WindowsPowerShell[.]zip

Resubmissions

15-04-2024 17:37

240415-v66nksed8w 7

15-04-2024 17:34

240415-v5ll1sed3z 7

15-04-2024 17:30

240415-v3fmzsca66 3

15-04-2024 17:27

240415-v1vdcseb8w 7

Sharing

Copy URL

Twitter E-mail

General

Target

WindowsPowerShell.zip
Size

2.9MB
MD5

4beaf6b031c0c5207b19918913b57e0d
SHA1

c9856b91a671619302799d166875cfda119fb121
SHA256

0432dca5d3f8623103c1e112f052a4ed7990d550b029c445858ffc94a9abe65b
SHA512

3eb79e807c5a8ecda39d8da9591bef48d7db49004ad052c6e2e4a53d922cd97d2ded480c04d5397b946f9a0bc5944d2a45dc026fe35919e0c9aa63715b47095e
SSDEEP

49152:VDMkyxtSYe6vWnyXkeC9TDVG2wl9Bs1DIN1BWWh7PbCpoV0pX8o7mQuzg7pVa1GV:Gky33e6+nmCts2cBN5Cpc0986wqm1gt1

Score

3^/10

Malware Config

Signatures

Unsigned PE 46 IoCs

Checks for missing Authenticode signature.

resource
unpack001/WindowsPowerShell/v1.0/Modules/AppBackgroundTask/Microsoft.Windows.AppBackgroundTask.Commands.dll
unpack001/WindowsPowerShell/v1.0/Modules/AppvClient/en/Microsoft.AppV.AppVClientPowerShell.resources.dll
unpack001/WindowsPowerShell/v1.0/Modules/AppvClient/en/Microsoft.AppV.AppvClientComConsumer.resources.dll
unpack001/WindowsPowerShell/v1.0/Modules/BitLocker/Microsoft.BitLocker.Structures.dll
unpack001/WindowsPowerShell/v1.0/Modules/DeliveryOptimization/Microsoft.Windows.DeliveryOptimization.AdminCommands.dll
unpack001/WindowsPowerShell/v1.0/Modules/Dism/Microsoft.Dism.PowerShell.dll
unpack001/WindowsPowerShell/v1.0/Modules/Dism/en/Microsoft.Dism.Powershell.Resources.dll
unpack001/WindowsPowerShell/v1.0/Modules/DnsClient/dnslookup.dll
unpack001/WindowsPowerShell/v1.0/Modules/LAPS/lapspsh.dll
unpack001/WindowsPowerShell/v1.0/Modules/LAPS/lapsutil.dll
unpack001/WindowsPowerShell/v1.0/Modules/LanguagePackManagement/Microsoft.LanguagePackManagement.Powershell.Commands.dll
unpack001/WindowsPowerShell/v1.0/Modules/LanguagePackManagement/en/Microsoft.LanguagePackManagement.Powershell.Commands.Resources.dll
unpack001/WindowsPowerShell/v1.0/Modules/Microsoft.PowerShell.LocalAccounts/1.0.0.0/Microsoft.PowerShell.LocalAccounts.dll
unpack001/WindowsPowerShell/v1.0/Modules/Microsoft.PowerShell.LocalAccounts/1.0.0.0/en/Microsoft.PowerShell.LocalAccounts.Resources.dll
unpack001/WindowsPowerShell/v1.0/Modules/Microsoft.Windows.Bcd.Cmdlets/Microsoft.Windows.Bcd.Cmdlets.dll
unpack001/WindowsPowerShell/v1.0/Modules/Microsoft.Windows.Bcd.Cmdlets/Microsoft.Windows.Bcd.Utils.dll
unpack001/WindowsPowerShell/v1.0/Modules/Microsoft.Windows.Bcd.Cmdlets/Microsoft.Windows.Bcd.dll
unpack001/WindowsPowerShell/v1.0/Modules/Microsoft.Windows.Bcd.Cmdlets/en/Microsoft.Windows.Bcd.Cmdlets.Resources.dll
unpack001/WindowsPowerShell/v1.0/Modules/Microsoft.Windows.Bcd.Cmdlets/en/Microsoft.Windows.Bcd.Resources.dll
unpack001/WindowsPowerShell/v1.0/Modules/MsDtc/en/Microsoft.Dtc.PowerShell.Resources.dll
unpack001/WindowsPowerShell/v1.0/Modules/NetSecurity/Microsoft.Windows.Firewall.Commands.dll
unpack001/WindowsPowerShell/v1.0/Modules/NetSecurity/en/Microsoft.Windows.Firewall.Commands.Resources.dll
unpack001/WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DownloadManager/DSCFileDownloadManager/Microsoft.PowerShell.DSC.FileDownloadManager.dll
unpack001/WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DownloadManager/DSCFileDownloadManager/en/Microsoft.PowerShell.DSC.FileDownloadManager.Resources.dll
unpack001/WindowsPowerShell/v1.0/Modules/PersistentMemory/Microsoft.Storage.PersistentMemory.Management.Commands.dll
unpack001/WindowsPowerShell/v1.0/Modules/PersistentMemory/en/Microsoft.Storage.PersistentMemory.Management.Commands.Resources.dll
unpack001/WindowsPowerShell/v1.0/Modules/PersistentMemory/scmbridge.dll
unpack001/WindowsPowerShell/v1.0/Modules/ProcessMitigations/Microsoft.ProcessMitigations.Commands.dll
unpack001/WindowsPowerShell/v1.0/Modules/Provisioning/provcmdlets.dll
unpack001/WindowsPowerShell/v1.0/Modules/Provisioning/provcommon.dll
unpack001/WindowsPowerShell/v1.0/Modules/Provisioning/wiminterop.dll
unpack001/WindowsPowerShell/v1.0/Modules/UEV/Microsoft.Uev.Commands.dll
unpack001/WindowsPowerShell/v1.0/Modules/Whea/Microsoft.Windows.Whea.WheaMemoryPolicy.dll
unpack001/WindowsPowerShell/v1.0/Modules/WindowsErrorReporting/Microsoft.WindowsErrorReporting.PowerShell.dll
unpack001/WindowsPowerShell/v1.0/Modules/WindowsSearch/Microsoft.WindowsSearch.Commands.dll
unpack001/WindowsPowerShell/v1.0/Modules/WindowsSearch/en/Microsoft.WindowsSearch.Commands.Resources.dll
unpack001/WindowsPowerShell/v1.0/PSEvents.dll
unpack001/WindowsPowerShell/v1.0/en-US/PSEvents.dll.mui
unpack001/WindowsPowerShell/v1.0/en-US/powershell.exe.mui
unpack001/WindowsPowerShell/v1.0/en-US/pspluginwkr.dll.mui
unpack001/WindowsPowerShell/v1.0/en-US/pwrshmsg.dll.mui
unpack001/WindowsPowerShell/v1.0/en/powershell_ise.resources.dll
unpack001/WindowsPowerShell/v1.0/powershell.exe
unpack001/WindowsPowerShell/v1.0/powershell_ise.exe
unpack001/WindowsPowerShell/v1.0/pspluginwkr.dll
unpack001/WindowsPowerShell/v1.0/pwrshmsg.dll

Files

WindowsPowerShell.zip
.zip
WindowsPowerShell/v1.0/Certificate.format.ps1xml
WindowsPowerShell/v1.0/Diagnostics.Format.ps1xml
WindowsPowerShell/v1.0/DotNetTypes.format.ps1xml
.xml
WindowsPowerShell/v1.0/Event.Format.ps1xml
WindowsPowerShell/v1.0/Examples/profile.ps1
WindowsPowerShell/v1.0/FileSystem.format.ps1xml
WindowsPowerShell/v1.0/Help.format.ps1xml
.ps1
WindowsPowerShell/v1.0/HelpV3.format.ps1xml
.xml .ps1 polyglot
WindowsPowerShell/v1.0/Modules/AppBackgroundTask/AppBackgroundTask.psd1
WindowsPowerShell/v1.0/Modules/AppBackgroundTask/MSFT_BackgroundTask.Format.ps1xml
.xml .ps1 polyglot
WindowsPowerShell/v1.0/Modules/AppBackgroundTask/Microsoft.Windows.AppBackgroundTask.Commands.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Microsoft.Windows.AppBackgroundTask.Commands.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/AppBackgroundTask/PS_BackgroundTask.cdxml
WindowsPowerShell/v1.0/Modules/AppLocker/AppLocker.psd1
WindowsPowerShell/v1.0/Modules/AppvClient/AppVClientCmdlets.format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/AppvClient/AppVClientCmdlets.psm1
.ps1
WindowsPowerShell/v1.0/Modules/AppvClient/AppvClient.psd1
WindowsPowerShell/v1.0/Modules/AppvClient/Microsoft.AppV.AppVClientPowerShell.dll
.dll windows:4 windows x64 arch:x64

Code Sign

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03-02-2023 00:05

Not After

01-02-2024 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c4:41:48:8b:63:1d:66:3d:37:64:3b:90:31:91:e5:48:1a:78:0b:8c:1e:cd:f0:f7:16:9b:a1:9c:b8:43:2c:6b
Signer

Actual PE Digest

c4:41:48:8b:63:1d:66:3d:37:64:3b:90:31:91:e5:48:1a:78:0b:8c:1e:cd:f0:f7:16:9b:a1:9c:b8:43:2c:6b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Microsoft.AppV.AppVClientPowerShell.pdb

Sections

.text
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/AppvClient/Microsoft.AppV.AppvClientComConsumer.dll
.dll windows:10 windows x64 arch:x64

9fb037108fd4ea47f152d0ea1614b70e

Code Sign

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03-02-2023 00:05

Not After

01-02-2024 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1e:a9:93:df:0c:0b:5f:b9:80:c4:87:13:86:b6:88:ae:6d:d5:87:61:03:be:24:43:50:98:90:e4:1d:4e:be:1a
Signer

Actual PE Digest

1e:a9:93:df:0c:0b:5f:b9:80:c4:87:13:86:b6:88:ae:6d:d5:87:61:03:be:24:43:50:98:90:e4:1d:4e:be:1a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Microsoft.AppV.AppvClientComConsumer.pdb

Imports

msvcp_win

?good@ios_base@std@@QEBA_NXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?flags@ios_base@std@@QEBAHXZ
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WXZ
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z
?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W0@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?pbase@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__stricmp
_o__wcsicmp
_o__wcslwr_s
_o__wcsnicmp
_o__wsplitpath_s
_o__wtoi
_o_abort
_o_free
_o_iswalpha
_o_iswdigit
_o_malloc
_o_terminate
__C_specific_handler
_CxxThrowException
__current_exception
__current_exception_context
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
wcsstr
strrchr
__FrameUnwindFilter
__CxxUnregisterExceptionObject
__CxxDetectRethrow
__CxxRegisterExceptionObject
__CxxExceptionFilter
__CxxQueryExceptionSize
memmove
memcpy
__std_terminate
__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

memset

advapi32

EventWriteTransfer
RegOpenKeyExW
RegDeleteTreeW
RegCreateKeyExW
RegCloseKey
RegSetKeyValueW
RegQueryValueExW
RegSetValueExW
RegGetValueW

kernel32

LocalFree
GetLastError
FormatMessageW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleW
WideCharToMultiByte
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetDriveTypeW
GetNativeSystemInfo
GetVersionExW
CloseHandle
LoadLibraryW
LoadLibraryA
GetSystemDirectoryW
Sleep
FreeLibrary
RaiseException
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
CreateEventW
InitializeCriticalSectionAndSpinCount
GetProcAddress

normaliz

IdnToNameprepUnicode

oleaut32

SysAllocStringLen
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SysStringByteLen
VariantInit
SysFreeString
SysAllocString
VariantClear
SysAllocStringByteLen

wininet

InternetCrackUrlW
InternetCanonicalizeUrlW
InternetCreateUrlW

ole32

CoUninitialize
CoInitializeEx
CoCreateInstance
CoSetProxyBlanket

mscoree

_CorDllMain

Sections

.text
Size: 188KB - Virtual size: 187KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.nep
Size: 4KB - Virtual size: 1024B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 472KB - Virtual size: 470KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/AppvClient/Microsoft.AppV.ClientProgrammability.Eventing.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03-02-2023 00:05

