CWindowsSysWOW64-3[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

CWindowsSysWOW64-3.zip
Size

1.8MB
MD5

d86832898ecbe25bf91441cfe627d3c3
SHA1

e07a7699cff4d4e5c7816bc417e645827803a9db
SHA256

b635555deae2b2eeefc8996e10eb13bc82b82376d9848892853925703cc76dea
SHA512

482a131e4a08f333689a683d4b3da9dac2aba1537ca55c1ee731fd91c34607873e30ddebf0cab86a9959cb72bc1a48bc5b5348915c6b1733b9c5be685fae5b51
SSDEEP

49152:bBFb2NJrrG8p/tDbexj2YxWLJwGSPKx5UjYfpOD6o0w78:9xapFSj1WLJ4PKUjM20S8

Score

3^/10

Malware Config

Signatures

Unsigned PE 30 IoCs

Checks for missing Authenticode signature.

resource
unpack001/SearchFilterHost.exe
unpack001/SearchIndexer.exe
unpack001/SearchProtocolHost.exe
unpack001/SecEdit.exe
unpack001/SpatialAudioLicenseSrv.exe
unpack001/SyncHost.exe
unpack001/SystemPropertiesAdvanced.exe
unpack001/SystemPropertiesComputerName.exe
unpack001/SystemPropertiesDataExecutionPrevention.exe
unpack001/SystemPropertiesHardware.exe
unpack001/SystemPropertiesPerformance.exe
unpack001/SystemPropertiesProtection.exe
unpack001/sc.exe
unpack001/schtasks.exe
unpack001/sdbinst.exe
unpack001/sdchange.exe
unpack001/sdiagnhost.exe
unpack001/sethc.exe
unpack001/setup16.exe
unpack001/setupugc.exe
unpack001/setx.exe
unpack001/sfc.exe
unpack001/shrpubw.exe
unpack001/shutdown.exe
unpack001/sort.exe
unpack001/srdelayed.exe
unpack001/stordiag.exe
unpack001/subst.exe
unpack001/sxstrace.exe
unpack001/systeminfo.exe

Files

CWindowsSysWOW64-3.zip
.zip
SearchFilterHost.exe
.exe windows:10 windows x86 arch:x86

045f6a2c4e199b57d3708fffb5de6c54

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

SearchFilterHost.pdb

Imports

msvcp_win

?_Syserror_map@std@@YAPBDH@Z
?_Xlength_error@std@@YAXPBD@Z
?_Winerror_map@std@@YAHH@Z

api-ms-win-crt-string-l1-1-0

wcsncmp
memset

api-ms-win-crt-runtime-l1-1-0

_initterm
_c_exit
_initterm_e
_register_thread_local_exe_atexit_callback

api-ms-win-crt-private-l1-1-0

_o__exit
_o__get_initial_wide_environment
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__itow_s
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
memmove
_o__wcsicmp
_o__wcsnicmp
_o__wtoi64
_o_abort
_o_exit
_o_free
_o_malloc
_o_realloc
_o_strerror
_o_terminate
_o_wcsncpy_s
__current_exception
__current_exception_context
_except_handler4_common
_CxxThrowException
_o__cexit
_o__callnewh
_o__crt_atexit
_o__controlfp_s
_o__configure_wide_argv
_o__errno
_o__configthreadlocale
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
_o___p___wargv
_o___p___argc
__std_terminate
__CxxFrameHandler3
memcmp
memcpy

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
LoadLibraryExW
GetModuleHandleExW
FreeLibrary
GetModuleHandleExA
SizeofResource
LoadResource
FindResourceExW
GetModuleFileNameW
LoadStringW
GetProcAddress
GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

CreateSemaphoreExW
WaitForSingleObject
ReleaseMutex
OpenEventW
ReleaseSemaphore
ResetEvent
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionEx
SetEvent
CreateEventW
DeleteCriticalSection
InitializeCriticalSection
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapSetInformation
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetErrorMode
RaiseException
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
SetPriorityClass
TerminateProcess
GetCurrentProcessId
OpenThreadToken
GetProcessTimes
GetCurrentThread
GetCurrentProcess
OpenProcessToken

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW
FormatMessageA
FormatMessageW
GetLocaleInfoEx

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle
GetHandleInformation

oleaut32

VarUI4FromStr

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventRegister
EventUnregister
EventActivityIdControl
EventWriteTransfer

api-ms-win-core-com-l1-1-0

CoTaskMemRealloc
CoCreateFreeThreadedMarshaler
StringFromCLSID
PropVariantCopy
CoTaskMemAlloc
CoUninitialize
PropVariantClear
CoInitializeSecurity
CoTaskMemFree
CoInitializeEx
CoCreateInstance

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
SetProcessMitigationPolicy
GetThreadTimes

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegGetValueW
RegDeleteValueW
RegEnumValueW
RegDeleteKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceComplete
InitOnceBeginInitialize
InitOnceExecuteOnce

api-ms-win-core-windowserrorreporting-l1-1-0

WerSetFlags

api-ms-win-core-processthreads-l1-1-3

SetProcessInformation
SetThreadDescription

api-ms-win-security-base-l1-1-0

CreateWellKnownSid
GetAce
AddAce
SetSecurityDescriptorDacl
GetTokenInformation
SetSecurityDescriptorOwner
IsValidSid
GetLengthSid
CopySid
SetSecurityDescriptorGroup
GetAclInformation
InitializeSecurityDescriptor
InitializeAcl
AddAccessAllowedAce

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW
LookupAccountNameW

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-processenvironment-l1-1-0

SearchPathW
ExpandEnvironmentStringsW

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage
GetSystemDefaultUILanguage

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetVersionExW
GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-timezone-l1-1-0

SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW

ntdll

RtlNtStatusToDosError
RtlGetPersistedStateLocation
RtlIsStateSeparationEnabled

api-ms-win-core-file-l1-1-0

CreateFileW

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
CreateFileMappingW
MapViewOfFile

api-ms-win-core-localization-l1-2-2

LCIDToLocaleName

api-ms-win-rtcore-ntuser-window-l1-1-0

PeekMessageW
DispatchMessageW

api-ms-win-rtcore-ntuser-synch-l1-1-0

MsgWaitForMultipleObjects

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 117KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SearchIndexer.exe
.exe windows:10 windows x86 arch:x86

9c7e5eec67e3177ed79d1b4cb6ed896a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

SearchIndexer.pdb

Imports

msvcp_win

?_Winerror_map@std@@YAHH@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
?tolower@?$ctype@_W@std@@QBEPB_WPA_WPB_W@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z
?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?tolower@?$ctype@_W@std@@QBE_W_W@Z
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z
?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z
_Wcsxfrm
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?_Xbad_alloc@std@@YAXXZ
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?_Syserror_map@std@@YAPBDH@Z
?_Xout_of_range@std@@YAXPBD@Z
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W0@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Xbad_function_call@std@@YAXXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?is@?$ctype@_W@std@@QBE_NF_W@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
??Bid@locale@std@@QAEIXZ
??Bios_base@std@@QBE_NXZ
?id@?$ctype@_W@std@@2V0locale@2@A
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
??0_Lockit@std@@QAE@H@Z
?id@?$collate@_W@std@@2V0locale@2@A
??1_Lockit@std@@QAE@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
_Wcscoll
?c_str@?$_Yarn@D@std@@QBEPBDXZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z
?_Xlength_error@std@@YAXPBD@Z

api-ms-win-crt-string-l1-1-0

memset
wcsncmp
wcspbrk
memmove_s

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_c_exit
_register_thread_local_exe_atexit_callback
_initterm

api-ms-win-crt-private-l1-1-0

_o__recalloc
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_errno
_o__set_fmode
_o__set_new_mode
_o__wcsicmp
_o__wcslwr_s
_o__wcsnicmp
memmove
_o__wtol
_o__initialize_narrow_environment
_o_calloc
_o_ceil
_o_exit
_o_free
_o_iswspace
_o_iswxdigit
_o_malloc
_o_qsort
_o_realloc
_o_terminate
_o_towupper
_o_wcsncpy_s
_o_wcstok
_o_wcstol
_o_wmemcpy_s
__current_exception
__current_exception_context
_except_handler4_common
_CxxThrowException
_o__get_narrow_winmain_command_line
_o__get_errno
_o__cexit
_o__callnewh
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
_o__invalid_parameter_noinfo_noreturn
_o__exit
_o__errno
_o__invalid_parameter_noinfo
_o____lc_codepage_func
__std_terminate
_o__initialize_onexit_table
_o_abort
__CxxFrameHandler3
wcschr
wcsstr
strchr
_o__crt_atexit
_o__controlfp_s
_o__configure_narrow_argv
_o__configthreadlocale
memcmp
memcpy

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
LockResource
FindResourceExW
LoadResource
FindStringOrdinal
GetModuleHandleW
GetModuleFileNameA
FreeLibrary
LoadLibraryExW
GetModuleFileNameW
GetProcAddress
LoadStringW
SizeofResource
GetModuleHandleExA

api-ms-win-core-synch-l1-1-0

InitializeSRWLock
OpenEventW
ReleaseSemaphore
ReleaseMutex
CreateEventW
ResetEvent
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
TryAcquireSRWLockExclusive
CreateMutexW
SetEvent
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
AcquireSRWLockExclusive
CreateSemaphoreExW
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapSize
HeapAlloc
HeapDestroy
HeapReAlloc
HeapSetInformation
HeapFree

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetErrorMode
SetLastError
GetLastError
RaiseException

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
OpenProcessToken
TerminateProcess
CreateThread
GetCurrentProcessId
OpenThreadToken
TlsAlloc
GetCurrentThreadId
TlsFree
SetPriorityClass
GetStartupInfoW
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

GetSystemPreferredUILanguages
FormatMessageA
GetSystemDefaultLCID
LocaleNameToLCID
FormatMessageW
GetNLSVersionEx
LCMapStringW
GetLocaleInfoEx
ResolveLocaleName
GetLocaleInfoW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

oleaut32

SysStringByteLen
LoadRegTypeLi
LoadTypeLi
SysAllocStringLen
VariantClear
SysAllocStringByteLen
SysStringLen
SysAllocString
SafeArrayDestroy
SetErrorInfo
GetErrorInfo
VarUI4FromStr
VarBstrCat
SafeArrayGetElement
SafeArrayGetUBound
SysFreeString
VariantInit

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegOpenKeyExW
RegDeleteValueW
RegSetValueExW
RegGetKeySecurity
RegCloseKey
RegEnumValueW
RegDeleteTreeW
RegEnumKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegDeleteKeyExW
RegCreateKeyExW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathIsRootW
PathIsUNCServerShareW
PathCanonicalizeW
PathAddBackslashW
PathIsUNCServerW
PathStripToRootW
PathIsUNCW
PathFileExistsW
PathSkipRootW
PathAppendW
PathRemoveBackslashW
PathFindNextComponentW

api-ms-win-core-com-l1-1-0

CoInitializeEx
CoImpersonateClient
CoRevertToSelf
CoReleaseServerProcess
CLSIDFromString
CoMarshalInterface
CoAddRefServerProcess
PropVariantClear
CoRegisterClassObject
CoInitializeSecurity
StringFromGUID2
CoResumeClassObjects
CoUninitialize
CoCreateFreeThreadedMarshaler
CoTaskMemRealloc
CoCreateInstance
IIDFromString
CoGetMalloc
CoRevokeClassObject
CoTaskMemAlloc
CoTaskMemFree

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolQueueTask

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
IsThreadpoolTimerSet
CreateThreadpoolTimer

