MPSSVC.pdb
Overview
overview
10Static
static
3x64_x32_setup.zip
windows7-x64
1x64_x32_setup.zip
windows10-2004-x64
10NcaApi/MPSSVC.dll
windows10-2004-x64
1NcaApi/NcaApi.dll
windows10-2004-x64
1NcaApi/msimg32.dll
windows10-2004-x64
1appmgr/appmgr.dll
windows10-2004-x64
1appmgr/appraiser.dll
windows10-2004-x64
1appmgr/miutils.dll
windows10-2004-x64
1profext/drvstore.dll
windows10-2004-x64
1profext/profext.dll
windows10-2004-x64
1profext/sysclass.dll
windows10-2004-x64
1setup.msi
windows7-x64
6setup.msi
windows10-2004-x64
10Static task
static1
Behavioral task
behavioral1
Sample
x64_x32_setup.zip
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
x64_x32_setup.zip
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
NcaApi/MPSSVC.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
NcaApi/NcaApi.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
NcaApi/msimg32.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral6
Sample
appmgr/appmgr.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
appmgr/appraiser.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral8
Sample
appmgr/miutils.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
profext/drvstore.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral10
Sample
profext/profext.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
profext/sysclass.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral12
Sample
setup.msi
Resource
win7-20240508-en
Behavioral task
behavioral13
Sample
setup.msi
Resource
win10v2004-20240426-en
General
-
Target
x64_x32_setup.zip
-
Size
6.8MB
-
MD5
c5866430af972bee963aa63523591239
-
SHA1
77b46de2f47e3ec1a0467c4bb5221ce7e6d40fae
-
SHA256
890900a5c7bf54a9d0b7cc04568bd0b3f85dc9f747608bbe014ea84430beb3fb
-
SHA512
c504fe54ef47f963ee87f8f2d7f5298552d6165c6fdd8f32f56deee696ac59fef68ab7f31ba72e1d54af74d14b0dda1ef8e73fdd6f3199abc12bde4f733e4fd7
-
SSDEEP
196608:y+7jQ7b4+FOgataC2EFohJC7DNZsQNzUmgZ:bXQH92N2EFoQ3skc
Malware Config
Signatures
-
Unsigned PE 6 IoCs
Checks for missing Authenticode signature.
resource unpack001/NcaApi/MPSSVC.dll unpack001/NcaApi/NcaApi.dll unpack001/NcaApi/msimg32.dll unpack001/appmgr/appmgr.dll unpack001/appmgr/miutils.dll unpack001/profext/sysclass.dll
Files
-
x64_x32_setup.zip.zip
Password: 2024
-
NcaApi/MPSSVC.dll.dll windows:10 windows x64 arch:x64
Password: 2024
996b80851b6d5ad091ddcf74d0e5d48f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
islower
abort
wcscpy_s
memset
_ultow_s
_wcsdup
_onexit
__dllonexit
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_initterm
_amsg_exit
_ismbblead
_CxxThrowException
_XcptFilter
bsearch
memcmp
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
_vsnwprintf
_wsetlocale
__crtLCMapStringA
??0exception@@QEAA@AEBV0@@Z
___mb_cur_max_func
calloc
___lc_codepage_func
___lc_handle_func
isupper
__pctype_func
__uncaught_exception
memmove
wcscat_s
_wcsnicmp
__CxxFrameHandler3
??1bad_cast@@UEAA@XZ
memcpy
setlocale
_unlock
_lock
toupper
wcschr
towupper
??0bad_cast@@QEAA@PEBD@Z
wcstok
wcstok_s
_wcsicmp
wcspbrk
wcsstr
_wcslwr_s
wcsncmp
iswspace
towlower
wcsnlen
iswdigit
wcscmp
??0bad_cast@@QEAA@AEBV0@@Z
qsort
_vsnprintf
memcpy_s
__C_specific_handler
strcspn
sprintf_s
memmove_s
_vsnprintf_s
localeconv
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@XZ
_purecall
??0exception@@QEAA@AEBQEBDH@Z
malloc
free
_callnewh
ntdll
RtlNtStatusToDosErrorNoTeb
RtlCreateServiceSid
RtlCompareUnicodeString
RtlAllocateHeap
RtlInitUnicodeString
RtlFreeHeap
NtQuerySecurityAttributesToken
RtlIsPackageSid
RtlIpv4AddressToStringW
RtlIsStateSeparationEnabled
RtlIpv6AddressToStringW
EtwEventEnabled
RtlQueryPackageIdentity
RtlNtStatusToDosError
RtlCopySid
RtlLengthSid
RtlIsCapabilitySid
RtlValidSid
RtlIpv6AddressToStringA
RtlEqualSid
RtlGetAppContainerSidType
DbgPrint
RtlIpv4AddressToStringA
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlPublishWnfStateData
RtlSubscribeWnfStateChangeNotification
WinSqmAddToStream
RtlGetActiveConsoleId
NtQueryInformationProcess
EtwEventWrite
EtwTraceMessage
EtwEventRegister
EtwEventUnregister
EtwUnregisterTraceGuids
EtwGetTraceEnableFlags
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwRegisterTraceGuidsW
RtlIsParentOfChildAppContainer
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventRegister
EventSetInformation
EventUnregister
EventProviderEnabled
api-ms-win-core-synch-l1-1-0
OpenSemaphoreW
InitializeCriticalSection
CreateEventW
ReleaseSRWLockShared
ResetEvent
SetWaitableTimer
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
InitializeSRWLock
WaitForMultipleObjectsEx
CreateSemaphoreExW
DeleteCriticalSection
ReleaseMutex
EnterCriticalSection
ReleaseSemaphore
AcquireSRWLockShared
CreateMutexExW
CreateEventA
WaitForSingleObject
LeaveCriticalSection
InitializeCriticalSectionEx
SetEvent
CreateMutexW
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
ReleaseSRWLockExclusive
CreateWaitableTimerExW
api-ms-win-core-errorhandling-l1-1-0
SetLastError
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CloseThreadpoolIo
CloseThreadpoolTimer
CreateThreadpoolWork
StartThreadpoolIo
WaitForThreadpoolIoCallbacks
SubmitThreadpoolWork
WaitForThreadpoolTimerCallbacks
WaitForThreadpoolWorkCallbacks
CreateThreadpoolIo
CancelThreadpoolIo
CloseThreadpoolWork
CreateThreadpoolTimer
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-processthreads-l1-1-0
ResumeThread
OpenThreadToken
CreateProcessAsUserW
GetCurrentProcess
OpenProcessToken
TerminateThread
QueueUserAPC
GetCurrentThread
GetCurrentProcessId
CreateThread
GetCurrentThreadId
TerminateProcess
api-ms-win-core-sysinfo-l1-1-0
GetVersionExW
GetLocalTime
GetSystemTimeAsFileTime
GetTickCount64
GetTickCount
api-ms-win-core-threadpool-private-l1-1-0
RegisterWaitForSingleObjectEx
api-ms-win-core-threadpool-legacy-l1-1-0
UnregisterWaitEx
CreateTimerQueue
CreateTimerQueueTimer
DeleteTimerQueueTimer
DeleteTimerQueueEx
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
FreeLibrary
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameA
LoadStringW
GetModuleHandleExW
api-ms-win-security-base-l1-1-0
