CoLockObjectExternal
CoTaskMemFree
CreateOleAdviseHolder
CreateBindCtx
OleRegEnumVerbs
OleRegGetUserType
OleRegGetMiscStatus
StringFromGUID2
CoCreateInstance
GetRunningObjectTable
CreateDataCache
RegisterDragDrop
RevokeDragDrop

oleaut32

SafeArrayCreateVector
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayDestroy
LoadTypeLi
LoadRegTypeLi
VariantTimeToSystemTime
SysStringLen
OleCreatePropertyFrameIndirect
SysAllocStringLen
OleCreatePropertyFrame
VariantChangeTypeEx
VariantClear
SysFreeString
SysAllocString
OleTranslateColor
OleCreateFontIndirect
DispGetIDsOfNames
VariantInit
VariantChangeType
SystemTimeToVariantTime

pdh

PdhSetDefaultRealTimeDataSource
PdhAddCounterW
PdhGetCounterInfoW
PdhRemoveCounter
PdhCalculateCounterFromRawValue
PdhEnumLogSetNamesW
PdhExpandWildCardPathHW
PdhCloseLog
PdhComputeCounterStatistics
PdhGetRawCounterValue
PdhCollectQueryDataWithTime
PdhSetQueryTimeRange
PdhBindInputDataSourceW
PdhGetDataSourceTimeRangeH
PdhMakeCounterPathW
PdhEnumObjectItemsHW
PdhEnumObjectsHW
PdhEnumMachinesHW
PdhRelogW
PdhTranslateLocaleCounterW
PdhTranslate009CounterW
PdhGetLogFileTypeW
PdhCloseQuery
PdhCollectQueryData
PdhOpenQueryH
PdhParseCounterPathW

shell32

CommandLineToArgvW
DragQueryFileW
DragFinish
DragAcceptFiles

odbc32

ord31
ord24
ord157
ord75

pdhui

PdhUiBrowseCountersExHW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 265KB - Virtual size: 264KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/fi-FI/sysntfy.dll
.dll windows x64

b1348f38cd34f0a6ab5b3f84e94e6948

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-crt-string-l1-1-0

memset
__isascii

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o___std_type_info_destroy_list
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
memcpy
_o__tolower
_o_isupper
_o__seh_filter_dll
__C_specific_handler

api-ms-win-core-heap-l1-1-0

HeapFree
HeapDestroy
HeapAlloc
HeapCreate

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

ntdll

NtOpenProcess
EtwGetTraceEnableFlags
NtQueryInformationToken
EtwGetTraceLoggerHandle
RtlEnterCriticalSection
EtwUnregisterTraceGuids
RtlInitializeCriticalSection
RtlLeaveCriticalSection
EtwRegisterTraceGuidsW
EtwTraceMessage
RtlDeleteCriticalSection
NtOpenProcessToken
EtwGetTraceEnableLevel
NtClose

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

SysNotifyStartServer
SysNotifyStopServer

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 280B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/fi-FI/sysprint.sep
OBS/Configuration/About/fi-FI/tls_branding_config.xml
OBS/Configuration/About/fi-FI/tlscsp.dll
.dll windows x64

622d7a69ad85cbdd8dc01277c8acbb2e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

memcmp
memcpy
_initterm
malloc
free
_amsg_exit
_XcptFilter
swprintf_s
__C_specific_handler
_callnewh
memset

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

bcrypt

BCryptEncrypt
BCryptCreateHash
BCryptHashData
BCryptImportKeyPair
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptOpenAlgorithmProvider
BCryptDestroyKey

kernel32

LeaveCriticalSection
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
DelayLoadFailureHook
ResolveDelayLoadedAPI
OpenMutexW
FreeLibrary
GetComputerNameW
GetProcAddress
CreateThread
LoadLibraryW
CloseHandle
SetEvent
GetLastError
Sleep
CreateEventW
ReleaseMutex
GetVersionExW
WaitForSingleObject
CreateMutexW
InitializeCriticalSection
DisableThreadLibraryCalls
DeleteCriticalSection
LocalAlloc
LocalFree
EnterCriticalSection

Exports

Exports

LsCsp_DecryptEnvelopedData
LsCsp_EncryptHwid
LsCsp_GetServerData
LsCsp_RetrieveSecret
LsCsp_StoreSecret
TLSCspInit
TLSCspShutdown
TLSCspStartInstallCertificateThread
TLSFreeTSCertificate
TLSGetTSCertificate

Sections

.text
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/fi-FI/tokenbinding.dll
.dll windows x64

b5024c4acac7f068948194f03a3c8adc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-string-l1-1-0

memset
wcscmp

api-ms-win-crt-private-l1-1-0

_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
memcpy
__C_specific_handler
_o___std_type_info_destroy_list
_o___stdio_common_vswprintf
wcsstr
memcmp

api-ms-win-eventing-classicprovider-l1-1-0

UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
TraceMessage
GetTraceEnableFlags
GetTraceLoggerHandle

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThread
OpenThreadToken
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
OpenProcessToken

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

bcrypt

BCryptVerifySignature
BCryptHashData
BCryptCreateHash
BCryptDestroyKey
BCryptDestroyHash
BCryptFinishHash
BCryptImportKeyPair

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockShared
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventRegister
EventUnregister
EventSetInformation

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoTaskMemFree

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW

api-ms-win-core-handle-l1-1-0

CloseHandle

rpcrt4

I_RpcExceptionFilter
RpcBindingBind
RpcBindingFree
NdrClientCall3
RpcBindingCreateW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

ntdll

NtClose
RtlFreeHeap
NtCreateFile
RtlAllocateHeap
RtlReleaseRelativeName
RtlDosPathNameToRelativeNtPathName_U
NtQueryInformationToken

Exports

Exports

TokenBindingDeleteAllBindings
TokenBindingDeleteBinding
TokenBindingGenerateBinding
TokenBindingGenerateID
TokenBindingGenerateMessage
TokenBindingGetHighestSupportedVersion
TokenBindingGetKeyTypesClient
TokenBindingGetKeyTypesServer
TokenBindingVerifyMessage

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/fi-FI/ttdloader.dll
.dll windows x64

cb95e61a39590eb4cf3cb880f49f0f5c

Code Sign

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03-07-2018 20:45

Not After

26-07-2019 20:45

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

71:09:1a:f9:96:e2:2f:3b:bb:e4:98:e0:23:85:f1:e2:55:4f:c6:c5:76:94:f3:0d:21:59:62:0f:78:c3:64:e8
Signer

Actual PE Digest

71:09:1a:f9:96:e2:2f:3b:bb:e4:98:e0:23:85:f1:e2:55:4f:c6:c5:76:94:f3:0d:21:59:62:0f:78:c3:64:e8

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

13-01-2023 12:41
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

NtDelayExecution

api-ms-win-core-errorhandling-l1-1-0

GetLastError

api-ms-win-core-processthreads-l1-1-0

ExitProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-libraryloader-l1-1-0

DisableThreadLibraryCalls
FreeLibrary
LoadLibraryExW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

Exports

Exports

InjectThread
ParametersBlock
StubDllEntry
ntdllLdrInitializeThunk

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/fi-FI/ttdplm.dll
.dll windows x64

0b98818ccf3918db5fa630458548793e

Code Sign

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03-07-2018 20:45

Not After

26-07-2019 20:45

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5a:55:97:32:c7:66:47:a3:d6:77:c0:47:1a:b2:4a:37:95:54:a1:75:87:ac:ee:13:9b:1a:bc:c8:40:22:7d:f7
Signer

Actual PE Digest

5a:55:97:32:c7:66:47:a3:d6:77:c0:47:1a:b2:4a:37:95:54:a1:75:87:ac:ee:13:9b:1a:bc:c8:40:22:7d:f7

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

13-01-2023 12:41
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-crt-locale-l1-1-0

_lock_locales
_unlock_locales

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__configure_narrow_argv
_o__crt_atexit
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__cexit
_o_abort
_o_free
_o_malloc
_o_terminate
_o_toupper
__C_specific_handler
_CxxThrowException
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vfprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___acrt_iob_func
__CxxFrameHandler3
memcpy
memmove

api-ms-win-core-file-l1-1-0

CreateDirectoryW
GetFileAttributesW

api-ms-win-core-libraryloader-l1-1-0

GetProcAddress
FreeLibrary
LoadLibraryExA
DisableThreadLibraryCalls

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetLastError
GetLastError
SetUnhandledExceptionFilter
RaiseException

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-com-l1-1-0

CoInitializeEx
CoCreateInstance
CoUninitialize

api-ms-win-core-registry-l1-1-0

RegGetKeySecurity
RegSetKeySecurity
RegGetValueW
RegQueryInfoKeyW
RegEnumKeyExW
RegCloseKey
RegOpenKeyExW

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetCurrentProcess
OpenProcessToken
GetCurrentThreadId

api-ms-win-core-processthreads-l1-1-1

OpenProcess
IsProcessorFeaturePresent

api-ms-win-security-base-l1-1-0

GetLengthSid
InitializeAcl
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetTokenInformation
GetSecurityDescriptorSacl
EqualSid
GetAce
SetSecurityDescriptorOwner
GetSecurityDescriptorOwner
GetAclInformation
AddAccessAllowedAceEx
AdjustTokenPrivileges
SetSecurityDescriptorDacl
GetSecurityDescriptorGroup
AddAce
SetFileSecurityW

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
LeaveCriticalSection

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemInfo

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-memory-l1-1-0

VirtualQuery
VirtualProtect

api-ms-win-appmodel-runtime-l1-1-0

GetPackageFullName

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoUninitialize
RoInitialize

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringLen
WindowsCreateStringReference
WindowsDeleteString
WindowsCreateString
WindowsGetStringRawBuffer

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW
LookupPrivilegeValueW

Exports

Exports

CreateModernAppToDelete
CreateModernAppToTrace
GetMaxPackageNameLength
GetPackageFromPid
SetPermisionsForFolder

Sections

.text
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/fi-FI/ttdrecord.dll
.dll windows x64

22f01878ef46bf98294d3f49ae99f0af

Code Sign

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03-07-2018 20:45

Not After

26-07-2019 20:45

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

50:17:ee:a1:e1:0f:a8:d2:b7:0c:ee:ef:fe:b3:3d:b7:25:26:e1:83:0c:97:6a:82:bc:50:9f:5f:e7:2c:e0:71
Signer

Actual PE Digest

50:17:ee:a1:e1:0f:a8:d2:b7:0c:ee:ef:fe:b3:3d:b7:25:26:e1:83:0c:97:6a:82:bc:50:9f:5f:e7:2c:e0:71

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

13-01-2023 12:41
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s
__stdio_common_vsnprintf_s
__stdio_common_vswprintf
fclose
__stdio_common_vfwprintf_s
fflush
__acrt_iob_func
__stdio_common_vfwprintf
__stdio_common_vswprintf_s
_wfopen
__stdio_common_vswscanf
_flushall
__stdio_common_vfprintf

api-ms-win-crt-string-l1-1-0

wcscpy_s
_wcslwr
wcsncmp
_wcsicmp
wcscmp
strcpy_s
_strnicmp

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_cexit
_register_onexit_function
_initterm_e
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
_initterm
_errno
_crt_atexit
abort
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_invalid_parameter_noinfo
terminate

ntdll

RtlVirtualUnwind
RtlPcToFileHeader
RtlInitUnicodeString
RtlLookupFunctionEntry
RtlUnwindEx
NtQueryInformationProcess
NtOpenDirectoryObject
NtQueryDirectoryObject
NtSetInformationProcess
RtlCaptureContext

api-ms-win-security-base-l1-1-0

GetTokenInformation
DuplicateTokenEx
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
AdjustTokenPrivileges
GetAclInformation
GetAce
SetSecurityDescriptorSacl
AddAccessAllowedAceEx
SetKernelObjectSecurity
GetKernelObjectSecurity
InitializeAcl
InitializeSecurityDescriptor
AddAce

api-ms-win-core-libraryloader-l1-1-0

GetModuleFileNameA
FreeLibraryAndExitThread
LoadLibraryExA
GetModuleHandleExW
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
FreeLibrary
GetModuleHandleW

api-ms-win-core-version-l1-1-0

VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW

api-ms-win-core-file-l1-1-0

CreateFileW
SetFilePointerEx
GetFileAttributesW
FindClose
FindFirstFileW
FlushFileBuffers
GetFullPathNameW
DeleteFileW

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegQueryValueExW

api-ms-win-core-synch-l1-1-0

SetWaitableTimer
OpenMutexW
DeleteCriticalSection
SetEvent
EnterCriticalSection
InitializeCriticalSectionEx
CreateEventW
CreateWaitableTimerExW
CreateMutexW
LeaveCriticalSection
ResetEvent
InitializeCriticalSection
OpenEventW
WaitForSingleObject
ReleaseMutex

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
UpdateProcThreadAttribute
ProcessIdToSessionId
ResumeThread
TlsAlloc
TlsSetValue
SuspendThread
CreateThread
TlsFree
DeleteProcThreadAttributeList
CreateProcessW
OpenThread
TerminateProcess
OpenProcessToken
GetExitCodeProcess
InitializeProcThreadAttributeList
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-errorhandling-l1-1-0

GetLastError
RaiseException
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-processenvironment-l1-1-0

GetCurrentDirectoryW
GetStdHandle

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringA
OutputDebugStringW
IsDebuggerPresent

rpcrt4

RpcStringFreeW
UuidToStringW
UuidCreate

api-ms-win-core-debug-l1-1-1

DebugActiveProcessStop

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetLocalTime
GetVersionExW
GetSystemDirectoryW
GetSystemTimeAsFileTime

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-processthreads-l1-1-1

OpenProcess
IsProcessorFeaturePresent

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-console-l1-1-0

GetConsoleMode

api-ms-win-core-localization-l1-2-0

FormatMessageW

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

api-ms-win-core-psapi-l1-1-0

K32EnumProcesses

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer

crypt32

CryptStringToBinaryW

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead
InterlockedFlushSList

api-ms-win-core-fibers-l1-1-0

FlsGetValue
FlsFree
FlsAlloc
FlsSetValue

api-ms-win-core-util-l1-1-0

EncodePointer

api-ms-win-core-kernel32-legacy-l1-1-0

LoadLibraryW
GetConsoleWindow
WaitForMultipleObjects
GetSystemWow64DirectoryW

api-ms-win-security-provider-l1-1-0

GetNamedSecurityInfoW
SetEntriesInAclW
SetNamedSecurityInfoW

api-ms-win-core-toolhelp-l1-1-0

CreateToolhelp32Snapshot
Process32FirstW
Process32NextW

api-ms-win-core-heap-obsolete-l1-1-0

LocalAlloc
GlobalFree
GlobalAlloc
LocalFree

api-ms-win-crt-heap-l1-1-0

free
_callnewh
_calloc_base
_free_base
malloc

api-ms-win-core-memory-l1-1-0

OpenFileMappingW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

TTDAttachGuestProcess
TTDCloseGuestObject
TTDCreateNonInteractiveWaitEventName
TTDEnumerateTracingProcesses
TTDExecutingInOneCore
TTDGetExecutableNameFromCommandLine
TTDGetLogFilenameFromGuestProcess
TTDGetNirvanaClientPathW
TTDGetProcessImageName
TTDGetVersionedName
TTDGuestObjectInfo
TTDLaunchGuestProcess
TTDSendMarkerToGuestProcess
TTDSendMessageToGuestProcess
TTDSetDebuggerImageFileExecutionOptions
TTDWaitForGuestObjects

Sections

.text
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/fi-FI/ttdrecordcpu.dll
.dll windows x64

0f854b1c3d856b14f45c54ed3fc27fab

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02-05-2019 21:24

Not After

02-05-2020 21:24

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

15:bc:26:c7:bf:0f:e6:83:5f:9d:2c:9a:98:85:ba:f3:7e:9d:ee:06:b1:d7:e6:97:49:70:11:59:67:0c:17:9b
Signer

Actual PE Digest

15:bc:26:c7:bf:0f:e6:83:5f:9d:2c:9a:98:85:ba:f3:7e:9d:ee:06:b1:d7:e6:97:49:70:11:59:67:0c:17:9b

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

13-01-2023 12:41
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-libraryloader-l1-1-0

GetModuleHandleW

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

ntdll

RtlDosPathNameToRelativeNtPathName_U_WithStatus
RtlReleaseRelativeName
RtlFreeHeap
RtlAllocateHeap
RtlQueryPerformanceFrequency
RtlQueryPerformanceCounter
LdrGetProcedureAddress
RtlInitString
RtlNtStatusToDosError
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnwindEx
RtlPcToFileHeader

Exports

Exports

ClearClientTlsValueForThreadId
EndRandomSample
FlushCodeCaches
GetClientTlsValueForThreadId
GetInstructionCounts
GetRandomSampleSequence
GetRegisterOffsets
InitializeSmartCpu
InitializeSmartCpuClient
IsEmulatingCurrentThread
IsSimulating
RegisterContextInstrumentationCallbacks
RegisterInstrumentationCallbacks
RegisterRecordCallbacks
RequestUnhookedFunctions
ResetMaxInstructionsToEmulate
ResumeSimulation
RunCallbackWithSmartContextForThreadByHandle
SetClientTlsValueForCurrentThread
SetClientTlsValueForThreadByHandle
SetClientTlsValueForThreadContext
SetRandomSampling
SetRuntimeOptions
SetThreadNative
SmartEnterSync
StartBacktrace
StartEmulatingCurrentThread
StopEmulatingCurrentThread
SyncGuestMachineState
TryPauseSimulation
g_debugOffsetInfo

Sections

.text
Size: 680KB - Virtual size: 680KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 519KB - Virtual size: 519KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 248KB - Virtual size: 583KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/fi-FI/ttdwriter.dll
.dll windows x64

5a1e6ac1279304f1466ef79e48e88823

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02-05-2019 21:24

Not After

02-05-2020 21:24

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

21:17:f5:c5:75:df:54:40:0f:b4:18:2d:a5:5a:42:62:ae:6c:c8:4b:2c:9b:de:d9:ec:3f:8e:a0:69:ee:d6:10
Signer

Actual PE Digest

21:17:f5:c5:75:df:54:40:0f:b4:18:2d:a5:5a:42:62:ae:6c:c8:4b:2c:9b:de:d9:ec:3f:8e:a0:69:ee:d6:10

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

13-01-2023 12:41
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-libraryloader-l1-1-0

GetModuleHandleW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

ntdll

RtlNtStatusToDosError
RtlInitString
RtlCaptureContext
RtlLockHeap
RtlUnlockHeap
RtlQueryPerformanceCounter
RtlWalkHeap
RtlGetProcessHeaps
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnwindEx
RtlPcToFileHeader
LdrGetProcedureAddress

ttdrecordcpu

RequestUnhookedFunctions
GetRegisterOffsets
SetThreadNative
StartBacktrace
TryPauseSimulation
RunCallbackWithSmartContextForThreadByHandle
SyncGuestMachineState
IsEmulatingCurrentThread
IsSimulating
RegisterRecordCallbacks
GetInstructionCounts
FlushCodeCaches
ResetMaxInstructionsToEmulate
SetRuntimeOptions
ResumeSimulation
ClearClientTlsValueForThreadId
StartEmulatingCurrentThread
RegisterContextInstrumentationCallbacks
RegisterInstrumentationCallbacks
StopEmulatingCurrentThread
SetClientTlsValueForThreadContext
InitializeSmartCpuClient
GetClientTlsValueForThreadId

Exports

Exports

AddMemoryRegionToIgnore
InitializeNirvanaClient
NirvMain
OpenWriter
TtdWriterAddCustomEvent
TtdWriterDumpHeaps
TtdWriterDumpModuleData
TtdWriterDumpSnapshot
TtdWriterGetFileName
TtdWriterGetState
TtdWriterGetThrottleState
TtdWriterRelease
TtdWriterResetThrottle
TtdWriterResumeRecording
TtdWriterStartRecordingCurrentThread
TtdWriterStopRecordingCurrentThread
TtdWriterTryPauseRecording

Sections

.text
Size: 216KB - Virtual size: 215KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/fi-FI/tvratings.dll
.dll regsvr32 windows x64

8a1894de7fb6e4e5ecbb1e26c4917f50

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_callnewh
malloc
_XcptFilter
wcscpy_s
__C_specific_handler
_lock
_amsg_exit
?terminate@@YAXXZ
_initterm
_unlock
__CxxFrameHandler3
__dllonexit
_onexit
free
memcmp
memset

kernel32

LoadLibraryExW
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
Sleep
GetTickCount
lstrcpyW
FreeLibrary
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleFileNameW
GetLastError
DisableThreadLibraryCalls
HeapDestroy

user32

CharNextW

ole32

CoCreateInstance

oleaut32

SysStringLen
SysFreeString
LoadRegTypeLi
SysAllocString
LoadTypeLi
RegisterTypeLi

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 196B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/fi-FI/twext.dll
.dll windows x64

42dc17682874120021b03a100bf57a6e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

memcpy
memcmp
_vsnwprintf
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
_get_errno
_set_errno
wcschr
wcsstr
memcpy_s
memmove_s
wcsncmp
wcsrchr
memmove
memset

shell32

ord102
SHCreateDefaultExtractIcon
SHCreateDefaultContextMenu
ord25
SHParseDisplayName
SHGetIDListFromObject
ord16
ord152
SHBindToParent
SHBindToFolderIDListParentEx
ord788
SHCreateItemFromParsingName
ord153
SHGetItemFromDataObject
ShellExecuteExW
SHGetKnownFolderPath
ord850
SHCreateShellItemArray
ord18
ord789
ord256
ord740
ord17
SHBindToObject
SHCreateItemFromIDList
SHCreateItemWithParent
ord19
ord155

shlwapi

ord540
PathFindFileNameW
ord172
ord199
ord176
ord615
StrPBrkW
PathIsUNCServerW
ord344
StrChrW
StrIsIntlEqualW
ord154
PathBuildRootW
StrCmpIW
PathGetDriveNumberW
ord158
ord174
ord215
ord437
ord388
ord354
PathRemoveBackslashW
StrRetToStrW
ord175
SHSkipJunction
ord169
ord268
ord267
ord476
StrRetToBufW
PathIsUNCW
PathRemoveFileSpecW
PathIsNetworkPathW
SHStrDupW
ord219
ord271
ord619

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
GetModuleFileNameW
GetModuleHandleW
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleExW
LoadStringW
LoadStringA
FindResourceExW
LockResource
LoadResource
GetProcAddress

api-ms-win-core-synch-l1-1-0

CreateMutexExW
AcquireSRWLockExclusive
SetEvent
ReleaseSemaphore
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
ResetEvent
CreateEventW
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
CreateSemaphoreExW
ReleaseSRWLockShared
AcquireSRWLockShared
DeleteCriticalSection
OpenSemaphoreW
WaitForSingleObjectEx
WaitForSingleObject
ReleaseMutex

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-com-l1-1-0

CoEnableCallCancellation
CoInitializeEx
CoUninitialize
PropVariantClear
CoWaitForMultipleHandles
CoTaskMemFree
StringFromGUID2
CoCancelCall
CoDisableCallCancellation
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoGetMalloc

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformationForYear
FileTimeToSystemTime
TzSpecificLocalTimeToSystemTime
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime

api-ms-win-core-path-l1-1-0

PathCchRemoveBackslash
PathCchAppendEx
PathCchRemoveFileSpec
PathAllocCombine
PathIsUNCEx
PathCchSkipRoot
PathCchIsRoot
PathCchAppend

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetComputerNameExW
GetVersionExW
GetTickCount

api-ms-win-core-file-l1-1-0

GetFileAttributesW
CreateFileW
GetFileInformationByHandle
GetFileAttributesExW
GetDriveTypeW
GetVolumePathNameW
CompareFileTime

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventWriteTransfer
EventUnregister
EventRegister

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
Sleep
InitOnceComplete

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegCloseKey

kernel32

GetComputerNameW
CreateActCtxW
ReleaseActCtx
ActivateActCtx
DeactivateActCtx
lstrlenW
lstrcmpiW
MulDiv
DeleteTimerQueueTimer
CreateTimerQueueTimer

ntdll

RtlNtStatusToDosError
NtFsControlFile
WinSqmAddToStream
NtQueryInformationFile

propsys

PSGetPropertyDescriptionListFromString
PSPropertyBag_ReadBOOL
PSPropertyBag_ReadDWORD
PSPropertyBag_ReadBSTR
PSFormatForDisplay
VariantToPropVariant
PSPropertyBag_WriteDWORD
VariantCompare
PSCreateMultiplexPropertyStore
InitPropVariantFromResource
PSCreateMemoryPropertyStore
InitVariantFromFileTime
VariantToBuffer
PropVariantCompareEx
PropVariantToStringAlloc
PSPropertyBag_WriteStr
PSPropertyBag_WriteBOOL

user32

CreatePopupMenu
SetMenuItemInfoW
RedrawWindow
TrackPopupMenu
ClientToScreen
SetWindowLongPtrW
GetWindowLongPtrW
EnableWindow
GetFocus
MoveWindow
MapWindowPoints
GetWindowRect
KillTimer
GetSystemMetrics
GetClientRect
SetTimer
PostMessageW
GetDlgItem
SetWindowPos
GetWindowLongW
SetWindowLongW
SetDlgItemTextW
InsertMenuItemW
AppendMenuW
DeleteMenu
GetMenuItemCount
GetMenuItemInfoW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 232B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/fi-FI/windows.ui.xaml.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/fi-FI/xpsfilt.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/fi-FI/xpsrchvw.exe.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 85KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/About/userinitext.dll
.dll windows x64

0469faa6d4139c5b99bea97181f8b52d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_vsnwprintf
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
memset

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegQueryValueExW
RegDeleteTreeW
RegSetValueExW
RegOpenKeyExW
RegCloseKey

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
SetCurrentDirectoryW

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetUserDefaultLangID

userenv

ord175

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-synch-l1-1-0

OpenEventW
SetEvent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-0

LoadStringW
GetProcAddress
LoadLibraryExW
FreeLibrary

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

ntdll

RtlInitUnicodeString
NtOpenKey
NtClose
DbgPrint

user32

MessageBoxW
LoadRemoteFonts
GetSystemMetrics
ExitWindowsEx
GetKeyboardLayout
SystemParametersInfoW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

CreateExplorerSessionKey
DisplayMessageAndExitWindows
ImmWorker
IsSubDesktopSession
IsTSAppCompatOn
LoadRemoteFontsAndInitMiscWorker
PerformXForestLogonCheck
ProcesRemoteSessionInitialCommand
ProcessTermSrvIniFiles
SetShellDesktopSwitchEvent
SetupHotKeyForKeyboardLayout
UserinitExt

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 468B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/usermgr.dll
.dll windows x64

583322f783e574d5a40b0d18c1ca340c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

