940EBDD3-EB46-4A91-BF3C-D15D21AAB029[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

940EBDD3-EB46-4A91-BF3C-D15D21AAB029.rar
Size

3.2MB
MD5

74e5b5929bc88bcbdbac462f56de3055
SHA1

cc053a9bf05de4616d8cc7eaf6b70c6ea2fb2166
SHA256

914fd127d5333c85fdac0dc41b32ec8a1cc85994ce3519fe02c5ff6a7d836b4b
SHA512

a22c84f5198b989325dfc48fdf650ddc3681b5e1a5861a6d70c389d540b86b0cc5528493bdc98fcbcb4776c3bb8d59078d998a6887988a6cfc5575b77faa81c6
SSDEEP

98304:/Qxi/bG2PTrfuohDytvo3/cR/L6nriTrWR:/v/C2PfuohDyRo3/f

Score

3^/10

Malware Config

Signatures

Unsigned PE 47 IoCs

Checks for missing Authenticode signature.

resource
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/FfuProvider.dll
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/AppxProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/AssocProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/CbsProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/DismCore.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/DismProv.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/DmiProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/FfuProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/FolderProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/GenericProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/IBSProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/ImagingProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/IntlProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/LogProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/MsiProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/OSProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/OfflineSetupProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/ProvProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/SetupPlatformProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/SmiProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/SysprepProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/TransmogProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/UnattendProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/VhdProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/WimProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/AppxProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/AssocProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/CbsProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/DismCore.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/DismProv.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/DmiProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/FfuProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/FolderProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/GenericProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/ImagingProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/IntlProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/LogProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/MsiProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/OSProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/OfflineSetupProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/ProvProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/SetupPlatformProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/SmiProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/TransmogProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/UnattendProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/VhdProvider.dll.mui
unpack001/940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/WimProvider.dll.mui

Files

940EBDD3-EB46-4A91-BF3C-D15D21AAB029.rar
.rar
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/AppxProvider.dll
.dll regsvr32 windows:10 windows x64 arch:x64

2e13c2bc4f0c9ed9f72b86e3c4cff318

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

14:1c:1d:cd:3d:ac:b4:a1:f3:e7:37:e8:fd:fe:5b:54:98:93:fe:d6:65:a1:29:1b:16:d6:a8:76:7f:ea:09:45
Signer

Actual PE Digest

14:1c:1d:cd:3d:ac:b4:a1:f3:e7:37:e8:fd:fe:5b:54:98:93:fe:d6:65:a1:29:1b:16:d6:a8:76:7f:ea:09:45

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

PDB Paths

AppxProvider.pdb

Imports

msvcrt

wcsrchr
_wcsnicmp
wcschr
wcstok_s
towupper
__CxxFrameHandler3
__RTDynamicCast
memcmp
_onexit
__dllonexit
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_unlock
_lock
malloc
memmove_s
_purecall
vswprintf_s
_vscwprintf
_wcsicmp
wcsncpy_s
wcscat_s
free
wcscpy_s
__C_specific_handler
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
memcpy_s
_vsnwprintf
memset

ntdll

RtlNtStatusToDosError
NtSetInformationFile
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlCompareUnicodeString
RtlInitUnicodeString
RtlAllocateAndInitializeSid
RtlEqualSid
RtlFindAceByType
RtlLookupElementGenericTableAvl
RtlInsertElementGenericTableAvl
RtlAcquireSRWLockExclusive
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockShared
RtlReleaseSRWLockShared
RtlFreeHeap
RtlReAllocateHeap
RtlAllocateHeap
RtlFreeSid
RtlEnumerateGenericTableWithoutSplayingAvl
RtlDeleteElementGenericTableAvl
RtlInitializeGenericTableAvl
RtlNumberGenericTableElementsAvl

advapi32

GetSecurityInfo
RegEnumKeyExW
RegSetValueExW
RegDeleteValueW
OpenProcessToken
RegQueryValueExW
EventWriteTransfer
RegEnumValueW
RegCreateKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
EventUnregister
EventRegister
AdjustTokenPrivileges
RegSetKeyValueW

kernel32

MapViewOfFile
CreateFileMappingW
GetVersionExW
SearchPathW
GetFullPathNameW
CreateDirectoryW
GetFileInformationByHandle
FindClose
GetFileAttributesW
GetFileInformationByHandleEx
DeviceIoControl
GetTempPathW
SetFileInformationByHandle
CopyFileExW
GetLongPathNameW
GetFinalPathNameByHandleW
GetCurrentDirectoryW
WaitForSingleObject
AcquireSRWLockShared
ReleaseSRWLockShared
SetThreadpoolTimer
CreateThreadpoolTimer
CreateSemaphoreExW
ReleaseSemaphore
OpenSemaphoreW
ReleaseMutex
UnmapViewOfFile
UnhandledExceptionFilter
HeapFree
GetCurrentThreadId
FormatMessageW
HeapAlloc
GetProcessHeap
DisableThreadLibraryCalls
FreeLibrary
GetProcAddress
GetModuleHandleExW
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
RaiseException
GetLastError
GetModuleFileNameW
LoadLibraryExW
GetModuleHandleW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetLastError
OutputDebugStringW
IsDebuggerPresent
CloseHandle
CompareStringOrdinal
MultiByteToWideChar
GetCurrentProcessId
SetThreadUILanguage
CopyFileW
SetFileAttributesW
CreateEventW
FindFirstFileW
FindNextFileW
DeleteFileW
CreateHardLinkW
CreateFileW
SizeofResource
LockResource
LoadResource
FindResourceExW
GetCurrentProcess
TerminateProcess
DebugBreak
LocalFree
VirtualProtect
LoadLibraryExA
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetSystemInfo
VirtualQuery
HeapSize
HeapReAlloc
HeapDestroy
CompareStringW
Sleep
InitializeCriticalSectionEx
CreateMutexExW
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
GetModuleFileNameA
WaitForSingleObjectEx

ole32

CoTaskMemFree
CoTaskMemAlloc
CoInitializeEx
CoCreateGuid
ProgIDFromCLSID
StringFromGUID2
CoCreateInstance
CoUninitialize
CoSetProxyBlanket
CLSIDFromString

shlwapi

SHCreateStreamOnFileW

user32

CharLowerBuffW
CharNextW
LoadStringW
UnregisterClassA

oleaut32

SysFreeString
UnRegisterTypeLi
SysAllocString
LoadTypeLi
RegisterTypeLi
SysStringLen
SysAllocStringLen
SysStringByteLen
SysAllocStringByteLen
LoadRegTypeLi
VariantClear
GetErrorInfo
SetErrorInfo
CreateErrorInfo

ext-ms-win-session-winsta-l1-1-0

WinStationGetTermSrvCountersValue

api-ms-win-core-path-l1-1-0

PathAllocCanonicalize

bcrypt

BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptHashData
BCryptOpenAlgorithmProvider
BCryptDestroyHash
BCryptFinishHash

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Exports

Exports

DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 323KB - Virtual size: 322KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 187KB - Virtual size: 187KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/AssocProvider.dll
.dll regsvr32 windows:10 windows x64 arch:x64

e1921d401583d0d512d1a8ec5d16429d

Code Sign

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cf:a9:89:3e:54:6d:6f:75:5c:91:6f:ac:bb:dd:61:33:17:ae:ce:0d:c6:49:51:5a:d3:7d:08:6a:05:56:28:d6
Signer

Actual PE Digest

cf:a9:89:3e:54:6d:6f:75:5c:91:6f:ac:bb:dd:61:33:17:ae:ce:0d:c6:49:51:5a:d3:7d:08:6a:05:56:28:d6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

PDB Paths

AssocProvider.pdb

Imports

msvcrt

vswprintf_s
memcpy_s
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBD@Z
memmove_s
_purecall
_vscwprintf
_vsnwprintf
wcsncpy_s
wcscat_s
free
malloc
??0exception@@QEAA@AEBQEBDH@Z
_callnewh
_CxxThrowException
_XcptFilter
_amsg_exit
_initterm
?terminate@@YAXXZ
_lock
_unlock
__dllonexit
__CxxFrameHandler3
_onexit
??1type_info@@UEAA@XZ
memcmp
??0exception@@QEAA@XZ
wcscpy_s
__C_specific_handler
__RTDynamicCast
memset

ntdll

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

kernel32

FreeLibrary
GetVersionExW
SearchPathW
SetLastError
UnmapViewOfFile
LocalFree
LockResource
LoadResource
FindResourceExW
FormatMessageW
GetTickCount
GetSystemTimeAsFileTime
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
HeapDestroy
MapViewOfFile
CreateFileMappingW
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
RaiseException
GetLastError
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetThreadUILanguage
MultiByteToWideChar
OutputDebugStringW
GetCurrentThreadId
GetCurrentProcessId
CreateFileW
GetFileSizeEx
ReadFile
CloseHandle
CopyFileW
DeleteFileW
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegQueryInfoKeyW

user32

UnregisterClassA
CharLowerBuffW
LoadStringW
CharNextW

ole32

CoCreateInstance
CoTaskMemFree
ProgIDFromCLSID
StringFromGUID2

oleaut32

SysStringLen
SysFreeString
LoadRegTypeLi
VarBstrCmp
CreateErrorInfo
SetErrorInfo
GetErrorInfo
SysAllocStringLen
VariantClear
SysAllocStringByteLen
UnRegisterTypeLi
SysStringByteLen
RegisterTypeLi
LoadTypeLi
SysAllocString

shell32

SHCreateAssociationRegistration

Exports

Exports

DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 908B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/CbsProvider.dll
.dll regsvr32 windows:10 windows x64 arch:x64

3e8a2fa3ee3b10848f33ec53056f9da2

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9d:70:c9:69:9c:0d:63:09:70:2e:5a:ca:75:c7:6d:77:66:31:56:8f:f4:9f:6e:c5:19:b9:79:e7:e5:36:86:96
Signer

Actual PE Digest

9d:70:c9:69:9c:0d:63:09:70:2e:5a:ca:75:c7:6d:77:66:31:56:8f:f4:9f:6e:c5:19:b9:79:e7:e5:36:86:96

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

PDB Paths

CBSProvider.pdb

Imports

msvcrt

_wcsnicmp
iswspace
wcstoul
wcsstr
_ultow_s
__CxxFrameHandler3
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_CxxThrowException
_callnewh
??0exception@@QEAA@AEBQEBDH@Z
_wcslwr_s
wcsrchr
_wtoi64
_wtoi
iswdigit
??0exception@@QEAA@XZ
_vsnprintf_s
_vsnwprintf
malloc
calloc
memmove_s
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBV0@@Z
memcpy_s
_purecall
wcschr
vswprintf_s
_vscwprintf
_wcstoui64
_wcsicmp
wcsncpy_s
wcscat_s
free
wcscpy_s
__C_specific_handler
_XcptFilter
memcpy
memcmp
__RTDynamicCast
memset

advapi32

RegDeleteKeyExW
RegEnumValueW
RegFlushKey
RegEnumKeyExW
RegSetKeySecurity
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAceEx
InitializeAcl
RegDeleteKeyW
CopySid
GetLengthSid
IsValidSid
GetTokenInformation
RegSetValueExW
RegCreateKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegUnLoadKeyW
RegQueryValueExW
RegLoadKeyW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey

kernel32

SetErrorMode
GetTempPathW
GetErrorMode
RemoveDirectoryW
ReadFile
SetFilePointer
GetFileInformationByHandleEx
DeviceIoControl
SetFileAttributesW
SetFileInformationByHandle
GetCurrentDirectoryW
GetLongPathNameW
GetFinalPathNameByHandleW
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
RaiseException
GetLastError
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GetCurrentProcessId
GetVersionExW
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
SetThreadUILanguage
FreeLibrary
GetFileAttributesW
CompareStringW
HeapFree
GetProcessHeap
GetCurrentProcess
CloseHandle
LoadLibraryW
CopyFileW
Sleep
DeleteFileW
SizeofResource
LockResource
LoadResource
FindResourceExW
CreateEventW
WaitForSingleObjectEx
SetEvent
FormatMessageW
HeapAlloc
GetModuleHandleExW
GetModuleFileNameA
DebugBreak
IsDebuggerPresent
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
SetLastError
ReleaseSemaphore
ReleaseMutex
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
InitializeCriticalSectionEx
WaitForSingleObject
OpenSemaphoreW
CreateThreadpoolTimer
CreateMutexExW
CreateSemaphoreExW
GetEnvironmentVariableW
SetEnvironmentVariableW
GetDiskFreeSpaceExW
FileTimeToLocalFileTime
FileTimeToSystemTime
HeapSize
HeapReAlloc
HeapDestroy
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
SearchPathW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
OutputDebugStringW
GetTimeFormatEx
LocalFree
CreateFileW
GetFullPathNameW
CreateDirectoryW
GetFileInformationByHandle
FindFirstFileW
FindNextFileW
FindClose
ExpandEnvironmentStringsW
IsWow64Process
GetDateFormatEx
GetSystemInfo
SetUnhandledExceptionFilter