Not After

01-02-2024 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b9:1c:d9:e3:5f:ea:0d:0f:36:44:a3:65:85:88:d7:5c:2b:62:b5:2e:e7:c0:bd:18:93:04:ad:c6:16:ce:f5:2d
Signer

Actual PE Digest

b9:1c:d9:e3:5f:ea:0d:0f:36:44:a3:65:85:88:d7:5c:2b:62:b5:2e:e7:c0:bd:18:93:04:ad:c6:16:ce:f5:2d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Microsoft.AppV.ClientProgrammability.Eventing.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 158KB - Virtual size: 157KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/AppvClient/en/Microsoft.AppV.AppVClientPowerShell.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/AppvClient/en/Microsoft.AppV.AppvClientComConsumer.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/Appx/Appx.format.ps1xml
.xml .ps1 polyglot
WindowsPowerShell/v1.0/Modules/Appx/Appx.psd1
WindowsPowerShell/v1.0/Modules/Appx/Appx.psm1
.ps1
WindowsPowerShell/v1.0/Modules/Appx/en-US/Appx.psd1
WindowsPowerShell/v1.0/Modules/AssignedAccess/AssignedAccess.psd1
WindowsPowerShell/v1.0/Modules/AssignedAccess/AssignedAccess.psm1
.ps1
WindowsPowerShell/v1.0/Modules/AssignedAccess/en-US/AssignedAccessMsg.psd1
WindowsPowerShell/v1.0/Modules/BitLocker/BitLocker.Format.ps1xml
WindowsPowerShell/v1.0/Modules/BitLocker/BitLocker.psd1
WindowsPowerShell/v1.0/Modules/BitLocker/BitLocker.psm1
.ps1
WindowsPowerShell/v1.0/Modules/BitLocker/Microsoft.BitLocker.Structures.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Microsoft.BitLocker.Structures.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/BitLocker/en-US/BitLocker.psd1
WindowsPowerShell/v1.0/Modules/BitsTransfer/BitsTransfer.Format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/BitsTransfer/BitsTransfer.psd1
WindowsPowerShell/v1.0/Modules/BitsTransfer/BitsTransfer.psm1
.ps1
WindowsPowerShell/v1.0/Modules/BitsTransfer/Microsoft.BackgroundIntelligentTransfer.Management.Interop.dll
.dll windows:10 windows x64 arch:x64

cef636a8f3aceaca75bf4aa706f0ba28

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03-02-2023 00:05

Not After

01-02-2024 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ec:da:49:50:07:71:56:c3:17:f1:35:ec:1f:cd:cb:4b:78:8f:be:b0:22:a4:ac:06:73:2c:82:12:0b:ea:ba:21
Signer

Actual PE Digest

ec:da:49:50:07:71:56:c3:17:f1:35:ec:1f:cd:cb:4b:78:8f:be:b0:22:a4:ac:06:73:2c:82:12:0b:ea:ba:21

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Microsoft.BackgroundIntelligentTransfer.Management.Interop.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o___std_exception_destroy
_o___std_type_info_destroy_list
_o___stdio_common_vswprintf
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
_o_abort
_o_free
_o_malloc
_o_terminate
__C_specific_handler
_CxxThrowException
__current_exception
__current_exception_context
wcschr
_o___std_exception_copy
__FrameUnwindFilter

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-file-l1-1-0

FileTimeToLocalFileTime

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoSetProxyBlanket
CoCreateInstance

api-ms-win-core-synch-l1-2-0

Sleep

mscoree

_CorDllMain

Sections

.text
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.nep
Size: 4KB - Virtual size: 256B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/BranchCache/BranchCache.format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/BranchCache/BranchCache.psd1
WindowsPowerShell/v1.0/Modules/BranchCache/BranchCache.types.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/BranchCache/BranchCacheClientSettingData.cdxml
WindowsPowerShell/v1.0/Modules/BranchCache/BranchCacheContentServerSettingData.cdxml
WindowsPowerShell/v1.0/Modules/BranchCache/BranchCacheHostedCacheServerSettingData.cdxml
WindowsPowerShell/v1.0/Modules/BranchCache/BranchCacheNetworkSettingData.cdxml
WindowsPowerShell/v1.0/Modules/BranchCache/BranchCacheOrchestrator.cdxml
WindowsPowerShell/v1.0/Modules/BranchCache/BranchCachePrimaryPublicationCacheFile.cdxml
WindowsPowerShell/v1.0/Modules/BranchCache/BranchCachePrimaryRepublicationCacheFile.cdxml
WindowsPowerShell/v1.0/Modules/BranchCache/BranchCacheSecondaryRepublicationCacheFile.cdxml
WindowsPowerShell/v1.0/Modules/BranchCache/BranchCacheStatus.cdxml
WindowsPowerShell/v1.0/Modules/CimCmdlets/CimCmdlets.psd1
WindowsPowerShell/v1.0/Modules/ConfigCI/ConfigCI.psd1
WindowsPowerShell/v1.0/Modules/ConfigDefender/ConfigDefender.psd1
WindowsPowerShell/v1.0/Modules/ConfigDefender/MSFT_MpComputerStatus.cdxml
WindowsPowerShell/v1.0/Modules/ConfigDefender/MSFT_MpPreference.cdxml
.xml
WindowsPowerShell/v1.0/Modules/ConfigDefender/MSFT_MpRollback.cdxml
WindowsPowerShell/v1.0/Modules/ConfigDefender/MSFT_MpScan.cdxml
WindowsPowerShell/v1.0/Modules/ConfigDefender/MSFT_MpSignature.cdxml
WindowsPowerShell/v1.0/Modules/ConfigDefender/MSFT_MpThreat.cdxml
WindowsPowerShell/v1.0/Modules/ConfigDefender/MSFT_MpThreatCatalog.cdxml
WindowsPowerShell/v1.0/Modules/ConfigDefender/MSFT_MpThreatDetection.cdxml
WindowsPowerShell/v1.0/Modules/ConfigDefender/MSFT_MpWDOScan.cdxml
WindowsPowerShell/v1.0/Modules/ConfigDefenderPerformance/ConfigDefenderPerformance.psd1
WindowsPowerShell/v1.0/Modules/ConfigDefenderPerformance/MSFT_MpPerformanceRecording.psm1
.ps1
WindowsPowerShell/v1.0/Modules/ConfigDefenderPerformance/MSFT_MpPerformanceRecording.wprp
WindowsPowerShell/v1.0/Modules/ConfigDefenderPerformance/MSFT_MpPerformanceReport.Format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/Defender/Defender.psd1
WindowsPowerShell/v1.0/Modules/Defender/MSFT_MpComputerStatus.cdxml
WindowsPowerShell/v1.0/Modules/Defender/MSFT_MpPreference.cdxml
.xml
WindowsPowerShell/v1.0/Modules/Defender/MSFT_MpRollback.cdxml
WindowsPowerShell/v1.0/Modules/Defender/MSFT_MpScan.cdxml
WindowsPowerShell/v1.0/Modules/Defender/MSFT_MpSignature.cdxml
WindowsPowerShell/v1.0/Modules/Defender/MSFT_MpThreat.cdxml
WindowsPowerShell/v1.0/Modules/Defender/MSFT_MpThreatCatalog.cdxml
WindowsPowerShell/v1.0/Modules/Defender/MSFT_MpThreatDetection.cdxml
WindowsPowerShell/v1.0/Modules/Defender/MSFT_MpWDOScan.cdxml
WindowsPowerShell/v1.0/Modules/DefenderPerformance/DefenderPerformance.psd1
WindowsPowerShell/v1.0/Modules/DefenderPerformance/MSFT_MpPerformanceRecording.psm1
.ps1
WindowsPowerShell/v1.0/Modules/DefenderPerformance/MSFT_MpPerformanceRecording.wprp
WindowsPowerShell/v1.0/Modules/DefenderPerformance/MSFT_MpPerformanceReport.Format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/DeliveryOptimization/DeliveryOptimization.psd1
WindowsPowerShell/v1.0/Modules/DeliveryOptimization/DeliveryOptimizationSettings.psm1
.ps1
WindowsPowerShell/v1.0/Modules/DeliveryOptimization/DeliveryOptimizationStatus.psm1
.ps1
WindowsPowerShell/v1.0/Modules/DeliveryOptimization/DeliveryOptimizationVerboseLogs.psm1
.ps1
WindowsPowerShell/v1.0/Modules/DeliveryOptimization/Microsoft.Windows.DeliveryOptimization.AdminCommands.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Microsoft.Windows.DeliveryOptimization.AdminCommands.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/DirectAccessClientComponents/DirectAccessClientComponents.psd1
WindowsPowerShell/v1.0/Modules/DirectAccessClientComponents/MSFT_DAClientExperienceConfiguration.cdxml
.xml
WindowsPowerShell/v1.0/Modules/DirectAccessClientComponents/MSFT_DAClientExperienceConfiguration.format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/DirectAccessClientComponents/MSFT_DAClientExperienceConfiguration.types.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/DirectAccessClientComponents/MSFT_DASiteTableEntry.cdxml
.xml
WindowsPowerShell/v1.0/Modules/DirectAccessClientComponents/MSFT_DASiteTableEntry.format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/DirectAccessClientComponents/MSFT_DASiteTableEntry.types.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/Dism/Dism.Format.ps1xml
.ps1
WindowsPowerShell/v1.0/Modules/Dism/Dism.Types.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/Dism/Dism.psd1
WindowsPowerShell/v1.0/Modules/Dism/Dism.psm1
WindowsPowerShell/v1.0/Modules/Dism/Microsoft.Dism.PowerShell.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Microsoft.Dism.PowerShell.pdb