?terminate@@YAXXZ
_lock
malloc
_unlock
__dllonexit
free
_amsg_exit
_XcptFilter
memmove_s
_vsnprintf_s
memcmp
__C_specific_handler
_get_current_locale
__crtLCMapStringW
_wcsdup
abort
calloc
__pctype_func
memset
_ismbblead
___lc_codepage_func
___lc_handle_func
___mb_cur_max_func
setlocale
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
_purecall
??3@YAXPEAX@Z
memcpy_s
_vsnwprintf
??_V@YAXPEAX@Z
??1type_info@@UEAA@XZ
_free_locale
_initterm
__CxxFrameHandler3
_onexit
_wcsicmp
_ui64tow_s
realloc
_wtoi
wcsstr
_errno
wcstol
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBD@Z
sprintf_s
??0bad_cast@@QEAA@AEBV0@@Z
??1bad_cast@@UEAA@XZ
??0bad_cast@@QEAA@PEBD@Z
localeconv
strcspn
_wtol
_wcsnicmp
wcschr
_set_errno
_get_errno
_vscwprintf
rand
swprintf_s
wcsnlen
toupper
_callnewh
??0exception@@QEAA@AEBQEBDH@Z
_CxxThrowException
memcpy
memmove
__uncaught_exception
wcscmp

shcore

CreateRandomAccessStreamOverStream
SHTaskPoolAllowThreadReuse
CreateStreamOverRandomAccessStream
SHTaskPoolQueueTask

api-ms-win-core-com-l1-1-0

CoRegisterClassObject
CoGetMalloc
CoIncrementMTAUsage
CoEnableCallCancellation
CoCopyProxy
CoInitializeSecurity
CoCreateGuid
CoTaskMemRealloc
StringFromCLSID
CoSetProxyBlanket
CoCreateFreeThreadedMarshaler
CoGetInterfaceAndReleaseStream
PropVariantClear
CreateStreamOnHGlobal
CoWaitForMultipleHandles
CoCreateInstance
CoMarshalInterface
CoDisconnectContext
CoTaskMemFree
CoGetCallContext
CoDecrementMTAUsage
CoTaskMemAlloc
CoResumeClassObjects
CoRevertToSelf
CoDisableCallCancellation
CoReleaseMarshalData
CoGetApartmentType
CoRevokeClassObject
CoAddRefServerProcess
CoReleaseServerProcess
CoGetCancelObject
CoImpersonateClient

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetModuleHandleExW
FreeLibrary
GetModuleFileNameA
GetProcAddress
LoadLibraryExW

api-ms-win-security-base-l1-1-0

CreateWellKnownSid
AccessCheckByType
IsValidSid
ImpersonateLoggedOnUser
PrivilegeCheck
SetTokenInformation
DuplicateTokenEx
AccessCheck
CheckTokenMembership
AdjustTokenPrivileges
FreeSid
CreateRestrictedToken
AllocateLocallyUniqueId
AllocateAndInitializeSid
CopySid
RevertToSelf
GetLengthSid
DuplicateToken
MakeAbsoluteSD
GetTokenInformation

api-ms-win-core-synch-l1-1-0

SetEvent
ReleaseSRWLockExclusive
CreateEventW
WaitForSingleObjectEx
TryAcquireSRWLockExclusive
WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection
ReleaseSemaphore
EnterCriticalSection
CreateEventExW
CreateSemaphoreExW
OpenSemaphoreW
ReleaseSRWLockShared
AcquireSRWLockExclusive
CreateMutexExW
AcquireSRWLockShared
InitializeSRWLock
DeleteCriticalSection
ReleaseMutex

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

SetLastError
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsDuplicateString
WindowsCompareStringOrdinal
WindowsConcatString
WindowsDeleteString
WindowsIsStringEmpty
WindowsCreateStringReference
WindowsStringHasEmbeddedNull
WindowsCreateString
WindowsPreallocateStringBuffer
WindowsGetStringLen
WindowsPromoteStringBuffer
WindowsDeleteStringBuffer

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSidToSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-eventing-provider-l1-1-0

EventProviderEnabled
EventActivityIdControl
EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
SubmitThreadpoolWork
CloseThreadpoolTimer
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolWork

api-ms-win-core-processthreads-l1-1-0

CreateProcessAsUserW
CreateThread
ResumeThread
OpenThreadToken
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetProcessId
GetCurrentThreadId
OpenProcessToken
GetCurrentThread
ProcessIdToSessionId

api-ms-win-core-winrt-l1-1-0

RoRevokeActivationFactories
RoGetActivationFactory
RoUninitialize
RoRegisterActivationFactories
RoActivateInstance
RoInitialize

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo
RoOriginateError
GetRestrictedErrorInfo
RoTransformError
RoOriginateErrorW

api-ms-win-core-synch-l1-2-0

WaitOnAddress
Sleep
WakeByAddressSingle
WakeAllConditionVariable
InitOnceComplete
InitOnceBeginInitialize
InitOnceExecuteOnce
SleepConditionVariableSRW

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-sysinfo-l1-1-0

GetComputerNameExW
GetSystemTimeAsFileTime
GetTickCount
GetTickCount64

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-service-core-l1-1-0

SetServiceStatus
RegisterServiceCtrlHandlerExW

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-eventing-controller-l1-1-0

EnableTraceEx2
ControlTraceW
StartTraceW

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
RegCloseKey
RegDeleteTreeW
RegOpenKeyExA
RegEnumValueW
RegQueryValueExA
RegOpenKeyExW
RegFlushKey
RegGetValueW
RegCreateKeyExW

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree
LocalReAlloc

api-ms-win-core-string-l1-1-0

GetStringTypeW
CompareStringOrdinal
WideCharToMultiByte
MultiByteToWideChar

bcrypt

BCryptDestroyHash
BCryptFinishHash
BCryptCreateHash
BCryptGetProperty
BCryptHashData

crypt32

CryptBinaryToStringW

rpcrt4

I_RpcMapWin32Status
NdrClientCall3
I_RpcExceptionFilter
RpcBindingFree
RpcBindingFromStringBindingW
RpcRevertToSelf
RpcImpersonateClient
RpcServerInqCallAttributesW
RpcStringBindingComposeW
RpcSsDestroyClientContext
NdrServerCallAll
NdrServerCall2
RpcStringFreeW
RpcEpUnregister
RpcServerUnregisterIf
RpcEpRegisterW
RpcServerRegisterIf3
RpcBindingCreateW
RpcBindingVectorFree
RpcBindingBind
RpcServerUseProtseqW
RpcServerInqBindings

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
RoReportFailedDelegate

api-ms-win-core-processthreads-l1-1-1

OpenProcess

sspicli

SeciFreeCallContext
LsaDeregisterLogonProcess
SeciAllocateAndSetCallFlags
LsaLogonUser
LsaFreeReturnBuffer
SeciAllocateAndSetIPAddress
LsaRegisterLogonProcess
GetUserNameExW
LsaConnectUntrusted
LsaCallAuthenticationPackage
LogonUserExExW
LsaLookupAuthenticationPackage

userenv

GetDefaultUserProfileDirectoryW
UnloadUserProfile
CreateProfile
DeleteProfileW
GetUserProfileDirectoryW
LoadUserProfileW

api-ms-win-security-lsalookup-l2-1-0

LookupAccountNameW

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW
RegSetKeyValueW

oleaut32

VariantClear
SysAllocString
SysFreeString
VariantInit

api-ms-win-core-file-l1-1-0

GetFileSizeEx
WriteFile
CreateFileW
ReadFile

logoncli

DsGetDcNameW

wldap32

ord16
ord41
ord18
ord208
ord13
ord140
ord88
ord73
ord224
ord145

api-ms-win-security-base-l1-2-0

CheckTokenCapability
CheckTokenMembershipEx

api-ms-win-security-credentials-l1-1-0

CredProtectW

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem
UnregisterWaitEx

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

api-ms-win-core-kernel32-legacy-l1-1-0

MulDiv
RegisterWaitForSingleObject

api-ms-win-security-provider-l1-1-0

GetSecurityInfo
SetSecurityInfo

api-ms-win-core-heap-obsolete-l1-1-0

LocalSize

api-ms-win-service-private-l1-1-0

I_ScBroadcastServiceControlMessage

api-ms-win-security-base-private-l1-1-1

CreateAppContainerToken

profapi

ord102
ord101

api-ms-win-core-winrt-propertysetprivate-l1-1-1

RoCreatePropertySetSerializer

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

ntdll

RtlGetNtProductType
RtlSubAuthoritySid
RtlNtStatusToDosErrorNoTeb
RtlCompareUnicodeString
RtlAdjustPrivilege
EtwTraceMessage
RtlCopySid
RtlGetDaclSecurityDescriptor
NtQuerySecurityObject
NtCreateFile
RtlCreateSecurityDescriptor
NtCreateSymbolicLinkObject
RtlFreeSid
NtOpenDirectoryObject
RtlAllocateAndInitializeSid
RtlAddAccessAllowedAceEx
NtSetInformationToken
RtlConvertSidToUnicodeString
RtlSetDaclSecurityDescriptor
NtCreateDirectoryObjectEx
RtlDeriveCapabilitySidsFromName
RtlRunOnceExecuteOnce
RtlQueryRegistryValuesEx
RtlAllocateHeap
RtlSubAuthorityCountSid
RtlAddAccessAllowedAce
RtlAddAce
RtlGetAce
RtlCreateAcl
RtlQueryInformationAcl
RtlLengthSid
RtlCapabilityCheck
NtQueryInformationToken
NtSetInformationProcess
RtlSetProcessIsCritical
RtlCheckSandboxedToken
RtlInitUnicodeString
NtClose
RtlNtStatusToDosError
RtlEqualSid
RtlIsCapabilitySid
RtlValidSid
NtCompareTokens
RtlSubscribeWnfStateChangeNotification
RtlQueryWnfStateData
NtAllocateLocallyUniqueId
RtlInitString
RtlIsMultiSessionSku
RtlGetDeviceFamilyInfoEnum
RtlUnsubscribeWnfStateChangeNotification
RtlGetCurrentServiceSessionId
RtlPublishWnfStateData
NtQuerySystemInformation
NtOpenFile
NtDeviceIoControlFile
RtlFreeHeap

combase

ord68
ord69
ord67
ord66

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

ServiceMain

Sections

.text
Size: 649KB - Virtual size: 648KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 517KB - Virtual size: 517KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/usermgrcli.dll
.dll windows x64

0a51776914df4877e7c224045a441731

Code Sign

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03-07-2018 20:45

Not After

26-07-2019 20:45

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e1:7b:85:34:41:2c:81:2b:c8:b8:51:8b:52:80:74:73:23:82:97:58:ee:68:18:4e:03:1e:ee:4e:b2:a5:fa:33
Signer

Actual PE Digest

e1:7b:85:34:41:2c:81:2b:c8:b8:51:8b:52:80:74:73:23:82:97:58:ee:68:18:4e:03:1e:ee:4e:b2:a5:fa:33

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

13-01-2023 12:41
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

memcpy
__CxxFrameHandler3
?what@exception@@UEBAPEBDXZ
_vsnprintf_s
memmove
malloc
_XcptFilter
??0exception@@QEAA@AEBV0@@Z
_amsg_exit
??0exception@@QEAA@XZ
free
_initterm
??1exception@@UEAA@XZ
_CxxThrowException
_lock
_callnewh
??0exception@@QEAA@AEBQEBD@Z
_unlock
??1type_info@@UEAA@XZ
??0exception@@QEAA@AEBQEBDH@Z
_purecall
??3@YAXPEAX@Z
memcpy_s
_onexit
_vsnwprintf
__C_specific_handler
__dllonexit
memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExW
GetProcAddress

api-ms-win-core-synch-l1-1-0

ReleaseSemaphore
CreateMutexExW
CreateSemaphoreExW
WaitForSingleObject
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseMutex

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-errorhandling-l1-1-0

SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
OpenProcessToken
GetCurrentProcessId
GetCurrentThreadId

rpcrt4

RpcBindingFree
RpcBindingFromStringBindingW
RpcStringBindingComposeW
I_RpcExceptionFilter
RpcBindingSetAuthInfoExW
RpcStringFreeW
NdrClientCall3

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-security-base-l1-1-0

CreateWellKnownSid

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

ntdll

RtlIsMultiSessionSku
RtlGetCurrentServiceSessionId

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

CamCleanupDisardedCandidateAccounts
CamConnectCandidateUser
CamFreeAuthBuffer
CamFreeBuffer
CamGetCandidateAccountCredz
CamGetCandidateUserSessionIds
CamGetNonCandidateUserSessionIds
CamIsCandidateUser
CamIsEphemeralCandidateUser
CamRefreshCandidateUser
IsInteractiveUserSession
QueryActiveSession
QueryUserToken
RegisterUsertokenForNoWinlogon
UMgrChangeSessionActiveShellUser
UMgrChangeSessionUserToken
UMgrClearDefaultSignInAccount
UMgrConnectLocalUser
UMgrDisconnectLocalUser
UMgrEnumerateSessionUsers
UMgrFreeSessionUsers
UMgrFreeUserCredentials
UMgrGetCachedCredentials
UMgrGetConstrainedUserToken
UMgrGetDefaultSignInAccount
UMgrGetImpersonationTokenForContext
UMgrGetSessionActiveShellUserToken
UMgrInformFlags
UMgrInformUserLogoff
UMgrInformUserLogon
UMgrIsAllowedToActivateAsUser
UMgrLaunchShell
UMgrLaunchShellInfrastructureHost
UMgrLogonUser
UMgrOpenProcessHandleForAccess
UMgrOpenProcessTokenForQuery
UMgrQueryDefaultAccountToken
UMgrQuerySessionUserToken
UMgrQuerySessionVirtualAccountToken
UMgrQueryUserContext
UMgrQueryUserContextFromName
UMgrQueryUserContextFromSid
UMgrQueryUserToken
UMgrQueryUserTokenFromName
UMgrQueryUserTokenFromSid
UMgrSetCachedCredentials
UMgrSetShellInformation
UMgrpGetRegistryLocation

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 908B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/About/usoapi.dll
.dll windows x64

74ca3e5fa2f0f222ae1c0e398e4934bb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-crt-string-l1-1-0

memset
wcscmp

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
memcmp
_o_free
_o_malloc
_o_terminate
_o_wcsncpy_s
_CxxThrowException
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__execute_onexit_table
_o__errno
memcpy
__C_specific_handler
__std_terminate
__CxxFrameHandler3

oleaut32

SystemTimeToVariantTime
SysFreeString
BSTR_UserSize
VARIANT_UserSize64
BSTR_UserMarshal64
VARIANT_UserMarshal64
BSTR_UserFree
SysStringLen
LoadRegTypeLi
VariantClear
VariantInit
BSTR_UserUnmarshal64
VARIANT_UserFree
VARIANT_UserUnmarshal
LoadTypeLi
VARIANT_UserSize
BSTR_UserSize64
BSTR_UserFree64
BSTR_UserUnmarshal
VARIANT_UserMarshal
BSTR_UserMarshal
VarUI4FromStr
VARIANT_UserUnmarshal64
VARIANT_UserFree64

rpcrt4

CStdStubBuffer_DebugServerRelease
NdrOleAllocate
CStdStubBuffer_QueryInterface
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
CStdStubBuffer_Disconnect
IUnknown_QueryInterface_Proxy
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
NdrDllCanUnloadNow
NdrDllGetClassObject
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
CStdStubBuffer_Connect
NdrStubForwardingFunction
NdrStubCall3
NdrCStdStubBuffer_Release
NdrCStdStubBuffer2_Release
CStdStubBuffer_CountRefs

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient11
ObjectStublessClient14
CStdStubBuffer2_Connect
ObjectStublessClient22
CStdStubBuffer2_QueryInterface
CStdStubBuffer2_Disconnect
CStdStubBuffer2_CountRefs
ObjectStublessClient3
ObjectStublessClient25
ObjectStublessClient4
ObjectStublessClient31
ObjectStublessClient27
ObjectStublessClient18
ObjectStublessClient12
ObjectStublessClient13
ObjectStublessClient21
ObjectStublessClient28
ObjectStublessClient29
ObjectStublessClient6
ObjectStublessClient20
ObjectStublessClient15
ObjectStublessClient16
ObjectStublessClient30
ObjectStublessClient5
ObjectStublessClient8
ObjectStublessClient23
ObjectStublessClient24
ObjectStublessClient10
ObjectStublessClient17
ObjectStublessClient26
ObjectStublessClient7
ObjectStublessClient9
ObjectStublessClient19

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
LoadResource
FreeLibrary
FindResourceExW
GetModuleFileNameA
SizeofResource
GetProcAddress
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameW
GetModuleHandleExW

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-errorhandling-l1-1-0

SetLastError
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
RaiseException

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
ReleaseSemaphore
ReleaseMutex
WaitForSingleObject
WaitForSingleObjectEx
OpenSemaphoreW
CreateSemaphoreExW
CreateMutexExW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetCurrentProcessId

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-service-management-l2-1-0

ChangeServiceConfig2W
QueryServiceConfig2W
ChangeServiceConfigW
QueryServiceConfigW

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenSCManagerW
StartServiceW
OpenServiceW

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-security-base-l1-1-0

GetTokenInformation
DuplicateTokenEx
FreeSid
CheckTokenMembership
AllocateAndInitializeSid

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

api-ms-win-core-synch-l1-2-0

Sleep

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/Unistore.dll
.dll windows x64

0509eb9c40d6b27d0f83261e3b4ecc93

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
__CxxFrameHandler3
_callnewh
malloc
free
_vsnprintf
strtoul
_wcsnicmp
wcstol
wcscspn
wcsrchr
_wcsicmp
memcpy_s
memset
memmove
memcmp
_purecall
_vsnwprintf
strrchr
strcpy_s
memcpy
__C_specific_handler
wcscmp

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
ReleaseMutex
OpenEventW
ReleaseSemaphore
LeaveCriticalSection
CreateEventW
InitializeSRWLock
InitializeCriticalSectionEx
DeleteCriticalSection
ReleaseSRWLockShared
SetEvent
WaitForSingleObjectEx
WaitForSingleObject
AcquireSRWLockExclusive
AcquireSRWLockShared
InitializeCriticalSection
CreateMutexExW
ReleaseSRWLockExclusive
CreateSemaphoreExW
OpenSemaphoreW

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
SetLastError

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventRegister
EventUnregister
EventWrite
EventWriteTransfer

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc
LocalReAlloc

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
LoadLibraryExW
GetModuleHandleW
LoadStringW
DisableThreadLibraryCalls
GetModuleFileNameA
GetProcAddress
GetModuleHandleExW

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegFlushKey
RegOpenKeyExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegGetValueW

api-ms-win-core-path-l1-1-0

PathAllocCombine
PathCchCombine

api-ms-win-core-file-l1-1-0

GetFileAttributesW
WriteFile
GetTempFileNameW
DeleteFileW
CompareFileTime
FindFirstFileExW
FindFirstFileW
FindNextFileW
RemoveDirectoryW
CreateDirectoryW
GetFileSize
ReadFile
SetEndOfFile
FindClose
CreateFileW
SetFilePointer

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringW

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
SetThreadPriority
GetThreadPriority
GetCurrentProcess
GetCurrentThread
TlsSetValue
GetProcessId
TlsGetValue
TlsFree
TlsAlloc
TerminateProcess
SetThreadToken
GetCurrentProcessId
OpenThreadToken

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-localization-l1-2-0

GetSystemDefaultLCID
FormatMessageW

api-ms-win-security-base-l1-1-0

GetSidSubAuthorityCount
GetTokenInformation
GetSidSubAuthority

api-ms-win-core-synch-l1-2-0

InitOnceComplete
Sleep
InitializeConditionVariable
SleepConditionVariableCS
InitOnceBeginInitialize
WakeAllConditionVariable

esent

JetRetrieveKey
JetCreateInstance2W
JetAddColumnA
JetSetSystemParameterA
JetSetSystemParameterW
JetMove
JetBeginTransaction
JetSetColumns
JetGetTableIndexInfoA
JetRetrieveColumns
JetBeginSessionA
JetRetrieveColumn
JetEndSession
JetGetBookmark
JetMakeKey
JetCreateDatabaseW
JetDelete
JetResetSessionContext
JetCloseDatabase
JetCreateTableColumnIndex3A
JetGetTableColumnInfoA
JetBackupInstanceW
JetDeleteIndexA
JetSetCurrentIndexA
JetIdle
JetSetSessionContext
JetGetResourceParam
JetGetSessionParameter
JetGotoBookmark
JetCreateIndex3A
JetOpenTableW
JetResizeDatabase
JetStopServiceInstance
JetEnumerateColumns
JetEscrowUpdate
JetConvertDDLA
JetGetSecondaryIndexBookmark
JetUpdate
JetCloseTable
JetSetCurrentIndex2A
JetPrepareUpdate
JetBeginTransaction2
JetCommitTransaction2
JetGetErrorInfoW
JetCommitTransaction
JetDetachDatabaseA
JetIndexRecordCount
JetSeek
JetTerm2
JetRollback
JetInit2
JetAttachDatabaseW
JetGotoSecondaryIndexBookmark
JetSetIndexRange
JetOpenDatabaseW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFileExistsW

api-ms-win-shell-shdirectory-l1-1-0

ord290

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetTickCount64

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolCleanupGroup
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWork
CreateThreadpoolTimer
SubmitThreadpoolWork
CreateThreadpoolWork
IsThreadpoolTimerSet
CloseThreadpoolWait
CloseThreadpoolCleanupGroup
CloseThreadpool
SetThreadpoolThreadMaximum
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolWait
CreateThreadpoolWait
FreeLibraryWhenCallbackReturns
CloseThreadpoolTimer
CreateThreadpool

ntdll

RtlIsCriticalSectionLockedByThread
RtlNtStatusToDosError
RtlGetThreadWorkOnBehalfTicket

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime
GetTimeZoneInformation

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

AddDWORDPropertyRestrictions
AppRevisionBlobToUSBlob
ClearUSCache
CreateStoreManager
CreateStoreManagerWithToken
DetectExistingCorruption
DisableLocalUnistore
EnableLocalUnistore
EndUnifiedStoreWorkForClient
FindMaxSeenRevisionForAppInBlob
GetCurrentProcessRundownProtectionIdentifier
GetDeviceStoreDefaultName
GetRealStoreManager
GetUSDataFolderPath
GetUSDeviceStoreCorruptedVolumeFolderPath
GetUSDeviceStoreFolderPath
GetUSDeviceStoreVolumePath
GetUSFileStreamPath
GetUnistoreJetInstance
IsCEPropValPresent
IsUSPropValPresent
IsUnistoreInProc
IsUnistoreLocal
LowerRPCPriority
RegisterRundownProtectionForProcess
ReleaseUnistoreJetInstance
RemoveStaleChangeTrackingDataOnStore
ServiceMain
SetMaxRevisionBlobSize
SetUnistoreProcessEventFilter
SetUnistoreVersion
StartUnifiedStoreWorkForClient
SvchostPushServiceGlobals
USBlobToAppRevisionBlob
USComparePropVals
USCopyPropVals
USDeleteFileEx
USEventMaskToObjectType
USGetPropValsAncillaryBufferSize
USIsObjectHidden
USIsSameObject
USObjectTypeToEventMask

Sections

.text
Size: 779KB - Virtual size: 779KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 280KB - Virtual size: 280KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/UserDataAccessRes.dll
.dll windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/UserDataAccountApis.dll
.dll windows x64

54773f51388cd32db87fa0542561a304

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

memmove
memcmp
__CxxFrameHandler3
_onexit
_vsnwprintf
memset
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
_callnewh
realloc
wcstoul
free
malloc
memmove_s
wcsncmp
wcscpy_s
__C_specific_handler
_purecall
memcpy_s
memcpy
wcscmp

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
DisableThreadLibraryCalls

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
InitializeSRWLock
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
SetEvent
WaitForSingleObject
CreateEventExW
ReleaseMutex
CreateEventW
AcquireSRWLockShared
CreateMutexExW
ReleaseSRWLockShared
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseSRWLockExclusive
ReleaseSemaphore
CreateSemaphoreExW
AcquireSRWLockExclusive

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
RaiseException
SetLastError
SetUnhandledExceptionFilter
GetLastError

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventSetInformation
EventRegister
EventUnregister
EventActivityIdControl

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
OpenProcessToken
GetCurrentThreadId
TerminateProcess
OpenThreadToken
SetThreadToken
GetCurrentThread
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

Sleep
WakeAllConditionVariable
SleepConditionVariableSRW
InitOnceComplete
InitOnceExecuteOnce
InitOnceBeginInitialize

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
CloseThreadpoolWait
CreateThreadpoolWait

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetTickCount64
GetSystemTimeAsFileTime

ntdll

RtlQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion

api-ms-win-service-management-l1-1-0

OpenSCManagerW
CloseServiceHandle
OpenServiceW

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

api-ms-win-core-winrt-propertysetprivate-l1-1-1

RoCreatePropertySetSerializer

api-ms-win-shcore-stream-winrt-l1-1-0

CreateStreamOverRandomAccessStream

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

userdataplatformhelperutil

GetUserTokenFromContext
StartAndWaitForServiceForUser
IsCommsSystemService
RunServicesInProc
GenerateUserModeServiceName
GetUserContextFromHandle

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 309KB - Virtual size: 309KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 102KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/UserDataLanguageUtil.dll
.dll windows x64

900005ecf5b8550ed110f6c485470e2b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

free
iswalpha
_amsg_exit
_onexit
iswdigit
malloc
_vsnwprintf
iswspace
iswpunct
_initterm
__dllonexit
_callnewh
__CxxFrameHandler3
_lock
_XcptFilter
memmove
wcsstr
__C_specific_handler
_purecall
bsearch_s
_unlock
memcpy
memset

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventUnregister
EventRegister

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-errorhandling-l1-1-0

RaiseException
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection

api-ms-win-core-memory-l1-1-0

MapViewOfFile
CreateFileMappingW

api-ms-win-core-file-l1-1-0

GetFileInformationByHandle
CreateFileW

api-ms-win-core-shlwapi-obsolete-l1-1-0

QISearch

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringEx
WideCharToMultiByte

api-ms-win-core-heap-l2-1-0

GlobalFree
GlobalAlloc

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalLock

api-ms-win-core-localization-l1-2-0

GetSystemDefaultLangID
IsValidCodePage
GetSystemDefaultLCID
LCMapStringEx
GetUserDefaultLangID
GetLocaleInfoEx

api-ms-win-core-normalization-l1-1-0

GetStringScripts
NormalizeString

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

CHSPinYinHelper_CreateInstance
CHSPinYinHelper_HasPossibleCHSPinYin
CHSPinYinHelper_HasPossiblePinYin
CHSPinYinHelper_Initialize
CanConvertStringFromUnicode
ConvertToMultiByte
ConvertToWideStream
ConvertWideStreamToMultiByte
DecomposeHangulSyllables
DetermineStringEALangId
DetermineStringEALangIdNLS
GetCodepageName
GetConvertedTextForMatching
GetCurrentLangIdForMatching
GetMultiLanguage2
GetNarrowSzCodepage
GetSystemDefaultCodepage
GetWideSz
GetWideSzAlloc
InitializeLanguageUtil
IsAltChar
IsCHNChar
IsEAChar
IsHangulSyllable
IsJPNChar
IsLocalePseudoLoc
IsMatchingEAPrefix
IsMatchingEAPrefixEx
IsMatchingPrefix
IsMatchingPrefixEx
IsSkippableCharacter
IsSupportedCodepage
MapCharToBaseChar
MapStringToBaseCharacters
UninitializeLanguageUtil

Sections

.text
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/UserDataPlatformHelperUtil.dll
.dll windows x64

8fdc756ac83e76cb611c1d7c194f3e8e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

??1type_info@@UEAA@XZ
_lock
_unlock
free
rand
memmove
__CxxFrameHandler3
__dllonexit
_onexit
memcpy_s
_callnewh
memcpy
_vsnwprintf
memset
_XcptFilter
srand
__C_specific_handler
_purecall
?raw_name@type_info@@QEBAPEBDXZ
_initterm
malloc
_amsg_exit
sqrtf

rpcrt4

RpcBindingFromStringBindingW
RpcImpersonateClient
RpcRevertToSelf
RpcBindingFree
RpcStringFreeW
RpcStringBindingComposeW
RpcBindingSetAuthInfoExW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

