microsoft-remote-desktop-2023-612-1723-0[.]appxbundle

Sharing

Copy URL Twitter E-mail

General

Target

microsoft-remote-desktop-2023-612-1723-0.appxbundle
Size

82.5MB
MD5

c2c26b44b4ac177a41dfdff5409fa66c
SHA1

0b551caf505170a28a022ac4fdbfe3a13de8597c
SHA256

bc114c2d53f1c59c2ecedda4bc0302837db3cea9260b83f444b08433adb270e6
SHA512

bd32cbac806fa3fa2ec40301d025042fd5969da4ba2073c6dab42a9126eca71f9e1945fc3d1a7588404842d655b7f1e5b8914875de40e25985ebed2b0d41ca19
SSDEEP

1572864:FYTQycXmqa2CEJYow88XiQ2L+ctKCO7GHvdDHoNY44odwokEbNZh/7PAGNnTrIxD:FYTAk2Cjoh8XwzKVyJ0ld1kEbHh/7YWK

Score

3^/10

Malware Config

Signatures

Unsigned PE 46 IoCs

Checks for missing Authenticode signature.

resource
unpack002/Email.winmd
unpack002/InputProfileSink.winmd
unpack002/Microsoft.RemoteDesktop.DesktopSharing.winmd
unpack002/Microsoft.RemoteDesktop.winmd
unpack002/PlatformExtension.dll
unpack002/PlatformExtension.winmd
unpack002/RdClient.BackgroundTasks.winmd
unpack002/RdClient.ConnectionManagerService.winmd
unpack002/RdClient.Windows.dll
unpack002/RdClient.Windows.exe
unpack002/RdClientWinRT.dll
unpack002/urdc.email-lookup.dll
unpack002/urdc.input-profile-sink.dll
unpack003/Email.winmd
unpack003/InputProfileSink.winmd
unpack003/Microsoft.RemoteDesktop.DesktopSharing.winmd
unpack003/Microsoft.RemoteDesktop.winmd
unpack003/PlatformExtension.winmd
unpack004/Email.winmd
unpack004/InputProfileSink.winmd
unpack004/Microsoft.RemoteDesktop.DesktopSharing.winmd
unpack004/Microsoft.RemoteDesktop.winmd
unpack004/MsRdcWebRTCAddIn.dll
unpack004/PlatformExtension.dll
unpack004/PlatformExtension.winmd
unpack004/RdClient.BackgroundTasks.winmd
unpack004/RdClient.ConnectionManagerService.winmd
unpack004/RdClient.Windows.dll
unpack004/RdClient.Windows.exe
unpack004/RdClientWinRT.dll
unpack004/urdc.email-lookup.dll
unpack004/urdc.input-profile-sink.dll
unpack005/Email.winmd
unpack005/InputProfileSink.winmd
unpack005/Microsoft.RemoteDesktop.DesktopSharing.winmd
unpack005/Microsoft.RemoteDesktop.winmd
unpack005/MsRdcWebRTCAddIn.dll
unpack005/PlatformExtension.dll
unpack005/PlatformExtension.winmd
unpack005/RdClient.BackgroundTasks.winmd
unpack005/RdClient.ConnectionManagerService.winmd
unpack005/RdClient.Windows.dll
unpack005/RdClient.Windows.exe
unpack005/RdClientWinRT.dll
unpack005/urdc.email-lookup.dll
unpack005/urdc.input-profile-sink.dll

Files

microsoft-remote-desktop-2023-612-1723-0.appxbundle
.zip
AppxBlockMap.xml
.xml
AppxMetadata/AppxBundleManifest.xml
.xml
AppxSignature.p7x
[Content_Types].xml
.xml
urdc_10.2.3012.0_ARM.appx
.appx
AppxBlockMap.xml
.xml
AppxManifest.xml
AppxMetadata/CodeIntegrity.cat
AppxSignature.p7x
Assets/BadgeLogo.scale-100.png
.png
Assets/BadgeLogo.scale-125.png
.png
Assets/BadgeLogo.scale-150.png
.png
Assets/BadgeLogo.scale-200.png
.png
Assets/BadgeLogo.scale-400.png
.png
Assets/Day0.png
.png
Assets/FileExplorerIcon/RemoteDesktopExtension.targetsize-16.png
.png
Assets/FileExplorerIcon/RemoteDesktopExtension.targetsize-20.png
.png
Assets/FileExplorerIcon/RemoteDesktopExtension.targetsize-24.png
.png
Assets/FileExplorerIcon/RemoteDesktopExtension.targetsize-256.png
.png
Assets/FileExplorerIcon/RemoteDesktopExtension.targetsize-32.png
.png
Assets/FileExplorerIcon/RemoteDesktopExtension.targetsize-40.png
.png
Assets/FileExplorerIcon/RemoteDesktopExtension.targetsize-48.png
.png
Assets/FileExplorerIcon/RemoteDesktopExtension.targetsize-64.png
.png
Assets/Fonts/RDPMDL2.1.91.ttf
Assets/NewStoreLogo.scale-100.png
.png
Assets/NewStoreLogo.scale-125.png
.png
Assets/NewStoreLogo.scale-150.png
.png
Assets/NewStoreLogo.scale-200.png
.png
Assets/NewStoreLogo.scale-400.png
.png
Assets/SplashScreen.scale-100.png
.png
Assets/SplashScreen.scale-125.png
.png
Assets/SplashScreen.scale-150.png
.png
Assets/SplashScreen.scale-200.png
.png
Assets/SplashScreen.scale-400.png
.png
Assets/Square150x150Logo.scale-100.png
.png
Assets/Square150x150Logo.scale-125.png
.png
Assets/Square150x150Logo.scale-150.png
.png
Assets/Square150x150Logo.scale-200.png
.png
Assets/Square150x150Logo.scale-400.png
.png
Assets/Square310x310Logo.scale-100.png
.png
Assets/Square310x310Logo.scale-125.png
.png
Assets/Square310x310Logo.scale-150.png
.png
Assets/Square310x310Logo.scale-200.png
.png
Assets/Square310x310Logo.scale-400.png
.png
Assets/Square44x44Logo.scale-100.png
.png
Assets/Square44x44Logo.scale-125.png
.png
Assets/Square44x44Logo.scale-150.png
.png
Assets/Square44x44Logo.scale-200.png
.png
Assets/Square44x44Logo.scale-400.png
.png
Assets/Square44x44Logo.targetsize-16.png
.png
Assets/Square44x44Logo.targetsize-16_altform-unplated.png
.png
Assets/Square44x44Logo.targetsize-24.png
.png
Assets/Square44x44Logo.targetsize-24_altform-unplated.png
.png
Assets/Square44x44Logo.targetsize-256.png
.png
Assets/Square44x44Logo.targetsize-256_altform-unplated.png
.png
Assets/Square44x44Logo.targetsize-32.png
.png
Assets/Square44x44Logo.targetsize-32_altform-unplated.png
.png
Assets/Square44x44Logo.targetsize-48.png
.png
Assets/Square44x44Logo.targetsize-48_altform-unplated.png
.png
Assets/Square71x71Logo.scale-100.png
.png
Assets/Square71x71Logo.scale-125.png
.png
Assets/Square71x71Logo.scale-150.png
.png
Assets/Square71x71Logo.scale-200.png
.png
Assets/Square71x71Logo.scale-400.png
.png
Assets/Wide310x150Logo.scale-100.png
.png
Assets/Wide310x150Logo.scale-125.png
.png
Assets/Wide310x150Logo.scale-150.png
.png
Assets/Wide310x150Logo.scale-200.png
.png
Assets/Wide310x150Logo.scale-400.png
.png
Assets/session_white_32.png
.png
Assets/windows_logo-01.png
.png
Email.winmd
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
InputProfileSink.winmd
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Microsoft.RemoteDesktop.DesktopSharing.winmd
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
Microsoft.RemoteDesktop.winmd
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
PlatformExtension.dll
.dll windows:6 windows

b24275191c0f2799bcd6f238505cd26b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\b\Release\ARM\PlatformExtension.pdb

Imports

msvcp140_app

?_Xlength_error@std@@YAXPBD@Z

vcruntime140_app

_CxxThrowException
__std_type_info_destroy_list
__std_exception_destroy
memset
memmove
memcpy
memcmp
__CxxFrameHandler3
__C_specific_handler
__std_terminate
__std_exception_copy

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_configure_narrow_argv
_initialize_onexit_table
_execute_onexit_table
_seh_filter_dll
_initterm_e
_initterm
_cexit
_invalid_parameter_noinfo
terminate
_errno

api-ms-win-crt-string-l1-1-0

strlen
iswspace

api-ms-win-crt-heap-l1-1-0

malloc
_callnewh
free

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
DisableThreadLibraryCalls
GetProcAddress

api-ms-win-core-interlocked-l1-1-0

InterlockedFlushSList
InterlockedPushEntrySList
InitializeSListHead

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

oleaut32

GetErrorInfo
SetErrorInfo
SysAllocString
SysStringLen
SysFreeString

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoTaskMemAlloc

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory

Sections

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PlatformExtension.winmd
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
RdClient.BackgroundTasks.winmd
.dll windows:4 windows

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
RdClient.ConnectionManagerService.winmd
.dll windows:4 windows

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
RdClient.Windows.dll
.dll windows:6 windows

4ee0364a23fcd7663ad3bc6b41bea610

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\b\Release\ARM\ilc\RdClient.Windows.pdb

Imports

mrt100_app

RhpNewFast
RhpAssignRefR1
RhpNewFastAlign8
RhpNewFastMisalign
RhpNewArray
RhpInitialInterfaceDispatch
RhpResolveInterfaceMethod
RhpCheckCctor2
RhpNewFinalizableAlign8
RhTypeCast_CheckArrayStore
RhpCheckedAssignRefR1
RhpLng2Dbl
RhpCopyMultibyteNoGCRefs
__rt_sdiv64
RhpNewFinalizable
RhpCopyMultibyteWithWriteBarrier
RhpNewArrayAlign8
RhpRethrow
RhpThrowEx
RhTypeCast_CheckCastClass
RhNewArray
RhAllocLocal
RhpInitMultibyte
RhpReversePInvoke
RhpReversePInvokeReturn
RhpPInvokeExceptionGuard
RhpSuppressGcStress
RhpRegisterModule
RhpUnsuppressGcStress
RhMemberwiseClone
RhpArrayCopy
RhTypeCast_IsInstanceOf
RhTypeCast_IsInstanceOfArray
RhpCheckedXchg
RhTypeCast_CheckCast
RhTypeCast_CheckCastArray
RhTypeCast_IsInstanceOfInterface
RhTypeCast_CheckCastInterface
RhpArrayClear
RhpCheckedLockCmpXchg
RhUnboxAny
RhpCopyAnyWithWriteBarrier
RhBoxAny
RhTypeCast_CheckVectorElemAddr
__rt_sdiv
RhTypeCast_IsInstanceOfClass
RhArrayStoreCheckAny
RhTypeCast_CheckUnbox
RhSuppressFinalize
RhHandleSet
RhHandleGetDependent
RhpHandleAllocDependent
RhpGetThread
RhpTrapThreads
RhpWaitForSuspend
RhpWaitForGC
RhTypeCast_AreTypesEquivalent
__rt_udiv
RhpHandleAlloc
RhNewString
memmove
RhTypeCast_AreTypesAssignable
RhUnbox
RhBox
RhNewObject
RhHandleFree
RhGetProcessCpuCount
RhSpinWait
RhCompatibleReentrantWaitAny
__rt_udiv64
RhCreateThunksHeap
RhSetThunkData
RhGetJmpStubCodeTarget
RhAllocateThunk
RhGetLoadedOSModules
RhSetErrorInfoBuffer
RhGetExceptionsForCurrentThread
RhpDbl2Lng
RhYield
RhReRegisterForFinalize
RhGetCurrentThreadStackBounds
RhGetOSModuleFromEEType
RhTryGetThunkData
RhFreeThunk
RhBulkMoveWithWriteBarrier
RhResolveDispatch
RhGetGeneration
RhFindBlob
RhGetModuleFromEEType
RhConvertPublicKeyToPublicKeyToken
RhGetDispatchMapForType
RhCreateGenericInstanceDescForType2
RhGetGCDescSize
RhRegisterGcCallout
RhpETWShouldWalkCom
RhpETWLogLiveCom
RhIsPromoted
RhHandleSetDependentSecondary
RhGetGcCollectionCount
RhGetCurrentObjSize
RhGetGCNow
RhGetLastGCStartTime
RhGetLastGCDuration
RhCollect
pow
floor
fmod
RhGetThreadLocalStorageForDynamicType
RhGetCodeTarget
RhGetTargetOfUnboxingAndInstantiatingStub
RhGetOSModuleFromPointer
RhResolveDispatchOnType
RhGetUniversalTransitionThunk
RhpCopyMultibyte
RhInitializeConservativeReportingRegion
RhDisableConservativeReportingRegion
RhCallDescrWorker
RhRegisterRefCountedHandleCallback
memset
RhpULng2Dbl
_ecvt_s
RhpDbl2ULng
RhpCreateTypeManager
RhpRegisterOsModule
RhpGetModuleSection
RhpRegisterFrozenSegment
RhFindMethodStartAddress
RhGetModuleFileName
__rt_srsh
RhpDblRemRev
RhpFltRemRev
RhGetRuntimeHelperForType
RhNewInterfaceDispatchCell
RhGetThunkSize
RhGetThreadStaticFieldAddress
modf
asin
RhpEtwExceptionThrown
tan
sin
cos
RhpLoopHijack

rdclient.windows

CreateCommandLine

ole32

CoTaskMemFree
CoTaskMemAlloc
CoGetApartmentType
CoCreateGuid

api-ms-win-core-errorhandling-l1-1-0

SetLastError
GetLastError

kernel32

FormatMessageW
SetEvent
CreateEventExW
WaitForMultipleObjectsEx
GetThreadPriority
GetCurrentProcess
GetCurrentThread
DuplicateHandle
GetLocaleInfoEx
ResolveLocaleName
LCMapStringEx
LCIDToLocaleName
CompareStringOrdinal
GetCalendarInfoEx
EnumCalendarInfoExEx
EnumTimeFormatsEx
CompareStringEx
Sleep
SetThreadPriority
ResetEvent
FindStringOrdinal
FindNLSStringEx
GetCurrentProcessId
QueryPerformanceFrequency
GetVersionExW
GetCPInfo
WideCharToMultiByte
MultiByteToWideChar
LocalAlloc
GetLongPathNameW
GetFullPathNameW
SetFileCompletionNotificationModes
K32EnumProcesses
FindFirstFileExW
GetFileAttributesExW
OpenProcess
GetComputerNameW
CreateThread
EnumSystemLocalesEx
CancelIoEx
GetExitCodeProcess
WriteFile
CreateFile2
SetThreadErrorMode
ReadFile
SetEndOfFile
FlushFileBuffers
GetFileType
QueryPerformanceCounter
SetFilePointerEx
GetFileInformationByHandleEx
ResumeThread
WaitForSingleObject
FindClose
CloseHandle
LocaleNameToLCID
LocalFree
GetProcessId