Sections

.text
Size: 134KB - Virtual size: 134KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/Dism/en/Microsoft.Dism.Powershell.Resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/DnsClient/DnsClient.psd1
WindowsPowerShell/v1.0/Modules/DnsClient/DnsClientPSProvider.Format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/DnsClient/DnsClientPSProvider.Types.ps1xml
.xml .ps1 polyglot
WindowsPowerShell/v1.0/Modules/DnsClient/DnsCmdlets.Format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/DnsClient/DnsCmdlets.Types.ps1xml
WindowsPowerShell/v1.0/Modules/DnsClient/DnsConfig.Format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/DnsClient/DnsConfig.Types.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/DnsClient/MSFT_DnsClient.cdxml
.xml
WindowsPowerShell/v1.0/Modules/DnsClient/MSFT_DnsClientCache.cdxml
.xml
WindowsPowerShell/v1.0/Modules/DnsClient/MSFT_DnsClientDohServerAddress.cdxml
.xml
WindowsPowerShell/v1.0/Modules/DnsClient/MSFT_DnsClientGlobalSetting.cdxml
.xml
WindowsPowerShell/v1.0/Modules/DnsClient/MSFT_DnsClientServerAddress.cdxml
.xml
WindowsPowerShell/v1.0/Modules/DnsClient/PS_DnsClientNRPTGlobal_v1.0.0.cdxml
WindowsPowerShell/v1.0/Modules/DnsClient/PS_DnsClientNRPTRule_v1.0.0.cdxml
WindowsPowerShell/v1.0/Modules/DnsClient/PS_DnsClientNrptPolicy_v1.0.0.cdxml
WindowsPowerShell/v1.0/Modules/DnsClient/dnslookup.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

dnslookup.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/EventTracingManagement/EventTracingManagement.Types.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/EventTracingManagement/EventTracingManagement.psd1
WindowsPowerShell/v1.0/Modules/EventTracingManagement/EventTracingManagement.psm1
.ps1
WindowsPowerShell/v1.0/Modules/EventTracingManagement/MSFT_AutologgerConfig_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/EventTracingManagement/MSFT_AutologgerConfig_v1.0.format.ps1xml
WindowsPowerShell/v1.0/Modules/EventTracingManagement/MSFT_EtwTraceProvider_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/EventTracingManagement/MSFT_EtwTraceProvider_v1.0.format.ps1xml
WindowsPowerShell/v1.0/Modules/EventTracingManagement/MSFT_EtwTraceSession_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/EventTracingManagement/MSFT_EtwTraceSession_v1.0.format.ps1xml
WindowsPowerShell/v1.0/Modules/Get-NetView/Get-NetView.psd1
WindowsPowerShell/v1.0/Modules/Get-NetView/Get-NetView.psm1
.ps1
WindowsPowerShell/v1.0/Modules/ISE/ise.psd1
WindowsPowerShell/v1.0/Modules/ISE/ise.psm1
.ps1
WindowsPowerShell/v1.0/Modules/International/International.psd1
WindowsPowerShell/v1.0/Modules/Kds/Kds.psd1
WindowsPowerShell/v1.0/Modules/LAPS/LAPS.psd1
WindowsPowerShell/v1.0/Modules/LAPS/LAPS.psm1
.ps1
WindowsPowerShell/v1.0/Modules/LAPS/lapspsh.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

lapspsh.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/LAPS/lapsutil.dll
.dll windows:10 windows x64 arch:x64

e4ca712011469a0507d0af7edfe94a5a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

lapsutil.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o_malloc
_o_terminate
_o_wmemcpy_s
__C_specific_handler
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o__cexit
_o__callnewh
_o__crt_atexit
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__configure_narrow_argv
_CxxThrowException
__CxxFrameHandler3
memcpy

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-libraryloader-l1-2-0

SizeofResource
GetModuleFileNameA
LoadResource
GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleHandleW
GetProcAddress
FindResourceExW
LockResource

ncrypt

NCryptStreamUpdate
NCryptStreamClose
NCryptGetProtectionDescriptorInfo
NCryptUnprotectSecret
NCryptCloseProtectionDescriptor
NCryptStreamOpenToUnprotect

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

sspicli

LogonUserExExW

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
GetLastError
RaiseException

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
WaitForSingleObject
CreateEventW
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
ReleaseSemaphore
CreateSemaphoreExW

api-ms-win-security-base-l1-1-0

ImpersonateLoggedOnUser
RevertToSelf

api-ms-win-core-heap-l1-1-0

HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
HeapSize
HeapDestroy

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DecryptNormalMode
DecryptRecoveryMode
GetSidProtectionString
LogonWithCredentials
ProcessCurrentPolicy
ResetPassword

Sections

.text
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 316B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/LanguagePackManagement/LanguagePackManagement.psd1
WindowsPowerShell/v1.0/Modules/LanguagePackManagement/LanguagePackManagementViews.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/LanguagePackManagement/Microsoft.LanguagePackManagement.Powershell.Commands.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Microsoft.LanguagePackManagement.Powershell.Commands.pdb

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/LanguagePackManagement/en/Microsoft.LanguagePackManagement.Powershell.Commands.Resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/MMAgent/MMAgent.psd1
WindowsPowerShell/v1.0/Modules/MMAgent/ps_mmagent_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/Microsoft.PowerShell.Archive/Microsoft.PowerShell.Archive.psd1
WindowsPowerShell/v1.0/Modules/Microsoft.PowerShell.Archive/Microsoft.PowerShell.Archive.psm1
.ps1
WindowsPowerShell/v1.0/Modules/Microsoft.PowerShell.Archive/en-US/ArchiveResources.psd1
WindowsPowerShell/v1.0/Modules/Microsoft.PowerShell.Diagnostics/Microsoft.PowerShell.Diagnostics.psd1
WindowsPowerShell/v1.0/Modules/Microsoft.PowerShell.Host/Microsoft.PowerShell.Host.psd1
WindowsPowerShell/v1.0/Modules/Microsoft.PowerShell.LocalAccounts/1.0.0.0/LocalAccounts.format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/Microsoft.PowerShell.LocalAccounts/1.0.0.0/Microsoft.PowerShell.LocalAccounts.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Microsoft.PowerShell.LocalAccounts.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/Microsoft.PowerShell.LocalAccounts/1.0.0.0/Microsoft.PowerShell.LocalAccounts.psd1
WindowsPowerShell/v1.0/Modules/Microsoft.PowerShell.LocalAccounts/1.0.0.0/en/Microsoft.PowerShell.LocalAccounts.Resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/Microsoft.PowerShell.Management/Microsoft.PowerShell.Management.psd1
WindowsPowerShell/v1.0/Modules/Microsoft.PowerShell.ODataUtils/Microsoft.PowerShell.ODataAdapter.ps1
.ps1
WindowsPowerShell/v1.0/Modules/Microsoft.PowerShell.ODataUtils/Microsoft.PowerShell.ODataUtils.psd1
WindowsPowerShell/v1.0/Modules/Microsoft.PowerShell.ODataUtils/Microsoft.PowerShell.ODataUtils.psm1
.ps1
WindowsPowerShell/v1.0/Modules/Microsoft.PowerShell.ODataUtils/Microsoft.PowerShell.ODataUtilsHelper.ps1
.ps1
WindowsPowerShell/v1.0/Modules/Microsoft.PowerShell.ODataUtils/Microsoft.PowerShell.ODataV4Adapter.ps1
.ps1
WindowsPowerShell/v1.0/Modules/Microsoft.PowerShell.ODataUtils/en-US/Microsoft.PowerShell.ODataUtilsStrings.psd1
WindowsPowerShell/v1.0/Modules/Microsoft.PowerShell.Security/Microsoft.PowerShell.Security.psd1
WindowsPowerShell/v1.0/Modules/Microsoft.PowerShell.Utility/Microsoft.PowerShell.Utility.psd1
WindowsPowerShell/v1.0/Modules/Microsoft.PowerShell.Utility/Microsoft.PowerShell.Utility.psm1
.ps1
WindowsPowerShell/v1.0/Modules/Microsoft.WSMan.Management/Microsoft.WSMan.Management.psd1
WindowsPowerShell/v1.0/Modules/Microsoft.Windows.Bcd.Cmdlets/Microsoft.Windows.Bcd.Cmdlets.Format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/Microsoft.Windows.Bcd.Cmdlets/Microsoft.Windows.Bcd.Cmdlets.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Microsoft.Windows.Bcd.Cmdlets.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 113KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/Microsoft.Windows.Bcd.Cmdlets/Microsoft.Windows.Bcd.Cmdlets.psd1
WindowsPowerShell/v1.0/Modules/Microsoft.Windows.Bcd.Cmdlets/Microsoft.Windows.Bcd.Utils.dll
.dll windows:10 windows x64 arch:x64

519c0cadce77794676856d883204e01f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Microsoft.Windows.Bcd.Utils.pdb

Imports

msvcrt

__C_specific_handler
_wcsicmp
malloc
free
_initterm
_amsg_exit
_XcptFilter
wcscpy_s

ntdll

RtlInitUnicodeString
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlFreeUnicodeString
RtlGUIDFromString
RtlAllocateHeap
RtlStringFromGUID

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

Exports

Exports

BcdUtilGetDebuggerStartPolicy
BcdUtilGetDebuggerType
BcdUtilGetHypervisorDebuggerType
BcdUtilsGetElementAppliesTo
BcdUtilsGetElementFriendlyName
BcdUtilsGetElementPolicyIndex
BcdUtilsGetElementPolicyString
BcdUtilsGetElementTypeId
BcdUtilsGetNamedElements
BcdUtilsGuidToString
BcdUtilsStringToGuid