IsValidSecurityDescriptor
CheckTokenMembership
IsValidSid
GetSecurityDescriptorControl
AllocateAndInitializeSid
SetFileSecurityW
GetLengthSid
CreateWellKnownSid
AddAccessAllowedAce
SetSecurityDescriptorGroup
FreeSid
GetSecurityDescriptorLength
AccessCheck
SetSecurityDescriptorOwner
InitializeSecurityDescriptor
MakeSelfRelativeSD
SetSecurityDescriptorDacl
DuplicateTokenEx
AdjustTokenPrivileges
EqualSid
InitializeAcl
sspicli
LsaRegisterPolicyChangeNotification
LsaUnregisterPolicyChangeNotification
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiA
lstrcmpiW
api-ms-win-core-shlwapi-legacy-l1-1-0
PathIsRelativeW
PathRemoveFileSpecW
PathFindFileNameW
PathFileExistsW
api-ms-win-core-file-l1-1-0
GetFileSize
FileTimeToLocalFileTime
FindClose
FindFirstFileW
FindNextFileW
GetLogicalDriveStringsW
QueryDosDeviceW
GetFileAttributesW
CreateFileW
SetEndOfFile
GetFileType
WriteFile
SetFilePointerEx
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegOpenCurrentUser
RegEnumKeyExW
RegQueryValueExW
RegOpenKeyExW
RegNotifyChangeKeyValue
RegCloseKey
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
HeapReAlloc
api-ms-win-devices-config-l1-1-1
CM_Open_Class_KeyW
api-ms-win-core-synch-l1-2-0
WakeAllConditionVariable
InitOnceComplete
SleepConditionVariableSRW
InitOnceBeginInitialize
Sleep
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
CompareStringW
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-eventing-controller-l1-1-0
EnableTraceEx2
ControlTraceW
StartTraceW
api-ms-win-eventing-consumer-l1-1-0
OpenTraceW
ProcessTrace
CloseTrace
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
api-ms-win-eventing-obsolete-l1-1-0
RemoveTraceCallback
rpcrt4
RpcEpUnregister
RpcBindingVectorFree
RpcServerInqBindings
RpcBindingInqAuthClientW
RpcStringBindingParseW
RpcRevertToSelf
RpcServerUnregisterIfEx
UuidCreate
I_RpcBindingIsClientLocal
RpcEpRegisterW
RpcImpersonateClient
NdrServerCall2
RpcAsyncCompleteCall
RpcAsyncAbortCall
NdrAsyncServerCall
NdrServerCallAll
Ndr64AsyncServerCallAll
RpcServerInqDefaultPrincNameW
RpcServerRegisterAuthInfoW
RpcStringFreeW
RpcServerUseProtseqW
RpcServerRegisterIf3
RpcBindingToStringBindingW
api-ms-win-core-file-l2-1-0
CopyFileExW
api-ms-win-core-memory-l1-1-0
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-security-grouppolicy-l1-1-0
RegisterGPNotificationInternal
UnregisterGPNotificationInternal
api-ms-win-core-io-l1-1-1
CancelIo
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-security-base-l1-2-0
CheckTokenCapability
dnsapi
DnsSetNrptRules
DnsGetNrptRuleNamesList
DnsRemoveNrptRule
DnsFreeNrptRuleNamesList
DnsGetProxyInformation
DnsFreeProxyName
api-ms-win-core-string-l2-1-0
CharLowerBuffW
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-rtlsupport-l1-1-0
RtlCompareMemory
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
fwpuclnt
FwpmIPsecTunnelDeleteByKey0
FwpmIPsecTunnelAdd2
FwpmIPsecTunnelAddConditions0
FwpmSubLayerAdd0
FwpmProviderContextDeleteByKey0
FwpmProviderAdd0
FwpmProviderContextAdd3
FwpmFilterAdd0
FwpmBitmapIndexFree0
FwpmCalloutAdd0
FwpmTransactionAbort0
FwpmFilterDeleteById0
FwpmFilterDeleteByKey0
FwpmTransactionBegin0
FwpmProviderContextAdd0
FwpmTransactionCommit0
FwpmProviderContextDeleteById0
FwpmBitmapIndexGet0
FwpmFilterDestroyEnumHandle0
FwpmFilterEnum0
FwppGetMD5HashBytes
FwpmNetEventDestroyEnumHandle0
FwpmNetEventEnum5
FwpmNetEventCreateEnumHandle0
IkeextSaDestroyEnumHandle0
IkeextSaCreateEnumHandle0
IPsecSaContextDestroyEnumHandle0
FwpmFreeMemory0
IkeextSaEnum2
IPsecSaContextEnum0
IPsecSaContextDeleteById0
IkeextSaDeleteById0
IPsecSaContextCreateEnumHandle0
FwpmEventProviderDestroy0
FwpmNetEventUnsubscribe0
FwpmEventProviderIsNetEventTypeEnabled0
FwpmNetEventSubscribe4
FwpmEventProviderCreate0
FwpmEventProviderFireNetEvent0
FwpmFilterUnsubscribeChanges0
FwpmFilterSubscribeChanges0
FwpmEngineClose0
FwpmEngineSetOption0
FwpmEngineOpen0
FwpiExpandCriteria0
FwpmFilterCreateEnumHandle0
FwpiFreeCriteria0
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
Exports
Exports
ServiceMain
SvchostPushServiceGlobals
Sections
.text Size: 754KB - Virtual size: 753KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 243KB - Virtual size: 243KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
NcaApi/NcaApi.dll.dll windows:10 windows x64 arch:x64
Password: 2024
2e4b626bfcc4585f71fa8c79a540843b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
NcaApi.pdb
Imports
msvcrt
_initterm
malloc
free
_amsg_exit
_XcptFilter
__C_specific_handler
memset
ntdll
EtwTraceMessage
EtwGetTraceLoggerHandle
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
rpcrt4
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcBindingSetAuthInfoExW
Ndr64AsyncClientCall
RpcAsyncCompleteCall
RpcBindingSetOption
RpcBindingFree
RpcStringFreeW
RpcAsyncInitializeHandle
NdrClientCall3
kernel32
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
SetUnhandledExceptionFilter
Sleep
GetCurrentProcess
QueryPerformanceCounter
SetThreadpoolWait
CloseHandle
HeapFree
GetProcessHeap
HeapAlloc
SetLastError
CreateThreadpoolWait
CreateEventW
CloseThreadpoolWait
GetLastError
DisableThreadLibraryCalls
TerminateProcess
api-ms-win-security-base-l1-1-0
CreateWellKnownSid
api-ms-win-security-lsalookup-l1-1-0
LookupAccountSidLocalW
Exports
Exports
DllMain
NcaEngineClose
NcaEngineOpen
NcaExecuteAndCaptureLogs
NcaGetConfig
NcaGetEvidenceCollectorResult
NcaNetworkClose
NcaNetworkOpen
NcaStatusEventSubscribe
NcaStatusEventUnsubscribe
NcaToggleNamePreferenceState
Sections
.text Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 612B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
NcaApi/msimg32.dll.dll windows:10 windows x64 arch:x64
Password: 2024
b7ef9630c9e2eaa54d80cf5332520503
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
msimg32.pdb
Imports
ntdll
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
gdi32
GetDeviceCaps
GetCurrentObject
GetObjectType
GdiAlphaBlend
GdiTransparentBlt
GdiGradientFill
GetObjectA
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
FreeLibrary
api-ms-win-core-sysinfo-l1-1-0