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc
HeapReAlloc

api-ms-win-core-winrt-l1-1-0

RoInitialize
RoUninitialize
RoGetActivationFactory

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetSystemTimeAsFileTime

api-ms-win-core-kernel32-legacy-l1-1-0

RaiseFailFastException

advapi32

EventActivityIdControl
EventSetInformation
EnumerateTraceGuidsEx
RevertToSelf
ImpersonateLoggedOnUser
OpenProcessToken
OpenThreadToken
GetTokenInformation
AdjustTokenPrivileges
LookupPrivilegeValueW
EnableTraceEx2
StartTraceW
StopTraceW
FlushTraceW
LsaOpenPolicy
LsaLookupNames2
LsaLookupSids
CryptGenKey
CryptSetProvParam
CryptImportKey
CryptGetProvParam
CryptGetUserKey
CryptAcquireContextW
CryptGetDefaultProviderW
CryptGetKeyParam
EventRegister
EventWriteTransfer
LsaNtStatusToWinError
LsaClose
LsaFreeMemory
CryptDestroyKey
CryptReleaseContext
EventUnregister

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformationForYear
GetDynamicTimeZoneInformationEffectiveYears
EnumDynamicTimeZoneInformation
GetDynamicTimeZoneInformation

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWork
CloseThreadpoolWork
SubmitThreadpoolWork
CancelThreadpoolIo
CreateThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolIo
StartThreadpoolIo
CloseThreadpoolIo

bcrypt

BCryptCreateHash
BCryptFinishHash
BCryptHashData
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptGenRandom
BCryptExportKey
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptDestroyKey

api-ms-win-core-localization-l1-2-0

FormatMessageW
IsValidLocaleName
ResolveLocaleName

api-ms-win-core-com-l1-1-0

CoGetObjectContext
CoReleaseMarshalData
CoUnmarshalInterface
CoGetMarshalSizeMax
CoMarshalInterface
CoGetContextToken
CoCreateFreeThreadedMarshaler
CoCreateInstanceFromApp

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsCreateStringReference

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent

oleaut32

SysFreeString
SysStringLen
VariantClear
SysAllocStringLen

api-ms-win-core-winrt-error-l1-1-0

GetRestrictedErrorInfo
RoOriginateError
SetRestrictedErrorInfo

normaliz

NormalizeString
IdnToAscii
IdnToUnicode

ncrypt

NCryptOpenStorageProvider
NCryptCreatePersistedKey
NCryptSetProperty
NCryptVerifySignature
NCryptGetProperty
NCryptImportKey
NCryptOpenKey
NCryptDeleteKey
NCryptFinalizeKey
NCryptFreeObject

ws2_32

WSAGetOverlappedResult
getpeername
select
getsockname
setsockopt
ioctlsocket
WSAIoctl
recv
shutdown
WSAConnect
getsockopt
WSASocketW
gethostname
WSAStartup
closesocket
GetAddrInfoW
FreeAddrInfoExW
WSASend
WSARecv
accept
bind
listen
GetNameInfoW
GetAddrInfoExW
send
freeaddrinfo

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

crypt32

CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertAddCertificateLinkToStore
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertOpenStore
CertFindCertificateInStore
CertGetIntendedKeyUsage
CertFindExtension
CryptDecodeObject
CertGetValidUsages
CryptFindOIDInfo
CertVerifyTimeValidity
CertGetNameStringW
CertControlStore
CryptImportPublicKeyInfoEx2
CryptFormatObject
CertNameToStrW
PFXImportCertStore
CryptMsgGetParam
CryptQueryObject
CertSetCertificateContextProperty
CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CertFreeCertificateChain

iphlpapi

GetNetworkParams

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException
RoReportUnhandledError

api-ms-win-ro-typeresolution-l1-1-0

RoParseTypeName

sspicli

FreeCredentialsHandle
AcquireCredentialsHandleW
InitializeSecurityContextW
DeleteSecurityContext
AcceptSecurityContext
ApplyControlToken
QueryContextAttributesW
EnumerateSecurityPackagesW
DecryptMessage
EncryptMessage
LsaGetLogonSessionData
FreeContextBuffer
LsaFreeReturnBuffer

api-ms-win-core-winrt-robuffer-l1-1-0

RoGetBufferMarshaler

api-ms-win-core-processthreads-l1-1-1

GetCurrentProcessorNumber

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW

Exports

Exports

$thread_static_index
ActivatorCreateInstanceAny
AppendExceptionStackFrame
CheckStaticClassConstruction
CreateCommandLine
Dbl2IntOvf
Dbl2LngOvf
Dbl2UIntOvf
Dbl2ULngOvf
DebugFuncEvalAbortHelper
DebugFuncEvalHelper
DllGetActivationFactory
DllGetClassObject
FailFast
Flt2IntOvf
Flt2LngOvf
GenericLookup
GenericLookupAndAllocArray
GenericLookupAndAllocObject
GenericLookupAndCallCtor
GenericLookupAndCast
GenericLookupAndCheckArrayElemType
GetRuntimeException
GetSystemArrayEEType
GetThreadStaticsForDynamicType
InitializeFinalizerThread
InitializeModules
InvokeExeMain
LMulOvf
OnFirstChanceException
RHBinder__ShimExeMain
ULMulOvf
UpdateMethodFloatingDictionary
UpdateTypeFloatingDictionary

Sections

.rdata
Size: 9.6MB - Virtual size: 9.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 549KB - Virtual size: 549KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 8.2MB - Virtual size: 8.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RdClient.Windows.exe
.exe windows:6 windows

f4f50b0d1c08bc9c838cf396b7757afc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

rdclient.windows

RHBinder__ShimExeMain

Sections

.rdata
Size: 512B - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RdClient.Windows.exe.config
RdClientWinRT.dll
.dll windows:6 windows

254ccd83758b5c3d1c48a531fc1277eb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\b\release\arm32\RdClientWinRT.pdb

Imports

advapi32

EventWriteTransfer
EventRegister
EventActivityIdControl
EventSetInformation

d3d11

D3D11CreateDevice

d2d1

ord1

user32

MapVirtualKeyExW

ole32

CoIncrementMTAUsage
CoCreateGuid
StringFromGUID2
CoCreateFreeThreadedMarshaler
CoGetApartmentType
CoGetObjectContext
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc

kernel32

LoadPackagedLibrary
FreeLibrary
GetProcAddress
GetCurrentPackageFullName
GetModuleHandleW
GetModuleHandleExW
CreateFileW
GetStartupInfoW
LoadLibraryExW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetOEMCP
CreateTimerQueue
CreateTimerQueueTimer
DebugBreak
CreateMutexExW
OpenSemaphoreW
ReleaseMutex
AreFileApisANSI
GetFileInformationByHandle
LoadLibraryW
UnregisterWaitEx
VirtualProtect
VirtualAlloc
GetModuleHandleA
UnregisterWait
RegisterWaitForSingleObject
SetThreadGroupAffinity
GetThreadGroupAffinity
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer

rpcrt4

UuidFromStringW

bcrypt

BCryptOpenAlgorithmProvider
BCryptGenRandom
BCryptGenerateSymmetricKey
BCryptDestroyKey
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptFinishHash
BCryptEncrypt
BCryptCreateHash
BCryptHashData
BCryptImportKeyPair

ws2_32

WSAIoctl
WSAEventSelect
WSASendTo
WSARecvFrom
ntohs
ntohl
htons
getpeername
freeaddrinfo
getaddrinfo
WSASocketW
WSAWaitForMultipleEvents
setsockopt
select
listen
getsockopt
getsockname
ioctlsocket
connect
closesocket
bind
accept
__WSAFDIsSet
getnameinfo
recv
WSAStartup
WSACleanup
WSARecv
send
shutdown
WSAAddressToStringW
WSASend
htonl
WSAStringToAddressW
WSAGetLastError
WSASetLastError

api-ms-win-core-errorhandling-l1-1-0

RaiseException
GetLastError
SetLastError

api-ms-win-core-processthreads-l1-1-0

CreateThread
GetCurrentThreadId
TlsFree
GetExitCodeThread
SwitchToThread
TlsAlloc
TlsSetValue
GetCurrentProcess
GetCurrentThread
FlushProcessWriteBuffers
ExitThread
SetThreadPriority
TlsGetValue
ResumeThread
GetCurrentProcessId
ExitProcess
TerminateProcess
GetThreadPriority

api-ms-win-core-console-l1-1-0

WriteConsoleW
GetConsoleMode
GetConsoleCP
ReadConsoleW

api-ms-win-core-heap-l1-1-0

HeapSize
GetProcessHeap
HeapFree
HeapAlloc
HeapReAlloc

api-ms-win-core-synch-l1-1-0

SetWaitableTimer
SetEvent
CreateSemaphoreExW
ReleaseSemaphore
OpenEventA
CreateEventA
CreateEventExW
WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
CreateEventW
ResetEvent
InitializeCriticalSection
ReleaseSRWLockShared
AcquireSRWLockShared
InitializeCriticalSectionEx
InitializeSRWLock
ReleaseSRWLockExclusive
WaitForMultipleObjectsEx
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
TryEnterCriticalSection
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineA
GetCurrentDirectoryW
GetCommandLineW
GetStdHandle
GetEnvironmentStringsW
SetStdHandle
FreeEnvironmentStringsW
SetEnvironmentVariableW

api-ms-win-core-file-l1-1-0

GetFileAttributesW
GetFileAttributesExW
FindFirstFileW
FindNextFileW
FindFirstFileExW
GetFullPathNameW
ReadFile
GetDriveTypeW
SetEndOfFile
FlushFileBuffers
WriteFile
SetFilePointerEx
GetFileType
FindClose
GetFileSizeEx

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation
GetDynamicTimeZoneInformation
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-string-l1-1-0

GetStringTypeW
MultiByteToWideChar
CompareStringEx
WideCharToMultiByte

api-ms-win-core-sysinfo-l1-1-0

GetLogicalProcessorInformationEx
GetSystemTime
GetSystemInfo
GetTickCount64
GetLocalTime
GetSystemTimeAsFileTime

api-ms-win-core-localization-l1-2-0

IsValidCodePage
LCMapStringEx
GetCPInfo
FormatMessageW
GetLocaleInfoW
GetACP
GetLocaleInfoEx
FormatMessageA

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
GetModuleFileNameA
FreeLibraryAndExitThread

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwindEx
RtlLookupFunctionEntry
RtlPcToFileHeader

api-ms-win-core-interlocked-l1-1-0

InterlockedFlushSList
InterlockedPushEntrySList
InitializeSListHead
QueryDepthSList
InterlockedPopEntrySList

api-ms-win-core-fibers-l1-1-0

FlsFree
FlsSetValue
FlsGetValue
FlsAlloc

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-processthreads-l1-1-1

GetCurrentProcessorNumberEx
IsProcessorFeaturePresent
GetThreadTimes

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-synch-l1-2-0

SleepConditionVariableCS
SleepConditionVariableSRW
WakeConditionVariable
SignalObjectAndWait
InitOnceExecuteOnce
InitializeConditionVariable
Sleep
WakeAllConditionVariable

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime
GetNativeSystemInfo

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolIo
WaitForThreadpoolTimerCallbacks
TrySubmitThreadpoolCallback
CloseThreadpoolCleanupGroup
CloseThreadpoolWait
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolTimer
CloseThreadpool
StartThreadpoolIo
CancelThreadpoolIo
WaitForThreadpoolIoCallbacks
SetThreadpoolThreadMinimum
SetThreadpoolThreadMaximum
CreateThreadpool
CreateThreadpoolCleanupGroup
CreateThreadpoolWait
CloseThreadpoolIo
FreeLibraryWhenCallbackReturns
SetThreadpoolTimer
SetThreadpoolWait
CreateThreadpoolTimer

api-ms-win-core-memory-l1-1-0

VirtualQuery
VirtualFree

api-ms-win-core-processtopology-obsolete-l1-1-0

GetProcessAffinityMask

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW
WaitForMultipleObjects

oleaut32

SysStringLen
SysFreeString
SysAllocString
SetErrorInfo
VariantClear
VariantCopy
VariantInit
GetErrorInfo

crypt32

CertFreeCertificateContext
CryptDecodeObject
CertDuplicateCertificateContext
CryptProtectData
CryptUnprotectData
CertVerifySubjectCertificateContext
CertCreateCertificateContext

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe
DisconnectNamedPipe

api-ms-win-core-io-l1-1-0

CancelIoEx
DeviceIoControl
GetQueuedCompletionStatus
CreateIoCompletionPort

iphlpapi

GetAdaptersAddresses

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-synch-ansi-l1-1-0

CreateWaitableTimerA

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoInitialize

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsPreallocateStringBuffer
WindowsDeleteString
WindowsPromoteStringBuffer
WindowsGetStringRawBuffer

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory

Sections

.text
Size: 6.5MB - Virtual size: 6.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4.5MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.0MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 216KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 417KB - Virtual size: 416KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RemoteVoiceCommands.xml
Strings/da-DK/PDP-Preview.xml
.xml
Strings/da-DK/PDP-RTM.xml
.xml
Strings/de-DE/PDP-Preview.xml
.xml
Strings/de-DE/PDP-RTM.xml
.xml
Strings/en-GB/PDP-Preview.xml
.xml
Strings/en-GB/PDP-RTM.xml
.xml
Strings/en-US/NOTICE.html
.html
Strings/en-US/PDP-Preview.xml
.xml
Strings/en-US/PDP-RTM.xml
.xml
Strings/es-ES/PDP-Preview.xml
.xml
Strings/es-ES/PDP-RTM.xml
.xml
Strings/fi-FI/PDP-Preview.xml
.xml
Strings/fi-FI/PDP-RTM.xml
.xml
Strings/fr-FR/PDP-Preview.xml
.xml
Strings/fr-FR/PDP-RTM.xml
.xml
Strings/it-IT/PDP-Preview.xml
.xml
Strings/it-IT/PDP-RTM.xml
.xml
Strings/ja-JP/PDP-Preview.xml
.xml
Strings/ja-JP/PDP-RTM.xml
.xml
Strings/nb-NO/PDP-Preview.xml
.xml
Strings/nb-NO/PDP-RTM.xml
.xml
Strings/nl-NL/PDP-Preview.xml
.xml
Strings/nl-NL/PDP-RTM.xml
.xml
Strings/pl-PL/PDP-Preview.xml
.xml
Strings/pl-PL/PDP-RTM.xml
.xml
Strings/pt-BR/PDP-Preview.xml
.xml
Strings/pt-BR/PDP-RTM.xml
.xml
Strings/ru-RU/PDP-Preview.xml
.xml
Strings/ru-RU/PDP-RTM.xml
.xml
Strings/sv-SE/PDP-Preview.xml
.xml
Strings/sv-SE/PDP-RTM.xml
.xml
Strings/zh-CN/PDP-Preview.xml
.xml
Strings/zh-CN/PDP-RTM.xml
.xml
Strings/zh-TW/PDP-Preview.xml
.xml
Strings/zh-TW/PDP-RTM.xml
.xml
[Content_Types].xml
.xml
clrcompression.dll
.dll windows:6 windows