Sections

.text
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/Microsoft.Windows.Bcd.Cmdlets/Microsoft.Windows.Bcd.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Microsoft.Windows.Bcd.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/Microsoft.Windows.Bcd.Cmdlets/en/Microsoft.Windows.Bcd.Cmdlets.Resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/Microsoft.Windows.Bcd.Cmdlets/en/Microsoft.Windows.Bcd.Resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/MsDtc/MSFT_DtcAdvancedHostSettingTask_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/MsDtc/MSFT_DtcAdvancedSettingTask_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/MsDtc/MSFT_DtcClusterDefaultTask_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/MsDtc/MSFT_DtcClusterTMMappingTask_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/MsDtc/MSFT_DtcDefaultTask_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/MsDtc/MSFT_DtcLogTask_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/MsDtc/MSFT_DtcNetworkSettingTask_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/MsDtc/MSFT_DtcTask_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/MsDtc/MSFT_DtcTransactionTask_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/MsDtc/MSFT_DtcTransactionsStatisticsTask_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/MsDtc/MSFT_DtcTransactionsTraceSessionTask_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/MsDtc/MSFT_DtcTransactionsTraceSettingTask_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/MsDtc/MsDtc.Formats.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/MsDtc/MsDtc.Types.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/MsDtc/MsDtc.psd1
WindowsPowerShell/v1.0/Modules/MsDtc/TestDtc.psm1
.ps1
WindowsPowerShell/v1.0/Modules/MsDtc/en-US/TestDtc.psd1
WindowsPowerShell/v1.0/Modules/MsDtc/en/Microsoft.Dtc.PowerShell.Resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapter.Format.ps1xml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapter.cmdletDefinition.cdxml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterAdvancedProperty.Format.ps1xml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterAdvancedProperty.cmdletDefinition.cdxml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterBinding.Format.ps1xml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterBinding.cmdletDefinition.cdxml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterChecksumOffload.Format.ps1xml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterChecksumOffload.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterDataPathConfiguration.Format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterDataPathConfiguration.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterEncapsulatedPacketTaskOffload.Format.ps1xml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterEncapsulatedPacketTaskOffload.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterHardwareInfo.Format.ps1xml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterHardwareInfo.cmdletDefinition.cdxml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterIPsecOffload.Format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterIPsecOffload.cdxml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterLso.Format.ps1xml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterLso.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterPacketDirect.Format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterPacketDirect.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterPowerManagement.Format.Helper.psm1
.ps1
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterPowerManagement.Format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterPowerManagement.cmdletDefinition.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterQos.Format.Helper.psm1
.ps1
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterQos.Format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterQos.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterRdma.Format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterRdma.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterRsc.Format.ps1xml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterRsc.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterRss.Format.ps1xml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterRss.cmdletDefinition.cdxml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterSriov.Format.ps1xml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterSriov.cdxml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterSriovVf.Format.ps1xml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterSriovVf.cmdletDefinition.cdxml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterStatistics.Format.ps1xml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterStatistics.cmdletDefinition.cdxml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterUso.Format.ps1xml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterUso.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterVPort.Format.ps1xml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterVPort.cmdletDefinition.cdxml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterVmq.Format.ps1xml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterVmq.cmdletDefinition.cdxml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterVmqQueue.Format.ps1xml
WindowsPowerShell/v1.0/Modules/NetAdapter/MSFT_NetAdapterVmqQueue.cmdletDefinition.cdxml
WindowsPowerShell/v1.0/Modules/NetAdapter/NetAdapter.Format.Helper.psm1
.ps1
WindowsPowerShell/v1.0/Modules/NetAdapter/NetAdapter.Types.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/NetAdapter/NetAdapter.psd1
WindowsPowerShell/v1.0/Modules/NetConnection/MSFT_NetConnectionProfile.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetConnection/MSFT_NetConnectionProfile.format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/NetConnection/MSFT_NetConnectionProfile.types.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/NetConnection/NetConnection.psd1
WindowsPowerShell/v1.0/Modules/NetEventPacketCapture/MSFT_NetEventNetworkAdapter.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetEventPacketCapture/MSFT_NetEventNetworkAdapter.format.ps1xml
WindowsPowerShell/v1.0/Modules/NetEventPacketCapture/MSFT_NetEventPacketCaptureProvider.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetEventPacketCapture/MSFT_NetEventPacketCaptureProvider.format.ps1xml
WindowsPowerShell/v1.0/Modules/NetEventPacketCapture/MSFT_NetEventProvider.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetEventPacketCapture/MSFT_NetEventProvider.format.ps1xml
WindowsPowerShell/v1.0/Modules/NetEventPacketCapture/MSFT_NetEventSession.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetEventPacketCapture/MSFT_NetEventSession.format.ps1xml
WindowsPowerShell/v1.0/Modules/NetEventPacketCapture/MSFT_NetEventVFPProvider.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetEventPacketCapture/MSFT_NetEventVFPProvider.format.ps1xml
WindowsPowerShell/v1.0/Modules/NetEventPacketCapture/MSFT_NetEventVmNetworkAdatper.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetEventPacketCapture/MSFT_NetEventVmNetworkAdatper.format.ps1xml
WindowsPowerShell/v1.0/Modules/NetEventPacketCapture/MSFT_NetEventVmSwitch.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetEventPacketCapture/MSFT_NetEventVmSwitch.format.ps1xml
WindowsPowerShell/v1.0/Modules/NetEventPacketCapture/MSFT_NetEventVmSwitchProvider.cdxml
WindowsPowerShell/v1.0/Modules/NetEventPacketCapture/MSFT_NetEventVmSwitchProvider.format.ps1xml
WindowsPowerShell/v1.0/Modules/NetEventPacketCapture/MSFT_NetEventWFPCaptureProvider.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetEventPacketCapture/MSFT_NetEventWFPCaptureProvider.format.ps1xml
WindowsPowerShell/v1.0/Modules/NetEventPacketCapture/NetEventPacketCapture.Types.ps1xml
.xml .ps1 polyglot
WindowsPowerShell/v1.0/Modules/NetEventPacketCapture/NetEventPacketCapture.psd1
WindowsPowerShell/v1.0/Modules/NetLbfo/MSFT_NetLbfoTeam.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetLbfo/MSFT_NetLbfoTeam.format.ps1xml
WindowsPowerShell/v1.0/Modules/NetLbfo/MSFT_NetLbfoTeamMember.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetLbfo/MSFT_NetLbfoTeamMember.format.ps1xml
WindowsPowerShell/v1.0/Modules/NetLbfo/MSFT_NetLbfoTeamNic.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetLbfo/MSFT_NetLbfoTeamNic.format.ps1xml
WindowsPowerShell/v1.0/Modules/NetLbfo/NetLbfo.Types.ps1xml
.xml .ps1 polyglot
WindowsPowerShell/v1.0/Modules/NetLbfo/NetLbfo.psd1
WindowsPowerShell/v1.0/Modules/NetNat/MSFT_NetNat.Format.ps1xml
WindowsPowerShell/v1.0/Modules/NetNat/MSFT_NetNat.Types.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/NetNat/MSFT_NetNat.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetNat/MSFT_NetNatExternalAddress.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetNat/MSFT_NetNatGlobal.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetNat/MSFT_NetNatSession.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetNat/MSFT_NetNatStaticMapping.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetNat/NetNat.psd1
WindowsPowerShell/v1.0/Modules/NetQos/MSFT_NetQosPolicy.Format.Helper.psm1
.ps1
WindowsPowerShell/v1.0/Modules/NetQos/MSFT_NetQosPolicy.Format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/NetQos/MSFT_NetQosPolicy.Types.ps1xml
.xml .ps1 polyglot
WindowsPowerShell/v1.0/Modules/NetQos/MSFT_NetQosPolicy.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetQos/NetQos.psd1
WindowsPowerShell/v1.0/Modules/NetSecurity/Microsoft.Windows.Firewall.Commands.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Microsoft.Windows.Firewall.Commands.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/NetSecurity/NetFirewallAddressFilter.cmdletDefinition.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetSecurity/NetFirewallApplicationFilter.cmdletDefinition.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetSecurity/NetFirewallDynamicKeywordAddress.cmdletDefinition.cdxml
WindowsPowerShell/v1.0/Modules/NetSecurity/NetFirewallHyperVPort.cmdletDefinition.cdxml
WindowsPowerShell/v1.0/Modules/NetSecurity/NetFirewallHyperVProfile.cmdletDefinition.cdxml
WindowsPowerShell/v1.0/Modules/NetSecurity/NetFirewallHyperVRule.cmdletDefinition.cdxml
WindowsPowerShell/v1.0/Modules/NetSecurity/NetFirewallHyperVVMCreator.cmdletDefinition.cdxml
WindowsPowerShell/v1.0/Modules/NetSecurity/NetFirewallHyperVVMSetting.cmdletDefinition.cdxml
WindowsPowerShell/v1.0/Modules/NetSecurity/NetFirewallInterfaceFilter.cmdletDefinition.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetSecurity/NetFirewallInterfaceTypeFilter.cmdletDefinition.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetSecurity/NetFirewallPortFilter.cmdletDefinition.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetSecurity/NetFirewallProfile.cmdletDefinition.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetSecurity/NetFirewallRule.cmdletDefinition.cdxml
WindowsPowerShell/v1.0/Modules/NetSecurity/NetFirewallSecurityFilter.cmdletDefinition.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetSecurity/NetFirewallServiceFilter.cmdletDefinition.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetSecurity/NetFirewallSetting.cmdletDefinition.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetSecurity/NetGPO.cmdletDefinition.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetSecurity/NetIPsecDospSetting.cmdletDefinition.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetSecurity/NetIPsecIdentity.cmdletDefinition.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetSecurity/NetIPsecMainModeCryptoSet.cmdletDefinition.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetSecurity/NetIPsecMainModeRule.cmdletDefinition.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetSecurity/NetIPsecMainModeSA.cmdletDefinition.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetSecurity/NetIPsecPhase1AuthSet.cmdletDefinition.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetSecurity/NetIPsecPhase2AuthSet.cmdletDefinition.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetSecurity/NetIPsecPolicyChange.cmdletDefinition.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetSecurity/NetIPsecQuickModeCryptoSet.cmdletDefinition.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetSecurity/NetIPsecQuickModeSA.cmdletDefinition.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetSecurity/NetIPsecRule.cmdletDefinition.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetSecurity/NetSecurity.formats.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/NetSecurity/NetSecurity.psd1
WindowsPowerShell/v1.0/Modules/NetSecurity/NetSecurity.types.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/NetSecurity/en/Microsoft.Windows.Firewall.Commands.Resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/NetSwitchTeam/MSFT_NetSwitchTeam.cdxml
WindowsPowerShell/v1.0/Modules/NetSwitchTeam/MSFT_NetSwitchTeam.format.ps1xml
WindowsPowerShell/v1.0/Modules/NetSwitchTeam/MSFT_NetSwitchTeamMember.cdxml
WindowsPowerShell/v1.0/Modules/NetSwitchTeam/MSFT_NetSwitchTeamMember.format.ps1xml
WindowsPowerShell/v1.0/Modules/NetSwitchTeam/NetSwitchTeam.psd1
WindowsPowerShell/v1.0/Modules/NetTCPIP/MSFT_NetCompartment.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetTCPIP/MSFT_NetIPAddress.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetTCPIP/MSFT_NetIPInterface.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetTCPIP/MSFT_NetIPv4Protocol.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetTCPIP/MSFT_NetIPv6Protocol.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetTCPIP/MSFT_NetNeighbor.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetTCPIP/MSFT_NetOffloadGlobalSetting.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetTCPIP/MSFT_NetPrefixPolicy.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetTCPIP/MSFT_NetRoute.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetTCPIP/MSFT_NetTCPConnection.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetTCPIP/MSFT_NetTCPSetting.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetTCPIP/MSFT_NetTransportFilter.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetTCPIP/MSFT_NetUDPEndpoint.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetTCPIP/MSFT_NetUDPSetting.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetTCPIP/NetIPConfiguration.psm1
.ps1
WindowsPowerShell/v1.0/Modules/NetTCPIP/NetTCPIP.psd1
WindowsPowerShell/v1.0/Modules/NetTCPIP/Tcpip.Format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/NetTCPIP/Tcpip.Types.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/NetTCPIP/Test-NetConnection.psm1
.ps1
WindowsPowerShell/v1.0/Modules/NetworkConnectivityStatus/MSFT_DAConnectionStatus.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetworkConnectivityStatus/MSFT_DAConnectionStatus.format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/NetworkConnectivityStatus/MSFT_DAConnectionStatus.types.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/NetworkConnectivityStatus/MSFT_NCSIPolicyConfiguration.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetworkConnectivityStatus/MSFT_NCSIPolicyConfiguration.format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/NetworkConnectivityStatus/NetworkConnectivityStatus.psd1
WindowsPowerShell/v1.0/Modules/NetworkSwitchManager/CmdletHelpers.psm1
.ps1
WindowsPowerShell/v1.0/Modules/NetworkSwitchManager/NetworkSwitchConfiguration.psm1
.ps1
WindowsPowerShell/v1.0/Modules/NetworkSwitchManager/NetworkSwitchEthernetPort.psm1
.ps1
WindowsPowerShell/v1.0/Modules/NetworkSwitchManager/NetworkSwitchFeature.psm1
.ps1
WindowsPowerShell/v1.0/Modules/NetworkSwitchManager/NetworkSwitchGlobalSettingData.psm1
.ps1
WindowsPowerShell/v1.0/Modules/NetworkSwitchManager/NetworkSwitchManager.format.ps1xml
WindowsPowerShell/v1.0/Modules/NetworkSwitchManager/NetworkSwitchManager.psd1
WindowsPowerShell/v1.0/Modules/NetworkSwitchManager/NetworkSwitchManager.types.ps1xml
WindowsPowerShell/v1.0/Modules/NetworkSwitchManager/NetworkSwitchVlan.psm1
.ps1
WindowsPowerShell/v1.0/Modules/NetworkSwitchManager/en-US/NetworkSwitchManager.Resource.psd1
WindowsPowerShell/v1.0/Modules/NetworkTransition/MSFT_Net6to4Configuration.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetworkTransition/MSFT_Net6to4Configuration.format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/NetworkTransition/MSFT_Net6to4Configuration.types.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/NetworkTransition/MSFT_NetDnsTransitionConfiguration.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetworkTransition/MSFT_NetDnsTransitionConfiguration.format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/NetworkTransition/MSFT_NetDnsTransitionConfiguration.types.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/NetworkTransition/MSFT_NetDnsTransitionMonitoring.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetworkTransition/MSFT_NetDnsTransitionMonitoring.format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/NetworkTransition/MSFT_NetISATAPConfiguration.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetworkTransition/MSFT_NetISATAPConfiguration.format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/NetworkTransition/MSFT_NetISATAPConfiguration.types.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/NetworkTransition/MSFT_NetIpHTTPsConfiguration.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetworkTransition/MSFT_NetIpHTTPsConfiguration.format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/NetworkTransition/MSFT_NetIpHTTPsConfiguration.types.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/NetworkTransition/MSFT_NetIpHTTPsState.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetworkTransition/MSFT_NetIpHTTPsState.format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/NetworkTransition/MSFT_NetNatTransitionConfiguration.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetworkTransition/MSFT_NetNatTransitionConfiguration.format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/NetworkTransition/MSFT_NetNatTransitionConfiguration.types.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/NetworkTransition/MSFT_NetNatTransitionMonitoring.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetworkTransition/MSFT_NetNatTransitionMonitoring.format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/NetworkTransition/MSFT_NetTeredoConfiguration.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetworkTransition/MSFT_NetTeredoConfiguration.format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/NetworkTransition/MSFT_NetTeredoConfiguration.types.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/NetworkTransition/MSFT_NetTeredoState.cdxml
.xml
WindowsPowerShell/v1.0/Modules/NetworkTransition/MSFT_NetTeredoState.format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/NetworkTransition/NetworkTransition.psd1
WindowsPowerShell/v1.0/Modules/PKI/pki.psd1
WindowsPowerShell/v1.0/Modules/PKI/pki.types.ps1xml
.xml .ps1 polyglot
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCClassResources/WindowsPackageCab/WindowsPackageCab.psd1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCClassResources/WindowsPackageCab/WindowsPackageCab.psm1
.ps1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCClassResources/WindowsPackageCab/en-US/WindowsPackageCab.Strings.psd1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/CompositeResourceHelper.psm1
.ps1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/DSCResourceHelper.psm1
.ps1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/GroupSet/GroupSet.Schema.psm1
.ps1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/GroupSet/GroupSet.psd1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_ArchiveResource/MSFT_ArchiveResource.psm1
.ps1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_ArchiveResource/MSFT_ArchiveResource.schema.mof
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_ArchiveResource/en-US/ArchiveProvider.psd1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_ArchiveResource/en-US/MSFT_ArchiveResource.schema.mfl
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_EnvironmentResource/MSFT_EnvironmentResource.psm1
.ps1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_EnvironmentResource/MSFT_EnvironmentResource.schema.mof
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_EnvironmentResource/en-US/MSFT_EnvironmentResource.schema.mfl
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_EnvironmentResource/en-US/MSFT_EnvironmentResource.strings.psd1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_GroupResource/MSFT_GroupResource.psm1
.ps1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_GroupResource/MSFT_GroupResource.schema.mof
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_GroupResource/en-US/MSFT_GroupResource.schema.mfl
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_GroupResource/en-US/MSFT_GroupResource.strings.psd1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_LogResource/MSFT_LogResource.schema.mof
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_LogResource/en-US/MSFT_LogResource.schema.mfl
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_PackageResource/MSFT_PackageResource.psm1
.ps1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_PackageResource/MSFT_PackageResource.schema.mof
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_PackageResource/en-US/MSFT_PackageResource.schema.mfl
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_PackageResource/en-US/PackageProvider.psd1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_ProcessResource/MSFT_ProcessResource.psm1
.ps1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_ProcessResource/MSFT_ProcessResource.schema.mof
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_ProcessResource/en-US/MSFT_ProcessResource.schema.mfl
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_ProcessResource/en-US/MSFT_ProcessResource.strings.psd1
.ps1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_RegistryResource/MSFT_RegistryResource.psm1
.ps1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_RegistryResource/MSFT_RegistryResource.schema.mof
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_RegistryResource/en-US/MSFT_RegistryResource.schema.mfl
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_RegistryResource/en-US/MSFT_RegistryResource.strings.psd1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_RoleResource/MSFT_RoleResource.psm1
.ps1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_RoleResource/MSFT_RoleResource.schema.mof
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_RoleResource/en-US/MSFT_RoleResource.schema.mfl
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_RoleResource/en-US/MSFT_RoleResourceStrings.psd1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_ScriptResource/MSFT_ScriptResource.psm1
.ps1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_ScriptResource/MSFT_ScriptResource.schema.mof
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_ScriptResource/en-US/MSFT_ScriptResource.schema.mfl
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_ScriptResource/en-US/MSFT_ScriptResourceStrings.psd1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_ServiceResource/MSFT_ServiceResource.psm1
.ps1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_ServiceResource/MSFT_ServiceResource.schema.mof
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_ServiceResource/en-US/MSFT_ServiceResource.schema.mfl
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_ServiceResource/en-US/MSFT_ServiceResource.strings.psd1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_UserResource/MSFT_UserResource.psm1
.ps1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_UserResource/MSFT_UserResource.schema.mof
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_UserResource/en-US/MSFT_UserResource.schema.mfl
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_UserResource/en-US/MSFT_UserResource.strings.psd1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_WaitForAll/MSFT_WaitForAll.psm1
.ps1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_WaitForAll/MSFT_WaitForAll.schema.mof
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_WaitForAll/en-US/MSFT_WaitForAll.schema.mfl
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_WaitForAny/MSFT_WaitForAny.psm1
.ps1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_WaitForAny/MSFT_WaitForAny.schema.mof
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_WaitForAny/en-US/MSFT_WaitForAny.schema.mfl
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_WaitForSome/MSFT_WaitForSome.psm1
.ps1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_WaitForSome/MSFT_WaitForSome.schema.mof
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_WaitForSome/en-US/MSFT_WaitForSome.schema.mfl
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_WindowsOptionalFeature/MSFT_WindowsOptionalFeature.psm1
.ps1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_WindowsOptionalFeature/MSFT_WindowsOptionalFeature.schema.mof
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_WindowsOptionalFeature/en-US/MSFT_WindowsOptionalFeature.schema.mfl
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/MSFT_WindowsOptionalFeature/en-US/MSFT_WindowsOptionalFeature.strings.psd1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/ProcessSet/ProcessSet.Schema.psm1
.ps1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/ProcessSet/ProcessSet.psd1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/RunAsHelper.psm1
.ps1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/ServiceSet/ServiceSet.Schema.psm1
.ps1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/ServiceSet/ServiceSet.psd1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/WindowsFeatureSet/WindowsFeatureSet.Schema.psm1
.ps1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/WindowsFeatureSet/WindowsFeatureSet.psd1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/WindowsOptionalFeatureSet/WindowsOptionalFeatureSet.Schema.psm1
.ps1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/WindowsOptionalFeatureSet/WindowsOptionalFeatureSet.psd1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DSCResources/en-US/RunAsHelper.strings.psd1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/Disable-DscDebug.cdxml
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DownloadManager/DSCFileDownloadManager/DSCFileDownloadManager.psd1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DownloadManager/DSCFileDownloadManager/Microsoft.PowerShell.DSC.FileDownloadManager.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Microsoft.PowerShell.DSC.FileDownloadManager.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/DownloadManager/DSCFileDownloadManager/en/Microsoft.PowerShell.DSC.FileDownloadManager.Resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/Enable-DscDebug.cdxml
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/Get-DSCLocalConfigurationManager.cdxml
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/Get-DscConfiguration.cdxml
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/Get-DscConfigurationStatus.cdxml
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/PSDesiredStateConfiguration.format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/PSDesiredStateConfiguration.psd1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/PSDesiredStateConfiguration.psm1
.ps1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/PSDesiredStateConfiguration.types.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/PSDscXMachine.psm1
.ps1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/Remove-DscConfigurationDocument.cdxml
.xml
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/Restore-DscConfiguration.cdxml
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/Stop-DscConfiguration.cdxml
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/WebDownloadManager/WebDownloadManager.psd1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/en-US/PSDSCxMachine.strings.psd1
WindowsPowerShell/v1.0/Modules/PSDesiredStateConfiguration/en-US/PSDesiredStateConfiguration.Resource.psd1
WindowsPowerShell/v1.0/Modules/PSDiagnostics/PSDiagnostics.psd1
WindowsPowerShell/v1.0/Modules/PSDiagnostics/PSDiagnostics.psm1
.ps1
WindowsPowerShell/v1.0/Modules/PSScheduledJob/PSScheduledJob.Format.ps1xml
WindowsPowerShell/v1.0/Modules/PSScheduledJob/PSScheduledJob.psd1
WindowsPowerShell/v1.0/Modules/PSScheduledJob/PSScheduledJob.types.ps1xml
WindowsPowerShell/v1.0/Modules/PSWorkflow/PSWorkflow.psd1
WindowsPowerShell/v1.0/Modules/PSWorkflow/PSWorkflow.psm1
.ps1
WindowsPowerShell/v1.0/Modules/PSWorkflow/PSWorkflow.types.ps1xml
WindowsPowerShell/v1.0/Modules/PSWorkflowUtility/PSWorkflowUtility.psd1
WindowsPowerShell/v1.0/Modules/PSWorkflowUtility/PSWorkflowUtility.psm1
.ps1
WindowsPowerShell/v1.0/Modules/PcsvDevice/CIM_PhysicalComputerSystemView.cdxml
.xml
WindowsPowerShell/v1.0/Modules/PcsvDevice/PcsvDevice.format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/PcsvDevice/PcsvDevice.psd1
WindowsPowerShell/v1.0/Modules/PcsvDevice/PcsvDevice.types.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/PersistentMemory/Microsoft.Storage.PersistentMemory.Management.Commands.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Microsoft.Storage.PersistentMemory.Management.Commands.pdb

