windhawk_setup[.]exe

resource
unpack001/$PLUGINSDIR/AccessControl.dll
unpack001/$PLUGINSDIR/ApplicationID.dll
unpack001/$PLUGINSDIR/INetC.dll
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/SimpleSC.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PLUGINSDIR/nsis7z.dll
unpack001/UI/resources/app/extensions/windhawk/dist/e0f1dd0fc5bc2e5c289962389cb164c4.node
unpack001/UI/resources/app/extensions/windhawk/prebuilds/win32-ia32/node.napi.node
unpack001/UI/resources/app/extensions/windhawk/prebuilds/win32-x64/node.napi.node
unpack002/$PLUGINSDIR/LangDLL.dll
unpack002/$PLUGINSDIR/SimpleSC.dll
unpack002/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/nsExec.dll

windhawk_setup.exe

.exe windows:4 windows x86 arch:x86

9dda1a1d1f8a1d13ae0297b47046b26e

Code Sign

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

16-04-2020 18:36

Not After

16-04-2045 18:44

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:01:47:a6:31:52:5c:23:53:35:c2:56:00:00:00:01:47:a6
Certificate

Issuer

CN=Microsoft ID Verified CS AOC CA 02,O=Microsoft Corporation,C=US

Not Before

28-07-2024 21:14

Not After

31-07-2024 21:14

Subject

CN=Michael Maltsev,O=Michael Maltsev,L=Rishon LeZion,ST=Central,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:01:47:a6:31:52:5c:23:53:35:c2:56:00:00:00:01:47:a6
Certificate

Issuer

CN=Microsoft ID Verified CS AOC CA 02,O=Microsoft Corporation,C=US

Not Before

28-07-2024 21:14

Not After

31-07-2024 21:14

Subject

CN=Michael Maltsev,O=Michael Maltsev,L=Rishon LeZion,ST=Central,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:00:00:04:96:50:4b:d2:db:ee:cb:88:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Not Before

13-04-2021 17:31

Not After

13-04-2026 17:31

Subject

CN=Microsoft ID Verified CS AOC CA 02,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

01-04-2021 20:05

Not After

01-04-2036 20:15

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

19-11-2020 20:32

Not After

19-11-2035 20:42

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:00:3d:d1:9f:e2:d4:41:cd:e3:40:00:00:00:00:00:3d
Certificate

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Not Before

18-04-2024 17:59

Not After

17-04-2025 17:59

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:C392-9641-4540,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

80:88:7c:62:a2:47:6b:9c:59:52:22:e9:1a:75:bf:c5:4b:6c:df:72:a0:04:f4:24:0e:b2:bb:4b:bc:92:a2:9c
Signer

Actual PE Digest

80:88:7c:62:a2:47:6b:9c:59:52:22:e9:1a:75:bf:c5:4b:6c:df:72:a0:04:f4:24:0e:b2:bb:4b:bc:92:a2:9c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_NO_SEH

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LINE_NUMS_STRIPPED

IMAGE_FILE_LOCAL_SYMS_STRIPPED

IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegEnumValueW

RegEnumKeyW

RegQueryValueExW

RegSetValueExW

RegCloseKey

RegDeleteValueW

RegDeleteKeyW

AdjustTokenPrivileges

LookupPrivilegeValueW

OpenProcessToken

RegOpenKeyExW

RegCreateKeyExW

shell32

SHGetPathFromIDListW

SHBrowseForFolderW

SHGetFileInfoW

SHFileOperationW

ShellExecuteExW

ole32

CoCreateInstance

OleUninitialize

OleInitialize

IIDFromString

CoTaskMemFree

comctl32

ImageList_Destroy

ord17

ImageList_AddMasked

ImageList_Create

user32

MessageBoxIndirectW

GetDlgItemTextW

SetDlgItemTextW

CreatePopupMenu

AppendMenuW

TrackPopupMenu

OpenClipboard

EmptyClipboard

SetClipboardData

CloseClipboard

IsWindowVisible

CallWindowProcW

GetMessagePos

CheckDlgButton

LoadCursorW

SetCursor

GetSysColor

SetWindowPos

GetWindowLongW

IsWindowEnabled

SetClassLongW

GetSystemMenu

EnableMenuItem

GetWindowRect

ScreenToClient

EndDialog

RegisterClassW

SystemParametersInfoW

CharPrevW

GetClassInfoW

DialogBoxParamW

CharNextW

ExitWindowsEx

DestroyWindow

CreateDialogParamW

SetTimer

SetWindowTextW

PostQuitMessage

SetForegroundWindow

ShowWindow

wsprintfW

SendMessageTimeoutW

FindWindowExW

IsWindow

GetDlgItem

SetWindowLongW

LoadImageW

GetDC

ReleaseDC

EnableWindow

InvalidateRect

SendMessageW

DefWindowProcW

BeginPaint

GetClientRect

FillRect

DrawTextW

EndPaint

CharNextA

wsprintfA

DispatchMessageW

CreateWindowExW

PeekMessageW

GetSystemMetrics

gdi32

GetDeviceCaps

SetBkColor

SelectObject

DeleteObject

CreateBrushIndirect

CreateFontIndirectW

SetBkMode

SetTextColor

kernel32

RemoveDirectoryW

lstrcmpiA

GetTempFileNameW

CreateProcessW

CreateDirectoryW

GetLastError

CreateThread

GlobalLock

GlobalUnlock

GetDiskFreeSpaceW

WideCharToMultiByte

lstrcpynW

lstrlenW

SetErrorMode

GetVersionExW

GetCommandLineW

GetTempPathW

GetWindowsDirectoryW

SetEnvironmentVariableW

WriteFile

ExitProcess

GetCurrentProcess

GetModuleFileNameW

GetFileSize

CreateFileW

GetTickCount

Sleep

SetFileAttributesW

GetFileAttributesW

SetCurrentDirectoryW

MoveFileW

GetFullPathNameW

GetShortPathNameW

SearchPathW

CompareFileTime

SetFileTime

CloseHandle

lstrcmpiW

lstrcmpW

ExpandEnvironmentStringsW

GlobalFree

GlobalAlloc

GetModuleHandleW

LoadLibraryExW

FreeLibrary

WritePrivateProfileStringW

GetPrivateProfileStringW

lstrlenA

MultiByteToWideChar

ReadFile

SetFilePointer

FindClose

FindNextFileW

FindFirstFileW

DeleteFileW

MulDiv

lstrcpyA

MoveFileExW

lstrcatW

GetSystemDirectoryW

GetProcAddress

GetModuleHandleA

GetExitCodeProcess

WaitForSingleObject

CopyFileW

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 172KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

$LOCALAPPDATA/Windhawk/Engine/Mods/32/windhawk-mod-shim.dll

.dll windows:6 windows x86 arch:x86

08228c24f43f2cf986fabfde584eeecf

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

cb:bf:3d:73:b5:02:21:79:28:5f:ba:16:9d:66:f0:30
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

26-07-2022 00:00

Not After

25-07-2024 23:59

Subject

CN=Michael Maltsev,O=Michael Maltsev,ST=HaMerkaz,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

cb:bf:3d:73:b5:02:21:79:28:5f:ba:16:9d:66:f0:30
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

26-07-2022 00:00

Not After

25-07-2024 23:59

Subject

CN=Michael Maltsev,O=Michael Maltsev,ST=HaMerkaz,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

3f:2f:d9:31:0d:95:86:99:7b:8b:59:5a:0c:50:f8:a3:aa:d8:c0:4c:9c:80:fc:9a:19:d5:e1:75:5e:28:73:2c
Signer

Actual PE Digest

3f:2f:d9:31:0d:95:86:99:7b:8b:59:5a:0c:50:f8:a3:aa:d8:c0:4c:9c:80:fc:9a:19:d5:e1:75:5e:28:73:2c

Digest Algorithm

sha256

PE Digest Matches

true

e5:6d:d7:66:2a:4b:e2:82:55:d7:e9:a1:f8:d0:e5:52:34:70:45:5a
Signer

Actual PE Digest

e5:6d:d7:66:2a:4b:e2:82:55:d7:e9:a1:f8:d0:e5:52:34:70:45:5a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

Imports

windhawk

InternalWh_HookSymbols

libc++

_ZNSt11logic_errorC2EPKc

_ZNSt12length_errorD1Ev

_ZNSt20bad_array_new_lengthC1Ev

_ZNSt20bad_array_new_lengthD1Ev

_ZTVN10__cxxabiv117__class_type_infoE

_ZTVN10__cxxabiv120__si_class_type_infoE

_ZTVSt12length_error

_ZdaPv

_ZdlPv

_Znaj

_Znwj

__cxa_allocate_exception

__cxa_free_exception

__cxa_throw

__gxx_personality_v0

libunwind

_Unwind_Resume

msvcrt

_amsg_exit

_initterm

_iob

_lock

_unlock

abort

calloc

free

fwrite

memcpy

memset

realloc

strlen

strncmp

vfprintf

kernel32

DeleteCriticalSection

EnterCriticalSection

GetLastError

GetModuleHandleExW

GetProcAddress

InitializeCriticalSection

LeaveCriticalSection

Sleep

TlsGetValue

VirtualProtect

VirtualQuery

Exports

_Z15CmwfHookSymbolsP11HINSTANCE__PK16CMWF_SYMBOL_HOOKj

_Z25GetCallerInternalWhModPtrPv

_ZN13WindhawkUtils11HookSymbolsEP11HINSTANCE__PKNS_17SYMBOL_HOOK_OLD_1Ej

_ZN13WindhawkUtils11HookSymbolsEP11HINSTANCE__PKNS_17SYMBOL_HOOK_OLD_2EjPKNS_29tagWH_FIND_SYMBOL_OPTIONS_OLDE

_ZNKSt3__16vectorIN13WindhawkUtils15SYMBOL_HOOK_NEWENS_9allocatorIS2_EEE20__throw_length_errorB6v15000Ev

_ZNSt12length_errorC2B6v15000EPKc

_ZNSt3__114__split_bufferIN13WindhawkUtils15SYMBOL_HOOK_NEWERNS_9allocatorIS2_EEED2Ev

_ZNSt3__120__throw_length_errorB6v15000EPKc

_ZNSt3__16vectorIN13WindhawkUtils15SYMBOL_HOOK_NEWENS_9allocatorIS2_EEE24__emplace_back_slow_pathIJRKNS0_INS_12basic_stringIwNS_11char_traitsIwEENS3_IwEEEENS3_ISB_EEEERKPPvRKSG_RKbEEEvDpOT_

_ZNSt3__16vectorIN13WindhawkUtils15SYMBOL_HOOK_NEWENS_9allocatorIS2_EEE24__emplace_back_slow_pathIJRKNS0_INS_17basic_string_viewIwNS_11char_traitsIwEEEENS3_ISA_EEEERKPPvRKSF_RKbEEEvDpOT_

_ZNSt3__16vectorIN13WindhawkUtils15SYMBOL_HOOK_NEWENS_9allocatorIS2_EEE7reserveEj

_ZNSt3__16vectorIN13WindhawkUtils15SYMBOL_HOOK_NEWENS_9allocatorIS2_EEED2B6v15000Ev

_ZSt28__throw_bad_array_new_lengthB6v15000v

_ZTISt11logic_error

_ZTISt12length_error

_ZTISt20bad_array_new_length

_ZTISt9bad_alloc

_ZTISt9exception

_ZTSSt11logic_error

_ZTSSt12length_error

_ZTSSt20bad_array_new_length

_ZTSSt9bad_alloc

_ZTSSt9exception

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.buildid
Size: 512B - Virtual size: 53B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.eh_fram
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.gcc_exc
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/4
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/18
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/31
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/43
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/55
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/66
Size: 512B - Virtual size: 408B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/80
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

$LOCALAPPDATA/Windhawk/Engine/Mods/64/windhawk-mod-shim.dll

.dll windows:6 windows x64 arch:x64

b2cde532f9f14e59304f1d028d981c5d

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

cb:bf:3d:73:b5:02:21:79:28:5f:ba:16:9d:66:f0:30
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

26-07-2022 00:00

Not After

25-07-2024 23:59

Subject

CN=Michael Maltsev,O=Michael Maltsev,ST=HaMerkaz,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

cb:bf:3d:73:b5:02:21:79:28:5f:ba:16:9d:66:f0:30
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

26-07-2022 00:00

Not After

25-07-2024 23:59

Subject

CN=Michael Maltsev,O=Michael Maltsev,ST=HaMerkaz,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

cd:48:44:64:87:38:c0:bd:43:20:6b:65:a9:f2:7d:89:95:0e:37:6b:bf:b4:9f:3a:92:e1:ed:b3:85:60:08:14
Signer

Actual PE Digest

cd:48:44:64:87:38:c0:bd:43:20:6b:65:a9:f2:7d:89:95:0e:37:6b:bf:b4:9f:3a:92:e1:ed:b3:85:60:08:14