ole32

CoTaskMemFree
CoCreateInstance
StringFromGUID2
ProgIDFromCLSID
CoCreateGuid
CoGetMalloc

user32

CharLowerBuffW
LoadStringW
CharNextW

oleaut32

SysAllocStringByteLen
SysStringByteLen
SysStringLen
RegisterTypeLi
CreateErrorInfo
SysAllocString
UnRegisterTypeLi
SysFreeString
LoadTypeLi
SysAllocStringLen
VarBstrCmp
LoadRegTypeLi
VariantClear
VarBstrCat
SetErrorInfo
GetErrorInfo

version

GetFileVersionInfoSizeExW
GetFileVersionInfoExW
VerQueryValueW

ntdll

RtlGetVersion
NtWriteFile
RtlInitUnicodeString
NtReadFile
RtlReAllocateHeap
NtClose
RtlAllocateHeap
NtQueryInformationFile
NtWaitForSingleObject
NtOpenFile
RtlRaiseStatus
NtYieldExecution
RtlExpandEnvironmentStrings
RtlNtStatusToDosError
NtSetInformationFile
RtlFreeHeap
RtlDosPathNameToNtPathName_U_WithStatus

Exports

Exports

DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 559KB - Virtual size: 559KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 251KB - Virtual size: 251KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/DismCore.dll
.dll regsvr32 windows:10 windows x64 arch:x64

158676856e43faf0c23969c9bed80b77

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b4:7c:66:f0:7e:ec:32:96:0d:25:0f:2a:b5:85:6a:83:95:bc:4b:d4:57:a8:7d:d8:09:c8:98:d7:e1:98:47:d6
Signer

Actual PE Digest

b4:7c:66:f0:7e:ec:32:96:0d:25:0f:2a:b5:85:6a:83:95:bc:4b:d4:57:a8:7d:d8:09:c8:98:d7:e1:98:47:d6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

PDB Paths

DismCore.pdb

Imports

msvcrt

_wtoi
swscanf_s
_vscprintf
vsprintf_s
iswalpha
_vsnwprintf
_wcsnicmp
wcsncmp
wcsstr
towlower
_vsnprintf
toupper
iswctype
memmove
fclose
__dllonexit
_unlock
_lock
realloc
_errno
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
wcsncpy_s
wcscat_s
calloc
memmove_s
memcpy_s
_purecall
_wcsicmp
wcsrchr
wcschr
vswprintf_s
_vscwprintf
wcscpy_s
malloc
wcstok_s
_wfopen
fgetws
feof
_onexit
_resetstkoflw
free
__C_specific_handler
strrchr
__CxxFrameHandler3
memcpy
memcmp
memset

advapi32

AdjustTokenPrivileges
EventWriteTransfer
EventRegister
EventProviderEnabled
EventUnregister
SetSecurityDescriptorDacl
EqualSid
InitializeSecurityDescriptor
InitializeAcl
GetLengthSid
AddAccessAllowedAce
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
OpenThreadToken
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegQueryInfoKeyW

kernel32

SetThreadUILanguage
CreateFileW
CloseHandle
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GetCurrentProcessId
OutputDebugStringW
MultiByteToWideChar
GetTempPathW
GetModuleHandleExW
FreeLibrary
SetEvent
GetModuleFileNameW
GetModuleHandleW
Wow64DisableWow64FsRedirection
CopyFileExW
Wow64RevertWow64FsRedirection
CreateEventW
GetNativeSystemInfo
HeapFree
GetProcessHeap
WaitForSingleObject
TerminateProcess
WideCharToMultiByte
SizeofResource
LockResource
LoadResource
FindResourceExW
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
RaiseException
GetProcAddress
LoadLibraryExW
HeapSize
HeapReAlloc
HeapAlloc
HeapDestroy
CompareStringW
GetEnvironmentVariableW
Sleep
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
GetLastError
GetCurrentProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
GetFileAttributesW
GetSystemInfo
ExpandEnvironmentStringsW
GetFileSizeEx
LocalAlloc
CreateFileMappingA
DeleteFileW
DeleteFileA
CreateFileA
GetSystemWindowsDirectoryW
FormatMessageW
GetSystemDirectoryW
MoveFileExW
FindClose
FindNextFileW
FindFirstFileW
QueryDosDeviceW
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
GetFileInformationByHandle
CreateDirectoryW
LocalFree
GetCurrentThread
GetFullPathNameW
GetVersion
ReleaseMutex
CreateMutexA
CreateMutexW
WriteFile
GetModuleFileNameA
VirtualQuery
FormatMessageA
TlsFree
TlsGetValue
ExitProcess
GetFileSize
GetLocalTime
TlsAlloc
TlsSetValue
MapViewOfFile
GetTempFileNameW
CreateFileMappingW
UnmapViewOfFile
GetVersionExW
SetLastError
SearchPathW
SetFilePointer
ReadFile
GetWindowsDirectoryW
IsDebuggerPresent
FlushFileBuffers
GetFileInformationByHandleEx
DeviceIoControl
SetFileAttributesW
SetFileInformationByHandle
GetCurrentDirectoryW
GetLongPathNameW
GetFinalPathNameByHandleW
GetDriveTypeW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
CreateProcessW
GetExitCodeProcess
DuplicateHandle
SetUnhandledExceptionFilter
DebugBreak

ole32

CoRegisterPSClsid
CoRegisterClassObject
CoRevokeClassObject
CoSetProxyBlanket
CoCreateGuid
StringFromCLSID
CoTaskMemFree
ProgIDFromCLSID
StringFromGUID2
CoCreateInstance

user32

LoadStringW
CharNextW

oleaut32

SysAllocString
SysAllocStringByteLen
SysAllocStringLen
SysFreeString
VariantTimeToSystemTime
VariantInit
VariantClear
SysStringLen
LoadRegTypeLi
LoadTypeLi
SetErrorInfo
CreateErrorInfo
GetErrorInfo
UnRegisterTypeLi
RegisterTypeLi
SysStringByteLen
SystemTimeToVariantTime
LoadTypeLibEx

version

GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW

ntdll

RtlFreeHeap
RtlNtStatusToDosError
NtSetInformationFile
RtlAllocateHeap

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 188KB - Virtual size: 188KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/DismCorePS.dll
.dll regsvr32 windows:10 windows x64 arch:x64

70198dcb51b0ecd285a581030c4f37a8

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7d:4c:85:eb:fa:80:8f:49:e0:1e:8b:99:c6:11:27:cd:a4:45:3a:2f:1d:aa:4e:5b:89:77:90:fa:e5:0e:fe:b5
Signer

Actual PE Digest

7d:4c:85:eb:fa:80:8f:49:e0:1e:8b:99:c6:11:27:cd:a4:45:3a:2f:1d:aa:4e:5b:89:77:90:fa:e5:0e:fe:b5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

DismCorePS.pdb

Imports

msvcrt

_XcptFilter
_initterm
malloc
free
_amsg_exit
__C_specific_handler
memcmp

oleaut32

BSTR_UserUnmarshal64
BSTR_UserUnmarshal
BSTR_UserMarshal
BSTR_UserFree64
BSTR_UserFree
BSTR_UserSize
BSTR_UserMarshal64
LPSAFEARRAY_UserSize
LPSAFEARRAY_UserFree
LPSAFEARRAY_UserUnmarshal
LPSAFEARRAY_UserFree64
LPSAFEARRAY_UserMarshal64
LPSAFEARRAY_UserUnmarshal64
LPSAFEARRAY_UserMarshal
LPSAFEARRAY_UserSize64
BSTR_UserSize64

rpcrt4

NdrDllRegisterProxy
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
NdrDllUnregisterProxy
NdrCStdStubBuffer2_Release
NdrStubForwardingFunction
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
NdrOleFree
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
CStdStubBuffer_CountRefs
CStdStubBuffer_QueryInterface
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
IUnknown_QueryInterface_Proxy
NdrStubCall3
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Connect
CStdStubBuffer_Invoke

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

kernel32

GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
DisableThreadLibraryCalls
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllGetDismInterfaces
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 492B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/DismHost.exe
.exe windows:10 windows x64 arch:x64

1b31d5bf56f31446dc3caf847a3d3456

Code Sign

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f4:dd:42:8c:d5:48:41:e8:58:76:58:ea:96:9a:d0:98:6c:54:e7:92:0f:19:4d:96:6d:4f:61:28:82:71:03:49
Signer

Actual PE Digest

f4:dd:42:8c:d5:48:41:e8:58:76:58:ea:96:9a:d0:98:6c:54:e7:92:0f:19:4d:96:6d:4f:61:28:82:71:03:49

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

PDB Paths

dismhost.pdb

Imports

msvcrt

??0exception@@QEAA@AEBQEBDH@Z
_wcsicmp
wcscpy_s
_beginthreadex
wcsstr
wcsrchr
__C_specific_handler
calloc
memmove_s
malloc
memcpy_s
_purecall
free
fgetws
_wfopen
wcstok_s
fclose
iswctype
toupper
strrchr
_vsnprintf
??1exception@@UEAA@XZ
__getmainargs
?what@exception@@UEBAPEBDXZ
exit
_exit
_cexit
__CxxFrameHandler3
_ismbblead
__setusermatherr
_initterm
_acmdln
_fmode
_commode
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_wtoi
towlower
wcschr
_wcsnicmp
_vsnwprintf
_vscprintf
vsprintf_s
vswprintf_s
_vscwprintf
swscanf_s
_callnewh
??0exception@@QEAA@AEBV0@@Z
_CxxThrowException
_XcptFilter
_amsg_exit
__set_app_type
_lock
_unlock
__dllonexit
_onexit
feof
memmove
memcpy
memcmp
memset

advapi32

RegOpenKeyExW
EventWriteTransfer
EventRegister
EventProviderEnabled
EventUnregister
EqualSid
AddAccessAllowedAce
OpenThreadToken
GetTokenInformation
OpenProcessToken
RegCloseKey
RegQueryValueExW
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
IsValidSecurityDescriptor
GetAclInformation
InitializeAcl
AddAce
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
MakeAbsoluteSD
GetLengthSid
CopySid
IsValidSid
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
SetSecurityDescriptorOwner
InitializeSecurityDescriptor
GetSecurityDescriptorOwner
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorControl

kernel32

SetLastError
GetCurrentThread
GetLastError
CreateEventExW
CloseHandle
WaitForSingleObjectEx
SetErrorMode
GetCommandLineW
InitializeCriticalSection
SetThreadUILanguage
SetEvent
EnterCriticalSection
LeaveCriticalSection
OpenEventW
WaitForMultipleObjectsEx
ExitProcess
DeleteCriticalSection
OutputDebugStringW
GetModuleFileNameW
RaiseException
GetCurrentThreadId
GetModuleHandleW
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
HeapDestroy
GetEnvironmentVariableW
MultiByteToWideChar
WideCharToMultiByte
Sleep
GetStartupInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
GetVersionExW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
TlsSetValue
TlsAlloc
DeviceIoControl
FreeLibrary
FlushFileBuffers
IsDebuggerPresent
GetWindowsDirectoryW
GetFileSizeEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
LocalAlloc
DebugBreak
CreateFileMappingA
DeleteFileW
DeleteFileA
CreateFileA
GetVersion
ReleaseMutex
CreateMutexA
CreateMutexW
SetFilePointer
WriteFile
GetModuleFileNameA
VirtualQuery
FormatMessageA
TlsFree
TlsGetValue
GetFileSize
GetLocalTime
GetSystemWindowsDirectoryW
ExpandEnvironmentStringsW
CreateFileW
FormatMessageW
FindResourceExW
LoadResource
LocalFree
LoadLibraryExW
GetProcAddress
GetTempFileNameW
WaitForSingleObject
GetModuleHandleExW
SearchPathW

ole32

CoRevokeClassObject
CoCreateInstance
CLSIDFromString
CoRegisterClassObject
CoTaskMemFree
ProgIDFromCLSID
CoUninitialize
CoRegisterPSClsid
CoInitializeEx
CoInitializeSecurity

user32

LoadStringW

oleaut32

SysFreeString
SysAllocString
SysStringLen
LoadRegTypeLi
LoadTypeLi
CreateErrorInfo
SetErrorInfo
SysAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime

ntdll

RtlAllocateHeap
RtlFreeHeap
RtlGetVersion
RtlNtStatusToDosError

Sections

.text
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 468B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/DismProv.dll
.dll regsvr32 windows:10 windows x64 arch:x64