Sections

.text
Size: 147KB - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/PersistentMemory/PersistentMemory.psd1
WindowsPowerShell/v1.0/Modules/PersistentMemory/PmemDedicatedMemory.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/PersistentMemory/PmemDisk.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/PersistentMemory/PmemPhysicalDevice.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/PersistentMemory/en/Microsoft.Storage.PersistentMemory.Management.Commands.Resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/PersistentMemory/scmbridge.dll
.dll windows:10 windows x64 arch:x64

c9e82c03f92b3c8c763e4f161784e772

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

scmbridge.pdb

Imports

msvcp_win

?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?_Xbad_function_call@std@@YAXXZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@H@Z
?_Xout_of_range@std@@YAXPEBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
??1facet@locale@std@@MEAA@XZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$numpunct@D@std@@2V0locale@2@A
?_Xinvalid_argument@std@@YAXPEBD@Z
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?uncaught_exception@std@@YA_NXZ
?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
??0facet@locale@std@@IEAA@_K@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
??Bid@locale@std@@QEAA_KXZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?in@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z
??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__crt_atexit
_o__dsign
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__configure_narrow_argv
_o__wcsicmp
_o_calloc
_o_free
_o_localeconv
_o_malloc
_o_strcpy_s
_o_strtod
_o_strtoul
_o_strtoull
_o_terminate
_o_towlower
_o_wcscpy_s
__C_specific_handler
__current_exception
__current_exception_context
_CxxThrowException
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o__cexit
_o___std_type_info_destroy_list
_o__callnewh
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
__std_type_info_compare
memcmp
memmove
memcpy