GetVersionExA
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
Exports
Exports
AlphaBlend
DllInitialize
GradientFill
TransparentBlt
vSetDdrawflag
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 992B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
appmgr/appmgr.dll.dll windows:10 windows x64 arch:x64
Password: 2024
da6c88f24c22dd504b55ef75682a015d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
appmgr.pdb
Imports
mfc42u
ord3366
ord3231
ord4815
ord3362
ord3243
ord3049
ord5699
ord2140
ord2457
ord5683
ord1736
ord5484
ord3933
ord6814
ord2060
ord2670
ord4789
ord5229
ord4017
ord5702
ord4694
ord5586
ord2399
ord5663
ord4752
ord1777
ord4365
ord6437
ord2517
ord5406
ord4721
ord5687
ord2328
ord6021
ord6632
ord4473
ord1124
ord4436
ord1286
ord4601
ord1906
ord549
ord999
ord1774
ord6801
ord2425
ord2024
ord4543
ord2592
ord6440
ord1778
ord4746
ord5712
ord3535
ord4770
ord3805
ord1067
ord665
ord911
ord2329
ord4582
ord6418
ord4699
ord5227
ord5709
ord5246
ord4722
ord5352
ord5382
ord5114
ord5304
ord5583
ord5585
ord5584
ord4548
ord4131
ord2846
ord6614
ord1264
ord2845
ord287
ord622
ord3052
ord2665
ord6328
ord2311
ord6147
ord3437
ord621
ord2781
ord6705
ord6642
ord6641
ord4521
ord2783
ord2629
ord4523
ord2593
ord4747
ord3501
ord3806
ord912
ord4257
ord1262
ord4262
ord6395
ord6385
ord3396
ord3740
ord2408
ord2427
ord1574
ord286
ord3830
ord3790
ord1441
ord1647
ord640
ord2849
ord6708
ord1566
ord1562
ord659
ord1063
ord4214
ord2752
ord1426
ord3916
ord4983
ord3534
ord6053
ord5711
ord5730
ord5065
ord4368
ord5724
ord5722
ord3468
ord2412
ord5615
ord1388
ord4191
ord6071
ord2515
ord2559
ord4836
ord6813
ord3868
ord1082
ord288
ord812
ord1544
ord1586
ord1555
ord1583
ord1585
ord355
ord1477
ord1553
ord1416
ord1491
ord1577
ord1463
ord3166
ord3046
ord4082
ord4083
ord4077
ord3164
ord4371
ord4988
ord4771
ord3761
ord620
ord6886
ord6812
ord6767
ord1284
ord1287
ord624
ord4027
ord5245
ord6351
ord2906
ord2661
ord4519
ord2898
ord3177
ord5077
ord1122
ord4557
ord2384
ord2371
ord1126
ord1040
ord626
ord852
ord337
ord4860
ord6887
msvcrt
__dllonexit
_onexit
_errno
_unlock
realloc
memset
memcpy
_lock
??1type_info@@UEAA@XZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
??0exception@@QEAA@AEBQEBDH@Z
free
malloc
wcsncpy_s
wcsrchr
_wfopen
_purecall
fclose
fgetws
rewind
_fileno
_setmode
tmpfile
fwprintf
swscanf
wcsncmp
__C_specific_handler
_vsnwprintf
??0exception@@QEAA@XZ
memmove_s
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
memcpy_s
??0exception@@QEAA@AEBV0@@Z
_wcsnicmp
_wcsicmp
__CxxFrameHandler3
_callnewh
wcscmp
oleaut32
VarUI4FromStr
SysAllocString
VariantInit
SysFreeString
SysAllocStringLen
SysStringLen
VariantClear
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoCreateInstance
CoCreateGuid
StringFromGUID2
CreateStreamOnHGlobal
CoSetProxyBlanket
CoTaskMemRealloc
CLSIDFromString
CoTaskMemAlloc
api-ms-win-core-heap-l2-1-0
LocalFree
GlobalFree
LocalAlloc
GlobalAlloc
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetLocaleInfoW
api-ms-win-core-libraryloader-l1-2-0
FindResourceExW
LoadLibraryExW
GetModuleHandleW
LoadResource
GetModuleHandleExW
GetProcAddress
SizeofResource
LoadStringW
FreeLibrary
GetModuleFileNameW
api-ms-win-core-registry-l1-1-0
RegDeleteValueW
RegCloseKey
RegOpenKeyExW
RegQueryValueExA
RegQueryValueExW
RegSetValueExW
RegEnumKeyExW
RegOpenKeyExA
RegCreateKeyExW
RegQueryInfoKeyW
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError
RaiseException
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
OutputDebugStringA
api-ms-win-core-file-l1-1-0
FindFirstFileW
FindClose
WriteFile
GetTempFileNameW
DeleteFileW
SetFilePointer
CreateFileW
CreateDirectoryW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-string-l1-1-0
CompareStringW
MultiByteToWideChar
logoncli
DsGetDcNameW
netutils
NetApiBufferFree
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
InitializeCriticalSection
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
ReleaseSRWLockExclusive
api-ms-win-security-base-l1-1-0
IsValidSecurityDescriptor
GetSecurityDescriptorLength
MapGenericMask
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
GetSystemTime
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
mpr
WNetGetUniversalNameW
api-ms-win-core-file-l1-2-0
GetTempPathW
api-ms-win-core-file-l2-1-2
CopyFileW
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-synch-l1-2-0
Sleep
WakeAllConditionVariable
SleepConditionVariableSRW
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
aclui
ord1
advapi32
OpenEventLogW
ReportEventW
CloseEventLog
RegOpenKeyW
appmgmts
CsGetClassStorePath
CsGetClassStore
CsRegisterAppCategory
CsUnregisterAppCategory
CsGetAppCategories
ReleasePackageDetail
ReleasePackageInfo
CsCreateClassStore
CsServerGetClassStore
CsSetOptions
framedynos
??4WBEMTime@@QEAAAEBV0@QEAG@Z
?GetFILETIME@WBEMTime@@QEBAHPEAU_FILETIME@@@Z
gdi32
GetTextExtentPoint32W
gpedit
BrowseForGPO
kernel32
DeactivateActCtx
ActivateActCtx
FindActCtxSectionStringW
CreateActCtxW
QueryActCtxW
GetPrivateProfileStringW
MoveFileW
lstrcmpiW
ReleaseActCtx
LoadLibraryExA
ExpandEnvironmentStringsA
msi
ord92
ord228
ord158
ord141
ord165
ord8
ord118
ord116
ord160
ord32
ord159
ord78
ord150
ord19
ole32
CoInitialize
CoUninitialize
shell32
SHGetMalloc
SHGetSpecialFolderLocation
ShellExecuteExW
SHBrowseForFolderW
SHGetPathFromIDListW
DragQueryFileW
user32
RegisterClipboardFormatW
LoadCursorW
SetCursor
LoadImageW
LoadBitmapW
MessageBoxW
GetActiveWindow
GetClientRect
SetWindowsHookExW
EnableWindow
GetFocus
ReleaseDC
GetDC
SendMessageW
GetParent
UnhookWindowsHookEx
CallNextHookEx
UnregisterClassA
Exports
Exports
DllCanUnloadNow
DllGetClassObject
GenerateScript
Sections
.text Size: 238KB - Virtual size: 238KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 120KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 79KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
appmgr/appraiser.dll.dll windows:10 windows x64 arch:x64
Password: 2024
9540ad858afe7a06078d74ce76f85b3f
Code Sign
33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3cCertificate