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
Sleep
InitOnceBeginInitialize
InitOnceComplete
InitOnceInitialize

ntdll

RtlNtStatusToDosError
RtlIsStateSeparationEnabled
NtQueryWnfStateData
NtSetInformationFile
NtOpenFile
RtlInitUnicodeString
RtlQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfStateChangeNotification
RtlPublishWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlQueryPackageClaims
RtlGetPersistedStateLocation
RtlGetDeviceFamilyInfoEnum

api-ms-win-core-file-l1-1-0

SetFileAttributesW
GetFileAttributesW
FindClose
GetFileAttributesExW
DeleteFileW
FindNextFileW
FindFirstFileExW
SetFileTime
CreateDirectoryW
GetVolumeInformationW
FindFirstVolumeW
FindFirstFileW
GetFileTime
FindVolumeClose
FindNextVolumeW
CreateFileW
CompareFileTime
RemoveDirectoryW
GetLogicalDrives
GetDriveTypeW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW
GetVolumePathNamesForVolumeNameW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrcmpW

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventRegister
EventWriteTransfer
EventUnregister
EventEnabled
EventActivityIdControl

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetVersionExW
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetTickCount64

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringOrdinal
WideCharToMultiByte
CompareStringW

api-ms-win-shcore-registry-l1-1-0

SHDeleteKeyW
SHGetValueW
SHSetValueW
SHCopyKeyW

api-ms-win-shell-shdirectory-l1-1-0

ord290

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
SearchPathW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-service-management-l1-1-0

OpenServiceW
OpenSCManagerW
CloseServiceHandle

api-ms-win-core-processthreads-l1-1-1

OpenProcess
IsProcessorFeaturePresent
SetProcessMitigationPolicy

api-ms-win-service-management-l2-1-0

ChangeServiceConfig2W

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
RoOriginateErrorW

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage
GetSystemDefaultUILanguage

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

shcore

SHStrDupW
ord1

combase

ord184

mssrch

?GetFilterHostProcessPoolManager@CSearchServiceObj@@SGJPAPAUIFilterHostProcessPoolManager@@@Z
??1CSearchServiceObj@@QAE@XZ
??0CSearchServiceObj@@QAE@XZ
?Cleanup@CSearchServiceObj@@SGXXZ
?GetFileChangeClientManagerInstance@@YA?AV?$shared_ptr@UIFileChangeClientManager@ChangeTracking@Windows@@@std@@XZ

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrStrIW
StrCmpNICW

api-ms-win-core-path-l1-1-0

PathCchSkipRoot

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileW
GetSystemPowerStatus
RegisterWaitForSingleObject

api-ms-win-service-winsvc-l1-1-0

ControlService
QueryServiceStatus

api-ms-win-service-core-l1-1-1

EnumDependentServicesW

api-ms-win-core-processthreads-l1-1-3

SetThreadDescription

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-winrt-l1-1-0

RoRegisterActivationFactories
RoGetActivationFactory
RoRevokeActivationFactories

api-ms-win-core-winrt-string-l1-1-0

WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsCreateString
WindowsDeleteString

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-service-core-l1-1-0

RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW
SetServiceStatus

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
CreateFileMappingW
MapViewOfFile

api-ms-win-core-localization-l1-2-2

LCIDToLocaleName

rpcrt4

I_RpcBindingInqLocalClientPID

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-shcore-stream-l1-1-0

SHCreateMemStream

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-appmodel-runtime-l1-1-1

GetApplicationUserModelIdFromToken

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

propsys

ord437

Sections

.text
Size: 636KB - Virtual size: 635KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 360B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SearchProtocolHost.exe
.exe windows:10 windows x86 arch:x86

98093f7d09ba457d0ffcc2e1ca029898

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

SearchProtocolHost.pdb

Imports

msvcp_win

?_Xlength_error@std@@YAXPBD@Z
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPBDH@Z
?_Xbad_function_call@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z

api-ms-win-crt-runtime-l1-1-0

_c_exit
_register_thread_local_exe_atexit_callback
_set_error_mode
_initterm_e
_initterm

api-ms-win-crt-string-l1-1-0

memset
wcsncmp

api-ms-win-crt-private-l1-1-0

_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__itow
_o__itow_s
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
__CxxFrameHandler3
memmove
_o__wcsicmp
_o__wcsnicmp
_o__wtoi
_o__wtol
_o_abort
_o_exit
_o_free
_o_iswspace
_o_malloc
_o_realloc
_o_strerror
_o_terminate
_o_wcsncpy_s
_except_handler4_common
__current_exception
__current_exception_context
_CxxThrowException
_o__get_initial_wide_environment
_o__crt_atexit
_o__controlfp_s
_o___stdio_common_vswprintf
_o__configure_wide_argv
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o__configthreadlocale
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
_o___p___wargv
_o___p___argc
_o__exit
_o__errno
_o__cexit
_o__callnewh
__std_terminate
wcschr
memcmp
memcpy

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventRegister
EventUnregister
EventActivityIdControl
EventSetInformation
EventEnabled

api-ms-win-security-base-l1-1-0

InitializeSid
MakeAbsoluteSD
GetSidSubAuthority
GetSidLengthRequired
SetSecurityDescriptorDacl
AdjustTokenPrivileges
RevertToSelf
GetAclInformation
DeleteAce
EqualPrefixSid
SetSecurityDescriptorOwner
GetAce
CreateWellKnownSid
GetTokenInformation
SetSecurityDescriptorGroup
MakeSelfRelativeSD
AddAccessAllowedAce
CopySid
GetSecurityDescriptorLength
GetLengthSid
ImpersonateLoggedOnUser
IsValidSid
AddAce
SetSecurityDescriptorSacl
InitializeSecurityDescriptor
InitializeAcl

oleaut32

SetErrorInfo
CreateErrorInfo
SysAllocString
SysFreeString
GetErrorInfo
SysStringLen
VarUI4FromStr

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetModuleHandleA
LoadStringW
GetModuleFileNameW
GetModuleHandleExA
LoadResource
GetProcAddress
GetModuleHandleW
FreeLibrary
LoadLibraryExW
SizeofResource
FindResourceExW
GetModuleFileNameA

api-ms-win-core-windowserrorreporting-l1-1-0

WerSetFlags

api-ms-win-core-errorhandling-l1-1-1

RemoveVectoredExceptionHandler
AddVectoredExceptionHandler

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW
LookupAccountNameW
LookupPrivilegeValueW

api-ms-win-core-com-l1-1-0

PropVariantClear
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
CoUninitialize
CoTaskMemFree
StringFromCLSID
CoInitializeSecurity
CoTaskMemRealloc
CoInitializeEx
CoDisconnectObject
PropVariantCopy
CLSIDFromProgID
CLSIDFromString
CoCreateInstance

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize
Sleep
InitOnceExecuteOnce

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegQueryValueExW
RegEnumValueW
RegDeleteKeyExW
RegCloseKey
RegQueryInfoKeyW
RegOpenKeyExW
RegGetValueW
RegSetValueExW
RegCreateKeyExW
RegEnumKeyExW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
WideCharToMultiByte
CompareStringW
MultiByteToWideChar

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW
GetLocaleInfoEx
ResolveLocaleName
GetSystemDefaultLCID
LocaleNameToLCID
FormatMessageA
LCMapStringW
FormatMessageW

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
DeleteCriticalSection
AcquireSRWLockShared
ReleaseSemaphore
CreateMutexExW
InitializeCriticalSectionEx
EnterCriticalSection
InitializeSRWLock
OpenEventW
ReleaseSRWLockShared
ResetEvent
OpenSemaphoreW
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
AcquireSRWLockExclusive
ReleaseMutex
TryAcquireSRWLockExclusive
SetEvent
InitializeCriticalSection
ReleaseSRWLockExclusive
LeaveCriticalSection
CreateSemaphoreExW
SetWaitableTimerEx
CreateWaitableTimerExW
CreateEventExW
CreateEventW

api-ms-win-core-heap-l1-1-0

HeapSetInformation
GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetLastError
RaiseException
SetUnhandledExceptionFilter
SetErrorMode

api-ms-win-core-handle-l1-1-0

DuplicateHandle
GetHandleInformation
CloseHandle

api-ms-win-core-processthreads-l1-1-0

GetProcessTimes
GetCurrentProcess
OpenThreadToken
GetCurrentProcessId
CreateThread
GetCurrentThread
SetPriorityClass
OpenProcessToken
TerminateProcess
GetCurrentThreadId

api-ms-win-core-processthreads-l1-1-3

SetProcessInformation
SetThreadDescription

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-memory-l1-1-0

MapViewOfFile
WriteProcessMemory
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
ReadProcessMemory

api-ms-win-shell-namespace-l1-1-0

SHCreateItemFromIDList
SHParseDisplayName
ILFree

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
GetThreadTimes
SetProcessMitigationPolicy

ntdll

NtMapViewOfSection
NtQueryInformationProcess
NtCreateSection
RtlAppendUnicodeToString
RtlQueryPackageClaims
RtlAppendUnicodeStringToString
RtlFreeUnicodeString
NtClose
RtlStringFromGUIDEx
NtCreateFile
RtlGetPersistedStateLocation
RtlIsStateSeparationEnabled
NtCreateCrossVmEvent
RtlNtStatusToDosError

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-processenvironment-l1-1-0

SearchPathW
ExpandEnvironmentStringsW

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage
GetSystemDefaultUILanguage

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

shcore

ord107

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsDeleteString
WindowsGetStringRawBuffer

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW

api-ms-win-core-file-l1-1-0

GetFileSize
CreateFileW
GetFileTime
UnlockFile
WriteFile
ReadFile
SetEndOfFile
SetFilePointer
DeleteFileW
FlushFileBuffers
LockFile

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-localization-l1-2-2

LCIDToLocaleName

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

Sections

.text
Size: 227KB - Virtual size: 226KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SecEdit.exe
.exe windows:10 windows x86 arch:x86

615449a6a25801f47ae0d7578eb950b4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

SecEdit.pdb

Imports

msvcrt

__setusermatherr
__p__fmode
_initterm
?terminate@@YAXXZ
_controlfp
_except_handler4_common
towlower
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
wcsncpy_s
sprintf_s
wcsrchr
vfwprintf
vprintf
fgetwc
__iob_func
vswprintf_s
wcscat_s
wcscpy_s
iswctype
_wcsicmp
setlocale

api-ms-win-core-console-l1-1-0

SetConsoleCtrlHandler
GetConsoleOutputCP
WriteConsoleW

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle
GetCurrentDirectoryW

api-ms-win-core-file-l1-1-0

WriteFile
GetFileAttributesW
CreateFileW
GetFileType
SetFilePointer

api-ms-win-core-localization-l1-2-0

FormatMessageW
SetThreadUILanguage

api-ms-win-security-base-l1-1-0

AllocateAndInitializeSid
CheckTokenMembership
FreeSid

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-1-0

HeapSetInformation

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleHandleW
LoadStringW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-shlwapi-legacy-l1-1-0

PathIsRootW
PathCanonicalizeW

scecli

SceOpenProfile
SceFreeMemory
SceBrowseDatabaseTable
SceGetSecurityProfileInfo
SceWriteSecurityProfileInfo
SceConfigureSystem
SceSetupGenerateTemplate
SceCloseProfile
SceGenerateRollback
SceFreeProfileMemory
SceIsSystemDatabase
SceAnalyzeSystem
SceRegisterRegValues

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SndVol.exe
.exe windows:10 windows x86 arch:x86

9498044ed69dac094d46c088a6a0c29e

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16-11-2023 19:20

Not After

14-11-2024 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3c:bd:d8:27:4d:23:6f:df:47:d2:56:d2:e4:52:eb:fa:80:df:47:5d:9d:85:ec:11:91:ab:0b:8b:5b:64:4e:06
Signer

Actual PE Digest

3c:bd:d8:27:4d:23:6f:df:47:d2:56:d2:e4:52:eb:fa:80:df:47:5d:9d:85:ec:11:91:ab:0b:8b:5b:64:4e:06