96af7c4840aa9ea814a6cc897252f141

Code Sign

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

48:d8:2d:ef:02:52:1f:50:01:b0:d5:96:f0:02:12:b8:67:af:84:13:a6:d2:ea:03:e0:ca:8c:21:5e:1e:36:5d
Signer

Actual PE Digest

48:d8:2d:ef:02:52:1f:50:01:b0:d5:96:f0:02:12:b8:67:af:84:13:a6:d2:ea:03:e0:ca:8c:21:5e:1e:36:5d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

PDB Paths

DISMProv.pdb

Imports

msvcrt

_vscprintf
swscanf_s
_wtoi
toupper
strrchr
vsprintf_s
_vsnprintf
_wcsnicmp
iswctype
fclose
wcstok_s
_wfopen
fgetws
feof
__RTDynamicCast
memcmp
memcpy
wcschr
_vsnwprintf
memmove
_onexit
__dllonexit
_unlock
_lock
realloc
_errno
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
??0exception@@QEAA@AEBQEBDH@Z
wcscat_s
wcscpy_s
calloc
??0exception@@QEAA@XZ
memmove_s
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBV0@@Z
wcsrchr
_purecall
vswprintf_s
_vscwprintf
memcpy_s
free
malloc
wcsncpy_s
__C_specific_handler
_wcsicmp
towlower
__CxxFrameHandler3
memset

ntdll

RtlFreeHeap
RtlAllocateHeap
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

oleaut32

SysAllocStringByteLen
SysAllocString
VarUI4FromStr
SysAllocStringLen
SysStringLen
LoadRegTypeLi
SystemTimeToVariantTime
LoadTypeLi
VariantClear
UnRegisterTypeLi
RegisterTypeLi
SysStringByteLen
VariantTimeToSystemTime
SysFreeString

advapi32

GetLengthSid
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
OpenThreadToken
RegQueryValueExW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
AddAccessAllowedAce
EventRegister
InitializeAcl
InitializeSecurityDescriptor
EqualSid
SetSecurityDescriptorDacl
EventUnregister
EventWriteTransfer
EventProviderEnabled

kernel32

TlsSetValue
UnmapViewOfFile
TlsAlloc
GetLocalTime
GetFileSize
ExitProcess
TlsGetValue
TlsFree
FormatMessageA
CreateFileMappingW
MapViewOfFile
VirtualQuery
GetModuleFileNameA
WriteFile
SetFilePointer
CreateMutexW
CreateMutexA
ReleaseMutex
GetVersion
CreateFileA
DeleteFileA
CreateFileMappingA
DebugBreak
LocalAlloc
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetFileSizeEx
GetWindowsDirectoryW
IsDebuggerPresent
CreateFileW
GetLastError
CloseHandle
InitializeCriticalSection
DeleteCriticalSection
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleW
lstrcmpiW
LeaveCriticalSection
RaiseException
EnterCriticalSection
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceExW
GetModuleFileNameW
GetCurrentThreadId
GetCurrentProcessId
OutputDebugStringW
GetModuleHandleExW
CompareStringW
LockResource
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
HeapDestroy
GetEnvironmentVariableW
WideCharToMultiByte
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
SetLastError
DeviceIoControl
GetFileAttributesW
DeleteFileW
FlushFileBuffers
GetFullPathNameW
ExpandEnvironmentStringsW
WaitForSingleObject
FormatMessageW
LocalFree
GetTempFileNameW
GetCurrentThread

ole32

CoRegisterClassObject
CoRegisterPSClsid
CoRevokeClassObject
StringFromGUID2
CoMarshalInterThreadInterfaceInStream
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
CoUnmarshalInterface

user32

CharNextW

version

VerQueryValueW
GetFileVersionInfoSizeExW
GetFileVersionInfoExW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/DmiProvider.dll
.dll regsvr32 windows:10 windows x64 arch:x64

cde36dabfb7fe24ee4eb60582fe518a0

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

57:cc:b3:7a:53:4c:d7:4d:3e:bb:32:ef:92:1d:e8:4c:83:10:1e:6f:b4:15:ed:3f:d6:5b:24:ed:b8:6f:2d:06
Signer

Actual PE Digest

57:cc:b3:7a:53:4c:d7:4d:3e:bb:32:ef:92:1d:e8:4c:83:10:1e:6f:b4:15:ed:3f:d6:5b:24:ed:b8:6f:2d:06

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

PDB Paths

DmiProvider.pdb

Imports

msvcrt

wcscmp
__RTDynamicCast
swscanf_s
iswalpha
_wcsnicmp
memcpy
towlower
towupper
memcmp
memset
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
??0exception@@QEAA@AEBQEBDH@Z
wcsrchr
wcschr
wcsstr
malloc
calloc
??0exception@@QEAA@XZ
memmove_s
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBV0@@Z
memcpy_s
_purecall
_wcslwr_s
vswprintf_s
_vscwprintf
_vsnwprintf
_wcsicmp
wcsncpy_s
wcscat_s
free
wcscpy_s
__C_specific_handler
__CxxFrameHandler3

advapi32

RegLoadKeyW
RegDeleteTreeW
RegCreateKeyExW
RegSetValueExW
RegDeleteKeyExW
RegFlushKey
RegUnLoadKeyW
RegQueryValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey

kernel32

GetDateFormatEx
GetFileAttributesW
WaitForSingleObject
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
RaiseException
GetLastError
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetThreadUILanguage
MultiByteToWideChar
OutputDebugStringW
GetCurrentThreadId
GetCurrentProcessId
SizeofResource
LockResource
LoadResource
FreeLibrary
HeapFree
GetProcessHeap
HeapAlloc
FileTimeToSystemTime
CompareStringW
HeapSize
HeapReAlloc
HeapDestroy
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
GetFileInformationByHandleEx
SetLastError
GetSystemInfo
FindClose
FindNextFileW
FindFirstFileW
DeviceIoControl
SetFileAttributesW
SetFileInformationByHandle
DeleteFileW
CopyFileExW
GetFinalPathNameByHandleW
GetVersionExW
FindResourceExW
SearchPathW
GetFileInformationByHandle
CreateDirectoryW
GetFullPathNameW
CloseHandle
CreateFileW
LocalFree
FormatMessageW
ExpandEnvironmentStringsW
VirtualQuery
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
LoadLibraryExA
VirtualProtect
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile

ole32

StringFromGUID2
CoCreateInstance
CoTaskMemFree
ProgIDFromCLSID
CLSIDFromString

user32

LoadStringW
CharLowerBuffW
CharNextW

oleaut32

SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayAccessData
GetErrorInfo
LoadRegTypeLi
VarBstrCmp
SysAllocStringLen
CreateErrorInfo
SafeArrayGetUBound
VariantClear
SysAllocStringByteLen
SysStringByteLen
SysStringLen
RegisterTypeLi
LoadTypeLi
SysAllocString
UnRegisterTypeLi
SysFreeString
SafeArrayGetLBound
SafeArrayUnaccessData
SafeArrayCreate
SafeArrayDestroy
SetErrorInfo

ntdll

RtlFreeHeap
RtlAllocateHeap
RtlNtStatusToDosError
NtSetInformationFile
RtlGetVersion

Exports

Exports

DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 223KB - Virtual size: 222KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 135KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/FfuProvider.dll
.dll regsvr32 windows:10 windows x64 arch:x64

1e0aadd4dfd430f17cedbca6e1b9f6b2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

PDB Paths

FfuProvider.pdb

Imports

msvcrt

swscanf
__CxxFrameHandler3
strchr
wcstoul
_vsnprintf
iswspace
wcsrchr
_wcsnicmp
memmove
memcpy
memcmp
__RTDynamicCast
memset
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
malloc
_wcsicmp
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBV0@@Z
_purecall
memmove_s
wcschr
wcstol
_vsnwprintf
_vscwprintf
memcpy_s
vswprintf_s
wcsncpy_s
wcscat_s
free
wcscpy_s
__C_specific_handler
_stricmp
bsearch
wcscmp

advapi32

RegDeleteKeyW
RegEnumKeyW
RegSetKeySecurity
RegFlushKey
AdjustTokenPrivileges
LookupPrivilegeValueW
RegLoadKeyW
RegUnLoadKeyW
RegEnumKeyExW
RegQueryValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey

kernel32

GetSystemFirmwareTable
GetFileSize
LocalAlloc
ReleaseMutex
SetFilePointerEx
SetFileAttributesW
CreateMutexW
CopyFileExW
GetDriveTypeW
LCMapStringW
DeleteVolumeMountPointW
HeapFree
GetModuleHandleExW
HeapAlloc
GetProcAddress
GetProcessHeap
SetLastError
GetModuleHandleW
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
RaiseException
GetLastError
GetModuleFileNameW
LoadLibraryExW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetThreadUILanguage
GetCurrentThreadId
GetCurrentProcessId
GetFileAttributesW
CompareStringW
CreateFileW
GetFileSizeEx
WriteFile
ReadFile
CloseHandle
GetTempPathW
CreateDirectoryW
RemoveDirectoryW
SizeofResource
LockResource
LoadResource
FindResourceExW
HeapSize
HeapReAlloc
HeapDestroy
MultiByteToWideChar
WideCharToMultiByte
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
VirtualQuery
SearchPathW
GetVersionExW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
VirtualProtect
LoadLibraryExA
ReleaseSRWLockExclusive
OutputDebugStringW
AcquireSRWLockExclusive
CreateIoCompletionPort
CreateEventW
DeviceIoControl
GetOverlappedResult
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
CopyFileW
GetVolumeInformationByHandleW
SetFilePointer
QueryPerformanceFrequency
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
GetFileTime
TrySubmitThreadpoolCallback
SetEvent
GetQueuedCompletionStatus
PostQueuedCompletionStatus
DeleteFileW
GetFirmwareEnvironmentVariableW
GetDiskFreeSpaceW

ole32

StringFromGUID2
CoTaskMemFree
CoCreateInstance
ProgIDFromCLSID
CoSetProxyBlanket
CoInitializeEx
CoUninitialize
CoCreateGuid

user32

CharNextW
CharLowerBuffW
LoadStringW

oleaut32

VariantInit
GetErrorInfo
SysAllocStringLen
SysAllocString
SysFreeString
VariantClear
CreateErrorInfo
SetErrorInfo
LoadRegTypeLi
VarBstrCmp
SysAllocStringByteLen
SysStringByteLen
SysStringLen
RegisterTypeLi
LoadTypeLi
UnRegisterTypeLi

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree

api-ms-win-core-file-l1-1-0

GetFullPathNameW
FindClose
FindNextFileW
FindFirstFileW
QueryDosDeviceW
GetFileInformationByHandle
GetVolumePathNameW

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
OpenThreadToken
GetCurrentThread

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo

api-ms-win-core-libraryloader-l1-1-0

FreeLibrary

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegCreateKeyExW

ntdll

NtOpenFile
NtWaitForSingleObject
NtCreateFile
RtlNtStatusToDosError
NtQueryInformationFile
RtlExpandEnvironmentStrings
NtClose
RtlReAllocateHeap
NtReadFile
NtSetInformationFile
RtlRaiseStatus
NtYieldExecution
RtlInitUnicodeString
RtlDosPathNameToNtPathName_U_WithStatus
NtWriteFile
RtlFreeHeap
RtlAllocateHeap
RtlRandom
RtlNumberOfSetBits
RtlFindSetBits
RtlAreBitsClear
RtlSetBits
RtlClearAllBits
RtlInitializeBitMap

version

VerQueryValueW
GetFileVersionInfoSizeExW
GetFileVersionInfoExW

bcrypt

BCryptDestroyHash
BCryptGetProperty
BCryptHashData
BCryptOpenAlgorithmProvider
BCryptCreateHash
BCryptCloseAlgorithmProvider
BCryptFinishHash