Digest Algorithm

sha256

PE Digest Matches

true

2d:0f:fc:f7:51:8b:4c:54:7c:c0:a7:58:97:25:b2:e4:d8:65:7d:2a
Signer

Actual PE Digest

2d:0f:fc:f7:51:8b:4c:54:7c:c0:a7:58:97:25:b2:e4:d8:65:7d:2a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

PDB Paths

Imports

windhawk

InternalWh_HookSymbols

libc++

_ZNSt11logic_errorC2EPKc

_ZNSt12length_errorD1Ev

_ZNSt20bad_array_new_lengthC1Ev

_ZNSt20bad_array_new_lengthD1Ev

_ZTVN10__cxxabiv117__class_type_infoE

_ZTVN10__cxxabiv120__si_class_type_infoE

_ZTVSt12length_error

_ZdaPv

_ZdlPv

_Znay

_Znwy

__cxa_allocate_exception

__cxa_free_exception

__cxa_throw

__gxx_personality_seh0

libunwind

_Unwind_Resume

msvcrt

__iob_func

_amsg_exit

_initterm

_lock

_unlock

abort

calloc

free

fwrite

memcpy

memset

realloc

strlen

strncmp

vfprintf

kernel32

DeleteCriticalSection

EnterCriticalSection

GetLastError

GetModuleHandleExW

GetProcAddress

InitializeCriticalSection

LeaveCriticalSection

Sleep

TlsGetValue

VirtualProtect

VirtualQuery

Exports

_Z15CmwfHookSymbolsP11HINSTANCE__PK16CMWF_SYMBOL_HOOKy

_Z25GetCallerInternalWhModPtrPv

_ZN13WindhawkUtils11HookSymbolsEP11HINSTANCE__PKNS_17SYMBOL_HOOK_OLD_1Ey

_ZN13WindhawkUtils11HookSymbolsEP11HINSTANCE__PKNS_17SYMBOL_HOOK_OLD_2EyPKNS_29tagWH_FIND_SYMBOL_OPTIONS_OLDE

_ZNKSt3__16vectorIN13WindhawkUtils15SYMBOL_HOOK_NEWENS_9allocatorIS2_EEE20__throw_length_errorB6v15000Ev

_ZNSt12length_errorC2B6v15000EPKc

_ZNSt3__114__split_bufferIN13WindhawkUtils15SYMBOL_HOOK_NEWERNS_9allocatorIS2_EEED2Ev

_ZNSt3__120__throw_length_errorB6v15000EPKc

_ZNSt3__16vectorIN13WindhawkUtils15SYMBOL_HOOK_NEWENS_9allocatorIS2_EEE24__emplace_back_slow_pathIJRKNS0_INS_12basic_stringIwNS_11char_traitsIwEENS3_IwEEEENS3_ISB_EEEERKPPvRKSG_RKbEEEvDpOT_

_ZNSt3__16vectorIN13WindhawkUtils15SYMBOL_HOOK_NEWENS_9allocatorIS2_EEE24__emplace_back_slow_pathIJRKNS0_INS_17basic_string_viewIwNS_11char_traitsIwEEEENS3_ISA_EEEERKPPvRKSF_RKbEEEvDpOT_

_ZNSt3__16vectorIN13WindhawkUtils15SYMBOL_HOOK_NEWENS_9allocatorIS2_EEE7reserveEy

_ZNSt3__16vectorIN13WindhawkUtils15SYMBOL_HOOK_NEWENS_9allocatorIS2_EEED2B6v15000Ev

_ZSt28__throw_bad_array_new_lengthB6v15000v

_ZTISt11logic_error

_ZTISt12length_error

_ZTISt20bad_array_new_length

_ZTISt9bad_alloc

_ZTISt9exception

_ZTSSt11logic_error

_ZTSSt12length_error

_ZTSSt20bad_array_new_length

_ZTSSt9bad_alloc

_ZTSSt9exception

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.buildid
Size: 512B - Virtual size: 53B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 228B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 372B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/4
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/18
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/30
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/42
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/53
Size: 1024B - Virtual size: 720B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/67
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

$PLUGINSDIR/AccessControl.dll

.dll windows:4 windows x86 arch:x86

6b225baf8d24583523d4f42890e12522

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc

CloseHandle

lstrlenW

lstrcatW

lstrcmpiW

GetFileAttributesW

LocalAlloc

LoadLibraryA

GetCurrentProcess

GetProcAddress

lstrcpyW

GetLastError

LocalFree

GlobalFree

lstrcpynW

user32

wsprintfW

advapi32

GetSecurityDescriptorOwner

GetSecurityDescriptorGroup

GetSidSubAuthority

RegCloseKey

OpenProcessToken

RegGetKeySecurity

LookupAccountSidW

GetSidIdentifierAuthority

AdjustTokenPrivileges

LookupPrivilegeValueW

SetNamedSecurityInfoW

SetSecurityDescriptorDacl

RegOpenKeyExW

RegSetKeySecurity

IsValidSid

GetSecurityDescriptorDacl

GetUserNameW

GetNamedSecurityInfoW

SetSecurityDescriptorGroup

SetSecurityDescriptorOwner

GetSidSubAuthorityCount

InitializeSecurityDescriptor

LookupAccountNameW

SetEntriesInAclW

Exports

ClearOnFile

ClearOnRegKey

DenyOnFile

DenyOnRegKey

DisableFileInheritance

DisableRegKeyInheritance

EnableFileInheritance

EnableRegKeyInheritance

GetCurrentUserName

GetFileGroup

GetFileOwner

GetRegKeyGroup

GetRegKeyOwner

GrantOnFile

GrantOnRegKey

NameToSid

RevokeOnFile

RevokeOnRegKey

SetFileGroup

SetFileOwner

SetOnFile

SetOnRegKey

SetRegKeyGroup

SetRegKeyOwner

SidToName

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

$PLUGINSDIR/ApplicationID.dll

.dll windows:6 windows x86 arch:x86

8c45ff8a205d07c8c17066afebcdfc91

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

C:\src\NSIS-ApplicationID\ReleaseUnicode\ApplicationID.pdb

Imports

kernel32

lstrcpynW

GlobalAlloc

GlobalFree

WriteConsoleW

FlushFileBuffers

SetFilePointerEx

GetConsoleMode

GetConsoleCP

WriteFile

MultiByteToWideChar

WideCharToMultiByte

GetStringTypeW

EnterCriticalSection

LeaveCriticalSection

DeleteCriticalSection

EncodePointer

DecodePointer

SetLastError

InitializeCriticalSectionAndSpinCount

CreateEventW

TlsAlloc

TlsGetValue

TlsSetValue

TlsFree

GetSystemTimeAsFileTime

GetModuleHandleW

GetProcAddress

LCMapStringW

GetLocaleInfoW

GetCPInfo

CloseHandle

SetEvent

ResetEvent

WaitForSingleObjectEx

UnhandledExceptionFilter

SetUnhandledExceptionFilter

GetCurrentProcess

TerminateProcess

IsProcessorFeaturePresent

IsDebuggerPresent

GetStartupInfoW

QueryPerformanceCounter

GetCurrentProcessId

GetCurrentThreadId

InitializeSListHead

RtlUnwind

RaiseException

GetLastError

FreeLibrary

LoadLibraryExW

InterlockedFlushSList

HeapAlloc

HeapReAlloc

HeapFree

ExitProcess

GetModuleHandleExW

GetModuleFileNameA

GetACP

GetStdHandle

GetFileType

IsValidLocale

GetUserDefaultLCID

EnumSystemLocalesW

GetProcessHeap

FindClose

FindFirstFileExA

FindNextFileA

IsValidCodePage

GetOEMCP

GetCommandLineA

GetCommandLineW

GetEnvironmentStringsW

FreeEnvironmentStringsW

SetStdHandle

HeapSize

CreateFileW

shell32

SHCreateItemFromParsingName

SHGetPropertyStoreFromParsingName

ole32

CoCreateInstance

CoInitialize

CoUninitialize

shlwapi

SHStrDupW

Exports

Set

UninstallJumpLists

UninstallPinnedItem

Sections

.text
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 552B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

$PLUGINSDIR/INetC.dll

.dll windows:4 windows x86 arch:x86

163fdad7b5f915e3a0ca7ad1d08b4ff8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

Imports

kernel32

lstrcpyW

CreateThread

LocalAlloc

lstrcpynW

SleepEx

MulDiv

GetModuleHandleW

GetTickCount

ReadFile

CreateFileA

CreateFileW

GetFileSize

lstrcmpiW

lstrcatW

LoadLibraryA

lstrcmpW

lstrlenA

MultiByteToWideChar

WriteFile

lstrlenW

CloseHandle

GetLastError

DeleteFileW

GetProcAddress

WideCharToMultiByte

LocalFree

TerminateThread

GlobalAlloc

GlobalFree

SetFilePointer

WaitForSingleObject

user32

wsprintfA

FindWindowExW

GetWindowLongW

IsWindow

CreateDialogParamW

ShowWindow

GetParent

DispatchMessageW

LoadIconW

KillTimer

PostMessageW

IsDialogMessageW

SetWindowPos

SetWindowTextW

GetMessageW

SendDlgItemMessageW

TranslateMessage

EnableWindow

RedrawWindow

UpdateWindow

GetWindowRect

SendMessageW

SetTimer

SetWindowLongW

wsprintfW

SetDlgItemTextW

GetDlgItem

IsWindowVisible

MessageBoxW

GetClientRect

DestroyWindow

SystemParametersInfoW

GetWindowTextW

comctl32

ord17

wininet

HttpSendRequestExW

InternetErrorDlg

InternetWriteFile

HttpSendRequestW

InternetSetFilePointer

HttpAddRequestHeadersA

FtpCreateDirectoryW

InternetCrackUrlW

FtpOpenFileW

InternetSetOptionW

InternetOpenW

InternetGetLastResponseInfoW

HttpEndRequestW

InternetReadFile

HttpAddRequestHeadersW

HttpQueryInfoW

InternetCloseHandle

InternetConnectW

InternetQueryOptionW

HttpOpenRequestW

Exports

get

head

post

put

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

$PLUGINSDIR/LangDLL.dll

.dll windows:4 windows x86 arch:x86

fe3375e7e4529b73ba45ab2246b9269b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_NO_SEH

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LINE_NUMS_STRIPPED

IMAGE_FILE_LOCAL_SYMS_STRIPPED

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

Imports

kernel32

GlobalFree

lstrlenW

GlobalAlloc

lstrcmpW

GetModuleHandleW

MulDiv

lstrcpyW

lstrcpynW

user32

SetWindowTextW

SetDlgItemTextW

SendDlgItemMessageW

EndDialog

DialogBoxParamW

LoadIconW

SendMessageW

ShowWindow

GetDC

gdi32

CreateFontIndirectW

GetDeviceCaps

DeleteObject

Exports

LangDialog

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 681B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

