jjkj (2).zip
- SHA256 a79e0af13f5666e6bf70f1a423a1e89c48c7eb540afb7cb1cd61e146c104a009
Password
2024
Overview
overview
10Static
static
3jjkj/SEMgrPS.dll
windows10-2004-x64
1jjkj/SensApi.dll
windows10-2004-x64
1jjkj/Solara.exe
windows7-x64
3jjkj/Solara.exe
windows10-2004-x64
10jjkj/lib/S...ll.dll
windows10-2004-x64
1jjkj/lib/S...ol.dll
windows10-2004-x64
1jjkj/lib/S...as.dll
windows10-2004-x64
1jjkj/lib/S...ss.dll
windows10-2004-x64
1jjkj/lib/S...on.dll
windows10-2004-x64
1jjkj/lib/S...ps.dll
windows10-2004-x64
1jjkj/lib/S...ge.dll
windows10-2004-x64
1jjkj/lib/S...er.dll
windows10-2004-x64
1jjkj/lib/S...ss.dll
windows10-2004-x64
1jjkj/lib/S...rd.dll
windows10-2004-x64
1jjkj/lib/S...ng.dll
windows10-2004-x64
1jjkj/lib/S...er.dll
windows10-2004-x64
1jjkj/lib/S...na.dll
windows10-2004-x64
1jjkj/lib/S...es.dll
windows10-2004-x64
1jjkj/lib/s...ns.dll
windows10-2004-x64
1jjkj/sedplugins.dll
windows10-2004-x64
1jjkj/sendmail.dll
windows10-2004-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jjkj/SEMgrPS.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
jjkj/SensApi.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
jjkj/Solara.exe
Resource
win7-20240705-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
jjkj/Solara.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral5
Sample
jjkj/lib/SettingsHandlers_AnalogShell.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
jjkj/lib/SettingsHandlers_AppControl.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
jjkj/lib/SettingsHandlers_AppExecutionAlias.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
jjkj/lib/SettingsHandlers_AssignedAccess.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
jjkj/lib/SettingsHandlers_Authentication.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
jjkj/lib/SettingsHandlers_BackgroundApps.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
jjkj/lib/SettingsHandlers_BatteryUsage.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
jjkj/lib/SettingsHandlers_BrowserDeclutter.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
jjkj/lib/SettingsHandlers_CapabilityAccess.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
jjkj/lib/SettingsHandlers_Clipboard.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
jjkj/lib/SettingsHandlers_ClosedCaptioning.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
jjkj/lib/SettingsHandlers_ContentDeliveryManager.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
jjkj/lib/SettingsHandlers_Cortana.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
jjkj/lib/SettingsHandlers_Devices.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
jjkj/lib/sedplugins.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
jjkj/sedplugins.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
jjkj/sendmail.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target jjkj (2).zip
- Size 2.4MB
- Sample240707-cqeaaa1dlk
- SHA256 a79e0af13f5666e6bf70f1a423a1e89c48c7eb540afb7cb1cd61e146c104a009
- MD5 678f8c0b8c9e5ced7471ce8e9a3a1fea
- SHA1 1e7d421ffcd66a188eb4342c12159168d650d95d
- SHA512 60314fbe817b9f4c2b334c14f94382e60197e3991823e56e024da94237948aa3505390e288e11e411d03d99c6af45f50f6ee73ad73cc69ff2e737578564c832c
- SSDEEP 49152:vT6FikVauQ9WUY1TY6wKtl1nCGrwYqRYR4De9pT6FikVWAjCqg+sp8o:dkVaJ9hrNq1nCjVRYi6FkVWMCqG8o
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 18 IoCs
Checks for missing Authenticode signature.
resource unpack001/jjkj/SEMgrPS.dll unpack001/jjkj/SensApi.dll unpack001/jjkj/Solara.exe unpack001/jjkj/lib/SettingsHandlers_AnalogShell.dll unpack001/jjkj/lib/SettingsHandlers_AppControl.dll unpack001/jjkj/lib/SettingsHandlers_AppExecutionAlias.dll unpack001/jjkj/lib/SettingsHandlers_AssignedAccess.dll unpack001/jjkj/lib/SettingsHandlers_Authentication.dll unpack001/jjkj/lib/SettingsHandlers_BackgroundApps.dll unpack001/jjkj/lib/SettingsHandlers_BatteryUsage.dll unpack001/jjkj/lib/SettingsHandlers_BrowserDeclutter.dll unpack001/jjkj/lib/SettingsHandlers_CapabilityAccess.dll unpack001/jjkj/lib/SettingsHandlers_Clipboard.dll unpack001/jjkj/lib/SettingsHandlers_ClosedCaptioning.dll unpack001/jjkj/lib/SettingsHandlers_ContentDeliveryManager.dll unpack001/jjkj/lib/SettingsHandlers_Cortana.dll unpack001/jjkj/lib/SettingsHandlers_Devices.dll unpack001/jjkj/sendmail.dll
File Explorer
-
jjkj (2).zip.zip 2.4MB
-
jjkj/SEMgrPS.dll.dll 40KB
-
jjkj/SensApi.dll.dll 14KB
-
jjkj/Solara.exe.exe 60.5MB
-
jjkj/lib/SettingsHandlers_AnalogShell.dll.dll 234KB
-
jjkj/lib/SettingsHandlers_AppControl.dll.dll 101KB
-
jjkj/lib/SettingsHandlers_AppExecutionAlias.dll.dll 155KB
-
jjkj/lib/SettingsHandlers_AssignedAccess.dll.dll 376KB
-
jjkj/lib/SettingsHandlers_Authentication.dll.dll 324KB
-
jjkj/lib/SettingsHandlers_BackgroundApps.dll.dll 151KB
-
jjkj/lib/SettingsHandlers_BatteryUsage.dll.dll 244KB
-
jjkj/lib/SettingsHandlers_BrowserDeclutter.dll.dll 151KB
-
jjkj/lib/SettingsHandlers_CapabilityAccess.dll.dll 294KB
-
jjkj/lib/SettingsHandlers_Clipboard.dll.dll 194KB
-
jjkj/lib/SettingsHandlers_ClosedCaptioning.dll.dll 140KB
-
jjkj/lib/SettingsHandlers_ContentDeliveryManager.dll.dll 173KB
-
jjkj/lib/SettingsHandlers_Cortana.dll.dll 320KB
-
jjkj/lib/SettingsHandlers_Devices.dll.dll 593KB
-
jjkj/lib/sedplugins.dll.dll 574KB
-
jjkj/sedplugins.dll.dll 574KB
-
jjkj/sendmail.dll.dll 144KB
jjkj/SEMgrPS.dll
- IMPHASH 7dcc2d309d96727b06e1bbb65b6597f9
- SHA256 5edd09d2a2e2e03ac2fa7db4c7b9f4ee300c696534788dbedaf9cee617a97ab1
- MD5 76e12d39f82567db28b132e245d9e3ce
- SHA1 53cbd54614b8e21e78096d32ddebf0771b359c37
- SHA512 62de3ef3caf4997e0f1b02f5805a5da757c7506dcf5e6f93ed9870b6a53858dd24f588700dc2e6cd1d524291fb0fe1968169a52c53e9253244f7ebd633b89f4a
- SSDEEP 384:tASguFmJEqu2MZ3RDil1jt9exCUF9n10jaTANQ+1Lxdprb4Y75WRkWmmca9pa:KK9JbyFUF910GANQ+1pgYg
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
2024
Minor OS version
0
Major OS version
10
Entry point
5472
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
SEMgrPS.pdb
msvcrt
__C_specific_handler
malloc
_initterm
free
_amsg_exit
_XcptFilter
rpcrt4
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Connect
NdrCStdStubBuffer2_Release
NdrStubForwardingFunction
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
CStdStubBuffer_Invoke
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
CStdStubBuffer_QueryInterface
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_CountRefs
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
NdrStubCall3
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-winrt-string-l1-1-0
HSTRING_UserUnmarshal64
HSTRING_UserSize
HSTRING_UserSize64
HSTRING_UserFree
HSTRING_UserMarshal64
HSTRING_UserUnmarshal
HSTRING_UserFree64
HSTRING_UserMarshal
api-ms-win-core-com-midlproxystub-l1-1-0
ObjectStublessClient7
ObjectStublessClient15
NdrProxyForwardingFunction23
ObjectStublessClient6
ObjectStublessClient8
ObjectStublessClient9
NdrProxyForwardingFunction21
ObjectStublessClient3
ObjectStublessClient10
ObjectStublessClient5
ObjectStublessClient11
ObjectStublessClient14
ObjectStublessClient12
ObjectStublessClient30
ObjectStublessClient16
NdrProxyForwardingFunction9
ObjectStublessClient18
NdrProxyForwardingFunction11
NdrProxyForwardingFunction13
NdrProxyForwardingFunction29
NdrProxyForwardingFunction12
ObjectStublessClient4
NdrProxyForwardingFunction10
CStdStubBuffer2_CountRefs
NdrProxyForwardingFunction6
CStdStubBuffer2_Disconnect
CStdStubBuffer2_QueryInterface
NdrProxyForwardingFunction4
NdrProxyForwardingFunction5
NdrProxyForwardingFunction3
NdrProxyForwardingFunction7
ObjectStublessClient13
CStdStubBuffer2_Connect
ObjectStublessClient22
ObjectStublessClient27
NdrProxyForwardingFunction19
ObjectStublessClient28
ObjectStublessClient20
ObjectStublessClient23
ObjectStublessClient19
ObjectStublessClient26
ObjectStublessClient17
ObjectStublessClient29
ObjectStublessClient21
ObjectStublessClient24
ObjectStublessClient25
NdrProxyForwardingFunction27
NdrProxyForwardingFunction26
NdrProxyForwardingFunction24
NdrProxyForwardingFunction18
NdrProxyForwardingFunction22
NdrProxyForwardingFunction17
NdrProxyForwardingFunction14
ObjectStublessClient31
NdrProxyForwardingFunction15
NdrProxyForwardingFunction20
NdrProxyForwardingFunction28
NdrProxyForwardingFunction8
NdrProxyForwardingFunction16
NdrProxyForwardingFunction25
oleaut32
BSTR_UserUnmarshal
BSTR_UserFree
BSTR_UserUnmarshal64
BSTR_UserSize
BSTR_UserMarshal
BSTR_UserFree64
BSTR_UserMarshal64
BSTR_UserSize64
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
264B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=259, version=27412,
count=10, id=260, version=27412,
count=122, id=1, productName=Unmarked objects,
count=3, id=257, version=27412,
count=1, id=256, version=27412,
count=10, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
jjkj/SensApi.dll
- IMPHASH c34715179b656bb994d569fb12d49645
- SHA256 ae507d88c83271e1ef0e8ace3f3782be042f157c1b8018e852a9b1d2f0e98727
- MD5 738256d2e39103441efe79e2c17c39cd
- SHA1 133ca3ac0923dd862e1f75d2734f9f6547c04a18
- SHA512 8b2f702199778331948ca8ae984313ee532e66b448320d114ce837444ae823663c9063bd694e9edbcb0d84dce2a27baa76a1a9e0e494cf952fead0cba5057293
- SSDEEP 192:LTSZrurwtlbbvcuXnmbtwUrDOtFMYLlFMI99tQRyEtHl1/uLVW+KW:Sr7bNXmbtfrDOtuSP/9wRlHj/sW+KW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
2024
Minor OS version
0
Major OS version
10
Entry point
6000
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
SensApi.pdb
msvcrt
_XcptFilter
__C_specific_handler
_amsg_exit
free
malloc
_initterm
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-memory-l1-1-0
MapViewOfFile
OpenFileMappingW
UnmapViewOfFile
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-synch-l1-1-0
InitializeCriticalSection
EnterCriticalSection
DeleteCriticalSection
LeaveCriticalSection
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-sysinfo-l1-2-0
GetOsSafeBootMode
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
ntdll
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
IsDestinationReachableA
IsDestinationReachableW
IsNetworkAlive
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
116B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=26, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=259, version=27412,
count=10, id=260, version=27412,
count=44, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=1, id=256, version=27412,
count=5, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
jjkj/Solara.exe
- IMPHASH b1fdca67f9b8dae5c0fa30f8218d4955
- SHA256 e2f4755f73aec0977f1d6a04732eb1239a7c8b2f88049e4136c2720c95cac6b9
- MD5 d8c788d251a84e00189ed5dcb00da40e
- SHA1 b745a5059ff6c12cc6b25ee40ae20e2df6d55a7c
- SHA512 6eb4a3960e17baad8490c02ee6036a6fba3c9cc48ad340327778618b6e6e6e2d897dd33154cf6aedd511b713e9fcbb484d28c0dfbf092c3624a154d22582d39b
- SSDEEP 12288:0oxruugE3QDZcobhawYWhBuspcRMWsR5Zazx:0oxCugEAtZwWhBKsDsz
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
2024
Minor OS version
0
Major OS version
6
Entry point
53102
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
OffsetRect
kernel32
CreateFileW
HeapSize
SetStdHandle
WaitForSingleObject
Sleep
CreateThread
VirtualAlloc
FreeConsole
RaiseException
InitOnceBeginInitialize
InitOnceComplete
CloseHandle
WaitForSingleObjectEx
GetCurrentThreadId
GetExitCodeThread
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
GetLastError
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
GetModuleHandleExW
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
QueryPerformanceCounter
EncodePointer
DecodePointer
LCMapStringEx
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
GetCPInfo
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
InitializeSListHead
GetProcessHeap
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitThread
FreeLibraryAndExitThread
ExitProcess
GetModuleFileNameW
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
ReadConsoleW