GetLastError
RaiseException
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
AcquireSRWLockExclusive
DeleteCriticalSection
InitializeCriticalSection
InitializeCriticalSectionEx
EnterCriticalSection
LeaveCriticalSection

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
FreeLibrary
GetModuleHandleW
GetProcAddress
DisableThreadLibraryCalls

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister

api-ms-win-core-file-l1-1-0

CreateFileW
GetTempFileNameW
GetFileAttributesW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-shell-shdirectory-l1-1-0

ord290

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegCloseKey
RegSetValueExW
RegCreateKeyExW

api-ms-win-security-base-l1-1-0

SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
MakeSelfRelativeSD
MakeAbsoluteSD

api-ms-win-core-processthreads-l1-1-0

OpenThreadToken
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentThread
GetCurrentProcess

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-service-winsvc-l1-1-0

ControlService

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindExtensionW
PathMatchSpecW

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrStrIW

ntdll

NtQueryInformationThread
NtSetInformationThread

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
InitOnceExecuteOnce
InitOnceBeginInitialize
InitOnceComplete
Sleep
SleepConditionVariableSRW

api-ms-win-core-heap-l1-1-0

HeapReAlloc
HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabled

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

??0CalculateSize@Comms@@QEAA@_N0@Z
??0Deserializer@Comms@@QEAA@PEBE0_N1@Z
??0RpcClient@Comms@@QEAA@XZ
??0SecureRpcClient@Comms@@QEAA@XZ
??0SerializeBuffer@Comms@@QEAA@AEBVCalculateSize@1@_N1@Z
??1Deserializer@Comms@@QEAA@XZ
??1RpcClient@Comms@@QEAA@XZ
??1SecureRpcClient@Comms@@UEAA@XZ
?CopyBytesIn@CalculateSize@Comms@@UEAAXPEBX_KAEBVtype_info@@@Z
?CopyBytesIn@SerializeBuffer@Comms@@UEAAXPEBX_KAEBVtype_info@@@Z
?CopyBytesOut@Deserializer@Comms@@QEAA_NPEAX_KAEBVtype_info@@@Z
?DeserializeObject@Comms@@YA_NAEAVDeserializer@1@AEAPEAD@Z
?DeserializeObject@Comms@@YA_NAEAVDeserializer@1@AEAPEAG@Z
?DeserializeObject@Comms@@YA_NAEAVDeserializer@1@AEAPEBD@Z
?DeserializeObject@Comms@@YA_NAEAVDeserializer@1@AEAPEBG@Z
?DeserializeObject@Comms@@YA_NAEAVDeserializer@1@AEAV?$basic_string@GU?$char_traits@G@utl@@V?$allocator@G@2@@utl@@@Z
?DeserializeObject@Comms@@YA_NAEAVDeserializer@1@AEAV?$vector@EV?$allocator@E@utl@@@utl@@@Z
?DeserializeObject@Comms@@YA_NAEAVDeserializer@1@AEAVNullType@detail@1@@Z
?DeserializeObject@Comms@@YA_NAEAVDeserializer@1@AEBVNullType@detail@1@@Z
?GetBuffer@Deserializer@Comms@@QEAAPEAX_K@Z
?GetBuffer@SerializeBuffer@Comms@@QEAAXAEAV?$vector@EV?$allocator@E@utl@@@utl@@@Z
?GetBuffer@SerializeBuffer@Comms@@QEBAPEBV?$vector@EV?$allocator@E@utl@@@utl@@XZ
?GetTotal@CalculateSize@Comms@@QEBA_KXZ
?Initialize@SerializeBuffer@Comms@@QEAA_NXZ
?InitializeBinding@RpcClient@Comms@@QEAAJPEBGAEAPEAX@Z
?ReleaseBuffer@Deserializer@Comms@@QEAAXPEBX@Z
?SerializeObject@Comms@@YAXAEAVSerializeBase@1@AEBV?$basic_string@GU?$char_traits@G@utl@@V?$allocator@G@2@@utl@@@Z
?SerializeObject@Comms@@YAXAEAVSerializeBase@1@AEBV?$vector@EV?$allocator@E@utl@@@utl@@@Z
?SerializeObject@Comms@@YAXAEAVSerializeBase@1@AEBVNullType@detail@1@@Z
?SerializeObject@Comms@@YAXAEAVSerializeBase@1@PEBD@Z
?SerializeObject@Comms@@YAXAEAVSerializeBase@1@PEBG@Z
?_InitializeSecureRpcBinding@SecureRpcClient@Comms@@IEAAJPEBG0@Z
ConvertHtmlStringToPlainTextStringOneCore
ConvertPlainTextStringToHtmlStringOneCore
CreateKnownFolderPath
DefaultMakeHresultFromJetError
DllCanUnloadNow
DllGetClassObject
FreeEnumColumn
GenerateUserModeServiceName
GetCalendarColors
GetCombinedTransientObjectSecurityDescriptor
GetContentTypeFromFilePath
GetFileExtensionFromContentType
GetNextNewCalendarColor
GetQueryProcessHandle
GetRpcClientThreadToken
GetSupportedImageFileExtensions
GetTempFileNameWithExt
GetThreadIOPriority
GetUserContextFromHandle
GetUserTokenFromContext
IsActiveDebugger
IsCommsSystemService
IsImageExtension
JetReallocMethod
PrependHtmlOneCore
ResizeImageBySizeInMemory
ResizeImageBySizeToStream
RunServicesInProc
SetCommsServiceJetGlobalSystemParameters
SetPoolThreadBasePriority
SetThreadIOPriority
StartAndWaitForService
StartAndWaitForServiceForUser
StopAndWaitForService
UT_UninitializeTrident

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 392B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 408B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/UserDataService.dll
.dll windows x64

c50324e10f82181b74e02ec62e5fcad6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_unlock
_lock
_initterm
_amsg_exit
_onexit
memset
_callnewh
strncpy_s
tolower
_XcptFilter
_strnicmp
wcscpy_s
memmove
iswdigit
towlower
memcpy
wcstoul
__CxxFrameHandler3
_wcstoi64
memcmp
__dllonexit
_wcstoui64
wcstol
wcstod
towupper
realloc
free
malloc
wcschr
_wcsnicmp
toupper
wcstok_s
?terminate@@YAXXZ
iswspace
_wtoi
_errno
_vsnwprintf_s
memmove_s
_wcsicmp
__C_specific_handler
_purecall
memcpy_s
_vsnwprintf
wcscmp

ntdll

RtlDeriveCapabilitySidsFromName
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlSetThreadWorkOnBehalfTicket
RtlClearThreadWorkOnBehalfTicket
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlGetDeviceFamilyInfoEnum
RtlNtStatusToDosError
ZwQueryWnfStateData
RtlPublishWnfStateData
RtlEqualSid

esent

JetOpenDatabaseW
JetOpenTableA
JetGetSecondaryIndexBookmark
JetEnumerateColumns
JetAddColumnA
JetCommitTransaction
JetIndexRecordCount
JetGotoSecondaryIndexBookmark
JetDeleteIndexA
JetGetTableColumnInfoA
JetTerm2
JetCloseDatabase
JetDelete
JetCreateDatabaseW
JetInit2
JetGetErrorInfoW
JetEndSession
JetBeginSessionA
JetGetTableIndexInfoA
JetCreateIndex2A
JetCreateTableColumnIndexA
JetCloseTable
JetCreateInstanceW
JetSetSystemParameterW
JetMakeKey
JetSetIndexRange
JetSeek
JetSetCurrentIndexA
JetRollback
JetCommitTransaction2
JetBeginTransaction2
JetPrepareUpdate
JetRetrieveColumns
JetUpdate
JetRetrieveColumn
JetSetColumns
JetSetColumn
JetMove
JetAttachDatabaseW

systemeventsbrokerclient

SebSignalEvent
SebQueryEventPackage
SebSignalSyncEvent
SebEnumerateEventsByType

pimstore

FindAllMatchingAggregates
GetDefaultStoreFilter
GetStartAndEndDate
CreateRecurrenceFromData
GetSortBy
ClearPreferenceAndOverride
GetPartnerGUID
GetMeetingNotificationFromMessage
?SubmitSynchronously@AccountProviderHostJobBase@@QEAAJPEAXKPEAT_SNJobOutParams@@@Z
GetDefaultFolderFromStoreEx
IsDefaultStore
PimBinaryBodyToString
GetContactDisplayAndSortPropertiesFromRegistry
IsEmptyProp
CreateAttendeeList
?Submit@AccountProviderHostJobBase@@QEAAJPEAK@Z
GetDefaultStoreId
FindMatchingContactEx2
OlObjectTypeFromOLITEMID
FindAllMatchingContactsEx
SetIncludeMiddle
SetDisplayBy
SetSortBy
POutlookAppManager_CreateInstance
HandleMeetingResponseForAppointment
FindAllMatchingContactsEx2

phoneutil

IsDialableChar
GetCchTailMin
ComparePhoneNumbers
GetTelUriFromDialString
IsCellularVoiceCapableDevice
CauseCode_GetCodeFriendlyText
GetDialableNumberEtc
RemoveMetadataFromNumber
IsNumberDialable
MaskPhoneNumber
GetDialStringFromTelUri
Phone_FmtText_NonDialerFormat
MaskPhoneUri

messagingdatamodel2

Messaging_FormatRecipientFromAggregate
Messaging_GetRecipientsString
Messaging_GetMessageAttachmentText
?DeleteTempFiles@MessagingDeferredAttachment@@YAJPEAUISmMessage@@@Z
Messaging_IsDataRoamingRestrictionActive
Messaging_IsVoiceRoamingRestrictionActive
Messaging_GetSmsCharacterCount
Messaging_ShowToastForRcsEndUserMessage
Messaging_StartCloudServices
Messaging_RetryDownloadCloudServiceMessage
Messaging_GetPlatformType
?GetDeferredAttachmentFilePath@MessagingDeferredAttachment@@YAJPEAUISmMessage@@KPEAHPEAV?$basic_string@GU?$char_traits@G@utl@@V?$allocator@G@2@@utl@@@Z
Messaging_IsMmsMessage
Messaging_IsSIMMessage
Messaging_GetValidSimId
Messaging_IsFilterProviderId
Messaging_IsThreadedByRemoteConversationId
Messaging_IsRcsEnabled
Messaging_GetMediaTypeFromMimeTag
Messaging_GetMediaTempFolder
Messaging_IsRcsMessage
Messaging_GetFileExtensionFromContentType
Messaging_ChatTransportIdToStoreId
Messaging_SmEntryIdToUdmObjectId
Messaging_IsCustomAppProviderId
Messaging_MessagingOMStartupShutdown
Messaging_ShutdownCloudServices
Messaging_StartMessageMaintenance
UnInitMessagingObjectModelModule
Messaging_ShutdownNotification
Messaging_MessagingOMStartupStoreScan
Messaging_ShutdownMessageMaintenance
Messaging_StartNotification

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
FreeLibraryAndExitThread
GetProcAddress
LoadLibraryExW
LoadStringW
FreeLibrary
GetModuleHandleExW
GetModuleHandleW
DisableThreadLibraryCalls

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceComplete
InitOnceBeginInitialize
InitOnceExecuteOnce

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
CreateEventExW
ResetEvent
InitializeCriticalSectionEx
DeleteCriticalSection
ReleaseSRWLockShared
AcquireSRWLockShared
LeaveCriticalSection
SetEvent
InitializeCriticalSection
AcquireSRWLockExclusive
InitializeSRWLock
ReleaseSRWLockExclusive
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
TryAcquireSRWLockShared
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
CreateEventW

api-ms-win-core-heap-l1-1-0

HeapCompact
HeapCreate
HeapReAlloc
GetProcessHeap
HeapDestroy
HeapSize
HeapFree
HeapAlloc
HeapValidate

api-ms-win-core-errorhandling-l1-1-0

RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventUnregister
EventWriteTransfer
EventProviderEnabled
EventRegister

api-ms-win-core-processthreads-l1-1-0

SetThreadToken
OpenProcessToken
OpenThreadToken
CreateThread
GetCurrentProcessId
GetCurrentThread
TerminateProcess
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetUserDefaultLangID

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-sysinfo-l1-1-0

GetSystemTime
GetTickCount64
GetLocalTime
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-path-l1-1-0

PathAllocCombine

api-ms-win-core-file-l1-1-0

GetFileAttributesW
FindClose
LocalFileTimeToFileTime
FindFirstChangeNotificationW
FindNextChangeNotification
GetFileAttributesExW
RemoveDirectoryW
FindNextFileW
CreateFileW
FindCloseChangeNotification
WriteFile
CompareFileTime
DeleteFileW
FindFirstFileW

api-ms-win-core-string-l2-1-0

CharLowerBuffW

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindExtensionW
PathFileExistsW

api-ms-win-shell-shdirectory-l1-1-0

ord290

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-kernel32-legacy-l1-1-0

GetSystemPowerStatus
RegisterWaitForSingleObject

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolThreadMaximum
CloseThreadpoolCleanupGroup
CloseThreadpool
CreateThreadpoolTimer
WaitForThreadpoolWorkCallbacks
SetThreadpoolTimer
CreateThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
IsThreadpoolTimerSet
WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolWait
CreateThreadpool
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
SubmitThreadpoolWork
CloseThreadpoolWork
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegCreateKeyExW
RegGetValueW
RegDeleteValueW
RegSetValueExW
RegOpenKeyExW
RegNotifyChangeKeyValue
RegCloseKey

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
GetTimeZoneInformation
SystemTimeToFileTime

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrcmpW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-string-l2-1-1

SHLoadIndirectString

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

pimindexmaintenanceclient

CreateIndexedFilterClient

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

CleanupUDSGlobals
CreateInprocConnectionHandle
ServiceMain
SvchostPushServiceGlobals
TeardownInprocConnectionHandle

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 177KB - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/UserDataTimeUtil.dll
.dll windows x64

8b80c15a1aaf722c801c7b2e0eb47af5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

__CxxFrameHandler3
_lock
malloc
wcschr
_initterm
_unlock
__dllonexit
__C_specific_handler
memmove
_callnewh
_amsg_exit
_XcptFilter
free
tolower
_onexit
floor
memcpy
memset

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
EnumDynamicTimeZoneInformation
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
GetTimeZoneInformation

api-ms-win-core-localization-obsolete-l1-2-0

GetSystemDefaultUILanguage

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-errorhandling-l1-1-0

RaiseException
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
InitializeSRWLock
InitializeCriticalSectionEx
LeaveCriticalSection
ReleaseSRWLockShared
DeleteCriticalSection
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
CompareStringW

api-ms-win-core-localization-l1-2-0

GetSystemDefaultLCID
GetLocaleInfoW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetLocalTime

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoTaskMemFree

api-ms-win-core-winrt-l1-1-0

RoActivateInstance

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateStringReference

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

AdjustForAllDayAppts
AdjustForBias
AdjustGMTForAllDayAppts
CmpDateST
CmpST
CmpYMD
ConvertFileTimeToLocalVariantTime
ConvertLocalVariantTimeToFileTime
ConvertSchedPlusToRenTz
ConvertTimeZone
ConvertVariantTimeToFileTime
DaysBetweenDates
DaysBetweenFT
DowFromDate
DurationBetweenFT
ExpandRtm
FileTimeAdjustTzToUTC
FileTimeAdjustUTCToTz
FileTimeToLocalFileTimeEx
FileTimeToTzSpecificVariantTime
FileTimeToVariantTime
GetCurrentLocalTime
GetDaysForLunarMonthOfCalendar
GetDaysForMonth
GetLeapMonthOfLunarYear
GetLocalIANAName
GetLunarDate
GetLunarDateOfCalendar
GetSolarDateOfCalendar
GetStartEndTime
IncrSystemTime
IsSupportedLunarCalendarType
LIncrWord
LegacyTimezoneInformationToTimezoneInformation
LocalFileTimeToFileTimeEx
MapIANATZNameToTZInfo
MapTZInfoToIANAName
MinutesBetweenFT
MinutesBetweenST
PimGet24HourFormat
PimGetDateFormat
PimGetLocaleInfo
PimGetTimeFormat
RenFromStdTimeZoneInfo
RoundEventTime
SecondsBetweenFT
StdTimeZoneInfoFromRen
TruncFt

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/UserDataTypeHelperUtil.dll
.dll windows x64

7ba94215bfb65c092eaa1c0225ff5c01

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_XcptFilter
_callnewh
malloc
__CxxFrameHandler3
iswdigit
__C_specific_handler
_vsnwprintf
_amsg_exit
_initterm
memmove
wcsncmp
wcsstr
swscanf_s
iswspace
free
memcmp
memcpy
memset

api-ms-win-core-registry-l1-1-0

RegGetValueW

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-file-l1-1-0

SetFilePointer
GetFileTime
GetFileSize
WriteFile
CompareFileTime
SetEndOfFile
ReadFile
GetTempFileNameW
SetFileAttributesW
DeleteFileW
CreateFileW

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-memory-l1-1-0

VirtualFree
VirtualAlloc

api-ms-win-core-libraryloader-l1-2-0

LoadStringW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemTime
GetTickCount

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

BytesToDigits
ComparePropVals
CompressWhitespaceNW
ConvertUnicodeToUtf8
ConvertUnicodeToUtf8Sz
ConvertUtf8ToUnicode
CopyPropValue
CopyStream
CreateTempFileStm
CreateWrapFileNameStm
CreateWrapFileStm
CreateWrapFileStreamFromDssToken
DupString
DupStringA
DupStringNA
DupStringRes
DuplicateCEPROPVALArray
DuplicateCEPROPVALArrayNoAlloc
EcGlobalObjIdToUid
EcUidToGlobalObjId
EscapeURL
FileTimeToISO8601String
FindProp
FormatPoomIdToString
GetFilePathFromStream
GetPropMemSize
GetStreamSize
ISO8601StringToFileTime
ISO8601StringToSystemTime
MapiIdToEmailUdmId
ParseDelimitedString
ParsePoomIdFromString
ReadStreamContent
ReadStreamContentA
RemoveLeadingAndTrailingSpace
ReplaceChar
SafeLPWSTR
SafeStrDup
SplitString
StreamCopyTo
StreamFromStringW
StringToBytes
SystemTimeToISO8601String
TrimWhiteSpaces
UsOidToCalendarUdmId
UsOidToContactUdmId
UsOidToTaskUdmId

Sections

.text
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/UserDeviceRegistration.dll
.dll windows x64

09480ce5ed2617e6790a3d0a54253edb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

realloc
memcpy_s
_callnewh
memcmp
memmove_s
_onexit
__dllonexit
_unlock
_lock
__CxxFrameHandler3
_vsnwprintf
__C_specific_handler
_initterm
malloc
_amsg_exit
_purecall
_XcptFilter
free
memcpy
memset

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsCreateString
WindowsDuplicateString
HSTRING_UserSize
HSTRING_UserMarshal
HSTRING_UserUnmarshal64
WindowsGetStringRawBuffer
HSTRING_UserUnmarshal
HSTRING_UserFree64
HSTRING_UserMarshal64
HSTRING_UserFree
HSTRING_UserSize64
WindowsDeleteString

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
CoCreateInstance
CoGetInterfaceAndReleaseStream
CreateStreamOnHGlobal
CoReleaseMarshalData
CoMarshalInterface
CoRevertToSelf
CoGetCallContext
CoTaskMemFree
CoImpersonateClient

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW
GetRestrictedErrorInfo
SetRestrictedErrorInfo
RoTransformError
RoOriginateError

api-ms-win-core-synch-l1-1-0

SetEvent
CreateMutexExW
WaitForSingleObject
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSemaphore
AcquireSRWLockExclusive
OpenSemaphoreW
ReleaseMutex
InitializeSRWLock
WaitForSingleObjectEx
CreateSemaphoreExW
CreateEventExW
ReleaseSRWLockExclusive

rpcrt4

CStdStubBuffer_AddRef
NdrStubForwardingFunction
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_Invoke
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
CStdStubBuffer_Connect
NdrCStdStubBuffer2_Release
NdrStubCall3
IUnknown_Release_Proxy
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
IUnknown_AddRef_Proxy
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_QueryInterface

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient12
ObjectStublessClient22
ObjectStublessClient3
ObjectStublessClient18
ObjectStublessClient14
ObjectStublessClient20
CStdStubBuffer2_CountRefs
CStdStubBuffer2_Disconnect
ObjectStublessClient7
ObjectStublessClient13
ObjectStublessClient21
CStdStubBuffer2_QueryInterface
ObjectStublessClient19
NdrProxyForwardingFunction3
ObjectStublessClient15
NdrProxyForwardingFunction4
NdrProxyForwardingFunction5
ObjectStublessClient6
ObjectStublessClient8
ObjectStublessClient9
CStdStubBuffer2_Connect
ObjectStublessClient11
ObjectStublessClient17
ObjectStublessClient10
ObjectStublessClient16

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
Sleep
WakeAllConditionVariable
SleepConditionVariableSRW

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
GetModuleHandleExW
FreeLibrary
GetModuleHandleW
GetProcAddress

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
OpenProcessToken
GetCurrentThread
OpenThreadToken
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-errorhandling-l1-1-0

SetLastError
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

ntdll

RtlImageNtHeader
LdrDisableThreadCalloutsForDll

api-ms-win-security-base-l1-1-0

AllocateAndInitializeSid
FreeSid
GetLengthSid
GetTokenInformation
CopySid

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventUnregister
EventRegister

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

crypt32

CryptAcquireCertificatePrivateKey
CryptHashCertificate
CertNameToStrW

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate
IsErrorPropagationEnabled

api-ms-win-core-winrt-l1-1-0

RoUninitialize
RoInitialize
RoGetActivationFactory

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem

ncrypt

NCryptSignHash
NCryptFreeObject

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolQueueTask
SHTaskPoolAllowThreadReuse

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-security-base-l1-2-0

CheckTokenCapability

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/de-DE/WWAHost.exe.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 21KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/de-DE/Windows.Media.Speech.UXRes.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/de-DE/cdosys.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 50KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/de-DE/comctl32.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/de-DE/comdlg32.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 61KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/de-DE/fms.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/de-DE/mlang.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/de-DE/msimsg.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 95KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/de-DE/msprivs.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/de-DE/windows.ui.xaml.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/de-DE/xpsfilt.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/de-DE/xpsrchvw.exe.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 94KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/el-GR/WWAHost.exe.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 22KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/el-GR/Windows.Media.Speech.UXRes.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/el-GR/cdosys.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 50KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/el-GR/comctl32.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/el-GR/comdlg32.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 62KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/el-GR/fms.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/el-GR/mlang.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/el-GR/msimsg.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 95KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/el-GR/msprivs.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/el-GR/windows.ui.xaml.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/el-GR/xpsfilt.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/el-GR/xpsrchvw.exe.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 97KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/en-GB/WWAHost.exe.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 19KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/en-GB/Windows.Media.Speech.UXRes.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/en-GB/comctl32.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/en-GB/comdlg32.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 55KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/en-GB/fms.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 13KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/en-GB/mlang.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/en-GB/msimsg.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 77KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/en-GB/windows.ui.xaml.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/en-GB/xpsrchvw.exe.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 81KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/es-MX/WWAHost.exe.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 21KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/es-MX/Windows.Media.Speech.UXRes.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/es-MX/comctl32.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/es-MX/comdlg32.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 59KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/es-MX/fms.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/es-MX/mlang.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/es-MX/msimsg.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 89KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/es-MX/windows.ui.xaml.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/es-MX/xpsrchvw.exe.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 89KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-CA/TapiMigPlugin.dll
.dll regsvr32 windows x64

2f9131db35669f3e23ce3d5e24d732ed

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

msvcrt

memcmp
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
realloc
_errno
_initterm
_amsg_exit
_XcptFilter
memmove
memcpy
__CxxFrameHandler3
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_callnewh
_wcsnicmp
_vsnwprintf
wcsncpy_s
malloc
memmove_s
free
_purecall
wcscat_s
wcscpy_s
memcpy_s
??_V@YAXPEAX@Z
__C_specific_handler
??3@YAXPEAX@Z
wcschr
memset

ole32

CoCreateInstance
StringFromGUID2
CoTaskMemAlloc
StringFromCLSID
CoTaskMemFree
CoTaskMemRealloc

oleaut32

GetErrorInfo
VariantClear
SysStringByteLen
SysAllocStringByteLen
UnRegisterTypeLi
LoadRegTypeLi
LoadTypeLi
SysFreeString
RegisterTypeLi
SysAllocString
SysStringLen
VarUI4FromStr

user32

CharNextW
UnregisterClassA

kernel32

OutputDebugStringA
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
FreeLibrary
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
Sleep
LocalFree
HeapDestroy
GetProcessHeap
lstrcmpiW
SetUnhandledExceptionFilter
EnterCriticalSection
lstrlenA
GetModuleHandleW
DeleteCriticalSection
GetProcAddress
LoadResource
FindResourceExW
RaiseException
LockResource
GetLastError
MultiByteToWideChar
InitializeCriticalSection
LeaveCriticalSection
GetThreadLocale
GetModuleFileNameW
WritePrivateProfileStringW
SetThreadLocale
SizeofResource
GetPrivateProfileIntW
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetPrivateProfileStringW
LoadLibraryExW

advapi32

RegQueryValueExW
RegCloseKey
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW

shell32

SHGetFileInfoW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 828B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-CA/TapiSysprep.dll
.dll windows x64

397bc475fccba616c4c1b87402a4b3b1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_amsg_exit
__C_specific_handler
_initterm
malloc
free
_XcptFilter

advapi32

RegCloseKey
RegEnumKeyExW
RegQueryValueExW
RegOpenKeyExW

shlwapi

SHDeleteKeyW

wdscore

WdsSetupLogMessageW
CurrentIP
ConstructPartialMsgVW

kernel32

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentThreadId
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentProcess
TerminateProcess
GetTickCount
Sleep
GetLastError
GetCurrentProcessId

Exports

Exports

TapiSysPrepClean

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-CA/TieringEngineProxy.dll
.dll windows x64

14616b9041c561c61ede205d91dedadf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

malloc
free
__C_specific_handler
_amsg_exit
_initterm
_XcptFilter

rpcrt4

NdrCStdStubBuffer_Release
NdrDllGetClassObject
CStdStubBuffer_Invoke
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
NdrOleFree
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
CStdStubBuffer_CountRefs
CStdStubBuffer_QueryInterface
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
IUnknown_QueryInterface_Proxy
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Connect
NdrDllCanUnloadNow

oleaut32

BSTR_UserMarshal
BSTR_UserMarshal64
BSTR_UserSize64
BSTR_UserFree64
BSTR_UserSize
BSTR_UserUnmarshal
BSTR_UserUnmarshal64
BSTR_UserFree

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient9
ObjectStublessClient14
ObjectStublessClient17
ObjectStublessClient10
ObjectStublessClient16
ObjectStublessClient21
ObjectStublessClient4
ObjectStublessClient13
ObjectStublessClient5
ObjectStublessClient19
ObjectStublessClient8
ObjectStublessClient12
ObjectStublessClient7
ObjectStublessClient11
ObjectStublessClient22
ObjectStublessClient3
ObjectStublessClient18
ObjectStublessClient20
ObjectStublessClient15
ObjectStublessClient23
ObjectStublessClient6