$PLUGINSDIR/SimpleSC.dll

.dll windows:5 windows x86 arch:x86

a9546246ff97b887a4072a24f9106617

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LINE_NUMS_STRIPPED

IMAGE_FILE_LOCAL_SYMS_STRIPPED

IMAGE_FILE_BYTES_REVERSED_LO

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

EnterCriticalSection

SetFilePointer

GetACP

CloseHandle

LocalFree

SuspendThread

VirtualProtect

TlsAlloc

GetTickCount

IsDebuggerPresent

GetFullPathNameW

VirtualFree

HeapAlloc

GetStartupInfoW

ExitProcess

GetFileAttributesW

InitializeCriticalSection

GetCPInfoExW

GetThreadPriority

GetCurrentProcess

SetThreadPriority

VirtualAlloc

RtlUnwind

GetCPInfo

GetCommandLineW

GetSystemInfo

ResumeThread

GetProcAddress

LeaveCriticalSection

EnumSystemLocalesW

GetStdHandle

GetVersionExW

VerifyVersionInfoW

GetModuleHandleW

FreeLibrary

HeapCreate

HeapDestroy

ReadFile

GetDiskFreeSpaceW

VerSetConditionMask

GetUserDefaultUILanguage

FindFirstFileW

TlsFree

HeapSize

lstrcpynW

SetLastError

GetModuleFileNameW

GetLastError

GlobalAlloc

lstrlenW

SetEndOfFile

CompareStringW

CreateThread

HeapFree

WideCharToMultiByte

MultiByteToWideChar

FindClose

LoadLibraryA

ResetEvent

SetEvent

CreateFileW

GetLocaleInfoW

GetVersion

RaiseException

FormatMessageW

SwitchToThread

GetExitCodeThread

GetLocalTime

WaitForSingleObject

GetCurrentThread

WriteFile

ExitThread

DeleteCriticalSection

GetDateFormatW

TlsGetValue

IsValidLocale

TlsSetValue

LoadLibraryExW

GetSystemDefaultUILanguage

EnumCalendarInfoW

LocalAlloc

GetCurrentThreadId

UnhandledExceptionFilter

VirtualQuery

CreateEventW

GlobalFree

VirtualQueryEx

GetThreadLocale

Sleep

SetThreadLocale

version

GetFileVersionInfoSizeW

VerQueryValueW

GetFileVersionInfoW

user32

CharUpperBuffW

CharNextW

MsgWaitForMultipleObjects

FindWindowExW

CharLowerBuffW

LoadStringW

CharUpperW

PeekMessageW

GetSystemMetrics

MessageBoxW

oleaut32

SysAllocStringLen

SafeArrayPtrOfIndex

VariantCopy

SafeArrayGetLBound

SafeArrayGetUBound

VariantInit

VariantClear

SysFreeString

SysReAllocStringLen

VariantChangeType

SafeArrayCreate

netapi32

NetWkstaGetInfo

NetApiBufferFree

advapi32

CloseServiceHandle

ControlService

CreateServiceW

LookupAccountNameW

DeleteService

LsaAddAccountRights

StartServiceW

UnlockServiceDatabase

GetServiceKeyNameW

GetServiceDisplayNameW

ChangeServiceConfigW

LsaClose

LockServiceDatabase

OpenServiceW

ChangeServiceConfig2W

EnumDependentServicesW

QueryServiceConfig2W

LsaRemoveAccountRights

QueryServiceStatus

AdjustTokenPrivileges

QueryServiceConfigW

LookupPrivilegeValueW

OpenSCManagerW

LsaOpenPolicy

OpenProcessToken

RegOpenKeyExW

RegQueryValueExW

RegCloseKey

Exports

ContinueService

ExistsService

GetErrorMessage

GetServiceBinaryPath

GetServiceDelayedAutoStartInfo

GetServiceDescription

GetServiceDisplayName

GetServiceFailure

GetServiceFailureFlag

GetServiceLogon

GetServiceName

GetServiceStartType

GetServiceStatus

GrantServiceLogonPrivilege

InstallService

PauseService

RemoveService

RemoveServiceLogonPrivilege

RestartService

ServiceIsPaused

ServiceIsRunning

ServiceIsStopped

SetServiceBinaryPath

SetServiceDelayedAutoStartInfo

SetServiceDescription

SetServiceFailure

SetServiceFailureFlag

SetServiceLogon

SetServiceStartType

StartService

StopService

TMethodImplementationIntercept

__dbk_fcall_wrapper

dbkFCallWrapperAddr

Sections

.text
Size: 956KB - Virtual size: 956KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.itext
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 25KB

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.didata
Size: 512B - Virtual size: 490B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.edata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 69B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

$PLUGINSDIR/System.dll

.dll windows:4 windows x86 arch:x86

509a34b3a68a773e0afb4259e68f9f82

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_NO_SEH

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LINE_NUMS_STRIPPED

IMAGE_FILE_LOCAL_SYMS_STRIPPED

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc

GlobalFree

GlobalSize

lstrcpynW

lstrcpyW

GetProcAddress

WideCharToMultiByte

VirtualFree

FreeLibrary

lstrlenW

LoadLibraryW

GetModuleHandleW

MultiByteToWideChar

VirtualAlloc

VirtualProtect

GetLastError

user32

wsprintfW

ole32

StringFromGUID2

CLSIDFromString

Exports

Alloc

Call

Copy

Free

Get

Int64Op

Store

StrAlloc

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 867B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 662B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

.dll windows:4 windows x86 arch:x86

3b477381217c97b22146297f93df2a92

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_NO_SEH

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LINE_NUMS_STRIPPED

IMAGE_FILE_LOCAL_SYMS_STRIPPED

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

Imports

kernel32

lstrcpyW

GetFileAttributesW

lstrcmpiW

MulDiv

lstrlenW

HeapFree

GetProcessHeap

GetCurrentDirectoryW

HeapReAlloc

GlobalFree

lstrcpynW

GlobalAlloc

HeapAlloc

SetCurrentDirectoryW

user32

GetPropW

DestroyWindow

CallWindowProcW

SetCursor

LoadCursorW

RemovePropW

CharPrevW

GetWindowLongW

DrawTextW

GetWindowTextW

SetWindowLongW

GetDlgItem

GetSysColor

SetWindowPos

CreateDialogParamW

MapWindowPoints

GetWindowRect

SetPropW

CreateWindowExW

IsWindow

SetTimer

KillTimer

DispatchMessageW

TranslateMessage

GetMessageW

IsDialogMessageW

ShowWindow

wsprintfW

MapDialogRect

GetClientRect

CharNextW

SendMessageW

DrawFocusRect

gdi32

SetTextColor

shell32

SHBrowseForFolderW

SHGetPathFromIDListW

comdlg32

GetSaveFileNameW

GetOpenFileNameW

CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Create

CreateControl

CreateItem

CreateTimer

GetUserData

KillTimer

OnBack

OnChange

OnClick

OnNotify

SelectFileDialog

SelectFolderDialog

SetRTL

SetUserData

Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 638B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

$PLUGINSDIR/nsExec.dll

.dll windows:4 windows x86 arch:x86

68b7023f8923dd087549802f8fa631c3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_NO_SEH

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LINE_NUMS_STRIPPED

IMAGE_FILE_LOCAL_SYMS_STRIPPED

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

Imports

advapi32

SetSecurityDescriptorDacl

InitializeSecurityDescriptor

IsTextUnicode

user32

CharNextExA

CharNextW

CharPrevW

FindWindowExW

wsprintfW

SendMessageW

kernel32

GetCommandLineW

lstrcpynW

ExitProcess

GetCurrentProcess

GetModuleHandleA

GetProcAddress

Sleep

TerminateProcess

GlobalReAlloc

MultiByteToWideChar

IsDBCSLeadByteEx

ReadFile

PeekNamedPipe

GetExitCodeProcess

WaitForSingleObject

GetTickCount

lstrcpyW

CreateProcessW

GetStartupInfoW

CreatePipe

GetVersion

DeleteFileW

lstrcmpiW

lstrlenW

lstrcatW

CloseHandle

UnmapViewOfFile

MapViewOfFile

CreateFileMappingW

CreateFileW

CopyFileW

GetTempFileNameW

GlobalFree

GlobalAlloc

GetModuleFileNameW

Exports

Exec

ExecToLog

ExecToStack

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 420B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

$PLUGINSDIR/nsis7z.dll

.dll windows:6 windows x86 arch:x86

2656ea25cde98f31a490513c2db04ae8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

Imports

kernel32

LocalFree

FormatMessageW

GetFileInformationByHandle

SetLastError

DeviceIoControl

GetModuleHandleW

GetProcAddress

HeapAlloc

HeapFree

GetProcessHeap

GetSystemTimeAsFileTime

GetStdHandle

WaitForMultipleObjects

GetTickCount

GetConsoleMode

AreFileApisANSI

SetFileApisToOEM

SetFileApisToANSI

GlobalAlloc

GlobalFree

lstrcpynW

lstrcpyW

MultiByteToWideChar

WideCharToMultiByte

FreeLibrary

GetModuleFileNameW

LoadLibraryExW

GetCurrentDirectoryW

CreateDirectoryW

CreateSemaphoreW

RemoveDirectoryW

SetFileAttributesW

SetFileTime

GetTempPathW

GetCurrentProcessId

GetCurrentThreadId

MoveFileW

FindClose

FindFirstFileW

FindNextFileW

GetFileAttributesW

GetModuleHandleA

SetEndOfFile

GetCurrentProcess

GetSystemInfo

GlobalMemoryStatus

GetProcessAffinityMask

IsProcessorFeaturePresent

WriteConsoleW

HeapSize

GetStringTypeW

DecodePointer

SetStdHandle

FreeEnvironmentStringsW

GetEnvironmentStringsW

GetCommandLineW

GetCommandLineA

WaitForSingleObject

CreateEventW

ReleaseSemaphore

ResetEvent

SetEvent

InitializeCriticalSection

DeleteCriticalSection

LeaveCriticalSection

EnterCriticalSection

GetVersionExW

VirtualFree

VirtualAlloc

GetLastError

CloseHandle

WriteFile

SetFilePointer

ReadFile

GetFileSize

CreateFileW

DeleteFileW

GetCPInfo

GetOEMCP

GetACP

IsValidCodePage

FindFirstFileExW

SetFilePointerEx

GetFileSizeEx

GetConsoleCP

FlushFileBuffers

GetFileType

HeapReAlloc

LCMapStringW

UnhandledExceptionFilter

SetUnhandledExceptionFilter

TerminateProcess

IsDebuggerPresent

GetStartupInfoW

QueryPerformanceCounter

InitializeSListHead

RtlUnwind

RaiseException

InterlockedFlushSList

EncodePointer

InitializeCriticalSectionAndSpinCount

TlsAlloc

TlsGetValue

TlsSetValue

TlsFree

CreateThread

ExitThread

FreeLibraryAndExitThread

GetModuleHandleExW

ExitProcess

user32

SendMessageW

FindWindowExW

SetWindowTextW

GetDlgItem

wsprintfW

CharUpperW

advapi32

SetFileSecurityW

LookupPrivilegeValueW

AdjustTokenPrivileges

OpenProcessToken

oleaut32

VariantClear

SysAllocStringLen

SysStringLen

SysFreeString

VariantCopy

Exports

Extract

ExtractWithCallback

ExtractWithDetails

Sections

.text
Size: 323KB - Virtual size: 323KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

AppData/Engine/Mods/32/windhawk-mod-shim.dll

.dll windows:6 windows x86 arch:x86

08228c24f43f2cf986fabfde584eeecf

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

cb:bf:3d:73:b5:02:21:79:28:5f:ba:16:9d:66:f0:30
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

26-07-2022 00:00

Not After

25-07-2024 23:59

Subject

CN=Michael Maltsev,O=Michael Maltsev,ST=HaMerkaz,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

cb:bf:3d:73:b5:02:21:79:28:5f:ba:16:9d:66:f0:30
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

26-07-2022 00:00

Not After

25-07-2024 23:59

Subject

CN=Michael Maltsev,O=Michael Maltsev,ST=HaMerkaz,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

3f:2f:d9:31:0d:95:86:99:7b:8b:59:5a:0c:50:f8:a3:aa:d8:c0:4c:9c:80:fc:9a:19:d5:e1:75:5e:28:73:2c
Signer

Actual PE Digest

3f:2f:d9:31:0d:95:86:99:7b:8b:59:5a:0c:50:f8:a3:aa:d8:c0:4c:9c:80:fc:9a:19:d5:e1:75:5e:28:73:2c

Digest Algorithm

sha256

PE Digest Matches

true

e5:6d:d7:66:2a:4b:e2:82:55:d7:e9:a1:f8:d0:e5:52:34:70:45:5a
Signer

Actual PE Digest

e5:6d:d7:66:2a:4b:e2:82:55:d7:e9:a1:f8:d0:e5:52:34:70:45:5a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

Imports

windhawk

InternalWh_HookSymbols

libc++

_ZNSt11logic_errorC2EPKc

_ZNSt12length_errorD1Ev

_ZNSt20bad_array_new_lengthC1Ev

_ZNSt20bad_array_new_lengthD1Ev

_ZTVN10__cxxabiv117__class_type_infoE

_ZTVN10__cxxabiv120__si_class_type_infoE

_ZTVSt12length_error

_ZdaPv

_ZdlPv

_Znaj

_Znwj

__cxa_allocate_exception

__cxa_free_exception

__cxa_throw

__gxx_personality_v0

libunwind

_Unwind_Resume

msvcrt

_amsg_exit

_initterm

_iob

_lock

_unlock

abort

calloc

free

fwrite

memcpy

memset

realloc

strlen

strncmp

vfprintf

kernel32

DeleteCriticalSection

EnterCriticalSection

GetLastError

GetModuleHandleExW

GetProcAddress

InitializeCriticalSection

LeaveCriticalSection

Sleep

TlsGetValue

VirtualProtect

VirtualQuery

Exports

_Z15CmwfHookSymbolsP11HINSTANCE__PK16CMWF_SYMBOL_HOOKj

_Z25GetCallerInternalWhModPtrPv

_ZN13WindhawkUtils11HookSymbolsEP11HINSTANCE__PKNS_17SYMBOL_HOOK_OLD_1Ej

_ZN13WindhawkUtils11HookSymbolsEP11HINSTANCE__PKNS_17SYMBOL_HOOK_OLD_2EjPKNS_29tagWH_FIND_SYMBOL_OPTIONS_OLDE

_ZNKSt3__16vectorIN13WindhawkUtils15SYMBOL_HOOK_NEWENS_9allocatorIS2_EEE20__throw_length_errorB6v15000Ev

_ZNSt12length_errorC2B6v15000EPKc

_ZNSt3__114__split_bufferIN13WindhawkUtils15SYMBOL_HOOK_NEWERNS_9allocatorIS2_EEED2Ev

_ZNSt3__120__throw_length_errorB6v15000EPKc

_ZNSt3__16vectorIN13WindhawkUtils15SYMBOL_HOOK_NEWENS_9allocatorIS2_EEE24__emplace_back_slow_pathIJRKNS0_INS_12basic_stringIwNS_11char_traitsIwEENS3_IwEEEENS3_ISB_EEEERKPPvRKSG_RKbEEEvDpOT_