Exports

Exports

DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 423KB - Virtual size: 422KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 149KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/FolderProvider.dll
.dll regsvr32 windows:10 windows x64 arch:x64

7191a261b3387fac5d34de51cc114558

Code Sign

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a6:80:c2:2c:12:08:b8:ec:12:18:36:23:4f:f9:81:ae:ed:65:90:87:1d:ea:2d:12:89:14:da:1b:16:fc:31:33
Signer

Actual PE Digest

a6:80:c2:2c:12:08:b8:ec:12:18:36:23:4f:f9:81:ae:ed:65:90:87:1d:ea:2d:12:89:14:da:1b:16:fc:31:33

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

PDB Paths

FolderProvider.pdb

Imports

msvcrt

wcschr
_wcsnicmp
__CxxFrameHandler3
memcmp
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
malloc
memmove_s
memcpy_s
_purecall
vswprintf_s
_vscwprintf
wcsncpy_s
wcscat_s
free
wcscpy_s
__C_specific_handler

ntdll

RtlAllocateHeap
RtlFreeHeap
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

advapi32

RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey

kernel32

SetLastError
GetFileAttributesW
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
GetLastError
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GetCurrentProcessId
OutputDebugStringW
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
HeapDestroy
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
GetFullPathNameW

ole32

StringFromGUID2
CoCreateInstance

user32

CharNextW

oleaut32

SysAllocString
LoadTypeLi
RegisterTypeLi
SysStringLen
UnRegisterTypeLi
SysAllocStringByteLen
LoadRegTypeLi
SysAllocStringLen
SysFreeString
SysStringByteLen

Exports

Exports

DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 464B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/GenericProvider.dll
.dll regsvr32 windows:10 windows x64 arch:x64

6c406f9102d09ac8b8c11beea662647f

Code Sign

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

34:34:92:e2:a0:37:4f:d3:d7:8f:c8:c8:6a:a2:28:cd:ce:5f:9d:b0:86:7d:4d:95:f9:46:a7:02:26:aa:51:79
Signer

Actual PE Digest

34:34:92:e2:a0:37:4f:d3:d7:8f:c8:c8:6a:a2:28:cd:ce:5f:9d:b0:86:7d:4d:95:f9:46:a7:02:26:aa:51:79

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

PDB Paths

GenericProvider.pdb

Imports

msvcrt

__CxxFrameHandler3
_vsnprintf
wcsrchr
memmove
??0exception@@QEAA@XZ
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
malloc
memmove_s
_vsnwprintf
??0exception@@QEAA@AEBQEBD@Z
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
memcpy_s
_purecall
vswprintf_s
memcpy
memcmp
__RTDynamicCast
_vscwprintf
wcsncpy_s
wcscat_s
free
wcscpy_s
__C_specific_handler
_CxxThrowException
memset

advapi32

GetTraceLoggerHandle
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceEnableFlags
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey

kernel32

DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
GetLastError
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetThreadUILanguage
HeapAlloc
GetProcessHeap
HeapFree
MultiByteToWideChar
OutputDebugStringW
GetCurrentThreadId
GetCurrentProcessId
LocalFree
GetModuleHandleExW
InitializeCriticalSectionAndSpinCount
CompareStringW
HeapSize
HeapReAlloc
HeapDestroy
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
FreeLibrary
CloseHandle
CreateFileW
GetVersionExW
SetComputerNameExW
LocalAlloc
FindResourceExW
LoadResource
LockResource
SetLastError
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
FormatMessageW
SearchPathW

ole32

StringFromGUID2
CoCreateInstance
CoTaskMemFree
ProgIDFromCLSID

user32

LoadStringW
CharLowerBuffW
CharNextW

oleaut32

SafeArrayDestroy
VariantClear
SysAllocStringByteLen
SysStringByteLen
GetErrorInfo
RegisterTypeLi
LoadTypeLi
SysAllocString
UnRegisterTypeLi
SysFreeString
SysAllocStringLen
SetErrorInfo
CreateErrorInfo
VarBstrCmp
SafeArrayAccessData
SafeArrayUnaccessData
SysStringLen
LoadRegTypeLi
SafeArrayCreate

ntdll

RtlFreeHeap
RtlAllocateHeap

Exports

Exports

DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/IBSProvider.dll
.dll regsvr32 windows:10 windows x64 arch:x64

87b4267c346bd6c6b1f46f0e9977dc3f

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

80:73:5a:23:bf:1a:58:89:95:95:90:3b:19:ea:e0:5e:84:58:61:c9:f6:15:ea:0f:f7:95:af:b0:f3:b0:c3:f1
Signer

Actual PE Digest

80:73:5a:23:bf:1a:58:89:95:95:90:3b:19:ea:e0:5e:84:58:61:c9:f6:15:ea:0f:f7:95:af:b0:f3:b0:c3:f1

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

PDB Paths

IBSProvider.pdb

Imports

msvcrt

malloc
memmove_s
memcpy_s
_purecall
??0exception@@QEAA@AEBQEBDH@Z
_lock
wcsncpy_s
wcscat_s
free
wcscpy_s
__C_specific_handler
??0exception@@QEAA@AEBV0@@Z
?terminate@@YAXXZ
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_callnewh
_CxxThrowException
_XcptFilter
_amsg_exit
_initterm
vswprintf_s
_unlock
__dllonexit
_onexit
??1type_info@@UEAA@XZ
memcmp
_vscwprintf
__CxxFrameHandler3
_vsnwprintf

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlAllocateHeap
RtlFreeHeap

kernel32

DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
RaiseException
GetLastError
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
OutputDebugStringW
GetCurrentThreadId
GetCurrentProcessId
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
HeapDestroy
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount

advapi32

RegQueryInfoKeyW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW

user32

UnregisterClassA
CharNextW

ole32

CoCreateInstance
StringFromGUID2

oleaut32

LoadRegTypeLi
SysAllocStringLen
SysStringLen
RegisterTypeLi
LoadTypeLi
SysAllocString
UnRegisterTypeLi
SysFreeString

Exports

Exports

DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 604B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/ImagingProvider.dll
.dll regsvr32 windows:10 windows x64 arch:x64

fde6111483fa327428b9ac492cef8237

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e4:8c:1d:db:71:c2:47:ee:55:a6:a7:68:65:c7:fb:de:2b:a5:37:a4:7a:85:06:03:c2:f7:c3:43:c0:1e:cc:ba
Signer

Actual PE Digest

e4:8c:1d:db:71:c2:47:ee:55:a6:a7:68:65:c7:fb:de:2b:a5:37:a4:7a:85:06:03:c2:f7:c3:43:c0:1e:cc:ba

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

PDB Paths

ImagingProvider.pdb

Imports

msvcrt

_vsnwprintf
iswalpha
towlower
wcschr
wcsrchr
__RTDynamicCast
memcmp
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
??0exception@@QEAA@AEBQEBDH@Z
malloc
calloc
??0exception@@QEAA@XZ
memmove_s
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBV0@@Z
memcpy_s
_purecall
_wcsicmp
vswprintf_s
_vscwprintf
_wtoi64
wcstoul
_wcsnicmp
wcsncpy_s
wcscat_s
free
wcscpy_s
__C_specific_handler
__CxxFrameHandler3
memset

ntdll

VerSetConditionMask
RtlVerifyVersionInfo
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

advapi32

RegQueryValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey

kernel32

SearchPathW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
GetVersionExW
SetLastError
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
GetLastError
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GetCurrentProcessId
OutputDebugStringW
GetLocaleInfoW
GetNumberFormatW
HeapAlloc
GetProcessHeap
HeapFree
FileTimeToLocalFileTime
FileTimeToSystemTime
GetDateFormatW
GetTimeFormatW
CompareStringW
HeapSize
HeapReAlloc
HeapDestroy
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
SetThreadUILanguage
FormatMessageW
FindResourceExW
LoadResource
LockResource
LocalFree
CloseHandle
FreeLibrary
CreateFileW

ole32

StringFromGUID2
CoCreateInstance
CoTaskMemFree
ProgIDFromCLSID

user32

LoadStringW
CharLowerBuffW
CharNextW

oleaut32

CreateErrorInfo
SetErrorInfo
GetErrorInfo
VariantClear
SysAllocStringLen
LoadRegTypeLi
VarBstrCmp
SysAllocStringByteLen
SysFreeString
UnRegisterTypeLi
SysAllocString
LoadTypeLi
RegisterTypeLi
SysStringLen
SysStringByteLen

Exports

Exports

DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 118KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/IntlProvider.dll
.dll regsvr32 windows:10 windows x64 arch:x64

2461afc3851e64f67c1e03e290f11e97

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

94:03:86:34:81:10:17:7a:dd:c2:f2:ed:d5:d9:a5:fd:66:d7:48:59:88:27:53:7c:36:9a:20:64:f5:1a:33:da
Signer

Actual PE Digest

94:03:86:34:81:10:17:7a:dd:c2:f2:ed:d5:d9:a5:fd:66:d7:48:59:88:27:53:7c:36:9a:20:64:f5:1a:33:da

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

PDB Paths

IntlProvider.pdb

Imports

msvcrt

?terminate@@YAXXZ
_errno
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
realloc
__RTDynamicCast
??0exception@@QEAA@AEBQEBDH@Z
memmove_s
wcschr
??1type_info@@UEAA@XZ
_wtoi
_lock
wcscat_s
??0exception@@QEAA@AEBQEBD@Z
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
_purecall
vswprintf_s
_vscwprintf
wcstoul
wcstol
_vsnwprintf
memcpy_s
malloc
wcsncpy_s
free
_unlock
__dllonexit
_onexit
wcscpy_s
memset
__C_specific_handler
memcpy
??0exception@@QEAA@XZ
bsearch
_wcsicmp
_itow_s
_wcsnicmp
memcmp
log
ceil
__CxxFrameHandler3
_initterm
wcscmp

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

oleaut32

SysFreeString
SysAllocString
SysStringLen
SetErrorInfo
CreateErrorInfo
SysStringByteLen
SysAllocStringByteLen
VariantClear
VarUI4FromStr
VarBstrCmp
VarBstrCat
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
LoadRegTypeLi
SysAllocStringLen

kernel32

UnmapViewOfFile
GetLocalTime
CreateFileMappingW
MapViewOfFile
GetFileAttributesExW
IsDebuggerPresent
GetModuleFileNameA
CreateSemaphoreExW
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
ReleaseMutex
SetLastError
GetVersionExW
WaitForSingleObjectEx
LockResource
OutputDebugStringA
GetTickCount
GetSystemTimeAsFileTime
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
SetThreadUILanguage
UnhandledExceptionFilter
Sleep
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryExW
GetModuleHandleW
OpenSemaphoreW
CreateMutexExW
DebugBreak
SearchPathW
lstrcmpiW
LoadLibraryW
RaiseException
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceExW
GetModuleFileNameW
InitializeCriticalSection
GetCurrentThreadId
GetCurrentProcessId
OutputDebugStringW
DeleteCriticalSection
CompareStringW
LocalFree
LocalAlloc
EnterCriticalSection
LeaveCriticalSection
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
HeapDestroy
HeapReAlloc
CloseHandle
CreateFileW
CopyFileW
DeleteFileW
GetTempPathW
GetTempFileNameW
WideCharToMultiByte
WriteFile
GetPrivateProfileSectionNamesW
lstrcmpW
GetPrivateProfileSectionW
GetGeoInfoW
HeapAlloc
GetProcessHeap
FindFirstFileW
HeapFree
HeapSize
FindNextFileW
FindClose
FormatMessageW
GetFileAttributesW

ole32

ProgIDFromCLSID
CoCreateInstance
StringFromGUID2
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree

user32

CharNextW
CharLowerBuffW
UnregisterClassA
LoadStringW

advapi32

RegQueryValueExW
RegDeleteValueW
AdjustTokenPrivileges
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
PrivilegeCheck
RegEnumValueW
RegLoadKeyW
RegUnLoadKeyW
OpenProcessToken
RegDeleteKeyW
LookupPrivilegeValueW

shlwapi

SHGetValueW
StrChrW

input

ord110
ord112
ord109

setupapi

SetupOpenInfFileW
SetupInstallFromInfSectionW
SetupCloseInfFile

Exports

Exports

DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 145KB - Virtual size: 144KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/LogProvider.dll
.dll regsvr32 windows:10 windows x64 arch:x64

b14bbc4788378a545c762a1ad1f74dcf

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ba:ba:82:81:21:10:18:f7:bf:c3:49:43:3f:5e:5e:94:b7:f8:84:57:0f:a9:50:69:78:a1:23:88:55:7e:88:e1
Signer