IssuerCN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before02/09/2021, 18:23Not After01/09/2022, 18:23SubjectCN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
61:07:76:56:00:00:00:00:00:08Certificate
IssuerCN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before19/10/2011, 18:41Not After19/10/2026, 18:51SubjectCN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
c6:07:44:c0:55:48:ba:af:56:99:dd:06:47:00:13:fa:90:d7:6d:87:f6:49:4b:92:c8:0c:ad:fe:a8:b1:bc:d9Signer
Actual PE Digestc6:07:44:c0:55:48:ba:af:56:99:dd:06:47:00:13:fa:90:d7:6d:87:f6:49:4b:92:c8:0c:ad:fe:a8:b1:bc:d9Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Appraiser.pdb
Imports
msvcrt
memcmp
_wcslwr_s
wcstoul
_strnicmp
swscanf_s
_stricmp
strtok_s
_wcstoui64
_wtol
_wtoi64
_wtoi
wcstok_s
rand_s
_wmkdir
??_V@YAXPEAX@Z
strrchr
_set_errno
strtol
_errno
strncpy_s
strncmp
toupper
wcsncmp
wcsstr
_wcslwr
wcscat_s
wcscpy_s
_wcsnicmp
strchr
strcpy_s
_vsnprintf
_wcsicmp
_wsetlocale
__crtLCMapStringW
_wcsdup
memset
abort
_ismbblead
___mb_cur_max_func
__uncaught_exception
calloc
___lc_codepage_func
___lc_handle_func
__pctype_func
setlocale
??3@YAXPEAX@Z
strcspn
wcsrchr
localeconv
strcmp
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
__C_specific_handler
_initterm
free
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_get_osfhandle
_wopen
_read
_close
_write
_lseek
iswalpha
wcsspn
qsort
swprintf_s
_ultow_s
_vsnwprintf_s
wcsnlen
_wcsupr
_snwscanf_s
towlower
strstr
strnlen
_wtof
_wsplitpath_s
??0bad_cast@@QEAA@AEBV0@@Z
??1bad_cast@@UEAA@XZ
??0bad_cast@@QEAA@PEBD@Z
wcschr
_purecall
_callnewh
malloc
sprintf_s
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
memcpy_s
_vsnwprintf
__CxxFrameHandler3
wcscmp
ntdll
RtlRunOnceExecuteOnce
NtWriteFile
NtClose
RtlDoesFileExists_U
NtOpenKey
RtlCopyUnicodeString
ZwQueryKey
ZwSetValueKey
ZwWaitForSingleObject
ZwReleaseMutant
ZwOpenMutant
ZwQueryAttributesFile
RtlLengthSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlSetDaclSecurityDescriptor
ZwLoadKey
RtlAddAccessAllowedAceEx
RtlLengthSid
ZwDeleteValueKey
RtlCreateAcl
ZwSetSecurityObject
ZwUnloadKey
RtlCreateSecurityDescriptor
NtQueryKey
LdrGetDllHandle
ZwOpenProcess
NtQuerySystemInformation
ZwQuerySymbolicLinkObject
ZwDeviceIoControlFile
ZwQueryDirectoryObject
ZwOpenSymbolicLinkObject
ZwOpenDirectoryObject
ZwAllocateUuids
NtAdjustPrivilegesToken
NtOpenProcessTokenEx
NtSetInformationThread
NtOpenThreadTokenEx
RtlImpersonateSelf
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject
NtDeviceIoControlFile
NtOpenFile
NtQueryValueKey
NtQueryBootEntryOrder
NtQueryBootOptions
NtTranslateFilePath
NtOpenDirectoryObject
NtQueryDirectoryObject
NtEnumerateBootEntries
RtlTimeToSecondsSince1970
NtQuerySystemTime
RtlFreeSid
RtlAllocateAndInitializeSid
RtlNtStatusToDosError
RtlStringFromGUID
LdrGetProcedureAddress
WinSqmIsOptedInEx
NtQueryInformationProcess
RtlCompareMemory
NtSetInformationProcess
RtlGetVersion
RtlImageDirectoryEntryToData
VerSetConditionMask
RtlCaptureContext
RtlLookupFunctionEntry
EtwTraceMessage
NtEnumerateValueKey
NtEnumerateKey
RtlVirtualUnwind
RtlVerifyVersionInfo
LdrResSearchResource
NtQueryLicenseValue
RtlTimeToTimeFields
ZwMapViewOfSection
ZwUnmapViewOfSection
ZwQuerySystemInformation
RtlGetNativeSystemInformation
RtlNtPathNameToDosPathName
RtlpEnsureBufferSize
ZwQueryDirectoryFile
RtlUpcaseUnicodeChar
RtlUnicodeStringToAnsiString
RtlUpcaseUnicodeString
RtlAnsiStringToUnicodeString
RtlxAnsiStringToUnicodeSize
RtlInitString
RtlGUIDFromString
EtwEventRegister
EtwEventWrite
EtwEventUnregister
RtlSecondsSince1970ToTime
ZwSetInformationProcess
ZwQueryInformationProcess
ZwCreateSection
ZwQueryInformationFile
ZwCreateFile
ZwCreateKey
RtlFormatCurrentUserKeyPath
RtlAppendUnicodeToString
RtlAppendUnicodeStringToString
ZwQueryValueKey
ZwDeleteKey
RtlInitUnicodeStringEx
ZwEnumerateKey
ZwOpenKey
RtlFreeUnicodeString
ZwOpenFile
RtlInitUnicodeString
RtlDosPathNameToNtPathName_U_WithStatus
ZwClose
RtlLeaveCriticalSection
RtlFreeHeap
RtlInitializeCriticalSection
RtlMultiByteToUnicodeN
RtlInitAnsiString
RtlEnterCriticalSection
RtlReAllocateHeap
RtlEqualString
RtlAllocateHeap
RtlDeleteCriticalSection
rpcrt4
UuidFromStringW
RpcStringFreeW
UuidToStringW
UuidCreate
wdscore
ConstructPartialMsgVW
CurrentIP
WdsSetupLogMessageW
WdsSetupLogMessageA
ConstructPartialMsgVA
kernel32
WriteFile
ExpandEnvironmentStringsW
OutputDebugStringA
GetModuleFileNameW
CreateFileW
GetModuleHandleExA
WakeAllConditionVariable
SleepConditionVariableSRW
FileTimeToSystemTime
CreateProcessW
LocalFree
GetCurrentThread
GetLastError
LoadLibraryExW
EnumUILanguagesW
GetSystemTime
DeleteCriticalSection
InitializeCriticalSectionEx
GetDiskFreeSpaceExW
CreateThreadpoolWork
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
CloseThreadpoolWork
GetActiveProcessorCount
FindFirstFileW
DeleteFileW
FindNextFileW
FindClose
IsDebuggerPresent
GetFileSize
ReadFile
GetFullPathNameW
VirtualFree
FindResourceW
LoadResource
SizeofResource
LockResource
FlushInstructionCache
OutputDebugStringW
GetTickCount
ExitProcess
GlobalFree
GetSystemTimeAsFileTime
GetCurrentProcessId
IsWow64Process
VirtualProtect
QueryPerformanceCounter
CreateEventW
QueryFullProcessImageNameW
VirtualAlloc
GetFileAttributesW
TerminateProcess
GetCurrentProcess
WTSGetActiveConsoleSessionId
SetThreadAffinityMask
IsProcessorFeaturePresent
PostQueuedCompletionStatus
SystemTimeToFileTime
GetPrivateProfileStringW
GetPrivateProfileSectionW
InitOnceExecuteOnce
RaiseException
ResumeThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateSemaphoreExW
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
CreateDirectoryW
SetUnhandledExceptionFilter
WaitForMultipleObjects
SetEvent
ResetEvent
CopyFileW
SetLastError
UnhandledExceptionFilter
Sleep
HeapReAlloc
TryEnterCriticalSection
CreateThread
GetProductInfo
GetNativeSystemInfo
MoveFileExW
OpenProcess
SetPriorityClass
GetSystemPowerStatus
CloseHandle
AssignProcessToJobObject
TerminateThread
WideCharToMultiByte
VerifyVersionInfoW
SetInformationJobObject
LoadLibraryW
FreeLibrary
DebugBreak
GetSystemDirectoryW