5a51928c11ae88f8c7e463bab1d9868a

Code Sign

33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:37

Not After

02/05/2020, 21:37

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7d:ac:7a:1c:22:5c:ef:b8:fc:6c:5b:48:46:0e:ed:3f:67:e2:1b:d2:53:6a:8f:85:48:64:d3:6b:e1:d2:99:1c
Signer

Actual PE Digest

7d:ac:7a:1c:22:5c:ef:b8:fc:6c:5b:48:46:0e:ed:3f:67:e2:1b:d2:53:6a:8f:85:48:64:d3:6b:e1:d2:99:1c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\A\_work\354\s\corefx\bin\obj\Windows_NT.arm.Release\native_aot\clrcompression\Release\clrcompression.pdb

Imports

kernel32

GetCurrentThreadId
GetTickCount64
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
QueryPerformanceCounter

ole32

CoTaskMemFree
CoTaskMemAlloc

Exports

Exports

crc32
deflate
deflateEnd
deflateInit2_
inflate
inflateEnd
inflateInit2_
zlibCompileFlags

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 456B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
resources.pri
urdc.email-lookup.dll
.dll windows:6 windows

0c2c1b3bbf2a835493e06b3e7924f29e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\b\Release\ARM\urdc.email-lookup.pdb

Imports

dnsapi

DnsFree
DnsQuery_W

vccorlib140_app

?__abi_WinRTraiseOutOfMemoryException@@YAXXZ
?__abi_WinRTraiseWrongThreadException@@YAXXZ
?__abi_WinRTraiseOutOfBoundsException@@YAXXZ
?__abi_WinRTraiseChangedStateException@@YAXXZ
?TerminateModule@Details@Platform@@YA_NPAVModuleBase@1WRL@Microsoft@@@Z
?UninitializeData@Details@Platform@@YAXH@Z
?InitializeData@Details@Platform@@YAJH@Z
?GetIidsFn@@YAJHPAKPBU__s_GUID@@PAPAVGuid@Platform@@@Z
?__abi_WinRTraiseObjectDisposedException@@YAXXZ
?__abi_WinRTraiseInvalidCastException@@YAXXZ
?__abi_WinRTraiseNotImplementedException@@YAXXZ
??0Object@Platform@@Q$AAA@XZ
?Allocate@Heap@Details@Platform@@SAPAXII@Z
?Free@Heap@Details@Platform@@SAXPAX@Z
?AlignedFree@Heap@Details@Platform@@SAXPAX@Z
?ReleaseTarget@ControlBlock@Details@Platform@@AAAXXZ
?__abi_WinRTraiseDisconnectedException@@YAXXZ
?__abi_WinRTraiseFailureException@@YAXXZ
?__abi_WinRTraiseOperationCanceledException@@YAXXZ
?__abi_WinRTraiseAccessDeniedException@@YAXXZ
?__abi_WinRTraiseInvalidArgumentException@@YAXXZ
?__abi_WinRTraiseClassNotRegisteredException@@YAXXZ
?__abi_WinRTraiseCOMException@@YAXJ@Z
?__abi_translateCurrentException@@YAJ_N@Z
?GetActivationFactory@Details@Platform@@YAJPAVModuleBase@1WRL@Microsoft@@PAUHSTRING__@@PAPAUIActivationFactory@@@Z
?__abi_WinRTraiseNullReferenceException@@YAXXZ

vcruntime140_app

memset
__std_type_info_destroy_list
__C_specific_handler
__CxxFrameHandler3

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf

api-ms-win-crt-string-l1-1-0

wcscmp
wcslen

api-ms-win-crt-runtime-l1-1-0

_cexit
_execute_onexit_table
_initterm
_configure_narrow_argv
_initialize_onexit_table
_crt_atexit
_seh_filter_dll
_register_onexit_function
_initterm_e
_initialize_narrow_environment

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString
WindowsDuplicateString
WindowsGetStringRawBuffer
WindowsDeleteString

api-ms-win-core-util-l1-1-0

DecodePointer

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
ReleaseSRWLockExclusive

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 852B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
urdc.input-profile-sink.dll
.dll windows:6 windows

cd6362a7b6892f8a11fa2372b4db3519

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\b\Release\ARM\urdc.input-profile-sink.pdb

Imports

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoCreateInstanceFromApp

vccorlib140_app

?__abi_WinRTraiseOutOfMemoryException@@YAXXZ
?__abi_WinRTraiseWrongThreadException@@YAXXZ
?__abi_WinRTraiseOutOfBoundsException@@YAXXZ
?__abi_WinRTraiseChangedStateException@@YAXXZ
?__abi_WinRTraiseNullReferenceException@@YAXXZ
?__abi_translateCurrentException@@YAJ_N@Z
?__abi_WinRTraiseCOMException@@YAXJ@Z
?__abi_WinRTraiseClassNotRegisteredException@@YAXXZ
?__abi_WinRTraiseInvalidArgumentException@@YAXXZ
?TerminateModule@Details@Platform@@YA_NPAVModuleBase@1WRL@Microsoft@@@Z
?UninitializeData@Details@Platform@@YAXH@Z
?InitializeData@Details@Platform@@YAJH@Z
?GetIidsFn@@YAJHPAKPBU__s_GUID@@PAPAVGuid@Platform@@@Z
?__abi_WinRTraiseObjectDisposedException@@YAXXZ
?__abi_WinRTraiseInvalidCastException@@YAXXZ
?__abi_WinRTraiseNotImplementedException@@YAXXZ
??0Object@Platform@@Q$AAA@XZ
?Allocate@Heap@Details@Platform@@SAPAXII@Z
?Free@Heap@Details@Platform@@SAXPAX@Z
?AlignedFree@Heap@Details@Platform@@SAXPAX@Z
?ReleaseTarget@ControlBlock@Details@Platform@@AAAXXZ
?__abi_WinRTraiseDisconnectedException@@YAXXZ
?__abi_WinRTraiseFailureException@@YAXXZ
?__abi_WinRTraiseOperationCanceledException@@YAXXZ
?GetActivationFactory@Details@Platform@@YAJPAVModuleBase@1WRL@Microsoft@@PAUHSTRING__@@PAPAUIActivationFactory@@@Z
?__abi_WinRTraiseAccessDeniedException@@YAXXZ

vcruntime140_app

memcmp
__C_specific_handler
__std_exception_copy
__std_type_info_destroy_list
_CxxThrowException
__std_exception_destroy
__CxxFrameHandler3

api-ms-win-crt-string-l1-1-0

wcscmp

api-ms-win-crt-heap-l1-1-0

_callnewh
free
malloc

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_initterm_e
_initialize_onexit_table
_initialize_narrow_environment
_initterm
_execute_onexit_table
_register_onexit_function
_configure_narrow_argv
_seh_filter_dll
_cexit

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString

api-ms-win-core-util-l1-1-0

DecodePointer

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
ReleaseSRWLockExclusive

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
urdc_10.2.3012.0_ARM64.appx
.appx
AppxBlockMap.xml
.xml
AppxManifest.xml
AppxMetadata/CodeIntegrity.cat
AppxSignature.p7x
Assets/BadgeLogo.scale-100.png
.png
Assets/BadgeLogo.scale-125.png
.png
Assets/BadgeLogo.scale-150.png
.png
Assets/BadgeLogo.scale-200.png
.png
Assets/BadgeLogo.scale-400.png
.png
Assets/Day0.png
.png
Assets/FileExplorerIcon/RemoteDesktopExtension.targetsize-16.png
.png
Assets/FileExplorerIcon/RemoteDesktopExtension.targetsize-20.png
.png
Assets/FileExplorerIcon/RemoteDesktopExtension.targetsize-24.png
.png
Assets/FileExplorerIcon/RemoteDesktopExtension.targetsize-256.png
.png
Assets/FileExplorerIcon/RemoteDesktopExtension.targetsize-32.png
.png
Assets/FileExplorerIcon/RemoteDesktopExtension.targetsize-40.png
.png
Assets/FileExplorerIcon/RemoteDesktopExtension.targetsize-48.png
.png
Assets/FileExplorerIcon/RemoteDesktopExtension.targetsize-64.png
.png
Assets/Fonts/RDPMDL2.1.91.ttf
Assets/NewStoreLogo.scale-100.png
.png
Assets/NewStoreLogo.scale-125.png
.png
Assets/NewStoreLogo.scale-150.png
.png
Assets/NewStoreLogo.scale-200.png
.png
Assets/NewStoreLogo.scale-400.png
.png
Assets/SplashScreen.scale-100.png
.png
Assets/SplashScreen.scale-125.png
.png
Assets/SplashScreen.scale-150.png
.png
Assets/SplashScreen.scale-200.png
.png
Assets/SplashScreen.scale-400.png
.png
Assets/Square150x150Logo.scale-100.png
.png
Assets/Square150x150Logo.scale-125.png
.png
Assets/Square150x150Logo.scale-150.png
.png
Assets/Square150x150Logo.scale-200.png
.png
Assets/Square150x150Logo.scale-400.png
.png
Assets/Square310x310Logo.scale-100.png
.png
Assets/Square310x310Logo.scale-125.png
.png
Assets/Square310x310Logo.scale-150.png
.png
Assets/Square310x310Logo.scale-200.png
.png
Assets/Square310x310Logo.scale-400.png
.png
Assets/Square44x44Logo.scale-100.png
.png
Assets/Square44x44Logo.scale-125.png
.png
Assets/Square44x44Logo.scale-150.png
.png
Assets/Square44x44Logo.scale-200.png
.png
Assets/Square44x44Logo.scale-400.png
.png
Assets/Square44x44Logo.targetsize-16.png
.png
Assets/Square44x44Logo.targetsize-16_altform-unplated.png
.png
Assets/Square44x44Logo.targetsize-24.png
.png
Assets/Square44x44Logo.targetsize-24_altform-unplated.png
.png
Assets/Square44x44Logo.targetsize-256.png
.png
Assets/Square44x44Logo.targetsize-256_altform-unplated.png
.png
Assets/Square44x44Logo.targetsize-32.png
.png
Assets/Square44x44Logo.targetsize-32_altform-unplated.png
.png
Assets/Square44x44Logo.targetsize-48.png
.png
Assets/Square44x44Logo.targetsize-48_altform-unplated.png
.png
Assets/Square71x71Logo.scale-100.png
.png
Assets/Square71x71Logo.scale-125.png
.png
Assets/Square71x71Logo.scale-150.png
.png
Assets/Square71x71Logo.scale-200.png
.png
Assets/Square71x71Logo.scale-400.png
.png
Assets/Wide310x150Logo.scale-100.png
.png
Assets/Wide310x150Logo.scale-125.png
.png
Assets/Wide310x150Logo.scale-150.png
.png
Assets/Wide310x150Logo.scale-200.png
.png
Assets/Wide310x150Logo.scale-400.png
.png
Assets/session_white_32.png
.png
Assets/windows_logo-01.png
.png
Email.winmd
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
InputProfileSink.winmd
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Microsoft.RemoteDesktop.DesktopSharing.winmd
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
Microsoft.RemoteDesktop.winmd
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
MsRdcWebRTCAddIn.dll
PlatformExtension.dll
PlatformExtension.winmd
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
RdClient.BackgroundTasks.winmd
RdClient.ConnectionManagerService.winmd
RdClient.Windows.dll
RdClient.Windows.exe
RdClient.Windows.exe.config
RdClientWinRT.dll
RemoteVoiceCommands.xml
Strings/da-DK/PDP-Preview.xml
.xml
Strings/da-DK/PDP-RTM.xml
.xml
Strings/de-DE/PDP-Preview.xml
.xml
Strings/de-DE/PDP-RTM.xml
.xml
Strings/en-GB/PDP-Preview.xml
.xml
Strings/en-GB/PDP-RTM.xml
.xml
Strings/en-US/NOTICE.html
.html
Strings/en-US/PDP-Preview.xml
.xml
Strings/en-US/PDP-RTM.xml
.xml
Strings/es-ES/PDP-Preview.xml
.xml
Strings/es-ES/PDP-RTM.xml
.xml
Strings/fi-FI/PDP-Preview.xml
.xml
Strings/fi-FI/PDP-RTM.xml
.xml
Strings/fr-FR/PDP-Preview.xml
.xml
Strings/fr-FR/PDP-RTM.xml
.xml
Strings/it-IT/PDP-Preview.xml
.xml
Strings/it-IT/PDP-RTM.xml
.xml
Strings/ja-JP/PDP-Preview.xml
.xml
Strings/ja-JP/PDP-RTM.xml
.xml
Strings/nb-NO/PDP-Preview.xml
.xml
Strings/nb-NO/PDP-RTM.xml
.xml
Strings/nl-NL/PDP-Preview.xml
.xml
Strings/nl-NL/PDP-RTM.xml
.xml
Strings/pl-PL/PDP-Preview.xml
.xml
Strings/pl-PL/PDP-RTM.xml
.xml
Strings/pt-BR/PDP-Preview.xml
.xml
Strings/pt-BR/PDP-RTM.xml
.xml
Strings/ru-RU/PDP-Preview.xml
.xml
Strings/ru-RU/PDP-RTM.xml
.xml
Strings/sv-SE/PDP-Preview.xml
.xml
Strings/sv-SE/PDP-RTM.xml
.xml
Strings/zh-CN/PDP-Preview.xml
.xml
Strings/zh-CN/PDP-RTM.xml
.xml
Strings/zh-TW/PDP-Preview.xml
.xml
Strings/zh-TW/PDP-RTM.xml
.xml
[Content_Types].xml
.xml
clrcompression.dll
resources.pri
urdc.email-lookup.dll
urdc.input-profile-sink.dll
urdc_10.2.3012.0_x64.appx
.appx
AppxBlockMap.xml
.xml
AppxManifest.xml
AppxMetadata/CodeIntegrity.cat
AppxSignature.p7x
Assets/BadgeLogo.scale-100.png
.png
Assets/BadgeLogo.scale-125.png
.png
Assets/BadgeLogo.scale-150.png
.png
Assets/BadgeLogo.scale-200.png
.png
Assets/BadgeLogo.scale-400.png
.png
Assets/Day0.png
.png
Assets/FileExplorerIcon/RemoteDesktopExtension.targetsize-16.png
.png
Assets/FileExplorerIcon/RemoteDesktopExtension.targetsize-20.png
.png
Assets/FileExplorerIcon/RemoteDesktopExtension.targetsize-24.png
.png
Assets/FileExplorerIcon/RemoteDesktopExtension.targetsize-256.png
.png
Assets/FileExplorerIcon/RemoteDesktopExtension.targetsize-32.png
.png
Assets/FileExplorerIcon/RemoteDesktopExtension.targetsize-40.png
.png
Assets/FileExplorerIcon/RemoteDesktopExtension.targetsize-48.png
.png
Assets/FileExplorerIcon/RemoteDesktopExtension.targetsize-64.png
.png
Assets/Fonts/RDPMDL2.1.91.ttf
Assets/NewStoreLogo.scale-100.png
.png
Assets/NewStoreLogo.scale-125.png
.png
Assets/NewStoreLogo.scale-150.png
.png
Assets/NewStoreLogo.scale-200.png
.png
Assets/NewStoreLogo.scale-400.png
.png
Assets/SplashScreen.scale-100.png
.png
Assets/SplashScreen.scale-125.png
.png
Assets/SplashScreen.scale-150.png
.png
Assets/SplashScreen.scale-200.png
.png
Assets/SplashScreen.scale-400.png
.png
Assets/Square150x150Logo.scale-100.png
.png
Assets/Square150x150Logo.scale-125.png
.png
Assets/Square150x150Logo.scale-150.png
.png
Assets/Square150x150Logo.scale-200.png
.png
Assets/Square150x150Logo.scale-400.png
.png
Assets/Square310x310Logo.scale-100.png
.png
Assets/Square310x310Logo.scale-125.png
.png
Assets/Square310x310Logo.scale-150.png
.png
Assets/Square310x310Logo.scale-200.png
.png
Assets/Square310x310Logo.scale-400.png
.png
Assets/Square44x44Logo.scale-100.png
.png
Assets/Square44x44Logo.scale-125.png
.png
Assets/Square44x44Logo.scale-150.png
.png
Assets/Square44x44Logo.scale-200.png
.png
Assets/Square44x44Logo.scale-400.png
.png
Assets/Square44x44Logo.targetsize-16.png
.png
Assets/Square44x44Logo.targetsize-16_altform-unplated.png
.png
Assets/Square44x44Logo.targetsize-24.png
.png
Assets/Square44x44Logo.targetsize-24_altform-unplated.png
.png
Assets/Square44x44Logo.targetsize-256.png
.png
Assets/Square44x44Logo.targetsize-256_altform-unplated.png
.png
Assets/Square44x44Logo.targetsize-32.png
.png
Assets/Square44x44Logo.targetsize-32_altform-unplated.png
.png
Assets/Square44x44Logo.targetsize-48.png
.png
Assets/Square44x44Logo.targetsize-48_altform-unplated.png
.png
Assets/Square71x71Logo.scale-100.png
.png
Assets/Square71x71Logo.scale-125.png
.png
Assets/Square71x71Logo.scale-150.png
.png
Assets/Square71x71Logo.scale-200.png
.png
Assets/Square71x71Logo.scale-400.png
.png
Assets/Wide310x150Logo.scale-100.png
.png
Assets/Wide310x150Logo.scale-125.png
.png
Assets/Wide310x150Logo.scale-150.png
.png
Assets/Wide310x150Logo.scale-200.png
.png
Assets/Wide310x150Logo.scale-400.png
.png
Assets/session_white_32.png
.png
Assets/windows_logo-01.png
.png
Email.winmd
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
InputProfileSink.winmd
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Microsoft.RemoteDesktop.DesktopSharing.winmd
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
Microsoft.RemoteDesktop.winmd
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
MsRdcWebRTCAddIn.dll
.dll windows:5 windows x64 arch:x64