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

SndVol.pdb

Imports

gdi32

CreateFontIndirectW
CreateDIBSection
CreateSolidBrush
SelectObject
SetTextColor
SetBkColor
BeginPath
GetObjectW
CreateCompatibleDC
GetDeviceCaps
Rectangle
DeleteDC
PathToRegion
EndPath
SetBkMode
CreatePen
ScriptStringAnalyse
ScriptString_pLogAttr
ScriptStringFree
BitBlt
Polygon
GetStockObject
DeleteObject

user32

GetMenuItemInfoW
DestroyMenu
SetWindowRgn
BeginPaint
EndPaint
IntersectRect
CreateDialogParamW
PostQuitMessage
GetDlgCtrlID
SubtractRect
PtInRect
SendMessageTimeoutW
SendNotifyMessageW
LoadIconW
SetTimer
NotifyWinEvent
GetForegroundWindow
GetWindowThreadProcessId
GetDoubleClickTime
KillTimer
CalculatePopupWindowPosition
DestroyIcon
EnumChildWindows
EnableWindow
EndDialog
SetRect
IsDlgButtonChecked
CheckDlgButton
CopyRect
GetParent
GetWindowTextW
GetScrollPos
SetScrollInfo
BeginDeferWindowPos
DeferWindowPos
SetFocus
IsImmersiveProcess
GetIconInfoExW
SendDlgItemMessageW
InternalGetWindowText
GetWindow
IsWindowVisible
EnumWindows
GetClassLongW
GetWindowTextLengthW
GetMenuItemCount
DrawEdge
SetWindowLongW
InflateRect
CheckMenuRadioItem
GetWindowLongW
GetWindowRect
SetWindowPos
MapWindowPoints
GetClientRect
ShowWindow
GetDlgItem
PrivateExtractIconsW
ValidateRect
FrameRect
MonitorFromRect
AdjustWindowRectEx
SetRectEmpty
SetCursor
ReleaseCapture
SetCapture
DrawFocusRect
GetFocus
OffsetRect
IsWindowEnabled
LoadImageW
ClientToScreen
EqualRect
IsWindow
GetSysColorBrush
FillRect
GetSysColor
InvalidateRect
CreateWindowExW
DestroyWindow
LoadCursorW
GetClassInfoExW
RegisterClassExW
UnregisterClassA
GhostWindowFromHungWindow
GetWindowBand
ord2575
TrackPopupMenuEx
InsertMenuItemW
CreatePopupMenu
GetSystemMetrics
ReleaseDC
DefWindowProcW
CallWindowProcW
DrawTextW
GetDC
SetDlgItemTextW
SetWindowTextW
SetClassLongW
LoadStringW
SendMessageW
DialogBoxParamW
GetActiveWindow
SetProcessDefaultLayout
SetProcessDPIAware
BringWindowToTop
PostMessageW
SetForegroundWindow
FindWindowW
EndDeferWindowPos

msvcrt

_except_handler4_common
realloc
_errno
??1type_info@@UAE@XZ
??_V@YAXPAX@Z
__dllonexit
_unlock
__CxxFrameHandler3
??3@YAXPAX@Z
_onexit
_lock
?terminate@@YAXXZ
_wcmdln
_initterm
__setusermatherr
__p__fmode
_ftol2
_ftol2_sse
_XcptFilter
memmove
memcpy
_CxxThrowException
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
_callnewh
_isnan
wcsstr
calloc
_resetstkoflw
_purecall
vswprintf_s
_vscwprintf
memmove_s
free
malloc
swprintf_s
wcstol
_wtoi
_wcsicmp
iswspace
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
memcpy_s
_vsnwprintf
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
memset
_controlfp

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegCloseKey
RegCreateKeyExW
RegSetValueExW

comctl32

ImageList_CoCreateInstance
ImageList_Remove
InitCommonControlsEx
ord381
ImageList_Draw
ImageList_ReplaceIcon
ImageList_Destroy
ImageList_Create
ImageList_SetBkColor

ole32

CoTaskMemAlloc
CoUninitialize
CoInitialize
CoTaskMemFree
CoCreateInstance
CoAllowSetForegroundWindow
CoCreateGuid
PropVariantClear
CoWaitForMultipleObjects

oleaut32

SysAllocString
VariantClear
VariantInit
SysFreeString

shell32

ShellExecuteW
ShellExecuteExW
Shell_NotifyIconGetRect
CommandLineToArgvW
SHGetFileInfoW

gdiplus

GdipCreateFromHDC
GdiplusStartup
GdipSetSmoothingMode
GdipCreatePen1
GdipDrawLine
GdipCreateSolidFill
GdipDeleteBrush
GdipDeletePen
GdipFillRectangle
GdipAlloc
GdipCloneBrush
GdipCreatePath
GdipDeletePath
GdipAddPathLine
GdipFillPath
GdiplusShutdown
GdipCreateLineBrush
GdipDeleteGraphics
GdipFree

ntdll

EtwEventRegister
EtwEventUnregister
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwEventActivityIdControl
EtwEventSetInformation
EtwEventWriteTransfer
EtwTraceMessage
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW

uxtheme

OpenThemeData
BufferedPaintUnInit
BufferedPaintInit
CloseThemeData
IsThemeActive
DrawThemeBackground
GetThemeTextExtent
DrawThemeParentBackgroundEx
GetThemeSysColor
IsThemeBackgroundPartiallyTransparent
DrawThemeParentBackground
BufferedPaintSetAlpha
SetWindowTheme
DrawThemeText

dwmapi

DwmIsCompositionEnabled
DwmQueryThumbnailSourceSize
DwmUnregisterThumbnail
DwmRegisterThumbnail
DwmUpdateThumbnailProperties
DwmSetWindowAttribute

shlwapi

ord348
PathFindFileNameW
ord487
StrTrimW
PathParseIconLocationW

imm32

ImmDisableIME

api-ms-win-core-libraryloader-l1-2-0

LockResource
LoadLibraryExW
LoadResource
FindResourceExW
GetModuleHandleExW
FreeResource
SizeofResource
GetModuleFileNameA
LoadLibraryExA
GetProcAddress
GetModuleHandleW
FreeLibrary

api-ms-win-core-synch-l1-1-0

OpenSemaphoreW
CreateMutexExW
EnterCriticalSection
CreateEventW
CreateSemaphoreExW
LeaveCriticalSection
ReleaseSemaphore
DeleteCriticalSection
SetEvent
CreateEventExW
WaitForSingleObject
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CreateMutexW
ReleaseMutex
InitializeCriticalSection
WaitForSingleObjectEx

api-ms-win-core-heap-l1-1-0

HeapSize
HeapAlloc
GetProcessHeap
HeapSetInformation
HeapDestroy
HeapReAlloc
HeapFree

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
GetLastError
SetLastError

api-ms-win-core-processthreads-l1-1-0

CreateThread
SetThreadPriority
GetCurrentThreadId
GetCurrentProcessId
GetStartupInfoW
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetLocaleInfoEx
GetUserPreferredUILanguages

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
OutputDebugStringA
IsDebuggerPresent
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l2-1-0

LocalFree
GlobalFree

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceComplete
WakeAllConditionVariable
Sleep
SleepConditionVariableSRW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem
UnregisterWaitEx

api-ms-win-appmodel-runtime-l1-1-0

GetPackageFamilyName

api-ms-win-core-processthreads-l1-1-1

OpenProcess
FlushInstructionCache
IsProcessorFeaturePresent

api-ms-win-core-kernel32-legacy-l1-1-0

RegisterWaitForSingleObject

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateStringReference

api-ms-win-shcore-stream-winrt-l1-1-0

CreateStreamOverRandomAccessStream

api-ms-win-core-largeinteger-l1-1-0

MulDiv

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-memory-l1-1-0

VirtualAlloc
VirtualFree

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InterlockedPopEntrySList

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-ntuser-sysparams-l1-1-0

SystemParametersInfoW
GetMonitorInfoW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindExtensionW

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 138KB - Virtual size: 137KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.imrsiv
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SpatialAudioLicenseSrv.exe
.exe windows:10 windows x86 arch:x86

0cffc93e733d0faa243643790194fe2a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

SpatialAudioLicenseSrv.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_c_exit
_register_thread_local_exe_atexit_callback
_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__configthreadlocale
_o__configure_wide_argv
_o__controlfp_s
_o__crt_atexit
_o__errno
_o__exit
_o__get_wide_winmain_command_line
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
memcpy
_o_exit
_o_free
_o_malloc
_o_terminate
__CxxFrameHandler3
__current_exception
__current_exception_context
_o__callnewh
_except_handler4_common
_CxxThrowException
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
_o___stdio_common_vswprintf
_o__cexit
_o___stdio_common_vsnprintf_s
_o___p__commode

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleHandleExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameA
GetModuleFileNameW

api-ms-win-core-synch-l1-1-0

ReleaseMutex
WaitForSingleObjectEx
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
CreateMutexExW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
OpenSemaphoreW
EnterCriticalSection
LeaveCriticalSection
SetEvent
DeleteCriticalSection
InitializeCriticalSectionEx
CreateEventExW

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

SetLastError
RaiseException
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetStartupInfoW
GetCurrentProcess
GetCurrentThreadId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoWaitForMultipleHandles
CoCreateFreeThreadedMarshaler
CoInitializeSecurity
CoReleaseServerProcess
CoTaskMemFree
CoAddRefServerProcess
CoRevokeClassObject
CoRegisterClassObject
CoResumeClassObjects

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsDeleteString
WindowsCreateString
WindowsGetStringLen

api-ms-win-core-commandlinetoargv-l1-1-0

CommandLineToArgvW

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoRegisterActivationFactories
RoRevokeActivationFactories
RoUninitialize
RoInitialize
RoActivateInstance

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
RoOriginateErrorW

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
GetProcessMitigationPolicy

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

mmdevapi

ord26

combase

ord69

api-ms-win-core-featurestaging-l1-1-0

SubscribeFeatureStateChangeNotification
RecordFeatureUsage
UnsubscribeFeatureStateChangeNotification

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-registry-l1-1-0

RegGetValueW

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventSetInformation
EventUnregister

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.imrsiv
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SyncHost.exe
.exe windows:10 windows x86 arch:x86

a09baa3289072a25d3904587075721e4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

SyncHost.pdb

Imports

advapi32

RegDeleteValueW
RegOpenKeyExW
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
RegSetValueExW
GetTraceEnableFlags
RegEnumKeyExW
GetTraceLoggerHandle
RegCreateKeyExW
RegQueryInfoKeyW
RegCloseKey
TraceMessage

kernel32

SizeofResource
EnterCriticalSection
GetCommandLineW
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSection
GetCurrentThreadId
MultiByteToWideChar
Sleep
GetLastError
SetEvent
RaiseException
FindResourceExW
LoadResource
GetProcAddress
DeleteCriticalSection
GetModuleHandleW
FreeLibrary
lstrcmpiW
LoadLibraryExW
FormatMessageW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetCurrentProcessId

user32

PostThreadMessageW
TranslateMessage
CharNextW
DispatchMessageW
CharUpperW
GetMessageW
UnregisterClassA