Actual PE Digest

ba:ba:82:81:21:10:18:f7:bf:c3:49:43:3f:5e:5e:94:b7:f8:84:57:0f:a9:50:69:78:a1:23:88:55:7e:88:e1

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

PDB Paths

LogProvider.pdb

Imports

msvcrt

?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_lock
_callnewh
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
malloc
calloc
memmove_s
memcpy_s
_purecall
vswprintf_s
_vscwprintf
_vsnprintf
wcsncpy_s
wcscat_s
free
wcscpy_s
__C_specific_handler
_unlock
__dllonexit
_onexit
??1type_info@@UEAA@XZ
memcmp
wcschr
_wcsnicmp
_CxxThrowException
__CxxFrameHandler3
vsprintf_s
_vscprintf
_vsnwprintf
memset

ntdll

RtlFreeHeap
RtlAllocateHeap
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

oleaut32

CreateErrorInfo
SetErrorInfo
LoadRegTypeLi
SysStringLen
RegisterTypeLi
LoadTypeLi
SysAllocString
UnRegisterTypeLi
SysFreeString
SysAllocStringLen

advapi32

RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey

kernel32

FreeLibrary
SetLastError
GetFileAttributesW
GetFullPathNameW
GetVersionExW
SearchPathW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
RaiseException
GetLastError
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetThreadUILanguage
GetCurrentThreadId
GetCurrentProcessId
OutputDebugStringW
HeapAlloc
GetProcessHeap
OutputDebugStringA
HeapFree
CreateDirectoryW
WideCharToMultiByte
SizeofResource
LockResource
LoadResource
FindResourceExW
HeapSize
HeapReAlloc
HeapDestroy
GetSystemWindowsDirectoryW
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
CreateFileW
CloseHandle
FormatMessageW
LocalFree

ole32

CoCreateInstance
CoTaskMemFree
ProgIDFromCLSID
StringFromGUID2

user32

CharNextW
LoadStringW

wdscore

WdsGenericSetupLogInit
CurrentIP
WdsSetupLogDestroy
WdsSetupLogMessageA
ConstructPartialMsgVA
WdsGetSetupLog

Exports

Exports

DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/MsiProvider.dll
.dll regsvr32 windows:10 windows x64 arch:x64

ee2bd2ee64b2c570536995a9ee0daf2e

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

79:f2:63:18:2e:5e:42:8b:27:9a:ef:eb:27:1d:12:11:ff:a2:dd:7c:97:24:1c:1c:b4:ee:f9:dc:8b:47:87:1f
Signer

Actual PE Digest

79:f2:63:18:2e:5e:42:8b:27:9a:ef:eb:27:1d:12:11:ff:a2:dd:7c:97:24:1c:1c:b4:ee:f9:dc:8b:47:87:1f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

PDB Paths

MsiProvider.pdb

Imports

msvcrt

wcsrchr
_vscwprintf
memcpy_s
vswprintf_s
wcsncpy_s
wcscat_s
_purecall
wcscpy_s
__C_specific_handler
memmove_s
??0exception@@QEAA@AEBV0@@Z
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBQEBD@Z
malloc
??0exception@@QEAA@AEBQEBDH@Z
_callnewh
wcsstr
_wcslwr_s
_wcsnicmp
_CxxThrowException
_XcptFilter
_amsg_exit
_initterm
?terminate@@YAXXZ
_lock
_unlock
__dllonexit
_onexit
??1type_info@@UEAA@XZ
memset
memcpy
memcmp
__RTDynamicCast
towupper
??0exception@@QEAA@XZ
wcschr
free
__CxxFrameHandler3
_vsnwprintf
wcscmp

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlFreeHeap
RtlAllocateHeap

kernel32

MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
GetVersionExW
SearchPathW
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
RaiseException
GetLastError
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
OutputDebugStringW
GetCurrentThreadId
GetCurrentProcessId
GetModuleHandleExW
SetThreadUILanguage
CompareStringW
GetFullPathNameW
FreeLibrary
CopyFileW
LoadLibraryW
SizeofResource
LockResource
LoadResource
FindResourceExW
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
HeapDestroy
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
FormatMessageW
LocalFree
GetFileAttributesW
CreateFileW
CloseHandle
SetLastError

advapi32

RegQueryInfoKeyW
RegCloseKey
RegLoadKeyW
RegUnLoadKeyW
RegFlushKey
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW

user32

CharNextW
UnregisterClassA
LoadStringW
CharLowerBuffW

ole32

CoCreateInstance
CoTaskMemFree
ProgIDFromCLSID
StringFromGUID2

oleaut32

UnRegisterTypeLi
SysAllocString
LoadTypeLi
RegisterTypeLi
SysStringLen
SysAllocStringLen
VarBstrCat
SysAllocStringByteLen
SysStringByteLen
LoadRegTypeLi
VariantClear
CreateErrorInfo
SetErrorInfo
SysFreeString

Exports

Exports

DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 107KB - Virtual size: 107KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/OSProvider.dll
.dll regsvr32 windows:10 windows x64 arch:x64

940e602fcc3c64d0a12a0fd111c6fb16

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:59:d6:56:de:1d:6b:3e:4d:80:23:bd:de:27:26:0f:b9:7f:a4:03:fa:79:b5:0f:e5:70:ef:d9:14:75:96:22
Signer

Actual PE Digest

09:59:d6:56:de:1d:6b:3e:4d:80:23:bd:de:27:26:0f:b9:7f:a4:03:fa:79:b5:0f:e5:70:ef:d9:14:75:96:22

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

PDB Paths

OSProvider.pdb

Imports

msvcrt

towupper
wcschr
wcsrchr
_wcsnicmp
wcsncmp
_vsnwprintf
memset
memcmp
memcpy
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
malloc
memmove_s
memcpy_s
_purecall
wcsstr
_wcslwr_s
vswprintf_s
_vscwprintf
_wcsicmp
wcsncpy_s
wcscat_s
free
wcscpy_s
__C_specific_handler
__CxxFrameHandler3

advapi32

RegCreateKeyExW
RegSetValueExW
RegFlushKey
RegUnLoadKeyW
RegLoadKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegQueryValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey

kernel32

DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
RaiseException
GetLastError
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetThreadUILanguage
GetCurrentThreadId
GetCurrentProcessId
MultiByteToWideChar
OutputDebugStringW
Sleep
GetFileAttributesW
GetCurrentProcess
OpenProcess
SetEnvironmentVariableW
FreeLibrary
GetEnvironmentVariableW
SizeofResource
LockResource
LoadResource
FindResourceExW
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
HeapDestroy
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
GetFullPathNameW
CreateFileW
GetFileInformationByHandle
LocalFree
FormatMessageW
ReadFile
SetFilePointer
SetLastError
GetVersionExW
CloseHandle
GetSystemWindowsDirectoryW
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
SearchPathW
GetModuleHandleExW
GetSystemInfo

ole32

StringFromGUID2
CoCreateInstance
CoTaskMemFree
ProgIDFromCLSID

user32

CharNextW
LoadStringW

oleaut32

SysFreeString
UnRegisterTypeLi
SysAllocString
LoadTypeLi
RegisterTypeLi
SysStringLen
SysAllocStringLen
SysStringByteLen
SysAllocStringByteLen
LoadRegTypeLi
SetErrorInfo
CreateErrorInfo

ntdll

RtlAllocateHeap
RtlFreeHeap
NtUnloadKey2
NtQueryInformationProcess
NtQueryOpenSubKeysEx
RtlInitUnicodeString

version

GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeExW

Exports

Exports

DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 600B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/OfflineSetupProvider.dll
.dll regsvr32 windows:10 windows x64 arch:x64

5e14c5f70826fbb5007113b4d0e7e990

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:5f:73:37:f8:93:03:7e:8b:5b:70:b2:ca:60:94:01:06:5c:fb:46:72:03:26:d2:bd:45:64:83:43:b2:71:1e
Signer

Actual PE Digest

01:5f:73:37:f8:93:03:7e:8b:5b:70:b2:ca:60:94:01:06:5c:fb:46:72:03:26:d2:bd:45:64:83:43:b2:71:1e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

PDB Paths

OfflineSetupProvider.pdb

Imports

msvcrt

towupper
_vsnwprintf
__RTDynamicCast
memcmp
__CxxFrameHandler3
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@XZ
memmove_s
wcschr
??0exception@@QEAA@AEBQEBD@Z
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
memcpy_s
_purecall
vswprintf_s
_vscwprintf
malloc
_stricmp
_wcsicmp
wcsncpy_s
wcscat_s
free
wcscpy_s
__C_specific_handler
memset

advapi32

RegCloseKey
RegQueryInfoKeyW
RegOpenKeyExW
ConvertStringSidToSidW
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegEnumKeyExW
RegDeleteKeyValueW
RegDeleteTreeW
RegDeleteValueW
RegGetValueW

kernel32

SearchPathW
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
RaiseException
GetLastError
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GetCurrentProcessId
MultiByteToWideChar
OutputDebugStringW
CompareStringOrdinal
FreeLibrary
LocalFree
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
HeapDestroy
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
SetLastError
LoadResource
FindResourceExW
GetVersionExW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
LocalAlloc
VirtualProtect
LoadLibraryExA
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetSystemInfo
VirtualQuery
CreateFileW
CloseHandle
SetThreadUILanguage

ole32

CoCreateInstance
StringFromGUID2

shlwapi

ord158

user32

CharLowerBuffW
CharNextW

oleaut32

LoadRegTypeLi
SysAllocStringLen
VariantClear
SysStringLen
RegisterTypeLi
LoadTypeLi
SysAllocString
UnRegisterTypeLi
SysStringByteLen
SysAllocStringByteLen
SysFreeString

ntdll

NtDeviceIoControlFile
NtClose
NtOpenFile
RtlNtStatusToDosError
RtlAllocateHeap
RtlFreeHeap
NtOpenProcessToken
NtDuplicateToken
NtAdjustPrivilegesToken
NtSetInformationThread
RtlGUIDFromString
RtlInitUnicodeString

dnsapi

DnsValidateName_W

Exports

Exports

DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 800B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/ProvProvider.dll
.dll regsvr32 windows:10 windows x64 arch:x64

91712e8ec3be030741115542b96aa566

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:06:bb:4f:b7:b1:68:69:8d:6d:d2:e0:24:69:1b:14:34:59:32:c0:b8:79:10:7c:1b:2f:e6:2e:13:43:1a:62
Signer

Actual PE Digest

03:06:bb:4f:b7:b1:68:69:8d:6d:d2:e0:24:69:1b:14:34:59:32:c0:b8:79:10:7c:1b:2f:e6:2e:13:43:1a:62