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 548B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-CA/TileDataRepository.dll
.dll windows x64

e1f90e77bd8d232d95ecedcce4f4f39c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-string-l1-1-0

memset
strcmp
memmove_s

api-ms-win-crt-private-l1-1-0

_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__ultow_s
_o__wcsicmp
memmove
_o__initialize_onexit_table
_o_free
_o_malloc
_o_memcpy_s
_o_realloc
_o_terminate
_o_toupper
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__initialize_narrow_environment
_o__get_errno
_o__execute_onexit_table
_o__errno
__std_terminate
wcschr
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
memcmp
memcpy

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetProcAddress
GetModuleFileNameA
GetModuleHandleW
LoadLibraryExW
FreeLibrary

api-ms-win-core-synch-l1-1-0

ReleaseMutex
WaitForSingleObjectEx
CreateEventW
ResetEvent
ReleaseSemaphore
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
InitializeCriticalSectionEx
SetEvent
ReleaseSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockShared
AcquireSRWLockExclusive
InitializeSRWLock
CreateMutexExW
OpenSemaphoreW
CreateSemaphoreExW

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetLastError
GetLastError
RaiseException
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

SetThreadToken
GetCurrentProcessId
OpenThreadToken
GetCurrentThreadId
OpenProcessToken
GetCurrentProcess
TerminateProcess
GetCurrentThread
ProcessIdToSessionId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW
SetRestrictedErrorInfo
RoOriginateError
GetRestrictedErrorInfo
RoTransformError

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsDuplicateString
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsCreateString
WindowsDeleteString
WindowsGetStringRawBuffer

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoGetCallContext
CoGetApartmentType
CoTaskMemRealloc
CoTaskMemFree
CoMarshalInterface
CreateStreamOnHGlobal
CoReleaseMarshalData
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoCreateGuid
CoGetInterfaceAndReleaseStream

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureStackBackTrace
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-1

OpenProcess
IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoActivateInstance

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventRegister
EventWriteTransfer
EventUnregister
EventActivityIdControl
EventProviderEnabled

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
InitOnceComplete
InitOnceBeginInitialize
Sleep

api-ms-win-security-base-l1-1-0

CopySid
GetLengthSid
CreateWellKnownSid
GetTokenInformation

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-winrt-error-l1-1-1

IsErrorPropagationEnabled
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolAllowThreadReuse
SHTaskPoolQueueTask

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegOpenKeyExW
RegCreateKeyExW
RegQueryValueExW
RegCloseKey
RegSetValueExW

ntdll

RtlLookupElementGenericTableAvl
RtlInitUnicodeString
RtlEnterCriticalSection
RtlLeaveCriticalSection
RtlNtStatusToDosErrorNoTeb
RtlGetDeviceFamilyInfoEnum
RtlDeleteCriticalSection
RtlFreeHeap
RtlAllocateHeap
NtQueryInformationProcess
RtlCompareUnicodeString
RtlInitializeGenericTableAvl
NtAccessCheck
NtQueryInformationThread
NtQueryInformationFile
RtlConvertSidToUnicodeString
RtlFreeUnicodeString
RtlValidSid
RtlLengthSid
RtlReleaseSRWLockShared
RtlAcquireSRWLockExclusive
RtlAcquireSRWLockShared
RtlInitializeCriticalSection
RtlInsertElementGenericTableAvl
RtlReleaseSRWLockExclusive

staterepository.core

sqlite3_changes
sqlite3_last_insert_rowid
sqlite3_db_filename
sqlite3_next_stmt
sqlite3_errcode
sqlite3_shutdown
sqlite3_close
sqlite3_errmsg
sqlite3_log
sqlite3_prepare_v2
sqlite3_stmt_busy
sqlite3_exec
sqlite3_free
sqlite3_db_handle
sqlite3_clear_bindings
sqlite3_vfs_unregister
sqlite3_expanded_sql
sqlite3_snprintf
sqlite3_config
sqlite3_step
sqlite3_reset
sqlite3_finalize
sqlite3_sql
sqlite3_column_blob
sqlite3_column_text16
sqlite3_column_bytes
sqlite3_column_int64
sqlite3_column_int
sqlite3_bind_blob
sqlite3_bind_text16
sqlite3_bind_int64
sqlite3_bind_int
sqlite3_get_autocommit

windows.staterepository

StateRepository_DataAccessLayer_DatabaseCache_Get
StateRepository_DataAccessLayer_DatabaseCache_Add
StateRepository_Shutdown
StateRepository_Initialize

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer

api-ms-win-core-path-l1-1-0

PathCchCombine

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
MultiByteToWideChar

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-file-l1-1-0

GetFileAttributesW
WriteFile
CreateFileW

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-security-lsalookup-l1-1-0

LsaLookupClose
LsaLookupFreeMemory
LsaLookupOpenLocalPolicy
LsaLookupGetDomainInfo

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-windowserrorreporting-l1-1-1

WerRegisterCustomMetadata

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 366KB - Virtual size: 365KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 146KB - Virtual size: 145KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-CA/TimeBrokerClient.dll
.dll windows x64

69281b8dd2b2c080b17e7cef7b150666

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcp_win

?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-crt-private-l1-1-0

_o___stdio_common_vswprintf
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo_noreturn
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o_malloc
__C_specific_handler
_CxxThrowException
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__CxxFrameHandler3
memcpy

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlNtStatusToDosErrorNoTeb
RtlNtStatusToDosError
RtlInitUnicodeString

api-ms-win-security-base-l1-1-0

GetTokenInformation

rpcrt4

RpcBindingBind
RpcBindingCreateW
RpcBindingFree
NdrClientCall3

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
GetCurrentProcessId
TerminateProcess
OpenProcessToken
OpenThreadToken
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
ReleaseSRWLockExclusive

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-security-lsalookup-l1-1-0

LookupAccountNameLocalW

eventaggregation

BriCreateBrokeredEvent
BriDeleteBrokeredEvent

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

TbCreateCEvent
TbCreateEvent
TbDeleteCEvent
TbDeleteEvent
TbEnumerateEvents
TbQueryCEventData
TbQueryCEventTriggerTime
TbQueryEventData
TbUpdateCEvent
TbUpdateEvent

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-CA/TimeBrokerServer.dll
.dll windows x64

5fe34e94e22706eede8219d3086d241c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_unlock
??1type_info@@UEAA@XZ
memmove
_lock
memcpy
memcmp
__CxxFrameHandler3
?terminate@@YAXXZ
__dllonexit
toupper
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
??_V@YAXPEAX@Z
malloc
free
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_purecall
??3@YAXPEAX@Z
_vsnwprintf
_onexit
memset

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlUnsubscribeWnfNotificationWaitForCompletion
NtQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlQueryPackageIdentity
RtlVirtualUnwind
RtlReleaseSRWLockExclusive
RtlInitializeSRWLock
RtlPublishWnfStateData
TpReleaseWork
TpPostWork
TpAllocWork
NtCreateIRTimer
RtlNtStatusToDosError
NtPowerInformation
NtSetIRTimer
RtlAcquireSRWLockExclusive

api-ms-win-power-setting-l1-1-0

PowerSettingUnregisterNotification
PowerSettingRegisterNotification

api-ms-win-core-synch-l1-1-0

SetWaitableTimer
CreateEventW
ReleaseSRWLockExclusive
CreateWaitableTimerExW
AcquireSRWLockExclusive
InitializeSRWLock
TryAcquireSRWLockExclusive
ReleaseSRWLockShared
SetEvent
AcquireSRWLockShared
CancelWaitableTimer

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-eventing-classicprovider-l1-1-0

UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
TraceMessage
GetTraceEnableLevel
GetTraceLoggerHandle

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-service-core-l1-1-0

RegisterServiceCtrlHandlerExW
SetServiceStatus

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolWait
CreateThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer

api-ms-win-eventing-provider-l1-1-0

EventProviderEnabled
EventSetInformation
EventRegister
EventUnregister
EventWriteTransfer

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-registry-l1-1-0

RegGetValueW

api-ms-win-core-string-l1-1-0

CompareStringW

api-ms-win-security-base-l1-1-0

MapGenericMask
GetTokenInformation
GetLengthSid
IsValidSid
AccessCheck

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
TerminateProcess
OpenThreadToken
GetCurrentProcess

api-ms-win-core-file-l1-1-0

CompareFileTime
LocalFileTimeToFileTime

rpcrt4

NdrServerCall2
NdrServerCallAll
RpcServerInqBindings
RpcEpRegisterW
RpcEpUnregister
RpcRevertToSelf
RpcImpersonateClient
RpcServerRegisterIf3
RpcServerUnregisterIfEx
I_RpcBindingInqLocalClientPID
RpcObjectSetType
RpcBindingVectorFree
RpcServerUseProtseqW

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-com-l1-1-0

CoInitializeEx
CoCreateInstance
CoUninitialize

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

brokerlib

BrDeleteBrokerInstance
BrFindBrokeredEvent
BrLockBroker
BrGetBrokeredAppState2
BrGetBrokeredEventState
BrSignalBrokerEvent2
BrQueryBrokeredEvents2
BrDecQuota
BrFindBrokeredEvent2
BrUnlockBroker
BrIncQuota
BrBufferFree
BrQueryBrokeredApplicationState
BrCreateBrokerInstance2
BrInitializeBrokerInstance2
BrGetBrokeredEventInfo2

powrprof

PowerSettingRegisterNotificationEx

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

ServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 110KB - Virtual size: 109KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 712B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-CA/TimeDateMUICallback.dll
.dll windows x64

740a4ff75c53c50c264b5525635797c2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

__C_specific_handler
malloc
_initterm
_amsg_exit
_XcptFilter
free
_callnewh

kernel32

TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
GetThreadPreferredUILanguages
SetThreadPreferredUILanguages
Sleep
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
RtlCaptureContext

advapi32

RegCloseKey
RegEnumKeyW
RegOpenKeyExW
RegSetValueExW
RegLoadMUIStringW

Exports

Exports

OnMachineUILanguageSwitch

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 300B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-CA/TimeSyncTask.dll
.dll regsvr32 windows x64

c6428f48e274f14bda38e852a6049b74

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
free
_wcsdup

advapi32

OpenSCManagerW
OpenServiceW
StartServiceW
ControlService
WaitServiceState
CloseServiceHandle
QueryServiceStatusEx

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
DisableThreadLibraryCalls
FreeLibrary
GetModuleHandleExW
GetProcAddress
FreeLibraryAndExitThread

api-ms-win-core-synch-l1-1-0

WaitForSingleObject

api-ms-win-core-processthreads-l1-1-0

ResumeThread
GetCurrentThreadId
GetCurrentProcessId
CreateThread
TerminateProcess
GetCurrentProcess

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 456B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-CA/WWAHost.exe.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 22KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-CA/Windows.Media.Speech.UXRes.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-CA/comctl32.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-CA/comdlg32.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 61KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-CA/fms.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-CA/mlang.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-CA/msimsg.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 93KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-CA/tapiperf.dll
.dll windows x64

efa83d2187797a3e76863f8d5643e826

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

memmove
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
memset

advapi32

QueryServiceStatus
CloseServiceHandle
RegQueryValueExA
OpenSCManagerA
RegOpenKeyExA
OpenServiceA
RegCloseKey

kernel32

GetTickCount
RtlCaptureContext
GetCurrentThreadId
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
LoadLibraryA
GetCurrentProcessId
GlobalAlloc
GlobalFree
GetProcAddress
Sleep
QueryPerformanceCounter

Exports

Exports

CloseTapiPerformanceData
CollectTapiPerformanceData
OpenTapiPerformanceData

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-CA/tapisnap.dll
.dll regsvr32 windows x64

a237988e9c1a587fea17f1b124adb09a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mfc42u

ord5065
ord4368
ord5724
ord5722
ord3468
ord2412
ord5615
ord1388
ord4191
ord6071
ord2515
ord2559
ord4836
ord6813
ord911
ord288
ord812
ord1544
ord1586
ord1555
ord1583
ord1585
ord355
ord1477
ord1553
ord1416
ord1491
ord1577
ord665
ord1067
ord2857
ord5730
ord5711
ord6053
ord4983
ord3916
ord1426
ord2752
ord4214
ord1063
ord659
ord4598
ord4161
ord1262
ord4436
ord2783
ord6225
ord4481
ord6734
ord599
ord629
ord1043
ord4770
ord3535
ord2979
ord4746
ord1778
ord6440
ord2592
ord4543
ord2024
ord2425
ord6801
ord1774
ord5687
ord5245
ord5406
ord6437
ord4365
ord1777
ord4752
ord5663
ord2399
ord5586
ord6812
ord4694
ord5702
ord4017
ord5229
ord4789
ord2670
ord2060
ord6814
ord3933
ord5484
ord1736
ord5683
ord2457
ord2140
ord5699
ord3049
ord3243
ord3362
ord4815
ord3231
ord3366
ord3052
ord3166
ord3046
ord4082
ord4083
ord4077
ord3164
ord4371
ord4988
ord4771
ord2665
ord2661
ord4721
ord286
ord1574
ord2676
ord2408
ord1677
ord1463
ord1499
ord1443
ord2517
ord3177
ord5077
ord626
ord852
ord287
ord1040
ord3754
ord6541
ord865
ord354
ord5584
ord5585
ord5583
ord5304
ord5114
ord5382
ord5352
ord4722
ord5246
ord5709
ord5227
ord4027
ord6767
ord6614
ord4131
ord6418
ord822
ord3743
ord4741
ord2586
ord1033
ord3892
ord867
ord3774
ord1498
ord620
ord6050
ord6544
ord2049
ord2459
ord6184
ord1287
ord1284
ord2629
ord1041
ord627
ord4473
ord1264
ord1259
ord2846
ord5887
ord2975
ord1126
ord2856
ord4601
ord624
ord5804
ord6821
ord2121
ord2876
ord5815
ord6832
ord3830
ord5712
ord5719
ord6880
ord6351
ord2906
ord1442
ord1122
ord3805
ord2329
ord1082
ord3174
ord4860
ord549
ord4582
ord1906
ord551
ord999
ord4612
ord5725
ord2753
ord5066
ord3484
ord3919
ord2273
ord1066
ord663
ord1123
ord1812
ord3920
ord3761
ord1441
ord2393
ord4557
ord4523
ord3894
ord337
ord2845
ord1286
ord1035
ord2178
ord1537
ord4599
ord2781

msvcrt

_CxxThrowException
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_callnewh
realloc
malloc
free
__C_specific_handler
_itow
_wtoi
_purecall
qsort
memset
memcpy
memmove
_wcsicmp
??1exception@@UEAA@XZ
__CxxFrameHandler3
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
iswdigit
printf
wcscpy_s
_vsnwprintf
?what@exception@@UEBAPEBDXZ

atl

ord15
ord22
ord16
ord32
ord21
ord18

advapi32

RegOpenKeyExA
RegDeleteValueW
RegDeleteKeyW
RegConnectRegistryW
ControlService
EnumDependentServicesW
StartServiceW
LookupAccountSidW
RegEnumKeyExW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
ChangeServiceConfigW
OpenSCManagerW
QueryServiceConfigW
QueryServiceStatus
OpenServiceW
CloseServiceHandle
FreeSid
EqualSid
AllocateAndInitializeSid
LookupAccountNameW
LsaClose
LsaSetSystemAccessAccount
LsaGetSystemAccessAccount
LsaCreateAccount
LsaOpenAccount
LsaFreeMemory
GetSidSubAuthority
GetSidSubAuthorityCount
CopySid
GetLengthSid
LsaLookupNames
LsaOpenPolicy
RegQueryValueExA

gdi32

GetDeviceCaps
SelectObject
CreateFontIndirectW
GetCharWidthW
CreateSolidBrush
DeleteObject
Rectangle
SetTextColor
SetBkColor
TextOutW

kernel32

GetWindowsDirectoryW
HeapFree
HeapDestroy
HeapAlloc
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
Sleep
WaitForSingleObject
CreateEventW
SetLastError
FormatMessageW
GetCurrentThread
CloseHandle
GetCurrentProcess
lstrcmpiW
GetModuleHandleW
GetCurrentThreadId
GetLastError
LocalFree
LocalAlloc
GlobalAlloc
GetComputerNameW
WideCharToMultiByte
WinExec
GetSystemDirectoryW
lstrlenW
GetModuleFileNameW
GlobalFree
lstrcmpW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
FreeLibrary
GetProcAddress
LoadLibraryW
LoadLibraryExA
GlobalLock
GlobalUnlock
SetEvent
WaitForSingleObjectEx
DuplicateHandle
ResumeThread
ResetEvent
GetThreadLocale
GetProcessHeap
ExpandEnvironmentStringsA

netapi32

NetApiBufferFree
NetWkstaUserGetInfo
NetLocalGroupGetMembers

ole32

ReleaseStgMedium
CreateStreamOnHGlobal
StringFromGUID2
CoTaskMemAlloc
CoInitialize
CoCreateInstance
CoUninitialize
CoTaskMemFree
StringFromCLSID

oleaut32

SysFreeString
SysStringLen
SysAllocString

secur32

AcquireCredentialsHandleW
InitializeSecurityContextW
AcceptSecurityContext
FreeCredentialsHandle
QuerySecurityPackageInfoW

user32

GetActiveWindow
EnumThreadWindows
IsWindowVisible
GetDesktopWindow
PostMessageW
IsWindow
DispatchMessageW
TranslateMessage
GetParent
DestroyWindow
LoadBitmapW
SetWindowLongW
MessageBoxW
PeekMessageW
LoadIconW
LoadStringW
MessageBeep
KillTimer
SetTimer
RegisterClipboardFormatW
GetFocus
EnableWindow
SendMessageW
GetWindowLongW
GetWindowRect
SystemParametersInfoW
SetWindowPos
SendNotifyMessageW
GetDC
ReleaseDC
LoadCursorW
RegisterClassW
CreateWindowExW
GetWindowLongPtrW
SetWindowLongPtrW
GetClientRect
BeginPaint
GetSysColor
InvalidateRect
DefWindowProcW
CallWindowProcW
GetKeyState
FillRect
EndPaint
GetWindow
GetTopWindow
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
SetFocus

wsock32

ioctlsocket
ntohl
WSAGetLastError
htonl
WSAStartup
WSACleanup

ws2_32

GetNameInfoW

comctl32

CreatePropertySheetPageW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 198KB - Virtual size: 197KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-CA/tapisrv.dll
.dll windows x64

6aba8903eb7e4be23e07d9607806e424

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

free
_initterm
_vsnprintf
memmove
_amsg_exit
malloc
_XcptFilter
_itow
_wcsnicmp
wcsncmp
_wtol
wcsstr
wcschr
_wcsupr
_wcsicmp
_vsnwprintf
__C_specific_handler
memcpy
memset

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegQueryValueExA
RegOpenKeyExA
RegNotifyChangeKeyValue
RegDeleteValueW
RegEnumValueW
RegCloseKey
RegDeleteKeyExW
RegOpenCurrentUser
RegQueryInfoKeyW

rpcrt4

RpcServerUseProtseqEpW
RpcServerInqDefaultPrincNameW
RpcBindingFromStringBindingW
RpcMgmtSetCancelTimeout
RpcRevertToSelf
RpcBindingSetAuthInfoW
RpcServerUnregisterIf
RpcStringBindingComposeW
I_RpcExceptionFilter
RpcStringFreeW
NdrServerCall2
NdrServerCallAll
NdrClientCall3
RpcCancelThread
RpcServerInqCallAttributesW
RpcBindingFree
RpcServerRegisterAuthInfoW
RpcServerListen
RpcServerRegisterIfEx
RpcImpersonateClient

api-ms-win-service-core-l1-1-0

SetServiceStatus

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenSCManagerW
OpenServiceW

api-ms-win-service-management-l2-1-0

ChangeServiceConfigW

kernel32

GetSystemTime
DelayLoadFailureHook
ResolveDelayLoadedAPI
GetWindowsDirectoryW
GlobalFree
DeleteFileW
GlobalAlloc
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetLocalTime
lstrlenA
OutputDebugStringA
GetSystemTimeAsFileTime
LocalFree
K32EnumProcesses
FileTimeToSystemTime
GetSystemWindowsDirectoryW
MapViewOfFile
CreateFileMappingW
WritePrivateProfileSectionW
GetFileSize
GetCurrentDirectoryW
IsDBCSLeadByte
GetFileAttributesExW
GetPrivateProfileStringW
UnmapViewOfFile
GetSystemDirectoryW
FindClose
GetPrivateProfileSectionW
FindNextFileW
FindFirstFileW
lstrcmpiW
GetProcessHeap
GetComputerNameW
DeleteCriticalSection
GetProcAddress
HeapDestroy
HeapCompact
HeapAlloc
ResetEvent
CreateThread
GetSystemInfo
GetCurrentThread
DisableThreadLibraryCalls
CreateEventW
OpenProcess
ExitThread
GetComputerNameExW
GetPrivateProfileSectionNamesW
OpenEventW
CreateFileW
InitializeCriticalSectionAndSpinCount
SetThreadPriority
WaitForMultipleObjects
GetPrivateProfileIntW
UnregisterWait
WriteFile
GetCurrentProcess
EnterCriticalSection
lstrlenW
LeaveCriticalSection
CreateMutexW
WaitForSingleObject
LocalAlloc
GetCurrentThreadId
ReleaseMutex
DuplicateHandle
MultiByteToWideChar
Sleep
GetLastError
SetEvent
CloseHandle
LoadLibraryW
FreeLibrary
HeapFree
GetTickCount
HeapCreate
WritePrivateProfileStringW
CompareStringW

api-ms-win-core-com-l1-1-0

CoUninitialize
CoInitializeEx
CoCreateInstance

Exports

Exports

ServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 233KB - Virtual size: 232KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-CA/tapiui.dll
.dll windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 105KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-CA/themeui.dll
.dll windows x64

3377bf4ad60c0566fbecf4212621b1a1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_vsnprintf
memcmp
memcpy
memmove
memset
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
malloc
_amsg_exit
_XcptFilter
wcsstr
swscanf_s
memmove_s
wcschr
free
towupper
_wtoi
memcpy_s
_vsnwprintf
sqrtf

shcore

SHDeleteValueW
SHRegSetPathW
ord290
ord162
SHUnicodeToUnicode
SHStrDupW
SHCreateStreamOnFileEx
ord190
SHGetValueW
SHSetValueW
SHCreateThreadWithHandle
IsOS
IStream_Reset
ord142
ord292
IStream_Size
SHCreateThread
SHRegGetValueW
ord123
SHDeleteKeyW
IUnknown_Set
IUnknown_SetSite
SHRegGetPathW
ord222

shell32

SHGetIDListFromObject
ord100
SHParseDisplayName
SHQueryRecycleBinW
ord147
ord28
SHCreateItemFromIDList
SHFileOperationW
ord102
SHChangeNotify
SHCreateItemWithParent
ord18
SHCreateShellItemArrayFromIDLists
ord92
ord24
ord152
ord846
ord25
ord27
ExtractIconW
SHCreateItemFromParsingName
SHGetKnownFolderPath
SHGetFolderPathEx
ord155
SHGetNameFromIDList
SHCreateShellItemArrayFromShellItem

shlwapi

PathFileExistsW
StrChrW
StrRChrW
StrToIntExW
StrStrW
PathAppendW
StrToIntW
PathQuoteSpacesW
StrCmpIW
StrDupW
StrCmpNW
UrlCompareW
PathFindExtensionW
PathRemoveFileSpecW
StrRStrIW
PathIsPrefixW
ord487
PathIsRelativeW
ord466
PathRemoveExtensionW
SHRegGetUSValueW
PathIsFileSpecW
ord464
StrCmpNIW
PathUnExpandEnvStringsW
StrStrIW
PathCommonPrefixW
ord433
PathAddBackslashW
PathCombineW
ord448
PathIsDirectoryW
PathFindNextComponentW
ord23
StrFormatByteSizeW
StrTrimW
PathStripToRootW
PathRemoveFileSpecA
PathStripPathA
ord456
StrRChrA
StrCmpW
ord154
ord158
ord219
ord460
PathFindFileNameW

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
LoadStringW
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA
FreeLibraryAndExitThread
GetProcAddress
GetModuleFileNameW
LoadLibraryExW
FreeLibrary

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockShared
EnterCriticalSection
DeleteCriticalSection
WaitForSingleObjectEx
CreateSemaphoreExW
CreateMutexExW
InitializeCriticalSectionEx
ResetEvent
CreateEventExW
OpenEventW
SetEvent
InitializeCriticalSection
CreateEventW
CreateMutexW
OpenSemaphoreW
ReleaseMutex
ReleaseSemaphore
WaitForSingleObject
ReleaseSRWLockExclusive

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapReAlloc
HeapAlloc
HeapFree

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

CreateThread
GetCurrentProcessId
OpenThreadToken
ResumeThread
GetCurrentThread
TerminateProcess
GetExitCodeThread
GetCurrentThreadId
OpenProcessToken
CreateProcessW
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW
LCMapStringW
GetLocaleInfoW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-com-l1-1-0

CoCreateGuid
StringFromCLSID
PropVariantClear
CoReleaseMarshalData
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoUninitialize
CoInitializeEx
CoTaskMemAlloc
CLSIDFromString
CoCreateFreeThreadedMarshaler
CoTaskMemRealloc
CoGetMalloc
CoTaskMemFree
CoCreateInstance
StringFromGUID2
CreateStreamOnHGlobal

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemDirectoryW
GetWindowsDirectoryW
GetTickCount

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegGetValueW
RegEnumValueW
RegQueryValueExW
RegCloseKey
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-file-l1-1-0

DeleteFileW
GetFileAttributesExW
FindFirstFileExW
CompareFileTime
FindClose
GetFileSize
FindNextFileW
CreateDirectoryW
FileTimeToLocalFileTime
CreateFileW
ReadFile
SetFilePointer
GetDiskFreeSpaceExW
GetLongPathNameW
SetFileAttributesW
SetFileTime
WriteFile
FindFirstFileW
LocalFileTimeToFileTime
GetTempFileNameW

api-ms-win-core-string-l2-1-0

CharNextW
IsCharUpperW
CharUpperBuffW
CharLowerW

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-wow64-l1-1-1

GetSystemWow64DirectoryW

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceComplete
Sleep

api-ms-win-core-threadpool-l1-2-0

SubmitThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolWork
CloseThreadpoolTimer
CloseThreadpoolWork

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-path-l1-1-0

PathCchCombine
PathCchRenameExtension
PathCchAddExtension
PathCchCanonicalize
PathCchAppend