_ZNSt3__16vectorIN13WindhawkUtils15SYMBOL_HOOK_NEWENS_9allocatorIS2_EEE24__emplace_back_slow_pathIJRKNS0_INS_17basic_string_viewIwNS_11char_traitsIwEEEENS3_ISA_EEEERKPPvRKSF_RKbEEEvDpOT_

_ZNSt3__16vectorIN13WindhawkUtils15SYMBOL_HOOK_NEWENS_9allocatorIS2_EEE7reserveEj

_ZNSt3__16vectorIN13WindhawkUtils15SYMBOL_HOOK_NEWENS_9allocatorIS2_EEED2B6v15000Ev

_ZSt28__throw_bad_array_new_lengthB6v15000v

_ZTISt11logic_error

_ZTISt12length_error

_ZTISt20bad_array_new_length

_ZTISt9bad_alloc

_ZTISt9exception

_ZTSSt11logic_error

_ZTSSt12length_error

_ZTSSt20bad_array_new_length

_ZTSSt9bad_alloc

_ZTSSt9exception

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.buildid
Size: 512B - Virtual size: 53B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.eh_fram
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.gcc_exc
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/4
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/18
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/31
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/43
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/55
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/66
Size: 512B - Virtual size: 408B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/80
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

AppData/Engine/Mods/64/windhawk-mod-shim.dll

.dll windows:6 windows x64 arch:x64

b2cde532f9f14e59304f1d028d981c5d

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

cb:bf:3d:73:b5:02:21:79:28:5f:ba:16:9d:66:f0:30
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

26-07-2022 00:00

Not After

25-07-2024 23:59

Subject

CN=Michael Maltsev,O=Michael Maltsev,ST=HaMerkaz,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

cb:bf:3d:73:b5:02:21:79:28:5f:ba:16:9d:66:f0:30
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

26-07-2022 00:00

Not After

25-07-2024 23:59

Subject

CN=Michael Maltsev,O=Michael Maltsev,ST=HaMerkaz,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

cd:48:44:64:87:38:c0:bd:43:20:6b:65:a9:f2:7d:89:95:0e:37:6b:bf:b4:9f:3a:92:e1:ed:b3:85:60:08:14
Signer

Actual PE Digest

cd:48:44:64:87:38:c0:bd:43:20:6b:65:a9:f2:7d:89:95:0e:37:6b:bf:b4:9f:3a:92:e1:ed:b3:85:60:08:14

Digest Algorithm

sha256

PE Digest Matches

true

2d:0f:fc:f7:51:8b:4c:54:7c:c0:a7:58:97:25:b2:e4:d8:65:7d:2a
Signer

Actual PE Digest

2d:0f:fc:f7:51:8b:4c:54:7c:c0:a7:58:97:25:b2:e4:d8:65:7d:2a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

PDB Paths

Imports

windhawk

InternalWh_HookSymbols

libc++

_ZNSt11logic_errorC2EPKc

_ZNSt12length_errorD1Ev

_ZNSt20bad_array_new_lengthC1Ev

_ZNSt20bad_array_new_lengthD1Ev

_ZTVN10__cxxabiv117__class_type_infoE

_ZTVN10__cxxabiv120__si_class_type_infoE

_ZTVSt12length_error

_ZdaPv

_ZdlPv

_Znay

_Znwy

__cxa_allocate_exception

__cxa_free_exception

__cxa_throw

__gxx_personality_seh0

libunwind

_Unwind_Resume

msvcrt

__iob_func

_amsg_exit

_initterm

_lock

_unlock

abort

calloc

free

fwrite

memcpy

memset

realloc

strlen

strncmp

vfprintf

kernel32

DeleteCriticalSection

EnterCriticalSection

GetLastError

GetModuleHandleExW

GetProcAddress

InitializeCriticalSection

LeaveCriticalSection

Sleep

TlsGetValue

VirtualProtect

VirtualQuery

Exports

_Z15CmwfHookSymbolsP11HINSTANCE__PK16CMWF_SYMBOL_HOOKy

_Z25GetCallerInternalWhModPtrPv

_ZN13WindhawkUtils11HookSymbolsEP11HINSTANCE__PKNS_17SYMBOL_HOOK_OLD_1Ey

_ZN13WindhawkUtils11HookSymbolsEP11HINSTANCE__PKNS_17SYMBOL_HOOK_OLD_2EyPKNS_29tagWH_FIND_SYMBOL_OPTIONS_OLDE

_ZNKSt3__16vectorIN13WindhawkUtils15SYMBOL_HOOK_NEWENS_9allocatorIS2_EEE20__throw_length_errorB6v15000Ev

_ZNSt12length_errorC2B6v15000EPKc

_ZNSt3__114__split_bufferIN13WindhawkUtils15SYMBOL_HOOK_NEWERNS_9allocatorIS2_EEED2Ev

_ZNSt3__120__throw_length_errorB6v15000EPKc

_ZNSt3__16vectorIN13WindhawkUtils15SYMBOL_HOOK_NEWENS_9allocatorIS2_EEE24__emplace_back_slow_pathIJRKNS0_INS_12basic_stringIwNS_11char_traitsIwEENS3_IwEEEENS3_ISB_EEEERKPPvRKSG_RKbEEEvDpOT_

_ZNSt3__16vectorIN13WindhawkUtils15SYMBOL_HOOK_NEWENS_9allocatorIS2_EEE24__emplace_back_slow_pathIJRKNS0_INS_17basic_string_viewIwNS_11char_traitsIwEEEENS3_ISA_EEEERKPPvRKSF_RKbEEEvDpOT_

_ZNSt3__16vectorIN13WindhawkUtils15SYMBOL_HOOK_NEWENS_9allocatorIS2_EEE7reserveEy

_ZNSt3__16vectorIN13WindhawkUtils15SYMBOL_HOOK_NEWENS_9allocatorIS2_EEED2B6v15000Ev

_ZSt28__throw_bad_array_new_lengthB6v15000v

_ZTISt11logic_error

_ZTISt12length_error

_ZTISt20bad_array_new_length

_ZTISt9bad_alloc

_ZTISt9exception

_ZTSSt11logic_error

_ZTSSt12length_error

_ZTSSt20bad_array_new_length

_ZTSSt9bad_alloc

_ZTSSt9exception

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.buildid
Size: 512B - Virtual size: 53B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 228B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 372B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/4
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/18
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/30
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/42
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/53
Size: 1024B - Virtual size: 720B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/67
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

Compiler/compile_flags.txt

Compiler/i686-w64-mingw32/bin/windhawk-mod-shim.dll

.dll windows:6 windows x86 arch:x86

08228c24f43f2cf986fabfde584eeecf

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

cb:bf:3d:73:b5:02:21:79:28:5f:ba:16:9d:66:f0:30
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

26-07-2022 00:00

Not After

25-07-2024 23:59

Subject

CN=Michael Maltsev,O=Michael Maltsev,ST=HaMerkaz,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

cb:bf:3d:73:b5:02:21:79:28:5f:ba:16:9d:66:f0:30
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

26-07-2022 00:00

Not After

25-07-2024 23:59

Subject

CN=Michael Maltsev,O=Michael Maltsev,ST=HaMerkaz,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

3f:2f:d9:31:0d:95:86:99:7b:8b:59:5a:0c:50:f8:a3:aa:d8:c0:4c:9c:80:fc:9a:19:d5:e1:75:5e:28:73:2c
Signer

Actual PE Digest

3f:2f:d9:31:0d:95:86:99:7b:8b:59:5a:0c:50:f8:a3:aa:d8:c0:4c:9c:80:fc:9a:19:d5:e1:75:5e:28:73:2c

Digest Algorithm

sha256

PE Digest Matches

true

e5:6d:d7:66:2a:4b:e2:82:55:d7:e9:a1:f8:d0:e5:52:34:70:45:5a
Signer

Actual PE Digest

e5:6d:d7:66:2a:4b:e2:82:55:d7:e9:a1:f8:d0:e5:52:34:70:45:5a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

Imports

windhawk

InternalWh_HookSymbols

libc++

_ZNSt11logic_errorC2EPKc

_ZNSt12length_errorD1Ev

_ZNSt20bad_array_new_lengthC1Ev

_ZNSt20bad_array_new_lengthD1Ev

_ZTVN10__cxxabiv117__class_type_infoE

_ZTVN10__cxxabiv120__si_class_type_infoE

_ZTVSt12length_error

_ZdaPv

_ZdlPv

_Znaj

_Znwj

__cxa_allocate_exception

__cxa_free_exception

__cxa_throw

__gxx_personality_v0

libunwind

_Unwind_Resume

msvcrt

_amsg_exit

_initterm

_iob

_lock

_unlock

abort

calloc

free

fwrite

memcpy

memset

realloc

strlen

strncmp

vfprintf

kernel32

DeleteCriticalSection

EnterCriticalSection

GetLastError

GetModuleHandleExW

GetProcAddress

InitializeCriticalSection

LeaveCriticalSection

Sleep

TlsGetValue

VirtualProtect

VirtualQuery

Exports

_Z15CmwfHookSymbolsP11HINSTANCE__PK16CMWF_SYMBOL_HOOKj

_Z25GetCallerInternalWhModPtrPv

_ZN13WindhawkUtils11HookSymbolsEP11HINSTANCE__PKNS_17SYMBOL_HOOK_OLD_1Ej

_ZN13WindhawkUtils11HookSymbolsEP11HINSTANCE__PKNS_17SYMBOL_HOOK_OLD_2EjPKNS_29tagWH_FIND_SYMBOL_OPTIONS_OLDE

_ZNKSt3__16vectorIN13WindhawkUtils15SYMBOL_HOOK_NEWENS_9allocatorIS2_EEE20__throw_length_errorB6v15000Ev

_ZNSt12length_errorC2B6v15000EPKc

_ZNSt3__114__split_bufferIN13WindhawkUtils15SYMBOL_HOOK_NEWERNS_9allocatorIS2_EEED2Ev

_ZNSt3__120__throw_length_errorB6v15000EPKc

_ZNSt3__16vectorIN13WindhawkUtils15SYMBOL_HOOK_NEWENS_9allocatorIS2_EEE24__emplace_back_slow_pathIJRKNS0_INS_12basic_stringIwNS_11char_traitsIwEENS3_IwEEEENS3_ISB_EEEERKPPvRKSG_RKbEEEvDpOT_

_ZNSt3__16vectorIN13WindhawkUtils15SYMBOL_HOOK_NEWENS_9allocatorIS2_EEE24__emplace_back_slow_pathIJRKNS0_INS_17basic_string_viewIwNS_11char_traitsIwEEEENS3_ISA_EEEERKPPvRKSF_RKbEEEvDpOT_

_ZNSt3__16vectorIN13WindhawkUtils15SYMBOL_HOOK_NEWENS_9allocatorIS2_EEE7reserveEj

_ZNSt3__16vectorIN13WindhawkUtils15SYMBOL_HOOK_NEWENS_9allocatorIS2_EEED2B6v15000Ev

_ZSt28__throw_bad_array_new_lengthB6v15000v

_ZTISt11logic_error

_ZTISt12length_error

_ZTISt20bad_array_new_length

_ZTISt9bad_alloc

_ZTISt9exception

_ZTSSt11logic_error

_ZTSSt12length_error

_ZTSSt20bad_array_new_length

_ZTSSt9bad_alloc

_ZTSSt9exception

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.buildid
Size: 512B - Virtual size: 53B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.eh_fram
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.gcc_exc
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/4
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/18
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/31
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/43
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/55
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/66
Size: 512B - Virtual size: 408B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/80
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

Compiler/include/wil/Tracelogging.h

Compiler/include/wil/com.h

Compiler/include/wil/com_apartment_variable.h

.js

Compiler/include/wil/common.h

Compiler/include/wil/coroutine.h

Compiler/include/wil/cppwinrt.h

.js

Compiler/include/wil/cppwinrt_authoring.h

Compiler/include/wil/cppwinrt_helpers.h

.js

Compiler/include/wil/cppwinrt_notifiable_module_lock.h

Compiler/include/wil/cppwinrt_register_com_server.h

Compiler/include/wil/cppwinrt_wrl.h

Compiler/include/wil/filesystem.h

Compiler/include/wil/nt_result_macros.h

Compiler/include/wil/registry.h

Compiler/include/wil/registry_helpers.h

.js

Compiler/include/wil/resource.h

.js

Compiler/include/wil/result.h

Compiler/include/wil/result_macros.h

Compiler/include/wil/result_originate.h

Compiler/include/wil/rpc_helpers.h

Compiler/include/wil/safecast.h

Compiler/include/wil/stl.h

.js

Compiler/include/wil/token_helpers.h

Compiler/include/wil/traceloggingconfig.h

Compiler/include/wil/win32_helpers.h

Compiler/include/wil/win32_result_macros.h

Compiler/include/wil/windowing.h

.js

Compiler/include/wil/winrt.h

Compiler/include/wil/wistd_config.h

Compiler/include/wil/wistd_functional.h

Compiler/include/wil/wistd_memory.h

Compiler/include/wil/wistd_type_traits.h

Compiler/include/wil/wrl.h

Compiler/include/windhawk_api.h

Compiler/include/windhawk_api_internal.h

Compiler/include/windhawk_utils.h

Compiler/include/winrt/Windows.AI.MachineLearning.Preview.h

.js

Compiler/include/winrt/Windows.AI.MachineLearning.h

Compiler/include/winrt/Windows.ApplicationModel.Activation.h

.js

Compiler/include/winrt/Windows.ApplicationModel.AppExtensions.h

.js

Compiler/include/winrt/Windows.ApplicationModel.AppService.h

.js

Compiler/include/winrt/Windows.ApplicationModel.Appointments.AppointmentsProvider.h