GetModuleHandleW
GetProcessHeap
GetProcAddress
HeapAlloc
FormatMessageW
CreateJobObjectW
GetCurrentThreadId
CreateIoCompletionPort
GetQueuedCompletionStatus
GetTempPathW
GetModuleHandleExW
HeapFree
GetModuleFileNameA
GetSystemWindowsDirectoryW
AcquireSRWLockExclusive
GetFileSizeEx
CreateMutexW
SetFileTime
SetFileAttributesW
CreateEventExW
MultiByteToWideChar
GetSystemFirmwareTable
DeviceIoControl
ReleaseSRWLockExclusive
LoadLibraryExA
CreateActCtxW
GetStringTypeW
EncodePointer
DecodePointer
QueryActCtxW
ReleaseActCtx
UnlockFileEx
LockFileEx
FlushFileBuffers
GetFileInformationByHandle
LocalFileTimeToFileTime
CreateSemaphoreW
OpenWaitableTimerW
CreateWaitableTimerW
SetWaitableTimer
SetFilePointer
GetComputerNameW
WaitForSingleObject
GetVolumeInformationByHandleW
GetDriveTypeW
GetLongPathNameW
DelayLoadFailureHook
DosDateTimeToFileTime
LocalAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFileTime
advapi32
ImpersonateLoggedOnUser
ControlService
RegEnumKeyW
RegLoadAppKeyW
ConvertSidToStringSidW
RegDeleteValueW
RegEnumKeyExW
ControlTraceW
RegQueryInfoKeyW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
EventWriteTransfer
StartTraceW
OpenTraceW
EnableTrace
CloseTrace
ProcessTrace
OpenSCManagerW
OpenServiceW
CloseServiceHandle
StartServiceW
CryptDestroyHash
CryptReleaseContext
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RevertToSelf
SetNamedSecurityInfoW
EventRegister
EventUnregister
SetEntriesInAclW
GetNamedSecurityInfoW
RegDeleteTreeW
RegGetValueW
RegCreateKeyTransactedW
RegEnumValueW
IsWellKnownSid
CopySid
LookupAccountNameW
ConvertStringSidToSidW
CreateWellKnownSid
RegQueryValueExW
CredFree
CredReadW
ole32
StringFromCLSID
CoWaitForMultipleHandles
StringFromGUID2
CoCreateGuid
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc
CoInitializeEx
CoCreateInstance
shlwapi
PathRemoveFileSpecW
PathFindExtensionW
PathUnquoteSpacesW
PathAppendW
PathStripPathW
StrStrW
UrlGetPartW
PathFindFileNameW
PathFileExistsW
SHCreateStreamOnFileEx
PathRemoveBlanksW
ord219
oleaut32
SysFreeString
VariantInit
VariantClear
SysStringLen
SysAllocString
user32
CharLowerBuffW
PeekMessageW
GetSystemMetrics
TranslateMessage
DestroyIcon
DispatchMessageW
CharUpperBuffW
MsgWaitForMultipleObjects
GetIconInfo
LoadStringW
wtsapi32
WTSFreeMemory
WTSQueryUserToken
WTSEnumerateSessionsW
msi
MsiSetInternalUI
MsiOpenDatabaseW
MsiViewExecute
MsiViewFetch
MsiRecordGetStringW
MsiCloseHandle
MsiGetProductInfoW
MsiDatabaseOpenViewW
shell32
ExtractIconExW
SHGetFileInfoW
crypt32
CertVerifyCertificateChainPolicy
gdi32
CreateCompatibleDC
CreateDIBSection
GetDIBits
DeleteObject
DeleteDC
GetObjectW
netapi32
NetUserGetInfo
NetApiBufferFree
NetUserEnum
ws2_32
getaddrinfo
WSAGetLastError
WSACleanup
freeaddrinfo
gethostname
WSAStartup
xmllite
CreateXmlWriterOutputWithEncodingName
CreateXmlReaderInputWithEncodingName
CreateXmlWriter
CreateXmlReader
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
tdh
TdhGetEventInformation
cabinet
ord23
ord22
ord20
bcrypt
BCryptGetProperty
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptHashData
BCryptCreateHash
BCryptOpenAlgorithmProvider
iphlpapi
GetIfTable2
FreeMibTable
setupapi
SetupTermDefaultQueueCallback
SetupCloseInfFile
SetupInstallServicesFromInfSectionW
SetupDefaultQueueCallbackW
SetupInstallFromInfSectionW
SetupInitDefaultQueueCallbackEx
SetupOpenInfFileW
Exports
Exports
ContainerSetupFunction
ContainerSetupWrapper
DoScheduledTelemetryRun
DoScheduledTelemetryRunTC
GetCtacProvider
GetProvider
GetTargetVersionList
RunTest
RunXml
Sgd
UpdateAvStatus
UpdateCacheCompatStatuses
UpdateExperienceIndicators
Sections
.text Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
RT_CODE Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 508KB - Virtual size: 504KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 4KB - Virtual size: 392B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
appmgr/miutils.dll.dll windows:10 windows x64 arch:x64
Password: 2024
2d69f4011bf27ecd72bd6c380d4aff86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
miutils.pdb
Imports
msvcrt
_XcptFilter
memmove
memcpy
_amsg_exit
_CxxThrowException
??1type_info@@UEAA@XZ
??0exception@@QEAA@AEBQEBD@Z
malloc
_wtoi
wcscpy_s
_lock
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??1exception@@UEAA@XZ
_initterm
?what@exception@@UEBAPEBDXZ
__dllonexit
_i64tow_s
free
_ui64tow_s
wcsstr
wcschr
_wcsdup
swscanf_s
_vsnwprintf
__CxxFrameHandler3
_onexit
__C_specific_handler
fwprintf
_swprintf_c
_wcsnicmp
getenv
_unlock
_wcstoui64
?terminate@@YAXXZ
memset
wcstod
memcmp
wcstoul
__iob_func
_wcsicmp
_wcstoi64
wcstol
_purecall
wcscmp
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapReAlloc
HeapAlloc
HeapFree
api-ms-win-core-registry-l1-1-0
RegEnumKeyExW
RegGetValueW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
api-ms-win-core-synch-l1-1-0
WaitForSingleObject
SetEvent
LeaveCriticalSection
ResetEvent
DeleteCriticalSection
EnterCriticalSection
CreateEventW
InitializeCriticalSection
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
GetTickCount64
GetSystemInfo
GetSystemDirectoryW
GetComputerNameExW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
SwitchToThread
GetCurrentProcess
GetProcessId
GetCurrentThreadId
TerminateProcess
api-ms-win-core-libraryloader-l1-2-0
LoadStringW
GetProcAddress
GetModuleHandleW
DisableThreadLibraryCalls
LoadLibraryExW
FreeLibrary
api-ms-win-core-localization-l1-2-0
GetThreadPreferredUILanguages
FormatMessageW
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoCreateGuid
StringFromGUID2
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
FileTimeToSystemTime
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventWriteTransfer
EventUnregister
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
ntdll
RtlGetCurrentProcessorNumber
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
Exports
Exports
??0CAutoSetActivityId@@QEAA@XZ
??0CCritSec@@QEAA@XZ
??0DynamicSchema@@QEAA@XZ
??0IndicationSchema@@QEAA@XZ
??0StaticSchema@@QEAA@XZ
??0WMISchema@@QEAA@XZ
??0WMISchema@@QEAA@_N@Z
??1CAutoSetActivityId@@QEAA@XZ