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
MapViewOfFile
CreateFileMappingW

api-ms-win-core-sidebyside-l1-1-0

DeactivateActCtx
CreateActCtxW
ActivateActCtx
ReleaseActCtx

api-ms-win-core-kernel32-legacy-l1-1-0

DosDateTimeToFileTime
MulDiv
FileTimeToDosDateTime

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage
GetNumberFormatW

api-ms-win-core-privateprofile-l1-1-0

GetPrivateProfileStringW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrlenW

ntdll

WinSqmIsOptedIn
WinSqmSetDWORD
WinSqmIncrementDWORD
EtwEventActivityIdControl
EtwEventSetInformation
EtwEventUnregister
WinSqmAddToStream
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwEventWriteTransfer
EtwTraceMessage
EtwEventRegister

gdi32

BitBlt
GdiAlphaBlend
GetRegionData
SetMagicColors
SetLayout
GetObjectW
SetTextColor
SetBkMode
GetStockObject
ExtFloodFill
CreateFontIndirectW
CreateSolidBrush
GetDeviceCaps
GetPixel
SetStretchBltMode
StretchBlt
CreateCompatibleBitmap
SaveDC
RestoreDC
CreateRectRgn
DeleteDC
CreateCompatibleDC
CreateDIBSection
SelectObject
DeleteObject

user32

SetDlgItemInt
CheckDlgButton
SendDlgItemMessageW
RegisterClassW
GetClassInfoW
RedrawWindow
CallWindowProcW
GetWindow
IsWindow
GetDlgItem
EnableWindow
SendMessageW
GetFocus
LoadImageW
WaitForInputIdle
DrawTextW
GetWindowLongW
SetWindowLongW
OffsetRect
GetMonitorInfoW
MonitorFromPoint
ValidateRect
SetForegroundWindow
SendMessageTimeoutW
ShowWindow
FillRect
GetClientRect
DefWindowProcW
SetDlgItemTextW
BeginPaint
PostQuitMessage
KillTimer
DestroyWindow
SetTimer
GetWindowLongPtrW
GetMessageW
CreateWindowExW
EndTask
CreateWindowInBand
EnumChildWindows
MoveWindow
GetSystemMetrics
SystemParametersInfoW
UnregisterClassW
SetWindowLongPtrW
RegisterClassExW
SendNotifyMessageW
LoadCursorW
SetCursor
SetSysColors
GetSysColor
DispatchMessageW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjects
PostMessageW
GetParent
GetDC
ReleaseDC
DrawIconEx
EndPaint
InvalidateRect
GetDlgCtrlID
IsDlgButtonChecked
GetDlgItemInt
DestroyIcon
LoadBitmapW
GetSysColorBrush
GetShellWindow
FindWindowW
OpenIcon
CopyRect
InflateRect
MessageBoxW
PostThreadMessageW
FindWindowExW
GetClassNameW
EnumWindows
LoadIconW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall

Sections

.text
Size: 267KB - Virtual size: 267KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 616B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-CA/threadpoolwinrt.dll
.dll windows x64

d86d168674b8fd21a18fd2e759bfd5f1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

??3@YAXPEAX@Z
??0exception@@QEAA@AEBV0@@Z
malloc
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_callnewh
_CxxThrowException
free
_amsg_exit
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
_purecall
_XcptFilter
_lock
?terminate@@YAXXZ
__C_specific_handler
??0exception@@QEAA@AEBQEBDH@Z
_initterm
??1type_info@@UEAA@XZ

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
TpSetWait
TpAllocWait
TpReleaseWait
TpSetWaitEx
TpReleaseWork
TpPostWork
TpAllocWork
TpAllocPool
TpReleasePool
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
RtlReleaseSRWLockShared
RtlAcquireSRWLockShared
RtlInitializeSRWLock
TpReleaseTimer
TpSetTimer
RtlNtStatusToDosError
TpAllocTimer
TpSetPoolThreadBasePriority

api-ms-win-core-winrt-string-l1-1-0

WindowsIsStringEmpty
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsCreateString

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-winrt-error-l1-1-0

RoFailFastWithErrorContext
RoOriginateErrorW
SetRestrictedErrorInfo
GetRestrictedErrorInfo
RoOriginateError
RoTransformError

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoDecrementMTAUsage
CoTaskMemAlloc
CoIncrementMTAUsage

api-ms-win-core-winrt-l1-1-0

RoInitialize
RoGetActivationFactory
RoUninitialize

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-fibers-l1-1-0

FlsFree
FlsAlloc
FlsGetValue
FlsSetValue

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-synch-l1-1-0

InitializeSRWLock
AcquireSRWLockShared
OpenSemaphoreW
OpenEventW
AcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSRWLockExclusive

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabled

api-ms-win-core-winrt-error-l1-1-1

RoReportUnhandledError
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
RoReportFailedDelegate

api-ms-win-core-processthreads-l1-1-0

TerminateThread
ResumeThread
GetCurrentProcess
GetCurrentProcessId
SetThreadPriority
TerminateProcess
GetCurrentThreadId
CreateThread

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
GetLastError

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
Sleep
SleepConditionVariableSRW
InitOnceExecuteOnce

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-com-private-l1-1-0

CoRegisterInitializeSpy
CoRevokeInitializeSpy

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllMain

Sections

.text
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-CA/thumbcache.dll
.dll windows x64

f4ef1bb3b33298a0b7cdee9f6ab7415f

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02-05-2019 21:24

Not After

02-05-2020 21:24

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:91:15:0d:9f:1d:8a:55:37:50:7d:6e:70:d5:1e:35:a9:7a:5b:c4:22:4c:93:c3:60:00:68:c4:be:92:45:a2
Signer

Actual PE Digest

0a:91:15:0d:9f:1d:8a:55:37:50:7d:6e:70:d5:1e:35:a9:7a:5b:c4:22:4c:93:c3:60:00:68:c4:be:92:45:a2

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

13-01-2023 12:41
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_ui64tow_s
_ultow_s
toupper
_errno
realloc
memmove
_onexit
__C_specific_handler
__CxxFrameHandler3
malloc
free
_amsg_exit
_lock
_XcptFilter
memcpy_s
memcpy
memcmp
memmove_s
_vsnwprintf
_unlock
_initterm
__dllonexit
memset

api-ms-win-shcore-obsolete-l1-1-0

SHStrDupW

api-ms-win-shcore-stream-l1-1-0

IStream_Reset
SHCreateMemStream
IStream_Read
IStream_Size
IStream_Copy
IStream_Write

api-ms-win-shcore-stream-winrt-l1-1-0

CreateStreamOverRandomAccessStream
CreateRandomAccessStreamOverStream

api-ms-win-shcore-comhelpers-l1-1-0

IUnknown_SetSite
IUnknown_Set

api-ms-win-shcore-registry-l1-1-0

SHGetValueW

api-ms-win-shcore-path-l1-1-0

ord170

api-ms-win-shcore-sysinfo-l1-1-0

IsOS

api-ms-win-shcore-thread-l1-1-0

SHCreateThread

shcore

ord130
ord290
ord190
ord1

rpcrt4

IUnknown_QueryInterface_Proxy
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_IsIIDSupported
IUnknown_AddRef_Proxy
NdrStubForwardingFunction
CStdStubBuffer_Invoke
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrCStdStubBuffer2_Release
NdrStubCall3
CStdStubBuffer_DebugServerQueryInterface

api-ms-win-core-heap-l1-1-0

HeapReAlloc
GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
GetModuleHandleExW
GetModuleFileNameA
GetModuleHandleW
LoadStringW
DisableThreadLibraryCalls
GetProcAddress

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
RoOriginateErrorW

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-synch-l1-1-0

CreateEventW
LeaveCriticalSection
ReleaseSRWLockExclusive
WaitForSingleObjectEx
DeleteCriticalSection
ReleaseSRWLockShared
ReleaseSemaphore
AcquireSRWLockShared
ReleaseMutex
SetEvent
CreateMutexW
ResetEvent
EnterCriticalSection
InitializeSRWLock
InitializeCriticalSectionEx
AcquireSRWLockExclusive
WaitForSingleObject
CreateSemaphoreExW
CreateMutexExW
OpenSemaphoreW

api-ms-win-core-errorhandling-l1-1-0

RaiseException
GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-winrt-string-l1-1-0

WindowsIsStringEmpty
HSTRING_UserUnmarshal64
HSTRING_UserSize
HSTRING_UserUnmarshal
WindowsGetStringRawBuffer
HSTRING_UserSize64
WindowsStringHasEmbeddedNull
HSTRING_UserFree
HSTRING_UserMarshal64
HSTRING_UserMarshal
WindowsCreateString
WindowsCreateStringReference
HSTRING_UserFree64

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventActivityIdControl
EventSetInformation
EventRegister
EventWriteTransfer
EventProviderEnabled

api-ms-win-core-localization-l1-2-0

FormatMessageW
LCMapStringW

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
OpenProcessToken
OpenThreadToken
TerminateProcess
GetCurrentProcess
GetProcessId
GetCurrentThread
GetCurrentProcessId

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak
OutputDebugStringA

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceBeginInitialize
WakeAllConditionVariable
InitOnceComplete
SleepConditionVariableSRW

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemInfo
GetWindowsDirectoryW
GetSystemTimeAsFileTime

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegCloseKey
RegGetValueW
RegOpenKeyExW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-path-l1-1-0

PathCchAppend
PathCchStripToRoot

api-ms-win-core-string-l2-1-0

CharUpperBuffW

api-ms-win-core-winrt-l1-1-0

RoActivateInstance

api-ms-win-core-file-l1-1-0

GetVolumeInformationW
WriteFile
GetFileSize
GetTempFileNameW
SetFileAttributesW
SetFileInformationByHandle
SetEndOfFile
SetFilePointer
CreateDirectoryW
DeleteFileW
FindNextFileW
CreateFileW
FindClose
FindFirstFileW
GetFileAttributesW
GetDiskFreeSpaceExW
RemoveDirectoryW
GetDriveTypeW

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW

api-ms-win-security-base-l1-1-0

GetSecurityDescriptorControl
GetTokenInformation
GetSidSubAuthority
DuplicateTokenEx

api-ms-win-core-heap-l2-1-0

GlobalFree
LocalAlloc
LocalFree
GlobalAlloc

api-ms-win-core-file-l2-1-0

MoveFileExW
GetFileInformationByHandleEx

api-ms-win-core-memory-l1-1-0

MapViewOfFile
CreateFileMappingW
UnmapViewOfFile

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-psapi-l1-1-0

K32QueryWorkingSetEx

api-ms-win-core-com-midlproxystub-l1-1-0

CStdStubBuffer2_Connect
ObjectStublessClient6
NdrProxyForwardingFunction3
ObjectStublessClient5
ObjectStublessClient7
CStdStubBuffer2_Disconnect
CStdStubBuffer2_CountRefs
ObjectStublessClient4
NdrProxyForwardingFunction4
NdrProxyForwardingFunction5
ObjectStublessClient8
CStdStubBuffer2_QueryInterface

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindFileNameW
PathIsRootW
PathFindExtensionW
PathIsUNCW
PathAppendW
PathSkipRootW
PathStripToRootW
PathCombineW
PathRemoveFileSpecW

api-ms-win-core-kernel32-legacy-l1-1-0

MulDiv

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
CreateTimerQueueTimer

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrCmpNIW
StrCmpICW
QISearch

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalLock

api-ms-win-appmodel-runtime-l1-1-0

GetPackageFamilyName

ntdll

RtlNtStatusToDosError
NtSetInformationFile
RtlCreateAcl
RtlAddAccessAllowedAce
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
NtQueryInformationFile

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
GetProxyDllInfo

Sections

.text
Size: 260KB - Virtual size: 259KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 632B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-CA/tier2punctuations.dll
.dll windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-CA/timedate.cpl
.dll regsvr32 windows x64

a9bb30bf11529ad47123c39854c7ea6f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

memcpy
memcmp
bsearch
__C_specific_handler
memset
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
free
wcsstr
_purecall
_vsnwprintf
memcpy_s
_wtoi
_itow_s
wcschr
_wcsicmp
wcscmp

atl

ord15
ord21
ord16
ord32

comctl32

InitCommonControlsEx

shlwapi

PathRemoveBlanksW
ord158
StrStrIW
StrChrW
SHSetValueW
StrStrW
SHGetValueW
ord630
StrCmpIW
ord278
StrToIntW
ord16
SHRegGetValueW
ord631
SHDeleteValueW
ord354
StrCmpW

rpcrt4

IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_CountRefs
CStdStubBuffer_QueryInterface
CStdStubBuffer_Invoke
IUnknown_Release_Proxy
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
CStdStubBuffer_AddRef
NdrDllUnregisterProxy
NdrDllRegisterProxy
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
NdrOleAllocate
NdrOleFree
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Connect
CStdStubBuffer_IsIIDSupported

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime
GetVersionExW
GetTickCount
SetLocalTime
GetSystemTime
GetSystemDirectoryW
GetSystemTimeAsFileTime

api-ms-win-core-heap-l2-1-0

GlobalAlloc
LocalFree
LocalAlloc
GlobalFree

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
LeaveCriticalSection
AcquireSRWLockShared
AcquireSRWLockExclusive
CreateSemaphoreExW
ReleaseSRWLockExclusive
CreateMutexExW
InitializeCriticalSection
DeleteCriticalSection
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
WaitForSingleObject
ReleaseSRWLockShared

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

GetCalendarInfoW
GetLocaleInfoW
FormatMessageW

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
FreeLibrary
LoadResource
GetModuleFileNameA
FindResourceExW
DisableThreadLibraryCalls
GetModuleHandleExW
LoadStringW
GetModuleHandleW
GetModuleFileNameW
LockResource
SizeofResource
LoadLibraryExW

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
SleepConditionVariableSRW
InitOnceExecuteOnce
Sleep
InitOnceComplete
InitOnceBeginInitialize

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW
OutputDebugStringA

api-ms-win-core-errorhandling-l1-1-0

RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventSetInformation
EventWriteTransfer
EventActivityIdControl

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegQueryValueExW
RegCloseKey
RegGetValueW
RegOpenKeyExW
RegSetValueExW

api-ms-win-core-string-l1-1-0

CompareStringW

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoCreateInstance
CoInitializeEx
CoUninitialize
StringFromGUID2
CreateStreamOnHGlobal

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-file-l1-1-0

FileTimeToLocalFileTime
CreateFileW
LocalFileTimeToFileTime

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient20
ObjectStublessClient7
ObjectStublessClient18
ObjectStublessClient13
ObjectStublessClient3
ObjectStublessClient11
ObjectStublessClient14
ObjectStublessClient12
ObjectStublessClient5
ObjectStublessClient19
ObjectStublessClient6
ObjectStublessClient8
ObjectStublessClient9
ObjectStublessClient17
ObjectStublessClient10
ObjectStublessClient16
ObjectStublessClient21
ObjectStublessClient15
ObjectStublessClient4

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-timezone-private-l1-1-0

IsTimeZoneRedirectionEnabled

dwmapi

DwmSetWindowAttribute
DwmIsCompositionEnabled

gdiplus

GdipGetRegionHRgn
GdipDeleteRegion
GdipCreateRegionPath
GdipCreateBitmapFromStream
GdipCloneBitmapAreaI
GdipBitmapSetPixel
GdipGetImageWidth
GdiplusStartup
GdipDrawImageRectI
GdipGraphicsClear
GdiplusShutdown
GdipSetSmoothingMode
GdipGetImageHeight
GdipSetCompositingQuality
GdipSetCompositingMode
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipCreateFromHDC
GdipAddPathEllipseI
GdipDeletePath
GdipCreatePath
GdipDeletePen
GdipCreatePen1
GdipDisposeImage
GdipAlloc
GdipFree
GdipCloneImage
GdipSetInterpolationMode
GdipDrawLineI

kernel32

CreateActCtxW
ActivateActCtx
DeactivateActCtx
FindActCtxSectionStringW
GetCalendarDateFormat
ConvertSystemTimeToCalDateTime
MulDiv
GetTimeZoneInformation
lstrlenW
UpdateCalendarDayOfWeek
ConvertCalDateTimeToSystemTime
CheckElevationEnabled
GetUserDefaultUILanguage
QueryActCtxW
GlobalLock
GlobalUnlock
GetDynamicTimeZoneInformation
SetDynamicTimeZoneInformation
CompareStringOrdinal
CompareFileTime
RegEnumKeyExW

ntdll

EtwEventRegister
EtwEventUnregister
EtwEventWrite
WinSqmIsOptedIn
WinSqmSetString
WinSqmSetDWORD
NtOpenProcessToken
NtAdjustPrivilegesToken
NtClose

ole32

CoGetObject
HWND_UserUnmarshal
HWND_UserFree
HWND_UserFree64
HWND_UserSize64
HWND_UserSize
HWND_UserMarshal
HWND_UserMarshal64
HWND_UserUnmarshal64

user32

SetForegroundWindow
FindWindowW
RegisterClassExW
GetClassInfoExW
DispatchMessageW
TranslateMessage
DefWindowProcW
SetProcessDPIAware
IsWindow
GetWindowTextW
GetAncestor
DestroyWindow
CreateWindowExW
PostMessageW
GetDlgItemTextW
IsDlgButtonChecked
CheckDlgButton
SetWindowLongPtrW
GetMessageW
GetParent
SendDlgItemMessageW
GetWindowLongW
SetWindowTextW
ShowWindow
SetDlgItemTextW
DialogBoxParamW
InvalidateRect
GetWindow
SetWindowPos
MapWindowPoints
GetWindowRect
PostThreadMessageW
SystemParametersInfoW
GetClientRect
EnableWindow
SetFocus
EndDialog
SetWindowRgn
AdjustWindowRectEx
GetCursorPos
PtInRect
CalculatePopupWindowPosition
GetKeyState
RegisterClassW
GetFocus
GetWindowTextLengthW
MoveWindow
UpdateWindow
GetWindowInfo
GetSystemMetrics
SetRect
SetWindowLongW
BeginPaint
EndPaint
GetProcessDefaultLayout
SetTimer
KillTimer
GetWindowLongPtrW
SetCursor
LoadCursorW
GetWindowBand
InflateRect
CreateWindowInBand
GetDC
GetDlgItem
SendMessageW
GetSysColor
ReleaseDC

uxtheme

CloseThemeData
GetThemeBackgroundRegion
OpenThemeData

gdi32

SelectObject
GetTextExtentPoint32W
DeleteObject
GetDeviceCaps
CreateFontIndirectW
PtInRegion
GetDCBrushColor

api-ms-win-core-processenvironment-l1-1-0

SearchPathW

api-ms-win-core-memory-l1-1-0

MapViewOfFile
CreateFileMappingW
UnmapViewOfFile

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

CPlApplet
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo

Sections

.text
Size: 139KB - Virtual size: 139KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 276KB - Virtual size: 275KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-CA/windows.ui.xaml.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-CA/xpsrchvw.exe.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-FR/SwitcherDataModel.dll
.dll windows x64

ee89f7d55aa4341efaa26820526cfe58

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-crt-private-l1-1-0

_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o_malloc
_o_realloc
_o_terminate
__C_specific_handler
_o__crt_atexit
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o__cexit
_o__configure_narrow_argv
_o___std_type_info_destroy_list
__std_terminate
_o___std_exception_destroy
_o___std_exception_copy
__CxxFrameHandler3
_o__callnewh
_CxxThrowException
memcpy

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsCompareStringOrdinal
WindowsDuplicateString
WindowsCreateStringReference
WindowsCreateString
WindowsGetStringRawBuffer
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo
RoOriginateError
RoOriginateErrorW
RoTransformError
GetRestrictedErrorInfo

api-ms-win-core-synch-l1-1-0

OpenSemaphoreW
ReleaseMutex
WaitForSingleObject
ReleaseSemaphore
CreateMutexExW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CreateEventExW
ReleaseSRWLockShared
AcquireSRWLockShared
CreateSemaphoreExW
EnterCriticalSection
InitializeSRWLock
LeaveCriticalSection
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameA
DisableThreadLibraryCalls

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
OpenProcessToken
GetCurrentProcess
TerminateProcess
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
SetLastError

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
OpenProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory

api-ms-win-core-com-l1-1-0

CoGetApartmentType
CoCreateFreeThreadedMarshaler
CoCreateInstance
CoMarshalInterface
CreateStreamOnHGlobal
CoReleaseMarshalData
CoWaitForMultipleHandles
CoTaskMemAlloc

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-winrt-error-l1-1-1

RoReportFailedDelegate
IsErrorPropagationEnabled
RoGetMatchingRestrictedErrorInfo

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventSetInformation
EventWriteTransfer
EventActivityIdControl

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceComplete
InitOnceExecuteOnce

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegGetValueW

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolAllowThreadReuse
SHTaskPoolQueueTask
SHTaskPoolGetUniqueContext

msvcp_win

?_Xlength_error@std@@YAXPEBD@Z

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 132KB - Virtual size: 132KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-FR/SyncInfrastructure.dll
.dll regsvr32 windows x64

2557035442a013649c8063955d83660f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_amsg_exit
_XcptFilter
_callnewh
malloc
memmove_s
calloc
free
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_errno
memcpy
_CxxThrowException
_ltow
_wtoi64
_wmakepath_s
wcsrchr
_wtol
_vsnprintf
_wsplitpath_s
swprintf_s
_initterm
_lock
_onexit
__CxxFrameHandler3
_unlock
__dllonexit
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
_purecall
wcscat_s
wcscpy_s
memcpy_s
_vsnwprintf
__C_specific_handler
realloc
memset

ntdll

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

kernel32

ReadFile
GetCurrentThread
DelayLoadFailureHook
ResolveDelayLoadedAPI
GetModuleFileNameA
SetThreadLocale
CreateSemaphoreExW
HeapFree
SetLastError
EnterCriticalSection
ReleaseSemaphore
GetModuleHandleExW
GetThreadLocale
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
OutputDebugStringW
DisableThreadLibraryCalls
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
RaiseException
HeapAlloc
LockResource
CreateMutexExW
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
WriteFile
DebugBreak
LoadLibraryExW
IsDebuggerPresent
CreateEventW
SetEvent
CreateThread
ResetEvent
InitOnceBeginInitialize
QueueUserWorkItem
ReleaseSRWLockExclusive
InitOnceComplete
AcquireSRWLockExclusive
GetSystemTimeAsFileTime
GetTickCount64
MultiByteToWideChar
WideCharToMultiByte
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
WakeAllConditionVariable
SleepConditionVariableSRW
QueryPerformanceCounter
GetTickCount
OutputDebugStringA
FindResourceExW
DeleteFileW
LocalFree
SizeofResource
CreateFileW
GetModuleHandleW
LoadResource
GetFileAttributesW
CopyFileW
VirtualFree
VirtualAlloc
LoadLibraryExA
EncodePointer
DecodePointer
OpenEventW
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
GetProcAddress

user32

DestroyWindow
DefWindowProcW
CreateWindowExW
UnregisterClassW
RegisterClassExW
UnregisterClassA
CallWindowProcW
GetWindowLongPtrW
SetTimer
CharUpperBuffW
KillTimer
CharLowerBuffW
GetMessageW
PostMessageW
SetWindowLongPtrW
PostThreadMessageW
DispatchMessageW
TranslateMessage
LoadCursorW
GetClassInfoExW
GetSystemMetrics

ole32

PropVariantCopy
CoTaskMemFree
CoTaskMemAlloc
GetRunningObjectTable
CreateItemMoniker
CoRevokeClassObject
StringFromCLSID
CoRegisterClassObject
CoInitializeEx
CoUninitialize
CoReleaseServerProcess
CoAddRefServerProcess
CoCreateInstance
StringFromGUID2
PropVariantClear
CoCreateGuid
StgOpenStorageEx
StgCreateStorageEx
CoResumeClassObjects
CLSIDFromString

oleaut32

SysStringByteLen
VariantInit
SysAllocStringLen
VarBstrCat
VariantClear
DispCallFunc
VarBstrCmp
VarUI8FromStr
SysAllocStringByteLen
SysStringLen
SysAllocString
SysFreeString

shlwapi

PathCombineW
PathAddBackslashW
SHStrDupW
StrStrIW
StrStrA
StrStrW
StrCmpNIW
StrCmpIW
ord219

advapi32

EventUnregister
RegOpenKeyExW
UnregisterTraceGuids
RegisterTraceGuidsW
OpenThreadToken
OpenProcessToken
GetTokenInformation
ConvertSidToStringSidW
GetTraceEnableLevel
EventRegister
GetTraceLoggerHandle
RegQueryInfoKeyW
RegCloseKey
EventWriteTransfer
EventActivityIdControl
EventSetInformation
RegGetValueW
RegEnumKeyExW
RegSetKeyValueW
EventWrite
GetTraceEnableFlags
TraceMessage

propsys

PropVariantToBSTR
PropVariantToUInt64
InitPropVariantFromCLSID
InitPropVariantFromFileTime
PSCreateMemoryPropertyStore
PropVariantToUInt32
PropVariantCompareEx
PropVariantToGUID

crypt32

CryptProtectData
CryptUnprotectData

wtsapi32

WTSUnRegisterSessionNotification
WTSRegisterSessionNotification

shell32

SHParseDisplayName
SHGetKnownFolderPath
SHBindToParent
SHCreateDirectoryExW
SHCreateShellItem

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 312KB - Virtual size: 311KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-FR/SyncInfrastructureps.dll
.dll regsvr32 windows x64

dedd8f7e717a33fdf541c4e32877874d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_XcptFilter
_initterm
malloc
free
_amsg_exit
__C_specific_handler
memcmp

kernel32

RtlVirtualUnwind
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
DisableThreadLibraryCalls
Sleep
QueryPerformanceCounter

combase

CStdStubBuffer_Disconnect
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Connect
ord3
NdrCStdStubBuffer_Release
CStdStubBuffer_QueryInterface
ord9
ord8
ord7
ord5
CStdStubBuffer_AddRef
ord4
ord12
ord2
CStdStubBuffer_DebugServerQueryInterface
ord10
ord11
CStdStubBuffer_Invoke
CStdStubBuffer_DebugServerRelease
ord6
CStdStubBuffer_CountRefs

oleaut32

LPSAFEARRAY_UserMarshal64
LPSAFEARRAY_UserFree64
LPSAFEARRAY_UserUnmarshal
LPSAFEARRAY_UserFree
BSTR_UserUnmarshal64
BSTR_UserSize64
LPSAFEARRAY_UserSize
BSTR_UserFree
BSTR_UserMarshal64
BSTR_UserSize
BSTR_UserFree64
LPSAFEARRAY_UserMarshal
LPSAFEARRAY_UserUnmarshal64
BSTR_UserMarshal
BSTR_UserUnmarshal
LPSAFEARRAY_UserSize64

rpcrt4

IUnknown_AddRef_Proxy
NdrOleFree
IUnknown_Release_Proxy
NdrDllCanUnloadNow
IUnknown_QueryInterface_Proxy
NdrDllUnregisterProxy
NdrDllRegisterProxy
NdrDllGetClassObject
NdrOleAllocate

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-FR/Syncreg.dll
.dll regsvr32 windows x64

5d1427a119fe6c1eda9acbba3bb1d0cb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_initterm
__C_specific_handler
malloc
free
_XcptFilter
_amsg_exit
_vsnwprintf
memset

api-ms-win-core-com-l1-1-0

CoCreateInstance
IIDFromString
CoCreateGuid
CoTaskMemFree
CoCreateFreeThreadedMarshaler
StringFromGUID2

api-ms-win-core-libraryloader-l1-1-0

FreeLibrary
GetModuleFileNameW

api-ms-win-core-registry-l1-1-0

RegNotifyChangeKeyValue
RegOpenCurrentUser
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
RegGetValueW
RegSetValueExW
RegCreateKeyExW
RegEnumKeyExW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-heap-l1-1-0

HeapFree
HeapDestroy
HeapAlloc
GetProcessHeap

api-ms-win-core-synch-l1-1-0

ResetEvent
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
CreateEventW
WaitForSingleObject
DeleteCriticalSection

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
RegisterTraceGuidsW
GetTraceEnableFlags
UnregisterTraceGuids

api-ms-win-security-base-l1-1-0

AllocateAndInitializeSid
CheckTokenMembership
FreeSid

api-ms-win-core-localization-l1-2-0

FormatMessageW

oleaut32

SetErrorInfo
GetErrorInfo
CreateErrorInfo

api-ms-win-core-file-l1-1-0

GetFullPathNameW
FindFirstFileW
FindClose

api-ms-win-core-localization-l1-2-2

LCIDToLocaleName

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-registry-l2-1-0

RegSetValueW
RegDeleteKeyW

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

ext-ms-win-shell-propsys-l1-1-0

PSCreateMemoryPropertyStore

propsys

InitPropVariantFromCLSID

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-FR/WWAHost.exe.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 22KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-FR/Windows.Media.Speech.UXRes.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-FR/cdosys.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 50KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-FR/comctl32.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-FR/comdlg32.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 61KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-FR/fms.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-FR/mlang.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-FR/msimsg.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 92KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-FR/msprivs.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-FR/swprv.dll
.dll regsvr32 windows x64