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
WriteConsoleW
AwakeSound
Name
.text
Size
168KB
Virtual Size
167KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.bSS
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
50KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
280KB
Virtual Size
284KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=259, version=29395,
count=173, id=261, version=29395,
count=22, id=260, version=29395,
count=18, id=260, version=33218,
count=7, id=257, version=29395,
count=134, id=1, productName=Unmarked objects,
count=93, id=261, version=33218,
count=24, id=259, version=33218,
count=1, id=261, version=33523,
count=1, id=256, version=33523,
count=1, id=255, version=33523,
count=1, id=258, version=33523,
jjkj/lib/SettingsHandlers_AnalogShell.dll
- IMPHASH 647aab0d0361079267ebb2eed3950a2f
- SHA256 06d29294dd229e0886fe19c110ff96bb7d025a7985d597a79be7f57c89157f89
- MD5 22a562def013921095d0e54787a620fd
- SHA1 2a260f351c4aa0338a7fe9fc08452889ea97665f
- SHA512 0928a68a08e0f45b86760eabdc406371942a1d2a034db95929f615f1e73eb44a6e437c378b98dce7df436c040d23c6d989556b2ea7bd026740d9eb34c8731fb0
- SSDEEP 3072:BS8YGOtOdpUBlD/ENYhgLXvC9TZDY4o13utA9WHdI8qphSio7K:Yh2Q2CKLfCdLoGIW9rqphSi
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
2024
Minor OS version
0
Major OS version
10
Entry point
136880
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
SettingsHandlers_AnalogShell.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__get_errno
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
memcmp
_o_bsearch_s
_o_free
_o_malloc
_o_realloc
_o_terminate
__C_specific_handler
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_CxxThrowException
memcpy
memmove
__CxxFrameHandler3
_o___std_exception_destroy
_o___std_exception_copy
_o__execute_onexit_table
_o__errno
__std_terminate
__CxxFrameHandler4
api-ms-win-crt-string-l1-1-0
memset
ntdll
NtQueryWnfStateData
RtlGetDeviceFamilyInfoEnum
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
DisableThreadLibraryCalls
GetProcAddress
GetModuleFileNameA
GetModuleHandleExW
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
CreateMutexExW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockShared
InitializeCriticalSectionEx
SetEvent
ReleaseMutex
InitializeSRWLock
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
ReleaseSemaphore
CreateEventExW
WaitForMultipleObjectsEx
CreateSemaphoreExW
LeaveCriticalSection
EnterCriticalSection
CreateEventW
ResetEvent
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
RaiseException
SetLastError
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetProcessId
GetExitCodeProcess
GetCurrentThreadId
CreateThread
GetCurrentProcessId
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsDuplicateString
WindowsCreateStringReference
WindowsConcatString
WindowsGetStringRawBuffer
WindowsPreallocateStringBuffer
WindowsDeleteStringBuffer
WindowsPromoteStringBuffer
WindowsCreateString
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
CompareStringOrdinal
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
SetRestrictedErrorInfo
RoTransformError
GetRestrictedErrorInfo
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceComplete
InitOnceExecuteOnce
InitOnceBeginInitialize
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemDirectoryW
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
msvcp_win
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?flags@ios_base@std@@QEBAHXZ
?width@ios_base@std@@QEBA_JXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?width@ios_base@std@@QEAA_J_J@Z
?uncaught_exception@std@@YA_NXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Xbad_function_call@std@@YAXXZ
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@N@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z
?good@ios_base@std@@QEBA_NXZ
?_Xlength_error@std@@YAXPEBD@Z
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
ext-ms-win-rtcore-ntuser-sysparams-l1-1-0
DisplayConfigGetDeviceInfo
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
api-ms-win-core-com-l1-1-0
CoGetMalloc
CoTaskMemFree
CoCreateGuid
CoTaskMemRealloc
CoCreateFreeThreadedMarshaler
CoInitializeEx
CoUninitialize
CoWaitForMultipleHandles
CoDecrementMTAUsage
CoCreateInstance
CoTaskMemAlloc
CoIncrementMTAUsage
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoInitialize
RoUninitialize
api-ms-win-core-winrt-error-l1-1-1
RoReportFailedDelegate
IsErrorPropagationEnabled
RoOriginateLanguageException
RoGetMatchingRestrictedErrorInfo
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventWriteTransfer
EventUnregister
EventRegister
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegGetValueW
RegFlushKey
RegSetValueExW
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-sysinfo-l1-2-0
GetProductInfo
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-registry-l2-1-0
RegOpenKeyW
api-ms-win-core-localization-obsolete-l1-2-0
GetUserDefaultUILanguage
coremessaging
CoreUICallSend
CoreUICreate
CoreUICallReceive
CoreUICallCreateEndpointHost
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
shell32
ShellExecuteExW
user32
GetWindowThreadProcessId
SendMessageW
SetTimer
GetWindowRect
GetProcessDefaultLayout
EnumWindows
shcore
ord230
ord244
ord233
SHCreateThread
ord232
oleaut32
SysFreeString
DllCanUnloadNow
DllGetClassObject
GetSetting
Name
.text
Size
153KB
Virtual Size
153KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
62KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=85, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=11, id=260, version=27412,
count=3, id=259, version=27412,
count=1264, id=1, productName=Unmarked objects,
count=12, id=257, version=27412,
count=1, id=256, version=27412,
count=32, id=264, version=27412,
count=33, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
jjkj/lib/SettingsHandlers_AppControl.dll
- IMPHASH 231a8d63aebdde37471deb0c7ddb31b1
- SHA256 070bc8975a8a2a72480861edab1a040fc91847dd4e4f3deecfb52e40a2c8e8a9
- MD5 b0aa59d540b22f00d1db216a30cb51f0
- SHA1 8d9985980cd63ed0fa6c042db47879d68c081058
- SHA512 0cbe2c957496c002785770780cf7bf04db9e734b4da59cf028d0014f1c939c6ccc83f1c41bd47ace80bb0aa9b5f3e80499801b3821a257c93c7b7bc65fbe9145
- SSDEEP 3072:YLalDfGNwJ7ouT7jF3YHGybXH1k+Dy4M9IQd:LlzbJtT7jF3YHG2H1kYCI
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
2024
Minor OS version
0
Major OS version
10
Entry point
55088
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
SettingsHandlers_AppControl.pdb
msvcrt
__C_specific_handler
_initterm
_XcptFilter
??3@YAXPEAX@Z
?terminate@@YAXXZ
malloc
bsearch_s
free
_amsg_exit
memmove
_vsnwprintf
??_V@YAXPEAX@Z
_purecall
memmove_s
realloc
memcpy_s
??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBV0@@Z
_vsnprintf_s
??1type_info@@UEAA@XZ
_lock
__CxxFrameHandler3
_unlock
_onexit
__dllonexit
_callnewh
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
?what@exception@@UEBAPEBDXZ
_CxxThrowException
memcpy
memset
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
GetProcAddress
GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExW
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsDeleteString
WindowsCreateStringReference
WindowsGetStringRawBuffer
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
CreateThread
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetExitCodeProcess
GetProcessId
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-errorhandling-l1-1-0
SetLastError
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
OpenSemaphoreW
WaitForSingleObjectEx
DeleteCriticalSection
CreateEventExW
CreateMutexExW
ReleaseMutex
WaitForSingleObject
AcquireSRWLockShared
InitializeSRWLock
AcquireSRWLockExclusive
ReleaseSemaphore
WaitForMultipleObjectsEx
CreateSemaphoreExW
LeaveCriticalSection
ReleaseSRWLockShared
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
api-ms-win-core-winrt-l1-1-0
RoInitialize
RoUninitialize
RoGetActivationFactory
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-winrt-error-l1-1-1
RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
RoOriginateError
api-ms-win-core-com-l1-1-0
CoInitializeEx
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
CoCreateFreeThreadedMarshaler
CoUninitialize
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-rtcore-ntuser-window-l1-1-0
SendMessageW
GetWindowThreadProcessId
EnumWindows
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
GetSetting
Name
.text
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=42, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=260, version=27412,
count=3, id=259, version=27412,
count=111, id=1, productName=Unmarked objects,
count=3, id=257, version=27412,
count=12, id=261, version=27412,
count=1, id=256, version=27412,
count=6, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
jjkj/lib/SettingsHandlers_AppExecutionAlias.dll
- IMPHASH 529fb0d47ecfe386a173faa125ba8801
- SHA256 8819132a9c29688cef9a0523d15f5bc4bd7c663c0c77ca1a02071bc6bda2ec85
- MD5 b6c030927e1556240ccb24686738e6ad
- SHA1 b6e285dfcf26ac9b87b3f355057cdbbd0448d161
- SHA512 25c31532035da8570fb729c7cff58a21f47516cefd492a958c90a688afe05523a325d1a1b8b3cca32d875b9eb8cce605ee611ed05e2ff9b349de85473a432b5d
- SSDEEP 3072:XgMuPlKp9xRVukhF66ApyFZKmidt7rjO258FHJUv12zNTS0:X1uPw/xL9AIFZKV75WpUNoS
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
2024
Minor OS version
0
Major OS version
10
Entry point
105296
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
SettingsHandlers_AppExecutionAlias.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_bsearch_s
_o_free
_o_malloc
_o_realloc
_o_terminate
_o_wcscat_s
_o_wcscpy_s
__C_specific_handler
__CxxFrameHandler3
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o__crt_atexit
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o__configure_narrow_argv
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
_CxxThrowException
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetModuleHandleExW
FreeLibrary
DisableThreadLibraryCalls
GetModuleHandleW
GetProcAddress
api-ms-win-core-winrt-string-l1-1-0
WindowsConcatString
WindowsCreateStringReference
WindowsDeleteString
WindowsCreateString
WindowsCompareStringOrdinal
WindowsGetStringRawBuffer
WindowsDuplicateString
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
CreateThread
GetCurrentThread
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
OpenThreadToken
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
SetLastError
SetUnhandledExceptionFilter
RaiseException
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionEx
InitializeSRWLock
WaitForSingleObject
OpenSemaphoreW
ReleaseMutex
AcquireSRWLockShared
CreateMutexExW
CreateEventW
CreateSemaphoreExW
ReleaseSRWLockExclusive
WaitForSingleObjectEx
LeaveCriticalSection
EnterCriticalSection
ReleaseSemaphore
SetEvent
DeleteCriticalSection
AcquireSRWLockExclusive
ResetEvent
ReleaseSRWLockShared
api-ms-win-shcore-thread-l1-1-0
SHCreateThread
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-com-l1-1-0
CoInitializeEx
CoIncrementMTAUsage
CoTaskMemRealloc
CoCreateFreeThreadedMarshaler
CoDecrementMTAUsage
CoGetMalloc
CoTaskMemAlloc
CoWaitForMultipleHandles
CoUninitialize
CoCreateInstance
CoTaskMemFree
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
RoOriginateError
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventWriteTransfer
EventRegister
EventUnregister
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegGetValueW
RegOpenKeyExW
api-ms-win-core-winrt-error-l1-1-1
IsErrorPropagationEnabled
RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
api-ms-win-core-winrt-l1-1-0
RoInitialize
RoGetActivationFactory
RoUninitialize
RoActivateInstance
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
api-ms-win-core-file-l1-1-0
GetFileAttributesW
DeleteFileW
CreateFileW
api-ms-win-shcore-obsolete-l1-1-0
SHStrDupW
api-ms-win-security-base-l1-1-0