af457349f804bd38465e2ce8f72a1968

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

MsRdcWebRTCAddIn.pdb

Imports

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
TraceMessage
UnregisterTraceGuids

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount64

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
AcquireSRWLockShared
CreateEventExW
CreateEventW
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSRWLock
LeaveCriticalSection
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ReleaseSemaphore
ResetEvent
SetEvent
TryEnterCriticalSection
WaitForMultipleObjectsEx
WaitForSingleObject
WaitForSingleObjectEx

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceComplete
InitOnceExecuteOnce
InitializeConditionVariable
Sleep
SleepConditionVariableCS
SleepConditionVariableSRW
WakeAllConditionVariable
WakeConditionVariable

api-ms-win-core-errorhandling-l1-1-0

GetLastError
RaiseException
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

CreateThread
ExitProcess
ExitThread
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetStartupInfoW
OpenThread
SetThreadPriority
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-localization-l1-2-0

EnumSystemLocalesW
FormatMessageA
FormatMessageW
GetACP
GetCPInfo
GetLocaleInfoW
GetOEMCP
GetUserDefaultLCID
IsValidCodePage
IsValidLocale
LCMapStringW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringA

api-ms-win-core-processenvironment-l1-1-0

FreeEnvironmentStringsW
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
GetStdHandle
SetEnvironmentVariableW
SetStdHandle

api-ms-win-core-file-l1-1-0

CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
FlushFileBuffers
GetFileSizeEx
GetFileType
ReadFile
SetEndOfFile
SetFilePointer
SetFilePointerEx
WriteFile

api-ms-win-mm-time-l1-1-0

timeBeginPeriod
timeEndPeriod
timeGetTime

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
LoadLibraryExA
LoadLibraryExW

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind

api-ms-win-core-util-l1-1-0

EncodePointer

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoCreateGuid
CoCreateInstance
CoGetApartmentType
CoInitializeEx
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CreateStreamOnHGlobal
PropVariantClear

ws2_32

WSACleanup
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSAResetEvent
WSASetEvent
WSAStartup
WSAWaitForMultipleEvents
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
getpeername
getsockname
getsockopt
htonl
htons
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
send
sendto
setsockopt
socket

api-ms-win-core-string-l1-1-0

CompareStringW
GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-registry-l1-1-0

RegGetValueW

api-ms-win-appmodel-runtime-l1-1-0

GetCurrentPackageId

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory
RoInitialize
RoUninitialize

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString
WindowsCreateStringReference
WindowsDeleteString
WindowsGetStringRawBuffer

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

mfplat

MFCancelWorkItem
MFCreateAsyncResult
MFCreateAttributes
MFCreateMediaType
MFCreateMemoryBuffer
MFCreateSample
MFPutWorkItem2
MFScheduleWorkItemEx
MFShutdown
MFStartup
MFTEnumEx
MFllMulDiv

oleaut32

VariantClear
VariantInit

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo
VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW
WaitForMultipleObjects

iphlpapi

GetAdaptersAddresses

api-ms-win-security-systemfunctions-l1-1-0

SystemFunction036

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-heap-l2-1-0

GlobalAlloc
GlobalFree

api-ms-win-core-memory-l1-1-0

VirtualProtect
VirtualQuery

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead
InterlockedFlushSList

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation

api-ms-win-core-console-l1-1-0

GetConsoleCP
GetConsoleMode
ReadConsoleW
WriteConsoleW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize

api-ms-win-core-datetime-l1-1-0

GetDateFormatW
GetTimeFormatW

Exports

Exports

VirtualChannelGetInstance

Sections

.text
Size: 12.1MB - Virtual size: 12.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 382KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 250KB - Virtual size: 249KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.retplne
Size: 512B - Virtual size: 24B

.rodata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 41B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PlatformExtension.dll
.dll windows:6 windows x64 arch:x64

9c407ad774c3ea1debf78c9a8905ec5c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\b\Release\x64\PlatformExtension.pdb

Imports

msvcp140_app

?_Xlength_error@std@@YAXPEBD@Z

vcruntime140_1_app

__CxxFrameHandler4

vcruntime140_app

memmove
memcpy
__std_type_info_destroy_list
_CxxThrowException
__std_exception_destroy
__std_exception_copy
__std_terminate
memcmp
__C_specific_handler
memset

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll
_initterm_e
_invalid_parameter_noinfo_noreturn
terminate
_invalid_parameter_noinfo
_cexit
_execute_onexit_table
_errno
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_initterm

api-ms-win-crt-string-l1-1-0

iswspace

api-ms-win-crt-heap-l1-1-0

_callnewh
free
malloc

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
DisableThreadLibraryCalls
GetProcAddress

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead
InterlockedPushEntrySList
InterlockedFlushSList

oleaut32

GetErrorInfo
SetErrorInfo
SysAllocString
SysStringLen
SysFreeString

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoCreateFreeThreadedMarshaler

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PlatformExtension.winmd
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
RdClient.BackgroundTasks.winmd
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
RdClient.ConnectionManagerService.winmd
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
RdClient.Windows.dll
.dll windows:6 windows x64 arch:x64

6ac956fd4b1a2347f85576290c563ce7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\b\Release\x64\ilc\RdClient.Windows.pdb

Imports

mrt100_app

RhpNewFast
RhpAssignRefEDX
RhpNewArray
RhpInitialInterfaceDispatch
RhpResolveInterfaceMethod
RhpCheckCctor2
RhpNewFinalizable
RhTypeCast_CheckArrayStore
RhpCheckedAssignRefEDX
RhpCopyMultibyteWithWriteBarrier
RhpRethrow
RhpThrowEx
RhTypeCast_CheckCastClass
RhAllocLocal
RhpInitMultibyte
RhpReversePInvoke
RhpReversePInvokeReturn
RhpPInvokeExceptionGuard
RhpSuppressGcStress
RhpRegisterModule
RhpUnsuppressGcStress
RhMemberwiseClone
RhpArrayCopy
RhTypeCast_IsInstanceOf
RhTypeCast_IsInstanceOfArray
RhpCheckedXchg
RhTypeCast_CheckCast
RhTypeCast_CheckCastArray
RhTypeCast_IsInstanceOfInterface
RhTypeCast_CheckCastInterface
RhpArrayClear
RhpCheckedLockCmpXchg
RhUnboxAny
RhpCopyAnyWithWriteBarrier
RhBoxAny
RhTypeCast_CheckVectorElemAddr
RhTypeCast_IsInstanceOfClass
RhArrayStoreCheckAny
RhTypeCast_CheckUnbox
RhSuppressFinalize
RhHandleSet
RhHandleGetDependent
RhpHandleAllocDependent
RhpGetThread
RhpTrapThreads
RhpWaitForSuspend
RhpWaitForGC
RhGetProcessCpuCount
RhTypeCast_AreTypesEquivalent
__chkstk
RhpHandleAlloc
RhNewString
memmove
RhTypeCast_AreTypesAssignable
RhUnbox
RhBox
RhNewObject
RhHandleFree
RhSpinWait
RhCompatibleReentrantWaitAny
RhCreateThunksHeap
RhSetThunkData
RhGetJmpStubCodeTarget
RhGetLoadedOSModules
RhSetErrorInfoBuffer
RhGetExceptionsForCurrentThread
RhAllocateThunk
RhNewArray
RhpCopyMultibyte
RhYield
RhReRegisterForFinalize
RhGetCurrentThreadStackBounds
RhGetOSModuleFromEEType
RhTryGetThunkData
RhFreeThunk
RhBulkMoveWithWriteBarrier
RhResolveDispatch
RhGetGeneration
RhFindBlob
RhGetModuleFromEEType
RhConvertPublicKeyToPublicKeyToken
RhGetDispatchMapForType
RhCreateGenericInstanceDescForType2
RhGetGCDescSize
RhRegisterGcCallout
RhpETWShouldWalkCom
RhpETWLogLiveCom
RhIsPromoted
RhHandleSetDependentSecondary
RhGetGcCollectionCount
RhGetCurrentObjSize
RhGetGCNow
RhGetLastGCStartTime
RhGetLastGCDuration
RhCollect
pow
fmod
RhGetThreadLocalStorageForDynamicType
RhGetCodeTarget
RhGetTargetOfUnboxingAndInstantiatingStub
RhGetOSModuleFromPointer
RhResolveDispatchOnType
RhGetUniversalTransitionThunk
RhInitializeConservativeReportingRegion
RhDisableConservativeReportingRegion
RhCallDescrWorker
RhRegisterRefCountedHandleCallback
memset
_ecvt_s
RhpGetModuleSection
RhpRegisterFrozenSegment
RhpCreateTypeManager
RhpRegisterOsModule
RhFindMethodStartAddress
RhGetModuleFileName
RhpDblRemRev
RhpFltRemRev
RhGetRuntimeHelperForType
RhNewInterfaceDispatchCell
RhGetThunkSize
RhGetThreadStaticFieldAddress
modf
asin
RhpEtwExceptionThrown
tan
sin
cos
RhpLoopHijack

rdclient.windows

CreateCommandLine

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetSystemTimeAsFileTime

ole32

CoCreateGuid
CoTaskMemFree
CoTaskMemAlloc
CoGetApartmentType

api-ms-win-core-errorhandling-l1-1-0

SetLastError
GetLastError

kernel32

FormatMessageW
SetEvent
CloseHandle
CreateEventExW
WaitForMultipleObjectsEx
GetThreadPriority
GetCurrentProcess
GetCurrentThread
DuplicateHandle
GetLocaleInfoEx
ResolveLocaleName
LCMapStringEx
LCIDToLocaleName
CompareStringOrdinal
GetCalendarInfoEx
EnumCalendarInfoExEx
EnumTimeFormatsEx
CompareStringEx
Sleep
SetThreadPriority
ResetEvent
FindStringOrdinal
FindNLSStringEx
GetCurrentProcessId
QueryPerformanceFrequency
GetVersionExW
GetCPInfo
WideCharToMultiByte
MultiByteToWideChar
LocalFree
LocalAlloc
GetLongPathNameW
GetFullPathNameW
SetFileCompletionNotificationModes
K32EnumProcesses
FindFirstFileExW
GetFileAttributesExW
ResumeThread
CreateThread
EnumSystemLocalesEx
CancelIoEx
GetExitCodeProcess
GetProcessId
WriteFile
CreateFile2
SetThreadErrorMode
ReadFile
SetEndOfFile
FlushFileBuffers
GetFileType
SetFilePointerEx
GetFileInformationByHandleEx
WaitForSingleObject
FindClose
LocaleNameToLCID
QueryPerformanceCounter
GetComputerNameW
OpenProcess