??1CCritSec@@QEAA@XZ
??1WMISchema@@UEAA@XZ
??4CAutoSetActivityId@@QEAAAEAV0@AEBV0@@Z
??4CCritSec@@QEAAAEAV0@AEBV0@@Z
?CreateInstance@DynamicSchema@@UEAAJPEBGPEAUIWbemClassObject@@KPEBU_MI_PropertySet@@_NAEAPEAU_MI_Instance@@PEAUIConversionContext@@@Z
?CreateInstance@IndicationSchema@@UEAAJPEBGPEAUIWbemClassObject@@KPEBU_MI_PropertySet@@_NAEAPEAU_MI_Instance@@PEAUIConversionContext@@@Z
?CreateInstance@StaticSchema@@UEAAJPEBGPEAUIWbemClassObject@@KPEBU_MI_PropertySet@@_NAEAPEAU_MI_Instance@@PEAUIConversionContext@@@Z
?DeInitialize@WMISchema@@QEAAJXZ
?GetFlags@MiSchema@@UEBAJXZ
?GetMiClass@DynamicSchema@@UEAAJPEBG00PEAPEBU_MI_Class@@@Z
?GetMiClass@IndicationSchema@@UEAAJPEBG00PEAPEBU_MI_Class@@@Z
?GetMiClass@StaticSchema@@UEAAJPEBG00PEAPEBU_MI_Class@@@Z
?GetNoneCachedWmiClass@WMISchema@@UEAAJPEBGPEAUIWbemServices@@AEAV?$CComPtr@UIWbemClassObject@@@ATL@@PEAUIConversionContext@@@Z
?GetWmiClass@WMISchema@@UEAAJPEBG0AEAV?$CComPtr@UIWbemClassObject@@@ATL@@PEAUIConversionContext@@@Z
?GetWmiIWbemServices@WMISchema@@UEAAJPEBGAEAV?$CComPtr@UIWbemServices@@@ATL@@@Z
?Initialize@StaticSchema@@QEAAJPEBU_MI_Module@@@Z
?Initialize@WMISchema@@QEAAX_N@Z
?SetFlags@MiSchema@@MEAAJJ@Z
CimErrorFromErrorCode
CimError_Construct
CimStatusCodeFromWindowsError
CimTypeToType
ClassCache_AddClass
ClassCache_Delete
ClassCache_GetClass
ClassCache_New
Class_New
CompareInstance
CompareValue
Config_GetProtocolHandlerDetails
Config_GetRegString
CreateConversionContext
DestinationOptions_Create
DestinationOptions_Duplicate
DestinationOptions_MigrateOptions
FindClassDecl
FindMethodDecl
FindQualifierInWMIObject
GetCorrelationId
GetMethodParameters
GetReferenceFromWMIObjectPath
InstanceToWMIEvent
InstanceToWMIExtendedStatus
InstanceToWMIObject
Instance_Clone
Instance_Construct
Instance_GetResourceURI
Instance_InitDynamic
Instance_IsDynamic
Instance_MatchKeys
Instance_New
Instance_SetElementArray
Instance_SetElementArrayItem
Instance_SetResourceURI
Instance_SetServerName
IsLifeCycleIndicationQuery
MI_Hash
MiErrorCategoryFromWindowsError
OSC_Batch_Destroy
OSC_Batch_Get
OSC_Batch_Strdup
OSC_StringToMiValue
OSC_Type_GetSize
OperationOptions_CopyOptions
OperationOptions_Create
OperationOptions_MigrateOptions
OptionsValueToContextValue
Options_FindValue
ParametersToWMIObject
PropertySet_New
PropertyToVariant
PublishClientOperationInfo
PublishDebugInfo
PublishDebugMessage
PublishProviderResult
PublishProviderWriteError
PublishProviderWriteMessage
QualifierFlavorToWMI
RCClass_AddClassQualifier
RCClass_AddClassQualifierArray
RCClass_AddClassQualifierArrayItem
RCClass_AddElement
RCClass_AddElementArray
RCClass_AddElementArrayItem
RCClass_AddElementQualifier
RCClass_AddElementQualifierArray
RCClass_AddElementQualifierArrayItem
RCClass_AddMethod
RCClass_AddMethodParameter
RCClass_AddMethodParameterQualifier
RCClass_AddMethodParameterQualifierArray
RCClass_AddMethodParameterQualifierArrayItem
RCClass_AddMethodQualifier
RCClass_AddMethodQualifierArray
RCClass_AddMethodQualifierArrayItem
RCClass_New
ResultFromHRESULT
ResultToHRESULT
RtlDeleteCachedFastLock
RtlInitializeCachedFastLock
RtlInterlockedCompareWait
RtlInterlockedWakeAll
RtlQueueAcquireCachedFastLockExclusive
RtlQueueAcquireCachedFastLockShared
RtlQueueAcquireFastLockExclusive
RtlQueueAcquireFastLockShared
RtlReleaseCachedFastLockExclusive
RtlReleaseCachedFastLockShared
RtlReleaseFastLockExclusive
RtlReleaseFastLockShared
RtlTryAcquireCachedFastLockShared
RtlTryAcquireFastLockExclusive
RtlTryAcquireFastLockShared
RtlpInitFastLock
RtlpReleaseIdleSlots
SetCorrelationIdToWbemContext
SetModifiedPropertyNamesToContext
SetProperties
SubscriptionDeliveryOptions_Create
SubscriptionDeliveryOptions_MigrateOptions
TypeToCimType
ValueClear
ValueToVariant
VariantArrayToSafeArray
VariantToValue
WMIEventToCIMIndication
WMIExtendedObjectToInstance
WMIObjectToClass
WMIObjectToInstance
WMIQualifierFlavorToMI
WriteWBEM_MC_CLIENT_REQUEST_FAILURE
XMLDOM_Free
XMLDOM_Parse
XML_FormatError
XML_Init
XML_Next
XML_PutError
XML_RegisterNameSpace
XML_SetText
XML_StripWhitespace
Sections
.text Size: 156KB - Virtual size: 155KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 66KB - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
profext/drvstore.dll.dll windows:10 windows x64 arch:x64
Password: 2024
93c1e8d0ffaadaad37be2c01f095caf5
Code Sign
33:00:00:03:8d:b0:bf:e1:b0:ca:33:b3:d4:00:00:00:00:03:8dCertificate
IssuerCN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before05/05/2022, 19:23Not After04/05/2023, 19:23SubjectCN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
61:07:76:56:00:00:00:00:00:08Certificate
IssuerCN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before19/10/2011, 18:41Not After19/10/2026, 18:51SubjectCN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
df:a3:aa:f0:be:b3:4f:85:34:3b:ec:9d:ba:ea:32:30:72:8e:49:03:0d:80:ff:7f:83:e8:ea:12:6c:6e:3a:2fSigner
Actual PE Digestdf:a3:aa:f0:be:b3:4f:85:34:3b:ec:9d:ba:ea:32:30:72:8e:49:03:0d:80:ff:7f:83:e8:ea:12:6c:6e:3a:2fDigest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB Paths
drvstore.pdb
Imports
msvcrt
_amsg_exit
_XcptFilter
_wcsnicmp
__C_specific_handler
towlower
iswalpha
memcmp
memmove
_vsnprintf
strcmp
memcpy
iswxdigit
free
_purecall
memmove_s
_CxxThrowException
??0exception@@QEAA@AEBV0@@Z
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
_onexit
??0exception@@QEAA@XZ
_vsnprintf_s
memcpy_s
??3@YAXPEAX@Z
__dllonexit
malloc
??1exception@@UEAA@XZ
__CxxFrameHandler3
towupper
wcsstr
swscanf_s
_initterm
wcsrchr
wcschr
_vsnwprintf
memset
_wcsicmp
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
swscanf
_unlock
_lock
_resetstkoflw
toupper
wcstoul
_errno
_wcstoui64
_wtoi
_ultow_s
_itow_s
??_V@YAXPEAX@Z
wcscpy_s
swprintf_s
wcstok_s
iswspace
wcstol
bsearch
wcsncmp
_callnewh
??0exception@@QEAA@AEBQEBD@Z
wcscmp
ntdll
RtlLookupFunctionEntry
RtlCaptureContext
NtCreateFile
RtlGetVersion
RtlUnicodeToMultiByteSize
RtlUnicodeToMultiByteN
RtlMultiByteToUnicodeSize
RtlMultiByteToUnicodeN
RtlUpcaseUnicodeChar
NtQueryInformationThread