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

PDB Paths

ProvProvider.pdb

Imports

msvcrt

_vsnwprintf
_wcsicmp
memcmp
memcpy
wcschr
_wcsnicmp
strcpy_s
qsort
_wcsrev
_wcslwr
_strnicmp
wcsncmp
iswalpha
strncpy_s
_wcstoi64
_wtoi
towupper
_vsnprintf_s
iswspace
towlower
swscanf_s
__RTDynamicCast
memmove
_errno
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
??0exception@@QEAA@AEBQEBDH@Z
wcsstr
_wcslwr_s
malloc
wcsncpy_s
wcscat_s
wcscpy_s
_purecall
vswprintf_s
_vscwprintf
??0exception@@QEAA@XZ
memmove_s
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
memcpy_s
??0exception@@QEAA@AEBV0@@Z
free
__C_specific_handler
_vsnwprintf_s
wcstoul
wcstok_s
wcsrchr
__CxxFrameHandler3
memset

advapi32

LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
GetSecurityDescriptorControl
GetSecurityDescriptorLength
GetAclInformation
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegCreateKeyExW
RegGetValueW
RegSetValueExW
GetSecurityInfo
OpenEncryptedFileRawW
WriteEncryptedFileRaw
CloseEncryptedFileRaw
RevertToSelf
ReadEncryptedFileRaw

kernel32

CopyFileW
SizeofResource
LockResource
LoadResource
FindResourceExW
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
HeapDestroy
GetEnvironmentVariableW
WideCharToMultiByte
RaiseException
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringW
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
GetVersionExW
SearchPathW
SetThreadLocale
GetThreadLocale
DisableThreadLibraryCalls
InitializeCriticalSection
GetModuleFileNameW
GetCurrentProcessId
GetCurrentThreadId
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
MultiByteToWideChar
GetSystemInfo
GetHandleInformation
SetFilePointerEx
SetEndOfFile
GetOverlappedResult
SetFilePointer
SetThreadIdealProcessor
GetVolumeInformationW
InitializeCriticalSectionAndSpinCount
SetThreadUILanguage
GetModuleHandleW
LoadLibraryExW
GetProcAddress
CompareStringW
OutputDebugStringA
GetLastError
LockFileEx
UnlockFileEx
OpenProcess
GetPrivateProfileSectionW
WaitForMultipleObjects
GetVolumeInformationByHandleW
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WaitForMultipleObjectsEx
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
LoadLibraryW
GetVolumePathNamesForVolumeNameW
GetFileInformationByHandleEx
FindFirstFileW
SetLastError
FindNextFileW
DeviceIoControl
GetTempPathW
FindClose
CreateFileW
GetFileAttributesW
SetFileAttributesW
GetFileInformationByHandle
SetFileInformationByHandle
DeleteFileW
CloseHandle
CopyFileExW
FlushFileBuffers
GetFileSizeEx
WaitForSingleObject
GetCurrentDirectoryW
FreeLibrary
CreateDirectoryW
GetFullPathNameW
GetLongPathNameW
GetFinalPathNameByHandleW
GetVolumePathNameW
GetVolumeNameForVolumeMountPointW
ExpandEnvironmentStringsW
FormatMessageW
SetEvent
CreateThread
ResetEvent
LocalFree
GetModuleFileNameA
CreateSemaphoreExW
ReleaseSemaphore
GetModuleHandleExW
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
DebugBreak
IsDebuggerPresent
ReadFile
WriteFile
RemoveDirectoryW
LocalAlloc
GetCurrentThread
DuplicateHandle
CreateEventW

ole32

CoCreateGuid
CoCreateInstance
StringFromGUID2

user32

CharLowerBuffW
CharUpperW
CharNextW

oleaut32

VarBstrCmp
SysAllocStringLen
UnRegisterTypeLi
SysFreeString
SysStringByteLen
SysAllocStringByteLen
RegisterTypeLi
VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
LoadTypeLi

profapi

ord104

ntdll

RtlFindAceByType
NtSetSecurityObject
RtlDosPathNameToNtPathName_U
NtOpenFile
NtQueryDirectoryFile
NtClose
NtQueryInformationFile
NtQueryInformationProcess
NtQueryEaFile
NtCreateFile
NtSetEaFile
RtlImpersonateSelf
RtlAdjustPrivilege
RtlInitializeResource
RtlAcquireResourceExclusive
RtlSetControlSecurityDescriptor
RtlReleaseResource
RtlDeleteResource
RtlReAllocateHeap
RtlRaiseStatus
NtYieldExecution
DbgPrintEx
RtlAcquireResourceShared
RtlFreeHeap
RtlAllocateHeap
RtlNtStatusToDosError
NtSetInformationFile

xmllite

CreateXmlWriter
CreateXmlReader

bcrypt

BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptCreateHash
BCryptHashData
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptFinishHash

cabinet

ord22
ord23
ord20

rpcrt4

RpcStringFreeW
UuidToStringW
UuidCreate

Exports

Exports

DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 554KB - Virtual size: 553KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 149KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/SetupPlatformProvider.dll
.dll regsvr32 windows:10 windows x64 arch:x64

0f586771f4119c9968f7730e07074f95

Code Sign

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

da:19:78:77:9e:ca:12:e3:6a:3b:7c:01:bf:5b:34:af:b8:24:e7:69:b1:0f:ec:21:14:2c:c5:23:29:85:20:e6
Signer

Actual PE Digest

da:19:78:77:9e:ca:12:e3:6a:3b:7c:01:bf:5b:34:af:b8:24:e7:69:b1:0f:ec:21:14:2c:c5:23:29:85:20:e6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

PDB Paths

SetupPlatformProvider.pdb

Imports

msvcrt

wcschr
_wcsicmp
_wcsnicmp
wcsrchr
??0exception@@QEAA@XZ
_vsnwprintf
memcpy
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
??0exception@@QEAA@AEBQEBDH@Z
malloc
memmove_s
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
memcpy_s
??0exception@@QEAA@AEBV0@@Z
_purecall
vswprintf_s
_vscwprintf
wcstoul
wcsncpy_s
wcscat_s
free
wcscpy_s
__C_specific_handler
__CxxFrameHandler3
memcmp
__RTDynamicCast
memset

advapi32

OpenProcessToken
AdjustTokenPrivileges
RegQueryValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey

kernel32

DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
GetLastError
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
OutputDebugStringW
GetCurrentThreadId
GetCurrentProcessId
GetDiskFreeSpaceExW
FreeLibrary
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
HeapDestroy
CompareStringW
Sleep
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
SetLastError
CreateFileW
SearchPathW
GetVersionExW
UnmapViewOfFile
FindClose
FindNextFileW
FindFirstFileW
CopyFileExW
DeviceIoControl
SetFileAttributesW
DeleteFileW
RtlLookupFunctionEntry
GetCurrentDirectoryW
GetFinalPathNameByHandleW
GetLongPathNameW
GetFullPathNameW
CreateDirectoryW
MapViewOfFile
CreateFileMappingW
MoveFileW
GetFileInformationByHandleEx
GetFileInformationByHandle
SetFileInformationByHandle
SetThreadUILanguage
FormatMessageW
FindResourceExW
LoadResource
LockResource
LocalFree
GetFileAttributesW
GetWindowsDirectoryW
MoveFileExW
CloseHandle

ole32

CoCreateInstance
CoTaskMemFree
ProgIDFromCLSID
StringFromGUID2

user32

CharLowerBuffW
LoadStringW
CharNextW

oleaut32

LoadRegTypeLi
VarBstrCmp
CreateErrorInfo
SetErrorInfo
GetErrorInfo
SysAllocStringLen
VariantClear
SysAllocStringByteLen
SysStringByteLen
SysStringLen
RegisterTypeLi
LoadTypeLi
UnRegisterTypeLi
SysFreeString
SysAllocString

wintrust

WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WinVerifyTrust

crypt32

CertVerifyCertificateChainPolicy

wdscore

ConstructPartialMsgVW
WdsSetupLogMessageW
CurrentIP

version

GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeExW

ntdll

NtSetInformationFile
RtlFreeHeap
RtlAllocateHeap
RtlNtStatusToDosError

Exports

Exports

DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/SmiProvider.dll
.dll regsvr32 windows:10 windows x64 arch:x64

77639073167bbfee66b89d9781d060ca

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d4:b9:58:11:98:b0:fe:52:af:d6:e8:ce:be:cc:82:8e:3d:fa:99:67:da:46:3b:54:50:36:64:fd:b1:9b:e5:14
Signer

Actual PE Digest

d4:b9:58:11:98:b0:fe:52:af:d6:e8:ce:be:cc:82:8e:3d:fa:99:67:da:46:3b:54:50:36:64:fd:b1:9b:e5:14

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

PDB Paths

SmiProvider.pdb

Imports

msvcrt

??1type_info@@UEAA@XZ
_errno
realloc
_lock
_unlock
__dllonexit
_onexit
memmove
iswspace
??1exception@@UEAA@XZ
__CxxFrameHandler3
wcschr
_wcslwr_s
_wcsnicmp
wcsstr
_wcsicmp
_vsnprintf
??0exception@@QEAA@AEBQEBDH@Z
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
towupper
?what@exception@@UEBAPEBDXZ
memmove_s
_vsnwprintf
_purecall
vswprintf_s
_vscwprintf
wcscat_s
wcscpy_s
memcpy_s
free
malloc
wcsncpy_s
__C_specific_handler
??0exception@@QEAA@AEBV0@@Z
memcpy
memcmp
memset

advapi32

LookupPrivilegeValueW
RegLoadKeyW
RegUnLoadKeyW
RegFlushKey
AdjustTokenPrivileges
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
OpenProcessToken
RegQueryValueExW

kernel32

InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
OutputDebugStringW
GetCurrentThreadId
GetCurrentProcessId
HeapFree
GetProcessHeap
HeapSize
HeapReAlloc
HeapAlloc
HeapDestroy
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
SetFilePointer
GetModuleHandleExW
ReleaseSemaphore
GetFullPathNameW
SetLastError
CreateSemaphoreExW
GetModuleFileNameA
ReadFile
CloseHandle
DebugBreak
SetThreadLocale
GetThreadLocale
DisableThreadLibraryCalls
GetModuleFileNameW
FindResourceExW
LoadResource
SizeofResource
MultiByteToWideChar
RaiseException
lstrcmpiW
GetModuleHandleW
LoadLibraryExW
GetProcAddress
GetLastError
FreeLibrary
DeleteCriticalSection
IsDebuggerPresent
AcquireSRWLockShared
CreateMutexExW
CreateThreadpoolTimer
ReleaseSRWLockShared
SetThreadpoolTimer
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
CloseThreadpoolTimer
ReleaseSRWLockExclusive
FormatMessageW
ReleaseMutex
GetFileAttributesW
CreateFileW
WaitForSingleObject
WaitForThreadpoolTimerCallbacks
InitializeCriticalSectionEx

ole32

CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance
CreateStreamOnHGlobal

user32

CharNextW

oleaut32

UnRegisterTypeLi
VarUI4FromStr
SysFreeString
SysAllocString
LoadTypeLi
RegisterTypeLi
SysStringLen
SysAllocStringLen
LoadRegTypeLi

rpcrt4

UuidCreate
I_RpcMapWin32Status

ntdll

RtlAllocateHeap
RtlFreeHeap
RtlDosPathNameToNtPathName_U_WithStatus
RtlInitUnicodeString
RtlNtStatusToDosError
NtWriteFile
NtReadFile
RtlReAllocateHeap
RtlExpandEnvironmentStrings
NtQueryInformationFile
NtWaitForSingleObject
NtOpenFile
RtlRaiseStatus
NtYieldExecution
NtSetInformationFile
NtClose

Exports

Exports

DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 193KB - Virtual size: 192KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/SysprepProvider.dll
.dll regsvr32 windows:10 windows x64 arch:x64

857bb83db208b46d3c24aa3a74ec62e5

Code Sign

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:24:b1:b9:bf:73:c1:28:14:1b:5f:6a:e7:80:02:74:de:89:20:fc:50:46:e1:4f:01:68:76:89:d2:d4:f2:08
Signer

Actual PE Digest

77:24:b1:b9:bf:73:c1:28:14:1b:5f:6a:e7:80:02:74:de:89:20:fc:50:46:e1:4f:01:68:76:89:d2:d4:f2:08