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc
HeapReAlloc

api-ms-win-core-winrt-l1-1-0

RoInitialize
RoUninitialize
RoGetActivationFactory

api-ms-win-core-kernel32-legacy-l1-1-0

RaiseFailFastException

advapi32

EventActivityIdControl
EventSetInformation
EnumerateTraceGuidsEx
RevertToSelf
ImpersonateLoggedOnUser
OpenProcessToken
OpenThreadToken
GetTokenInformation
AdjustTokenPrivileges
LookupPrivilegeValueW
EnableTraceEx2
StartTraceW
StopTraceW
FlushTraceW
LsaOpenPolicy
LsaLookupNames2
LsaClose
LsaLookupSids
CryptGenKey
CryptReleaseContext
CryptAcquireContextW
CryptSetProvParam
CryptImportKey
CryptDestroyKey
CryptGetProvParam
CryptGetUserKey
CryptGetDefaultProviderW
CryptGetKeyParam
EventRegister
EventWriteTransfer
LsaNtStatusToWinError
LsaFreeMemory
EventUnregister

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformationForYear
GetDynamicTimeZoneInformationEffectiveYears
EnumDynamicTimeZoneInformation
GetDynamicTimeZoneInformation

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWork
CloseThreadpoolWork
SubmitThreadpoolWork
CancelThreadpoolIo
CloseThreadpoolIo
CreateThreadpoolTimer
SetThreadpoolTimer
StartThreadpoolIo
CreateThreadpoolIo

bcrypt

BCryptCreateHash
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptDestroyHash
BCryptHashData
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptGenRandom
BCryptExportKey
BCryptDestroyKey

api-ms-win-core-localization-l1-2-0

FormatMessageW
IsValidLocaleName
ResolveLocaleName

api-ms-win-core-com-l1-1-0

CoGetObjectContext
CoReleaseMarshalData
CoUnmarshalInterface
CoGetMarshalSizeMax
CoMarshalInterface
CoGetContextToken
CoCreateFreeThreadedMarshaler
CoCreateInstanceFromApp

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateStringReference

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent

oleaut32

SysFreeString
SysStringLen
VariantClear
SysAllocStringLen

api-ms-win-core-winrt-error-l1-1-0

GetRestrictedErrorInfo
RoOriginateError
SetRestrictedErrorInfo

normaliz

NormalizeString
IdnToAscii
IdnToUnicode

ncrypt

NCryptOpenStorageProvider
NCryptFinalizeKey
NCryptCreatePersistedKey
NCryptSetProperty
NCryptVerifySignature
NCryptGetProperty
NCryptImportKey
NCryptDeleteKey
NCryptOpenKey
NCryptFreeObject

ws2_32

WSAGetOverlappedResult
getpeername
select
getsockname
setsockopt
ioctlsocket
WSAIoctl
closesocket
recv
shutdown
WSAConnect
getsockopt
WSASocketW
gethostname
WSAStartup
GetAddrInfoW
FreeAddrInfoExW
WSASend
WSARecv
accept
bind
listen
GetNameInfoW
GetAddrInfoExW
send
freeaddrinfo

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

crypt32

CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertCloseStore
CertAddCertificateLinkToStore
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertGetCertificateChain
CertOpenStore
CertFindCertificateInStore
CertGetIntendedKeyUsage
CertFindExtension
CryptDecodeObject
CertGetValidUsages
CryptFindOIDInfo
CertVerifyTimeValidity
CertGetNameStringW
CertControlStore
CryptImportPublicKeyInfoEx2
CryptFormatObject
CertNameToStrW
PFXImportCertStore
CryptMsgGetParam
CryptMsgClose
CryptQueryObject
CertSetCertificateContextProperty
CertFreeCertificateContext

iphlpapi

GetNetworkParams

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException
RoReportUnhandledError

api-ms-win-ro-typeresolution-l1-1-0

RoParseTypeName

sspicli

FreeCredentialsHandle
AcquireCredentialsHandleW
InitializeSecurityContextW
DeleteSecurityContext
AcceptSecurityContext
QueryContextAttributesW
EnumerateSecurityPackagesW
DecryptMessage
EncryptMessage
LsaGetLogonSessionData
FreeContextBuffer
ApplyControlToken
LsaFreeReturnBuffer

api-ms-win-core-winrt-robuffer-l1-1-0

RoGetBufferMarshaler

api-ms-win-core-processthreads-l1-1-1

GetCurrentProcessorNumber

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW

Exports

Exports

$thread_static_index
ActivatorCreateInstanceAny
AppendExceptionStackFrame
CheckStaticClassConstruction
CreateCommandLine
Dbl2IntOvf
Dbl2LngOvf
Dbl2UIntOvf
Dbl2ULngOvf
DebugFuncEvalAbortHelper
DebugFuncEvalHelper
DllGetActivationFactory
DllGetClassObject
FailFast
Flt2IntOvf
Flt2LngOvf
GenericLookup
GenericLookupAndAllocArray
GenericLookupAndAllocObject
GenericLookupAndCallCtor
GenericLookupAndCast
GenericLookupAndCheckArrayElemType
GetRuntimeException
GetSystemArrayEEType
GetThreadStaticsForDynamicType
InitializeFinalizerThread
InitializeModules
InvokeExeMain
OnFirstChanceException
RHBinder__ShimExeMain
UpdateMethodFloatingDictionary
UpdateTypeFloatingDictionary

Sections

.rdata
Size: 11.3MB - Virtual size: 11.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 817KB - Virtual size: 817KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 11.0MB - Virtual size: 11.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 716KB - Virtual size: 716KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RdClient.Windows.exe
.exe windows:6 windows x64 arch:x64

f4f50b0d1c08bc9c838cf396b7757afc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

rdclient.windows

RHBinder__ShimExeMain

Sections

.rdata
Size: 512B - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
RdClient.Windows.exe.config
RdClientWinRT.dll
.dll windows:6 windows x64 arch:x64

3c8ee3ab2e9673e211605bea0ef4d28d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\b\release\x64\RdClientWinRT.pdb

Imports

advapi32

EventWriteTransfer
EventRegister
EventActivityIdControl
EventSetInformation

d3d11

D3D11CreateDevice

d2d1

ord1

user32

MapVirtualKeyExW

ole32

CoGetObjectContext
CoCreateGuid
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoGetApartmentType
CoTaskMemFree
CoIncrementMTAUsage
StringFromGUID2
CoTaskMemAlloc

kernel32

GetProcAddress
CreateFileW
GetCurrentPackageFullName
FreeLibrary
LoadPackagedLibrary
UnhandledExceptionFilter
SleepConditionVariableSRW
GetModuleHandleW
GetModuleHandleExW
GetStartupInfoW
LoadLibraryExW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetOEMCP
WakeConditionVariable
RtlCaptureContext
DebugBreak
CreateMutexExW
OpenSemaphoreW
ReleaseMutex
CreateSemaphoreExW
AreFileApisANSI
GetFileInformationByHandle
LoadLibraryW
UnregisterWaitEx
VirtualProtect
VirtualAlloc
GetModuleHandleA
UnregisterWait
RegisterWaitForSingleObject
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
CreateTimerQueue

rpcrt4

UuidFromStringW

bcrypt

BCryptOpenAlgorithmProvider
BCryptGenRandom
BCryptCloseAlgorithmProvider
BCryptEncrypt
BCryptImportKeyPair
BCryptDestroyKey
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptGenerateSymmetricKey

ws2_32

WSAIoctl
WSAEventSelect
WSASendTo
WSARecvFrom
ntohs
ntohl
htons
getpeername
freeaddrinfo
getaddrinfo
WSASocketW
WSAWaitForMultipleEvents
setsockopt
select
listen
getsockopt
getsockname
ioctlsocket
connect
closesocket
bind
accept
__WSAFDIsSet
getnameinfo
WSAStartup
WSACleanup
recv
WSARecv
send
shutdown
WSAAddressToStringW
WSASend
htonl
WSAStringToAddressW
WSAGetLastError
WSASetLastError

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetUnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-processthreads-l1-1-0

CreateThread
TerminateProcess
GetThreadPriority
ExitProcess
ResumeThread
GetExitCodeThread
GetCurrentProcess
SwitchToThread
GetCurrentThreadId
GetCurrentThread
ExitThread
SetThreadPriority
TlsGetValue
TlsSetValue
GetCurrentProcessId
TlsAlloc
TlsFree

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
GetThreadTimes

api-ms-win-core-console-l1-1-0

GetConsoleMode
WriteConsoleW
ReadConsoleW
GetConsoleCP

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree
HeapSize
HeapReAlloc

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection
WaitForMultipleObjectsEx
AcquireSRWLockShared
ReleaseSRWLockExclusive
ReleaseSRWLockShared
OpenEventA
ResetEvent
CreateEventA
CreateEventExW
InitializeCriticalSectionEx
SetEvent
CreateEventW
AcquireSRWLockExclusive
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
WaitForSingleObjectEx
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
ReleaseSemaphore
WaitForSingleObject
SetWaitableTimer

api-ms-win-core-processenvironment-l1-1-0

SetEnvironmentVariableW
GetStdHandle
GetCommandLineA
GetCommandLineW
GetCurrentDirectoryW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW

api-ms-win-core-file-l1-1-0

FlushFileBuffers
WriteFile
SetFilePointerEx
FindNextFileW
GetFileSizeEx
FindFirstFileW
GetFileAttributesW
GetFileAttributesExW
GetFileType
ReadFile
GetFullPathNameW
FindClose
FindFirstFileExW
GetDriveTypeW
SetEndOfFile

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
GetDynamicTimeZoneInformation
FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-string-l1-1-0

GetStringTypeW
WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetSystemInfo
GetLogicalProcessorInformation
GetSystemTime
GetTickCount
GetSystemTimeAsFileTime
GetVersionExW
GetLocalTime

api-ms-win-core-localization-l1-2-0

GetACP
IsValidCodePage
FormatMessageW
GetLocaleInfoW
FormatMessageA
GetCPInfo

api-ms-win-core-libraryloader-l1-2-0

FreeLibraryAndExitThread
GetModuleFileNameA
GetModuleFileNameW

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-interlocked-l1-1-0

InterlockedPopEntrySList
QueryDepthSList
InterlockedFlushSList
InitializeSListHead
InterlockedPushEntrySList

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-synch-l1-2-0

SignalObjectAndWait
Sleep

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

api-ms-win-core-processtopology-obsolete-l1-1-0

GetProcessAffinityMask
SetThreadAffinityMask

api-ms-win-core-memory-l1-1-0

VirtualFree
VirtualQuery

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-threadpool-l1-2-0

CancelThreadpoolIo
SetThreadpoolThreadMinimum
SetThreadpoolThreadMaximum
WaitForThreadpoolIoCallbacks
CreateThreadpoolIo
CloseThreadpool
CreateThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolCleanupGroup
TrySubmitThreadpoolCallback
CreateThreadpoolTimer
CloseThreadpoolIo
CreateThreadpool
SetThreadpoolTimer
CloseThreadpoolTimer
StartThreadpoolIo

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW
WaitForMultipleObjects

oleaut32

SysStringLen
SysFreeString
SysAllocString
SetErrorInfo
VariantClear
VariantCopy
VariantInit
GetErrorInfo

crypt32

CryptProtectData
CryptUnprotectData
CertVerifySubjectCertificateContext
CryptDecodeObject
CertDuplicateCertificateContext
CertCreateCertificateContext
CertFreeCertificateContext

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe
DisconnectNamedPipe

api-ms-win-core-io-l1-1-0

CreateIoCompletionPort
CancelIoEx
DeviceIoControl
GetQueuedCompletionStatus

iphlpapi

GetAdaptersAddresses

api-ms-win-core-synch-ansi-l1-1-0

CreateWaitableTimerA

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoInitialize

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsPromoteStringBuffer
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsPreallocateStringBuffer

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory

Sections

.text
Size: 10.4MB - Virtual size: 10.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5.0MB - Virtual size: 5.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 432KB - Virtual size: 431KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 97KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RemoteVoiceCommands.xml
Strings/da-DK/PDP-Preview.xml
.xml
Strings/da-DK/PDP-RTM.xml
.xml
Strings/de-DE/PDP-Preview.xml
.xml
Strings/de-DE/PDP-RTM.xml
.xml
Strings/en-GB/PDP-Preview.xml
.xml
Strings/en-GB/PDP-RTM.xml
.xml
Strings/en-US/NOTICE.html
.html
Strings/en-US/PDP-Preview.xml
.xml
Strings/en-US/PDP-RTM.xml
.xml
Strings/es-ES/PDP-Preview.xml
.xml
Strings/es-ES/PDP-RTM.xml
.xml
Strings/fi-FI/PDP-Preview.xml
.xml
Strings/fi-FI/PDP-RTM.xml
.xml
Strings/fr-FR/PDP-Preview.xml
.xml
Strings/fr-FR/PDP-RTM.xml
.xml
Strings/it-IT/PDP-Preview.xml
.xml
Strings/it-IT/PDP-RTM.xml
.xml
Strings/ja-JP/PDP-Preview.xml
.xml
Strings/ja-JP/PDP-RTM.xml
.xml
Strings/nb-NO/PDP-Preview.xml
.xml
Strings/nb-NO/PDP-RTM.xml
.xml
Strings/nl-NL/PDP-Preview.xml
.xml
Strings/nl-NL/PDP-RTM.xml
.xml
Strings/pl-PL/PDP-Preview.xml
.xml
Strings/pl-PL/PDP-RTM.xml
.xml
Strings/pt-BR/PDP-Preview.xml
.xml
Strings/pt-BR/PDP-RTM.xml
.xml
Strings/ru-RU/PDP-Preview.xml
.xml
Strings/ru-RU/PDP-RTM.xml
.xml
Strings/sv-SE/PDP-Preview.xml
.xml
Strings/sv-SE/PDP-RTM.xml
.xml
Strings/zh-CN/PDP-Preview.xml
.xml
Strings/zh-CN/PDP-RTM.xml
.xml
Strings/zh-TW/PDP-Preview.xml
.xml
Strings/zh-TW/PDP-RTM.xml
.xml
[Content_Types].xml
.xml
clrcompression.dll
.dll windows:6 windows x64 arch:x64

5a51928c11ae88f8c7e463bab1d9868a

Code Sign

33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:37

Not After

02/05/2020, 21:37

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2d:81:84:ac:65:d9:27:3a:a5:f0:49:71:66:0a:b5:4c:4c:3b:a2:f3:ea:fd:d4:f7:6d:b2:86:a7:d7:21:5d:61
Signer

Actual PE Digest

2d:81:84:ac:65:d9:27:3a:a5:f0:49:71:66:0a:b5:4c:4c:3b:a2:f3:ea:fd:d4:f7:6d:b2:86:a7:d7:21:5d:61