ImpersonateLoggedOnUser
RevertToSelf
api-ms-win-core-threadpool-legacy-l1-1-0
QueueUserWorkItem
api-ms-win-core-localization-l1-2-0
FormatMessageW
ext-ms-win-shell32-shellfolders-l1-1-0
SHGetKnownFolderPath
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-path-l1-1-0
PathCchAppend
api-ms-win-appmodel-runtime-l1-1-1
ParseApplicationUserModelId
ext-ms-win-appmodel-appexecutionalias-l1-1-0
CloseAppExecutionAliasEx
GetAppExecutionAliasExecutableEx
PersistAppExecutionAliasToFileEx
OpenAppExecutionAliasForUserEx
GetAppExecutionAliasPackageFamilyNameEx
GetAppExecutionAliasApplicationUserModelIdEx
ext-ms-win-appmodel-appexecutionalias-l1-1-1
GetAppExecutionAliasApplicationType
CreateAppExecutionAliasEx2
msvcp_win
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?_Xlength_error@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
GetSetting
Name
.text
Size
109KB
Virtual Size
109KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=73, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=11, id=260, version=27412,
count=3, id=259, version=27412,
count=1205, id=1, productName=Unmarked objects,
count=2, id=257, version=27412,
count=1, id=256, version=27412,
count=5, id=264, version=27412,
count=28, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
jjkj/lib/SettingsHandlers_AssignedAccess.dll
- IMPHASH bd7e53744fa10c044c4e8accd3f604a2
- SHA256 aa55a05a4d6cc46b429fe2cfcaefae62a945b8ffccf4b6f7e9214b7dedb0bec5
- MD5 b6c594be6cdf9744614a7331f68c0c9e
- SHA1 962112c4dcca10ac791bcb92a71029a314e94ee9
- SHA512 af9493fd5e9284eae3d4f05bf3d501734c48f9b95051c5baef086e1bb6971015abf322bda44414c90d81dd11d79103ac9991a37f3b9dab68bff02021760cb96f
- SSDEEP 6144:afmx/zEcj6btDu8XiLhKRON/eqEjT6wTRWlV0ed3ZkK+:5zRatDuEiL0ROlNE5Timed6
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
2024
Minor OS version
0
Major OS version
10
Entry point
241696
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
SettingsHandlers_AssignedAccess.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__get_errno
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
memmove
_o__wcsicmp
_o_bsearch_s
_o_free
_o_iswspace
_o_malloc
_o_realloc
_o_terminate
_o_tolower
_o_wcscat_s
_o_wcscpy_s
_o_wcstol
__C_specific_handler
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o__execute_onexit_table
_CxxThrowException
_o___stdio_common_vswprintf
__CxxFrameHandler3
_o___stdio_common_vsnprintf_s
_o__errno
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
GetModuleHandleExW
api-ms-win-core-synch-l1-1-0
CreateSemaphoreExW
AcquireSRWLockShared
ReleaseSRWLockShared
SetEvent
InitializeCriticalSectionEx
InitializeCriticalSectionAndSpinCount
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
OpenSemaphoreW
WaitForSingleObjectEx
CreateMutexExW
LeaveCriticalSection
DeleteCriticalSection
ReleaseMutex
CreateEventW
WaitForSingleObject
ResetEvent
ReleaseSemaphore
EnterCriticalSection
InitializeSRWLock
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
UnhandledExceptionFilter
RaiseException
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
TerminateProcess
GetCurrentThread
OpenThreadToken
GetCurrentProcess
GetCurrentThreadId
CreateThread
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-winrt-string-l1-1-0
WindowsConcatString
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsDuplicateString
WindowsCreateString
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
CompareStringEx
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemDirectoryW
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoActivateInstance
RoUninitialize
RoInitialize
api-ms-win-core-com-l1-1-0
CoUninitialize
CoInitializeEx
PropVariantClear
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoWaitForMultipleHandles
CoTaskMemRealloc
CoGetMalloc
CoTaskMemAlloc
CoDecrementMTAUsage
CoCreateInstance
CoIncrementMTAUsage
api-ms-win-core-winrt-error-l1-1-1
RoReportFailedDelegate
IsErrorPropagationEnabled
RoGetMatchingRestrictedErrorInfo
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
RoOriginateError
api-ms-win-shcore-obsolete-l1-1-0
SHStrDupW
api-ms-win-core-threadpool-legacy-l1-1-0
QueueUserWorkItem
api-ms-win-security-base-l1-1-0
ImpersonateLoggedOnUser
RevertToSelf
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventUnregister
EventSetInformation
EventRegister
EventActivityIdControl
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
Sleep
api-ms-win-security-sddl-l1-1-0
ConvertStringSidToSidW
ConvertSidToStringSidW
api-ms-win-security-lsalookup-l2-1-0
LookupAccountSidW
LookupAccountNameW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegOpenKeyExW
RegGetValueW
RegCloseKey
samcli
NetUserGetInfo
NetUserEnum
api-ms-win-core-kernel32-legacy-l1-1-0
GetComputerNameW
netutils
NetApiBufferFree
api-ms-win-shell-namespace-l1-1-0
SHCreateItemFromParsingName
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-sysinfo-l1-2-0
GetProductInfo
oleaut32
SafeArrayAccessData
SafeArrayGetLBound
SafeArrayUnaccessData
SafeArrayDestroy
SafeArrayGetVartype
SafeArrayGetDim
SafeArrayGetUBound
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer
api-ms-win-core-path-l1-1-0
PathCchAppend
api-ms-win-core-file-l1-1-0
GetFileAttributesW
api-ms-win-shcore-scaling-l1-1-1
ord244
api-ms-win-shcore-thread-l1-1-0
SHCreateThread
api-ms-win-core-shlwapi-obsolete-l1-1-0
QISearch
shell32
SHAssocEnumHandlersForProtocolByApplication
msvcp_win
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-crt-math-l1-1-0
ceilf
GetSetting
Name
.text
Size
257KB
Virtual Size
257KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
91KB
Virtual Size
90KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=97, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=12, id=260, version=27412,
count=3, id=259, version=27412,
count=1197, id=1, productName=Unmarked objects,
count=4, id=257, version=27412,
count=1, id=256, version=27412,
count=50, id=264, version=27412,
count=31, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
jjkj/lib/SettingsHandlers_Authentication.dll
- IMPHASH 2f042a812e1486a26e5a9cdddb4d8050
- SHA256 1060296c199bd32f70bfaef16ead33cde2fe6058215ebdd4879afda11daadbe5
- MD5 dd9bf0e72e1ec5050c1ee1def8e2b060
- SHA1 c8c2e4a590d039cea1ce8cdc84799a096673f77e
- SHA512 97297ede53b104cf06f0a572d2a12e5fc506ec7412e54062c63546faba643c65007e707dff8cf041316c10fa3c2a63ea52affcfca5cf95f5a036a2ceb071832d
- SSDEEP 6144:kdhiCCrZKse8k0vJfCJEUCxgrRa/dbnfaHdEucKk:C5se8Z6eUE8a/iyu
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
2024
Minor OS version
0
Major OS version
10
Entry point
225680
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
SettingsHandlers_Authentication.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_bsearch_s
_o_free
_o_malloc
_o_realloc
_o_terminate
__C_specific_handler
_o__crt_atexit
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o__execute_onexit_table
_o__configure_narrow_argv
_o__errno
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__cexit
_o__callnewh
__CxxFrameHandler3
_CxxThrowException
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
cryptngc
NgcFreeEnumState
NgcEnumContainers
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
CreateThread
OpenThreadToken
OpenProcessToken
GetCurrentThread
GetCurrentProcessId
GetExitCodeProcess
GetProcessId
GetCurrentProcess
GetCurrentThreadId
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleHandleW
GetModuleFileNameA
DisableThreadLibraryCalls
GetModuleHandleExW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-synch-l1-1-0
CreateEventW
OpenSemaphoreW
WaitForSingleObject
AcquireSRWLockShared
AcquireSRWLockExclusive
WaitForMultipleObjectsEx
DeleteCriticalSection
InitializeCriticalSectionEx
SetEvent
CreateEventExW
InitializeSRWLock
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
ReleaseMutex
ReleaseSemaphore
CreateSemaphoreExW
ReleaseSRWLockShared
CreateMutexExW
ReleaseSRWLockExclusive
api-ms-win-core-winrt-string-l1-1-0
WindowsCompareStringOrdinal
WindowsCreateStringReference
WindowsDeleteString
WindowsCreateString
WindowsGetStringRawBuffer
WindowsDuplicateString
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventActivityIdControl
EventRegister
EventUnregister
EventWriteTransfer
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-winrt-error-l1-1-0
SetRestrictedErrorInfo
RoTransformError
RoOriginateError
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceExecuteOnce
InitOnceBeginInitialize
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemDirectoryW
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-winrt-error-l1-1-1
IsErrorPropagationEnabled
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoTaskMemAlloc
CoUninitialize
CoInitializeEx
CoCreateFreeThreadedMarshaler
CoWaitForMultipleHandles
CoTaskMemFree
api-ms-win-core-winrt-l1-1-0
RoInitialize
RoActivateInstance
RoGetActivationFactory
RoUninitialize
ntdll
RtlIsMultiSessionSku
RtlIsMultiUsersInSessionSku
api-ms-win-rtcore-ntuser-window-l1-1-0
SendMessageW
GetWindowThreadProcessId
EnumWindows
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-sysinfo-l1-2-0
GetProductInfo
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
wldp
WldpQueryWindowsLockdownMode
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegSetValueExW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
GetSetting
Name
.text
Size
228KB
Virtual Size
227KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
74KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=27412,
count=89, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1211, id=1, productName=Unmarked objects,
count=10, id=260, version=27412,
count=3, id=259, version=27412,
count=1, id=256, version=27412,
count=25, id=264, version=27412,
count=30, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
jjkj/lib/SettingsHandlers_BackgroundApps.dll
- IMPHASH 394faad4042c6ef26a6554ff4e749c86
- SHA256 0135cb6b6864545d383da2f355d2715c301a7c2bb29a2a0f6172080946dd4ec4
- MD5 13bb077422ade76fd5e1850613cde23b
- SHA1 326bda4877351f15c863181f4724323d039cb287
- SHA512 6f681bc5df42052ee144cb54400bd9a96de1c268cc8129f64a853cf161cc5c698af68733b2b4396a437847a81d2802204cd7c7b6340c820edef93f406695746a
- SSDEEP 3072:hXqW9mB6SdvV3YVFMp0RXFjOzEUaphlDaho77KWnl0R49:h99tOEw0RXFjOzEvhCGWQl0
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
101280
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
SettingsHandlers_BackgroundApps.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o_bsearch_s
_o_free
_o_malloc
_o_realloc
_o_terminate
_o_wcscat_s
_o_wcscpy_s
__C_specific_handler
__CxxFrameHandler3
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o__cexit
_o__callnewh
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__crt_atexit
_o__configure_narrow_argv
__std_terminate
__CxxFrameHandler4
_CxxThrowException
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetProcAddress
DisableThreadLibraryCalls
GetModuleHandleExW
GetModuleHandleW
FreeLibrary
api-ms-win-core-winrt-string-l1-1-0
WindowsIsStringEmpty
WindowsCreateStringReference
WindowsDuplicateString
WindowsDeleteString
WindowsCompareStringOrdinal
WindowsCreateString
WindowsGetStringRawBuffer
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThread
CreateThread
OpenProcessToken
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
OpenThreadToken
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetLastError
GetLastError
SetUnhandledExceptionFilter
RaiseException
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-synch-l1-1-0
SetEvent
ResetEvent
CreateEventW
WaitForSingleObjectEx
ReleaseMutex
OpenSemaphoreW
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreExW
InitializeCriticalSectionEx
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeSRWLock
CreateMutexExW
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
RoTransformError
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventRegister
EventSetInformation
EventUnregister
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegGetValueW
RegOpenKeyExW
RegSetValueExW
RegCloseKey
api-ms-win-core-path-l1-1-0
PathCchAppend
api-ms-win-core-file-l1-1-0
GetFileAttributesW
api-ms-win-core-com-l1-1-0
CoInitializeEx
CoUninitialize
CoGetClassObject
CoTaskMemAlloc
CoDecrementMTAUsage
CoIncrementMTAUsage
CoTaskMemRealloc
CoWaitForMultipleHandles
CoCreateInstance
CoGetMalloc
CoTaskMemFree
CoCreateFreeThreadedMarshaler
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
api-ms-win-security-base-l1-1-0
CopySid
GetLengthSid
IsValidSid
GetTokenInformation
RevertToSelf
ImpersonateLoggedOnUser
api-ms-win-core-winrt-l1-1-0
RoUninitialize
RoGetActivationFactory
RoInitialize
api-ms-win-core-winrt-error-l1-1-1
RoReportFailedDelegate
IsErrorPropagationEnabled
RoGetMatchingRestrictedErrorInfo
api-ms-win-shcore-stream-winrt-l1-1-0
CreateRandomAccessStreamOnFile
api-ms-win-core-threadpool-legacy-l1-1-0
QueueUserWorkItem
api-ms-win-shcore-obsolete-l1-1-0
SHStrDupW
api-ms-win-appmodel-runtime-l1-1-0
PackageFamilyNameFromFullName
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-shcore-thread-l1-1-0
SHCreateThread
policymanager
PolicyManager_GetPolicyString
PolicyManager_FreeStringValue
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
GetSetting
Name
.text
Size
105KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=73, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=260, version=27412,
count=3, id=259, version=27412,
count=1167, id=1, productName=Unmarked objects,
count=4, id=257, version=27412,
count=1, id=256, version=27412,
count=6, id=264, version=27412,
count=28, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
jjkj/lib/SettingsHandlers_BatteryUsage.dll
- IMPHASH 60fbd12bed3fc2b1e8f074c66b50c6ad
- SHA256 832a1035878e545c745f5b8d8344a03efd763ac6cbe3feb71d4f8cd1dc79f0db
- MD5 fec6540ad6da797c881027de8687bdaa
- SHA1 ce773843c110b7be1548480f661ee2892927e6c8
- SHA512 043ef93c5acd74a39d6a0be064de39890ceacba2e460909941e29a165fe18efe32fb7830028a80fa1b890767ed79defba4fd00f7c8f9e8b9e8611a0b39b67872
- SSDEEP 6144:zrzqKcDIFMgGwgXIDG7qMlCg+Nd2Doz2hlr:UDIFMgysGWe+Ndfih
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
167712
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
SettingsHandlers_BatteryUsage.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__get_errno
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
memmove
_o__wcsicmp
_o__wcsnicmp
_o_bsearch_s
_o_free
_o_malloc
_o_rand_s
_o_realloc
_o_terminate
_o_wcsncpy_s
__C_specific_handler
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
wcschr
__CxxFrameHandler3
_CxxThrowException
_o__execute_onexit_table
_o__errno
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__crt_atexit
_o__configure_narrow_argv
__std_terminate
__CxxFrameHandler4
memcpy
api-ms-win-crt-string-l1-1-0
memset
wcscmp
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
OpenProcessToken
OpenThreadToken
GetCurrentThread
GetCurrentThreadId
CreateThread
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleHandleExW
FreeLibrary
GetModuleHandleW
GetModuleFileNameA
DisableThreadLibraryCalls
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-synch-l1-1-0
WaitForSingleObject
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseMutex
CreateSemaphoreExW
ReleaseSemaphore
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
CreateMutexExW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
InitializeSRWLock
SetEvent
ResetEvent
CreateEventW
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
shcore
SHStrDupW
ord244
CreateRandomAccessStreamOnFile
SHCreateThread
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-core-winrt-error-l1-1-1
RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
RoTransformError
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
PropVariantClear
CoCreateInstance
CoGetMalloc
CoTaskMemRealloc
CoTaskMemFree
CoGetClassObject
CoDecrementMTAUsage
CoWaitForMultipleHandles
CoInitializeEx
CoUninitialize
CoIncrementMTAUsage
CoCreateFreeThreadedMarshaler
CoGetApartmentType
api-ms-win-core-shlwapi-obsolete-l1-1-0
StrCmpLogicalW
StrToIntW
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventSetInformation
EventUnregister
EventWriteTransfer
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-security-base-l1-1-0
CopySid
ImpersonateLoggedOnUser
IsValidSid
GetLengthSid
RevertToSelf
GetTokenInformation
api-ms-win-core-threadpool-legacy-l1-1-0
QueueUserWorkItem
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
ntdll
RtlGetDeviceFamilyInfoEnum
NtPowerInformation
RtlInitUnicodeString
NtQueryFullAttributesFile
NtQuerySystemInformation
api-ms-win-core-timezone-l1-1-0
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
api-ms-win-shell-namespace-l1-1-0
SHCreateItemWithParent
SHCreateItemFromParsingName
api-ms-win-core-string-l2-1-1
SHLoadIndirectString
api-ms-win-core-version-l1-1-1
GetFileVersionInfoW
GetFileVersionInfoSizeW
api-ms-win-core-version-l1-1-0
VerQueryValueW
api-ms-win-storage-exports-internal-l1-1-0
SHGetKnownFolderItem
api-ms-win-core-file-l1-1-0
QueryDosDeviceW
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
GetLogicalDriveStringsW
api-ms-win-core-file-l1-2-0
GetVolumePathNamesForVolumeNameW
api-ms-win-appmodel-runtime-l1-1-0
ClosePackageInfo
PackageFamilyNameFromFullName
GetPackageInfo
OpenPackageInfoByFullName
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFindFileNameW
PathIsRelativeW
api-ms-win-appmodel-runtime-internal-l1-1-0
GetPackageContext
GetPackagePropertyString
oleaut32
SysFreeString
api-ms-win-shlwapi-winrt-storage-l1-1-1
ord448
api-ms-win-core-path-l1-1-0
PathCchAppend
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegQueryInfoKeyW
RegEnumValueW
RegGetValueW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
GetSetting
Name
.text
Size
175KB
Virtual Size
174KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
53KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
320B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=89, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=12, id=260, version=27412,
count=3, id=259, version=27412,
count=1215, id=1, productName=Unmarked objects,
count=4, id=257, version=27412,
count=1, id=256, version=27412,
count=25, id=264, version=27412,
count=30, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
jjkj/lib/SettingsHandlers_BrowserDeclutter.dll
- IMPHASH 16e0731eb891908867ae25733ae8d429
- SHA256 c8c81b1e0ff456836a9767ed792e39a52e748c835545704c0e7948ac1729d981
- MD5 4eb0fa69169e3680c87e49a979219609
- SHA1 c986b61ee7c4bd3b2c86f3a42441b19b433ecbf9
- SHA512 5f6e87cdde88610b2a6bc0106cb543c0b72eb9f6d09397f14281cefbb86e750256ea08dc2242552ec2b17aa5b0e37227979951a0bb4902fa2859b882584e88b3
- SSDEEP 3072:7XBowHdpfhCpbxHB8oD+LzPy89qApYnzUbViQTaw3RwYyTVL67r:7XBow9LGtCaMm6bfTz8m7
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
102608
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
SettingsHandlers_BrowserDeclutter.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o_bsearch_s
_o_free
_o_malloc
_o_terminate
__C_specific_handler
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__CxxFrameHandler3
_CxxThrowException
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
GetModuleHandleExW
GetModuleFileNameA
GetProcAddress
GetModuleHandleW
FreeLibrary
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
InitOnceExecuteOnce
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
ReleaseSemaphore
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
CreateSemaphoreExW
LeaveCriticalSection
InitializeCriticalSectionEx
CreateEventExW
WaitForSingleObject
ReleaseMutex
ResetEvent
InitializeSRWLock
ReleaseSRWLockShared
ReleaseSRWLockExclusive
OpenSemaphoreW
WaitForSingleObjectEx
SetEvent
AcquireSRWLockExclusive
CreateEventW
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
RaiseException
SetLastError
SetUnhandledExceptionFilter
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
WindowsConcatString
WindowsCreateString
WindowsIsStringEmpty
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsDeleteString
api-ms-win-core-com-l1-1-0
CoIncrementMTAUsage
CoTaskMemFree
CoInitializeEx
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoDecrementMTAUsage
CoGetMalloc
CoUninitialize
CoTaskMemAlloc
CoWaitForMultipleHandles
CoTaskMemRealloc
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-winrt-l1-1-0
RoUninitialize
RoGetActivationFactory
RoInitialize
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetCurrentProcess
CreateThread
OpenThreadToken
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
RoOriginateError
RoTransformError
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-shcore-thread-l1-1-0
SHCreateThread
api-ms-win-rtcore-ntuser-window-l1-1-0
GetWindowRect
PostQuitMessage
TranslateMessage
GetMessageW
DefWindowProcW
DestroyWindow
CreateWindowExW
SendMessageW
UnregisterClassW
RegisterClassExW
DispatchMessageW
api-ms-win-storage-exports-internal-l1-1-0
SHGetKnownFolderIDList
shcore
ord244
SHStrDupW
ord190
msvcp_win
_Query_perf_counter
_Thrd_sleep
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_frequency
_Xtime_get_ticks
api-ms-win-core-winrt-error-l1-1-1
IsErrorPropagationEnabled
RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventUnregister
EventWriteTransfer
EventRegister
EventActivityIdControl
api-ms-win-core-threadpool-legacy-l1-1-0
QueueUserWorkItem
api-ms-win-security-base-l1-1-0
RevertToSelf
ImpersonateLoggedOnUser
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-registry-l1-1-0
RegGetValueW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
user32
GetProcessDefaultLayout
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
GetSetting
Name
.text
Size
106KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
772B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=69, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=260, version=27412,
count=3, id=259, version=27412,
count=1179, id=1, productName=Unmarked objects,
count=6, id=257, version=27412,
count=1, id=256, version=27412,
count=7, id=264, version=27412,
count=28, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
jjkj/lib/SettingsHandlers_CapabilityAccess.dll
- IMPHASH 1e9ee27a084fbff8b045d6baca598382
- SHA256 a0b5aaaadf64deb274a0f019c9674b21a4dc1965ff10ba4d0a8ab96127d2b175
- MD5 3b81f5218e93abaf65bf9a9ca95146b9
- SHA1 271e3c047e7f1428a6d251b3bae3d3bf03bb9e6e
- SHA512 3c627cf41cdb9aaa1d7054df4f4d150307f7e5db3f3f33faf6ef89d06b3a33d5663a5f5c97d1d6b535750660b8522e1efc814e8402db1f9a84df6219dfb45745
- SSDEEP 6144:UhsRCnFzRcSaRmxkVDOm0SuRV8VdTj7g:ysRCnFVP0ukVd7g
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
176032
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
SettingsHandlers_CapabilityAccess.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__get_errno
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__configure_narrow_argv
memmove
_o__wcsicmp
_o_bsearch_s
_o_free
_o_malloc
_o_qsort
_o_realloc
_o_terminate
_o_wcscat_s
_o_wcscpy_s
__C_specific_handler
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o__cexit
_o__callnewh
_o___std_exception_copy
_o__execute_onexit_table
_CxxThrowException
__CxxFrameHandler3
_o__errno
__std_terminate
__CxxFrameHandler4
memcmp
_o___stdio_common_vswprintf
_o__crt_atexit
memcpy
_o___stdio_common_vsnprintf_s
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleHandleW
GetModuleFileNameA
GetModuleHandleExW
DisableThreadLibraryCalls
FreeLibrary
LoadStringW
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsDeleteString
WindowsCreateStringReference
WindowsDuplicateString
WindowsIsStringEmpty
WindowsGetStringRawBuffer
WindowsConcatString
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
OpenProcessToken
OpenThreadToken
GetCurrentProcessId
GetProcessId
GetCurrentThreadId