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e
_c_exit
_register_thread_local_exe_atexit_callback

api-ms-win-crt-private-l1-1-0

_o___p__commode
_o__callnewh
_o__cexit
_o__configthreadlocale
_o__configure_wide_argv
_o__controlfp_s
_o__crt_atexit
_o__errno
_o__exit
_o__get_wide_winmain_command_line
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o_exit
_o_free
_o_malloc
_o_terminate
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_except_handler4_common
__current_exception
__current_exception_context
memcpy

ole32

CoRevokeClassObject
CoUninitialize
StringFromGUID2
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
CoRegisterClassObject
CoTaskMemRealloc
CoInitializeEx
PropVariantClear

oleaut32

VarUI4FromStr
SysStringLen
SysAllocString
RegisterTypeLi
SysFreeString
LoadTypeLi
UnRegisterTypeLi
GetErrorInfo

shlwapi

SHStrDupW

propsys

PropVariantToGUID
PropVariantToUInt32

winsync

ord1

Sections

.text
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SystemPropertiesAdvanced.exe
.exe windows:10 windows x86 arch:x86

b788892ae84ba86201a726810f01cb07

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

SystemPropertiesAdvanced.pdb

Imports

msvcrt

__setusermatherr
_except_handler4_common
_controlfp
?terminate@@YAXXZ
_wcmdln
_initterm
_XcptFilter
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode

sysdm.cpl

DisplaySYSDMCPL

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SystemPropertiesComputerName.exe
.exe windows:10 windows x86 arch:x86

b788892ae84ba86201a726810f01cb07

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

SystemPropertiesComputerName.pdb

Imports

msvcrt

__setusermatherr
_except_handler4_common
_controlfp
?terminate@@YAXXZ
_wcmdln
_initterm
_XcptFilter
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode

sysdm.cpl

DisplaySYSDMCPL

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SystemPropertiesDataExecutionPrevention.exe
.exe windows:10 windows x86 arch:x86

b788892ae84ba86201a726810f01cb07

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

SystemPropertiesDataExecutionPrevention.pdb

Imports

msvcrt

__setusermatherr
_except_handler4_common
_controlfp
?terminate@@YAXXZ
_wcmdln
_initterm
_XcptFilter
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode

sysdm.cpl

DisplaySYSDMCPL

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SystemPropertiesHardware.exe
.exe windows:10 windows x86 arch:x86

b788892ae84ba86201a726810f01cb07

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

SystemPropertiesHardware.pdb

Imports

msvcrt

__setusermatherr
_except_handler4_common
_controlfp
?terminate@@YAXXZ
_wcmdln
_initterm
_XcptFilter
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode

sysdm.cpl

DisplaySYSDMCPL

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SystemPropertiesPerformance.exe
.exe windows:10 windows x86 arch:x86

0c021c23de2070c3c89aa72cc7e919e9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

SystemPropertiesPerformance.pdb

Imports

kernel32

CompareStringOrdinal

msvcrt

_except_handler4_common
_controlfp
?terminate@@YAXXZ
_wcmdln
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter

sysdm.cpl

DisplaySYSDMCPL

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetStartupInfoW
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SystemPropertiesProtection.exe
.exe windows:10 windows x86 arch:x86

b788892ae84ba86201a726810f01cb07

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

SystemPropertiesProtection.pdb

Imports

msvcrt

__setusermatherr
_except_handler4_common
_controlfp
?terminate@@YAXXZ
_wcmdln
_initterm
_XcptFilter
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode

sysdm.cpl

DisplaySYSDMCPL

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
sc.exe
.exe windows:10 windows x86 arch:x86

7eb6a79d09c556824451987988aa3078

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

sc.pdb

Imports

api-ms-win-crt-string-l1-1-0

memset
wcsncmp

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_c_exit
_initterm
_register_thread_local_exe_atexit_callback

api-ms-win-crt-private-l1-1-0

_o___stdio_common_vswprintf
_o__cexit
_o__configthreadlocale
_o__configure_wide_argv
_o__controlfp_s
_o__crt_atexit
_o__exit
_o__get_initial_wide_environment
_o__getche
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__tolower
_o__ultow
_o__wcsicmp
_o__wcsnicmp
_o__wtol
_o_exit
_o_isupper
_o_terminate
__current_exception
__current_exception_context
_except_handler4_common
_o___p__commode
_o___p___wargv
_o___p___argc
wcschr
memcpy

rpcrt4

RpcStringFreeW
I_RpcExceptionFilter
UuidEqual
NdrClientCall4
RpcBindingFree
UuidFromStringW
UuidToStringW

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle

api-ms-win-core-file-l1-1-0

GetFileType
WriteFile

api-ms-win-core-localization-l1-2-0

SetThreadUILanguage
FormatMessageW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-console-l1-1-0

WriteConsoleW
GetConsoleMode

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-security-base-l1-1-0

GetSecurityDescriptorControl

api-ms-win-core-heap-l1-1-0

HeapSetInformation

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

ntdll

RtlInitUnicodeString
RtlCreateServiceSid
RtlAdjustPrivilege
RtlNtStatusToDosError

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
schtasks.exe
.exe windows:10 windows x86 arch:x86

96f93525922ff1bb66dee7d1a85e7a11

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

schtasks.pdb

Imports

msvcrt

memmove
memcpy
_CxxThrowException
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
_purecall
fflush
fprintf
_get_osfhandle
_fileno
wcstoul
wcstol
wcstod
_errno
_memicmp
srand
__iob_func
wcstok
memcmp
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
_controlfp
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
_callnewh
malloc
_ultow_s
wcschr
_wtoi
iswdigit
iswpunct
wcstok_s
iswspace
wcspbrk
free
memcpy_s
isspace
_wtol
wcsrchr
_vsnwprintf
__CxxFrameHandler3
memset

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError

oleaut32

VariantInit
SysStringLen
SysFreeString
GetErrorInfo
SysAllocStringLen
VariantClear
VariantChangeType
SysAllocString
VarBstrCat
SysStringByteLen
SysAllocStringByteLen
VariantTimeToSystemTime

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime
GetTickCount
GetSystemTimeAsFileTime
GetComputerNameExW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
GetStdHandle

api-ms-win-core-console-l1-1-0

WriteConsoleW
ReadConsoleW
SetConsoleMode
GetConsoleMode
GetConsoleOutputCP

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-file-l1-1-0

SetFilePointer
CompareFileTime
CreateFileW
GetFileSizeEx
WriteFile
GetFileType
ReadFile

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringW
MultiByteToWideChar

api-ms-win-security-base-l1-1-0

GetSidSubAuthority
GetSidSubAuthorityCount
CreateWellKnownSid
GetSidIdentifierAuthority

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-localization-l1-2-0

GetThreadLocale
SetThreadUILanguage
GetLocaleInfoW
FormatMessageW

api-ms-win-core-libraryloader-l1-2-0

LoadStringW
GetModuleFileNameW
FindStringOrdinal
GetModuleHandleW

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

api-ms-win-core-registry-l1-1-0

RegDeleteKeyExW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegFlushKey
RegOpenKeyExW

api-ms-win-core-heap-l1-1-0

HeapSize
HeapAlloc
GetProcessHeap
HeapValidate
HeapSetInformation
HeapReAlloc
HeapFree

api-ms-win-core-com-l1-1-0

IIDFromString
StringFromGUID2
CoUninitialize
CoCreateInstance
CoInitializeEx
CoInitializeSecurity

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

ntdll

EtwTraceMessage
RtlNtStatusToDosError
RtlCreateVirtualAccountSid
RtlInitUnicodeString
RtlVerifyVersionInfo

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrRChrIW
StrStrIW
StrChrW

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
EnterCriticalSection

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-version-l1-1-0

GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW

api-ms-win-core-string-l2-1-0

CharUpperW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW
lstrlenA

api-ms-win-core-localization-obsolete-l1-2-0

CompareStringA

Sections

.text
Size: 157KB - Virtual size: 156KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
sdbinst.exe
.exe windows:10 windows x86 arch:x86

0c0bfa423ff862d6f71e0b1bfd9cb13d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

sdbinst.pdb

Imports

advapi32

RegQueryValueExW
RegEnumValueW
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegQueryInfoKeyW
RegDeleteKeyExW
RegCloseKey
RegDeleteKeyValueW
RegGetValueW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
RegDeleteKeyW
RegEnumKeyW
RegOpenKeyW

kernel32

WriteFile
GetModuleHandleExW
WaitForSingleObject
LocalAlloc
GetFileAttributesW
GetCurrentThreadId
ReleaseMutex
GetSystemDirectoryW
SetFileAttributesW
Sleep
GetConsoleMode
FormatMessageW
GetLastError
OutputDebugStringW
WaitForSingleObjectEx
DeleteFileW
OpenSemaphoreW
CloseHandle
SetProcessWorkingSetSizeEx
LoadLibraryW
HeapSetInformation
HeapAlloc
WriteConsoleW
GetProcAddress
CreateMutexExW
LocalFree
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
FreeLibrary
CopyFileW
WideCharToMultiByte
GetSystemTimeAsFileTime
GetStdHandle
DebugBreak
SetThreadPreferredUILanguages
IsDebuggerPresent
GetFileInformationByHandle
MoveFileExW
FindFirstFileExW
CreateFileW
LoadLibraryExW
FindClose
ExpandEnvironmentStringsW
FindNextFileW
CreateDirectoryW
GetTickCount
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
SetPriorityClass
SetLastError
HeapFree
CreateSemaphoreExW
GetModuleFileNameA
ReleaseSemaphore
GetFileType

msvcrt

memcpy
memmove
memcmp
_CxxThrowException
_except_handler4_common
_controlfp
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
towupper
wcsrchr
_wfullpath
_vsnprintf_s
fgetwc
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
??3@YAXPAX@Z
tolower
_wcsicmp
memcpy_s
_vsnwprintf
??_V@YAXPAX@Z
__CxxFrameHandler3
memset
__iob_func
wcschr
_wcsnicmp
qsort
_vscwprintf
_purecall
malloc
_callnewh
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABQBDH@Z
?what@exception@@UBEPBDXZ

user32

LoadStringW

shell32

ord680

ntdll

NtDeleteKey
RtlFreeUnicodeString
ZwQuerySystemInformation
ZwUnmapViewOfSection
RtlGUIDFromString
RtlStringFromGUID
RtlAllocateHeap
RtlAppendUnicodeToString
ZwCreateFile
RtlDosPathNameToNtPathName_U_WithStatus
RtlUpcaseUnicodeString
ZwCreateSection
RtlInitUnicodeString
RtlGetNativeSystemInformation
RtlReAllocateHeap
NtClose
RtlInitUnicodeStringEx
ZwMapViewOfSection
RtlFreeHeap
ZwQueryValueKey
ZwQueryInformationFile
ZwClose
ZwOpenKey
ZwEnumerateValueKey
RtlRunOnceExecuteOnce
ZwWriteFile
ZwQuerySystemTime
NtWriteFile
NtQueryInformationFile
RtlDoesFileExists_U
RtlExpandEnvironmentStrings_U
NtCreateKey
NtSetValueKey
NtSetInformationKey
NtOpenKey
RtlCopyUnicodeString
RtlCompareMemory
RtlNtStatusToDosError
NtQueryKey
NtQueryInformationByName
RtlAppendUnicodeStringToString

Sections

.text
Size: 143KB - Virtual size: 142KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
sdchange.exe
.exe windows:10 windows x86 arch:x86

701460481cfb9e7995b0e699a5ad2bfe

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

sdchange.pdb

Imports

advapi32

RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteValueW

kernel32

GetModuleFileNameA
SizeofResource
CreateSemaphoreExW
HeapFree
SetLastError
EnterCriticalSection
ReleaseSemaphore
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
MultiByteToWideChar
FormatMessageW
GetLastError
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
RaiseException
FindResourceExW
LoadResource
HeapAlloc
GetProcAddress
CreateMutexExW
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
FreeLibrary
DebugBreak
lstrcmpiW
LoadLibraryExW
IsDebuggerPresent
GetCommandLineW
SetEvent
Sleep
CreateEventW
CreateThread
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA

user32

UnregisterClassA
CharNextW
DispatchMessageW
TranslateMessage
GetMessageW
CharUpperW
PostThreadMessageW

msvcrt

_XcptFilter
memmove
_initterm
memcpy
_CxxThrowException
__wgetmainargs
__p__fmode
_wcmdln
__set_app_type
_except_handler4_common
_errno
?what@exception@@UBEPBDXZ
__p__commode
exit
realloc
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
?terminate@@YAXXZ
_lock
_cexit
_callnewh
__setusermatherr
_unlock
__dllonexit
_onexit
_controlfp
_amsg_exit
_exit
wcscat_s
wcscpy_s
wcsncpy_s
malloc
free
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_purecall
memcpy_s
_vsnwprintf
??_V@YAXPAX@Z
__CxxFrameHandler3
??3@YAXPAX@Z
memcmp
??1type_info@@UAE@XZ
memset

oleaut32

SysStringLen
SysFreeString
VarUI4FromStr
UnRegisterTypeLi
SysAllocString
RegisterTypeLi
LoadTypeLi
LoadRegTypeLi

api-ms-win-core-com-l1-1-0

StringFromGUID2
CoResumeClassObjects
CoInitializeEx
CoUninitialize
CoTaskMemRealloc
CoRevokeClassObject
CoSuspendClassObjects
CoRegisterClassObject
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance

api-ms-win-security-base-l1-1-0

CreateWellKnownSid

rpcrt4

RpcBindingFromStringBindingW
RpcBindingSetAuthInfoExW
RpcStringBindingComposeW
I_RpcExceptionFilter
RpcStringFreeW
RpcBindingFree
NdrClientCall2

api-ms-win-service-management-l1-1-0

OpenSCManagerW
OpenServiceW
StartServiceW
CloseServiceHandle

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

Sections

.text
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
sdiagnhost.exe
.exe windows:10 windows x86 arch:x86