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

E:\A\_work\314\s\corefx\bin\obj\Windows_NT.x64.Release\native_aot\clrcompression\Release\clrcompression.pdb

Imports

kernel32

GetCurrentThreadId
GetTickCount64
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
QueryPerformanceCounter

ole32

CoTaskMemFree
CoTaskMemAlloc

Exports

Exports

crc32
deflate
deflateEnd
deflateInit2_
inflate
inflateEnd
inflateInit2_
zlibCompileFlags

Sections

.text
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 504B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 540B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
resources.pri
urdc.email-lookup.dll
.dll windows:6 windows x64 arch:x64

5dbf4c662a5a8c9615324149cd9737a5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\b\Release\x64\urdc.email-lookup.pdb

Imports

dnsapi

DnsFree
DnsQuery_W

vccorlib140_app

?__abi_WinRTraiseOutOfMemoryException@@YAXXZ
?__abi_WinRTraiseWrongThreadException@@YAXXZ
?__abi_WinRTraiseOutOfBoundsException@@YAXXZ
?__abi_WinRTraiseChangedStateException@@YAXXZ
?__abi_WinRTraiseNullReferenceException@@YAXXZ
?TerminateModule@Details@Platform@@YA_NPEAVModuleBase@1WRL@Microsoft@@@Z
?UninitializeData@Details@Platform@@YAXH@Z
?InitializeData@Details@Platform@@YAJH@Z
?GetIidsFn@@YAJHPEAKPEBU__s_GUID@@PEAPEAVGuid@Platform@@@Z
?__abi_WinRTraiseObjectDisposedException@@YAXXZ
?__abi_WinRTraiseInvalidCastException@@YAXXZ
?__abi_WinRTraiseNotImplementedException@@YAXXZ
??0Object@Platform@@QE$AAA@XZ
?Allocate@Heap@Details@Platform@@SAPEAX_K0@Z
?Free@Heap@Details@Platform@@SAXPEAX@Z
?AlignedFree@Heap@Details@Platform@@SAXPEAX@Z
?ReleaseTarget@ControlBlock@Details@Platform@@AEAAXXZ
?__abi_WinRTraiseDisconnectedException@@YAXXZ
?__abi_WinRTraiseFailureException@@YAXXZ
?__abi_WinRTraiseOperationCanceledException@@YAXXZ
?__abi_WinRTraiseAccessDeniedException@@YAXXZ
?__abi_WinRTraiseInvalidArgumentException@@YAXXZ
?__abi_WinRTraiseClassNotRegisteredException@@YAXXZ
?__abi_WinRTraiseCOMException@@YAXJ@Z
?GetActivationFactory@Details@Platform@@YAJPEAVModuleBase@1WRL@Microsoft@@PEAUHSTRING__@@PEAPEAUIActivationFactory@@@Z
?__abi_translateCurrentException@@YAJ_N@Z

vcruntime140_1_app

__CxxFrameHandler4

vcruntime140_app

__C_specific_handler
__std_type_info_destroy_list
memset

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-runtime-l1-1-0

_cexit
_initialize_onexit_table
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_register_onexit_function
_initialize_narrow_environment
_initterm
_execute_onexit_table
_crt_atexit

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString
WindowsDuplicateString
WindowsGetStringRawBuffer
WindowsDeleteString

api-ms-win-core-util-l1-1-0

DecodePointer

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
ReleaseSRWLockExclusive

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 852B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
urdc.input-profile-sink.dll
.dll windows:6 windows x64 arch:x64

29e96156317dc08675e6dbf832a2879e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\b\Release\x64\urdc.input-profile-sink.pdb

Imports

api-ms-win-core-com-l1-1-0

CoCreateInstanceFromApp
CoCreateFreeThreadedMarshaler

vccorlib140_app

?GetActivationFactory@Details@Platform@@YAJPEAVModuleBase@1WRL@Microsoft@@PEAUHSTRING__@@PEAPEAUIActivationFactory@@@Z
?UninitializeData@Details@Platform@@YAXH@Z
?InitializeData@Details@Platform@@YAJH@Z
?GetIidsFn@@YAJHPEAKPEBU__s_GUID@@PEAPEAVGuid@Platform@@@Z
?__abi_WinRTraiseObjectDisposedException@@YAXXZ
?__abi_WinRTraiseInvalidCastException@@YAXXZ
?__abi_WinRTraiseNotImplementedException@@YAXXZ
??0Object@Platform@@QE$AAA@XZ
?Allocate@Heap@Details@Platform@@SAPEAX_K0@Z
?Free@Heap@Details@Platform@@SAXPEAX@Z
?AlignedFree@Heap@Details@Platform@@SAXPEAX@Z
?ReleaseTarget@ControlBlock@Details@Platform@@AEAAXXZ
?__abi_WinRTraiseDisconnectedException@@YAXXZ
?__abi_WinRTraiseFailureException@@YAXXZ
?__abi_WinRTraiseOperationCanceledException@@YAXXZ
?__abi_WinRTraiseAccessDeniedException@@YAXXZ
?__abi_WinRTraiseInvalidArgumentException@@YAXXZ
?__abi_WinRTraiseClassNotRegisteredException@@YAXXZ
?__abi_WinRTraiseCOMException@@YAXJ@Z
?__abi_translateCurrentException@@YAJ_N@Z
?__abi_WinRTraiseNullReferenceException@@YAXXZ
?__abi_WinRTraiseChangedStateException@@YAXXZ
?__abi_WinRTraiseOutOfBoundsException@@YAXXZ
?__abi_WinRTraiseWrongThreadException@@YAXXZ
?__abi_WinRTraiseOutOfMemoryException@@YAXXZ
?TerminateModule@Details@Platform@@YA_NPEAVModuleBase@1WRL@Microsoft@@@Z

vcruntime140_1_app

__CxxFrameHandler4

vcruntime140_app

__C_specific_handler
__std_type_info_destroy_list
_CxxThrowException
__std_exception_destroy
__std_exception_copy

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_execute_onexit_table
_crt_atexit
_cexit
_seh_filter_dll
_register_onexit_function
_initialize_onexit_table
_initterm
_initialize_narrow_environment
_initterm_e

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString

api-ms-win-core-util-l1-1-0

DecodePointer

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
ReleaseSRWLockExclusive

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
urdc_10.2.3012.0_x86.appx
.appx
AppxBlockMap.xml
.xml
AppxManifest.xml
AppxMetadata/CodeIntegrity.cat
AppxSignature.p7x
Assets/BadgeLogo.scale-100.png
.png
Assets/BadgeLogo.scale-125.png
.png
Assets/BadgeLogo.scale-150.png
.png
Assets/BadgeLogo.scale-200.png
.png
Assets/BadgeLogo.scale-400.png
.png
Assets/Day0.png
.png
Assets/FileExplorerIcon/RemoteDesktopExtension.targetsize-16.png
.png
Assets/FileExplorerIcon/RemoteDesktopExtension.targetsize-20.png
.png
Assets/FileExplorerIcon/RemoteDesktopExtension.targetsize-24.png
.png
Assets/FileExplorerIcon/RemoteDesktopExtension.targetsize-256.png
.png
Assets/FileExplorerIcon/RemoteDesktopExtension.targetsize-32.png
.png
Assets/FileExplorerIcon/RemoteDesktopExtension.targetsize-40.png
.png
Assets/FileExplorerIcon/RemoteDesktopExtension.targetsize-48.png
.png
Assets/FileExplorerIcon/RemoteDesktopExtension.targetsize-64.png
.png
Assets/Fonts/RDPMDL2.1.91.ttf
Assets/NewStoreLogo.scale-100.png
.png
Assets/NewStoreLogo.scale-125.png
.png
Assets/NewStoreLogo.scale-150.png
.png
Assets/NewStoreLogo.scale-200.png
.png
Assets/NewStoreLogo.scale-400.png
.png
Assets/SplashScreen.scale-100.png
.png
Assets/SplashScreen.scale-125.png
.png
Assets/SplashScreen.scale-150.png
.png
Assets/SplashScreen.scale-200.png
.png
Assets/SplashScreen.scale-400.png
.png
Assets/Square150x150Logo.scale-100.png
.png
Assets/Square150x150Logo.scale-125.png
.png
Assets/Square150x150Logo.scale-150.png
.png
Assets/Square150x150Logo.scale-200.png
.png
Assets/Square150x150Logo.scale-400.png
.png
Assets/Square310x310Logo.scale-100.png
.png
Assets/Square310x310Logo.scale-125.png
.png
Assets/Square310x310Logo.scale-150.png
.png
Assets/Square310x310Logo.scale-200.png
.png
Assets/Square310x310Logo.scale-400.png
.png
Assets/Square44x44Logo.scale-100.png
.png
Assets/Square44x44Logo.scale-125.png
.png
Assets/Square44x44Logo.scale-150.png
.png
Assets/Square44x44Logo.scale-200.png
.png
Assets/Square44x44Logo.scale-400.png
.png
Assets/Square44x44Logo.targetsize-16.png
.png
Assets/Square44x44Logo.targetsize-16_altform-unplated.png
.png
Assets/Square44x44Logo.targetsize-24.png
.png
Assets/Square44x44Logo.targetsize-24_altform-unplated.png
.png
Assets/Square44x44Logo.targetsize-256.png
.png
Assets/Square44x44Logo.targetsize-256_altform-unplated.png
.png
Assets/Square44x44Logo.targetsize-32.png
.png
Assets/Square44x44Logo.targetsize-32_altform-unplated.png
.png
Assets/Square44x44Logo.targetsize-48.png
.png
Assets/Square44x44Logo.targetsize-48_altform-unplated.png
.png
Assets/Square71x71Logo.scale-100.png
.png
Assets/Square71x71Logo.scale-125.png
.png
Assets/Square71x71Logo.scale-150.png
.png
Assets/Square71x71Logo.scale-200.png
.png
Assets/Square71x71Logo.scale-400.png
.png
Assets/Wide310x150Logo.scale-100.png
.png
Assets/Wide310x150Logo.scale-125.png
.png
Assets/Wide310x150Logo.scale-150.png
.png
Assets/Wide310x150Logo.scale-200.png
.png
Assets/Wide310x150Logo.scale-400.png
.png
Assets/session_white_32.png
.png
Assets/windows_logo-01.png
.png
Email.winmd
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
InputProfileSink.winmd
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Microsoft.RemoteDesktop.DesktopSharing.winmd
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
Microsoft.RemoteDesktop.winmd
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
MsRdcWebRTCAddIn.dll
.dll windows:5 windows x86 arch:x86

96e2e84f5bc21f802061348203153402

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

MsRdcWebRTCAddIn.pdb

Imports

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
TraceMessage
UnregisterTraceGuids

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount64

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
AcquireSRWLockShared
CreateEventExW
CreateEventW
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSRWLock
LeaveCriticalSection
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ReleaseSemaphore
ResetEvent
SetEvent
TryEnterCriticalSection
WaitForMultipleObjectsEx
WaitForSingleObject
WaitForSingleObjectEx

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceComplete
InitOnceExecuteOnce
InitializeConditionVariable
Sleep
SleepConditionVariableCS
SleepConditionVariableSRW
WakeAllConditionVariable
WakeConditionVariable

api-ms-win-core-errorhandling-l1-1-0

GetLastError
RaiseException
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

CreateThread
ExitProcess
ExitThread
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetStartupInfoW
OpenThread
SetThreadPriority
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-localization-l1-2-0

EnumSystemLocalesW
FormatMessageA
FormatMessageW
GetACP
GetCPInfo
GetLocaleInfoW
GetOEMCP
GetUserDefaultLCID
IsValidCodePage
IsValidLocale
LCMapStringW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringA

api-ms-win-core-processenvironment-l1-1-0

FreeEnvironmentStringsW
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
GetStdHandle
SetEnvironmentVariableW
SetStdHandle

api-ms-win-core-file-l1-1-0

CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
FlushFileBuffers
GetFileSizeEx
GetFileType
ReadFile
SetEndOfFile
SetFilePointer
SetFilePointerEx
WriteFile

api-ms-win-mm-time-l1-1-0

timeBeginPeriod
timeEndPeriod
timeGetTime

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
LoadLibraryExA
LoadLibraryExW

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoCreateGuid
CoCreateInstance
CoGetApartmentType
CoInitializeEx
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CreateStreamOnHGlobal
PropVariantClear

ws2_32

WSACleanup
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSAResetEvent
WSASetEvent
WSAStartup
WSAWaitForMultipleEvents
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
getpeername
getsockname
getsockopt
htonl
htons
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
send
sendto
setsockopt
socket

api-ms-win-core-string-l1-1-0

CompareStringW
GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-registry-l1-1-0

RegGetValueW

api-ms-win-appmodel-runtime-l1-1-0

GetCurrentPackageId

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory
RoInitialize
RoUninitialize

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString
WindowsCreateStringReference
WindowsDeleteString
WindowsGetStringRawBuffer

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

mfplat

MFCancelWorkItem
MFCreateAsyncResult
MFCreateAttributes
MFCreateMediaType
MFCreateMemoryBuffer
MFCreateSample
MFPutWorkItem2
MFScheduleWorkItemEx
MFShutdown
MFStartup
MFTEnumEx
MFllMulDiv

oleaut32

VariantClear
VariantInit

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo
VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW
WaitForMultipleObjects

iphlpapi

GetAdaptersAddresses

api-ms-win-security-systemfunctions-l1-1-0

SystemFunction036

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-heap-l2-1-0

GlobalAlloc
GlobalFree

api-ms-win-core-memory-l1-1-0

VirtualProtect
VirtualQuery

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead
InterlockedFlushSList

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwind

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation

api-ms-win-core-console-l1-1-0

GetConsoleCP
GetConsoleMode
ReadConsoleW
WriteConsoleW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize

api-ms-win-core-datetime-l1-1-0

GetDateFormatW
GetTimeFormatW

Exports

Exports

VirtualChannelGetInstance

Sections

.text
Size: 11.1MB - Virtual size: 11.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 359KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rodata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 33B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.voltbl
Size: 512B - Virtual size: 342B

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 257KB - Virtual size: 257KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PlatformExtension.dll
.dll windows:6 windows x86 arch:x86

19a866681cee321acc152f6027bd3b6d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\b\Release\x86\PlatformExtension.pdb

Imports

msvcp140_app

?_Xlength_error@std@@YAXPBD@Z

vcruntime140_app

__std_type_info_destroy_list
memmove
memcpy
_CxxThrowException
__std_exception_destroy
__std_exception_copy
__std_terminate
__CxxFrameHandler3
_except_handler4_common
memset

api-ms-win-crt-runtime-l1-1-0

_initterm
_invalid_parameter_noinfo_noreturn
_errno
terminate
_seh_filter_dll
_cexit
_execute_onexit_table
_invalid_parameter_noinfo
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_initterm_e

api-ms-win-crt-string-l1-1-0

iswspace

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
free

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetProcAddress
FreeLibrary

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InterlockedFlushSList
InitializeSListHead