231b48edabab666bcea5356ff3f00252

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_vsnwprintf
_wcsnicmp
_wcsicmp
memcpy_s
wcschr
_callnewh
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_CxxThrowException
_XcptFilter
_amsg_exit
_initterm
??1type_info@@UEAA@XZ
_lock
_unlock
__dllonexit
??0exception@@QEAA@XZ
_wtoi64
memmove_s
wcsncmp
wcscpy_s
wcscat_s
??0exception@@QEAA@AEBQEBD@Z
iswdigit
_vsnprintf
malloc
_purecall
realloc
free
memcpy
memcmp
_onexit
_errno
_beginthreadex
memmove
__CxxFrameHandler3
towupper
__C_specific_handler
?terminate@@YAXXZ
memset

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
OpenThreadToken
GetCurrentThread
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
ResumeThread
OpenProcessToken
SetThreadToken

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter
GetLastError

api-ms-win-core-synch-l1-1-0

SetWaitableTimer
EnterCriticalSection
WaitForSingleObject
CancelWaitableTimer
LeaveCriticalSection
CreateWaitableTimerExW
DeleteCriticalSection
CreateEventW
ResetEvent
InitializeCriticalSection

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-file-l1-1-0

ReadFile
CreateFileW
GetVolumeInformationW
FindVolumeClose
GetVolumePathNameW
GetDiskFreeSpaceExW
FindNextVolumeW
GetDriveTypeW
GetFileAttributesW
FindFirstVolumeW

api-ms-win-core-io-l1-1-0

GetOverlappedResult
DeviceIoControl

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleHandleW
SizeofResource
LoadResource
FindResourceExW
GetModuleFileNameW
DisableThreadLibraryCalls
LoadLibraryExW
GetProcAddress
LoadStringW

api-ms-win-core-string-l2-1-0

CharNextW
CharPrevW

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegQueryValueExW
RegDeleteTreeW
RegDeleteValueW
RegGetValueW
RegCreateKeyExW
RegEnumValueW
RegCloseKey
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW

api-ms-win-core-string-obsolete-l1-1-0

lstrcpynW
lstrcmpiW

api-ms-win-core-memory-l1-1-0

VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetSystemWindowsDirectoryW
GetComputerNameExW
GetVersionExW
GetSystemTimeAsFileTime
GetTickCount
GetSystemDirectoryW
GetWindowsDirectoryW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree
HeapDestroy

ntdll

RtlCompareMemory
NtQueryVolumeInformationFile
RtlInitializeBitMap
NtQuerySystemInformation
RtlNtStatusToDosError
RtlTimeToElapsedTimeFields
WinSqmAddToStream
RtlNtStatusToDosErrorNoTeb

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW
GetVolumePathNamesForVolumeNameW

devobj

DevObjEnumDeviceInterfaces
DevObjGetDeviceInterfaceDetail
DevObjGetClassDevs
DevObjCreateDeviceInfoList
DevObjGetDeviceRegistryProperty
DevObjDestroyDeviceInfoList

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
GetCommandLineW

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

vsstrace

ord5
ord9
ord2
ord1
ord7
ord8
ord6
ord3
ord10
ord11
ord4

api-ms-win-security-base-l1-1-0

CheckTokenMembership
AllocateAndInitializeSid
AdjustTokenPrivileges
FreeSid
CreateWellKnownSid
IsValidSid
AddAccessAllowedAceEx
InitializeSecurityDescriptor
AddAccessDeniedAceEx
InitializeAcl
AddAce
DuplicateTokenEx
GetTokenInformation
GetAclInformation
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
GetAce
CopySid
GetLengthSid
SetSecurityDescriptorOwner

api-ms-win-eventlog-legacy-l1-1-0

ReportEventW
DeregisterEventSource
RegisterEventSourceW

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

virtdisk

GetStorageDependencyInformation

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
ServiceMain

Sections

.text
Size: 291KB - Virtual size: 290KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 139KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 556B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-FR/sxs.dll
.dll windows x64

6de0f7a8bbc62d2cc10e30b6f33f0899

Code Sign

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03-07-2018 20:45

Not After

26-07-2019 20:45

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:7c:ab:5d:eb:ef:fc:d2:63:03:68:77:f9:c7:ec:a1:54:75:c2:1e:4d:92:d7:42:54:fb:64:5a:1c:9d:65:37
Signer

Actual PE Digest

08:7c:ab:5d:eb:ef:fc:d2:63:03:68:77:f9:c7:ec:a1:54:75:c2:1e:4d:92:d7:42:54:fb:64:5a:1c:9d:65:37

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

13-01-2023 12:41
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

DbgPrintEx
RtlRaiseStatus
RtlCaptureContext
RtlLookupFunctionEntry
RtlDowncaseUnicodeChar
EtwEventRegister
EtwEventUnregister
EtwEventWrite
__C_specific_handler
RtlCopyMappedMemory
LdrResSearchResource
RtlGetVersion
_wcsicmp
RtlUnhandledExceptionFilter
_vsnprintf_s
_snprintf_s
RtlGetFrame
wcsrchr
RtlHashUnicodeString
RtlNtStatusToDosError
_vsnwprintf_s
RtlDetermineDosPathNameType_U
wcsstr
RtlIsCloudFilesPlaceholder
wcsspn
wcscspn
RtlGetNtSystemRoot
RtlNtStatusToDosErrorNoTeb
RtlFindCharInUnicodeString
vsprintf_s
vDbgPrintEx
wcscat_s
swprintf_s
NtQueryDebugFilterState
sprintf_s
RtlCompareUnicodeString
RtlUpcaseUnicodeChar
qsort
bsearch
_lfind
RtlPopFrame
_i64tow
RtlVirtualUnwind
wcschr
RtlFreeUnicodeString
RtlLcidToLocaleName
wcscpy_s
RtlPushFrame
memmove
__chkstk
memcmp
memcpy
memset

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringA

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
SetLastError
RaiseException
UnhandledExceptionFilter

api-ms-win-core-file-l1-1-0

SetFileAttributesW
FindClose
RemoveDirectoryW
FindNextFileW
GetFileInformationByHandle
WriteFile
GetFileAttributesExW
GetFullPathNameW
CreateFileW
GetFileAttributesW
CreateDirectoryW
DeleteFileW
SetFilePointerEx
ReadFile
FlushFileBuffers
FindFirstFileW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleFileNameW
LoadLibraryExW
GetProcAddress
GetModuleHandleW
FreeLibrary

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-localization-l1-2-0

FormatMessageA
FormatMessageW
GetThreadPreferredUILanguages

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW
RegCloseKey
RegOpenKeyExW
RegDeleteKeyExW
RegQueryValueExW
RegQueryInfoKeyW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
SearchPathW

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
GetStringTypeW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-security-base-l1-1-0

FreeSid
CheckTokenMembership
AllocateAndInitializeSid

kernel32

DelayLoadFailureHook
ResolveDelayLoadedAPI
GetSystemWow64DirectoryW
WerUnregisterFile
WerRegisterFile
LocalFree
SystemTimeToTzSpecificLocalTime
DeviceIoControl
FindActCtxSectionGuid
QueryActCtxW
FindActCtxSectionStringW

api-ms-win-core-memory-l1-1-0

CreateFileMappingW
MapViewOfFile
UnmapViewOfFile

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSection

Exports

Exports

CreateAssemblyCache
CreateAssemblyNameObject
SxsBeginAssemblyInstall
SxsEndAssemblyInstall
SxsFindClrClassInformation
SxsFindClrSurrogateInformation
SxsGenerateActivationContext
SxsInstallW
SxsLookupClrGuid
SxsOleAut32MapConfiguredClsidToReferenceClsid
SxsOleAut32MapIIDOrCLSIDToTypeLibrary
SxsOleAut32MapIIDToProxyStubCLSID
SxsOleAut32MapIIDToTLBPath
SxsOleAut32MapReferenceClsidToConfiguredClsid
SxsOleAut32RedirectTypeLibrary
SxsProbeAssemblyInstallation
SxsQueryManifestInformation
SxsRunDllInstallAssembly
SxsRunDllInstallAssemblyW
SxsUninstallW
SxspGenerateManifestPathOnAssemblyIdentity

Sections

.text
Size: 390KB - Virtual size: 389KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 177KB - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-FR/sxshared.dll
.dll regsvr32 windows x64

c44d718caaa51e42552782a8021674bf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

__C_specific_handler
_onexit
_unlock
_lock
_initterm
malloc
_amsg_exit
_XcptFilter
free
__dllonexit

ntdll

RtlGetLastNtStatus
RtlNtStatusToDosError
EtwTraceMessage
EtwUnregisterTraceGuids
EtwGetTraceEnableFlags
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwRegisterTraceGuidsW

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
ReleaseSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetProcAddress
LoadLibraryExA

api-ms-win-core-errorhandling-l1-1-0

RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TlsGetValue
GetCurrentProcessId
TlsSetValue
TlsAlloc
TerminateProcess
GetCurrentThreadId
TlsFree

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemInfo
GetTickCount

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-memory-l1-1-0

VirtualProtect
VirtualQuery

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetLastFailureAsHRESULT
HRESULTFromNTSTATUS
SxTracerDebuggerBreak
SxTracerGetThreadContextDebug
SxTracerGetThreadContextRetail
SxTracerShouldTrackFailure
Win32FromHRESULT
Win32FromNTSTATUS

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-FR/sxssrv.dll
.dll windows x64

4bf8e692f4bd33947c8b7b301408157e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

NtClose
RtlInitializeCriticalSection
RtlDosPathNameToNtPathName_U_WithStatus
RtlAllocateHeap
DbgPrintEx
NtWriteVirtualMemory
NtUnmapViewOfSection
RtlFreeHeap
NtOpenFile
NtQueryInformationFile
LdrLoadDll
LdrGetProcedureAddress
LdrUnloadDll
RtlpApplyLengthFunction
RtlGetLengthWithoutTrailingPathSeperators
RtlMultiAppendUnicodeStringBuffer
RtlFreeUnicodeString
RtlAppendUnicodeToString
RtlLeaveCriticalSection
RtlInitializeGenericTableAvl
RtlInitUnicodeString
NtOpenKey
NtQueryValueKey
RtlCompareUnicodeString
RtlLookupElementGenericTableAvl
RtlLookupElementGenericTableFullAvl
RtlInsertElementGenericTableFullAvl
RtlNumberGenericTableElementsAvl
RtlDeleteElementGenericTableAvl
RtlEnumerateGenericTableAvl
LdrDisableThreadCalloutsForDll
NtTerminateProcess
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnhandledExceptionFilter
memcpy
RtlEnterCriticalSection
__C_specific_handler
RtlCreateUnicodeString
wcscat_s
RtlGetLengthWithoutLastFullDosOrNtPathElement
RtlExpandEnvironmentStrings_U
RtlNtStatusToDosErrorNoTeb
NtDuplicateObject
NtMapViewOfSection
NtCreateSection
RtlGetThreadPreferredUILanguages
RtlpEnsureBufferSize
NtReadVirtualMemory
RtlDoesFileExists_U
RtlCopyMappedMemory
NtApphelpCacheControl
RtlInitUnicodeStringEx
memcmp
memset

csrsrv

CsrRevertToSelf
CsrImpersonateClient
CsrValidateMessageBuffer

basesrv

BaseSrvRegisterSxS

Exports

Exports

ServerDllInitialization

Sections

.text
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 116B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-FR/sxsstore.dll
.dll windows x64

cdc02eb80da2e9076bb22ef7d44fd56a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

__C_specific_handler
malloc
_amsg_exit
memcpy
_initterm
_XcptFilter
free
_callnewh
memset

ntdll

RtlCaptureContext
RtlDetermineDosPathNameType_U
RtlLookupFunctionEntry
RtlVirtualUnwind

kernel32

TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
GetModuleHandleW
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
GetProcAddress
InitializeCriticalSection
DeleteCriticalSection
GetFileAttributesW
GetFullPathNameW
GetCurrentThread
CloseHandle
ExitProcess

advapi32

OpenThreadToken
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RevertToSelf
ImpersonateSelf

rpcrt4

CStdStubBuffer_Invoke
RpcStringFreeW
UuidToStringW
UuidCreate
CStdStubBuffer_Connect
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
NdrCStdStubBuffer_Release
NdrOleAllocate
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
NdrDllGetClassObject
IUnknown_AddRef_Proxy

api-ms-win-core-com-l1-1-0

CoImpersonateClient
CoRevertToSelf
CoGetCallContext

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient3
ObjectStublessClient6
ObjectStublessClient4
ObjectStublessClient5

Exports

Exports

DllGetClassObject
DllMain
SxsStoreFinalize
SxsStoreInitialize

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 804B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-FR/sysclass.dll
.dll windows x64

5c317b4785c1c3ce395f95788fb0f892

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

__C_specific_handler
_XcptFilter
_initterm
malloc
free
_amsg_exit

kernel32

QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
Sleep
GetCurrentProcessId

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 114KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-FR/sysdm.cpl
.dll windows x64

898437790637c5d8af09a923aa4c00cf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

memcpy
?what@exception@@UEBAPEBDXZ
_CxxThrowException
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
memmove
__CxxFrameHandler3
memset
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
_initterm
malloc
_amsg_exit
_XcptFilter
vswprintf_s
_purecall
_wcsicmp
_vsnprintf
__C_specific_handler
iswspace
memmove_s
wcschr
tolower
toupper
isalpha
free
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
??3@YAXPEAX@Z
memcpy_s
_vsnwprintf
??_V@YAXPEAX@Z
_callnewh
wcscmp

comctl32

CreatePropertySheetPageW
PropertySheetW

shell32

ord169
SHBrowseForFolderW
SHGetPathFromIDListW
ord680
ShellExecuteExW
ExtractIconW
ord195
SHCreateDirectoryExW
ord258
ord259
ord100
ord168
ord167
ord730

shlwapi

StrToIntExW
ord388
SHRegGetValueW
ord437
PathGetCharTypeW
PathRemoveBlanksW
ord450
StrDupW
StrChrW
ord158
ord460
StrStrIW
PathUnquoteSpacesW
AssocQueryStringW
ord154
StrRChrW
StrFormatByteSizeW
ord10
SHSetValueW
StrToIntW
PathBuildRootW
ord629

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
LoadLibraryExW
FreeLibrary
LoadStringW
GetModuleFileNameA
GetProcAddress
GetModuleHandleW
GetModuleHandleExW

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
CreateSemaphoreExW
ReleaseSemaphore
ReleaseMutex
WaitForSingleObject

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapSetInformation
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThreadId
OpenProcessToken
GetCurrentProcessId
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW
GetSystemDefaultLangID
FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l2-1-0

GlobalFree
GlobalAlloc
LocalReAlloc
LocalAlloc
LocalFree

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
GetEnvironmentVariableW

api-ms-win-core-file-l1-1-0

GetTempFileNameW
CreateFileW
FindNextFileW
FindClose
FindFirstFileW
GetFileAttributesExW
GetFileAttributesW
GetDriveTypeW
GetFullPathNameW
GetDiskFreeSpaceW
GetLogicalDrives
QueryDosDeviceW
GetVolumeInformationW
DeleteFileW
SetFileAttributesW
FileTimeToLocalFileTime

api-ms-win-security-base-l1-1-0

AdjustTokenPrivileges
FreeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetAce
AddAccessAllowedAce
CreateWellKnownSid
GetLengthSid
CopySid
AllocateAndInitializeSid
InitializeAcl

api-ms-win-security-lsalookup-l2-1-0

LookupAccountNameW
LookupPrivilegeValueW
LookupAccountSidW

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetTickCount
GetWindowsDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime

api-ms-win-core-registry-l1-1-0

RegUnLoadKeyW
RegOpenKeyExW
RegQueryValueExW
RegFlushKey
RegSetValueExW
RegCloseKey
RegQueryInfoKeyW
RegLoadKeyW
RegCreateKeyExW
RegEnumValueW
RegSetKeySecurity
RegDeleteValueW

api-ms-win-core-com-l1-1-0

CoTaskMemRealloc
CoGetMalloc
CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitializeSecurity

api-ms-win-core-string-l1-1-0

CompareStringW
CompareStringOrdinal

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-version-l1-1-1

GetFileVersionInfoSizeW
GetFileVersionInfoW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventWriteTransfer
EventSetInformation

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-datetime-l1-1-0

GetDateFormatW

userenv

ord209
DeleteProfileW
ord202

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceComplete
InitOnceBeginInitialize

rpcrt4

UuidCompare

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

setupapi

pSetupIsUserAdmin
pSetupDoesUserHavePrivilege

profapi

ord104

bcd

BcdOpenObject
BcdOpenSystemStore
BcdCloseObject
BcdGetElementData
BcdCloseStore
BcdSetElementData

advapi32

GetUserNameW
RegEnumKeyW
RegSaveKeyW

comdlg32

GetOpenFileNameW

gdi32

GetTextExtentPoint32W
CreateFontIndirectW
SelectObject
GetStockObject
GetObjectW

imagehlp

UnMapAndLoad
MapAndLoad

kernel32

Wow64EnableWow64FsRedirection
lstrlenW
GetComputerNameW
GlobalReAlloc
GetUserDefaultUILanguage
GlobalDeleteAtom
GlobalAddAtomW
GlobalLock
GetPrivateProfileStringW
GlobalUnlock
lstrcmpW

ntdll

NtSetSystemInformation
NtQuerySystemInformation
NtCreatePagingFile
RtlInitUnicodeStringEx
RtlAdjustPrivilege
RtlSetSystemBootStatus
RtlGetSystemBootStatus
RtlCopySid
RtlLengthSid
NtQueryInformationToken
RtlFreeUnicodeString
RtlInitUnicodeString
RtlConvertSidToUnicodeString
WinSqmAddToStream

ole32

ReleaseStgMedium
CoInitialize

user32

MessageBoxW
GetFocus
MessageBeep
ShowWindow
SetTimer
IsWindowEnabled
GetSystemMetrics
SendDlgItemMessageW
GetClientRect
GetWindowTextW
SetDlgItemTextW
ReleaseDC
SetCursor
PostMessageW
EndDialog
LoadCursorW
ScreenToClient
CheckRadioButton
IsDlgButtonChecked
CheckDlgButton
SetWindowTextW
SetWindowPos
EnableWindow
GetWindowLongPtrW
RegisterClipboardFormatW
EnumChildWindows
BeginDeferWindowPos
SetWindowLongPtrW
MapWindowPoints
SendNotifyMessageW
SetProcessDPIAware
GetDlgItem
SetFocus
GetDlgItemTextW
GetParent
SendMessageW
DialogBoxParamW
CreateWindowExW
UnregisterClassW
SwitchToThisWindow
EndDeferWindowPos
GetLastActivePopup
RemovePropW
DestroyWindow
LoadIconW
ShowCursor
MapDialogRect
GetMessagePos
GetClassNameW
DefWindowProcW
GetDC
GetWindow
DestroyIcon
InvalidateRect
DeferWindowPos
MoveWindow
RegisterClassW
SetDlgItemInt
GetDlgItemInt
FindWindowW
GetPropW
GetWindowRect
SetPropW

winsta

WinStationBroadcastSystemMessage

Exports

Exports

DisplaySYSDMCPL
EditEnvironmentVariables
EditUserProfiles
EnableExecuteProtectionSupportW
ModifyExecuteProtectionSupportW
NoExecuteAddFileOptOutList
NoExecuteAddFileOptOutListW
NoExecuteProcessExceptionW
NoExecuteRemoveFileOptOutList
NoExecuteRemoveFileOptOutListW

Sections

.text
Size: 91KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 199KB - Virtual size: 199KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-FR/sysmain.dll
.dll regsvr32 windows x64

ff37227159117322a124c6ccc5c2f93b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_wtof
rand
wcstok
_errno
malloc
memmove_s
_callnewh
memcpy_s
isprint
iswascii
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_CxxThrowException
memcpy
memmove
__iob_func
_XcptFilter
towupper
_wcslwr
wcstoul
_amsg_exit
tolower
iswspace
free
wcsncmp
_initterm
_strupr
_wcsupr_s
swscanf_s
wcsstr
_purecall
_wcsnicmp
feof
fgetws
wcschr
strnlen
strchr
strstr
_wfopen
_wcsupr
??3@YAXPEAX@Z
_wcsicmp
srand
wcsnlen
bsearch
qsort
fclose
fopen
_lock
_unlock
__dllonexit
_onexit
_wtoi
??1type_info@@UEAA@XZ
strcmp
sqrt
exp
powf
fprintf
memset
_vsnprintf
memcmp
_vsnwprintf
log
__C_specific_handler
__CxxFrameHandler3
??0exception@@QEAA@AEBQEBDH@Z
wcscmp

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlCompareMemory
ZwSetValueKey
ZwClose
ZwQueryValueKey
ZwCreateKey
RtlRandom
WinSqmAddToStreamEx
WinSqmAddToStream
WinSqmSetDWORD
WinSqmEndSession
WinSqmStartSession
WinSqmIsOptedIn
RtlInitUnicodeStringEx
RtlFreeUnicodeString
NtReadFile
NtSetInformationFile
RtlRbInsertNodeEx
NtQueryValueKey
RtlGetPersistedStateLocation
RtlRandomEx
RtlImageRvaToVa
RtlImageDirectoryEntryToData
RtlFindClearBitsAndSet
RtlInitializeBitMap
RtlClearBits
NtAllocateVirtualMemory
RtlFindLastBackwardRunClear
NtFreeVirtualMemory
NtSetInformationProcess
NtQueryDirectoryFile
RtlFreeHeap
RtlDosPathNameToNtPathName_U
DbgPrint
NtCreateKey
NtQueryInformationThread
RtlQueryWnfStateData
RtlDecompressBufferEx
RtlRbRemoveNode
RtlCompressBuffer
RtlGetCompressionWorkSpaceSize
NtSetInformationThread
NtQueryInformationProcess
RtlQueryPackageIdentity
NtEnumerateValueKey
NtQueryVirtualMemory
NtDeleteKey
NtOpenFile
NtCreateFile
ZwAlpcCancelMessage
RtlWakeAddressAll
TpAllocAlpcCompletion
ZwAlpcDisconnectPort
ZwAlpcSendWaitReceivePort
TpReleaseAlpcCompletion
ZwAlpcQueryInformation
RtlWaitOnAddress
ZwAlpcConnectPort
TpWaitForAlpcCompletion
AlpcInitializeMessageAttribute
AlpcGetMessageAttribute
RtlAllocateHeap
EtwEventWriteTransfer
EtwEventUnregister
EtwEventRegister
vDbgPrintEx
RtlAreBitsClear
RtlRaiseException
RtlFindClearBits
RtlSetAllBits
RtlFindSetBits
RtlInterlockedSetBitRun
RtlNumberOfClearBitsInRange
RtlAreBitsSet
ZwAllocateVirtualMemory
ZwFreeVirtualMemory
RtlNumberOfSetBits
RtlSetBits
RtlTestBit
RtlClearAllBits
RtlNumberOfSetBitsInRange
NtQueryObject
NtQueryVolumeInformationFile
RtlGetSuiteMask
NtQueryLicenseValue
NtQueryInformationFile
RtlGetVersion
RtlImageNtHeader
NtDeviceIoControlFile
NtPowerInformation
RtlInitUnicodeString
RtlUpcaseUnicodeString
RtlUpcaseUnicodeChar
NtOpenEvent
NtOpenKey
NtQuerySystemInformation
RtlComputeCrc32
NtSetSystemInformation
RtlReleaseSRWLockShared
RtlAcquireSRWLockShared
RtlInitializeSRWLock
RtlAcquireSRWLockExclusive
RtlReleaseSRWLockExclusive
RtlNtStatusToDosError
NtClose
RtlQueryResourcePolicy

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
InitializeCriticalSectionEx
WaitForSingleObjectEx
ReleaseMutex
DeleteCriticalSection
ReleaseSemaphore
WaitForMultipleObjectsEx
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SetEvent
InitializeSRWLock
OpenSemaphoreW
SetWaitableTimerEx
CreateEventW
CreateWaitableTimerExW
CreateMutexExW
ResetEvent
CreateSemaphoreExW
WaitForSingleObject

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegGetValueW
RegDeleteTreeW
RegSetValueExW
RegQueryInfoKeyW
RegQueryValueExW
RegCopyTreeW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegEnumValueA
RegEnumValueW

api-ms-win-eventing-provider-l1-1-0

EventEnabled
EventWriteTransfer
EventUnregister
EventWrite
EventRegister
EventSetInformation

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceExecuteOnce

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleFileNameW
GetModuleHandleExW
SizeofResource
FreeLibraryAndExitThread
GetProcAddress
GetModuleHandleW
LoadLibraryExW
LockResource
LoadResource
GetModuleFileNameA
DisableThreadLibraryCalls
LoadStringW

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
OutputDebugStringA
IsDebuggerPresent
DebugBreak

api-ms-win-core-sysinfo-l1-1-0

GetWindowsDirectoryW
GetSystemWindowsDirectoryW
GetLocalTime
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetSystemTime
GetTickCount64
GetTickCount

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
LoadLibraryA
FindResourceW

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
ResumeThread
GetCurrentThread
GetThreadPriority
OpenProcessToken
OpenThreadToken
GetCurrentProcess
TerminateProcess
CreateProcessW
GetCurrentProcessId
OpenThread
CreateThread
SetThreadPriority
GetExitCodeProcess

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-memory-l1-1-0

CreateFileMappingW
FlushViewOfFile
MapViewOfFile
VirtualProtect
VirtualFree
UnmapViewOfFile
VirtualAlloc

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-security-base-l1-1-0

AddAccessAllowedAceEx
IsValidSid
RevertToSelf
CopySid
DuplicateTokenEx
AllocateAndInitializeSid
GetLengthSid
GetTokenInformation
CheckTokenMembership
InitializeAcl
EqualSid
ImpersonateSelf
AdjustTokenPrivileges
FreeSid
ImpersonateLoggedOnUser

api-ms-win-core-file-l1-1-0

FindFirstFileW
CompareFileTime
SetFilePointerEx
FindNextFileW
GetFileTime
WriteFile
GetFinalPathNameByHandleW
DeleteFileW
FindClose
SetEndOfFile
FindFirstFileExW
FlushFileBuffers
FindNextVolumeW
GetFileSizeEx
CreateFileW
GetFileAttributesW
ReadFile
SetFilePointer
SetFileAttributesW
FindVolumeClose
GetFileSize
FileTimeToLocalFileTime
GetFullPathNameW
FindFirstVolumeW
QueryDosDeviceW
LocalFileTimeToFileTime
SetFileInformationByHandle

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
HeapDestroy
GetProcessHeap
HeapCreate