805ada2b1e97423ad5d5f6ed720b2117

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

sdiagnhost.pdb

Imports

advapi32

MakeAbsoluteSD
EventUnregister
EventRegister
EventWriteTransfer
AllocateAndInitializeSid
OpenProcessToken
FreeSid
CheckTokenMembership
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenThreadToken
GetTokenInformation

kernel32

AllocConsole
SetCurrentDirectoryW
GetCurrentDirectoryW
CloseHandle
GetCurrentThread
FormatMessageW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
GetStartupInfoW
Sleep
GetProcessHeap
HeapFree
WaitForSingleObject
CreateEventW
GetLastError
SetEvent
HeapSetInformation
LocalFree
HeapAlloc

msvcrt

_except_handler4_common
_controlfp
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_wcmdln
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
memmove
memcpy
memset
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
_purecall
_callnewh
malloc
??_V@YAXPAX@Z
??3@YAXPAX@Z
__CxxFrameHandler3
_CxxThrowException
_vsnwprintf
_vsnprintf

ole32

CoUninitialize
CoRegisterClassObject
CoInitializeSecurity
CoInitializeEx
CoRevokeClassObject
CoCreateInstance

ntdll

DbgPrintEx

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
sethc.exe
.exe windows:10 windows x86 arch:x86

3559ebf82095a415d26aba1ddd417b7f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

sethc.pdb

Imports

advapi32

EventUnregister
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
EventRegister
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
TraceMessage
EventWriteTransfer
RegOpenKeyExW
RegEnumValueW
EventSetInformation
RegDeleteTreeW
RegLoadMUIStringW
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
RegGetValueW
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
RegEnumKeyExW
RegCloseKey

kernel32

InitializeCriticalSection
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
VirtualQuery
GetSystemInfo
ExpandEnvironmentStringsW
CreateMutexW
LoadLibraryExA
VirtualProtect
OOBEComplete
MultiByteToWideChar
GetLastError
CloseHandle
RaiseException
IsProcessInJob
OpenJobObjectW
InitOnceComplete
InitOnceBeginInitialize
CreateSemaphoreExW
CreateMutexExW
FreeLibrary
LoadLibraryExW
CompareStringOrdinal
CreateThreadpoolTimer
OpenSemaphoreW
WaitForSingleObject
InitializeCriticalSectionEx
WaitForSingleObjectEx
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
ReleaseMutex
ReleaseSemaphore
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
OutputDebugStringW
IsDebuggerPresent
K32GetModuleBaseNameW
K32EnumProcessModules
K32EnumProcesses
DeleteFileW
GetFileAttributesW
DeleteProcThreadAttributeList
CreateProcessW
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
OpenProcess
SetLastError
GetProcAddress
DebugBreak
GetModuleFileNameA
GetModuleHandleExW
FormatMessageW
LocalFree
GetTickCount
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetModuleHandleW
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
Sleep
HeapSetInformation
OpenMutexW
GetCurrentProcessId
WTSGetActiveConsoleSessionId
ProcessIdToSessionId
GetVersionExW
HeapAlloc
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
LoadResource
FindResourceExW
LockResource
GetProductInfo
SizeofResource
GetProcessHeap
DeleteCriticalSection

user32

UnregisterClassA
LoadIconW
SetWindowPos
SystemParametersInfoW
LoadStringW
SetWindowTextW
MessageBoxW
GetUserObjectInformationW
GetThreadDesktop
SetDesktopColorTransform
SendNotifyMessageW
GetWindowThreadProcessId
GetShellWindow
GetKeyState
SendInput

msvcrt

_amsg_exit
__wgetmainargs
__set_app_type
exit
_exit
_cexit
__p__fmode
__setusermatherr
_initterm
__p__commode
_lock
_unlock
__dllonexit
_onexit
_except_handler4_common
?terminate@@YAXXZ
_controlfp
memcmp
??1type_info@@UAE@XZ
wcschr
_ltow_s
_wcslwr_s
wcscspn
_XcptFilter
??_V@YAXPAX@Z
memmove_s
_callnewh
malloc
free
_wcsicmp
_vsnwprintf
_purecall
wcsspn
wcsrchr
_wtoi
__CxxFrameHandler3
memcpy_s
_wcmdln
memset

ntdll

WinSqmIncrementDWORD
WinSqmIsOptedIn
WinSqmAddToStream

playsndsrv

PlaySoundServerInitialize

oleacc

AccessibleObjectFromWindow

ole32

CoUninitialize
CoCreateInstance
CoInitialize

oleaut32

SysFreeString

uxtheme

ord65

shell32

ShellExecuteW

shlwapi

PathFileExistsW
ord460

dui70

?SetLayoutPos@Element@DirectUI@@QAEJH@Z
?FindDescendent@Element@DirectUI@@QAEPAV12@G@Z
StrToID
?GetClassInfoPtr@CCPushButton@DirectUI@@SGPAUIClassInfo@2@XZ
?Click@Button@DirectUI@@SG?AVUID@@XZ
?GetKeyFocusedElement@HWNDElement@DirectUI@@SGPAVElement@2@XZ
?IsRTLReading@Element@DirectUI@@UAE_NXZ
?IsContentProtected@Element@DirectUI@@UAE_NXZ
?QueryInterface@Element@DirectUI@@UAGJABU_GUID@@PAPAX@Z
?GetKeyFocused@Element@DirectUI@@UAE_NXZ
?SetVisible@Element@DirectUI@@QAEJ_N@Z
?SetAccessible@Element@DirectUI@@QAEJ_N@Z
?SetLayout@Element@DirectUI@@QAEJPAVLayout@2@@Z
?CanSetFocus@HWNDElement@DirectUI@@UAE_NXZ
?IsMSAAEnabled@HWNDElement@DirectUI@@UAE_NXZ
?GetHWND@HWNDElement@DirectUI@@UAEPAUHWND__@@XZ
?GetClassInfoW@HWNDElement@DirectUI@@UAEPAUIClassInfo@2@XZ
?DestroyWindow@NativeHWNDHost@DirectUI@@QAEXXZ
??1DUIFactory@DirectUI@@QAE@XZ
?LoadFromResource@DUIFactory@DirectUI@@QAEJPAUHINSTANCE__@@PBG1PAVElement@2@PAKPAPAV42@1@Z
?Create@FillLayout@DirectUI@@SGJPAPAVLayout@2@@Z
?Destroy@Layout@DirectUI@@QAEXXZ
?Destroy@Element@DirectUI@@QAEJ_N@Z
?GetContentStringAsDisplayed@Element@DirectUI@@UAEPBGPAPAVValue@2@@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnKeyFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnMouseFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?Paint@Element@DirectUI@@UAEXPAUHDC__@@PBUtagRECT@@1PAU4@2@Z
?GetContentSize@Element@DirectUI@@UAE?AUtagSIZE@@HHPAVSurface@2@@Z
?Add@Element@DirectUI@@UAEJPAPAV12@I@Z
?Add@Element@DirectUI@@QAEJPAV12@@Z
?Insert@Element@DirectUI@@UAEJPAPAV12@II@Z
?Remove@Element@DirectUI@@UAEJPAPAV12@I@Z
?GetAdjacent@Element@DirectUI@@UAEPAV12@PAV12@HPBUNavReference@2@K@Z
?EnsureVisible@Element@DirectUI@@UAE_NHHHH@Z
?SetKeyFocus@Element@DirectUI@@UAEXXZ
?AddBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z
?RemoveBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z
?MessageCallback@Element@DirectUI@@UAEIPAUtagGMSG@@@Z
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UAEXPAUtagRECT@@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MAEXHH@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MAE?AUtagSIZE@@HHPAVSurface@2@@Z
?OnHosted@Element@DirectUI@@MAEXPAV12@@Z
?OnUnHosted@Element@DirectUI@@MAEXPAV12@@Z
?DoubleBuffered@Element@DirectUI@@QAEX_N@Z
?DefaultAction@Element@DirectUI@@UAEJXZ
?GetUIAElementProvider@Element@DirectUI@@UAEJABU_GUID@@PAPAX@Z
?GetElementProviderImpl@Element@DirectUI@@UAEJPAVInvokeHelper@2@PAPAVElementProvider@2@@Z
?HandleUiaDestroyListener@Element@DirectUI@@UAEXXZ
?HandleUiaPropertyListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@@Z
?HandleUiaEventListener@Element@DirectUI@@UAEXPAUEvent@2@@Z
?GetUiaFocusDelegate@Element@DirectUI@@UAEPAV12@XZ
?Host@NativeHWNDHost@DirectUI@@QAEXPAVElement@2@@Z
?OnPropertyChanged@HWNDElement@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnGroupChanged@HWNDElement@DirectUI@@UAEXH_N@Z
?OnDestroy@HWNDElement@DirectUI@@UAEXXZ
?OnEvent@HWNDElement@DirectUI@@UAEXPAUEvent@2@@Z
?OnThemeChanged@HWNDElement@DirectUI@@UAEXPAUThemeChangedEvent@2@@Z
?OnImmersiveColorSchemeChanged@HWNDElement@DirectUI@@UAEXXZ
?OnInput@HWNDElement@DirectUI@@UAEXPAUInputEvent@2@@Z
?OnNoChildWithShortcutFound@HWNDElement@DirectUI@@UAEXPAUKeyboardEvent@2@@Z
?OnGetDlgCode@HWNDElement@DirectUI@@UAEXPAUtagMSG@@PAJ@Z
?OnWmThemeChanged@HWNDElement@DirectUI@@UAEXIJ@Z
?OnWmSettingChanged@HWNDElement@DirectUI@@UAEXIJ@Z
?OnCompositionChanged@HWNDElement@DirectUI@@UAEXXZ
?UpdateTooltip@HWNDElement@DirectUI@@UAEXPAVElement@2@@Z
?ActivateTooltip@HWNDElement@DirectUI@@UAEXPAVElement@2@K@Z
?RemoveTooltip@HWNDElement@DirectUI@@UAEXPAVElement@2@@Z
?CreateStyleParser@HWNDElement@DirectUI@@UAEJPAPAVDUIXmlParser@2@@Z
?WndProc@HWNDElement@DirectUI@@UAEJPAUHWND__@@IIJ@Z
?GetWindowClassNameAndStyle@HWNDElement@DirectUI@@UAEXPAPBGPAI@Z
?Register@HWNDElement@DirectUI@@SGJXZ
?GetAccessibleImpl@HWNDElement@DirectUI@@UAEJPAPAUIAccessible@@@Z
??0HWNDElement@DirectUI@@QAE@XZ
??1HWNDElement@DirectUI@@UAE@XZ
?Initialize@HWNDElement@DirectUI@@QAEJPAUHWND__@@_NIPAVElement@2@PAK@Z
?_OnUIStateChanged@HWNDElement@DirectUI@@MAEXGG@Z
?Create@NativeHWNDHost@DirectUI@@SGJPBGPAUHWND__@@PAUHICON__@@HHHHHHIPAPAV12@@Z
?ShowWindow@NativeHWNDHost@DirectUI@@QAEXH@Z
InitProcessPriv
InitThread
?Destroy@NativeHWNDHost@DirectUI@@QAEXXZ
?EndDefer@Element@DirectUI@@QAEXK@Z
UnInitProcessPriv
StartMessagePump
UnInitThread