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
LoadLibraryExW
GetModuleFileNameA
DisableThreadLibraryCalls
GetModuleHandleW
FreeLibrary
GetProcAddress

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
CreateSemaphoreExW
ReleaseMutex
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
ReleaseSemaphore
WaitForSingleObjectEx
CreateEventW
SetEvent
ResetEvent
CreateMutexExW
OpenSemaphoreW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
SetLastError
GetLastError
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegFlushKey
RegDeleteValueW
RegCreateKeyExW

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

cfgmgr32

CM_Disable_DevNode
CM_Reenumerate_DevNode
CM_Query_And_Remove_SubTreeW
CM_Get_Sibling
CM_Get_Device_Interface_PropertyW
CM_Get_Device_Interface_List_SizeW
CM_Get_Device_Interface_ListW
CM_Enable_DevNode
CM_Locate_DevNodeW
CM_Get_Child
CM_Get_Device_ID_ListW
CM_Get_Device_ID_List_SizeW
CM_Get_DevNode_PropertyW
CM_Get_DevNode_Status

devobj

DevObjRegisterDeviceInfo
DevObjCreateDeviceInfo
DevObjDestroyDeviceInfoList
DevObjOpenDeviceInfo
DevObjDeleteDevice
DevObjSetDeviceRegistryProperty
DevObjCreateDeviceInfoList

rpcrt4

UuidCreate

ntdll

RtlSetBit
RtlClearBit
RtlInitializeBitMap
RtlSetBits

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-file-l1-1-0

FindVolumeClose
FindNextVolumeW
FindFirstVolumeW
CreateFileW

Exports

Exports

ScmDeleteAllSimulatedPmemDisks
ScmDeletePmemDisk
ScmDeletePmemDm
ScmGetDiskNumberFromDiskGuid
ScmGetLogicalPmemDiskByDiskNumber
ScmGetLogicalPmemDisks
ScmGetLogicalPmemDmByDeviceNumber
ScmGetLogicalPmemDms
ScmGetPhysicalNvdimmByNfitHandle
ScmGetPhysicalNvdimms
ScmGetUnusedPmemRegionById
ScmGetUnusedPmemRegions
ScmInitializePmemPhysicalDevice
ScmNewPmemDiskFromUnusedRegion
ScmNewPmemDmFromUnusedRegion
ScmNewSimulatedPmemDisk
ScmRebuildStacks
ScmRefreshNamespace
ScmSetPmemDmState

Sections

.text
Size: 176KB - Virtual size: 173KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 408B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/PnpDevice/PnpDevice.Format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/PnpDevice/PnpDevice.Resource.psd1
WindowsPowerShell/v1.0/Modules/PnpDevice/PnpDevice.Types.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/PnpDevice/PnpDevice.cdxml
.xml
WindowsPowerShell/v1.0/Modules/PnpDevice/PnpDevice.psd1
WindowsPowerShell/v1.0/Modules/PrintManagement/MSFT_3DPrinter.format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/PrintManagement/MSFT_3DPrinter_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/PrintManagement/MSFT_AdaptivePrinterPort.format.ps1xml
WindowsPowerShell/v1.0/Modules/PrintManagement/MSFT_AdaptivePrinterPort.types.ps1xml
WindowsPowerShell/v1.0/Modules/PrintManagement/MSFT_AdaptivePrinterPort_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/PrintManagement/MSFT_LocalPrinterPort.format.ps1xml
WindowsPowerShell/v1.0/Modules/PrintManagement/MSFT_LocalPrinterPort_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/PrintManagement/MSFT_LprPrinterPort.format.ps1xml
WindowsPowerShell/v1.0/Modules/PrintManagement/MSFT_LprPrinterPort_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/PrintManagement/MSFT_PrintJob.format.ps1xml
WindowsPowerShell/v1.0/Modules/PrintManagement/MSFT_PrintJob.types.ps1xml
WindowsPowerShell/v1.0/Modules/PrintManagement/MSFT_PrintJob_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/PrintManagement/MSFT_Printer.format.ps1xml
WindowsPowerShell/v1.0/Modules/PrintManagement/MSFT_Printer.types.ps1xml
WindowsPowerShell/v1.0/Modules/PrintManagement/MSFT_PrinterConfiguration.format.ps1xml
WindowsPowerShell/v1.0/Modules/PrintManagement/MSFT_PrinterConfiguration.types.ps1xml
WindowsPowerShell/v1.0/Modules/PrintManagement/MSFT_PrinterConfiguration_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/PrintManagement/MSFT_PrinterDriver.format.ps1xml
WindowsPowerShell/v1.0/Modules/PrintManagement/MSFT_PrinterDriver_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/PrintManagement/MSFT_PrinterNfcTag.format.ps1xml
WindowsPowerShell/v1.0/Modules/PrintManagement/MSFT_PrinterNfcTagTasks_v1.0.cdxml
.xml
WindowsPowerShell/v1.0/Modules/PrintManagement/MSFT_PrinterNfcTag_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/PrintManagement/MSFT_PrinterPort.format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/PrintManagement/MSFT_PrinterPortTasks_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/PrintManagement/MSFT_PrinterPort_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/PrintManagement/MSFT_PrinterProperty.format.ps1xml
WindowsPowerShell/v1.0/Modules/PrintManagement/MSFT_PrinterProperty.types.ps1xml
WindowsPowerShell/v1.0/Modules/PrintManagement/MSFT_PrinterProperty_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/PrintManagement/MSFT_Printer_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/PrintManagement/MSFT_TcpIpPrinterPort.format.ps1xml
WindowsPowerShell/v1.0/Modules/PrintManagement/MSFT_TcpIpPrinterPort.types.ps1xml
WindowsPowerShell/v1.0/Modules/PrintManagement/MSFT_TcpIpPrinterPort_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/PrintManagement/PrintManagement.psd1
WindowsPowerShell/v1.0/Modules/ProcessMitigations/Microsoft.ProcessMitigations.Commands.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Microsoft.ProcessMitigations.Commands.pdb

Sections

.text
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/ProcessMitigations/Microsoft.ProcessMitigations.Commands.dll-Help.xml
.xml .ps1
WindowsPowerShell/v1.0/Modules/ProcessMitigations/Microsoft.ProcessMitigations.Commands.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/ProcessMitigations/ProcessMitigations.psd1
WindowsPowerShell/v1.0/Modules/Provisioning/provautologger_add.reg
WindowsPowerShell/v1.0/Modules/Provisioning/provautologger_del.reg
WindowsPowerShell/v1.0/Modules/Provisioning/provcmdlets.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

ProvCmdlets.pdb

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/Provisioning/provcommon.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

ProvCommon.pdb

Sections

.text
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/Provisioning/provisioning.psd1
WindowsPowerShell/v1.0/Modules/Provisioning/provisioning.psm1
.ps1
WindowsPowerShell/v1.0/Modules/Provisioning/provpackageapi.dll
.dll windows:10 windows x64 arch:x64

ac174a8c3cad3380b767a8537c932bda

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03-02-2023 00:05

Not After

01-02-2024 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

67:35:31:9e:4d:8f:0e:d2:1d:e1:e7:07:2f:08:61:2f:78:38:4f:8d:3e:7f:d0:fd:bb:1f:96:dd:dd:c1:a4:fb
Signer

Actual PE Digest

67:35:31:9e:4d:8f:0e:d2:1d:e1:e7:07:2f:08:61:2f:78:38:4f:8d:3e:7f:d0:fd:bb:1f:96:dd:dd:c1:a4:fb

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

ProvPackageAPI.pdb

Imports

msvcrt

__badioinfo
__pioinfo
_iob
_fileno
mbtowc
__mb_cur_max
isleadbyte
iswalpha
wcspbrk
wcsncmp
wcsrchr
wcschr
wcstombs_s
wcstombs
??0exception@@QEAA@AEBQEBD@Z
?what@exception@@UEBAPEBDXZ
wcstoul
_wcsicmp
_vscwprintf
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
_vsnwprintf
__CxxFrameHandler3
_callnewh
memset
memcmp
?terminate@@YAXXZ
_cexit
_XcptFilter
_amsg_exit
free
_onexit
malloc
_initterm
__C_specific_handler
__dllonexit
_unlock
_lock
_CxxThrowException
memmove
ferror
_itoa
_snprintf
wctomb
_isatty
_write
_lseeki64
abort
??1type_info@@UEAA@XZ
??3@YAXPEAX@Z
_errno

kernel32

CreateMutexExW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
RtlPcToFileHeader
FindNextFileW
FindFirstFileW
ReadFile
GetVolumePathNamesForVolumeNameW
Sleep
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
IsDebuggerPresent
CloseHandle
LoadLibraryW
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
GetOverlappedResult
GetModuleHandleA
GetProcAddress
VirtualQuery
GetLastError
GetVersion
SetLastError
OpenSemaphoreW
WaitForSingleObjectEx
OutputDebugStringW
ReleaseMutex
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
DebugBreak
GetModuleHandleW
GetProcessHeap
HeapAlloc
FormatMessageW
GetModuleHandleExW
HeapFree
CreateEventW
GetFinalPathNameByHandleW
DeviceIoControl
OutputDebugStringA
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
FreeLibrary
GetSystemInfo
RaiseException
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
LoadLibraryExA
VirtualProtect
LocalAlloc
SetFileAttributesW
GetFileAttributesW
CreateDirectoryW
CreateProcessW
GetFileSizeEx
GetFileSize
LocalFree
DeleteFileW
CreateFileW
FindClose
RemoveDirectoryW
GetModuleFileNameA
WriteFile

mscoree

CorBindToRuntimeEx
_CorDllMain

ole32

IIDFromString
CoCreateGuid
CoCreateInstance

bcrypt

BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptGenRandom
BCryptSetProperty
BCryptDecrypt
BCryptGetProperty
BCryptDestroyKey
BCryptEncrypt
BCryptHashData
BCryptCreateHash
BCryptGenerateSymmetricKey
BCryptOpenAlgorithmProvider

xmllite

CreateXmlReader
CreateXmlWriter

Sections

.text
Size: 120KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.nep
Size: 4KB - Virtual size: 768B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 320B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/Provisioning/provtrace.wprp
.xml
WindowsPowerShell/v1.0/Modules/Provisioning/wiminterop.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WimInterop.pdb