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-synch-l1-2-1

CreateWaitableTimerW
WaitForMultipleObjects

api-ms-win-core-io-l1-1-0

DeviceIoControl
GetOverlappedResult

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceLoggerHandle
TraceEvent
GetTraceEnableFlags
RegisterTraceGuidsW
GetTraceEnableLevel
UnregisterTraceGuids

api-ms-win-devices-config-l1-1-1

CM_Get_Device_Interface_ListW
CM_Get_Device_Interface_List_SizeW

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CloseThreadpool
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
CreateThreadpool
SetThreadpoolTimer
CallbackMayRunLong
SetThreadpoolWait
CreateThreadpoolTimer

api-ms-win-core-file-l1-2-0

GetVolumePathNamesForVolumeNameW

api-ms-win-eventing-controller-l1-1-0

ControlTraceW

rpcrt4

RpcBindingFromStringBindingW
NdrClientCall3
RpcStringBindingComposeW
RpcBindingSetAuthInfoExW
RpcBindingFree
RpcServerUseProtseqEpW
RpcServerUnregisterIfEx
RpcStringFreeW
NdrServerCallAll
RpcImpersonateClient
RpcServerRegisterIf3
RpcBindingVectorFree
RpcServerInqBindings
RpcEpRegisterW
RpcEpUnregister
RpcServerRegisterAuthInfoW
NdrServerCall2
RpcRevertToSelf
RpcStringBindingParseW
RpcBindingToStringBindingW

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-io-l1-1-1

CancelIo

api-ms-win-eventing-consumer-l1-1-0

ProcessTrace
OpenTraceW
CloseTrace

api-ms-win-core-datetime-l1-1-0

GetDateFormatW
GetTimeFormatW

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-kernel32-legacy-l1-1-0

GetSystemPowerStatus
WTSGetActiveConsoleSessionId

api-ms-win-core-sidebyside-l1-1-0

DeactivateActCtx
FindActCtxSectionStringW
ActivateActCtx
CreateActCtxW
QueryActCtxW

powrprof

PowerSettingRegisterNotificationEx
PowerSetUserAwayPrediction
PowerClearUserAwayPrediction

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

AgGlLoad
AgPdLoad
AgTwLoad
CloseReadyBoostPerfData
CollectReadyBoostPerfData
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProviderClassID
MI_Main
OpenReadyBoostPerfData
PfSvSysprepCleanup
PfSvUnattendCallback
PfSvWsSwapAssessmentTask
SysMtServiceMain

Sections

.text
Size: 832KB - Virtual size: 832KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 120KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 600B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-FR/windows.ui.xaml.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-FR/xpsfilt.dll.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/fr-FR/xpsrchvw.exe.mui
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 92KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/svrmgrnc.dll
.dll windows x64

513899fac9fd5d626124c527807c0e63

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_initterm
malloc
free
_amsg_exit
__C_specific_handler
_XcptFilter
memset

advapi32

DuplicateTokenEx
OpenProcessToken
CreateProcessWithTokenW

kernel32

UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
SetUnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
RtlCaptureContext
Sleep
GetLastError
OpenProcess
CloseHandle
GetCurrentProcessId
QueryPerformanceCounter

user32

GetWindowThreadProcessId
FindWindowW

Exports

Exports

LaunchProcessWithShellToken

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/twinapi.appcore.dll
.dll windows x64

83bc34d9e73215a3f2d5c4fa4e51622f

Code Sign

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04-03-2020 18:30

Not After

03-03-2021 18:30

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

86:28:64:74:e3:5f:f1:12:9c:9f:76:08:f0:56:38:6b:b2:87:40:54:d9:be:a9:de:bd:50:e6:0b:54:6b:b7:36
Signer

Actual PE Digest

86:28:64:74:e3:5f:f1:12:9c:9f:76:08:f0:56:38:6b:b2:87:40:54:d9:be:a9:de:bd:50:e6:0b:54:6b:b7:36

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

13-01-2023 12:41
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-crt-private-l1-1-0

_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__ui64tow_s
_o__wcsicmp
memmove
_o_free
_o_iswspace
_o_malloc
_o_realloc
_o_strncpy_s
_o_strtol
_o_terminate
_o_toupper
__C_specific_handler
_CxxThrowException
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler3
memcmp
memcpy

rmclient

HamStartActivityAsync
HamQueryCallerTerminateReason
HamDisconnectForExtendedExecution
HamConnectForExtendedExecution
HamTerminateSelf
HamTryEstimateRemainingQuiesceTime
HamConnectToServer
HamDisconnectFromServer
HamCreateActivityForProcess
HamPopulateActivityProperties
HamTerminateActivityHost
HamCloseActivity
HamPopulateActivityPropertiesByClass

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetModuleHandleW
DisableThreadLibraryCalls
FreeLibrary
GetModuleFileNameA
LoadStringW
LoadLibraryExW
GetProcAddress
GetModuleFileNameW

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionAndSpinCount
EnterCriticalSection
SetEvent
DeleteCriticalSection
AcquireSRWLockShared
ReleaseSemaphore
WaitForSingleObjectEx
CreateMutexExW
OpenSemaphoreW
CreateEventW
TryAcquireSRWLockExclusive
InitializeSRWLock
AcquireSRWLockExclusive
CreateEventExW
ReleaseSRWLockExclusive
SetWaitableTimerEx
ReleaseMutex
ReleaseSRWLockShared
WaitForMultipleObjectsEx
WaitForSingleObject
ResetEvent
InitializeCriticalSectionEx
OpenEventW
LeaveCriticalSection
CreateWaitableTimerExW
CreateSemaphoreExW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetLastError
RaiseException
SetUnhandledExceptionFilter

api-ms-win-core-winrt-string-l1-1-0

WindowsStringHasEmbeddedNull
HSTRING_UserUnmarshal64
HSTRING_UserUnmarshal
HSTRING_UserMarshal64
HSTRING_UserFree
HSTRING_UserSize64
HSTRING_UserFree64
HSTRING_UserMarshal
HSTRING_UserSize
WindowsPreallocateStringBuffer
WindowsPromoteStringBuffer
WindowsDeleteStringBuffer
WindowsSubstring
WindowsSubstringWithSpecifiedLength
WindowsGetStringLen
WindowsIsStringEmpty
WindowsConcatString
WindowsCompareStringOrdinal
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsDuplicateString
WindowsCreateStringReference
WindowsCreateString

api-ms-win-eventing-provider-l1-1-0

EventProviderEnabled
EventRegister
EventSetInformation
EventActivityIdControl
EventWriteTransfer
EventUnregister

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
GetTraceEnableFlags
UnregisterTraceGuids
GetTraceLoggerHandle
RegisterTraceGuidsW
GetTraceEnableLevel

api-ms-win-core-winrt-l1-1-0

RoRegisterActivationFactories
RoRevokeActivationFactories
RoUninitialize
RoInitialize
RoGetActivationFactory
RoActivateInstance

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWait
CloseThreadpoolTimer
CloseThreadpoolWork
WaitForThreadpoolWaitCallbacks
SubmitThreadpoolWork
CreateThreadpoolTimer
WaitForThreadpoolWorkCallbacks
WaitForThreadpoolTimerCallbacks
CreateThreadpoolWork
SetThreadpoolWait
CreateThreadpoolWait
DisassociateCurrentThreadFromCallback
SetThreadpoolTimer

api-ms-win-core-processthreads-l1-1-0

GetProcessTimes
ExitProcess
GetCurrentThread
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
OpenThreadToken
OpenProcessToken
GetProcessId
OpenThread
GetCurrentThreadId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

GetHandleInformation
DuplicateHandle
CloseHandle

api-ms-win-core-winrt-error-l1-1-0

RoTransformError
SetRestrictedErrorInfo
RoTransformErrorW
RoOriginateErrorW
RoFailFastWithErrorContext
RoOriginateError
GetRestrictedErrorInfo

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlCaptureStackBackTrace

api-ms-win-core-processthreads-l1-1-1

OpenProcess
IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetVersionExW

api-ms-win-core-interlocked-l1-1-0

InterlockedFlushSList
InterlockedPushEntrySList
InitializeSListHead

api-ms-win-core-synch-l1-2-0

InitOnceInitialize
Sleep
WakeByAddressSingle
WaitOnAddress
InitOnceExecuteOnce
InitializeConditionVariable
WakeConditionVariable
InitOnceComplete
InitOnceBeginInitialize

api-ms-win-core-registry-l1-1-0

RegDeleteKeyExW
RegCreateKeyExW
RegEnumValueW
RegSetValueExW
RegOpenCurrentUser
RegGetValueW
RegSetKeySecurity
RegOpenKeyExW
RegEnumKeyExW
RegQueryValueExW
RegCloseKey
RegQueryInfoKeyW

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabled

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
GetCommandLineW

api-ms-win-core-heap-l2-1-0

GlobalAlloc
GlobalFree
LocalReAlloc
LocalFree
LocalAlloc

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
RoReportFailedDelegate
RoOriginateLanguageException

api-ms-win-security-base-l1-1-0

CreateWellKnownSid
FreeSid
GetTokenInformation
CopySid
GetLengthSid

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte
CompareStringOrdinal

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

rpcrt4

CStdStubBuffer_QueryInterface
CStdStubBuffer_Disconnect
NdrStubForwardingFunction
CStdStubBuffer_CountRefs
NdrClientCall3
RpcExceptionFilter
I_RpcBindingInqLocalClientPID
I_RpcMapWin32Status
CStdStubBuffer_IsIIDSupported
NdrStubCall3
UuidCreate
NdrCStdStubBuffer2_Release
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
CStdStubBuffer_Invoke
IUnknown_QueryInterface_Proxy
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
NdrOleFree
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
RpcBindingFree
RpcBindingBind
RpcBindingCreateW
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Connect

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-sysinfo-l1-2-0

GetProductInfo

api-ms-win-core-com-midlproxystub-l1-1-0

NdrProxyForwardingFunction3
ObjectStublessClient9
ObjectStublessClient8
ObjectStublessClient11
CStdStubBuffer2_CountRefs
ObjectStublessClient6
CStdStubBuffer2_Disconnect
CStdStubBuffer2_Connect
ObjectStublessClient7
ObjectStublessClient3
CStdStubBuffer2_QueryInterface
NdrProxyForwardingFunction4
NdrProxyForwardingFunction5
ObjectStublessClient10

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-memory-l1-1-0

MapViewOfFileEx
VirtualQueryEx
OpenFileMappingW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile

api-ms-win-core-threadpool-legacy-l1-1-0

CreateTimerQueueTimer
DeleteTimerQueueTimer
QueueUserWorkItem

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW
RegisterWaitForSingleObject

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrCmpNIW

api-ms-win-core-atoms-l1-1-0

GlobalAddAtomW
GlobalDeleteAtom

api-ms-win-core-psm-key-l1-1-0

PsmGetKeyFromProcess
PsmGetKeyFromToken

api-ms-win-core-winrt-registration-l1-1-0

RoGetActivatableClassRegistration
RoGetServerActivatableClasses

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-security-lsapolicy-l1-1-0

LsaClose
LsaQueryInformationPolicy
LsaFreeMemory
LsaOpenPolicy

combase

ord120
ord140
ord69
ord95
ord122
ord157
ord90

ntdll

RtlFlushHeaps
RtlQueryPackageIdentity
TpTrimPools
RtlUpcaseUnicodeChar
NtOpenProcessTokenEx
RtlUnsubscribeWnfStateChangeNotification
NtWaitForSingleObject
NtDelayExecution
RtlAllocateWnfSerializationGroup
RtlUnsubscribeWnfNotificationWithCompletionCallback
NtIsProcessInJob
NtQueryInformationJobObject
RtlRaiseStatus
RtlInitializeConditionVariable
NtResetEvent
RtlExpandEnvironmentStrings
RtlCompareUnicodeStrings
RtlReleaseSRWLockShared
RtlAcquireSRWLockShared
RtlAcquireSRWLockExclusive
RtlReleaseSRWLockExclusive
RtlSleepConditionVariableSRW
RtlInitializeSRWLock
NtClose
RtlQueryUnbiasedInterruptTime
RtlGUIDFromString
RtlFreeHeap
wcschr
RtlWakeAllConditionVariable
RtlInitUnicodeString
RtlAllocateHeap
RtlNtStatusToDosErrorNoTeb
RtlCompareUnicodeString
RtlFreeUnicodeString
RtlGetTokenNamedObjectPath
wcsrchr
NtQueryInformationToken
wcscspn
RtlLengthSid
RtlConvertDeviceFamilyInfoToString
RtlGetDeviceFamilyInfoEnum
strchr
RtlQueryWnfStateData
RtlFindLeastSignificantBit
TpSetWait
TpAllocWait
TpReleaseWait
TpWaitForWait
RtlRunOnceBeginInitialize
RtlRunOnceExecuteOnce
RtlEqualSid
RtlIsMultiSessionSku
RtlSubscribeWnfStateChangeNotification
NtQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlWaitOnAddress
NtQueryInformationProcess
RtlWakeAddressAll
RtlConvertSidToUnicodeString
WinSqmAddToStreamEx
WinSqmIsOptedIn
RtlNtStatusToDosError
RtlQueryPackageClaims
RtlLoadString

msvcp_win

??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@H@Z
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG0@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGXZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?uncaught_exception@std@@YA_NXZ
?flags@ios_base@std@@QEBAHXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
?good@ios_base@std@@QEBA_NXZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?pbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?_BADOFF@std@@3_JB
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?_Xlength_error@std@@YAXPEBD@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z

api-ms-win-service-management-l1-1-0

OpenSCManagerW
OpenServiceW
CloseServiceHandle

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-service-private-l1-1-0

WaitServiceState

Exports

Exports

BiActivateWorkItemForUser
BiChangeApplicationStateForPackageName
BiChangeApplicationStateForPackageNameForUser
BiChangeApplicationStateForPsmKey
BiChangeApplicationStateForPsmKeyForUser
BiChangeSessionState
BiChangeUserState
BiEnumerateWorkItemsForPackageNameAndUser
BiGetActiveBackgroundTasksEvent
BiGetActiveBackgroundTasksEventForUser
BiGetCancellationTimeoutInMs
BiIsApplicationTerminateSensitive
BiIsApplicationTerminateSensitiveForUser
BiNotifyNewSession
BiNotifyNewSessionComplete
BiNotifyNewUser
BiPlmFreeMemory
BiPtActivateDeferredWorkItem
BiPtActivateInBackground
BiPtActivateInBackgroundEx
BiPtActivateWorkItem
BiPtAssociateActivationProxy
BiPtAssociateApplicationEntryPoint
BiPtAssociateApplicationExtensionClass
BiPtCancelWorkItem
BiPtCancelWorkItemEx
BiPtCreateEvent
BiPtCreateEventForApp
BiPtCreateEventForPackageName
BiPtDeleteEvent
BiPtDisableWorkItem
BiPtDisassociateWorkItem
BiPtDisassociateWorkItemEx
BiPtEnableWorkItem
BiPtEnumerateBrokeredEvents
BiPtEnumerateBrokeredEventsEx
BiPtEnumerateWorkItemsForPackageName
BiPtEnumerateWorkItemsForPackageNameEx
BiPtFreeMemory
BiPtGetStatusStateNameFromBrokerEventId
BiPtQueryBrokerEventId
BiPtQueryBrokeredEvent
BiPtQuerySystemStateBroadcastChannels
BiPtQueryWorkItem
BiPtQueryWorkItemEx
BiPtQueryWorkItemStatusStateName
BiPtSignalEvent
BiPtSignalEventEx
BiPtSignalMultipleEvents
BiPtSignalTriggerEvent
BiPtSignalTriggerEventEx
BiQueryWorkItemForUser
BiResetActiveSessionForPackage
BiResetActiveUserForPackage
BiSetActiveSessionForPackage
BiSetActiveUserForPackage
BiTerminateApplicationHost
BiTerminateApplicationHost2
BiTerminateApplicationHostForUser
BiUpdateBackgroundAccessApplicationsForUser
BiUpdateLockScreenApplications
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
PsmApplyTaskCompletion
PsmBlockAppStateChangeCompletion
PsmDisconnect
PsmGetSessionInfo
PsmInitializeExtension
PsmIsProcessInApplication
PsmIsProcessInApplication2
PsmQueryApplicationInformation
PsmQueryApplicationInformation2
PsmQueryApplicationInterferenceCount
PsmQueryApplicationInterferenceCount2
PsmQueryApplicationList
PsmQueryApplicationList2
PsmQueryApplicationProperties
PsmQueryApplicationProperties2
PsmQueryApplicationProperties3
PsmQueryApplicationPropertiesByUser
PsmQueryApplicationResourceUsage
PsmQueryApplicationResourceUsage2
PsmQueryApplicationResourceUsageForTimer
PsmQueryCurrentAppState
PsmQueryMaxMemoryUsage
PsmQueryMaxMemoryUsage2
PsmQueryMemoryUsage
PsmQueryMemoryUsage2
PsmQueryMemoryUsageByUser
PsmQueryProcessList
PsmQueryProcessList2
PsmQuerySharedCommitByUser
PsmQueryTaskCompletionInformation
PsmQueryTaskCompletionInformation2
PsmRegisterAppPriorityNotification
PsmRegisterAppStateChangeNotification
PsmRegisterApplicationNotification
PsmRegisterApplicationNotification2
PsmRegisterDynamicProcess
PsmRegisterKeyNotification
PsmRegisterManagerType
PsmResetMaxMemoryUsage
PsmResetMaxMemoryUsage2
PsmResetMaxMemoryUsageByUser
PsmSetApplicationPriority
PsmSetApplicationPriority2
PsmSetApplicationProperties
PsmSetApplicationProperties2
PsmSetApplicationProperties3
PsmSetApplicationPropertiesByUser
PsmSetApplicationState
PsmSetApplicationState2
PsmShutdownApplication
PsmTimerCleanup
PsmTimerElapsedResourceTimeGet
PsmTimerInitialize
PsmTimerRemainingResourceTimeGet
PsmTimerStart
PsmUnblockAppStateChangeCompletion
PsmUnregisterAppStateChangeNotification
PsmWaitForAppResume
RegisterAppStateChangeNotification
TryGetTitleBarIslandId
TryGetTitleBarIslandSelectedHost
UnregisterAppStateChangeNotification
ValidateSystemShutdown

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 537KB - Virtual size: 537KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/Configuration/Resource/usercpl.dll
.dll regsvr32 windows x64

75f281196e5d4b0dac11607e223aec5c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

toupper
_wtoi
_wcsnicmp
_vsnwprintf_s
_snwprintf_s
rand
wcsspn
wcstoul
_vsnwprintf
wcsstr
_initterm
_get_errno
_set_errno
_wcsicmp
wprintf_s
vwprintf_s
floorf
memcmp
wcsrchr
free
memcpy
memmove
memset
__CxxFrameHandler3
_onexit
wcschr
malloc
__dllonexit
__C_specific_handler
_lock
_amsg_exit
_XcptFilter
memcpy_s
_unlock
wcscmp

ntshrui

IsFolderPrivateForUser
SetFolderPermissionsForSharing

api-ms-win-shcore-obsolete-l1-1-0

SHStrDupW
SHStrDupA

api-ms-win-shcore-thread-l1-1-0

SHGetThreadRef
SHCreateThread

api-ms-win-shcore-sysinfo-l1-1-0

IsOS

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolGetUniqueContext
SHTaskPoolGetCurrentThreadLifetime
SHTaskPoolQueueTask

api-ms-win-shcore-scaling-l1-1-0

GetScaleFactorForDevice

shell32

ord54
SHGetStockIconInfo
ord245
SHFileOperationW
ord859
ord680
SHChangeNotify
SHEnumerateUnreadMailAccountsW
SHGetUnreadMailCountW
ord262
ord171
SHGetIDListFromObject
SHBindToObject
ord25
ord18
SHParseDisplayName
ord645
ord644
ord102
SHCreateItemInKnownFolder
ShellExecuteExW
SHCreateItemFromParsingName
SHCreateShellItemArrayFromShellItem
ord754
ord155
ord4
ord2
ord888
ord810
SHGetFolderPathEx

shlwapi

ord165
ord174
ord514
ord24
ord156
PathIsFileSpecW
ord204
ord538
StrStrIW
PathCommonPrefixW
PathRemoveBackslashW
PathCreateFromUrlW
PathIsURLW
PathFindExtensionW
PathCombineW
PathAppendW
StrDupW
StrCmpW
ord225
PathFindFileNameW
PathRemoveFileSpecW
ord487
ord154
ord172
ord219
StrCmpIW
StrPBrkW
StrChrW
StrTrimW
ord158

api-ms-win-core-libraryloader-l1-2-0

LoadStringW
LoadLibraryExW
LockResource
GetProcAddress
FreeLibrary
FindResourceExW
GetModuleHandleW
DisableThreadLibraryCalls
GetModuleFileNameW
GetModuleFileNameA
GetModuleHandleExW
LoadResource
SizeofResource

api-ms-win-core-synch-l1-1-0

CreateMutexExW
OpenSemaphoreW
InitializeCriticalSectionEx
WaitForSingleObjectEx
ReleaseMutex
ReleaseSRWLockExclusive
OpenEventW
AcquireSRWLockExclusive
CreateEventExW
SetEvent
WaitForMultipleObjectsEx
CreateEventW
ResetEvent
WaitForSingleObject
CreateSemaphoreExW
ReleaseSRWLockShared
AcquireSRWLockShared
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
ReleaseSemaphore

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapReAlloc
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
RaiseException
GetLastError
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-processthreads-l1-1-0

GetProcessId
GetCurrentThread
GetExitCodeProcess
OpenThreadToken
GetCurrentProcessId
TlsSetValue
TlsFree
TlsAlloc
TlsGetValue
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
OpenProcessToken

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-com-l1-1-0

PropVariantClear
CoGetMalloc
CoTaskMemAlloc
CoCreateInstance
CoUninitialize
CoTaskMemFree
CoWaitForMultipleHandles
CoCreateGuid
CoInitializeEx
CoReleaseMarshalData
CoQueryProxyBlanket
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoTaskMemRealloc
CoUnmarshalInterface
CoGetApartmentType
CoCreateFreeThreadedMarshaler
CoGetCallContext
CLSIDFromString
CoSetProxyBlanket
StringFromGUID2

api-ms-win-eventing-provider-l1-1-0

EventWrite
EventSetInformation
EventUnregister
EventWriteTransfer
EventActivityIdControl
EventEnabled
EventProviderEnabled
EventRegister

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
SleepConditionVariableSRW
InitOnceBeginInitialize
InitOnceComplete
Sleep

oleaut32

VariantChangeType
VariantCopy
SysAllocString
SysFreeString
VariantInit
VariantClear
LoadTypeLi
LoadRegTypeLi
SafeArrayAccessData
SafeArrayUnaccessData
SysAllocStringByteLen
SafeArrayCreateVector
SetErrorInfo

api-ms-win-core-file-l1-1-0

CreateFileW
DeleteFileW
FindClose
FindNextFileW
FindFirstFileExW
CompareFileTime
RemoveDirectoryW

api-ms-win-core-path-l1-1-0

PathCchAppend
PathCchCombine

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
WideCharToMultiByte

samcli

NetUserGetLocalGroups
NetUserAdd
NetLocalGroupEnum
NetLocalGroupGetMembers
NetQueryDisplayInformation
NetLocalGroupDelMembers
NetUserModalsGet
NetUserChangePassword
NetUserSetInfo
NetUserGetInfo
NetUserDel
NetLocalGroupAddMembers

netutils

NetApiBufferAllocate
NetApiBufferFree

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-security-base-l1-1-0

GetAce
GetAclInformation
AddAce
AddAccessAllowedAceEx
GetSidSubAuthority
GetLengthSid
GetTokenInformation
AdjustTokenPrivileges
GetSidLengthRequired
GetSidSubAuthorityCount
CreateWellKnownSid
EqualSid
InitializeAcl
SetSecurityDescriptorControl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetSecurityDescriptorControl
SetKernelObjectSecurity
AddAccessDeniedAceEx
CopySid
GetSecurityDescriptorOwner
AllocateAndInitializeSid
FreeSid

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW
LookupAccountNameW
LookupPrivilegeValueW

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetTickCount64
GetSystemWindowsDirectoryW
GetVersionExW
GetLocalTime

api-ms-win-core-registry-l1-1-0

RegLoadKeyW
RegGetValueW
RegEnumKeyExW
RegUnLoadKeyW
RegEnumValueW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegNotifyChangeKeyValue
RegOpenKeyExW
RegQueryValueExW

wkscli

NetGetJoinInformation

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-1

GetProcessMitigationPolicy

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
ConvertStringSidToSidW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-power-base-l1-1-0

PowerDeterminePlatformRoleEx
GetPwrCapabilities

api-ms-win-service-management-l1-1-0

CloseServiceHandle
StartServiceW
OpenSCManagerW
OpenServiceW

api-ms-win-service-management-l2-1-0

QueryServiceStatusEx

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

api-ms-win-power-setting-l1-1-0

PowerReadACValue
PowerWriteDCValueIndex
PowerSetActiveScheme
PowerWriteACValueIndex
PowerReadDCValue
PowerGetActiveScheme

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-file-l2-1-0

MoveFileExW

logoncli

DsGetDcNameW

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsReplaceString
WindowsCreateString