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

Sections

.text
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
setup16.exe
.exe windows:10 windows x86 arch:x86

4378ab751681da98ab3b304461a9b42a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

setup16.pdb

Imports

advapi32

RegQueryValueA
RegDeleteKeyA
RegSetValueA
RegCloseKey
RegEnumKeyA
RegCreateKeyA
RegOpenKeyExA

kernel32

SetErrorMode
LocalAlloc
GetVersion
_lopen
_llseek
GetSystemInfo
IsDBCSLeadByte
GetWindowsDirectoryA
SetFileAttributesA
LocalSize
GlobalCompact
lstrcmpiA
ExitProcess
WinExec
LocalReAlloc
_lclose
GetDiskFreeSpaceExA
GetPrivateProfileIntA
GetPrivateProfileStringA
_lwrite
LocalUnlock
GetCurrentThreadId
LocalLock
GetModuleFileNameA
LocalFree
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
Sleep
GetDriveTypeA
lstrlenA
OpenFile
_lread
GetTickCount
GetSystemTimeAsFileTime

gdi32

SetBkMode
GetTextExtentPointA

user32

GetSystemMetrics
PostMessageA
CharPrevA
LoadStringA
SetWindowPos
DestroyWindow
DispatchMessageA
GetMessageA
CharNextA
IsWindow
OemToCharBuffA
EndPaint
BeginPaint
UpdateWindow
FindWindowA
KillTimer
PeekMessageA
GetClientRect
CharUpperA
SendMessageA
ShowWindow
SetTimer
MessageBoxA
DrawTextA
TranslateMessage
CreateWindowExA
DefWindowProcA
RegisterClassA
CharToOemA

msvcrt

_access
rename
_chdir
atoi
_chdrive
strstr
strchr
remove
_splitpath_s
_XcptFilter
__p__commode
_amsg_exit
__getmainargs
__set_app_type
exit
_exit
_cexit
__p__fmode
_ismbblead
__setusermatherr
_initterm
_acmdln
?terminate@@YAXXZ
_controlfp
_except_handler4_common
fclose
fopen
toupper
_rmdir
malloc
_tempnam
free
_lseek
_stat
_chmod
_ltoa
_open
_write
_close
_unlink
_vsnprintf
_read
_mktemp
_itoa_s
_mkdir
memset

cabinet

ord23
ord22
ord20

lz32

LZCopy
LZClose
LZOpenFileA

Sections

.text
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
setupugc.exe
.exe windows:10 windows x86 arch:x86

595d9b369e810dca08077f6c3d9b6d79

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

setupugc.pdb

Imports

msvcrt

wcsncmp
wcsspn
wcscspn
memcmp
iswalpha
memmove
_except_handler4_common
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
_wcmdln
_initterm
_wcsnicmp
wcschr
_vscwprintf
__setusermatherr
_vsnprintf
_vsnwprintf
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
__CxxFrameHandler3
qsort
iswdigit
_wtoi
iswspace
wcsrchr
_wcsicmp
_controlfp
memset

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-sysinfo-l1-2-0

SetComputerNameExW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
GetLastError

dnsapi

DnsValidateName_W

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoCreateInstance
CoInitializeEx
CoUninitialize

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetWindowsDirectoryW
GetVersionExW

api-ms-win-core-string-l1-1-0

CompareStringW

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegCreateKeyExW
RegDeleteValueW
RegQueryValueExW
RegDeleteTreeW
RegEnumKeyExW
RegDeleteKeyExW
RegOpenKeyExW
RegSetValueExW
RegCloseKey

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceEnableFlags
GetTraceLoggerHandle
TraceEvent

api-ms-win-core-libraryloader-l1-2-0

LoadStringW
GetProcAddress
FreeLibrary
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleW

api-ms-win-core-synch-l1-1-0

CreateEventW
OpenEventW
WaitForSingleObject
LeaveCriticalSection
SetEvent
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-0

GetExitCodeProcess
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
CreateProcessW
OpenProcessToken
CreateThread
TerminateProcess

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-kernel32-legacy-l1-1-0

SetVolumeLabelW

wdscore

WdsValidBlackboard
WdsInitializeDataStringW
WdsAbortBlackboardItemEnum
WdsSetBlackboardValue
WdsDestroyBlackboard
WdsFreeData
WdsGetBlackboardValue
WdsCreateBlackboard
WdsTerminate
WdsInitializeDataUInt32
WdsEnumFirstBlackboardItem
WdsDeleteBlackboardValue
WdsInitialize

rpcrt4

I_RpcMapWin32Status
UuidToStringW
RpcStringFreeW
UuidCreate

api-ms-win-core-processenvironment-l1-1-0

GetCurrentDirectoryW
ExpandEnvironmentStringsW

api-ms-win-core-file-l1-1-0

SetFileAttributesW
GetFileInformationByHandle
SetFileInformationByHandle
DeleteFileW
GetFileAttributesW
FindNextFileW
GetFullPathNameW
FindFirstFileW
CreateDirectoryW
FindClose
CreateFileW
GetFinalPathNameByHandleW
GetLongPathNameW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

mpr

WNetAddConnection2W
WNetCancelConnection2W

api-ms-win-security-base-l1-1-0

AdjustTokenPrivileges

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

ntdll

RtlGetThreadErrorMode
NtSetInformationFile
NtQuerySystemInformation
RtlFreeHeap
RtlAllocateHeap
NtOpenFile
NtClose
NtDeviceIoControlFile
RtlInitUnicodeString
RtlSetThreadErrorMode
RtlNtStatusToDosError

Sections

.text
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
setx.exe
.exe windows:10 windows x86 arch:x86

118566f8bc62d0c4dd5d6fabb7491816

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

setx.pdb

Imports

msvcrt

fflush
fprintf
_get_osfhandle
_fileno
_cexit
wcstoul
wcstod
_memicmp
__iob_func
_exit
_vsnwprintf
__set_app_type
__p__fmode
__wgetmainargs
_amsg_exit
fclose
iswctype
_wtoi
fseek
_wcsnset
wcschr
memmove
__p__commode
_XcptFilter
fgetws
_except_handler4_common
exit
_controlfp
?terminate@@YAXXZ
wcstok
wcsstr
_initterm
_errno
__setusermatherr
wcstol
_wfopen
memcpy
memchr
memset

api-ms-win-core-registry-l2-1-0

RegConnectRegistryW
RegCreateKeyW

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrTrimW
StrChrW

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
GetLastError

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetThreadLocale
SetThreadUILanguage

api-ms-win-core-file-l1-1-0

CreateFileW
ReadFile
GetFileType
GetFileSize

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapValidate
HeapSize
HeapSetInformation
HeapReAlloc
HeapFree
GetProcessHeap

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
FindStringOrdinal
LoadStringW
GetModuleHandleW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThreadId
GetCurrentProcess
ExitProcess
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetComputerNameExW
GetSystemTimeAsFileTime
GetTickCount

ws2_32

GetNameInfoW
WSACleanup
FreeAddrInfoW
WSAGetLastError
GetAddrInfoW
WSAStartup

sspicli

GetUserNameExW

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW
lstrlenA

api-ms-win-core-localization-obsolete-l1-2-0

CompareStringA

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte
CompareStringW

api-ms-win-core-console-l1-1-0

ReadConsoleW
WriteConsoleW
GetConsoleOutputCP
SetConsoleMode
GetConsoleMode

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle

api-ms-win-core-version-l1-1-0

GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeExW

api-ms-win-core-string-l2-1-0

CharUpperW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

ntdll

RtlVerifyVersionInfo

Sections

.text
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
sfc.exe
.exe windows:10 windows x86 arch:x86

95d4c1f2176b520da50458f8db768d2a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

sfc.pdb

Imports

msvcrt

_onexit
__dllonexit
_unlock
_lock
_controlfp
?terminate@@YAXXZ
wcstok
_except_handler4_common
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
exit
memmove
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
free
_callnewh
malloc
wcsrchr
strstr
atoi
wcsstr
wcschr
_strnicmp
wcstoul
strtoul
swscanf
_vsnwprintf
strtok
_wtof
_wcsnicmp
_fileno
_setmode
_wcsicmp
_errno
_purecall
memcpy
memcmp
_ftol2
__iob_func
__set_app_type
wprintf
memset

ntdll

RtlFreeHeap
RtlRaiseStatus
RtlExpandEnvironmentStrings_U
RtlInitAnsiString
RtlInitUnicodeString
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString

oleaut32

SysFreeString
SysAllocString

powrprof

PowerDeterminePlatformRole

api-ms-win-core-com-l1-1-0

CoInitializeEx
CoGetMalloc
CoCreateInstance
CoUninitialize
StringFromGUID2
CoCreateGuid

kernel32

LeaveCriticalSection
CreateSemaphoreExW
CreateMutexExW
RemoveDirectoryW
DeleteFileW
SetErrorMode
GetErrorMode
CopyFileW
CreateDirectoryW
GetFileAttributesW
CreateThreadpoolTimer
OpenSemaphoreW
DeleteCriticalSection
InitializeCriticalSectionEx
WaitForSingleObjectEx
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
ReleaseMutex
ReleaseSemaphore
SetLastError
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
OutputDebugStringW
IsDebuggerPresent
DebugBreak
GetModuleFileNameA
GetModuleHandleExW
EnterCriticalSection
SetEnvironmentVariableW
FormatMessageW
CloseHandle
HeapSetInformation
LocalFree
CompareFileTime
GetFileSizeEx
HeapFree
GetModuleFileNameW
GetUserDefaultUILanguage
GetProductInfo
WaitForSingleObject
CreateFileW
GetVersionExW
UnmapViewOfFile
QueueUserWorkItem
CreateEventW
GetLastError
SetEvent
FileTimeToSystemTime
GetDiskFreeSpaceExW
GetSystemInfo
LoadLibraryW
HeapAlloc
GetLocalTime
GetProcAddress
GetProcessHeap
SystemTimeToFileTime
FreeLibrary
LocaleNameToLCID
CreateFileMappingW
MapViewOfFile
GetFileTime
Sleep
SetUnhandledExceptionFilter
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LoadLibraryExW
GetWindowsDirectoryW
lstrcmpiW
RaiseException
OutputDebugStringA
GetTempPathW

advapi32

AllocateAndInitializeSid
CheckTokenMembership
RegQueryValueExW
RegEnumValueW
RegOpenKeyExW
RegCloseKey
FreeSid