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

PDB Paths

SysprepProvider.pdb

Imports

msvcrt

wcsstr
wcsncmp
iswalpha
iswspace
??0exception@@QEAA@XZ
?name@type_info@@QEBAPEBDXZ
_wcsupr_s
_wcsnicmp
_wcslwr_s
__RTtypeid
wcstol
time
_wctime
wcschr
_vsnwprintf
_vsnprintf
wcsrchr
__RTDynamicCast
memcmp
memcpy
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
??0exception@@QEAA@AEBQEBDH@Z
malloc
calloc
memmove_s
_wcsicmp
??0exception@@QEAA@AEBQEBD@Z
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
memcpy_s
_purecall
vswprintf_s
_vscwprintf
wcsncpy_s
wcscat_s
free
wcscpy_s
__C_specific_handler
__CxxFrameHandler3
memset

ntdll

RtlDosPathNameToRelativeNtPathName_U_WithStatus
NtSetInformationFile
NtSetSystemInformation
RtlFreeHeap
RtlAllocateHeap
RtlNtStatusToDosError
RtlGetVersion
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

advapi32

AdjustTokenPrivileges
QueryServiceStatus
CloseServiceHandle
NotifyServiceStatusChangeW
ControlService
EnumDependentServicesW
StartServiceW
OpenServiceW
RegDeleteTreeW
RegSetValueExW
RegDeleteValueW
RegEnumValueW
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
LookupPrivilegeValueW
OpenProcessToken
EventUnregister
EventRegister
EventWriteTransfer
TraceEvent
OpenSCManagerW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegQueryInfoKeyW

kernel32

SetFilePointer
ReadFile
MapViewOfFile
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
RaiseException
GetLastError
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetThreadUILanguage
MultiByteToWideChar
OutputDebugStringW
GetCurrentThreadId
GetCurrentProcessId
FreeLibrary
GetVolumePathNameW
GetVolumeNameForVolumeMountPointW
SetEvent
HeapAlloc
GetProcessHeap
HeapFree
CreateEventW
CreateWaitableTimerW
SetWaitableTimer
CancelWaitableTimer
CloseHandle
HeapSize
HeapReAlloc
HeapDestroy
CompareStringW
GetEnvironmentVariableW
WideCharToMultiByte
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemInfo
GetTickCount
GetVersionExW
SetLastError
LocalFree
SizeofResource
FindFirstFileNameW
CreateFileMappingW
UnmapViewOfFile
SearchPathW
SetErrorMode
FindNextFileNameW
IsWow64Process
TerminateThread
GetExitCodeThread
WaitForMultipleObjects
GetModuleHandleExW
LockResource
LoadResource
FindResourceExW
WritePrivateProfileStringW
GetFullPathNameW
CreateDirectoryW
FlushFileBuffers
DeleteFileW
SetFileInformationByHandle
GetFileInformationByHandle
SetFileAttributesW
FindClose
DeviceIoControl
FindNextFileW
FindFirstFileW
GetFileInformationByHandleEx
SleepEx
CreateThread
FormatMessageW
WaitForSingleObject
CreateFileW
ExitProcess
RemoveDirectoryW
GetFileAttributesW
GetFileAttributesExW
VirtualQuery
HeapValidate
HeapCompact
DebugBreak
ExpandEnvironmentStringsW
GetSystemTimeAsFileTime

ole32

StringFromGUID2
CoCreateInstance

user32

CharNextW
CharLowerBuffW

oleaut32

VariantInit
SysAllocStringLen
VarBstrCmp
LoadRegTypeLi
VariantClear
SysAllocStringByteLen
SysStringByteLen
SysStringLen
RegisterTypeLi
LoadTypeLi
SysFreeString
UnRegisterTypeLi
SysAllocString

wimgapi

WIMGetMountedImageInfo

wdscore

WdsSetupLogMessageW
ConstructPartialMsgVW
CurrentIP

Exports

Exports

DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 381KB - Virtual size: 381KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 323KB - Virtual size: 322KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 35KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/TransmogProvider.dll
.dll regsvr32 windows:10 windows x64 arch:x64

ff3ad3f4c457aeab897f502575405525

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9e:4f:c1:a4:b3:34:a7:24:f3:c3:a5:a3:01:a5:ba:e3:21:26:fc:fd:bd:0b:13:8c:f0:58:6a:0a:b8:3f:c6:bc
Signer

Actual PE Digest

9e:4f:c1:a4:b3:34:a7:24:f3:c3:a5:a3:01:a5:ba:e3:21:26:fc:fd:bd:0b:13:8c:f0:58:6a:0a:b8:3f:c6:bc

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

PDB Paths

TransmogProvider.pdb

Imports

msvcrt

iswspace
wcstoul
??0exception@@QEAA@XZ
_wcsnicmp
wcschr
_wcsicmp
bsearch
strncmp
_snprintf_s
_CxxThrowException
wcsrchr
__RTDynamicCast
memcmp
memcpy
memmove
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
realloc
_errno
_initterm
_amsg_exit
_XcptFilter
memmove_s
wcscat_s
_vsnwprintf
wcsstr
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBV0@@Z
wcscpy_s
wcsncpy_s
malloc
free
_vscwprintf
_purecall
vswprintf_s
memcpy_s
__C_specific_handler
__CxxFrameHandler3
memset

ntdll

RtlCreateUnicodeStringFromAsciiz
NtQueryValueKey
DbgPrint
RtlQueryEnvironmentVariable_U
LdrLoadDll
RtlDosPathNameToNtPathName_U
LdrUnloadDll
LdrGetDllHandle
NtOpenKey
LdrGetProcedureAddress
RtlLeaveCriticalSection
RtlInitializeCriticalSection
RtlDeleteCriticalSection
RtlTimeToTimeFields
RtlHashUnicodeString
NtYieldExecution
RtlRaiseStatus
NtQueryPerformanceCounter
NtOpenFile
NtWaitForSingleObject
NtCreateFile
NtQueryInformationFile
RtlExpandEnvironmentStrings
NtClose
RtlReAllocateHeap
NtReadFile
RtlInitUnicodeString
NtWriteFile
RtlEnterCriticalSection
RtlNtStatusToDosError
NtSetInformationFile
RtlDosPathNameToNtPathName_U_WithStatus
RtlFreeHeap
RtlAllocateHeap
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

advapi32

RegDeleteKeyExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
UnregisterTraceGuids
RegisterTraceGuidsW
RegUnLoadKeyW
RegLoadKeyW
RegQueryValueExW
RegCloseKey
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegQueryInfoKeyW

kernel32

SetLastError
GetFullPathNameW
GetFileAttributesW
SizeofResource
HeapFree
EnterCriticalSection
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSection
GetCurrentThreadId
MultiByteToWideChar
GetLastError
RaiseException
FindResourceExW
LoadResource
HeapAlloc
GetProcAddress
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
FreeLibrary
lstrcmpiW
LoadLibraryExW
LocalFree
CompareStringW
OutputDebugStringW
SetThreadUILanguage
LoadLibraryW
GetPrivateProfileIntW
CreateFileW
CloseHandle
GetLongPathNameW
CreateThread
WaitForSingleObject
GetExitCodeThread
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
HeapSize
HeapReAlloc
HeapDestroy
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
GetFinalPathNameByHandleW
GetCurrentDirectoryW
GetSystemWindowsDirectoryW
LocalAlloc
GetUserDefaultUILanguage
GetLocaleInfoW
LockResource
LCMapStringEx
CompareStringOrdinal
SearchPathW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
GetVersionExW
CopyFileExW
SetFileInformationByHandle
GetFileInformationByHandle
GetFileInformationByHandleEx
DeleteFileW
SetFileAttributesW
FindFirstFileW
FindNextFileW
DeviceIoControl
CopyFileW
FindClose
FormatMessageW

ole32

CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
StringFromGUID2
CoCreateInstance
ProgIDFromCLSID

oleaut32

VariantClear
SetErrorInfo
CreateErrorInfo
VarBstrCmp
UnRegisterTypeLi
RegisterTypeLi
SysStringByteLen
LoadRegTypeLi
LoadTypeLi
SysFreeString
SysAllocStringLen
VarUI4FromStr
SysStringLen
SysAllocString
SysAllocStringByteLen

user32

CharNextW
UnregisterClassA
CharLowerBuffW
LoadStringW

rpcrt4

UuidCreate
RpcStringFreeW
UuidToStringW

setupapi

SetupCloseInfFile
SetupGetIntField
SetupFindFirstLineW
SetupFindNextLine
SetupGetStringFieldW
SetupOpenInfFileW

Exports

Exports

DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 370KB - Virtual size: 369KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 901KB - Virtual size: 901KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/UnattendProvider.dll
.dll regsvr32 windows:10 windows x64 arch:x64

8ea5aa8a57496631445f0135e3e6c3b5

Code Sign

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

19:d0:0f:1e:08:1e:fa:4d:ff:66:b1:f5:d1:16:4c:a4:f9:f5:95:13:d8:67:75:82:a8:6c:eb:6a:5e:b1:4d:86
Signer

Actual PE Digest

19:d0:0f:1e:08:1e:fa:4d:ff:66:b1:f5:d1:16:4c:a4:f9:f5:95:13:d8:67:75:82:a8:6c:eb:6a:5e:b1:4d:86

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

PDB Paths

UnattendProvider.pdb

Imports

msvcrt

_vsnwprintf
memset
__RTDynamicCast
memcmp
memcpy
wcsrchr
??0exception@@QEAA@XZ
_wcsicmp
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
??0exception@@QEAA@AEBQEBDH@Z
malloc
memmove_s
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBV0@@Z
memcpy_s
_purecall
vswprintf_s
_vscwprintf
wcsncpy_s
wcscat_s
free
wcscpy_s
__C_specific_handler
__CxxFrameHandler3

advapi32

RegQueryValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey

kernel32

SetLastError
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
RaiseException
GetLastError
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
GetProcessHeap
OutputDebugStringW
GetCurrentThreadId
GetCurrentProcessId
SetThreadUILanguage
GetFileAttributesW
GetCurrentDirectoryW
HeapSize
HeapReAlloc
HeapAlloc
HeapDestroy
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
GetFullPathNameW
CloseHandle
FreeLibrary
SearchPathW
GetVersionExW
UnmapViewOfFile
CreateFileW
LocalFree
LockResource
LoadResource
SetCurrentDirectoryW
FindResourceExW
MapViewOfFile
FormatMessageW
CreateFileMappingW

ole32

StringFromGUID2
CoCreateInstance
CoTaskMemFree
ProgIDFromCLSID

user32

CharLowerBuffW
LoadStringW
CharNextW

oleaut32

SysStringLen
RegisterTypeLi
SysStringByteLen
SysAllocString
UnRegisterTypeLi
SysFreeString
VarBstrCmp
SysAllocStringByteLen
LoadRegTypeLi
SetErrorInfo
CreateErrorInfo
VariantClear
LoadTypeLi

ntdll

RtlNtStatusToDosError
NtSetInformationFile
NtWriteFile
RtlInitUnicodeString
NtReadFile
RtlReAllocateHeap
NtClose
RtlExpandEnvironmentStrings
NtQueryInformationFile
NtOpenFile
RtlRaiseStatus
NtYieldExecution
RtlDosPathNameToNtPathName_U_WithStatus
RtlFreeHeap
RtlAllocateHeap
NtWaitForSingleObject

Exports

Exports

DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 151KB - Virtual size: 150KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/VhdProvider.dll
.dll regsvr32 windows:10 windows x64 arch:x64

f802da9f0cf8081eed479b8daa7e80d9

Code Sign

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

dd:d3:0f:41:cf:cc:29:c6:f5:0d:8d:55:3a:e3:68:98:29:e3:c6:b3:d0:13:aa:d8:63:34:83:86:ad:a6:6b:92
Signer

Actual PE Digest

dd:d3:0f:41:cf:cc:29:c6:f5:0d:8d:55:3a:e3:68:98:29:e3:c6:b3:d0:13:aa:d8:63:34:83:86:ad:a6:6b:92