GetCurrentThread
GetExitCodeProcess
CreateThread
api-ms-win-core-sysinfo-l1-1-0
GetSystemDirectoryW
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
RaiseException
SetUnhandledExceptionFilter
SetLastError
GetLastError
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-synch-l1-1-0
WaitForSingleObject
InitializeCriticalSectionEx
ReleaseMutex
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSemaphore
WaitForSingleObjectEx
OpenSemaphoreW
ResetEvent
ReleaseSRWLockShared
CreateMutexExW
AcquireSRWLockShared
DeleteCriticalSection
CreateSemaphoreExW
SetEvent
AcquireSRWLockExclusive
CreateEventExW
EnterCriticalSection
CreateEventW
LeaveCriticalSection
WaitForMultipleObjectsEx
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-com-l1-1-0
CoSetProxyBlanket
CoImpersonateClient
CoGetMalloc
CoRevertToSelf
CoIncrementMTAUsage
CoCreateFreeThreadedMarshaler
CoCreateInstance
CoUninitialize
CoWaitForMultipleHandles
CoTaskMemFree
CoTaskMemRealloc
CoDecrementMTAUsage
CoTaskMemAlloc
CoInitializeEx
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
RoOriginateError
api-ms-win-core-winrt-error-l1-1-1
RoReportFailedDelegate
IsErrorPropagationEnabled
RoGetMatchingRestrictedErrorInfo
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoInitialize
RoActivateInstance
RoUninitialize
api-ms-win-shcore-obsolete-l1-1-0
SHStrDupW
api-ms-win-security-base-l1-1-0
GetTokenInformation
CreateWellKnownSid
CheckTokenMembership
CopySid
ImpersonateSelf
RevertToSelf
GetLengthSid
ImpersonateLoggedOnUser
api-ms-win-core-threadpool-legacy-l1-1-0
QueueUserWorkItem
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l2-1-1
SHLoadIndirectString
api-ms-win-shcore-thread-l1-1-0
SHCreateThread
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-core-shlwapi-obsolete-l1-1-0
StrCmpIW
api-ms-win-shcore-scaling-l1-1-1
ord244
ntdll
NtQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
api-ms-win-core-datetime-l1-1-1
GetDateFormatEx
GetTimeFormatEx
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventUnregister
EventRegister
EventWriteTransfer
api-ms-win-shcore-stream-winrt-l1-1-0
CreateRandomAccessStreamOnFile
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegCloseKey
RegGetValueW
api-ms-win-core-sysinfo-l1-2-0
GetProductInfo
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
CloseThreadpoolTimer
TrySubmitThreadpoolCallback
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-file-l1-1-0
GetFileAttributesW
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-path-l1-1-0
PathCchAppend
api-ms-win-security-lsalookup-l1-1-0
LsaLookupGetDomainInfo
LsaLookupFreeMemory
LsaLookupOpenLocalPolicy
LsaLookupClose
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
api-ms-win-rtcore-ntuser-window-l1-1-0
EnumWindows
GetWindowRect
GetWindowThreadProcessId
SendMessageW
api-ms-win-appmodel-runtime-internal-l1-1-4
GetEffectivePackageStatusForUserSid
api-ms-win-shlwapi-winrt-storage-l1-1-1
ord348
msvcp_win
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-crt-math-l1-1-0
ceilf
GetSetting
GetSettingForUser
Name
.text
Size
195KB
Virtual Size
194KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
76KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=115, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=14, id=260, version=27412,
count=3, id=259, version=27412,
count=1241, id=1, productName=Unmarked objects,
count=2, id=257, version=27412,
count=1, id=256, version=27412,
count=11, id=264, version=27412,
count=30, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
jjkj/lib/SettingsHandlers_Clipboard.dll
- IMPHASH 33496722c630142f200f20ac5e43bb29
- SHA256 a165fcff00911ec4924905405b681f90c4a77ceebafeb7b2a1186333913c65c9
- MD5 d1d5a50eb4793f7652e8a9df49c33ee1
- SHA1 3ebfa8aee98d333ea2e896f41f573c6a28ad06b8
- SHA512 1f753c0b62f349d125f7c7ff16e29377d7ec1bfc30c442717a474d1d02bd6655fce29457cc178a42bf50f849388a5d23ace388bd2a3d5c3766140053eb42fe6c
- SSDEEP 6144:qZSIeNljCYXlYEH1mneDT3c7g1flzrvHcY/2vBJA1:qZALXlY8m0
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
127776
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
SettingsHandlers_Clipboard.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_bsearch_s
_o_free
_o_malloc
_o_terminate
__C_specific_handler
_o___stdio_common_vswprintf
_o__crt_atexit
_o__configure_narrow_argv
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__cexit
_o__callnewh
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
_CxxThrowException
__CxxFrameHandler3
wcschr
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
api-ms-win-core-winrt-string-l1-1-0
WindowsCompareStringOrdinal
WindowsCreateStringReference
WindowsCreateString
WindowsGetStringRawBuffer
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsDeleteString
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
RoTransformError
RoOriginateErrorW
SetRestrictedErrorInfo
GetRestrictedErrorInfo
api-ms-win-core-synch-l1-1-0
SetEvent
ReleaseSRWLockExclusive
CreateEventExW
LeaveCriticalSection
InitializeSRWLock
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
EnterCriticalSection
CreateMutexExW
WaitForSingleObjectEx
ReleaseMutex
OpenSemaphoreW
DeleteCriticalSection
WaitForSingleObject
CreateSemaphoreExW
InitializeCriticalSectionEx
ReleaseSemaphore
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetModuleFileNameA
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
OpenProcessToken
CreateThread
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
GetLastError
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-com-l1-1-0
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoReleaseMarshalData
CreateStreamOnHGlobal
CoMarshalInterface
CoCreateInstance
CoWaitForMultipleHandles
CoTaskMemAlloc
CoUninitialize
CoGetInterfaceAndReleaseStream
CoInitializeEx
api-ms-win-core-winrt-l1-1-0
RoUninitialize
RoActivateInstance
RoInitialize
RoGetActivationFactory
api-ms-win-core-winrt-error-l1-1-1
IsErrorPropagationEnabled
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolAllowThreadReuse
SHTaskPoolQueueTask
ntdll
RtlSubscribeWnfStateChangeNotification
NtQueryWnfStateData
RtlNtStatusToDosErrorNoTeb
RtlAllocateHeap
RtlInitUnicodeString
NtQueryInformationToken
RtlFreeHeap
RtlCompareUnicodeString
RtlUnsubscribeWnfNotificationWaitForCompletion
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
GetSetting
Name
.text
Size
134KB
Virtual Size
133KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=67, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1165, id=1, productName=Unmarked objects,
count=9, id=260, version=27412,
count=3, id=259, version=27412,
count=1, id=256, version=27412,
count=8, id=264, version=27412,
count=28, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
jjkj/lib/SettingsHandlers_ClosedCaptioning.dll
- IMPHASH 6f65015c1ee40eb2f23bf2a33fc54fba
- SHA256 84bd469f206c8b4d85b8018ee18c644e21f3b0c2579763d97ce7e3b59ca610b6
- MD5 1344af07b859720cd3599bdb0d60ba4b
- SHA1 5d151ccc4cfe16d3338afdd08cfd02fe9e60fbe1
- SHA512 692970e3c5c9c6b8c24c13a6c16586a4ac937c03c18a0b4506ba5cf80a491a87da3ee36f1e320da8d8e792738d599b892b1825763f127057faf10be603c8fabf
- SSDEEP 3072:fy416t6sOClHf/dBHK86NoQn+jQpqHg/Inx:f51kOClHf/dcwoIn
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
77552
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
SettingsHandlers_ClosedCaptioning.pdb
msvcrt
memmove
__C_specific_handler
malloc
_lock
_unlock
??3@YAXPEAX@Z
free
_onexit
_initterm
?terminate@@YAXXZ
_vsnwprintf
_purecall
??_V@YAXPEAX@Z
memcpy_s
memmove_s
realloc
??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBV0@@Z
_vsnprintf_s
??1type_info@@UEAA@XZ
_amsg_exit
_XcptFilter
bsearch_s
__CxxFrameHandler3
__dllonexit
_callnewh
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
?what@exception@@UEBAPEBDXZ
_CxxThrowException
memcpy
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA
DisableThreadLibraryCalls
GetProcAddress
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsCreateString
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
CreateThread
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
GetLastError
RaiseException
api-ms-win-core-synch-l1-1-0
InitializeSRWLock
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
LeaveCriticalSection
EnterCriticalSection
ReleaseMutex
WaitForSingleObject
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseSemaphore
CreateSemaphoreExW
ReleaseSRWLockShared
InitializeCriticalSectionEx
DeleteCriticalSection
CreateEventW
ResetEvent
SetEvent
AcquireSRWLockShared
api-ms-win-core-com-l1-1-0
CoIncrementMTAUsage
CoTaskMemAlloc
CoUninitialize
CoInitializeEx
CoCreateFreeThreadedMarshaler
CoWaitForMultipleHandles
CoDecrementMTAUsage
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoGetMalloc
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
RoReportFailedDelegate
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
RoOriginateError
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoInitialize
RoUninitialize
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventSetInformation
EventRegister
EventActivityIdControl
EventWriteTransfer
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
GetSetting
Name
.text
Size
82KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
46KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=42, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=260, version=27412,
count=3, id=259, version=27412,
count=118, id=1, productName=Unmarked objects,
count=3, id=257, version=27412,
count=12, id=261, version=27412,
count=1, id=256, version=27412,
count=6, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
jjkj/lib/SettingsHandlers_ContentDeliveryManager.dll
- IMPHASH 7d8f38df0f10b13d800ee38224f7fd1d
- SHA256 82f0cd9faaaa9024e3b8fdf0aadf159946d11ba047c388708f913ac9e479421b
- MD5 46d3ba8c9a2eb3848c3b256c5c43aa47
- SHA1 1cf262354c0d8021edd8150cffc7be54a97ec067
- SHA512 4fd0c9b4b365a3f926e746c8ff119eadb73420e47fea6102dcf0678b4487f7d90d9cc3b07fb002e3527a6b5449047dc507752a4591bd2d0315e218c424bca18c
- SSDEEP 3072:ABObkgZQkV228TGIyCvz7zAcFbfaaZ79HRDtclrDslE:AYbjZQ0h8TGIlvz7zAcFzlZ79HAFDsl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
112816
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
SettingsHandlers_ContentDeliveryManager.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_bsearch_s
_o_free
_o_malloc
_o_terminate
_o_wcsncpy_s
__C_specific_handler
_o__crt_atexit
_o__configure_narrow_argv
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__CxxFrameHandler3
_CxxThrowException
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
_o___stdio_common_vsnprintf_s
api-ms-win-crt-string-l1-1-0
wcscspn
memset
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
DisableThreadLibraryCalls
GetModuleHandleW
GetModuleFileNameA
FindStringOrdinal
GetModuleHandleExW
GetProcAddress
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
WindowsDeleteString
WindowsDuplicateString
WindowsGetStringRawBuffer
WindowsCreateString
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
RoOriginateError
SetRestrictedErrorInfo
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
InitializeSRWLock
CreateMutexExW
WaitForSingleObjectEx
ReleaseMutex
OpenSemaphoreW
ReleaseSemaphore
ReleaseSRWLockShared
CreateSemaphoreExW
InitializeCriticalSectionEx
CreateEventExW
SetEvent
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockShared
WaitForSingleObject
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceExecuteOnce
InitOnceBeginInitialize
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
CreateThread
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
OpenThreadToken
GetCurrentThread
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
SetLastError
UnhandledExceptionFilter
RaiseException
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
shcore
SHTaskPoolQueueTask
ord190
SHStrDupW
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventUnregister
EventRegister
EventActivityIdControl
EventWriteTransfer
api-ms-win-core-winrt-l1-1-0
RoUninitialize
RoGetActivationFactory
RoInitialize
RoActivateInstance
api-ms-win-core-com-l1-1-0
CoUninitialize
CoGetClassObject
CoInitializeEx
CoTaskMemAlloc
CoWaitForMultipleHandles
CoCreateFreeThreadedMarshaler
CoTaskMemFree
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate
IsErrorPropagationEnabled
api-ms-win-core-threadpool-legacy-l1-1-0
QueueUserWorkItem
api-ms-win-security-base-l1-1-0
RevertToSelf
ImpersonateLoggedOnUser
sspicli
GetUserNameExW
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-sysinfo-l1-2-0
VerSetConditionMask
api-ms-win-core-kernel32-legacy-l1-1-1
VerifyVersionInfoW
DllCanUnloadNow
DllGetClassObject
GetSetting
Name
.text
Size
117KB
Virtual Size
116KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=73, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=260, version=27412,
count=3, id=259, version=27412,
count=1165, id=1, productName=Unmarked objects,
count=4, id=257, version=27412,
count=1, id=256, version=27412,
count=16, id=264, version=27412,
count=28, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
jjkj/lib/SettingsHandlers_Cortana.dll
- IMPHASH 78b6e23a0bf8a0b36dd7cc22ac980b60
- SHA256 c2f294c3e1fae4dfb3347b06c76c0b2702fc0e52a764d16d6808244657c9dda2
- MD5 023a280ed5ad4bb158206123af11f5c6
- SHA1 c1f10c436973a97990536d935c6a76586a819d04
- SHA512 0f479b498c871bd2dc0806b15f68c2ef17f82861aef53e2fca18feb00b4c0851a66f95ae35fb343ddd962ed4896e27355a2bd13bda640caf6a56007b68f61507
- SSDEEP 6144:rg+5fqkeS4y4duf7Ww5XkPtfBxl3neLVzkZxn+fGclTJsgRZvK:/qkeNy4dg5HjK
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
212960
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
SettingsHandlers_Cortana.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__get_errno
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
memmove
_o_bsearch_s
_o_free
_o_iswspace
_o_malloc
_o_realloc
_o_terminate
_o_toupper
__C_specific_handler
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o__execute_onexit_table
_o___stdio_common_vsnprintf_s
wcsstr
__CxxFrameHandler3
_CxxThrowException
_o__errno
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
GetModuleHandleExW
GetModuleHandleW
GetModuleFileNameA
GetProcAddress
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
InitOnceBeginInitialize
InitOnceComplete
Sleep
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
ReleaseSRWLockShared
EnterCriticalSection
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
AcquireSRWLockShared
CreateEventW
ReleaseSRWLockExclusive
ResetEvent
SetEvent
ReleaseMutex
DeleteCriticalSection
WaitForSingleObject
InitializeCriticalSectionEx
CreateMutexExW
CreateEventExW
ReleaseSemaphore
CreateSemaphoreExW
InitializeSRWLock
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
RaiseException
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-processthreads-l1-1-0
CreateThread
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
OpenProcessToken
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
RoOriginateErrorW
RoTransformError
GetRestrictedErrorInfo
SetRestrictedErrorInfo
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsDuplicateString
WindowsCreateStringReference
WindowsCreateString
WindowsCompareStringOrdinal
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
policymanager
PolicyManager_FreeGetPolicyData
PolicyManager_GetPolicy
PolicyManager_GetPolicyInt
PolicyManager_IsPolicySetByMobileDeviceManager
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
api-ms-win-core-winrt-error-l1-1-1
IsErrorPropagationEnabled
RoOriginateLanguageException
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate
api-ms-win-core-registry-l1-1-0
RegGetValueW
api-ms-win-core-com-l1-1-0
CoInitializeEx
CoUninitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoDecrementMTAUsage
CoGetInterfaceAndReleaseStream
CoWaitForMultipleHandles
CoMarshalInterface
CreateStreamOnHGlobal
CoReleaseMarshalData
CoGetMalloc
CoIncrementMTAUsage
CoTaskMemFree
CoGetApartmentType
CoCreateInstance
CoCreateFreeThreadedMarshaler
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-winrt-l1-1-0
RoInitialize
RoUninitialize
RoActivateInstance
RoGetActivationFactory
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer
oleaut32
VariantInit
SysFreeString
SysStringLen
SysAllocString
VariantClear
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
api-ms-win-security-base-l1-1-0
CheckTokenMembership
DuplicateToken
GetTokenInformation
CreateWellKnownSid
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-shcore-registry-l1-1-0
SHSetValueW
SHGetValueW
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventProviderEnabled
EventSetInformation
EventRegister
EventWriteTransfer
api-ms-win-power-setting-l1-1-0
PowerGetActiveScheme
powrprof
PowerReadACValueIndex
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
ntdll
NtQueryInformationToken
RtlSubscribeWnfStateChangeNotification
NtQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlGetDeviceFamilyInfoEnum
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolAllowThreadReuse
SHTaskPoolQueueTask
DllCanUnloadNow
DllGetClassObject
GetSetting
Name
.text
Size
218KB
Virtual Size
217KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
77KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=83, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=260, version=27412,
count=3, id=259, version=27412,
count=1206, id=1, productName=Unmarked objects,
count=4, id=257, version=27412,
count=1, id=256, version=27412,
count=14, id=264, version=27412,
count=29, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
jjkj/lib/SettingsHandlers_Devices.dll
- IMPHASH 05174e24bee40f85fd550e9642e0ed4f
- SHA256 d9c38f3d00e0a61af8fe14acb010aee4db2a20e696bcdca9718426389103b9ca
- MD5 998a842f38810c34cadd06e34998b6f0
- SHA1 b4c34b32ad626d9cfd64b43604d8334bebeb5dd3
- SHA512 225b77905637a2b30bbfb518eeb67ac08e702a41047a953e8a1b27df366706893a258f463d41b8a043612f923b061639a0c6c003852916d1ffa96d01efc5addd
- SSDEEP 6144:/KD5/wa5U5s9jqRhFwSlYPd5FJOiEUBDmjELDEEE8uE3blFrjv3wbpHxUZ4WKP2B:eBwIU5AqRhFwSlYP+i5XE2ZFrjIxv87
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
338816
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
SettingsHandlers_Devices.pdb
wincorlib
?__abi_WinRTraiseInvalidCastException@@YAXXZ
?__abi_WinRTraiseObjectDisposedException@@YAXXZ
?__abi_WinRTraiseWrongThreadException@@YAXXZ
?__abi_WinRTraiseNotImplementedException@@YAXXZ
?CreateException@Exception@Platform@@SAPE$AAV12@HPE$AAVString@2@@Z
?InitializeData@Details@Platform@@YAJH@Z
?UninitializeData@Details@Platform@@YAXH@Z
?AllocateException@Heap@Details@Platform@@SAPEAX_K0@Z
??0OutOfBoundsException@Platform@@QE$AAA@XZ
??0ChangedStateException@Platform@@QE$AAA@XZ
??0OutOfMemoryException@Platform@@QE$AAA@XZ
??0Object@Platform@@QE$AAA@XZ
?Free@Heap@Details@Platform@@SAXPEAX@Z
?AlignedFree@Heap@Details@Platform@@SAXPEAX@Z
?ReleaseTarget@ControlBlock@Details@Platform@@AEAAXXZ
??0FailureException@Platform@@QE$AAA@XZ
?Allocate@Heap@Details@Platform@@SAPEAX_K0@Z
?EventSourceUninitialize@Details@Platform@@YAXPEAPEAX@Z
?EventSourceInitialize@Details@Platform@@YAXPEAPEAX@Z
??0NotImplementedException@Platform@@QE$AAA@XZ
?EventSourceRemove@Details@Platform@@YAXPEAPEAXPEAUEventLock@12@VEventRegistrationToken@Foundation@Windows@@@Z
?EventSourceAdd@Details@Platform@@YA?AVEventRegistrationToken@Foundation@Windows@@PEAPEAXPEAUEventLock@12@PE$AAVDelegate@2@@Z
?EventSourceGetTargetArrayEvent@Details@Platform@@YAPEAXPEAXIPEBXPEA_J@Z
?EventSourceGetTargetArraySize@Details@Platform@@YAIPEAX@Z
?EventSourceGetTargetArray@Details@Platform@@YAPEAXPEAXPEAUEventLock@12@@Z
??0InvalidArgumentException@Platform@@QE$AAA@XZ
?__abi_cast_Object_to_String@__abi_details@@YAPE$AAVString@Platform@@_NPE$AAVObject@3@@Z
?GetObjectContext@Details@Platform@@YAPEAUIUnknown@@XZ
??0DisconnectedException@Platform@@QE$AAA@XZ
??0Delegate@Platform@@QE$AAA@XZ
?ReCreateException@Exception@Platform@@SAPE$AAV12@H@Z
?GetProxyImpl@Details@Platform@@YAJPEAUIUnknown@@AEBU_GUID@@0PEAPEAU3@@Z
?ReleaseInContextImpl@Details@Platform@@YAJPEAUIUnknown@@0@Z
??0NullReferenceException@Platform@@QE$AAA@XZ
?GetTypeCode@Type@Platform@@SA?AW4TypeCode@2@PE$AAV12@@Z
?__abi_make_type_id@@YAPE$AAVType@Platform@@AEBU__abi_type_descriptor@@@Z
?CreateValue@Details@Platform@@YAPE$AAVObject@2@W4TypeCode@2@PEBX@Z
?GetIBoxVtable@Details@Platform@@YAPEAXPEAX@Z
?__abi_ObjectToString@__abi_details@@YAPE$AAVString@Platform@@PE$AAVObject@3@_N@Z
?GetIBoxArrayVtable@Details@Platform@@YAPEAXPEAX@Z
?GetWeakReference@Details@Platform@@YAPEAU__abi_IUnknown@@QE$ADVObject@2@@Z
?__abi_cast_String_to_Object@__abi_details@@YAPE$AAVObject@Platform@@PE$AAVString@3@@Z
?ResolveWeakReference@Details@Platform@@YAPE$AAVObject@2@AEBU_GUID@@PEAPEAU__abi_IUnknown@@@Z
?CreateException@Exception@Platform@@SAPE$AAV12@H@Z
?get@Message@Exception@Platform@@QE$AAAPE$AAVString@3@XZ
?__abi_WinRTraiseDisconnectedException@@YAXXZ
?__abi_WinRTraiseFailureException@@YAXXZ
?__abi_WinRTraiseOperationCanceledException@@YAXXZ
?__abi_WinRTraiseAccessDeniedException@@YAXXZ
?__abi_WinRTraiseInvalidArgumentException@@YAXXZ
?__abi_WinRTraiseClassNotRegisteredException@@YAXXZ
?__abi_WinRTraiseCOMException@@YAXJ@Z
?__abi_WinRTraiseNullReferenceException@@YAXXZ
?__abi_WinRTraiseChangedStateException@@YAXXZ
?GetIidsFn@@YAJHPEAKPEBU__s_GUID@@PEAPEAVGuid@Platform@@@Z
?__abi_FailFast@@YAXXZ
?ReCreateFromException@Details@Platform@@YAJPE$AAVException@2@@Z
?GetActivationFactoryByPCWSTR@@YAJPEAXAEAVGuid@Platform@@PEAPEAX@Z
?__abi_WinRTraiseOutOfBoundsException@@YAXXZ
?__abi_WinRTraiseOutOfMemoryException@@YAXXZ
api-ms-win-crt-string-l1-1-0
wcslen
memset
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__ui64tow_s
memmove
_o_free
_o_malloc
_o_terminate
__C_specific_handler
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o__execute_onexit_table
_o__errno
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__crt_atexit
__std_terminate
wcsstr
__CxxFrameHandler4
_CxxThrowException
__CxxFrameHandler3
memcmp
memcpy
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
LockResource
GetModuleHandleExW
DisableThreadLibraryCalls
FreeLibrary
GetProcAddress
GetModuleFileNameA
FindResourceExW
LoadResource
LoadLibraryExW
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionAndSpinCount
CreateSemaphoreExW
LeaveCriticalSection
ReleaseMutex
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSemaphore
CreateEventExW
EnterCriticalSection
ResetEvent
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
WaitForSingleObject
SetEvent
WaitForSingleObjectEx
OpenSemaphoreW
InitializeSRWLock
CreateEventW
DeleteCriticalSection
CreateMutexExW
InitializeCriticalSectionEx
InitializeCriticalSection
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
SetLastError
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-util-l1-1-0
DecodePointer
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
InitOnceExecuteOnce
Sleep
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
RoOriginateError
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate
IsErrorPropagationEnabled
api-ms-win-core-com-l1-1-0
CLSIDFromString
CoRevertToSelf
CoTaskMemAlloc
CoTaskMemFree
CoImpersonateClient
CoCreateFreeThreadedMarshaler
CoTaskMemRealloc
CoGetContextToken
CoCreateInstance
PropVariantClear
api-ms-win-core-winrt-string-l1-1-0
WindowsIsStringEmpty
WindowsGetStringRawBuffer
WindowsGetStringLen
WindowsDuplicateString
WindowsDeleteString
WindowsCreateStringReference
WindowsCreateString
WindowsCompareStringOrdinal
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemDirectoryW
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventActivityIdControl
EventRegister
EventWriteTransfer
EventSetInformation
api-ms-win-core-string-l1-1-0