.js

Compiler/include/winrt/Windows.ApplicationModel.Appointments.DataProvider.h

.js

Compiler/include/winrt/Windows.ApplicationModel.Appointments.h

Compiler/include/winrt/Windows.ApplicationModel.Background.h

Compiler/include/winrt/Windows.ApplicationModel.Calls.Background.h

.js

Compiler/include/winrt/Windows.ApplicationModel.Calls.Provider.h

.js

Compiler/include/winrt/Windows.ApplicationModel.Calls.h

Compiler/include/winrt/Windows.ApplicationModel.Chat.h

Compiler/include/winrt/Windows.ApplicationModel.CommunicationBlocking.h

.js

Compiler/include/winrt/Windows.ApplicationModel.Contacts.DataProvider.h

.js

Compiler/include/winrt/Windows.ApplicationModel.Contacts.Provider.h

.js

Compiler/include/winrt/Windows.ApplicationModel.Contacts.h

Compiler/include/winrt/Windows.ApplicationModel.ConversationalAgent.h

.js

Compiler/include/winrt/Windows.ApplicationModel.Core.h

.js

Compiler/include/winrt/Windows.ApplicationModel.DataTransfer.DragDrop.Core.h

.js

Compiler/include/winrt/Windows.ApplicationModel.DataTransfer.DragDrop.h

Compiler/include/winrt/Windows.ApplicationModel.DataTransfer.ShareTarget.h

.js

Compiler/include/winrt/Windows.ApplicationModel.DataTransfer.h

Compiler/include/winrt/Windows.ApplicationModel.Email.DataProvider.h

Compiler/include/winrt/Windows.ApplicationModel.Email.h

Compiler/include/winrt/Windows.ApplicationModel.ExtendedExecution.Foreground.h

.js

Compiler/include/winrt/Windows.ApplicationModel.ExtendedExecution.h

.js

Compiler/include/winrt/Windows.ApplicationModel.Holographic.h

.js

Compiler/include/winrt/Windows.ApplicationModel.LockScreen.h

.js

Compiler/include/winrt/Windows.ApplicationModel.Payments.Provider.h

.js

Compiler/include/winrt/Windows.ApplicationModel.Payments.h

.js

Compiler/include/winrt/Windows.ApplicationModel.Preview.Holographic.h

.js

Compiler/include/winrt/Windows.ApplicationModel.Preview.InkWorkspace.h

.js

Compiler/include/winrt/Windows.ApplicationModel.Preview.Notes.h

.js

Compiler/include/winrt/Windows.ApplicationModel.Resources.Core.h

.js

Compiler/include/winrt/Windows.ApplicationModel.Resources.Management.h

.js

Compiler/include/winrt/Windows.ApplicationModel.Resources.h

.js

Compiler/include/winrt/Windows.ApplicationModel.Search.Core.h

.js

Compiler/include/winrt/Windows.ApplicationModel.Search.h

.js

Compiler/include/winrt/Windows.ApplicationModel.SocialInfo.Provider.h

.js

Compiler/include/winrt/Windows.ApplicationModel.SocialInfo.h

.js

Compiler/include/winrt/Windows.ApplicationModel.Store.LicenseManagement.h

.js

Compiler/include/winrt/Windows.ApplicationModel.Store.Preview.InstallControl.h

.js

Compiler/include/winrt/Windows.ApplicationModel.Store.Preview.h

.js

Compiler/include/winrt/Windows.ApplicationModel.Store.h

.js

Compiler/include/winrt/Windows.ApplicationModel.UserActivities.Core.h

.js

Compiler/include/winrt/Windows.ApplicationModel.UserActivities.h

.js

Compiler/include/winrt/Windows.ApplicationModel.UserDataAccounts.Provider.h

.js

Compiler/include/winrt/Windows.ApplicationModel.UserDataAccounts.SystemAccess.h

.js

Compiler/include/winrt/Windows.ApplicationModel.UserDataAccounts.h

.js

Compiler/include/winrt/Windows.ApplicationModel.UserDataTasks.DataProvider.h

.js

Compiler/include/winrt/Windows.ApplicationModel.UserDataTasks.h

.js

Compiler/include/winrt/Windows.ApplicationModel.VoiceCommands.h

.js

Compiler/include/winrt/Windows.ApplicationModel.Wallet.System.h

.js

Compiler/include/winrt/Windows.ApplicationModel.Wallet.h

.js

Compiler/include/winrt/Windows.ApplicationModel.h

Compiler/include/winrt/Windows.Data.Html.h

.js

Compiler/include/winrt/Windows.Data.Json.h

.js

Compiler/include/winrt/Windows.Data.Pdf.h

.js

Compiler/include/winrt/Windows.Data.Text.h

.js

Compiler/include/winrt/Windows.Data.Xml.Dom.h

.js

Compiler/include/winrt/Windows.Data.Xml.Xsl.h

.js

Compiler/include/winrt/Windows.Devices.Adc.Provider.h

.js

Compiler/include/winrt/Windows.Devices.Adc.h

.js

Compiler/include/winrt/Windows.Devices.AllJoyn.h

.js

Compiler/include/winrt/Windows.Devices.Background.h

.js

Compiler/include/winrt/Windows.Devices.Bluetooth.Advertisement.h

.js

Compiler/include/winrt/Windows.Devices.Bluetooth.Background.h

.js

Compiler/include/winrt/Windows.Devices.Bluetooth.GenericAttributeProfile.h

Compiler/include/winrt/Windows.Devices.Bluetooth.Rfcomm.h

.js

Compiler/include/winrt/Windows.Devices.Bluetooth.h

Compiler/include/winrt/Windows.Devices.Custom.h

.js

Compiler/include/winrt/Windows.Devices.Display.Core.h

.js

Compiler/include/winrt/Windows.Devices.Display.h

.js

Compiler/include/winrt/Windows.Devices.Enumeration.Pnp.h

.js

Compiler/include/winrt/Windows.Devices.Enumeration.h

.js

Compiler/include/winrt/Windows.Devices.Geolocation.Geofencing.h

.js

Compiler/include/winrt/Windows.Devices.Geolocation.Provider.h

.js

Compiler/include/winrt/Windows.Devices.Geolocation.h

.js

Compiler/include/winrt/Windows.Devices.Gpio.Provider.h

.js

Compiler/include/winrt/Windows.Devices.Gpio.h

.js

Compiler/include/winrt/Windows.Devices.Haptics.h

.js

Compiler/include/winrt/Windows.Devices.HumanInterfaceDevice.h

.js

Compiler/include/winrt/Windows.Devices.I2c.Provider.h

.js

Compiler/include/winrt/Windows.Devices.I2c.h

.js

Compiler/include/winrt/Windows.Devices.Input.Preview.h

.js

Compiler/include/winrt/Windows.Devices.Input.h

.js

Compiler/include/winrt/Windows.Devices.Lights.Effects.h

.js

Compiler/include/winrt/Windows.Devices.Lights.h

.js

Compiler/include/winrt/Windows.Devices.Midi.h

.js

Compiler/include/winrt/Windows.Devices.Perception.Provider.h

.js

Compiler/include/winrt/Windows.Devices.Perception.h

Compiler/include/winrt/Windows.Devices.PointOfService.Provider.h

.js

Compiler/include/winrt/Windows.Devices.PointOfService.h

Compiler/include/winrt/Windows.Devices.Portable.h

.js

Compiler/include/winrt/Windows.Devices.Power.h

.js

Compiler/include/winrt/Windows.Devices.Printers.Extensions.h

.js

Compiler/include/winrt/Windows.Devices.Printers.h

.js

Compiler/include/winrt/Windows.Devices.Pwm.Provider.h

.js

Compiler/include/winrt/Windows.Devices.Pwm.h

.js

Compiler/include/winrt/Windows.Devices.Radios.h

.js

Compiler/include/winrt/Windows.Devices.Scanners.h

.js

Compiler/include/winrt/Windows.Devices.Sensors.Custom.h

.js

Compiler/include/winrt/Windows.Devices.Sensors.h

Compiler/include/winrt/Windows.Devices.SerialCommunication.h

.js

Compiler/include/winrt/Windows.Devices.SmartCards.h

Compiler/include/winrt/Windows.Devices.Sms.h

.js

Compiler/include/winrt/Windows.Devices.Spi.Provider.h

.js

Compiler/include/winrt/Windows.Devices.Spi.h

.js

Compiler/include/winrt/Windows.Devices.Usb.h

.js

Compiler/include/winrt/Windows.Devices.WiFi.h

.js

Compiler/include/winrt/Windows.Devices.WiFiDirect.Services.h

.js

Compiler/include/winrt/Windows.Devices.WiFiDirect.h

.js

Compiler/include/winrt/Windows.Devices.h

.js

Compiler/include/winrt/Windows.Foundation.Collections.h

.js

Compiler/include/winrt/Windows.Foundation.Diagnostics.h

Compiler/include/winrt/Windows.Foundation.Metadata.h

.js

Compiler/include/winrt/Windows.Foundation.Numerics.h

Compiler/include/winrt/Windows.Foundation.h

.js

Compiler/include/winrt/Windows.Gaming.Input.Custom.h

.js

Compiler/include/winrt/Windows.Gaming.Input.ForceFeedback.h

.js

Compiler/include/winrt/Windows.Gaming.Input.Preview.h

.js

Compiler/include/winrt/Windows.Gaming.Input.h

.js

Compiler/include/winrt/Windows.Gaming.Preview.GamesEnumeration.h

.js

Compiler/include/winrt/Windows.Gaming.UI.h

.js

Compiler/include/winrt/Windows.Gaming.XboxLive.Storage.h

.js

Compiler/include/winrt/Windows.Globalization.Collation.h

.js

Compiler/include/winrt/Windows.Globalization.DateTimeFormatting.h

.js

Compiler/include/winrt/Windows.Globalization.Fonts.h

.js

Compiler/include/winrt/Windows.Globalization.NumberFormatting.h

.js

Compiler/include/winrt/Windows.Globalization.PhoneNumberFormatting.h

.js

Compiler/include/winrt/Windows.Globalization.h

Compiler/include/winrt/Windows.Graphics.Capture.h

.js

Compiler/include/winrt/Windows.Graphics.DirectX.Direct3D11.h

.js

Compiler/include/winrt/Windows.Graphics.DirectX.h

Compiler/include/winrt/Windows.Graphics.Display.Core.h

.js

Compiler/include/winrt/Windows.Graphics.Display.h

.js

Compiler/include/winrt/Windows.Graphics.Effects.h

.js

Compiler/include/winrt/Windows.Graphics.Holographic.h

.js

Compiler/include/winrt/Windows.Graphics.Imaging.h

.js

Compiler/include/winrt/Windows.Graphics.Printing.OptionDetails.h

.js

Compiler/include/winrt/Windows.Graphics.Printing.PrintSupport.h

.js

Compiler/include/winrt/Windows.Graphics.Printing.PrintTicket.h

.js

Compiler/include/winrt/Windows.Graphics.Printing.Workflow.h

.js

Compiler/include/winrt/Windows.Graphics.Printing.h

.js

Compiler/include/winrt/Windows.Graphics.Printing3D.h

.js

Compiler/include/winrt/Windows.Graphics.h

Compiler/include/winrt/Windows.Management.Core.h

.js

Compiler/include/winrt/Windows.Management.Deployment.Preview.h

.js

Compiler/include/winrt/Windows.Management.Deployment.h

Compiler/include/winrt/Windows.Management.Policies.h

.js

Compiler/include/winrt/Windows.Management.Setup.h

.js

Compiler/include/winrt/Windows.Management.Update.h

.js

Compiler/include/winrt/Windows.Management.Workplace.h

.js

Compiler/include/winrt/Windows.Management.h

.js

Compiler/include/winrt/Windows.Media.AppBroadcasting.h

.js

Compiler/include/winrt/Windows.Media.AppRecording.h

.js

Compiler/include/winrt/Windows.Media.Audio.h

Compiler/include/winrt/Windows.Media.Capture.Core.h

.js

Compiler/include/winrt/Windows.Media.Capture.Frames.h

.js

Compiler/include/winrt/Windows.Media.Capture.h

Compiler/include/winrt/Windows.Media.Casting.h

.js

Compiler/include/winrt/Windows.Media.ClosedCaptioning.h

.js

Compiler/include/winrt/Windows.Media.ContentRestrictions.h

.js

Compiler/include/winrt/Windows.Media.Control.h

.js

Compiler/include/winrt/Windows.Media.Core.Preview.h

.js

Compiler/include/winrt/Windows.Media.Core.h

Compiler/include/winrt/Windows.Media.Devices.Core.h

.js

Compiler/include/winrt/Windows.Media.Devices.h

Compiler/include/winrt/Windows.Media.DialProtocol.h

.js

Compiler/include/winrt/Windows.Media.Editing.h

.js

Compiler/include/winrt/Windows.Media.Effects.h

.js

Compiler/include/winrt/Windows.Media.FaceAnalysis.h

.js

Compiler/include/winrt/Windows.Media.Import.h

.js

Compiler/include/winrt/Windows.Media.MediaProperties.h

Compiler/include/winrt/Windows.Media.Miracast.h

.js

Compiler/include/winrt/Windows.Media.Ocr.h

.js

Compiler/include/winrt/Windows.Media.PlayTo.h

.js

Compiler/include/winrt/Windows.Media.Playback.h

Compiler/include/winrt/Windows.Media.Playlists.h

.js

Compiler/include/winrt/Windows.Media.Protection.PlayReady.h

Compiler/include/winrt/Windows.Media.Protection.h

.js

Compiler/include/winrt/Windows.Media.Render.h

Compiler/include/winrt/Windows.Media.SpeechRecognition.h

.js

Compiler/include/winrt/Windows.Media.SpeechSynthesis.h

.js

Compiler/include/winrt/Windows.Media.Streaming.Adaptive.h

.js

Compiler/include/winrt/Windows.Media.Transcoding.h

.js

Compiler/include/winrt/Windows.Media.h

Compiler/include/winrt/Windows.Networking.BackgroundTransfer.h