NtSetInformationThread
RtlImageNtHeader
NtSetInformationFile
RtlGUIDFromString
RtlRandomEx
RtlGetOwnerSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlFormatCurrentUserKeyPath
RtlFreeUnicodeString
NtDeleteKey
NtOpenKey
NtCreateKey
NtQueryKey
NtQueryValueKey
NtSetValueKey
NtDeleteValueKey
NtEnumerateKey
RtlIntegerToChar
RtlAnsiCharToUnicodeChar
RtlIsDosDeviceName_U
RtlGetLastNtStatus
RtlIsTextUnicode
RtlInitUnicodeStringEx
NtCreateTransaction
NtCommitTransaction
NtEnumerateValueKey
LdrLoadDll
LdrGetProcedureAddress
LdrUnloadDll
RtlMakeSelfRelativeSD
RtlSelfRelativeToAbsoluteSD2
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
RtlValidSid
RtlSetOwnerSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlGetAce
RtlMapGenericMask
RtlAllocateHeap
RtlDosPathNameToRelativeNtPathName_U_WithStatus
NtSetEaFile
RtlReleaseRelativeName
RtlVirtualUnwind
RtlFreeHeap
NtWaitForSingleObject
DbgPrintEx
RtlRaiseStatus
RtlInitializeSRWLock
RtlAcquireSRWLockExclusive
RtlReleaseSRWLockExclusive
RtlCreateUnicodeString
RtlEqualUnicodeString
RtlValidRelativeSecurityDescriptor
RtlLengthSecurityDescriptor
RtlUnicodeStringToInteger
RtlPrefixUnicodeString
RtlLengthSid
RtlCreateAcl
RtlAddAccessAllowedAceEx
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlValidSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
NtOpenThreadToken
NtOpenProcessToken
NtQuerySecurityObject
NtDuplicateToken
NtAdjustPrivilegesToken
RtlCopySid
RtlAddAce
NtSetSecurityObject
NtQueryObject
NtDuplicateObject
NtOpenThreadTokenEx
NtOpenProcessTokenEx
NtQueryInformationToken
RtlEqualSid
RtlConvertSidToUnicodeString
RtlAppendUnicodeStringToString
RtlTimeToTimeFields
LdrGetDllHandle
RtlInitAnsiString
RtlDuplicateUnicodeString
RtlInitUnicodeString
NtQuerySystemInformation
NtQueryInformationProcess
NtOpenProcess
NtQueryInformationFile
RtlNtStatusToDosErrorNoTeb
RtlVerifyVersionInfo
NtClose
RtlNtStatusToDosError
api-ms-win-core-libraryloader-l1-1-0
LoadLibraryExA
FreeLibrary
FindResourceExW
FreeResource
GetModuleFileNameW
LoadLibraryExW
LockResource
LoadResource
GetModuleHandleExW
GetModuleFileNameA
SizeofResource
GetModuleHandleW
GetProcAddress
api-ms-win-core-errorhandling-l1-1-0
SetErrorMode
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-core-file-l1-1-0
FindNextFileW
FindFirstFileW
DeleteFileW
SetEndOfFile
FindClose
SetFileAttributesW
RemoveDirectoryW
GetFileSizeEx
FileTimeToLocalFileTime
WriteFile
CreateDirectoryW
GetTempFileNameW
GetFileAttributesW
SetFileTime
GetFileSize
GetFileTime
GetShortPathNameW
ReadFile
CreateFileA
LocalFileTimeToFileTime
CompareFileTime
GetFileAttributesExW
FlushFileBuffers
SetFilePointer
GetFileInformationByHandle
GetDriveTypeW
GetFullPathNameW
CreateFileW
api-ms-win-core-sysinfo-l1-1-0
GetSystemTime
GetSystemDirectoryW
GetLocalTime
GetTickCount64
GetWindowsDirectoryW
GetSystemInfo
GetTickCount
GetSystemWindowsDirectoryW
GetSystemTimeAsFileTime
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-synch-l1-1-0
CreateMutexW
SleepEx
OpenSemaphoreW
CreateMutexExW
LeaveCriticalSection
CreateSemaphoreExW
WaitForSingleObject
WaitForSingleObjectEx
DeleteCriticalSection
InitializeCriticalSectionEx
EnterCriticalSection
ReleaseMutex
InitializeCriticalSection
CreateEventW
WaitForMultipleObjectsEx
ReleaseSemaphore
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SetEvent
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
MultiByteToWideChar
GetStringTypeExW
WideCharToMultiByte
CompareStringW
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
FileTimeToSystemTime
api-ms-win-core-localization-l1-2-0
GetThreadLocale
LCMapStringW
FormatMessageW
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
TerminateProcess
TlsGetValue
GetCurrentProcess
TlsFree
GetCurrentThreadId
TlsSetValue
SetThreadToken
OpenProcessToken
GetCurrentThread
ExitProcess
OpenThreadToken
TlsAlloc
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
HeapReAlloc
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-file-l2-1-0
CreateHardLinkW
MoveFileExW
CopyFileExW
api-ms-win-core-kernel32-legacy-l1-1-0
DosDateTimeToFileTime
CopyFileW
api-ms-win-core-memory-l1-1-0
VirtualProtect
VirtualQuery
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
api-ms-win-core-heap-obsolete-l1-1-0
LocalAlloc
LocalFree
api-ms-win-core-localization-obsolete-l1-2-0
GetSystemDefaultUILanguage
api-ms-win-core-wow64-l1-1-0
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
IsWow64Process
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
GetCommandLineA
ExpandEnvironmentStringsW
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-file-l1-2-0
GetTempPathW
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventUnregister
EventWriteTransfer
api-ms-win-core-sysinfo-l1-2-0
GetNativeSystemInfo
VerSetConditionMask
api-ms-win-core-rtlsupport-l1-1-0
RtlCompareMemory
Exports
Exports
DriverPackageClose
DriverPackageEnumClassesW
DriverPackageEnumComponentsW
DriverPackageEnumConfigurationsW
DriverPackageEnumDevicesW
DriverPackageEnumDriversW
DriverPackageEnumEventProvidersW
DriverPackageEnumFilesW
DriverPackageEnumFiltersW
DriverPackageEnumInterfacesW
DriverPackageEnumPropertiesW
DriverPackageEnumRegKeysW
DriverPackageEnumServicesW
DriverPackageEnumSoftwareW
DriverPackageGetPropertyW
DriverPackageGetVersionInfoW
DriverPackageOpenW
DriverStoreClose
DriverStoreConfigureW
DriverStoreCopyW
DriverStoreDeleteW
DriverStoreDriverPackageResolveCallbackW
DriverStoreEnumDeviceDriversW
DriverStoreEnumNodesW
DriverStoreEnumObjectsW
DriverStoreEnumRelatedDriversW
DriverStoreEnumW
DriverStoreFindW
DriverStoreGetObjectPropertyKeysW
DriverStoreGetObjectPropertyW
DriverStoreImportW
DriverStoreMountNodeW
DriverStoreOfflineAddDriverPackageA
DriverStoreOfflineAddDriverPackageW
DriverStoreOfflineDeleteDriverPackageA
DriverStoreOfflineDeleteDriverPackageW
DriverStoreOfflineEnumDriverPackageA
DriverStoreOfflineEnumDriverPackageW
DriverStoreOfflineFindDriverPackageA
DriverStoreOfflineFindDriverPackageW
DriverStoreOpenW
DriverStorePublishW
DriverStoreReflectCriticalW
DriverStoreReflectW
DriverStoreRunDllW
DriverStoreSelectNodeW