CompareStringEx
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegCreateKeyExW
RegCloseKey
RegSetValueExW
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
ntdll
NtQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
EtwTraceMessage
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlPublishWnfStateData
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolQueueTask
SHTaskPoolGetUniqueContext
rpcrt4
I_RpcBindingInqLocalClientPID
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-sysinfo-l1-2-0
GetProductInfo
api-ms-win-shcore-scaling-l1-1-1
ord244
oleaut32
SysFreeString
bluetoothapis
BluetoothFindRadioClose
BluetoothGetRadioInfo
BthpRegisterForAuthentication
BluetoothEnableDiscovery
BluetoothUnregisterAuthentication
BluetoothFindFirstRadio
deviceassociation
DafCreateAssociationContext
DafStartRemoveAssociation
DafCloseAssociationContext
msvcp_win
?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_Assign@_ContextCallback@details@Concurrency@@AEAAXPEAX@Z
?_XGetLastError@std@@YAXXZ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Throw_C_error@std@@YAXH@Z
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_unlock
_Cnd_init_in_situ
_Cnd_destroy_in_situ
_Cnd_broadcast
_Cnd_wait
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?__ExceptionPtrRethrow@@YAXPEBX@Z
?_IsNonBlockingThread@_Task_impl_base@details@Concurrency@@SA_NXZ
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_Xbad_function_call@std@@YAXXZ
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
GetSetting
Name
.text
Size
351KB
Virtual Size
350KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
149KB
Virtual Size
148KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
63KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
192B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=80, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=27412,
count=11, id=260, version=27412,
count=1320, id=1, productName=Unmarked objects,
count=9, id=257, version=27412,
count=1, id=256, version=27412,
count=20, id=265, version=27412,
count=34, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
jjkj/lib/sedplugins.dll
- IMPHASH a1ac2e9e84558e103f9242fdbf2c5788
- SHA256 41b0e5dd2795abeb347f1e85be172e0d8abc08e7538485cb6107b0caf2968287
- MD5 0c4b3b8740274056b1b6b3e0230aee96
- SHA1 1549fbbb6a366c9cc9da03cb0704d549a4d7afe1
- SHA512 e3bdf4316ca3630b51725eb317c15e1c13d102ddbaf094a7298c86c2f1001207ca879af1a35f8da31da57ced56e7d820ce91c226ad7bda1c87f2141a10eaab9b
- SSDEEP 12288:UH508DsCAFMWhHtH6ZTb4rjG7+5W7HAN4n:UH508w1OGtH6Bv7+5lN4n
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
0f:10:bd:50:5a:67:88:9f:b7:93:31:85:5f:8f:96:04:47:64:d3:42:ea:67:25:65:cf:18:58:e3:2d:7b:31:19
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 5, 2024
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 3, 2023 - Feb 1, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Minor OS version
0
Major OS version
10
Entry point
363152
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
sedplugins.pdb
api-ms-win-crt-locale-l1-1-0
_lock_locales
_unlock_locales
api-ms-win-crt-string-l1-1-0
memset
wcsnlen
wcsncmp
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__localtime64
_o__lock_file
_o__mktime64
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__unlock_file
_o__wcsdup
_o__wcsicmp
_o__wcsnicmp
_o__wcstoi64
_o__wcsupr_s
_o__wfsopen
_o__wtoi
_o__wtol
_o_abort
_o_fclose
_o_fflush
_o_fgetc
_o_fgetpos
_o_fgetwc
_o_fputwc
_o_free
_o_fsetpos
_o_fwrite
_o_malloc
_o_pow
_o_realloc
_o_round
_o_setlocale
_o_setvbuf
_o_strncpy_s
_o_strtol
_o_terminate
_o_towlower
_o_ungetc
_o_ungetwc
_o_wcstombs
_o_wcstoul
__uncaught_exception
__C_specific_handler
_CxxThrowException
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
wcsstr
_o__fseeki64
_o__execute_onexit_table
_o__errno
_o__difftime64
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__calloc_base
_o__callnewh
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___pctype_func
_o____mb_cur_max_func
_o____lc_locale_name_func
_o____lc_collate_cp_func
_o____lc_codepage_func
strrchr
strchr
wcschr
__CxxFrameHandler3
memcmp
memcpy
memmove
api-ms-win-core-file-l1-1-0
CreateDirectoryW
GetFileSize
FindNextFileW
FindFirstFileW
FindClose
CreateFileW
CompareFileTime
GetDiskFreeSpaceExW
FileTimeToLocalFileTime
DeleteFileW
SetFileAttributesW
RemoveDirectoryW
GetTempFileNameW
WriteFile
GetFileAttributesW
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameW
GetModuleFileNameA
SizeofResource
GetModuleHandleW
GetModuleHandleExW
LoadResource
LoadLibraryExW
FreeLibrary
GetModuleHandleA
GetProcAddress
LoadLibraryExA
LockResource
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitializeConditionVariable
Sleep
WakeConditionVariable
WakeAllConditionVariable
InitOnceExecuteOnce
InitOnceBeginInitialize
SleepConditionVariableSRW
api-ms-win-eventing-controller-l1-1-0
StartTraceW
ControlTraceW
EnableTraceEx2
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegDeleteTreeW
RegEnumValueW
RegGetValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteValueW
RegQueryValueExW
RegSetValueExW
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
OpenSemaphoreW
InitializeCriticalSectionEx
AcquireSRWLockExclusive
CreateEventExW
ReleaseSRWLockShared
InitializeCriticalSection
DeleteCriticalSection
InitializeSRWLock
WaitForSingleObjectEx
AcquireSRWLockShared
CreateSemaphoreExW
ReleaseSRWLockExclusive
ReleaseMutex
ReleaseSemaphore
WaitForSingleObject
CreateMutexW
TryAcquireSRWLockExclusive
CreateMutexExW
SetEvent
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapDestroy
HeapReAlloc
HeapSize
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
RaiseException
SetLastError
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-core-com-l1-1-0
CoSetProxyBlanket
CoTaskMemAlloc
CLSIDFromString
CoTaskMemRealloc
CoUninitialize
CoTaskMemFree
CoGetApartmentType
CoWaitForMultipleHandles
CoCreateInstance
CoCreateGuid
CoInitializeEx
CoCreateFreeThreadedMarshaler
api-ms-win-eventing-legacy-l1-1-0
QueryTraceW
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventUnregister
EventRegister
EventSetInformation
api-ms-win-core-shlwapi-legacy-l1-1-0
PathRemoveFileSpecW
PathFileExistsW
api-ms-win-core-heap-l2-1-0
LocalAlloc
GlobalFree
LocalFree
api-ms-win-shcore-obsolete-l1-1-0
CommandLineToArgvW
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
CreateProcessW
GetCurrentThreadId
TerminateProcess
GetExitCodeProcess
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetLocalTime
GetSystemWindowsDirectoryW
GlobalMemoryStatusEx
GetSystemTimeAsFileTime
GetSystemInfo
GetSystemTime
GetWindowsDirectoryW
GetSystemDirectoryW
GetVersionExW
GetVersionExA
api-ms-win-core-localization-l1-2-0
GetUserDefaultLocaleName
FormatMessageW
LCMapStringEx
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
oleaut32
SysFreeString
VariantClear
VariantChangeType
SysStringLen
VariantTimeToSystemTime
VariantInit
SysAllocString
api-ms-win-core-registry-l1-1-1
RegDeleteKeyValueW
RegSetKeyValueW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpW
lstrcmpiW
rpcrt4
UuidCreate
api-ms-win-core-kernel32-legacy-l1-1-0
MoveFileW
GetSystemPowerStatus
api-ms-win-core-string-l1-1-0
GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-memory-l1-1-0
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
shell32
SHGetSpecialFolderPathW
api-ms-win-crt-time-l1-1-0
_time64
winhttp
WinHttpQueryOption
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpSendRequest
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpOpen
WinHttpReadData
WinHttpAddRequestHeaders
WinHttpConnect
WinHttpSetTimeouts
WinHttpReceiveResponse
api-ms-win-core-version-l1-1-1
GetFileVersionInfoSizeW
GetFileVersionInfoW
crypt32
CertGetCertificateChain
CertFreeCertificateContext
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CryptStringToBinaryW
api-ms-win-core-version-l1-1-0
VerQueryValueW
api-ms-win-core-sysinfo-l1-2-0
GetProductInfo
GetNativeSystemInfo
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsDeleteString
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoGetActivationFactory
ntdll
NtPowerInformation
NtQueryVolumeInformationFile
RtlConvertDeviceFamilyInfoToString
api-ms-win-core-kernel32-legacy-l1-1-1
PowerSetRequest
PowerCreateRequest
PowerClearRequest
api-ms-win-core-file-l1-2-0
GetTempPathW
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
FileTimeToSystemTime
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
api-ms-win-service-management-l1-1-0
OpenServiceW
OpenSCManagerW
CloseServiceHandle
api-ms-win-service-management-l2-1-0
ChangeServiceConfigW
QueryServiceConfigW
api-ms-win-service-winsvc-l1-1-0
QueryServiceStatus
ControlService
api-ms-win-core-libraryloader-l1-2-1
FindResourceW
LoadLibraryW
api-ms-win-core-path-l1-1-0
PathCchRemoveFileSpec
PathCchCombine
netutils
NetApiBufferFree
api-ms-win-core-file-l1-2-1
GetCompressedFileSizeW
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
RoOriginateError
wkscli
NetGetJoinInformation
iphlpapi
IcmpSendEcho
IcmpCreateFile
ws2_32
getaddrinfo
WSAStartup
inet_addr
inet_ntoa
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
shlwapi
PathIsDirectoryW
user32
UnregisterClassA
netapi32
NetFreeAadJoinInformation
NetGetAadJoinInformation
wintrust
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WinVerifyTrust
api-ms-win-security-cryptoapi-l1-1-0
CryptCreateHash
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptAcquireContextW
setupapi
SetupIterateCabinetW
wininet
InternetCloseHandle
InternetReadFile
HttpQueryInfoW
InternetOpenW
InternetOpenUrlW
api-ms-win-crt-math-l1-1-0
ceilf
CheckShellTask
EnumeratePlugins
EnumeratePluginsWithApplicationSource
ExecuteShell
GetPluginDefaultSettings
GetSettingsName
Plugin_DetectCondition
Plugin_Init
Plugin_IsActionApplicable
Plugin_IsEnabled
Plugin_IsInteractiveOnly
Plugin_PerformAction
Plugin_Process
Plugin_Process_Aqua
Plugin_Uninit
RegisterApplication
SedimentDriver_Init
SedimentDriver_Init_Aqua
SedimentDriver_Uninit
Name
.text
Size
375KB
Virtual Size
374KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
168KB
Virtual Size
168KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=257, version=27412,
count=155, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1402, id=1, productName=Unmarked objects,
count=9, id=260, version=27412,
count=3, id=259, version=27412,
count=1, id=256, version=27412,
count=93, id=264, version=27412,
count=32, id=261, version=27412,
count=2, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
jjkj/sedplugins.dll
- IMPHASH a1ac2e9e84558e103f9242fdbf2c5788
- SHA256 41b0e5dd2795abeb347f1e85be172e0d8abc08e7538485cb6107b0caf2968287
- MD5 0c4b3b8740274056b1b6b3e0230aee96
- SHA1 1549fbbb6a366c9cc9da03cb0704d549a4d7afe1
- SHA512 e3bdf4316ca3630b51725eb317c15e1c13d102ddbaf094a7298c86c2f1001207ca879af1a35f8da31da57ced56e7d820ce91c226ad7bda1c87f2141a10eaab9b
- SSDEEP 12288:UH508DsCAFMWhHtH6ZTb4rjG7+5W7HAN4n:UH508w1OGtH6Bv7+5lN4n
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
0f:10:bd:50:5a:67:88:9f:b7:93:31:85:5f:8f:96:04:47:64:d3:42:ea:67:25:65:cf:18:58:e3:2d:7b:31:19
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 5, 2024
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 3, 2023 - Feb 1, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Minor OS version
0
Major OS version
10
Entry point
363152
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
sedplugins.pdb
api-ms-win-crt-locale-l1-1-0
_lock_locales
_unlock_locales
api-ms-win-crt-string-l1-1-0
memset
wcsnlen
wcsncmp
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__localtime64
_o__lock_file
_o__mktime64
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__unlock_file
_o__wcsdup
_o__wcsicmp
_o__wcsnicmp
_o__wcstoi64
_o__wcsupr_s
_o__wfsopen
_o__wtoi
_o__wtol
_o_abort
_o_fclose
_o_fflush
_o_fgetc
_o_fgetpos
_o_fgetwc
_o_fputwc