.js

Compiler/include/winrt/Windows.Networking.Connectivity.h

.js

Compiler/include/winrt/Windows.Networking.NetworkOperators.h

Compiler/include/winrt/Windows.Networking.Proximity.h

.js

Compiler/include/winrt/Windows.Networking.PushNotifications.h

.js

Compiler/include/winrt/Windows.Networking.ServiceDiscovery.Dnssd.h

.js

Compiler/include/winrt/Windows.Networking.Sockets.h

Compiler/include/winrt/Windows.Networking.Vpn.h

Compiler/include/winrt/Windows.Networking.XboxLive.h

.js

Compiler/include/winrt/Windows.Networking.h

.js

Compiler/include/winrt/Windows.Perception.Automation.Core.h

.js

Compiler/include/winrt/Windows.Perception.People.h

.js

Compiler/include/winrt/Windows.Perception.Spatial.Preview.h

.js

Compiler/include/winrt/Windows.Perception.Spatial.Surfaces.h

.js

Compiler/include/winrt/Windows.Perception.Spatial.h

.js

Compiler/include/winrt/Windows.Perception.h

.js

Compiler/include/winrt/Windows.Security.Authentication.Identity.Core.h

.js

Compiler/include/winrt/Windows.Security.Authentication.Identity.Provider.h

.js

Compiler/include/winrt/Windows.Security.Authentication.Identity.h

.js

Compiler/include/winrt/Windows.Security.Authentication.OnlineId.h

.js

Compiler/include/winrt/Windows.Security.Authentication.Web.Core.h

.js

Compiler/include/winrt/Windows.Security.Authentication.Web.Provider.h

.js

Compiler/include/winrt/Windows.Security.Authentication.Web.h

.js

Compiler/include/winrt/Windows.Security.Authorization.AppCapabilityAccess.h

.js

Compiler/include/winrt/Windows.Security.Credentials.UI.h

.js

Compiler/include/winrt/Windows.Security.Credentials.h

.js

Compiler/include/winrt/Windows.Security.Cryptography.Certificates.h

Compiler/include/winrt/Windows.Security.Cryptography.Core.h

Compiler/include/winrt/Windows.Security.Cryptography.DataProtection.h

.js

Compiler/include/winrt/Windows.Security.Cryptography.h

.js

Compiler/include/winrt/Windows.Security.DataProtection.h

.js

Compiler/include/winrt/Windows.Security.EnterpriseData.h

.js

Compiler/include/winrt/Windows.Security.ExchangeActiveSyncProvisioning.h

.js

Compiler/include/winrt/Windows.Security.Isolation.h

.js

Compiler/include/winrt/Windows.Services.Cortana.h

.js

Compiler/include/winrt/Windows.Services.Maps.Guidance.h

.js

Compiler/include/winrt/Windows.Services.Maps.LocalSearch.h

.js

Compiler/include/winrt/Windows.Services.Maps.OfflineMaps.h

.js

Compiler/include/winrt/Windows.Services.Maps.h

.js

Compiler/include/winrt/Windows.Services.Store.h

Compiler/include/winrt/Windows.Services.TargetedContent.h

.js

Compiler/include/winrt/Windows.Storage.AccessCache.h

.js

Compiler/include/winrt/Windows.Storage.BulkAccess.h

.js

Compiler/include/winrt/Windows.Storage.Compression.h

.js

Compiler/include/winrt/Windows.Storage.FileProperties.h

.js

Compiler/include/winrt/Windows.Storage.Pickers.Provider.h

.js

Compiler/include/winrt/Windows.Storage.Pickers.h

.js

Compiler/include/winrt/Windows.Storage.Provider.h

.js

Compiler/include/winrt/Windows.Storage.Search.h

.js

Compiler/include/winrt/Windows.Storage.Streams.h

.js

Compiler/include/winrt/Windows.Storage.h

Compiler/include/winrt/Windows.System.Diagnostics.DevicePortal.h

.js

Compiler/include/winrt/Windows.System.Diagnostics.Telemetry.h

.js

Compiler/include/winrt/Windows.System.Diagnostics.TraceReporting.h

.js

Compiler/include/winrt/Windows.System.Diagnostics.h

.js

Compiler/include/winrt/Windows.System.Display.h

.js

Compiler/include/winrt/Windows.System.Implementation.FileExplorer.h

.js

Compiler/include/winrt/Windows.System.Inventory.h

.js

Compiler/include/winrt/Windows.System.Power.Diagnostics.h

.js

Compiler/include/winrt/Windows.System.Power.h

.js

Compiler/include/winrt/Windows.System.Preview.h

.js

Compiler/include/winrt/Windows.System.Profile.SystemManufacturers.h

.js

Compiler/include/winrt/Windows.System.Profile.h

.js

Compiler/include/winrt/Windows.System.RemoteDesktop.Input.h

.js

Compiler/include/winrt/Windows.System.RemoteDesktop.Provider.h

.js

Compiler/include/winrt/Windows.System.RemoteDesktop.h

.js

Compiler/include/winrt/Windows.System.RemoteSystems.h

Compiler/include/winrt/Windows.System.Threading.Core.h

.js

Compiler/include/winrt/Windows.System.Threading.h

.js

Compiler/include/winrt/Windows.System.Update.h

.js

Compiler/include/winrt/Windows.System.UserProfile.h

.js

Compiler/include/winrt/Windows.System.h

Compiler/include/winrt/Windows.UI.Accessibility.h

.js

Compiler/include/winrt/Windows.UI.ApplicationSettings.h

.js

Compiler/include/winrt/Windows.UI.Composition.Core.h

.js

Compiler/include/winrt/Windows.UI.Composition.Desktop.h

.js

Compiler/include/winrt/Windows.UI.Composition.Diagnostics.h

.js

Compiler/include/winrt/Windows.UI.Composition.Effects.h

.js

Compiler/include/winrt/Windows.UI.Composition.Interactions.h

.js

Compiler/include/winrt/Windows.UI.Composition.Scenes.h

.js

Compiler/include/winrt/Windows.UI.Composition.h

Compiler/include/winrt/Windows.UI.Core.AnimationMetrics.h

.js

Compiler/include/winrt/Windows.UI.Core.Preview.h

.js

Compiler/include/winrt/Windows.UI.Core.h

Compiler/include/winrt/Windows.UI.Input.Core.h

.js

Compiler/include/winrt/Windows.UI.Input.Inking.Analysis.h

.js

Compiler/include/winrt/Windows.UI.Input.Inking.Core.h

.js

Compiler/include/winrt/Windows.UI.Input.Inking.Preview.h

.js

Compiler/include/winrt/Windows.UI.Input.Inking.h

Compiler/include/winrt/Windows.UI.Input.Preview.Injection.h

.js

Compiler/include/winrt/Windows.UI.Input.Preview.h

.js

Compiler/include/winrt/Windows.UI.Input.Spatial.h

Compiler/include/winrt/Windows.UI.Input.h

Compiler/include/winrt/Windows.UI.Notifications.Management.h

.js

Compiler/include/winrt/Windows.UI.Notifications.Preview.h

.js

Compiler/include/winrt/Windows.UI.Notifications.h

Compiler/include/winrt/Windows.UI.Popups.h

.js

Compiler/include/winrt/Windows.UI.Shell.h

.js

Compiler/include/winrt/Windows.UI.StartScreen.h

.js

Compiler/include/winrt/Windows.UI.Text.Core.h

.js

Compiler/include/winrt/Windows.UI.Text.h

Compiler/include/winrt/Windows.UI.UIAutomation.Core.h

.js

Compiler/include/winrt/Windows.UI.UIAutomation.h

.js

Compiler/include/winrt/Windows.UI.ViewManagement.Core.h

.js

Compiler/include/winrt/Windows.UI.ViewManagement.h

Compiler/include/winrt/Windows.UI.WebUI.h

.js

Compiler/include/winrt/Windows.UI.WindowManagement.Preview.h

.js

Compiler/include/winrt/Windows.UI.WindowManagement.h

.js

Compiler/include/winrt/Windows.UI.Xaml.Automation.Peers.h

Compiler/include/winrt/Windows.UI.Xaml.Automation.Provider.h

.js

Compiler/include/winrt/Windows.UI.Xaml.Automation.Text.h

Compiler/include/winrt/Windows.UI.Xaml.Automation.h

Compiler/include/winrt/Windows.UI.Xaml.Controls.Maps.h

Compiler/include/winrt/Windows.UI.Xaml.Controls.Primitives.h

Compiler/include/winrt/Windows.UI.Xaml.Controls.h

Compiler/include/winrt/Windows.UI.Xaml.Core.Direct.h

.js

Compiler/include/winrt/Windows.UI.Xaml.Data.h

.js

Compiler/include/winrt/Windows.UI.Xaml.Documents.h

Compiler/include/winrt/Windows.UI.Xaml.Hosting.h

.js

Compiler/include/winrt/Windows.UI.Xaml.Input.h

Compiler/include/winrt/Windows.UI.Xaml.Interop.h

.js

Compiler/include/winrt/Windows.UI.Xaml.Markup.h

.js

Compiler/include/winrt/Windows.UI.Xaml.Media.Animation.h

Compiler/include/winrt/Windows.UI.Xaml.Media.Imaging.h

.js

Compiler/include/winrt/Windows.UI.Xaml.Media.Media3D.h

.js

Compiler/include/winrt/Windows.UI.Xaml.Media.h

Compiler/include/winrt/Windows.UI.Xaml.Navigation.h

.js

Compiler/include/winrt/Windows.UI.Xaml.Printing.h

.js

Compiler/include/winrt/Windows.UI.Xaml.Resources.h

.js

Compiler/include/winrt/Windows.UI.Xaml.Shapes.h

.js

Compiler/include/winrt/Windows.UI.Xaml.h

Compiler/include/winrt/Windows.UI.h

.js

Compiler/include/winrt/Windows.Web.AtomPub.h

.js

Compiler/include/winrt/Windows.Web.Http.Diagnostics.h

.js

Compiler/include/winrt/Windows.Web.Http.Filters.h

.js

Compiler/include/winrt/Windows.Web.Http.Headers.h

Compiler/include/winrt/Windows.Web.Http.h

.js

Compiler/include/winrt/Windows.Web.Syndication.h

.js

Compiler/include/winrt/Windows.Web.UI.Interop.h

.js

Compiler/include/winrt/Windows.Web.UI.h

.js

Compiler/include/winrt/Windows.Web.h

.js

Compiler/include/winrt/base.h

Compiler/include/winrt/impl/Windows.AI.MachineLearning.0.h

Compiler/include/winrt/impl/Windows.AI.MachineLearning.1.h

Compiler/include/winrt/impl/Windows.AI.MachineLearning.2.h

Compiler/include/winrt/impl/Windows.AI.MachineLearning.Preview.0.h

Compiler/include/winrt/impl/Windows.AI.MachineLearning.Preview.1.h

Compiler/include/winrt/impl/Windows.AI.MachineLearning.Preview.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Activation.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Activation.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Activation.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.AppExtensions.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.AppExtensions.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.AppExtensions.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.AppService.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.AppService.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.AppService.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Appointments.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Appointments.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Appointments.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Appointments.AppointmentsProvider.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Appointments.AppointmentsProvider.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Appointments.AppointmentsProvider.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Appointments.DataProvider.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Appointments.DataProvider.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Appointments.DataProvider.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Background.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Background.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Background.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Calls.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Calls.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Calls.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Calls.Background.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Calls.Background.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Calls.Background.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Calls.Provider.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Calls.Provider.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Calls.Provider.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Chat.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Chat.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Chat.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.CommunicationBlocking.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.CommunicationBlocking.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.CommunicationBlocking.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Contacts.