DriverStoreSetLogContext
DriverStoreSetObjectPropertyW
DriverStoreUnconfigureW
DriverStoreUnmountNodeW
DriverStoreUnpublishW
DriverStoreUnreflectCriticalW
DriverStoreUnreflectW
DriverStoreUpdateDevicesW
pServerDeleteDriverPackage
pServerImportDriverPackage
Sections
.text Size: 957KB - Virtual size: 957KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 288KB - Virtual size: 287KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 1024B - Virtual size: 824B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1016B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
profext/profext.dll.dll windows:10 windows x64 arch:x64
Password: 2024
3c2c9a9e091c7a7238ef1c6d48ed8f54
Code Sign
33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3cCertificate
IssuerCN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before02/09/2021, 18:23Not After01/09/2022, 18:23SubjectCN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
61:07:76:56:00:00:00:00:00:08Certificate
IssuerCN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before19/10/2011, 18:41Not After19/10/2026, 18:51SubjectCN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
58:48:1e:23:04:42:66:1b:5c:b7:24:d5:50:c0:2c:15:7b:4f:cc:5d:27:a3:53:61:f4:d9:00:a1:33:74:d6:3cSigner
Actual PE Digest58:48:1e:23:04:42:66:1b:5c:b7:24:d5:50:c0:2c:15:7b:4f:cc:5d:27:a3:53:61:f4:d9:00:a1:33:74:d6:3cDigest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
profext.pdb
Imports
msvcrt
??0exception@@QEAA@AEBQEBD@Z
_callnewh
malloc
free
_initterm
??0exception@@QEAA@AEBQEBDH@Z
?what@exception@@UEBAPEBDXZ
_CxxThrowException
__C_specific_handler
_lock
_XcptFilter
memcpy
__dllonexit
_onexit
wcsncmp
_wcsnicmp
_get_errno
_set_errno
??_V@YAXPEAX@Z
wcsrchr
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
_purecall
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_unlock
memmove
__CxxFrameHandler3
??3@YAXPEAX@Z
memcpy_s
_vsnwprintf
_amsg_exit
toupper
memset
api-ms-win-security-base-l1-1-0
CopySid
InitializeAcl
AddAccessAllowedAceEx
GetSidSubAuthority
GetSidSubAuthorityCount
GetSecurityDescriptorSacl
GetLengthSid
GetTokenInformation
FreeSid
DestroyPrivateObjectSecurity
AllocateAndInitializeSid
AddAccessAllowedAce
AddAccessDeniedAce
api-ms-win-core-file-l1-1-0
CreateDirectoryW
CreateFileW
DeleteFileW
SetFileAttributesW
RemoveDirectoryW
FindNextFileW
FindClose
FindFirstFileW
GetFinalPathNameByHandleW
GetFileAttributesW
api-ms-win-core-string-l2-1-1
SHLoadIndirectString
api-ms-win-core-libraryloader-l1-2-0
LoadResource
GetModuleHandleW
GetModuleFileNameA
FindResourceExW
GetProcAddress
DisableThreadLibraryCalls
LockResource
GetModuleHandleExW
api-ms-win-core-synch-l1-1-0
WaitForSingleObject
CreateSemaphoreExW
ReleaseSRWLockExclusive
ReleaseMutex
OpenSemaphoreW
CreateMutexExW
ReleaseSemaphore
WaitForSingleObjectEx
AcquireSRWLockExclusive
api-ms-win-core-heap-l1-1-0
HeapReAlloc
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-core-com-l1-1-0
CoUninitialize
CoInitializeEx
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
OpenProcessToken
TerminateProcess
OpenThreadToken
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegDeleteTreeW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
CreateSymbolicLinkW
userenv
ord207
ord202
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
SearchPathW
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-path-l1-1-0
PathCchRemoveFileSpec
PathCchRemoveBackslash
PathAllocCanonicalize
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
Sleep
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
profapi
ord104
ord111
ord109
ord117
ord112
ord110
ord108
ord107
ord115
api-ms-win-security-provider-l1-1-0
SetEntriesInAclW
SetNamedSecurityInfoW
SetSecurityInfo
GetSecurityInfo
api-ms-win-core-shlwapi-legacy-l1-1-0
PathUnquoteSpacesW
PathGetArgsW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
kernelbase
GetStateRootFolder
AppContainerRegisterSid
CloseState
AppContainerUnregisterSid
AppContainerDeriveSidFromMoniker
GetPackageFamilyNameFromToken
OpenStateExplicit
AppContainerLookupMoniker
AppContainerFreeMemory
AppContainerLookupDisplayNameMrtReference
ntdll
RtlNtStatusToDosErrorNoTeb
RtlNtStatusToDosError
RtlExpandEnvironmentStrings
EtwEventRegister
EtwEventWrite
EtwEventUnregister
EtwEventWriteTransfer
RtlFreeSid
RtlDowncaseUnicodeString
RtlQueryPackageClaims
NtQueryInformationToken
RtlInitUnicodeString
RtlGetAppContainerSidType
EtwEventActivityIdControl
EtwEventSetInformation
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventProviderEnabled
EventRegister
EventUnregister
EventSetInformation
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
Exports
Exports
CreateAppContainerProfileWorker
CreateDirectoryJunctionsForSystemWorker
CreateDirectoryJunctionsForUserProfileWorker
CreateGroupExWorker
CreateLinkFileExWorker
DeleteAppContainerProfileWorker
DeleteGroupWorker
DeleteLinkFileWorker
DeriveAppContainerSidFromAppContainerNameWorker
DeriveRestrictedAppContainerSidFromAppContainerSidAndRestrictedNameWorker
GetAppContainerFolderPathWorker
GetAppContainerRegistryLocationWorker
IsAppContainerProfilePresentWorker
LookupAppContainerDisplayNameWorker
ProcessGroupPolicyCompletedExWorker
ProcessGroupPolicyCompletedWorker
RsopAccessCheckByTypeWorker
RsopFileAccessCheckWorker
RsopResetPolicySettingStatusWorker
RsopSetPolicySettingStatusWorker
UpdateAppContainerProfileWorker
Sections
.text Size: 96KB - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 740B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
profext/sysclass.dll.dll windows:10 windows x64 arch:x64
5c317b4785c1c3ce395f95788fb0f892
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
sysclass.pdb
Imports
msvcrt
__C_specific_handler
_XcptFilter
_initterm
malloc
free
_amsg_exit
kernel32
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
Sleep
GetCurrentProcessId
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 240B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 114KB - Virtual size: 113KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
setup.msi.msi