_o_free
_o_fsetpos
_o_fwrite
_o_malloc
_o_pow
_o_realloc
_o_round
_o_setlocale
_o_setvbuf
_o_strncpy_s
_o_strtol
_o_terminate
_o_towlower
_o_ungetc
_o_ungetwc
_o_wcstombs
_o_wcstoul
__uncaught_exception
__C_specific_handler
_CxxThrowException
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
wcsstr
_o__fseeki64
_o__execute_onexit_table
_o__errno
_o__difftime64
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__calloc_base
_o__callnewh
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___pctype_func
_o____mb_cur_max_func
_o____lc_locale_name_func
_o____lc_collate_cp_func
_o____lc_codepage_func
strrchr
strchr
wcschr
__CxxFrameHandler3
memcmp
memcpy
memmove
api-ms-win-core-file-l1-1-0
CreateDirectoryW
GetFileSize
FindNextFileW
FindFirstFileW
FindClose
CreateFileW
CompareFileTime
GetDiskFreeSpaceExW
FileTimeToLocalFileTime
DeleteFileW
SetFileAttributesW
RemoveDirectoryW
GetTempFileNameW
WriteFile
GetFileAttributesW
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameW
GetModuleFileNameA
SizeofResource
GetModuleHandleW
GetModuleHandleExW
LoadResource
LoadLibraryExW
FreeLibrary
GetModuleHandleA
GetProcAddress
LoadLibraryExA
LockResource
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitializeConditionVariable
Sleep
WakeConditionVariable
WakeAllConditionVariable
InitOnceExecuteOnce
InitOnceBeginInitialize
SleepConditionVariableSRW
api-ms-win-eventing-controller-l1-1-0
StartTraceW
ControlTraceW
EnableTraceEx2
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegDeleteTreeW
RegEnumValueW
RegGetValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteValueW
RegQueryValueExW
RegSetValueExW
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
OpenSemaphoreW
InitializeCriticalSectionEx
AcquireSRWLockExclusive
CreateEventExW
ReleaseSRWLockShared
InitializeCriticalSection
DeleteCriticalSection
InitializeSRWLock
WaitForSingleObjectEx
AcquireSRWLockShared
CreateSemaphoreExW
ReleaseSRWLockExclusive
ReleaseMutex
ReleaseSemaphore
WaitForSingleObject
CreateMutexW
TryAcquireSRWLockExclusive
CreateMutexExW
SetEvent
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapDestroy
HeapReAlloc
HeapSize
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
RaiseException
SetLastError
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-core-com-l1-1-0
CoSetProxyBlanket
CoTaskMemAlloc
CLSIDFromString
CoTaskMemRealloc
CoUninitialize
CoTaskMemFree
CoGetApartmentType
CoWaitForMultipleHandles
CoCreateInstance
CoCreateGuid
CoInitializeEx
CoCreateFreeThreadedMarshaler
api-ms-win-eventing-legacy-l1-1-0
QueryTraceW
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventUnregister
EventRegister
EventSetInformation
api-ms-win-core-shlwapi-legacy-l1-1-0
PathRemoveFileSpecW
PathFileExistsW
api-ms-win-core-heap-l2-1-0
LocalAlloc
GlobalFree
LocalFree
api-ms-win-shcore-obsolete-l1-1-0
CommandLineToArgvW
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
CreateProcessW
GetCurrentThreadId
TerminateProcess
GetExitCodeProcess
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetLocalTime
GetSystemWindowsDirectoryW
GlobalMemoryStatusEx
GetSystemTimeAsFileTime
GetSystemInfo
GetSystemTime
GetWindowsDirectoryW
GetSystemDirectoryW
GetVersionExW
GetVersionExA
api-ms-win-core-localization-l1-2-0
GetUserDefaultLocaleName
FormatMessageW
LCMapStringEx
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
oleaut32
SysFreeString
VariantClear
VariantChangeType
SysStringLen
VariantTimeToSystemTime
VariantInit
SysAllocString
api-ms-win-core-registry-l1-1-1
RegDeleteKeyValueW
RegSetKeyValueW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpW
lstrcmpiW
rpcrt4
UuidCreate
api-ms-win-core-kernel32-legacy-l1-1-0
MoveFileW
GetSystemPowerStatus
api-ms-win-core-string-l1-1-0
GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-memory-l1-1-0
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
shell32
SHGetSpecialFolderPathW
api-ms-win-crt-time-l1-1-0
_time64
winhttp
WinHttpQueryOption
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpSendRequest
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpOpen
WinHttpReadData
WinHttpAddRequestHeaders
WinHttpConnect
WinHttpSetTimeouts
WinHttpReceiveResponse
api-ms-win-core-version-l1-1-1
GetFileVersionInfoSizeW
GetFileVersionInfoW
crypt32
CertGetCertificateChain
CertFreeCertificateContext
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CryptStringToBinaryW
api-ms-win-core-version-l1-1-0
VerQueryValueW
api-ms-win-core-sysinfo-l1-2-0
GetProductInfo
GetNativeSystemInfo
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsDeleteString
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoGetActivationFactory
ntdll
NtPowerInformation
NtQueryVolumeInformationFile
RtlConvertDeviceFamilyInfoToString
api-ms-win-core-kernel32-legacy-l1-1-1
PowerSetRequest
PowerCreateRequest
PowerClearRequest
api-ms-win-core-file-l1-2-0
GetTempPathW
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
FileTimeToSystemTime
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
api-ms-win-service-management-l1-1-0
OpenServiceW
OpenSCManagerW
CloseServiceHandle
api-ms-win-service-management-l2-1-0
ChangeServiceConfigW
QueryServiceConfigW
api-ms-win-service-winsvc-l1-1-0
QueryServiceStatus
ControlService
api-ms-win-core-libraryloader-l1-2-1
FindResourceW
LoadLibraryW
api-ms-win-core-path-l1-1-0
PathCchRemoveFileSpec
PathCchCombine
netutils
NetApiBufferFree
api-ms-win-core-file-l1-2-1
GetCompressedFileSizeW
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
RoOriginateError
wkscli
NetGetJoinInformation
iphlpapi
IcmpSendEcho
IcmpCreateFile
ws2_32
getaddrinfo
WSAStartup
inet_addr
inet_ntoa
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
shlwapi
PathIsDirectoryW
user32
UnregisterClassA
netapi32
NetFreeAadJoinInformation
NetGetAadJoinInformation
wintrust
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WinVerifyTrust
api-ms-win-security-cryptoapi-l1-1-0
CryptCreateHash
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptAcquireContextW
setupapi
SetupIterateCabinetW
wininet
InternetCloseHandle
InternetReadFile
HttpQueryInfoW
InternetOpenW
InternetOpenUrlW
api-ms-win-crt-math-l1-1-0
ceilf
CheckShellTask
EnumeratePlugins
EnumeratePluginsWithApplicationSource
ExecuteShell
GetPluginDefaultSettings
GetSettingsName
Plugin_DetectCondition
Plugin_Init
Plugin_IsActionApplicable
Plugin_IsEnabled
Plugin_IsInteractiveOnly
Plugin_PerformAction
Plugin_Process
Plugin_Process_Aqua
Plugin_Uninit
RegisterApplication
SedimentDriver_Init
SedimentDriver_Init_Aqua
SedimentDriver_Uninit
Name
.text
Size
375KB
Virtual Size
374KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
168KB
Virtual Size
168KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=257, version=27412,
count=155, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1402, id=1, productName=Unmarked objects,
count=9, id=260, version=27412,
count=3, id=259, version=27412,
count=1, id=256, version=27412,
count=93, id=264, version=27412,
count=32, id=261, version=27412,
count=2, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
jjkj/sendmail.dll
- IMPHASH 9a2286798f785ee11497fa3d113d6cbe
- SHA256 b5e80992e94fe42b23f4cadc29bc5272f2ec868c36fbe1de90f1b5dcca2394ad
- MD5 797a7e4537d538e045b2bf239259a925
- SHA1 f4dbc8d5b2d108200126d3b5b072b03ee3d6cc23
- SHA512 7193044407dc3945150467453ee4cf7cec7fce2abb189aee9882104a2b99eb128691f10f29ebf421f833468d3d4da1d0cf6d5df6eba98255627675dcd2353de6
- SSDEEP 1536:75AKIc+5W38vl11d+ItKUvJ5TGL1tsOmslzaJtgBPwoMyV2eJN:2Pjl5+ItKUh56pyj2w0VZv
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
66304
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
sendmail.pdb
msvcrt
__C_specific_handler
_lock
_unlock
malloc
free
_amsg_exit
_onexit
_XcptFilter
__CxxFrameHandler3
wcscat_s
wcscpy_s
_initterm
memset
memcmp
_vsnwprintf
_get_errno
wcstok
_set_errno
wcsncmp
memcpy_s
__dllonexit
wcscmp
shell32
ord740
SHGetFileInfoW
ord155
SHCreateItemFromParsingName
SHGetKnownFolderPath
SHBindToObject
ord682
DragQueryFileW
SHGetItemFromDataObject
SHEvaluateSystemCommandTemplate
SHFileOperationW
ord171
SHGetSpecialFolderPathW
SHGetDesktopFolder
ord850
ord28
ord75
shlwapi
ord346
PathIsUNCW
PathSkipRootW
PathIsURLW
StrStrIW
PathFindNextComponentW
ord16
SHQueryValueExW
StrCmpW
StrFormatByteSizeW
PathCompactPathW
PathRenameExtensionW
PathAppendW
PathFindFileNameW
ord215
ord219
PathIsDirectoryW
PathRemoveFileSpecW
SHCreateStreamOnFileW
PathFindExtensionW
StrDupW
ord217
ord199
ord176
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameW
LoadLibraryExW
LoadStringW
GetProcAddress
FreeLibrary
DisableThreadLibraryCalls
GetModuleHandleExW
GetModuleFileNameA
GetModuleHandleW
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
CreateSemaphoreExW
LeaveCriticalSection
WaitForSingleObject
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
InitializeCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
DeleteCriticalSection
ReleaseSemaphore
CreateEventW
SetEvent
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
SetThreadPriority
CreateThread
GetCurrentProcessId
GetCurrentThread
GetExitCodeThread
GetCurrentProcess
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
FindNLSStringEx
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-heap-l2-1-0
GlobalFree
LocalFree
GlobalAlloc
LocalAlloc
api-ms-win-core-com-l1-1-0
CLSIDFromString
CoGetMalloc
CoCreateInstance
CoUninitialize
CoGetInterfaceAndReleaseStream
PropVariantClear
CoTaskMemAlloc
CoReleaseMarshalData
CoTaskMemFree
CoMarshalInterThreadInterfaceInStream
CoTaskMemRealloc
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-string-l1-1-0
CompareStringW
CompareStringOrdinal
api-ms-win-core-registry-l1-1-0
RegEnumValueW
RegQueryValueExW
RegCloseKey
RegGetValueW
RegQueryInfoKeyW
RegOpenKeyExW
api-ms-win-core-synch-l1-2-0
SleepConditionVariableSRW
WakeAllConditionVariable
InitOnceComplete
Sleep
InitOnceBeginInitialize
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventWriteTransfer
EventActivityIdControl
EventUnregister
EventRegister
api-ms-win-core-sysinfo-l1-1-0
GetTickCount64
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
api-ms-win-core-path-l1-1-0
PathCchRenameExtension
PathCchRemoveFileSpec
PathCchAppendEx
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-file-l1-1-0
CreateFileW
DeleteFileW
GetFileSize
api-ms-win-core-file-l1-2-0
GetTempPathW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
advapi32
RegQueryValueW
gdi32
DeleteObject
SelectObject
gdiplus
GdipDisposeImage
GdipFree
GdipGetImageEncoders
GdipRemovePropertyItem
GdipGetPropertyIdList
GdipGetImageEncodersSize
GdiplusShutdown
GdiplusStartup
GdipGetPropertyCount
GdipAlloc
GdipLoadImageFromFile
GdipCloneImage
GdipSaveImageToFile
GdipImageRotateFlip
kernel32
DeactivateActCtx
GlobalSize
CreateActCtxW
ReleaseActCtx
GlobalUnlock
ActivateActCtx
lstrlenW
GlobalLock
ole32
ReleaseStgMedium
CoInitialize
propsys
PSPropertyBag_ReadGUID
PSCreateSimplePropertyChange
PSCreatePropertyChangeArray
PropVariantToUInt32
user32
CreateDialogParamW
PostThreadMessageW
SetWindowTextW
GetMessageW
IsDialogMessageW
TranslateMessage
RegisterClipboardFormatW
GetClientRect
GetDlgItem
GetWindowLongPtrW
SetWindowLongPtrW
SendMessageW
DispatchMessageW
DestroyIcon
DefWindowProcW
DestroyWindow
GetDC
MessageBoxW
EnableWindow
GetWindowRect
ShowWindow
IsWindow
SetDlgItemTextW
ReleaseDC
wininet
DeleteUrlCacheEntryW
CreateUrlCacheEntryW
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
65KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
328B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=60, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=27412,
count=18, id=260, version=27412,
count=259, id=1, productName=Unmarked objects,
count=23, id=257, version=27412,
count=4, id=261, version=27412,
count=1, id=256, version=27412,
count=20, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,