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

Sections

.text
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
shrpubw.exe
.exe windows:10 windows x86 arch:x86

cb5f57cbff541490c4351b177ff74ec2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

shrpubw.pdb

Imports

advapi32

RegQueryValueExW
RegCloseKey
FreeSid
GetLengthSid
AddAccessAllowedAce
InitializeAcl
InitializeSecurityDescriptor
RegOpenKeyExW
MakeSelfRelativeSD
AllocateAndInitializeSid
LookupAccountNameW
MapGenericMask
GetSecurityDescriptorLength
GetSecurityDescriptorControl
RegOpenKeyExA
SetSecurityDescriptorDacl
RegConnectRegistryW
RegQueryValueExA

kernel32

LocalAlloc
GlobalAlloc
CreateDirectoryW
GetComputerNameExW
lstrcmpiW
LocalFree
GetFileAttributesW
GetDriveTypeW
GetLogicalDriveStringsW
FormatMessageW
GetProcAddress
ExpandEnvironmentStringsA
LoadLibraryExA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
HeapSetInformation
RegisterApplicationRestart
GetComputerNameW
GetLastError
Sleep
GetStartupInfoW
SetUnhandledExceptionFilter
FreeLibrary
LoadLibraryW

gdi32

CreateFontIndirectW
GetDeviceCaps
DeleteObject

user32

MessageBoxW
RegisterClipboardFormatW
EnableWindow
SendMessageW
GetParent
GetActiveWindow
ReleaseDC
GetDC
SystemParametersInfoW
LoadImageW
PostMessageW

mfc42u

ord4155
ord6564
ord538
ord6278
ord6279
ord861
ord4124
ord858
ord4272
ord1165
ord2820
ord940
ord942
ord3733
ord4418
ord4616
ord4075
ord3074
ord3820
ord3826
ord3825
ord2971
ord3076
ord2980
ord3257
ord3131
ord4459
ord3254
ord3142
ord2977
ord5710
ord5285
ord5303
ord823
ord4074
ord2717
ord5298
ord5296
ord3341
ord2388
ord5193
ord1089
ord3917
ord5727
ord2613
ord2546
ord4480
ord6371
ord6593
ord6481
ord768
ord4253
ord4704
ord3092
ord2859
ord3087
ord2634
ord4970
ord1662
ord2385
ord2644
ord1560
ord268
ord5977
ord4419
ord4621
ord5273
ord2116
ord2438
ord5257
ord1720
ord5059
ord3744
ord6372
ord2047
ord2640
ord4435
ord4829
ord3793
ord5283
ord4347
ord6370
ord5157
ord2377
ord5237
ord4401
ord1767
ord4073
ord6048
ord2506
ord4992
ord4848
ord4371
ord5261
ord4352
ord4942
ord4736
ord4899
ord5154
ord5156
ord5155
ord5949
ord5852
ord5706
ord536
ord941
ord6211
ord535
ord5679
ord2933
ord1775
ord922
ord4197
ord2810
ord2755
ord6867
ord825
ord2606
ord800
ord540
ord815
ord561
ord4269
ord1569
ord6484
ord2504
ord4692

msvcrt

__dllonexit
memmove
wcsrchr
iswspace
_XcptFilter
__p__commode
towupper
_wcsnicmp
wcschr
_unlock
_onexit
?terminate@@YAXXZ
_wcmdln
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
??1type_info@@UAE@XZ
_controlfp
_lock
_except_handler4_common
free
wcsncmp
calloc
__CxxFrameHandler3
memcpy
memset

comctl32

DestroyPropertySheetPage
PropertySheetW
ord17

netutils

NetpwPathType
NetpIsRemote
NetpwNameValidate
NetApiBufferFree

srvcli

NetServerDiskEnum
NetpsNameValidate
NetShareAdd
NetShareSetInfo
NetShareEnum
NetShareGetInfo
NetServerGetInfo

aclui

ord1

ws2_32

WSACleanup
WSAStartup
WSAStringToAddressW

shell32

SHGetMalloc
ord190
ord155
ord152
ord17
ord16
ord18
SHChangeNotify
SHBrowseForFolderW
SHGetSpecialFolderLocation
SHGetDesktopFolder
SHGetPathFromIDListW

api-ms-win-core-com-l1-1-0

CoUninitialize
CoInitializeEx
CoCreateInstance

Sections

.text
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
shutdown.exe
.exe windows:10 windows x86 arch:x86

8b92347e56758d2e293224c162867097

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

shutdown.pdb

Imports

msvcrt

wcsncmp
_XcptFilter
__p__commode
_amsg_exit
__wgetmainargs
__set_app_type
_except_handler4_common
_controlfp
?terminate@@YAXXZ
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
exit
_vsnwprintf

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCloseKey
RegQueryValueExW

api-ms-win-core-shutdown-l1-1-0

AbortSystemShutdownW
InitiateSystemShutdownExW

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-core-heap-l1-1-0

HeapSetInformation

api-ms-win-core-firmware-l1-1-0

GetFirmwareEnvironmentVariableW
SetFirmwareEnvironmentVariableW

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
LoadStringW

api-ms-win-core-localization-l1-2-0

FormatMessageW
SetThreadPreferredUILanguages

api-ms-win-core-shutdown-l1-1-1

InitiateShutdownW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW
lstrlenA

ntdll

NtInitiatePowerAction
NtPowerInformation
RtlNtStatusToDosError
RtlAdjustPrivilege

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-console-l1-1-0

WriteConsoleW
GetConsoleMode
GetConsoleOutputCP

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW
GetStdHandle

api-ms-win-core-file-l1-1-0

WriteFile
GetFileType

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
sort.exe
.exe windows:10 windows x86 arch:x86

c6ec9b11c5177bcdddfa1df776b08b61

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

sort.pdb

Imports

msvcrt

_ftol2
_ftol2_sse
memcpy
_except_handler4_common
_controlfp
?terminate@@YAXXZ
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
__iob_func
__getmainargs
_amsg_exit
__p__commode
_XcptFilter
_wcsncoll
_wcsnicoll
wcscoll
strchr
atoi
strcpy_s
_strnicmp
fprintf
qsort
_stricoll
strcoll
_strnicoll
__set_app_type
_strncoll
setlocale
_wcsicoll
exit
memset

ntdll

RtlMultiByteToUnicodeN
RtlUnicodeToOemN

kernel32

GetTempPath2A
GetModuleHandleExA
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
CreateEventA
GetTempFileNameA
FormatMessageA
SetThreadUILanguage
GetFileType
WideCharToMultiByte
GlobalMemoryStatusEx
GetProcessHeap
GetFileSize
GetOverlappedResult
HeapAlloc
ResetEvent
HeapSetInformation
GetSystemInfo
CloseHandle
CreateFileA
GetLastError
GetDiskFreeSpaceA
GetConsoleMode
MultiByteToWideChar
GetModuleHandleA
WaitForSingleObject
ReadFile
HeapFree
GetStdHandle
GetCPInfo
WriteFile
VirtualAlloc
GetProcAddress

advapi32

IsTextUnicode

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
srdelayed.exe
.sys windows:10 windows x86 arch:x86

831bd17f96aa64bd895d9c5c62c92318

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

srdelayed.pdb

Imports

ntdll

RtlQueryRegistryValuesEx
RtlWriteRegistryValue
_vsnwprintf
RtlDeleteRegistryValue
RtlAllocateHeap
RtlExitUserProcess
RtlEqualUnicodeString
NtWriteFile
RtlAppendUnicodeToString
RtlFreeUnicodeString
NtCreateThreadEx
RtlSetSystemBootStatus
RtlInitUnicodeString
NtSetInformationFile
NtReadFile
RtlReAllocateHeap
NtQueryAttributesFile
NtClose
RtlAdjustPrivilege
NtCreateEvent
NtShutdownSystem
NtQueryInformationFile
NtSetEvent
RtlFreeHeap
NtWaitForMultipleObjects
RtlSetHeapInformation
RtlDuplicateUnicodeString
NtWaitForSingleObject
NtOpenFile
NtTerminateProcess
RtlUnhandledExceptionFilter
_aullshr
memmove
iswspace
RtlNormalizeProcessParams
memcmp
memcpy
memset

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 624B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
stordiag.exe
.exe windows:10 windows x86 arch:x86

489ddde207af49358ee89456ca4853b5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

stordiag_unmanaged.pdb

Imports

msvcp_win

?_Syserror_map@std@@YAPBDH@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Winerror_map@std@@YAHH@Z

api-ms-win-crt-string-l1-1-0

strnlen
memset
memmove_s

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback
_c_exit
_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__get_initial_wide_environment
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
memmove
_o__wcsicmp
_o__wcsnicmp
_o_exit
_o_free
_o_malloc
_o_memcpy_s
_o_strcpy_s
_o_terminate
_o_towupper
_o_wcscpy_s
_o_wcstombs_s
wcschr
__current_exception
__current_exception_context
_except_handler4_common
_CxxThrowException
_o__exit
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___stdio_common_vfwprintf
_o___stdio_common_vfprintf
_o__errno
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
_o___p___wargv
_o___p___argc
_o___acrt_iob_func
__std_terminate
__CxxFrameHandler3
_o__cexit
_o__callnewh
_o__crt_atexit
_o__controlfp_s
_o__configure_wide_argv
_o__configthreadlocale
memcmp
memcpy

ntdll

NtQuerySystemInformation
NtPowerInformation
RtlGetDeviceFamilyInfoEnum

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-file-l1-1-0

FindNextFileW
WriteFile
FindFirstFileExW
GetFileAttributesExW
CreateFileW
FindClose
ReadFile
GetFileAttributesW
QueryDosDeviceW
SetFileInformationByHandle
SetFilePointerEx
CreateDirectoryW

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
GetModuleHandleExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameA
FreeLibrary

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-path-l1-1-0

PathCchStripToRoot
PathCchAddBackslash
PathCchCombine

api-ms-win-core-processthreads-l1-1-0

GetExitCodeProcess
GetCurrentThreadId
TerminateProcess
CreateProcessW
GetCurrentProcessId
OpenProcessToken
GetCurrentProcess

api-ms-win-core-com-l1-1-0

CoTaskMemFree
StringFromGUID2

api-ms-win-core-synch-l1-1-0

CreateEventW
ReleaseSRWLockShared
WaitForSingleObject
WaitForSingleObjectEx
AcquireSRWLockExclusive
CreateMutexExW
ReleaseSRWLockExclusive
AcquireSRWLockShared
OpenSemaphoreW
DeleteCriticalSection
ReleaseMutex
CreateSemaphoreExW
InitializeCriticalSectionEx
LeaveCriticalSection
ReleaseSemaphore
EnterCriticalSection

api-ms-win-core-localization-l1-2-0

FormatMessageW
FormatMessageA

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemDirectoryW
GetComputerNameExW
GetLocalTime

api-ms-win-core-processenvironment-l1-1-0

GetCurrentDirectoryW

api-ms-win-core-file-l1-2-4

GetTempPath2W

rpcrt4

RpcAsyncInitializeHandle
RpcAsyncCancelCall
RpcAsyncCompleteCall

api-ms-win-core-sysinfo-l2-1-0

GetUserNameA

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrStrA

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-devices-config-l1-1-1

CM_Get_Device_Interface_List_SizeW
CM_MapCrToWin32Err
CM_Get_Device_Interface_ListW

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventUnregister

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

api-ms-win-core-file-l1-2-0

GetVolumePathNamesForVolumeNameW

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolThreadMinimum
CloseThreadpool
SetThreadpoolThreadMaximum
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpool
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks

storageusage

SelectStorageVolumeEx
CloseFindStorageSearch
FindNextStorageTypeExAsync
FindNextStorageTypeEx
OpenStorageTypeSearch
RunStorageGroveler

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
subst.exe
.exe windows:10 windows x86 arch:x86