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

oleaut32

GetErrorInfo
SetErrorInfo
SysAllocString
SysStringLen
SysFreeString

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoTaskMemAlloc

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory

Sections

.text
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PlatformExtension.winmd
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
RdClient.BackgroundTasks.winmd
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RdClient.ConnectionManagerService.winmd
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RdClient.Windows.dll
.dll windows:6 windows x86 arch:x86

8dde99ca566aed3499083587594c20ff

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\b\Release\x86\ilc\RdClient.Windows.pdb

Imports

mrt100_app

RhpNewFast
RhpNewArray
RhpAssignRefEDX
RhpInitialInterfaceDispatch
RhpResolveInterfaceMethod
RhpCheckCctor2
RhpNewFinalizable
RhTypeCast_CheckArrayStore
RhpCheckedAssignRefEDX
_ltod3
RhpLDiv
RhpInitMultibyte
RhpCopyMultibyteWithWriteBarrier
RhpRethrow
RhpThrowEx
RhTypeCast_CheckCastClass
RhAllocLocal
RhpReversePInvoke
RhpPInvokeExceptionGuard
RhpReversePInvokeReturn
RhpSuppressGcStress
RhpRegisterModule
RhpUnsuppressGcStress
RhMemberwiseClone
RhpArrayCopy
RhTypeCast_IsInstanceOf
RhTypeCast_IsInstanceOfArray
RhpCheckedXchg
RhTypeCast_CheckCast
RhTypeCast_CheckCastArray
RhTypeCast_IsInstanceOfInterface
RhTypeCast_CheckCastInterface
RhpArrayClear
RhpCheckedLockCmpXchg
RhUnboxAny
RhpCopyAnyWithWriteBarrier
RhBoxAny
RhTypeCast_CheckVectorElemAddr
RhTypeCast_IsInstanceOfClass
RhArrayStoreCheckAny
RhTypeCast_CheckUnbox
RhSuppressFinalize
RhHandleSet
RhHandleGetDependent
RhpGetThread
RhpTrapThreads
RhpWaitForSuspend
RhpWaitForGC
RhGetProcessCpuCount
RhTypeCast_AreTypesEquivalent
_allshr
RhpCopyMultibyteNoGCRefs
_alloca_probe
RhpHandleAlloc
_aullshr
RhNewString
memmove
RhTypeCast_AreTypesAssignable
RhUnbox
RhBox
RhNewObject
RhHandleFree
RhSpinWait
RhCompatibleReentrantWaitAny
_allmul
RhpULDiv
RhCreateThunksHeap
RhSetThunkData
RhGetJmpStubCodeTarget
RhGetLoadedOSModules
RhSetErrorInfoBuffer
RhGetExceptionsForCurrentThread
RhAllocateThunk
RhNewArray
RhpLMod
_dtol3
RhYield
RhReRegisterForFinalize
RhGetCurrentThreadStackBounds
RhGetOSModuleFromEEType
RhTryGetThunkData
RhFreeThunk
RhBulkMoveWithWriteBarrier
RhResolveDispatch
RhGetGeneration
RhFindBlob
RhGetModuleFromEEType
RhConvertPublicKeyToPublicKeyToken
RhGetDispatchMapForType
RhCreateGenericInstanceDescForType2
RhGetGCDescSize
RhRegisterGcCallout
RhpETWShouldWalkCom
RhpETWLogLiveCom
RhIsPromoted
RhHandleSetDependentSecondary
RhpHandleAllocDependent
RhGetGcCollectionCount
RhGetCurrentObjSize
RhGetGCNow
RhGetLastGCStartTime
RhGetLastGCDuration
RhCollect
_allshl
__libm_sse2_pow
_CIfmod
RhGetThreadLocalStorageForDynamicType
RhGetCodeTarget
RhGetTargetOfUnboxingAndInstantiatingStub
RhGetOSModuleFromPointer
RhResolveDispatchOnType
RhGetUniversalTransitionThunk
RhInitializeConservativeReportingRegion
RhDisableConservativeReportingRegion
RhCallDescrWorker
RhRegisterRefCountedHandleCallback
memset
_ultod3
RhpULMod
_ecvt_s
_ftol3
_dtoul3
_dtoui3
RhpGetModuleSection
RhpRegisterFrozenSegment
RhpCreateTypeManager
RhpRegisterOsModule
RhFindMethodStartAddress
RhGetModuleFileName
RhpDblRemRev_SSE2
RhpFltRemRev_SSE2
RhGetRuntimeHelperForType
RhNewInterfaceDispatchCell
RhGetThunkSize
RhGetThreadStaticFieldAddress
modf
__libm_sse2_asin
RhpEtwExceptionThrown
__libm_sse2_tan
__libm_sse2_sin
__libm_sse2_cos
RhpLoopHijack

rdclient.windows

CreateCommandLine

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetSystemTimeAsFileTime

ole32

CoTaskMemFree
CoTaskMemAlloc
CoGetApartmentType
CoCreateGuid

api-ms-win-core-errorhandling-l1-1-0

SetLastError
GetLastError

kernel32

FormatMessageW
SetEvent
CreateEventExW
WaitForMultipleObjectsEx
GetThreadPriority
GetCurrentProcess
GetCurrentThread
DuplicateHandle
GetLocaleInfoEx
ResolveLocaleName
LCMapStringEx
LCIDToLocaleName
CompareStringOrdinal
GetCalendarInfoEx
EnumCalendarInfoExEx
EnumTimeFormatsEx
CompareStringEx
Sleep
SetThreadPriority
ResetEvent
FindStringOrdinal
FindNLSStringEx
GetCurrentProcessId
QueryPerformanceFrequency
GetVersionExW
GetCPInfo
WideCharToMultiByte
MultiByteToWideChar
LocalAlloc
GetLongPathNameW
GetFullPathNameW
SetFileCompletionNotificationModes
K32EnumProcesses
FindFirstFileExW
GetFileAttributesExW
OpenProcess
CreateThread
EnumSystemLocalesEx
CancelIoEx
GetExitCodeProcess
WriteFile
CreateFile2
SetThreadErrorMode
ReadFile
SetEndOfFile
FlushFileBuffers
GetFileType
SetFilePointerEx
GetFileInformationByHandleEx
ResumeThread
WaitForSingleObject
FindClose
CloseHandle
LocaleNameToLCID
QueryPerformanceCounter
GetComputerNameW
LocalFree
GetProcessId

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc
HeapReAlloc

api-ms-win-core-winrt-l1-1-0

RoInitialize
RoUninitialize
RoGetActivationFactory

api-ms-win-core-kernel32-legacy-l1-1-0

RaiseFailFastException

advapi32

EventActivityIdControl
EventSetInformation
EnumerateTraceGuidsEx
RevertToSelf
ImpersonateLoggedOnUser
OpenProcessToken
OpenThreadToken
GetTokenInformation
AdjustTokenPrivileges
LookupPrivilegeValueW
EnableTraceEx2
StartTraceW
StopTraceW
FlushTraceW
LsaOpenPolicy
LsaLookupNames2
LsaLookupSids
CryptGenKey
CryptSetProvParam
CryptImportKey
CryptGetProvParam
CryptGetUserKey
CryptAcquireContextW
CryptGetDefaultProviderW
CryptGetKeyParam
EventRegister
EventWriteTransfer
LsaNtStatusToWinError
LsaClose
LsaFreeMemory
CryptDestroyKey
CryptReleaseContext
EventUnregister

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformationForYear
GetDynamicTimeZoneInformationEffectiveYears
EnumDynamicTimeZoneInformation
GetDynamicTimeZoneInformation

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWork
CloseThreadpoolWork
SubmitThreadpoolWork
CancelThreadpoolIo
CreateThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolIo
StartThreadpoolIo
CloseThreadpoolIo

bcrypt

BCryptCreateHash
BCryptFinishHash
BCryptHashData
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptGenRandom
BCryptExportKey
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptDestroyKey

api-ms-win-core-localization-l1-2-0

FormatMessageW
IsValidLocaleName
ResolveLocaleName

api-ms-win-core-com-l1-1-0

CoGetObjectContext
CoReleaseMarshalData
CoUnmarshalInterface
CoGetMarshalSizeMax
CoMarshalInterface
CoGetContextToken
CoCreateFreeThreadedMarshaler
CoCreateInstanceFromApp

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateStringReference

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent

oleaut32

SysFreeString
SysStringLen
VariantClear
SysAllocStringLen

api-ms-win-core-winrt-error-l1-1-0

GetRestrictedErrorInfo
RoOriginateError
SetRestrictedErrorInfo

normaliz

NormalizeString
IdnToAscii
IdnToUnicode

ncrypt

NCryptOpenStorageProvider
NCryptCreatePersistedKey
NCryptSetProperty
NCryptVerifySignature
NCryptGetProperty
NCryptImportKey
NCryptOpenKey
NCryptDeleteKey
NCryptFinalizeKey
NCryptFreeObject

ws2_32

WSAGetOverlappedResult
getpeername
select
getsockname
setsockopt
ioctlsocket
WSAIoctl
recv
shutdown
listen
bind
closesocket
WSASocketW
gethostname
WSAStartup
getsockopt
WSAConnect
GetAddrInfoW
FreeAddrInfoExW
WSASend
WSARecv
accept
GetNameInfoW
GetAddrInfoExW
send
freeaddrinfo

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

crypt32

CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertAddCertificateLinkToStore
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertOpenStore
CertFindCertificateInStore
CertGetIntendedKeyUsage
CertFindExtension
CryptDecodeObject
CertGetValidUsages
CryptFindOIDInfo
CertVerifyTimeValidity
CertGetNameStringW
CertControlStore
CryptImportPublicKeyInfoEx2
CryptFormatObject
CertNameToStrW
PFXImportCertStore
CryptMsgGetParam
CryptQueryObject
CertSetCertificateContextProperty
CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CertFreeCertificateChain

iphlpapi

GetNetworkParams

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException
RoReportUnhandledError

api-ms-win-ro-typeresolution-l1-1-0

RoParseTypeName

sspicli

FreeCredentialsHandle
AcquireCredentialsHandleW
InitializeSecurityContextW
DeleteSecurityContext
AcceptSecurityContext
ApplyControlToken
QueryContextAttributesW
EnumerateSecurityPackagesW
DecryptMessage
EncryptMessage
LsaGetLogonSessionData
FreeContextBuffer
LsaFreeReturnBuffer

api-ms-win-core-winrt-robuffer-l1-1-0

RoGetBufferMarshaler

api-ms-win-core-processthreads-l1-1-1

GetCurrentProcessorNumber

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW

Exports

Exports

$thread_static_index
ActivatorCreateInstanceAny
AppendExceptionStackFrame
CheckStaticClassConstruction
CreateCommandLine
Dbl2IntOvf
Dbl2LngOvf
Dbl2UIntOvf
Dbl2ULngOvf
DebugFuncEvalAbortHelper
DebugFuncEvalHelper
DllGetActivationFactory
DllGetClassObject
FailFast
Flt2IntOvf
Flt2LngOvf
GenericLookup
GenericLookupAndAllocArray
GenericLookupAndAllocObject
GenericLookupAndCallCtor
GenericLookupAndCast
GenericLookupAndCheckArrayElemType
GetRuntimeException
GetSystemArrayEEType
GetThreadStaticsForDynamicType
InitializeFinalizerThread
InitializeModules
InvokeExeMain
LMulOvf
OnFirstChanceException
RHBinder__ShimExeMain
ULMulOvf
UpdateMethodFloatingDictionary
UpdateTypeFloatingDictionary

Sections

.rdata
Size: 9.5MB - Virtual size: 9.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 9.0MB - Virtual size: 9.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RdClient.Windows.exe
.exe windows:6 windows x86 arch:x86

f4f50b0d1c08bc9c838cf396b7757afc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

rdclient.windows

RHBinder__ShimExeMain

Sections

.rdata
Size: 512B - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RdClient.Windows.exe.config
RdClientWinRT.dll
.dll windows:6 windows x86 arch:x86

161d9bf26dd2af78bf72a66de105efd3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\b\release\x86\RdClientWinRT.pdb

Imports

advapi32

EventWriteTransfer
EventRegister
EventActivityIdControl
EventSetInformation

d3d11

D3D11CreateDevice

d2d1

ord1

user32

MapVirtualKeyExW

ole32

CoGetObjectContext
CoCreateGuid
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoGetApartmentType
CoTaskMemFree
CoIncrementMTAUsage
StringFromGUID2
CoTaskMemAlloc

kernel32

GetProcAddress
CreateFileW
GetCurrentPackageFullName
FreeLibrary
LoadPackagedLibrary
GetModuleHandleW
SleepConditionVariableSRW
GetModuleHandleExW
GetStartupInfoW
LoadLibraryExW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetOEMCP
CreateTimerQueue
WakeConditionVariable
UnhandledExceptionFilter
DebugBreak
CreateMutexExW
OpenSemaphoreW
ReleaseMutex
CreateSemaphoreExW
AreFileApisANSI
GetFileInformationByHandle
LoadLibraryW
UnregisterWaitEx
VirtualProtect
VirtualAlloc
GetModuleHandleA
UnregisterWait
RegisterWaitForSingleObject
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer

rpcrt4

UuidFromStringW

bcrypt

BCryptCreateHash
BCryptHashData
BCryptCloseAlgorithmProvider
BCryptDestroyKey
BCryptImportKeyPair
BCryptEncrypt
BCryptOpenAlgorithmProvider
BCryptGenRandom
BCryptGenerateSymmetricKey
BCryptDestroyHash
BCryptFinishHash

ws2_32

WSAIoctl
WSAEventSelect
WSASendTo
WSARecvFrom
ntohs
ntohl
htons
getpeername
freeaddrinfo
getaddrinfo
WSASocketW
WSAWaitForMultipleEvents
setsockopt
select
listen
getsockopt
getsockname
ioctlsocket
connect
closesocket
bind
accept
__WSAFDIsSet
getnameinfo
WSAStartup
WSACleanup
recv
WSARecv
send
shutdown
WSAAddressToStringW
WSASend
htonl
WSAStringToAddressW
WSAGetLastError
WSASetLastError

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
SetLastError
GetLastError
RaiseException