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/ScheduledTasks/MSFT_ScheduledTask.format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/ScheduledTasks/MSFT_ScheduledTask.types.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/ScheduledTasks/MSFT_ScheduledTask_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/ScheduledTasks/PS_ClusteredScheduledTask_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/ScheduledTasks/PS_ScheduledTask.types.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/ScheduledTasks/PS_ScheduledTask_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/ScheduledTasks/ScheduledTasks.psd1
WindowsPowerShell/v1.0/Modules/SecureBoot/SecureBoot.psd1
WindowsPowerShell/v1.0/Modules/SmbShare/Smb.format.ps1xml
WindowsPowerShell/v1.0/Modules/SmbShare/Smb.types.ps1xml
.xml .ps1 polyglot
WindowsPowerShell/v1.0/Modules/SmbShare/SmbBandwidthLimit.cdxml
.xml
WindowsPowerShell/v1.0/Modules/SmbShare/SmbClientCertificateMapping.cdxml
.xml
WindowsPowerShell/v1.0/Modules/SmbShare/SmbClientConfiguration.cdxml
.xml
WindowsPowerShell/v1.0/Modules/SmbShare/SmbClientNetworkInterface.cdxml
WindowsPowerShell/v1.0/Modules/SmbShare/SmbComponent.cdxml
.xml
WindowsPowerShell/v1.0/Modules/SmbShare/SmbConnection.cdxml
WindowsPowerShell/v1.0/Modules/SmbShare/SmbGlobalMapping.cdxml
WindowsPowerShell/v1.0/Modules/SmbShare/SmbMapping.cdxml
WindowsPowerShell/v1.0/Modules/SmbShare/SmbMultichannelConnection.cdxml
WindowsPowerShell/v1.0/Modules/SmbShare/SmbMultichannelConstraint.cdxml
.xml
WindowsPowerShell/v1.0/Modules/SmbShare/SmbOpenFile.cdxml
WindowsPowerShell/v1.0/Modules/SmbShare/SmbScriptModule.psm1
.ps1
WindowsPowerShell/v1.0/Modules/SmbShare/SmbServerCertificateMapping.cdxml
.xml
WindowsPowerShell/v1.0/Modules/SmbShare/SmbServerConfiguration.cdxml
.xml
WindowsPowerShell/v1.0/Modules/SmbShare/SmbServerNetworkInterface.cdxml
WindowsPowerShell/v1.0/Modules/SmbShare/SmbSession.cdxml
WindowsPowerShell/v1.0/Modules/SmbShare/SmbShare.Format.Helper.psm1
WindowsPowerShell/v1.0/Modules/SmbShare/SmbShare.cdxml
.xml
WindowsPowerShell/v1.0/Modules/SmbShare/SmbShare.psd1
WindowsPowerShell/v1.0/Modules/SmbShare/en-US/SmbLocalization.psd1
WindowsPowerShell/v1.0/Modules/SmbWitness/SmbWitness.Format.ps1xml
WindowsPowerShell/v1.0/Modules/SmbWitness/SmbWitness.psd1
WindowsPowerShell/v1.0/Modules/SmbWitness/SmbWitness.types.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/SmbWitness/SmbWitnessWmiClient.cdxml
.xml
WindowsPowerShell/v1.0/Modules/StartLayout/GetStartApps.psm1
.ps1
WindowsPowerShell/v1.0/Modules/StartLayout/StartLayout.psd1
WindowsPowerShell/v1.0/Modules/Storage/Disk.cdxml
WindowsPowerShell/v1.0/Modules/Storage/DiskImage.cdxml
WindowsPowerShell/v1.0/Modules/Storage/FileIntegrity.cdxml
WindowsPowerShell/v1.0/Modules/Storage/FileServer.cdxml
WindowsPowerShell/v1.0/Modules/Storage/FileShare.cdxml
WindowsPowerShell/v1.0/Modules/Storage/FileStorageTier.cdxml
WindowsPowerShell/v1.0/Modules/Storage/InitiatorId.cdxml
WindowsPowerShell/v1.0/Modules/Storage/InitiatorPort.cdxml
WindowsPowerShell/v1.0/Modules/Storage/MaskingSet.cdxml
WindowsPowerShell/v1.0/Modules/Storage/OffloadDataTransferSetting.cdxml
WindowsPowerShell/v1.0/Modules/Storage/Partition.cdxml
WindowsPowerShell/v1.0/Modules/Storage/PhysicalDisk.cdxml
WindowsPowerShell/v1.0/Modules/Storage/ResiliencySetting.cdxml
WindowsPowerShell/v1.0/Modules/Storage/Storage.format.ps1xml
.xml .ps1 polyglot
WindowsPowerShell/v1.0/Modules/Storage/Storage.psd1
WindowsPowerShell/v1.0/Modules/Storage/Storage.types.ps1xml
.xml .ps1 polyglot
WindowsPowerShell/v1.0/Modules/Storage/StorageCmdlets.cdxml
WindowsPowerShell/v1.0/Modules/Storage/StorageEnclosure.cdxml
WindowsPowerShell/v1.0/Modules/Storage/StorageHealth.cdxml
WindowsPowerShell/v1.0/Modules/Storage/StorageJob.cdxml
WindowsPowerShell/v1.0/Modules/Storage/StorageNode.cdxml
WindowsPowerShell/v1.0/Modules/Storage/StoragePool.cdxml
WindowsPowerShell/v1.0/Modules/Storage/StorageProvider.cdxml
WindowsPowerShell/v1.0/Modules/Storage/StorageReliabilityCounter.cdxml
WindowsPowerShell/v1.0/Modules/Storage/StorageScripts.psm1
.ps1
WindowsPowerShell/v1.0/Modules/Storage/StorageSetting.cdxml
WindowsPowerShell/v1.0/Modules/Storage/StorageSubSystem.cdxml
WindowsPowerShell/v1.0/Modules/Storage/StorageTier.cdxml
WindowsPowerShell/v1.0/Modules/Storage/TargetPort.cdxml
WindowsPowerShell/v1.0/Modules/Storage/TargetPortal.cdxml
WindowsPowerShell/v1.0/Modules/Storage/VirtualDisk.cdxml
WindowsPowerShell/v1.0/Modules/Storage/Volume.cdxml
WindowsPowerShell/v1.0/Modules/StorageBusCache/StorageBusCache.format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/StorageBusCache/StorageBusCache.psd1
WindowsPowerShell/v1.0/Modules/StorageBusCache/StorageBusCache.psm1
.ps1
WindowsPowerShell/v1.0/Modules/StorageBusCache/StorageBusCache.types.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/StorageBusCache/StorageBusClientDevice.cdxml
WindowsPowerShell/v1.0/Modules/StorageBusCache/StorageBusTargetCacheStoresInstance.cdxml
WindowsPowerShell/v1.0/Modules/StorageBusCache/StorageBusTargetDeviceInstance.cdxml
WindowsPowerShell/v1.0/Modules/TLS/tls.psd1
WindowsPowerShell/v1.0/Modules/TroubleshootingPack/TroubleshootingPack.format.ps1xml
WindowsPowerShell/v1.0/Modules/TroubleshootingPack/TroubleshootingPack.psd1
WindowsPowerShell/v1.0/Modules/TrustedPlatformModule/TrustedPlatformModule.psd1
WindowsPowerShell/v1.0/Modules/UEV/Microsoft.Uev.Commands.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Microsoft.Uev.Commands.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/UEV/UEV.Types.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/UEV/UEV.psd1
WindowsPowerShell/v1.0/Modules/VMDirectStorage/VMDirectStorage.format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/VMDirectStorage/VMDirectStorage.psd1
WindowsPowerShell/v1.0/Modules/VMDirectStorage/VMDirectStorage.psm1
.ps1
WindowsPowerShell/v1.0/Modules/VpnClient/PS_EapConfiguration_v1.0.0.cdxml
WindowsPowerShell/v1.0/Modules/VpnClient/PS_VpnConnectionIPsecConfiguration_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/VpnClient/PS_VpnConnectionProxy_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/VpnClient/PS_VpnConnectionRoute_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/VpnClient/PS_VpnConnectionTriggerApplication_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/VpnClient/PS_VpnConnectionTriggerDnsConfiguration_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/VpnClient/PS_VpnConnectionTriggerTrustedNetwork_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/VpnClient/PS_VpnConnectionTrigger_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/VpnClient/PS_VpnConnection_v1.0.0.cdxml
WindowsPowerShell/v1.0/Modules/VpnClient/PS_VpnServerAddress_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/VpnClient/VpnClient.psd1
WindowsPowerShell/v1.0/Modules/VpnClient/VpnClientPSProvider.Format.ps1xml
.xml .ps1 polyglot
WindowsPowerShell/v1.0/Modules/VpnClient/VpnClientPSProvider.Types.ps1xml
.xml .ps1 polyglot
WindowsPowerShell/v1.0/Modules/Wdac/MSFT_OdbcDriverTask_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/Wdac/MSFT_OdbcDsnTask_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/Wdac/MSFT_OdbcPerfCounterTask_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/Wdac/MSFT_WdacBidTraceTask_v1.0.cdxml
WindowsPowerShell/v1.0/Modules/Wdac/Wdac.format.ps1xml
WindowsPowerShell/v1.0/Modules/Wdac/Wdac.psd1
WindowsPowerShell/v1.0/Modules/Wdac/Wdac.types.ps1xml
WindowsPowerShell/v1.0/Modules/Whea/Microsoft.Windows.Whea.WheaMemoryPolicy.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Microsoft.Windows.Whea.WheaMemoryPolicy.pdb

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/Whea/Whea.psd1
WindowsPowerShell/v1.0/Modules/WinHttpProxy/WinHttpProxy.psd1
WindowsPowerShell/v1.0/Modules/WinHttpProxy/WinHttpProxy.psm1
.ps1
WindowsPowerShell/v1.0/Modules/WindowsDeveloperLicense/WindowsDeveloperLicense.psd1
WindowsPowerShell/v1.0/Modules/WindowsErrorReporting/Microsoft.WindowsErrorReporting.PowerShell.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Microsoft.WindowsErrorReporting.PowerShell.pdb