7dd76573763f447c2ef4e1c30b281996

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

subst.pdb

Imports

kernel32

QueryDosDeviceW
GetLastError
DefineDosDeviceW
HeapSetInformation
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
GetTickCount

msvcrt

?terminate@@YAXXZ
_controlfp
_except_handler4_common
__p__commode
_amsg_exit
__getmainargs
__set_app_type
exit
_exit
_cexit
__p__fmode
_initterm
_XcptFilter
__setusermatherr

ulib

??0PATH_ARGUMENT@@QAE@XZ
??0FSTRING@@QAE@XZ
?QueryDirectory@SYSTEM@@SGPAVFSN_DIRECTORY@@PBVPATH@@E@Z
?IsValueSet@ARGUMENT@@QAEEXZ
?GetPattern@ARGUMENT@@QAEPAVWSTRING@@XZ
??1OBJECT@@UAE@XZ
?SetCaseSensitive@ARGUMENT_LEXEMIZER@@QAEXE@Z
?Set@STREAM_MESSAGE@@UAEEKW4MESSAGE_TYPE@@K@Z
?QueryInvalidArgument@ARGUMENT_LEXEMIZER@@QAEPAVWSTRING@@XZ
?PutSwitches@ARGUMENT_LEXEMIZER@@QAEXPBD@Z
?PutSeparators@ARGUMENT_LEXEMIZER@@QAEXPBD@Z
?GetLexemeAt@ARGUMENT_LEXEMIZER@@QAEPAVWSTRING@@K@Z
?DoParsing@ARGUMENT_LEXEMIZER@@QAEEPAVARRAY@@@Z
??0FLAG_ARGUMENT@@QAE@XZ
??1ARGUMENT_LEXEMIZER@@UAE@XZ
??0ARGUMENT_LEXEMIZER@@QAE@XZ
?Initialize@STRING_ARGUMENT@@QAEEPAD@Z
??1STRING_ARGUMENT@@UAE@XZ
??1PATH_ARGUMENT@@UAE@XZ
??1PATH@@UAE@XZ
?Initialize@PATH@@QAEEPBV1@E@Z
??0PATH@@QAE@XZ
?Display@MESSAGE@@QAAEPBDZZ
Get_Standard_Output_Stream
?QueryWSTR@WSTRING@@QBEPAGKKPAGKE@Z
?DeleteChAt@WSTRING@@QAEXKK@Z
?Initialize@WSTRING@@QAEEPBV1@KK@Z
?Initialize@WSTRING@@QAEEPBGK@Z
?Initialize@WSTRING@@QAEEPBDK@Z
??1FSTRING@@UAE@XZ
?Initialize@FSTRING@@QAEPAVWSTRING@@PAGK@Z
?Strstr@WSTRING@@QBEKPBV1@@Z
?Strupr@WSTRING@@QAEPAV1@XZ
?Initialize@FLAG_ARGUMENT@@QAEEPAD@Z
?Initialize@PATH_ARGUMENT@@QAEEPADE@Z
Get_Standard_Error_Stream
??0STREAM_MESSAGE@@QAE@XZ
??1STREAM_MESSAGE@@UAE@XZ
??0STRING_ARGUMENT@@QAE@XZ
??0ARRAY@@QAE@XZ
??1ARRAY@@UAE@XZ
?Initialize@ARRAY@@QAEEKK@Z
?Put@ARRAY@@UAEEPAVOBJECT@@@Z
Get_Standard_Input_Stream
??0DSTRING@@QAE@XZ
??1DSTRING@@UAE@XZ
?Initialize@STREAM_MESSAGE@@QAEEPAVSTREAM@@00@Z
?Initialize@ARGUMENT_LEXEMIZER@@QAEEPAVARRAY@@@Z
?PrepareToParse@ARGUMENT_LEXEMIZER@@QAEEPAVWSTRING@@@Z

ntdll

RtlDosPathNameToNtPathName_U
RtlFreeUnicodeString
RtlFreeHeap

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 636B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
svchost.exe
.exe windows:10 windows x86 arch:x86

cd4b689577aa1ef0befc1f09c4682c67

Code Sign

33:00:00:03:6c:e5:7e:eb:5d:1c:c2:be:17:00:00:00:00:03:6c
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

27-01-2022 19:31

Not After

26-01-2023 19:31

Subject

CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b3:7f:6b:55:04:b7:9d:5f:bd:ef:7d:36:8b:e3:88:17:42:55:87:7c:3d:ff:eb:6f:09:2d:74:33:2b:a5:92:f3
Signer

Actual PE Digest

b3:7f:6b:55:04:b7:9d:5f:bd:ef:7d:36:8b:e3:88:17:42:55:87:7c:3d:ff:eb:6f:09:2d:74:33:2b:a5:92:f3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

svchost.pdb

Imports

api-ms-win-core-crt-l2-1-0

_initterm_e
_initterm
__wgetmainargs

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
OpenProcessToken
SetProcessAffinityUpdateMode
ExitProcess

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetTickCount64

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetErrorMode

api-ms-win-core-crt-l1-1-0

qsort_s
memset
memcpy
memcmp
_wcsicmp

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventRegister
EventWriteTransfer

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetProcAddress
LoadLibraryExW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapSetInformation
HeapFree

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
InitializeSRWLock
EnterCriticalSection
LeaveCriticalSection
ReleaseSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockShared

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar
CompareStringOrdinal

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryValueExW
RegEnumKeyExW
RegOpenKeyExW
RegDisablePredefinedCacheEx
RegGetValueW

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW
ExpandEnvironmentStringsW

api-ms-win-core-processthreads-l1-1-1

SetProcessMitigationPolicy

api-ms-win-core-processthreads-l1-1-2

SetProtectedPolicy

api-ms-win-core-synch-l1-2-0

InitializeConditionVariable
SleepConditionVariableSRW
WakeAllConditionVariable

api-ms-win-core-debug-l1-1-0

DebugBreak

api-ms-win-core-localization-l1-2-0

LCMapStringW

api-ms-win-security-base-l1-1-0

GetTokenInformation
MakeAbsoluteSD
InitializeSecurityDescriptor
AddAccessAllowedAce
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
GetLengthSid
SetSecurityDescriptorDacl
InitializeAcl

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-crt-utility-l1-1-0

bsearch_s

api-ms-win-core-sidebyside-l1-1-0

DeactivateActCtx
CreateActCtxW
ReleaseActCtx
ActivateActCtx

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

ntdll

RtlNtStatusToDosErrorNoTeb
TpSetWait
EtwEventEnabled
EtwEventWrite
RtlAllocateHeap
RtlFreeHeap
TpSetTimerEx
TpWaitForTimer
TpReleaseTimer
TpSetTimer
TpAllocTimer
RtlQueryHeapInformation
TpAllocWait
_vsnwprintf
EtwEventRegister
NtSetInformationProcess
RtlSetProcessIsCritical
RtlImageNtHeader
RtlValidSecurityDescriptor
RtlRunOnceExecuteOnce
NtQuerySystemInformation
RtlNtStatusToDosError
RtlInitializeCriticalSection
RtlInitializeSid
RtlSubAuthoritySid
RtlGetDeviceFamilyInfoEnum
RtlReleaseSRWLockExclusive
RtlSubAuthorityCountSid
RtlAcquireSRWLockExclusive
RtlLengthRequiredSid
RtlDeriveCapabilitySidsFromName
RtlCopySid
TpReleaseWait
RtlUnhandledExceptionFilter

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
sxstrace.exe
.exe windows:10 windows x86 arch:x86

c163bdb71a3b7d0452dffa81172b2804

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

sxstrace.pdb

Imports

advapi32

ControlTraceW
EnableTraceEx
CloseTrace
ProcessTrace
StartTraceW
OpenTraceW

kernel32

GetConsoleOutputCP
GetStdHandle
WriteFile
RaiseException
HeapSetInformation
GetModuleHandleW
WideCharToMultiByte
SetThreadPreferredUILanguages
SetConsoleCtrlHandler
lstrlenW
GetUserDefaultLangID
CreateFileW
FormatMessageW
GetLastError
CloseHandle
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter

msvcrt

??0exception@@QAE@ABV0@@Z
_purecall
?what@exception@@UBEPBDXZ
_CxxThrowException
memcpy
memmove
_XcptFilter
__p__commode
_amsg_exit
__wgetmainargs
__set_app_type
exit
_exit
_cexit
??0exception@@QAE@ABQBDH@Z
__setusermatherr
_initterm
_lock
_unlock
__dllonexit
_onexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_controlfp
_except_handler4_common
wcsrchr
getchar
wcsstr
_wcsnicmp
??0exception@@QAE@ABQBD@Z
__p__fmode
printf
_wcsicmp
_vsnwprintf
__CxxFrameHandler3
??1exception@@UAE@XZ
memset

ntdll

RtlAllocateHeap
RtlFreeHeap

user32

LoadStringW

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
systeminfo.exe
.exe windows:10 windows x86 arch:x86

fa30fe69016436db21780bb5a128c980

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

sysinfo.pdb

Imports

advapi32

RegConnectRegistryW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW

kernel32

SetLastError
GetTimeFormatW
SetConsoleCursorPosition
WriteConsoleW
GetNumberFormatW
GetLocaleInfoW
GetStdHandle
LocalAlloc
FormatMessageW
GetModuleHandleW
GetModuleFileNameW
GetComputerNameExW
FileTimeToSystemTime
HeapSize
HeapReAlloc
HeapAlloc
HeapValidate
HeapFree
GetProcessHeap
GetConsoleScreenBufferInfo
ReadFile
SetConsoleMode
MultiByteToWideChar
GetConsoleOutputCP
ExitProcess
CompareStringA
GetThreadLocale
CompareStringW
lstrlenW
lstrlenA
GetUserDefaultLCID
GetConsoleMode
GetFileType
WideCharToMultiByte
FindStringOrdinal
SetThreadUILanguage
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
LocalFree
GetLastError
GetDateFormatW
ReadConsoleW
GetCurrentProcessId
QueryPerformanceCounter

msvcrt

memcpy
_ftol2
_CxxThrowException
wcstok
_except_handler4_common
_controlfp
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
_callnewh
malloc
free
_wcsicmp
_ui64tow_s
_wtoi64
__CxxFrameHandler3
__iob_func
_memicmp
_vsnwprintf
_errno
wcstod
wcstol
wcstoul
_fileno
_get_osfhandle
fprintf
fflush
memset

ntdll

RtlVerifyVersionInfo
VerSetConditionMask

user32

LoadStringW
wsprintfW
CharUpperW

mpr

WNetCancelConnection2W
WNetGetLastErrorW

oleaut32

SysAllocStringByteLen
SafeArrayGetUBound
SafeArrayGetLBound
VariantCopy
VariantClear
VariantInit
SysAllocString
VariantChangeType
SysStringLen
SafeArrayGetElement
SysFreeString

framedynos

??0CHString@@QAE@PBG@Z
??H@YG?AVCHString@@PBGABV0@@Z
??YCHString@@QAEABV0@ABV0@@Z
?Format@CHString@@QAAXPBGZZ
??4CHString@@QAEABV0@PBG@Z
?Left@CHString@@QBE?AV1@H@Z
?Empty@CHString@@QAEXXZ
?Compare@CHString@@QBEHPBG@Z
?Mid@CHString@@QBE?AV1@H@Z
?GetData@CHString@@IBEPAUCHStringData@@XZ
??4CHString@@QAEABV0@ABV0@@Z
??1CHString@@QAE@XZ
??0CHString@@QAE@XZ
?GetBufferSetLength@CHString@@QAEPAGH@Z
?Find@CHString@@QBEHG@Z
?FindOneOf@CHString@@QBEHPBG@Z
?GetBuffer@CHString@@QAEPAGH@Z
?Mid@CHString@@QBE?AV1@HH@Z
?ReleaseBuffer@CHString@@QAEXH@Z
?Right@CHString@@QBE?AV1@H@Z

ws2_32

GetAddrInfoW
GetNameInfoW
FreeAddrInfoW
WSAGetLastError
WSACleanup
WSAStartup

shlwapi

StrChrW
ord487

version

VerQueryValueW
GetFileVersionInfoSizeExW
GetFileVersionInfoExW

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoTaskMemAlloc
CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoTaskMemFree

sspicli

GetUserNameExW

Sections

.text
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

045f6a2c4e199b57d3708fffb5de6c54

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp_win

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

oleaut32

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-windowserrorreporting-l1-1-0

api-ms-win-core-processthreads-l1-1-3

api-ms-win-security-base-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-0

ntdll

api-ms-win-core-file-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-localization-l1-2-2

api-ms-win-rtcore-ntuser-window-l1-1-0

api-ms-win-rtcore-ntuser-synch-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 117KB - Virtual size: 117KB

.data Size: 2KB - Virtual size: 3KB

.idata Size: 9KB - Virtual size: 8KB

.didat Size: 512B - Virtual size: 24B

.rsrc Size: 85KB - Virtual size: 85KB

.reloc Size: 6KB - Virtual size: 6KB

9c7e5eec67e3177ed79d1b4cb6ed896a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp_win

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

.text
Size: 117KB - Virtual size: 117KB

.data
Size: 2KB - Virtual size: 3KB

.idata
Size: 9KB - Virtual size: 8KB

.didat
Size: 512B - Virtual size: 24B

.rsrc
Size: 85KB - Virtual size: 85KB

.reloc
Size: 6KB - Virtual size: 6KB

.text
Size: 636KB - Virtual size: 635KB

.data
Size: 5KB - Virtual size: 12KB

.idata
Size: 18KB - Virtual size: 17KB

.didat
Size: 512B - Virtual size: 360B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 35KB - Virtual size: 35KB