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TlsGetValue
TlsSetValue
ExitProcess
GetCurrentThreadId
ExitThread
TlsFree
SetThreadPriority
GetExitCodeThread
GetCurrentThread
CreateThread
TerminateProcess
GetCurrentProcess
GetThreadPriority
ResumeThread
TlsAlloc
SwitchToThread

api-ms-win-core-processthreads-l1-1-1

GetThreadTimes
IsProcessorFeaturePresent

api-ms-win-core-console-l1-1-0

ReadConsoleW
GetConsoleCP
GetConsoleMode
WriteConsoleW

api-ms-win-core-heap-l1-1-0

HeapSize
HeapReAlloc
HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-synch-l1-1-0

AcquireSRWLockShared
WaitForSingleObject
AcquireSRWLockExclusive
ResetEvent
ReleaseSRWLockExclusive
DeleteCriticalSection
TryEnterCriticalSection
WaitForSingleObjectEx
CreateEventExW
LeaveCriticalSection
ReleaseSemaphore
CreateEventW
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
InitializeCriticalSection
InitializeCriticalSectionEx
ReleaseSRWLockShared
CreateEventA
OpenEventA
SetWaitableTimer
WaitForMultipleObjectsEx

api-ms-win-core-processenvironment-l1-1-0

SetStdHandle
GetCommandLineA
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetStdHandle
GetCommandLineW
GetEnvironmentStringsW
GetCurrentDirectoryW

api-ms-win-core-file-l1-1-0

GetDriveTypeW
GetFullPathNameW
SetEndOfFile
GetFileSizeEx
FindFirstFileExW
GetFileAttributesW
GetFileType
SetFilePointerEx
GetFileAttributesExW
WriteFile
ReadFile
FindNextFileW
FindFirstFileW
FindClose
FlushFileBuffers

api-ms-win-core-timezone-l1-1-0

GetDynamicTimeZoneInformation
GetTimeZoneInformation
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte
GetStringTypeW

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime
GetTickCount
GetSystemInfo
GetLogicalProcessorInformation
GetSystemTimeAsFileTime
GetTickCount64
GetSystemTime
GetVersionExW

api-ms-win-core-localization-l1-2-0

IsValidCodePage
FormatMessageA
GetLocaleInfoW
GetCPInfo
FormatMessageW
GetACP

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
FreeLibraryAndExitThread
GetModuleFileNameW

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwind

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InterlockedFlushSList
InitializeSListHead
InterlockedPopEntrySList
QueryDepthSList

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-synch-l1-2-0

Sleep
SignalObjectAndWait

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

api-ms-win-core-processtopology-obsolete-l1-1-0

GetProcessAffinityMask
SetThreadAffinityMask

api-ms-win-core-memory-l1-1-0

VirtualFree
VirtualQuery

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-threadpool-l1-2-0

CreateThreadpool
SetThreadpoolThreadMaximum
StartThreadpoolIo
CloseThreadpoolIo
CreateThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
WaitForThreadpoolIoCallbacks
CreateThreadpoolIo
CloseThreadpool
CancelThreadpoolIo
CloseThreadpoolTimer
CloseThreadpoolCleanupGroup
SetThreadpoolThreadMinimum
SetThreadpoolTimer
CreateThreadpoolTimer
TrySubmitThreadpoolCallback

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW
WaitForMultipleObjects

oleaut32

SysStringLen
SysFreeString
SysAllocString
SetErrorInfo
VariantClear
VariantCopy
VariantInit
GetErrorInfo

crypt32

CryptProtectData
CryptUnprotectData
CertVerifySubjectCertificateContext
CryptDecodeObject
CertDuplicateCertificateContext
CertCreateCertificateContext
CertFreeCertificateContext

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-namedpipe-l1-1-0

DisconnectNamedPipe
PeekNamedPipe

api-ms-win-core-io-l1-1-0

CreateIoCompletionPort
CancelIoEx
DeviceIoControl
GetQueuedCompletionStatus

iphlpapi

GetAdaptersAddresses

api-ms-win-core-synch-ansi-l1-1-0

CreateWaitableTimerA

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoInitialize

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsPromoteStringBuffer
WindowsPreallocateStringBuffer
WindowsDeleteString
WindowsCreateStringReference

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory

Sections

.text
Size: 9.0MB - Virtual size: 9.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.0MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 690KB - Virtual size: 690KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RemoteVoiceCommands.xml
Strings/da-DK/PDP-Preview.xml
.xml
Strings/da-DK/PDP-RTM.xml
.xml
Strings/de-DE/PDP-Preview.xml
.xml
Strings/de-DE/PDP-RTM.xml
.xml
Strings/en-GB/PDP-Preview.xml
.xml
Strings/en-GB/PDP-RTM.xml
.xml
Strings/en-US/NOTICE.html
.html
Strings/en-US/PDP-Preview.xml
.xml
Strings/en-US/PDP-RTM.xml
.xml
Strings/es-ES/PDP-Preview.xml
.xml
Strings/es-ES/PDP-RTM.xml
.xml
Strings/fi-FI/PDP-Preview.xml
.xml
Strings/fi-FI/PDP-RTM.xml
.xml
Strings/fr-FR/PDP-Preview.xml
.xml
Strings/fr-FR/PDP-RTM.xml
.xml
Strings/it-IT/PDP-Preview.xml
.xml
Strings/it-IT/PDP-RTM.xml
.xml
Strings/ja-JP/PDP-Preview.xml
.xml
Strings/ja-JP/PDP-RTM.xml
.xml
Strings/nb-NO/PDP-Preview.xml
.xml
Strings/nb-NO/PDP-RTM.xml
.xml
Strings/nl-NL/PDP-Preview.xml
.xml
Strings/nl-NL/PDP-RTM.xml
.xml
Strings/pl-PL/PDP-Preview.xml
.xml
Strings/pl-PL/PDP-RTM.xml
.xml
Strings/pt-BR/PDP-Preview.xml
.xml
Strings/pt-BR/PDP-RTM.xml
.xml
Strings/ru-RU/PDP-Preview.xml
.xml
Strings/ru-RU/PDP-RTM.xml
.xml
Strings/sv-SE/PDP-Preview.xml
.xml
Strings/sv-SE/PDP-RTM.xml
.xml
Strings/zh-CN/PDP-Preview.xml
.xml
Strings/zh-CN/PDP-RTM.xml
.xml
Strings/zh-TW/PDP-Preview.xml
.xml
Strings/zh-TW/PDP-RTM.xml
.xml
[Content_Types].xml
.xml
clrcompression.dll
.dll windows:6 windows x86 arch:x86

5a51928c11ae88f8c7e463bab1d9868a

Code Sign

33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:37

Not After

02/05/2020, 21:37

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c6:6d:76:d1:45:1e:fc:9e:f0:17:0d:27:b7:5e:8e:ef:aa:08:90:20:cf:df:f8:90:62:19:e1:2e:2d:ca:bc:01
Signer

Actual PE Digest

c6:6d:76:d1:45:1e:fc:9e:f0:17:0d:27:b7:5e:8e:ef:aa:08:90:20:cf:df:f8:90:62:19:e1:2e:2d:ca:bc:01

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\A\_work\380\s\corefx\bin\obj\Windows_NT.x86.Release\native_aot\clrcompression\Release\clrcompression.pdb

Imports

kernel32

GetCurrentThreadId
GetTickCount64
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
QueryPerformanceCounter

ole32

CoTaskMemFree
CoTaskMemAlloc

Exports

Exports

crc32
deflate
deflateEnd
deflateInit2_
inflate
inflateEnd
inflateInit2_
zlibCompileFlags

Sections

.text
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 468B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 560B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
resources.pri
urdc.email-lookup.dll
.dll windows:6 windows x86 arch:x86

ed86917b34a38b198fe5fb57a9684c6b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\b\Release\x86\urdc.email-lookup.pdb

Imports

dnsapi

DnsFree
DnsQuery_W

vccorlib140_app

?__abi_WinRTraiseOutOfMemoryException@@YGXXZ
?__abi_WinRTraiseWrongThreadException@@YGXXZ
?__abi_WinRTraiseOutOfBoundsException@@YGXXZ
?__abi_WinRTraiseChangedStateException@@YGXXZ
?TerminateModule@Details@Platform@@YG_NPAVModuleBase@1WRL@Microsoft@@@Z
?UninitializeData@Details@Platform@@YAXH@Z
?InitializeData@Details@Platform@@YAJH@Z
?GetIidsFn@@YGJHPAKPBU__s_GUID@@PAPAVGuid@Platform@@@Z
?__abi_WinRTraiseObjectDisposedException@@YGXXZ
?__abi_WinRTraiseInvalidCastException@@YGXXZ
?__abi_WinRTraiseNotImplementedException@@YGXXZ
??0Object@Platform@@Q$AAA@XZ
?Allocate@Heap@Details@Platform@@SAPAXII@Z
?Free@Heap@Details@Platform@@SAXPAX@Z
?AlignedFree@Heap@Details@Platform@@SAXPAX@Z
?ReleaseTarget@ControlBlock@Details@Platform@@AAEXXZ
?__abi_WinRTraiseDisconnectedException@@YGXXZ
?__abi_WinRTraiseFailureException@@YGXXZ
?__abi_WinRTraiseOperationCanceledException@@YGXXZ
?__abi_WinRTraiseAccessDeniedException@@YGXXZ
?__abi_WinRTraiseInvalidArgumentException@@YGXXZ
?__abi_WinRTraiseClassNotRegisteredException@@YGXXZ
?__abi_WinRTraiseCOMException@@YGXJ@Z
?__abi_translateCurrentException@@YGJ_N@Z
?GetActivationFactory@Details@Platform@@YGJPAVModuleBase@1WRL@Microsoft@@PAUHSTRING__@@PAPAUIActivationFactory@@@Z
?__abi_WinRTraiseNullReferenceException@@YGXXZ

vcruntime140_app

memset
_except_handler4_common
__std_type_info_destroy_list
__CxxFrameHandler3

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_cexit
_initialize_onexit_table
_initterm_e
_initterm
_execute_onexit_table
_register_onexit_function

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-core-winrt-string-l1-1-0

WindowsDuplicateString
WindowsCreateString
WindowsGetStringRawBuffer
WindowsDeleteString

api-ms-win-core-util-l1-1-0

DecodePointer

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
AcquireSRWLockExclusive

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
urdc.input-profile-sink.dll
.dll windows:6 windows x86 arch:x86

70746c964acef8701ed7af25f53c32ce

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\b\Release\x86\urdc.input-profile-sink.pdb

Imports

api-ms-win-core-com-l1-1-0

CoCreateInstanceFromApp
CoCreateFreeThreadedMarshaler

vccorlib140_app

?GetActivationFactory@Details@Platform@@YGJPAVModuleBase@1WRL@Microsoft@@PAUHSTRING__@@PAPAUIActivationFactory@@@Z
?UninitializeData@Details@Platform@@YAXH@Z
?InitializeData@Details@Platform@@YAJH@Z
?GetIidsFn@@YGJHPAKPBU__s_GUID@@PAPAVGuid@Platform@@@Z
?__abi_WinRTraiseObjectDisposedException@@YGXXZ
?__abi_WinRTraiseInvalidCastException@@YGXXZ
?__abi_WinRTraiseNotImplementedException@@YGXXZ
??0Object@Platform@@Q$AAA@XZ
?Allocate@Heap@Details@Platform@@SAPAXII@Z
?Free@Heap@Details@Platform@@SAXPAX@Z
?AlignedFree@Heap@Details@Platform@@SAXPAX@Z
?ReleaseTarget@ControlBlock@Details@Platform@@AAEXXZ
?__abi_WinRTraiseDisconnectedException@@YGXXZ
?__abi_WinRTraiseFailureException@@YGXXZ
?__abi_WinRTraiseOperationCanceledException@@YGXXZ
?__abi_WinRTraiseAccessDeniedException@@YGXXZ
?__abi_WinRTraiseInvalidArgumentException@@YGXXZ
?__abi_WinRTraiseClassNotRegisteredException@@YGXXZ
?__abi_WinRTraiseCOMException@@YGXJ@Z
?__abi_translateCurrentException@@YGJ_N@Z
?__abi_WinRTraiseNullReferenceException@@YGXXZ
?__abi_WinRTraiseChangedStateException@@YGXXZ
?__abi_WinRTraiseOutOfBoundsException@@YGXXZ
?__abi_WinRTraiseWrongThreadException@@YGXXZ
?__abi_WinRTraiseOutOfMemoryException@@YGXXZ
?TerminateModule@Details@Platform@@YG_NPAVModuleBase@1WRL@Microsoft@@@Z

vcruntime140_app

_except_handler4_common
__std_type_info_destroy_list
_CxxThrowException
__std_exception_destroy
__std_exception_copy
__CxxFrameHandler3

api-ms-win-crt-heap-l1-1-0

malloc
free
_callnewh

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_cexit
_initialize_narrow_environment
_initterm
_register_onexit_function
_configure_narrow_argv
_seh_filter_dll
_crt_atexit
_initterm_e
_execute_onexit_table

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString

api-ms-win-core-util-l1-1-0

DecodePointer

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
ReleaseSRWLockExclusive

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.rdata Size: 3KB - Virtual size: 3KB

Headers

DLL Characteristics

File Characteristics

Sections

.rdata Size: 3KB - Virtual size: 3KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 10KB - Virtual size: 9KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 74KB - Virtual size: 73KB

b24275191c0f2799bcd6f238505cd26b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp140_app

vcruntime140_app

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-processthreads-l1-1-1

oleaut32

api-ms-win-core-heap-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-com-l1-1-0

Exports

Exports

Sections

.text Size: 15KB - Virtual size: 14KB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 5KB - Virtual size: 5KB

.pdata Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 1KB - Virtual size: 1KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 1KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 1016B

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 6KB - Virtual size: 6KB

.rsrc Size: 1KB - Virtual size: 1KB

4ee0364a23fcd7663ad3bc6b41bea610

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mrt100_app

rdclient.windows

.rdata
Size: 3KB - Virtual size: 3KB

.rdata
Size: 3KB - Virtual size: 3KB

.text
Size: 10KB - Virtual size: 9KB

.text
Size: 74KB - Virtual size: 73KB

.text
Size: 15KB - Virtual size: 14KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 5KB - Virtual size: 5KB

.pdata
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 1KB - Virtual size: 1KB

.text
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 1016B

.text
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 1KB - Virtual size: 1KB

.rdata
Size: 9.6MB - Virtual size: 9.6MB

.data
Size: 1.5MB - Virtual size: 1.5MB

.pdata
Size: 549KB - Virtual size: 549KB

.rsrc
Size: 16KB - Virtual size: 16KB

.text
Size: 8.2MB - Virtual size: 8.2MB

.reloc
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 512B - Virtual size: 124B

.data
Size: 512B - Virtual size: 12B

.rsrc
Size: 16KB - Virtual size: 16KB

.text
Size: 512B - Virtual size: 16B

.reloc
Size: 512B - Virtual size: 12B