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-sidebyside-l1-1-0

DeactivateActCtx
CreateActCtxW
ReleaseActCtx
ActivateActCtx

credui

CredUnPackAuthenticationBufferW
CredPackAuthenticationBufferW

advapi32

GetUserNameW
TreeResetNamedSecurityInfoW
RegDeleteValueW
RegDeleteTreeW
PrivilegeCheck
CheckTokenMembership
IsValidSid
RegFlushKey
DuplicateToken
LogonUserW

dwmapi

DwmIsCompositionEnabled

kernel32

GetComputerNameExW
lstrcmpW
GlobalLock
GlobalUnlock
GetComputerNameW
lstrcmpiW
lstrlenW
MulDiv

ntdll

WinSqmSetString
NtGetCachedSigningLevel
NtQuerySystemInformation
NtDuplicateToken
NtOpenProcessToken
NtOpenThreadToken
RtlDeleteResource
RtlReleaseResource
RtlAcquireResourceExclusive
RtlInitializeResource
EtwLogTraceEvent
RtlFreeSid
RtlAllocateAndInitializeSid
NtQueryInformationFile
NtClose
RtlGetLastNtStatus
NtOpenFile
RtlAdjustPrivilege
RtlInitUnicodeStringEx
WinSqmSetDWORD
WinSqmAddToStream
RtlNtStatusToDosError
WinSqmIncrementDWORD
RtlMapGenericMask
NtQueryInformationToken

ole32

CoGetObject
CreateBindCtx

propsys

PSPropertyBag_ReadInt
PSPropertyBag_WriteUnknown
PropVariantToStringAlloc
PSCreateMemoryPropertyStore
PSPropertyBag_ReadStr
PSPropertyBag_ReadType
PropVariantToGUID

winsta

WinStationQueryInformationW
WinStationEnumerateW
WinStationFreeMemory

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsW
WTSQuerySessionInformationW

dui70

?GetPadding@Element@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z
?Create@ElementProvider@DirectUI@@SAJPEAVElement@2@PEAVInvokeHelper@2@PEAPEAV12@@Z
?Create@HWNDElementProvider@DirectUI@@SAJPEAVHWNDElement@2@PEAVInvokeHelper@2@PEAPEAV12@@Z
?Find@ElementProviderManager@DirectUI@@SAPEAVElementProvider@2@PEAVElement@2@@Z
?GetInvokeHelper@InvokeManager@DirectUI@@SAJPEAPEAVInvokeHelper@2@@Z
?EventFromEventId@Schema@DirectUI@@SA?AW4Event@12@H@Z
?WantEvent@EventManager@DirectUI@@SA_NW4Event@Schema@2@@Z
?FWantAnyEvent@EventManager@DirectUI@@SA_NPEAVElement@2@@Z
?GetAtomZero@Value@DirectUI@@SAPEAV12@XZ
?GetUnset@Value@DirectUI@@SAPEAV12@XZ
?SetActive@Element@DirectUI@@QEAAJH@Z
?GetStringNull@Value@DirectUI@@SAPEAV12@XZ
?CreateXBaby@XProvider@DirectUI@@UEAAJPEAVIXElementCP@2@PEAUHWND__@@PEAVElement@2@PEAKPEAPEAUIXBaby@2@@Z
?SetButtonClassAcceptsEnterKey@XProvider@DirectUI@@UEAAJ_N@Z
?SetRegisteredDefaultButton@XProvider@DirectUI@@UEAAJPEAVElement@2@@Z
?ClickDefaultButton@XProvider@DirectUI@@UEAAHXZ
?ForceThemeChange@XProvider@DirectUI@@UEAAJ_K_J@Z
?GetHostedElementID@XProvider@DirectUI@@UEAAJPEAG@Z
?FindElementWithShortcutAndDoDefaultAction@XProvider@DirectUI@@UEAAHGH@Z
?CanSetFocus@XProvider@DirectUI@@UEAAJPEA_N@Z
?Navigate@XProvider@DirectUI@@UEAAJHPEA_N@Z
?SetFocus@XProvider@DirectUI@@UEAAJPEAVElement@2@@Z
?IsDescendent@XProvider@DirectUI@@UEAAJPEAVElement@2@PEA_N@Z
?GetDesiredSize@XProvider@DirectUI@@UEAAJHHPEAUtagSIZE@@@Z
?SetParameter@XProvider@DirectUI@@UEAAJAEBU_GUID@@PEAX@Z
?AddRef@XProvider@DirectUI@@UEAAKXZ
?SetDefaultButtonTracking@XProvider@DirectUI@@UEAAJ_N@Z
?SetHandleEnterKey@XProvider@DirectUI@@IEAAX_N@Z
?CreateDUI@XProvider@DirectUI@@UEAAJPEAVIXElementCP@2@PEAPEAUHWND__@@@Z
?GetRoot@XProvider@DirectUI@@IEAAPEAVElement@2@XZ
?Initialize@XProvider@DirectUI@@QEAAJPEAVElement@2@PEAVIXProviderCP@2@@Z
?Create@XResourceProvider@DirectUI@@SAJPEAUHINSTANCE__@@PEBG11PEAPEAV12@@Z
?QueryInterface@XProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
??1XProvider@DirectUI@@UEAA@XZ
??0XProvider@DirectUI@@QEAA@XZ
?GetValue@Element@DirectUI@@QEAAPEAVValue@2@PEBUPropertyInfo@2@HPEAUUpdateCache@2@@Z
?DoubleBuffered@Element@DirectUI@@QEAAX_N@Z
?CreateInstance@CSafeElementProxy@@SAJPEAVElement@DirectUI@@PEAPEAV1@@Z
?CustomProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?GetWidth@Element@DirectUI@@QEAAHXZ
?IsEqual@Value@DirectUI@@QEAA_NPEAV12@@Z
?SetAccRole@Element@DirectUI@@QEAAJH@Z
?Detach@CSafeElementProxy@@QEAAXXZ
?SystemAlertEvent@Schema@DirectUI@@2HA
?GetClassInfoPtr@TouchCheckBox@DirectUI@@SAPEAUIClassInfo@2@XZ
?SetClass@Element@DirectUI@@QEAAJPEBG@Z
?SetAccState@Element@DirectUI@@QEAAJH@Z
?GetAccState@Element@DirectUI@@QEAAHXZ
?SetCheckedState@TouchCheckBox@DirectUI@@QEAAJW4CheckedStateFlags@2@@Z
?GetCheckedState@TouchCheckBox@DirectUI@@QEAA?AW4CheckedStateFlags@2@XZ
?GetClassInfoPtr@RichText@DirectUI@@SAPEAUIClassInfo@2@XZ
?EnsureVisible@Element@DirectUI@@QEAA_NXZ
?SetMaxLength@TouchEditBase@DirectUI@@QEAAJH@Z
?GetClassInfoPtr@TouchHyperLink@DirectUI@@SAPEAUIClassInfo@2@XZ
?GetClassInfoPtr@TouchEdit2@DirectUI@@SAPEAUIClassInfo@2@XZ
?SetInputScope@TouchEdit2@DirectUI@@QEAAJW4__MIDL___MIDL_itf_inputscope_0000_0000_0001@@@Z
?Destroy@Layout@DirectUI@@QEAAXXZ
?SetID@Element@DirectUI@@QEAAJPEBG@Z
?SetAccessible@Element@DirectUI@@QEAAJ_N@Z
?SetLayout@Element@DirectUI@@QEAAJPEAVLayout@2@@Z
?Create@FillLayout@DirectUI@@SAJPEAPEAVLayout@2@@Z
?Create@Element@DirectUI@@SAJIPEAV12@PEAKPEAPEAV12@@Z
?GetClassInfoPtr@Button@DirectUI@@SAPEAUIClassInfo@2@XZ
?SetYScrollable@BaseScrollViewer@DirectUI@@QEAAJ_N@Z
?SetSnapOffsetY@TouchScrollViewer@DirectUI@@QEAAJM@Z
?Add@Element@DirectUI@@QEAAJPEAV12@@Z
?GetKeyFocusedElement@HWNDElement@DirectUI@@SAPEAVElement@2@XZ
?GetClassInfoW@Element@DirectUI@@UEAAPEAUIClassInfo@2@XZ
?GetSelectionIndex@TouchSelect@DirectUI@@QEAAHXZ
?SetSelectionIndex@TouchSelect@DirectUI@@QEAAJH@Z
?AddString@TouchSelect@DirectUI@@QEAAJPEBGPEAPEAVElement@2@@Z
?RemoveAll@TouchSelect@DirectUI@@QEAAXXZ
?GetClassInfoPtr@TouchButton@DirectUI@@SAPEAUIClassInfo@2@XZ
?GetClassInfoPtr@TouchSelect@DirectUI@@SAPEAUIClassInfo@2@XZ
?Register@Element@DirectUI@@SAJXZ
DuiCreateObject
?SetGraphicType@Repeater@DirectUI@@QEAAXE@Z
?SelectionChange@TouchSelect@DirectUI@@SA?AVUID@@XZ
?Click@TouchButton@DirectUI@@SA?AVUID@@XZ
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@0@Z
?QueryInterface@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?GetClassInfoPtr@Element@DirectUI@@SAPEAUIClassInfo@2@XZ
?Init@NavReference@DirectUI@@QEAAXPEAVElement@2@PEAUtagRECT@@@Z
?GetRootRelativeBounds@Element@DirectUI@@QEAAJPEAUtagRECT@@@Z
?GetTopLevel@Element@DirectUI@@QEAAPEAV12@XZ
?RemoveLocalValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZ@Z
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUHBITMAP__@@EI_N11@Z
?Destroy@DUIXmlParser@DirectUI@@QEAAXXZ
?Create@DUIXmlParser@DirectUI@@SAJPEAPEAV12@P6APEAVValue@2@PEBGPEAX@Z2P6AX11H2@Z2@Z
?CreateElement@DUIXmlParser@DirectUI@@QEAAJPEBGPEAVElement@2@1PEAKPEAPEAV32@@Z
?GetClassInfoPtr@HWNDElement@DirectUI@@SAPEAUIClassInfo@2@XZ
?GetValue@Element@DirectUI@@QEAAPEAVValue@2@P6APEBUPropertyInfo@2@XZHPEAUUpdateCache@2@@Z
UnInitProcessPriv
UnInitThread
InitThread
InitProcessPriv
?GetClassInfoPtr@Repeater@DirectUI@@SAPEAUIClassInfo@2@XZ
?SetDataEntry@PText@DirectUI@@QEAAXPEAUIDataEntry@2@@Z
?GetClassInfoPtr@PText@DirectUI@@SAPEAUIClassInfo@2@XZ
?SetDataEntry@Macro@DirectUI@@QEAAXPEAUIDataEntry@2@PEAVElement@2@@Z
GetElementMacro
?SetValue@Element@DirectUI@@QEAAJPEBUPropertyInfo@2@HPEAVValue@2@@Z
GetElementDataEntry
?SetDataEngine@Repeater@DirectUI@@QEAAXPEAUIDataEngine@2@@Z
?DestroyCP@TaskPage@DirectUI@@EEAAXXZ
?CreateParserCP@TaskPage@DirectUI@@EEAAJPEAPEAVDUIXmlParser@2@@Z
?OnWizNext@TaskPage@DirectUI@@MEAA_JXZ
?OnWizFinish@TaskPage@DirectUI@@MEAA_JXZ
?OnReset@TaskPage@DirectUI@@MEAA_JXZ
?OnQueryCancel@TaskPage@DirectUI@@MEAA_JXZ
?OnKillActive@TaskPage@DirectUI@@MEAA_JXZ
?InitPropSheetPage@TaskPage@DirectUI@@MEAAXPEAU_PROPSHEETPAGEW@@@Z
?LoadPage@TaskPage@DirectUI@@MEAAJPEAVHWNDElement@2@PEAUHINSTANCE__@@PEAPEAVElement@2@PEAPEAVDUIXmlParser@2@@Z
?LoadParser@TaskPage@DirectUI@@MEAAJPEAPEAVDUIXmlParser@2@@Z
?OnListenedEvent@TaskPage@DirectUI@@MEAAXPEAVElement@2@PEAUEvent@2@@Z
?OnListenedInput@TaskPage@DirectUI@@MEAAXPEAVElement@2@PEAUInputEvent@2@@Z
?OnListenedPropertyChanged@TaskPage@DirectUI@@MEAAXPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z
?OnListenedPropertyChanging@TaskPage@DirectUI@@MEAA_NPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z
?OnListenerDetach@TaskPage@DirectUI@@MEAAXPEAVElement@2@@Z
?OnListenerAttach@TaskPage@DirectUI@@MEAAXPEAVElement@2@@Z
?PropSheet_SendMessage@TaskPage@DirectUI@@IEAA_JI_K_J@Z
??1TaskPage@DirectUI@@UEAA@XZ
??0TaskPage@DirectUI@@QEAA@XZ
?DUICreatePropertySheetPage@TaskPage@DirectUI@@QEAAJPEAUHINSTANCE__@@@Z
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UEBAXXZ
?GetChildren@ClassInfoBase@DirectUI@@UEBAHXZ
?RemoveChild@ClassInfoBase@DirectUI@@UEAAXXZ
?AddChild@ClassInfoBase@DirectUI@@UEAAXXZ
?IsGlobal@ClassInfoBase@DirectUI@@UEBA_NXZ
?GetModule@ClassInfoBase@DirectUI@@UEBAPEAUHINSTANCE__@@XZ
?IsSubclassOf@ClassInfoBase@DirectUI@@UEBA_NPEAUIClassInfo@2@@Z
?IsValidProperty@ClassInfoBase@DirectUI@@UEBA_NPEBUPropertyInfo@2@@Z
?GetName@ClassInfoBase@DirectUI@@UEBAPEBGXZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UEBAIXZ
?GetPICount@ClassInfoBase@DirectUI@@UEBAIXZ
?GetByClassIndex@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?Release@ClassInfoBase@DirectUI@@UEAAHXZ
?AddRef@ClassInfoBase@DirectUI@@UEAAXXZ
??0Element@DirectUI@@QEAA@XZ
??1ClassInfoBase@DirectUI@@UEAA@XZ
??0ClassInfoBase@DirectUI@@QEAA@XZ
?Destroy@Element@DirectUI@@QEAAJ_N@Z
?Initialize@Element@DirectUI@@QEAAJIPEAV12@PEAK@Z
?Initialize@ClassInfoBase@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG_NPEBQEBUPropertyInfo@2@I@Z
?Register@ClassInfoBase@DirectUI@@QEAAJXZ
?ClassExist@ClassInfoBase@DirectUI@@SA_NPEAPEAUIClassInfo@2@PEBQEBUPropertyInfo@2@IPEAU32@PEAUHINSTANCE__@@PEBG_N@Z
??1CritSecLock@DirectUI@@QEAA@XZ
?GetFactoryLock@Element@DirectUI@@SAPEAU_RTL_CRITICAL_SECTION@@XZ
??0CritSecLock@DirectUI@@QEAA@PEAU_RTL_CRITICAL_SECTION@@@Z
?SetLayoutPos@Element@DirectUI@@QEAAJH@Z
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUHICON__@@_N11@Z
?CreateString@Value@DirectUI@@SAPEAV12@PEBGPEAUHINSTANCE__@@@Z
?ContentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?SetHeight@Element@DirectUI@@QEAAJH@Z
GetScaleFactor
?ExtentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?SetValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@@Z
?RemoveListener@Element@DirectUI@@QEAAXPEAUIElementListener@2@@Z
?IsRTLReading@Element@DirectUI@@UEAA_NXZ
?IsContentProtected@Element@DirectUI@@UEAA_NXZ
?GetContentStringAsDisplayed@Element@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanged@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanged@Element@DirectUI@@UEAAXPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnGroupChanged@Element@DirectUI@@UEAAXH_N@Z
?OnInput@Element@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?OnKeyFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?OnMouseFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?OnDestroy@Element@DirectUI@@UEAAXXZ
?OnEvent@Element@DirectUI@@UEAAXPEAUEvent@2@@Z
?Paint@Element@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z
?GetContentSize@Element@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?Add@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?Insert@Element@DirectUI@@UEAAJPEAPEAV12@II@Z
?Remove@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?GetAdjacent@Element@DirectUI@@UEAAPEAV12@PEAV12@HPEBUNavReference@2@K@Z
?EnsureVisible@Element@DirectUI@@UEAA_NHHHH@Z
?SetKeyFocus@Element@DirectUI@@UEAAXXZ
?RemoveBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
?MessageCallback@Element@DirectUI@@UEAAIPEAUtagGMSG@@@Z
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UEAAXPEAUtagRECT@@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MEAAXHH@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?OnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
?OnUnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
?UpdateTooltip@Element@DirectUI@@MEAAXPEAV12@@Z
?ActivateTooltip@Element@DirectUI@@MEAAXPEAV12@K@Z
?RemoveTooltip@Element@DirectUI@@MEAAXPEAV12@@Z
?GetKeyFocused@Element@DirectUI@@UEAA_NXZ
?GetAccessibleImpl@Element@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
?DefaultAction@Element@DirectUI@@UEAAJXZ
?GetUIAElementProvider@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?GetElementProviderImpl@Element@DirectUI@@UEAAJPEAVInvokeHelper@2@PEAPEAVElementProvider@2@@Z
?HandleUiaDestroyListener@Element@DirectUI@@UEAAXXZ
?HandleUiaPropertyListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@@Z
?HandleUiaEventListener@Element@DirectUI@@UEAAXPEAUEvent@2@@Z
?GetUiaFocusDelegate@Element@DirectUI@@UEAAPEAV12@XZ
??1Element@DirectUI@@UEAA@XZ
?GetEncodedContentString@Element@DirectUI@@QEAAJPEAG_K@Z
?AddListener@Element@DirectUI@@QEAAJPEAUIElementListener@2@@Z
?SetMaxLength@Edit@DirectUI@@QEAAJH@Z
?Click@Button@DirectUI@@SA?AVUID@@XZ
?AddString@Combobox@DirectUI@@QEAAHPEBG@Z
?GetSelection@Combobox@DirectUI@@QEAAHXZ
?SetContentString@Element@DirectUI@@QEAAJPEBG@Z
?SelectionChange@Combobox@DirectUI@@SA?AVUID@@XZ
?SetSelection@Combobox@DirectUI@@QEAAJH@Z
?SetEnabled@Element@DirectUI@@QEAAJ_N@Z
?GetContentString@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z
??1IDataEngine@DirectUI@@UEAA@XZ
??0IDataEngine@DirectUI@@QEAA@XZ
??1IDataEntry@DirectUI@@UEAA@XZ
??0IDataEntry@DirectUI@@QEAA@XZ
?GetClassInfoPtr@Macro@DirectUI@@SAPEAUIClassInfo@2@XZ
?SetSelected@Element@DirectUI@@QEAAJ_N@Z
?EndDefer@Element@DirectUI@@QEAAXK@Z
?StartDefer@Element@DirectUI@@QEAAXPEAK@Z
?GetChildren@Element@DirectUI@@QEAAPEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@PEAPEAVValue@2@@Z
?Release@Value@DirectUI@@QEAAXXZ
?SetAccName@Element@DirectUI@@QEAAJPEBG@Z
StrToID
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z
??0HWNDHost@DirectUI@@QEAA@XZ
??1HWNDHost@DirectUI@@UEAA@XZ
?OnMessage@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnPropertyChanged@HWNDHost@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?KeyboardNavigate@Element@DirectUI@@SA?AVUID@@XZ
?FireEvent@Element@DirectUI@@QEAAXPEAUEvent@2@_N1@Z
?Register@HWNDHost@DirectUI@@SAJXZ
?OnInput@HWNDHost@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?OnDestroy@HWNDHost@DirectUI@@UEAAXXZ
?OnEvent@HWNDHost@DirectUI@@UEAAXPEAUEvent@2@@Z
?Paint@HWNDHost@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z
?SetKeyFocus@HWNDHost@DirectUI@@UEAAXXZ
?MessageCallback@HWNDHost@DirectUI@@UEAAIPEAUtagGMSG@@@Z
?OnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z
?OnUnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z
?GetKeyFocused@HWNDHost@DirectUI@@UEAA_NXZ
?GetAccessibleImpl@HWNDHost@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
?OnNotify@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnSysChar@HWNDHost@DirectUI@@UEAA_NG@Z
?OnSinkThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnCtrlThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnWindowStyleChanged@HWNDHost@DirectUI@@UEAAX_KPEBUtagSTYLESTRUCT@@@Z
?OnAdjustWindowSize@HWNDHost@DirectUI@@UEAAHHHI@Z
?SetWindowDirection@HWNDHost@DirectUI@@UEAAXPEAUHWND__@@@Z
?EraseBkgnd@HWNDHost@DirectUI@@MEAA_NPEAUHDC__@@PEA_J@Z
?GetHWND@HWNDHost@DirectUI@@UEAAPEAUHWND__@@XZ
?SetPromptText@TouchEdit2@DirectUI@@QEAAJPEBG@Z
?SetPromptWithCaret@TouchEdit2@DirectUI@@QEAAJ_N@Z
?SetWidth@Element@DirectUI@@QEAAJH@Z
?CreateDUICP@TaskPage@DirectUI@@EEAAJPEAVHWNDElement@2@PEAUHWND__@@1PEAPEAVElement@2@PEAPEAVDUIXmlParser@2@@Z
?Initialize@HWNDHost@DirectUI@@QEAAJIIPEAVElement@2@PEAK@Z
?GetClassInfoPtr@HWNDHost@DirectUI@@SAPEAUIClassInfo@2@XZ
?SetVisible@Element@DirectUI@@QEAAJ_N@Z
?AddBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
?PressedProp@TouchButton@DirectUI@@SAPEBUPropertyInfo@2@XZ

gdi32

DeleteObject
CreateDIBSection
SetStretchBltMode
SetDIBitsToDevice
StretchDIBits
GetDeviceCaps

user32

DefWindowProcW
GetAutoRotationState
IsWindowEnabled
SystemParametersInfoW
ExitWindowsEx
DispatchMessageW
TranslateMessage
PostQuitMessage
PeekMessageW
GetSystemMetrics
DestroyMenu
IsChild
CallNextHookEx
UnhookWindowsHookEx
MapWindowPoints
SetWindowsHookExW
MsgWaitForMultipleObjectsEx
GetParent
UpdateWindow
GetWindowBand
NotifyWinEvent
GetSysColor
GetKeyState
GetRawInputDeviceList
CreatePopupMenu
SetWindowLongPtrW
GetWindowLongPtrW
DestroyWindow
UpdatePerUserSystemParameters
LoadImageW
GetMenuDefaultItem
GetDC
ReleaseDC
GetFocus
SendMessageW
DestroyIcon
GetAncestor
LoadCursorW
PostMessageW
SetCursor
SetFocus
RegisterClipboardFormatW
MessageBoxW

rpcrt4

I_RpcMapWin32Status
RpcBindingFromStringBindingW
RpcStringBindingComposeW
I_RpcExceptionFilter
RpcBindingBind
RpcBindingCreateW
RpcStringFreeW
NdrClientCall3
RpcBindingFree

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-security-credentials-l1-1-0

CredProtectW
CredUnprotectW

api-ms-win-core-threadpool-l1-2-0

SubmitThreadpoolWork
CreateThreadpoolWork
CloseThreadpoolWait
CreateThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWork
SetThreadpoolWait

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 459KB - Virtual size: 458KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 207KB - Virtual size: 207KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 592B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 625KB - Virtual size: 624KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBS/OBS.exe
.exe windows x86

cd649d0c74c0b1660a728219514692ea

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

DispatchMessageW
CharUpperBuffW

gdi32

CreateCompatibleBitmap

ole32

CoInitializeEx

shell32

DragFinish

winmm

timeBeginPeriod

Exports

Exports

ݝ��냿��q.&��JAd��*��0Iq�\B%1e��G�joCU(J*�^ٴ�c��#�"��˷#nE�y��=�ݿuQY��R�D}��d��1*U�F-�x)X��|��[�n\�<��/J��੄ ��Y#�s��be��l�oK]�l��},po��˯\Zl��&Sӷ��9�I�As7h�E�A]� ouc`��D�b'�b�w~�&�*w �6j�݇&��V\$��l/B��?�U�=s�ˢ�/.��Sr��o��f�(�[h"��`Wf��d��h��V�7�C9N��@�ٶ��M3j��}fbE|½꯵=�.�s�Cd}��@-b��~ D��*��@��ӟ�5 <��`SVh��|ޣ�� ~t�أ��5��_�^ws�{�@R�hIjʰ�df&Q�@��O~�6�Qd�<#{�E<�{��a�x� �S�i0�E��n&;o�;4�f�҄��]��ŵ��Z�j�>�@R9��ȚL��>��Ź9�(�v��yۙ�oyӊC-��r2��RR3^ө�EuOS�'_ڬ��<D:Y� '��PYvB��lk��м�a�^�ͭ5��<6��vW7(+?�!CʸؑO ͅ�pE�[2{5�޻Y_�I�� w��h>l� I%/�g�H:̄K�-�;�� uPZMP/./�L6:,J ��KQ��]��v�0��`�f��"�A��pW��.��P��N��ɬ+y��)0{-8��y�6E��^`h��OɁ��}��6� ��a�-C�٬%5��tfz$�Ga�ͺ3�W�Ж FND�`�}�R��D}�`c��r ��AJNQ�$ӨrZÇȅ*M��O�n�bB`��.J@�n��.�É{|ڰ��vKa-w�V�X��*��̭��9t]�f1��qs$U~��D�I��Ӧ�ۯa��^�%̶�!�6��a0�K�B��o<G�b�?�Oc�C��Z&��0�Z�+�S��另*�V*q��t��.`6�G�B�ig�fFP1�K<0z��׃p�Ѽ��>i��Q�v�Vћ�� YT�<��|Mo�v��T]��g} F�'9' �uVZX��@�Svq��|��6zޘ<��3�/�hG0!�B��+��9�dIལȏgx��02��e-$z�g��d�}�%Ȓ�zJRc�V� R�A�H�#�3+�ͷ .5K{d��: ��("�Eƽ�R�-��2��}�~n��B��]hLm��[ˌ=4��%��|��޾>t�Bi� ��R�}��<�g��i/�R�p��?��T��*F7z��Tv��6ӊA��קt�:>�aʣ��~��szJåE�{� ,�TS��AΌ��㭿��{�fΠ��j��_�%��-6�� C6�J�T�$0 �%N��G�|ɪռ&HC��p_^?��tK=Jw�D��-��D��h��Tf�c�Wz�`�� q�H�\��}�� v��>�{ �A��|BFt��Tܕ�i �2�!��͘��O�O��F�u(��m��a<OY0V��,��֥��|ڍg"~P��A��btY�� :�h|��=�o�mH��Hl�M!5��#x��e`@$��>/�tuX�FtQ�`�p��7��"�̓M3z3�zI�� W��-*C<�I��nJ�!��r��.�P��W��;6&��"�S��s£Rs��˟�� {��'0�'�.�V��<��<��3?�"Q��̧8M��Ro(�8j�x��U��&0h�G��v]��a߄w}Ce��p�KFB�C�G�c� ��AI��ޫ�R��=�[$yȤ��6*��-^F>"��a=�T��{7�5u��M��i��q�% �77)*�,��|�CM6��aD1�ȇ�$nFWW� ��3�ձ ��F��B(�� )�2�+��T�޶G3��-��w��7&c\32��S�K�vAX�'��J@;S��m"��1��K/"$)m�J�"X�B�Zƪ=R�a�� D�$RO��q�k�� X�BB5�G��)ɕa� <`^j��l8��3�0\�:)��8nU*R\(�\��ܟm9B�)ڃ�Q��@��b�J[��M��28�E7��Q��H�j]7��l�%\��C��S�z�$e�I��"� ��Ӡ�[*� O��X~\!�Q��C�UM�S�m�V�� $��ʩU��<��e3Ւ�`��G8��F6�^��q��K}�D��GC�(+<�x�+�a.��b��Dn�%๗ً, T��C��;,�H��WU]Y�S&ĊY22K� ��o�T��{��P�g��o�n'�[��Ҭ� ��*E�5�m��_Dk��"�7�!v��<D��V+6��R��N��`H�P��;��̀.�Ĝb�E��M� ;�$u5��>�.�θ��o��s��/��ݮ��#`%�<DKC�|��:��;*��2?�&P̟�i�hZ��Dǥ8�P�5 1)��l4 ryl�BgC-%�kV_��*;T��=��u0)F��2�ebe(HH#�`��ѹj�>�l�De�T��/�&�%uQ��J!p�zk�H��9Ye�51��CC3B��5�v�l�l�L��@Tފ��Ž��#�� VkWV��AE�4ܒ[��*�Ռ;T��5YZG[D7�*��k�J��6��.�v�a�HG��6�m�M蘮Ea�=�p��3ߪ�Gw ��N�ؚ��<�+��z zR�HU��i�5�9dA��!|G��S�z�K��ۈ��hTG��n�{��K��Z��l�"�O��M�&��ǪtўG��[&�W�Sϕ��Y ,s��OTh�y�ח3 �n�f{

Sections

.text
Size: - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 140KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.lbX
Size: - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

. `|
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.{[h
Size: 6.0MB - Virtual size: 6.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 552KB - Virtual size: 548KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

58add1a59f0b3955b5aa1b2a8eb503d1

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-synch-l1-1-0

rpcrt4

api-ms-win-core-com-midlproxystub-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

ntdll

api-ms-win-security-base-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-string-l1-1-0

crypt32

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

api-ms-win-stateseparation-helpers-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-console-l3-2-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

twinapi.appcore

cryptngc

webauthn

api-ms-win-security-sddl-l1-1-0

winhttp

Exports

Exports

Sections

.text Size: 130KB - Virtual size: 130KB

.rdata Size: 105KB - Virtual size: 105KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 5KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 248B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 3KB

9fbb5428188490fcba695d25153e2fbc

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-1-0

oleaut32

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

.text
Size: 130KB - Virtual size: 130KB

.rdata
Size: 105KB - Virtual size: 105KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 5KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 248B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 3KB

.text
Size: 33KB - Virtual size: 33KB

.rdata
Size: 19KB - Virtual size: 19KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 2KB - Virtual size: 2KB

.didat
Size: 512B - Virtual size: 16B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 464B

.text
Size: 107KB - Virtual size: 107KB

.rdata
Size: 143KB - Virtual size: 143KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 8KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 232B

.rsrc
Size: 1024B - Virtual size: 1024B

.reloc
Size: 12KB - Virtual size: 12KB