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Contacts.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Contacts.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Contacts.DataProvider.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Contacts.DataProvider.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Contacts.DataProvider.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Contacts.Provider.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Contacts.Provider.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Contacts.Provider.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.ConversationalAgent.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.ConversationalAgent.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.ConversationalAgent.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Core.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Core.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Core.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.DataTransfer.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.DataTransfer.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.DataTransfer.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.DataTransfer.DragDrop.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.DataTransfer.DragDrop.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.DataTransfer.DragDrop.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.DataTransfer.DragDrop.Core.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.DataTransfer.DragDrop.Core.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.DataTransfer.DragDrop.Core.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.DataTransfer.ShareTarget.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.DataTransfer.ShareTarget.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.DataTransfer.ShareTarget.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Email.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Email.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Email.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Email.DataProvider.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Email.DataProvider.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Email.DataProvider.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.ExtendedExecution.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.ExtendedExecution.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.ExtendedExecution.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.ExtendedExecution.Foreground.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.ExtendedExecution.Foreground.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.ExtendedExecution.Foreground.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Holographic.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Holographic.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Holographic.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.LockScreen.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.LockScreen.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.LockScreen.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Payments.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Payments.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Payments.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Payments.Provider.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Payments.Provider.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Payments.Provider.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Preview.Holographic.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Preview.Holographic.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Preview.Holographic.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Preview.InkWorkspace.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Preview.InkWorkspace.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Preview.InkWorkspace.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Preview.Notes.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Preview.Notes.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Preview.Notes.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Resources.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Resources.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Resources.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Resources.Core.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Resources.Core.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Resources.Core.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Resources.Management.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Resources.Management.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Resources.Management.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Search.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Search.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Search.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Search.Core.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Search.Core.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Search.Core.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.SocialInfo.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.SocialInfo.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.SocialInfo.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.SocialInfo.Provider.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.SocialInfo.Provider.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.SocialInfo.Provider.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Store.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Store.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Store.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Store.LicenseManagement.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Store.LicenseManagement.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Store.LicenseManagement.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Store.Preview.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Store.Preview.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Store.Preview.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Store.Preview.InstallControl.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Store.Preview.InstallControl.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Store.Preview.InstallControl.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.UserActivities.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.UserActivities.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.UserActivities.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.UserActivities.Core.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.UserActivities.Core.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.UserActivities.Core.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.UserDataAccounts.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.UserDataAccounts.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.UserDataAccounts.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.UserDataAccounts.Provider.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.UserDataAccounts.Provider.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.UserDataAccounts.Provider.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.UserDataAccounts.SystemAccess.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.UserDataAccounts.SystemAccess.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.UserDataAccounts.SystemAccess.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.UserDataTasks.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.UserDataTasks.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.UserDataTasks.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.UserDataTasks.DataProvider.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.UserDataTasks.DataProvider.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.UserDataTasks.DataProvider.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.VoiceCommands.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.VoiceCommands.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.VoiceCommands.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Wallet.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Wallet.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Wallet.2.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Wallet.System.0.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Wallet.System.1.h

Compiler/include/winrt/impl/Windows.ApplicationModel.Wallet.System.2.h

Compiler/include/winrt/impl/Windows.Data.Html.0.h

Compiler/include/winrt/impl/Windows.Data.Html.1.h

Compiler/include/winrt/impl/Windows.Data.Html.2.h

Compiler/include/winrt/impl/Windows.Data.Json.0.h

Compiler/include/winrt/impl/Windows.Data.Json.1.h

Compiler/include/winrt/impl/Windows.Data.Json.2.h

Compiler/include/winrt/impl/Windows.Data.Pdf.0.h

Compiler/include/winrt/impl/Windows.Data.Pdf.1.h

Compiler/include/winrt/impl/Windows.Data.Pdf.2.h

Compiler/include/winrt/impl/Windows.Data.Text.0.h

Compiler/include/winrt/impl/Windows.Data.Text.1.h

Compiler/include/winrt/impl/Windows.Data.Text.2.h

Compiler/include/winrt/impl/Windows.Data.Xml.Dom.0.h

Compiler/include/winrt/impl/Windows.Data.Xml.Dom.1.h

Compiler/include/winrt/impl/Windows.Data.Xml.Dom.2.h

Compiler/include/winrt/impl/Windows.Data.Xml.Xsl.0.h

Compiler/include/winrt/impl/Windows.Data.Xml.Xsl.1.h

Compiler/include/winrt/impl/Windows.Data.Xml.Xsl.2.h

Compiler/include/winrt/impl/Windows.Devices.0.h

Compiler/include/winrt/impl/Windows.Devices.1.h

Compiler/include/winrt/impl/Windows.Devices.2.h

Compiler/include/winrt/impl/Windows.Devices.Adc.0.h

Compiler/include/winrt/impl/Windows.Devices.Adc.1.h

Compiler/include/winrt/impl/Windows.Devices.Adc.2.h

Compiler/include/winrt/impl/Windows.Devices.Adc.Provider.0.h

Compiler/include/winrt/impl/Windows.Devices.Adc.Provider.1.h

Compiler/include/winrt/impl/Windows.Devices.Adc.Provider.2.h

Compiler/include/winrt/impl/Windows.Devices.AllJoyn.0.h

Compiler/include/winrt/impl/Windows.Devices.AllJoyn.1.h

Compiler/include/winrt/impl/Windows.Devices.AllJoyn.2.h

Compiler/include/winrt/impl/Windows.Devices.Background.0.h

Compiler/include/winrt/impl/Windows.Devices.Background.1.h

Compiler/include/winrt/impl/Windows.Devices.Background.2.h

Compiler/include/winrt/impl/Windows.Devices.Bluetooth.0.h

Compiler/include/winrt/impl/Windows.Devices.Bluetooth.1.h

Compiler/include/winrt/impl/Windows.Devices.Bluetooth.2.h

Compiler/include/winrt/impl/Windows.Devices.Bluetooth.Advertisement.0.h

Compiler/include/winrt/impl/Windows.Devices.Bluetooth.Advertisement.1.h

Compiler/include/winrt/impl/Windows.Devices.Bluetooth.Advertisement.2.h

Compiler/include/winrt/impl/Windows.Devices.Bluetooth.Background.0.h

Compiler/include/winrt/impl/Windows.Devices.Bluetooth.Background.1.h

Compiler/include/winrt/impl/Windows.Devices.Bluetooth.Background.2.h

Compiler/include/winrt/impl/Windows.Devices.Bluetooth.GenericAttributeProfile.0.h

Compiler/include/winrt/impl/Windows.Devices.Bluetooth.GenericAttributeProfile.1.h

Compiler/include/winrt/impl/Windows.Devices.Bluetooth.GenericAttributeProfile.2.h