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

PDB Paths

VhdProvider.pdb

Imports

msvcrt

memcmp
__dllonexit
_onexit
memmove
_unlock
_lock
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
??0exception@@QEAA@AEBQEBDH@Z
malloc
_stricmp
??0exception@@QEAA@XZ
wcsncmp
_wcsnicmp
iswalpha
wcsrchr
wcschr
iswspace
towlower
iswctype
_wtoi
towupper
__CxxFrameHandler3
wcstoul
_vsnwprintf_s
memcpy
bsearch
_wcsupr
wcstok_s
qsort
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBV0@@Z
_purecall
wcsncpy_s
wcscat_s
__C_specific_handler
memmove_s
calloc
_wcsicmp
wcsstr
_vsnwprintf
_vscwprintf
memcpy_s
vswprintf_s
free
wcscpy_s
memset

advapi32

RegSetValueExW
RegFlushKey
RegEnumKeyExW
RegDeleteTreeW
RegEnumValueW
AdjustTokenPrivileges
RegLoadKeyW
RegUnLoadKeyW
DuplicateTokenEx
SetThreadToken
RegGetValueW
OpenThreadToken
OpenProcessToken
RegDeleteKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey

kernel32

LockFileEx
UnlockFileEx
SetEndOfFile
CloseHandle
OutputDebugStringW
GetCurrentThreadId
GetCurrentProcessId
CreateFileW
GetLastError
HeapFree
GetProcessHeap
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
Sleep
QueryDosDeviceW
GetVolumeNameForVolumeMountPointW
HeapAlloc
LoadLibraryExW
GetProcAddress
FreeLibrary
DeleteVolumeMountPointW
GetFileAttributesW
SetFileAttributesW
CreateMutexW
WaitForSingleObject
ReleaseMutex
DeleteFileW
GetVolumePathNamesForVolumeNameW
SetLastError
MultiByteToWideChar
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
RaiseException
GetModuleFileNameW
GetModuleHandleW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetThreadUILanguage
CompareStringW
HeapSize
HeapReAlloc
HeapDestroy
LoadLibraryW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
WriteFile
GetFileTime
SetFilePointerEx
GetFileSizeEx
ReadFile
VerSetConditionMask
GetSystemInfo
GetVersionExW
CopyFileExW
GetDiskFreeSpaceW
GetTempPathW
GetDriveTypeW
DeviceIoControl
GetLogicalDrives
CreateThread
FindClose
FindNextFileW
FindFirstFileW
GetFileInformationByHandle
GetCurrentThread
GetFullPathNameW
VirtualQuery
AcquireSRWLockExclusive
GetVolumePathNameW
ReleaseSRWLockExclusive
LoadLibraryExA
VirtualProtect
VirtualFree
VirtualAlloc
GetSystemDirectoryW
SearchPathW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
SetFilePointer
GetModuleHandleExW
GetVolumeInformationW
GetDiskFreeSpaceExW
FormatMessageW
FindResourceExW
LoadResource
LockResource
LocalFree

ole32

CoCreateInstance
StringFromGUID2
ProgIDFromCLSID
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket

user32

CharNextW
LoadStringW
CharUpperBuffW

oleaut32

SafeArrayGetElement
SafeArrayGetUBound
SysFreeString
SetErrorInfo
CreateErrorInfo
SysAllocString
UnRegisterTypeLi
VariantClear
SysAllocStringLen
LoadRegTypeLi
SysAllocStringByteLen
SysStringByteLen
SysStringLen
RegisterTypeLi
LoadTypeLi
SafeArrayDestroy

ntdll

RtlDowncaseUnicodeChar
NtQueryObject
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject
NtUnloadKey2
RtlAdjustPrivilege
DbgPrintEx
NtYieldExecution
RtlRaiseStatus
NtOpenFile
RtlReAllocateHeap
RtlSetThreadErrorMode
RtlGetThreadErrorMode
RtlVerifyVersionInfo
RtlGetVersion
RtlFreeHeap
RtlCompareMemory
RtlAllocateHeap
RtlDosPathNameToNtPathName_U_WithStatus
RtlNtStatusToDosError
NtQueryDirectoryObject
NtOpenDirectoryObject
NtClose
RtlInitUnicodeString

rpcrt4

RpcStringFreeW
UuidToStringW
UuidCreate

version

VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW

Exports

Exports

DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 359KB - Virtual size: 359KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 154KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/WimProvider.dll
.dll regsvr32 windows:10 windows x64 arch:x64

df4419b93535e12efb8912e6e019d260

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fc:d4:62:79:d3:de:cc:d3:32:16:18:f8:8e:66:65:35:59:0b:03:89:1c:8b:2d:f2:f2:07:f6:1a:06:bf:34:25
Signer

Actual PE Digest

fc:d4:62:79:d3:de:cc:d3:32:16:18:f8:8e:66:65:35:59:0b:03:89:1c:8b:2d:f2:f2:07:f6:1a:06:bf:34:25

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

PDB Paths

WimProvider.pdb

Imports

msvcrt

_vsnwprintf_s
_vsnprintf_s
towupper
_wtoi64
iswspace
iswalpha
_wcsnicmp
wcsstr
memcmp
memcpy
memmove
_errno
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
??0exception@@QEAA@AEBQEBDH@Z
malloc
_wcsicmp
wcstoul
_vsnwprintf
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBV0@@Z
wcsncmp
wcschr
wcscat_s
memmove_s
calloc
__RTDynamicCast
wcstok_s
_wtol
wcscpy_s
wcsncpy_s
wcsrchr
free
_stricmp
_vscwprintf
_strnicmp
_purecall
vswprintf_s
memcpy_s
__C_specific_handler
__CxxFrameHandler3
memset

advapi32

EventActivityIdControl
EventWriteTransfer
RegQueryValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
EventRegister
EventUnregister

kernel32

RemoveDirectoryW
WriteFile
ReadFile
IsDebuggerPresent
DebugBreak
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
ReleaseSemaphore
CreateSemaphoreExW
LocalAlloc
CreateEventW
GetOverlappedResult
LoadLibraryW
GetVolumePathNamesForVolumeNameW
VirtualProtect
SetLastError
EnterCriticalSection
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSection
GetCurrentThreadId
OutputDebugStringW
DeleteCriticalSection
GetCurrentProcessId
GetModuleHandleW
LoadLibraryExW
HeapFree
GetProcessHeap
GetFullPathNameW
HeapReAlloc
HeapAlloc
GetLastError
CompareStringW
GetProcAddress
FreeLibrary
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
RaiseException
LocalFree
DeleteFileW
GetLocaleInfoW
GetNumberFormatW
FileTimeToLocalFileTime
FileTimeToSystemTime
GetDateFormatW
GetTimeFormatW
SystemTimeToFileTime
FindFirstFileNameW
LoadLibraryExA
FindClose
SizeofResource
LockResource
LoadResource
FindResourceExW
HeapSize
HeapDestroy
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetTickCount
OutputDebugStringA
GetFileAttributesW
GetSystemInfo
FindNextFileW
FindFirstFileW
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
GetFileInformationByHandle
CreateDirectoryW
CloseHandle
CreateFileW
FormatMessageW
SetThreadUILanguage
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
VirtualQuery
DeviceIoControl
SetFileAttributesW
GetFinalPathNameByHandleW
GetModuleFileNameA
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
GetVersionExW
SearchPathW
WaitForSingleObject
GetPrivateProfileSectionW
GetDriveTypeW
FindNextFileNameW
GetSystemTimeAsFileTime

ole32

CoTaskMemFree
ProgIDFromCLSID
CoCreateInstance
StringFromGUID2
CLSIDFromString

user32

CharUpperW
LoadStringW
CharNextW
CharLowerBuffW

oleaut32

RegisterTypeLi
UnRegisterTypeLi
SysAllocStringByteLen
SysAllocStringLen
CreateErrorInfo
SetErrorInfo
LoadRegTypeLi
LoadTypeLi
SysFreeString
SysAllocString
SysStringLen
VariantClear
VarBstrCmp
VariantTimeToSystemTime
SysStringByteLen
VarDateFromStr

xmllite

CreateXmlWriter
CreateXmlReader

profapi

ord104

ntdll

RtlReAllocateHeap
RtlFreeHeap
RtlAllocateHeap
RtlNtStatusToDosError
RtlRaiseStatus
NtYieldExecution

Exports

Exports

DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 378KB - Virtual size: 377KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 130KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 328B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/AppxProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 21KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/AssocProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/CbsProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/DismCore.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/DismProv.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/DmiProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/FfuProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/FolderProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/GenericProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/IBSProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/ImagingProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/IntlProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 26KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/LogProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/MsiProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/OSProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/OfflineSetupProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/ProvProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/SetupPlatformProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/SmiProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/SysprepProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/TransmogProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/UnattendProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/VhdProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/en-US/WimProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 26KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/AppxProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 23KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/AssocProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/CbsProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 55KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/DismCore.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/DismProv.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/DmiProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/FfuProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/FolderProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/GenericProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/ImagingProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/IntlProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 28KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/LogProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/MsiProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/OSProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/OfflineSetupProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/ProvProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/SetupPlatformProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/SmiProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/TransmogProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/UnattendProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/VhdProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
940EBDD3-EB46-4A91-BF3C-D15D21AAB029/pt-BR/WimProvider.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2e13c2bc4f0c9ed9f72b86e3c4cff318

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

14:1c:1d:cd:3d:ac:b4:a1:f3:e7:37:e8:fd:fe:5b:54:98:93:fe:d6:65:a1:29:1b:16:d6:a8:76:7f:ea:09:45Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

advapi32

kernel32

ole32

shlwapi

user32

oleaut32

ext-ms-win-session-winsta-l1-1-0

api-ms-win-core-path-l1-1-0

bcrypt

api-ms-win-core-winrt-l1-1-0

Exports

Exports

Sections

.text Size: 323KB - Virtual size: 322KB

.rdata Size: 187KB - Virtual size: 187KB

.data Size: 16KB - Virtual size: 18KB

.pdata Size: 11KB - Virtual size: 10KB

.didat Size: 512B - Virtual size: 288B

.rsrc Size: 23KB - Virtual size: 23KB

.reloc Size: 2KB - Virtual size: 2KB

e1921d401583d0d512d1a8ec5d16429d

Code Sign

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

cf:a9:89:3e:54:6d:6f:75:5c:91:6f:ac:bb:dd:61:33:17:ae:ce:0d:c6:49:51:5a:d3:7d:08:6a:05:56:28:d6Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

kernel32

advapi32

user32

ole32

oleaut32

shell32

Exports

Exports

Sections

.text Size: 49KB - Virtual size: 48KB

.rdata Size: 33KB - Virtual size: 32KB

.data Size: 8KB - Virtual size: 9KB

.pdata Size: 3KB - Virtual size: 2KB

.rsrc Size: 9KB - Virtual size: 8KB

.reloc Size: 1024B - Virtual size: 908B

3e8a2fa3ee3b10848f33ec53056f9da2

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

9d:70:c9:69:9c:0d:63:09:70:2e:5a:ca:75:c7:6d:77:66:31:56:8f:f4:9f:6e:c5:19:b9:79:e7:e5:36:86:96Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

14:1c:1d:cd:3d:ac:b4:a1:f3:e7:37:e8:fd:fe:5b:54:98:93:fe:d6:65:a1:29:1b:16:d6:a8:76:7f:ea:09:45
Signer

.text
Size: 323KB - Virtual size: 322KB

.rdata
Size: 187KB - Virtual size: 187KB

.data
Size: 16KB - Virtual size: 18KB

.pdata
Size: 11KB - Virtual size: 10KB

.didat
Size: 512B - Virtual size: 288B

.rsrc
Size: 23KB - Virtual size: 23KB

.reloc
Size: 2KB - Virtual size: 2KB

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

cf:a9:89:3e:54:6d:6f:75:5c:91:6f:ac:bb:dd:61:33:17:ae:ce:0d:c6:49:51:5a:d3:7d:08:6a:05:56:28:d6
Signer

.text
Size: 49KB - Virtual size: 48KB

.rdata
Size: 33KB - Virtual size: 32KB

.data
Size: 8KB - Virtual size: 9KB

.pdata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 9KB - Virtual size: 8KB

.reloc
Size: 1024B - Virtual size: 908B

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

9d:70:c9:69:9c:0d:63:09:70:2e:5a:ca:75:c7:6d:77:66:31:56:8f:f4:9f:6e:c5:19:b9:79:e7:e5:36:86:96
Signer

.text
Size: 559KB - Virtual size: 559KB

.rdata
Size: 251KB - Virtual size: 251KB

.data
Size: 22KB - Virtual size: 24KB

.pdata
Size: 16KB - Virtual size: 16KB

.rsrc
Size: 55KB - Virtual size: 55KB

.reloc
Size: 3KB - Virtual size: 3KB

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

b4:7c:66:f0:7e:ec:32:96:0d:25:0f:2a:b5:85:6a:83:95:bc:4b:d4:57:a8:7d:d8:09:c8:98:d7:e1:98:47:d6
Signer

.text
Size: 188KB - Virtual size: 188KB

.rdata
Size: 94KB - Virtual size: 94KB

.data
Size: 7KB - Virtual size: 10KB

.pdata
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 93KB - Virtual size: 92KB

.reloc
Size: 1KB - Virtual size: 1KB

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

7d:4c:85:eb:fa:80:8f:49:e0:1e:8b:99:c6:11:27:cd:a4:45:3a:2f:1d:aa:4e:5b:89:77:90:fa:e5:0e:fe:b5
Signer

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 124KB - Virtual size: 124KB

.data
Size: 28KB - Virtual size: 29KB

.pdata
Size: 512B - Virtual size: 492B