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/WindowsErrorReporting/WindowsErrorReporting.psd1
WindowsPowerShell/v1.0/Modules/WindowsErrorReporting/WindowsErrorReporting.psm1
WindowsPowerShell/v1.0/Modules/WindowsSearch/Microsoft.WindowsSearch.Commands.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Microsoft.WindowsSearch.Commands.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/WindowsSearch/WindowsSearch.Format.ps1xml
.xml
WindowsPowerShell/v1.0/Modules/WindowsSearch/WindowsSearch.psd1
WindowsPowerShell/v1.0/Modules/WindowsSearch/en/Microsoft.WindowsSearch.Commands.Resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/Modules/WindowsUpdate/WindowsUpdate.psd1
WindowsPowerShell/v1.0/Modules/WindowsUpdate/WindowsUpdateLog.psm1
.ps1
WindowsPowerShell/v1.0/Modules/iSCSI/iSCSI.psd1
WindowsPowerShell/v1.0/Modules/iSCSI/iSCSIConnection.cdxml
WindowsPowerShell/v1.0/Modules/iSCSI/iSCSISession.cdxml
WindowsPowerShell/v1.0/Modules/iSCSI/iSCSITarget.cdxml
WindowsPowerShell/v1.0/Modules/iSCSI/iSCSITargetPortal.cdxml
WindowsPowerShell/v1.0/PSEvents.dll
.dll windows:10 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.rdata
Size: 4KB - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 56KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/PowerShellCore.format.ps1xml
.ps1
WindowsPowerShell/v1.0/PowerShellTrace.format.ps1xml
WindowsPowerShell/v1.0/Registry.format.ps1xml
WindowsPowerShell/v1.0/Schemas/PSMaml/ITPro.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/Maml.rld
WindowsPowerShell/v1.0/Schemas/PSMaml/Maml.tbr
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/Maml.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/Maml.xsx
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/Maml_HTML.xsl
WindowsPowerShell/v1.0/Schemas/PSMaml/Maml_HTML_Style.xsl
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/ManagedDeveloper.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/ManagedDeveloperStructure.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/ProviderHelp.xsd
WindowsPowerShell/v1.0/Schemas/PSMaml/base.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/baseConditional.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/block.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/blockCommon.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/blockSoftware.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/command.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/conditionSet.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/developer.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/developerCommand.rld
WindowsPowerShell/v1.0/Schemas/PSMaml/developerCommand.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/developerDscResource.xsd
WindowsPowerShell/v1.0/Schemas/PSMaml/developerManaged.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/developerManagedClass.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/developerManagedConstructor.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/developerManagedDelegate.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/developerManagedEnumeration.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/developerManagedEvent.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/developerManagedField.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/developerManagedInterface.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/developerManagedMethod.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/developerManagedNamespace.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/developerManagedOperator.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/developerManagedOverload.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/developerManagedProperty.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/developerManagedStructure.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/developerReference.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/developerStructure.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/developerXaml.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/endUser.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/faq.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/glossary.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/hierarchy.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/inline.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/inlineCommon.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/inlineSoftware.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/inlineUi.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/shellExecute.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/structure.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/structureGlossary.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/structureList.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/structureProcedure.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/structureTable.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/structureTaskExecution.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/task.xsd
.xml
WindowsPowerShell/v1.0/Schemas/PSMaml/troubleshooting.xsd
.xml
WindowsPowerShell/v1.0/WSMan.Format.ps1xml
WindowsPowerShell/v1.0/en-US/PSEvents.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 52KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/en-US/default.help.txt
.ps1
WindowsPowerShell/v1.0/en-US/powershell.exe.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/en-US/pspluginwkr.dll.mui
.dll windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/en-US/pwrshmsg.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/en/powershell_ise.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/getevent.types.ps1xml
.ps1
WindowsPowerShell/v1.0/powershell.exe
.exe windows:10 windows x64 arch:x64

afacf6dc9041114b198160aab4d0ae77

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

powershell.pdb

Imports

msvcrt

_unlock
_lock
_commode
_fmode
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
__CxxFrameHandler4
__dllonexit
_amsg_exit
_onexit
?terminate@@YAXXZ
_vsnwprintf
_wcsicmp
_wcsnicmp
fclose
_wfopen
??1type_info@@UEAA@XZ
wcstoul
wcschr
__uncaught_exception
_XcptFilter
memmove
memcpy
__CxxFrameHandler3
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_callnewh
malloc
wcsncmp
wcsrchr
free
_purecall
??3@YAXPEAX@Z
memcpy_s
??_V@YAXPEAX@Z
__C_specific_handler
_itow_s
memset

atl

ord30

kernel32

FindResourceExW
LCIDToLocaleName
UnmapViewOfFile
GetVersionExW
GetLocaleInfoW
GetUserDefaultUILanguage
GetLocaleInfoEx
GetSystemDefaultUILanguage
SearchPathW
LoadResource
GetTickCount
GetSystemTimeAsFileTime
FreeLibrary
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
CreateFileMappingW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
Sleep
IsWow64Process
GetCurrentThreadId
GetStartupInfoW
SetConsoleTitleW
FindFirstFileW
MapViewOfFile
GetFileType
CompareStringW
VerifyVersionInfoW
SetLastError
LoadLibraryExW
GetCurrentProcess
GetStdHandle
WriteFile
GetModuleHandleW
ExpandEnvironmentStringsW
GetModuleHandleExW
GetCurrentProcessId
VerSetConditionMask
GetModuleFileNameW
SetThreadUILanguage
K32GetModuleFileNameExW
GetProcAddress
SetErrorMode
FindClose
CreateFileW
GetFileAttributesW
OpenProcess
CreateToolhelp32Snapshot
WakeAllConditionVariable
FormatMessageW
LocalFree
WriteConsoleW
GetLastError
Process32NextW
Process32FirstW
CloseHandle

oleaut32

SysAllocString
SysFreeString
SafeArrayCreate
SafeArrayPutElement
SysStringLen
VariantClear

advapi32

EventRegister
RegEnumKeyExW
RegOpenKeyExW
RegGetValueW
EventUnregister
EventWriteTransfer
RegCloseKey
RegQueryValueExW
EventSetInformation

ole32

PropVariantClear
CoTaskMemAlloc
CoInitializeEx
CoUninitialize
CoCreateInstance
CoInitialize

user32

LoadStringW

mscoree

CorBindToRuntimeEx

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 352KB - Virtual size: 351KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/powershell.exe.config
WindowsPowerShell/v1.0/powershell_ise.exe
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

powershell_ise.pdb

Sections

.text
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 138KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/powershell_ise.exe.config
.xml
WindowsPowerShell/v1.0/pspluginwkr.dll
.dll windows:6 windows x64 arch:x64

36f7ca9a5caab24901fb951dfddee8fc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

pspluginwkr.pdb

Imports

msvcrt

isleadbyte
__pioinfo
_iob
??0exception@@QEAA@AEBV0@@Z
memset
_callnewh
?terminate@@YAXXZ
abort
??0exception@@QEAA@AEBQEBDH@Z
memmove
_cexit
wcsncmp
??2@YAPEAX_K@Z
_CxxThrowException
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
_wcsicmp
_wcsnicmp
_vsnwprintf
bsearch
??1type_info@@UEAA@XZ
??3@YAXPEAX@Z
__C_specific_handler
_amsg_exit
free
_initterm
malloc
_XcptFilter
_errno
?what@exception@@UEBAPEBDXZ
__badioinfo
_snprintf
_itoa
wctomb
_lseeki64
_write
_isatty
_fileno
memcpy

kernel32

LoadLibraryExW
LoadResource
FreeLibrary
FindResourceExW
GetSystemDefaultUILanguage
UnmapViewOfFile
MapViewOfFile
SearchPathW
UnregisterWaitEx
FormatMessageW
LocalFree
Sleep
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlPcToFileHeader
GetLocaleInfoW
GetVersionExW
CreateFileW
CreateFileMappingW
GetUserDefaultUILanguage
CloseHandle
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RtlCaptureContext
RtlVirtualUnwind
OutputDebugStringA
GetLastError
GetVersion
SetLastError
VirtualQuery
RtlLookupFunctionEntry
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
RegisterWaitForSingleObject

mscoree

CorBindToRuntimeEx
_CorDllMain

ole32

CoCreateInstance

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
EventWriteTransfer
EventWrite
EventUnregister
EventRegister
EventActivityIdControl

wsmsvc

WSManPluginOperationComplete
WSManPluginReceiveResult
WSManPluginGetOperationParameters
WSManPluginReportContext

Exports

Exports

InitPlugin
WSManPluginCommand
WSManPluginReceive
WSManPluginReleaseCommandContext
WSManPluginReleaseShellContext
WSManPluginSend
WSManPluginShell
WSManPluginSignal

Sections

.text
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.nep
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/pwrshmsg.dll
.dll windows:10 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.rdata
Size: 4KB - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
WindowsPowerShell/v1.0/types.ps1xml
.ps1
WindowsPowerShell/v1.0/typesv3.ps1xml

Resubmissions

Sharing

General

Malware Config

Signatures

Files

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 6KB - Virtual size: 5KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

Code Sign

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

c4:41:48:8b:63:1d:66:3d:37:64:3b:90:31:91:e5:48:1a:78:0b:8c:1e:cd:f0:f7:16:9b:a1:9c:b8:43:2c:6bSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Sections

.text Size: 96KB - Virtual size: 95KB

.rsrc Size: 1KB - Virtual size: 1KB

9fb037108fd4ea47f152d0ea1614b70e

Code Sign

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

1e:a9:93:df:0c:0b:5f:b9:80:c4:87:13:86:b6:88:ae:6d:d5:87:61:03:be:24:43:50:98:90:e4:1d:4e:be:1aSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp_win

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

advapi32

kernel32

normaliz

oleaut32

wininet

ole32

mscoree

Sections

.text Size: 188KB - Virtual size: 187KB

.nep Size: 4KB - Virtual size: 1024B

.rdata Size: 472KB - Virtual size: 470KB

.data Size: 8KB - Virtual size: 27KB

.pdata Size: 4KB - Virtual size: 3KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 6KB

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

b9:1c:d9:e3:5f:ea:0d:0f:36:44:a3:65:85:88:d7:5c:2b:62:b5:2e:e7:c0:bd:18:93:04:ad:c6:16:ce:f5:2dSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 158KB - Virtual size: 157KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Headers

.text
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

c4:41:48:8b:63:1d:66:3d:37:64:3b:90:31:91:e5:48:1a:78:0b:8c:1e:cd:f0:f7:16:9b:a1:9c:b8:43:2c:6b
Signer

.text
Size: 96KB - Virtual size: 95KB

.rsrc
Size: 1KB - Virtual size: 1KB

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

1e:a9:93:df:0c:0b:5f:b9:80:c4:87:13:86:b6:88:ae:6d:d5:87:61:03:be:24:43:50:98:90:e4:1d:4e:be:1a
Signer

.text
Size: 188KB - Virtual size: 187KB

.nep
Size: 4KB - Virtual size: 1024B

.rdata
Size: 472KB - Virtual size: 470KB

.data
Size: 8KB - Virtual size: 27KB

.pdata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 6KB

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

b9:1c:d9:e3:5f:ea:0d:0f:36:44:a3:65:85:88:d7:5c:2b:62:b5:2e:e7:c0:bd:18:93:04:ad:c6:16:ce:f5:2d
Signer

.text
Size: 158KB - Virtual size: 157KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 19KB - Virtual size: 18KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 9KB - Virtual size: 8KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

ec:da:49:50:07:71:56:c3:17:f1:35:ec:1f:cd:cb:4b:78:8f:be:b0:22:a4:ac:06:73:2c:82:12:0b:ea:ba:21
Signer

.text
Size: 52KB - Virtual size: 51KB

.nep
Size: 4KB - Virtual size: 256B

.rdata
Size: 76KB - Virtual size: 72KB

.data
Size: 4KB - Virtual size: 6KB

.pdata
Size: 4KB - Virtual size: 528B

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 84B