Compiler/include/winrt/impl/Windows.Devices.Bluetooth.Rfcomm.0.h

Compiler/include/winrt/impl/Windows.Devices.Bluetooth.Rfcomm.1.h

Compiler/include/winrt/impl/Windows.Devices.Bluetooth.Rfcomm.2.h

Compiler/include/winrt/impl/Windows.Devices.Custom.0.h

Compiler/include/winrt/impl/Windows.Devices.Custom.1.h

Compiler/include/winrt/impl/Windows.Devices.Custom.2.h

Compiler/include/winrt/impl/Windows.Devices.Display.0.h

Compiler/include/winrt/impl/Windows.Devices.Display.1.h

Compiler/include/winrt/impl/Windows.Devices.Display.2.h

Compiler/include/winrt/impl/Windows.Devices.Display.Core.0.h

Compiler/include/winrt/impl/Windows.Devices.Display.Core.1.h

Compiler/include/winrt/impl/Windows.Devices.Display.Core.2.h

Compiler/include/winrt/impl/Windows.Devices.Enumeration.0.h

Compiler/include/winrt/impl/Windows.Devices.Enumeration.1.h

Compiler/include/winrt/impl/Windows.Devices.Enumeration.2.h

Compiler/include/winrt/impl/Windows.Devices.Enumeration.Pnp.0.h

Compiler/include/winrt/impl/Windows.Devices.Enumeration.Pnp.1.h

Compiler/include/winrt/impl/Windows.Devices.Enumeration.Pnp.2.h

Compiler/include/winrt/impl/Windows.Devices.Geolocation.0.h

Compiler/include/winrt/impl/Windows.Devices.Geolocation.1.h

Compiler/include/winrt/impl/Windows.Devices.Geolocation.2.h

Compiler/include/winrt/impl/Windows.Devices.Geolocation.Geofencing.0.h

Compiler/include/winrt/impl/Windows.Devices.Geolocation.Geofencing.1.h

Compiler/include/winrt/impl/Windows.Devices.Geolocation.Geofencing.2.h

Compiler/include/winrt/impl/Windows.Devices.Geolocation.Provider.0.h

Compiler/include/winrt/impl/Windows.Devices.Geolocation.Provider.1.h

Compiler/include/winrt/impl/Windows.Devices.Geolocation.Provider.2.h

Compiler/include/winrt/impl/Windows.Devices.Gpio.0.h

Compiler/include/winrt/impl/Windows.Devices.Gpio.1.h

Compiler/include/winrt/impl/Windows.Devices.Gpio.2.h

Compiler/include/winrt/impl/Windows.Devices.Gpio.Provider.0.h

Compiler/include/winrt/impl/Windows.Devices.Gpio.Provider.1.h

Compiler/include/winrt/impl/Windows.Devices.Gpio.Provider.2.h

Compiler/include/winrt/impl/Windows.Devices.Haptics.0.h

Compiler/include/winrt/impl/Windows.Devices.Haptics.1.h

Compiler/include/winrt/impl/Windows.Devices.Haptics.2.h

Compiler/include/winrt/impl/Windows.Devices.HumanInterfaceDevice.0.h

Compiler/include/winrt/impl/Windows.Devices.HumanInterfaceDevice.1.h

Compiler/include/winrt/impl/Windows.Devices.HumanInterfaceDevice.2.h

Compiler/include/winrt/impl/Windows.Devices.I2c.0.h

Compiler/include/winrt/impl/Windows.Devices.I2c.1.h

Compiler/include/winrt/impl/Windows.Devices.I2c.2.h

Compiler/include/winrt/impl/Windows.Devices.I2c.Provider.0.h

Compiler/include/winrt/impl/Windows.Devices.I2c.Provider.1.h

Compiler/include/winrt/impl/Windows.Devices.I2c.Provider.2.h

Compiler/include/winrt/impl/Windows.Devices.Input.0.h

Compiler/include/winrt/impl/Windows.Devices.Input.1.h

Compiler/include/winrt/impl/Windows.Devices.Input.2.h

Compiler/include/winrt/impl/Windows.Devices.Input.Preview.0.h

Compiler/include/winrt/impl/Windows.Devices.Input.Preview.1.h

Compiler/include/winrt/impl/Windows.Devices.Input.Preview.2.h

Compiler/include/winrt/impl/Windows.Devices.Lights.0.h

Compiler/include/winrt/impl/Windows.Devices.Lights.1.h

Compiler/include/winrt/impl/Windows.Devices.Lights.2.h

Compiler/include/winrt/impl/Windows.Devices.Lights.Effects.0.h

Compiler/include/winrt/impl/Windows.Devices.Lights.Effects.1.h

Compiler/include/winrt/impl/Windows.Devices.Lights.Effects.2.h

Compiler/include/winrt/impl/Windows.Devices.Midi.0.h

Compiler/include/winrt/impl/Windows.Devices.Midi.1.h

Compiler/include/winrt/impl/Windows.Devices.Midi.2.h

Compiler/include/winrt/impl/Windows.Devices.Perception.0.h

Compiler/include/winrt/impl/Windows.Devices.Perception.1.h

Compiler/include/winrt/impl/Windows.Devices.Perception.2.h

Compiler/include/winrt/impl/Windows.Devices.Perception.Provider.0.h

Compiler/include/winrt/impl/Windows.Devices.Perception.Provider.1.h

Compiler/include/winrt/impl/Windows.Devices.Perception.Provider.2.h

Compiler/include/winrt/impl/Windows.Devices.PointOfService.0.h

Compiler/include/winrt/impl/Windows.Devices.PointOfService.1.h

Compiler/include/winrt/impl/Windows.Devices.PointOfService.2.h

Compiler/include/winrt/impl/Windows.Devices.PointOfService.Provider.0.h

Compiler/include/winrt/impl/Windows.Devices.PointOfService.Provider.1.h

Compiler/include/winrt/impl/Windows.Devices.PointOfService.Provider.2.h

Compiler/include/winrt/impl/Windows.Devices.Portable.0.h

Compiler/include/winrt/impl/Windows.Devices.Portable.1.h

Compiler/include/winrt/impl/Windows.Devices.Portable.2.h

Compiler/include/winrt/impl/Windows.Devices.Power.0.h

Compiler/include/winrt/impl/Windows.Devices.Power.1.h

Compiler/include/winrt/impl/Windows.Devices.Power.2.h

Compiler/include/winrt/impl/Windows.Devices.Printers.0.h

Compiler/include/winrt/impl/Windows.Devices.Printers.1.h

Compiler/include/winrt/impl/Windows.Devices.Printers.2.h

Compiler/include/winrt/impl/Windows.Devices.Printers.Extensions.0.h

Compiler/include/winrt/impl/Windows.Devices.Printers.Extensions.1.h

Compiler/include/winrt/impl/Windows.Devices.Printers.Extensions.2.h

Compiler/include/winrt/impl/Windows.Devices.Pwm.0.h

Compiler/include/winrt/impl/Windows.Devices.Pwm.1.h

Compiler/include/winrt/impl/Windows.Devices.Pwm.2.h

Compiler/include/winrt/impl/Windows.Devices.Pwm.Provider.0.h

Compiler/include/winrt/impl/Windows.Devices.Pwm.Provider.1.h

Compiler/include/winrt/impl/Windows.Devices.Pwm.Provider.2.h

Compiler/include/winrt/impl/Windows.Devices.Radios.0.h

Compiler/include/winrt/impl/Windows.Devices.Radios.1.h

Compiler/include/winrt/impl/Windows.Devices.Radios.2.h

Compiler/include/winrt/impl/Windows.Devices.Scanners.0.h

Compiler/include/winrt/impl/Windows.Devices.Scanners.1.h

Compiler/include/winrt/impl/Windows.Devices.Scanners.2.h

Compiler/include/winrt/impl/Windows.Devices.Sensors.0.h

Compiler/include/winrt/impl/Windows.Devices.Sensors.1.h

Compiler/include/winrt/impl/Windows.Devices.Sensors.2.h

Compiler/include/winrt/impl/Windows.Devices.Sensors.Custom.0.h

Compiler/include/winrt/impl/Windows.Devices.Sensors.Custom.1.h

Compiler/include/winrt/impl/Windows.Devices.Sensors.Custom.2.h

Compiler/include/winrt/impl/Windows.Devices.SerialCommunication.0.h

Compiler/include/winrt/impl/Windows.Devices.SerialCommunication.1.h

Compiler/include/winrt/impl/Windows.Devices.SerialCommunication.2.h

Compiler/include/winrt/impl/Windows.Devices.SmartCards.0.h

Compiler/include/winrt/impl/Windows.Devices.SmartCards.1.h

Compiler/include/winrt/impl/Windows.Devices.SmartCards.2.h

Compiler/include/winrt/impl/Windows.Devices.Sms.0.h

Compiler/include/winrt/impl/Windows.Devices.Sms.1.h

Compiler/include/winrt/impl/Windows.Devices.Sms.2.h

Compiler/include/winrt/impl/Windows.Devices.Spi.0.h

Compiler/include/winrt/impl/Windows.Devices.Spi.1.h

Compiler/include/winrt/impl/Windows.Devices.Spi.2.h

Compiler/include/winrt/impl/Windows.Devices.Spi.Provider.0.h

Compiler/include/winrt/impl/Windows.Devices.Spi.Provider.1.h

Compiler/include/winrt/impl/Windows.Devices.Spi.Provider.2.h

Compiler/include/winrt/impl/Windows.Devices.Usb.0.h

Compiler/include/winrt/impl/Windows.Devices.Usb.1.h

Compiler/include/winrt/impl/Windows.Devices.Usb.2.h

Compiler/include/winrt/impl/Windows.Devices.WiFi.0.h

Compiler/include/winrt/impl/Windows.Devices.WiFi.1.h

Compiler/include/winrt/impl/Windows.Devices.WiFi.2.h

Compiler/include/winrt/impl/Windows.Devices.WiFiDirect.0.h

Compiler/include/winrt/impl/Windows.Devices.WiFiDirect.1.h

Compiler/include/winrt/impl/Windows.Devices.WiFiDirect.2.h

Compiler/include/winrt/impl/Windows.Devices.WiFiDirect.Services.0.h

Compiler/include/winrt/impl/Windows.Devices.WiFiDirect.Services.1.h

Compiler/include/winrt/impl/Windows.Devices.WiFiDirect.Services.2.h

Compiler/include/winrt/impl/Windows.Foundation.0.h

Compiler/include/winrt/impl/Windows.Foundation.1.h

Compiler/include/winrt/impl/Windows.Foundation.2.h

Compiler/include/winrt/impl/Windows.Foundation.Collections.0.h

Compiler/include/winrt/impl/Windows.Foundation.Collections.1.h

Compiler/include/winrt/impl/Windows.Foundation.Collections.2.h

Compiler/include/winrt/impl/Windows.Foundation.Diagnostics.0.h

Compiler/include/winrt/impl/Windows.Foundation.Diagnostics.1.h

Compiler/include/winrt/impl/Windows.Foundation.Diagnostics.2.h

Compiler/include/winrt/impl/Windows.Foundation.Metadata.0.h

Compiler/include/winrt/impl/Windows.Foundation.Metadata.1.h

Compiler/include/winrt/impl/Windows.Foundation.Metadata.2.h

Compiler/include/winrt/impl/Windows.Foundation.Numerics.0.h

Compiler/include/winrt/impl/Windows.Foundation.Numerics.1.h

Compiler/include/winrt/impl/Windows.Foundation.Numerics.2.h

Compiler/include/winrt/impl/Windows.Gaming.Input.0.h

Compiler/include/winrt/impl/Windows.Gaming.Input.1.h

Compiler/include/winrt/impl/Windows.Gaming.Input.2.h

Compiler/include/winrt/impl/Windows.Gaming.Input.Custom.0.h

Compiler/include/winrt/impl/Windows.Gaming.Input.Custom.1.h

Compiler/include/winrt/impl/Windows.Gaming.Input.Custom.2.h

Compiler/include/winrt/impl/Windows.Gaming.Input.ForceFeedback.0.h

Compiler/include/winrt/impl/Windows.Gaming.Input.ForceFeedback.1.h

Compiler/include/winrt/impl/Windows.Gaming.Input.ForceFeedback.2.h

Compiler/include/winrt/impl/Windows.Gaming.Input.Preview.0.h

Compiler/include/winrt/impl/Windows.Gaming.Input.Preview.1.h

Compiler/include/winrt/impl/Windows.Gaming.Input.Preview.2.h

Compiler/include/winrt/impl/Windows.Gaming.Preview.GamesEnumeration.0.h

Compiler/include/winrt/impl/Windows.Gaming.Preview.GamesEnumeration.1.h

Compiler/include/winrt/impl/Windows.Gaming.Preview.GamesEnumeration.2.h

Compiler/include/winrt/impl/Windows.Gaming.UI.0.h

Compiler/include/winrt/impl/Windows.Gaming.UI.1.h

Compiler/include/winrt/impl/Windows.Gaming.UI.2.h

Compiler/include/winrt/impl/Windows.Gaming.XboxLive.Storage.0.h

Compiler/include/winrt/impl/Windows.Gaming.XboxLive.Storage.1.h

Compiler/include/winrt/impl/Windows.Gaming.XboxLive.Storage.2.h

Compiler/include/winrt/impl/Windows.Globalization.0.h

Compiler/include/winrt/impl/Windows.Globalization.1.h

Compiler/include/winrt/impl/Windows.Globalization.2.h

Compiler/include/winrt/impl/Windows.Globalization.Collation.0.h

Compiler/include/winrt/impl/Windows.Globalization.Collation.1.h

Compiler/include/winrt/impl/Windows.Globalization.Collation.2.h

Compiler/include/winrt/impl/Windows.Globalization.DateTimeFormatting.0.h

Compiler/include/winrt/impl/Windows.Globalization.DateTimeFormatting.1.h

Compiler/include/winrt/impl/Windows.Globalization.DateTimeFormatting.2.h

Compiler/include/winrt/impl/Windows.Globalization.Fonts.0.h

Compiler/include/winrt/impl/Windows.Globalization.Fonts.1.h

Compiler/include/winrt/impl/Windows.Globalization.Fonts.2.h

Compiler/include/winrt/impl/Windows.Globalization.NumberFormatting.0.h

Compiler/include/winrt/impl/Windows.Globalization.NumberFormatting.1.h

Compiler/include/winrt/impl/Windows.Globalization.NumberFormatting.2.h

Compiler/include/winrt/impl/Windows.Globalization.PhoneNumberFormatting.0.h

Compiler/include/winrt/impl/Windows.Globalization.PhoneNumberFormatting.1.h

Compiler/include/winrt/impl/Windows.Globalization.PhoneNumberFormatting.2.h

Compiler/include/winrt/impl/Windows.Graphics.0.h

Compiler/include/winrt/impl/Windows.Graphics.1.h

Compiler/include/winrt/impl/Windows.Graphics.2.h

Compiler/include/winrt/impl/Windows.Graphics.Capture.0.h

Compiler/include/winrt/impl/Windows.Graphics.Capture.1.h

Compiler/include/winrt/impl/Windows.Graphics.Capture.2.h

Compiler/include/winrt/impl/Windows.Graphics.DirectX.0.h

Compiler/include/winrt/impl/Windows.Graphics.DirectX.1.h

Compiler/include/winrt/impl/Windows.Graphics.DirectX.2.h

Compiler/include/winrt/impl/Windows.Graphics.DirectX.Direct3D11.0.h

Compiler/include/winrt/impl/Windows.Graphics.DirectX.Direct3D11.1.h

Compiler/include/winrt/impl/Windows.Graphics.DirectX.Direct3D11.2.h

Compiler/include/winrt/impl/Windows.Graphics.Display.0.h

Compiler/include/winrt/impl/Windows.Graphics.Display.1.h

Compiler/include/winrt/impl/Windows.Graphics.Display.2.h

Compiler/include/winrt/impl/Windows.Graphics.Display.Core.0.h

Compiler/include/winrt/impl/Windows.Graphics.Display.Core.1.h

Compiler/include/winrt/impl/Windows.Graphics.Display.Core.2.h

Compiler/include/winrt/impl/Windows.Graphics.Effects.0.h

Compiler/include/winrt/impl/Windows.Graphics.Effects.1.h

Compiler/include/winrt/impl/Windows.Graphics.Effects.2.h

Compiler/include/winrt/impl/Windows.Graphics.Holographic.0.h

Compiler/include/winrt/impl/Windows.Graphics.Holographic.1.h

Compiler/include/winrt/impl/Windows.Graphics.Holographic.2.h

Compiler/include/winrt/impl/Windows.Graphics.Imaging.0.h

Compiler/include/winrt/impl/Windows.Graphics.Imaging.1.h

Compiler/include/winrt/impl/Windows.Graphics.Imaging.2.h

Compiler/include/winrt/impl/Windows.Graphics.Printing.0.h

Compiler/include/winrt/impl/Windows.Graphics.Printing.1.h

Compiler/include/winrt/impl/Windows.Graphics.Printing.2.h

Compiler/include/winrt/impl/Windows.Graphics.Printing.OptionDetails.0.h

Compiler/include/winrt/impl/Windows.Graphics.Printing.OptionDetails.1.h

Compiler/include/winrt/impl/Windows.Graphics.Printing.OptionDetails.2.h

Compiler/include/winrt/impl/Windows.Graphics.Printing.PrintSupport.0.h

Compiler/include/winrt/impl/Windows.Graphics.Printing.PrintSupport.1.h

Compiler/include/winrt/impl/Windows.Graphics.Printing.PrintSupport.2.h

Compiler/include/winrt/impl/Windows.Graphics.Printing.PrintTicket.0.h

Compiler/include/winrt/impl/Windows.Graphics.Printing.PrintTicket.1.h

Compiler/include/winrt/impl/Windows.Graphics.Printing.PrintTicket.2.h

Compiler/include/winrt/impl/Windows.Graphics.Printing.Workflow.0.h

Compiler/include/winrt/impl/Windows.Graphics.Printing.Workflow.1.h

Compiler/include/winrt/impl/Windows.Graphics.Printing.Workflow.2.h

Compiler/include/winrt/impl/Windows.Graphics.Printing3D.0.h

Compiler/include/winrt/impl/Windows.Graphics.Printing3D.1.h

Compiler/include/winrt/impl/Windows.Graphics.Printing3D.2.h

Compiler/include/winrt/impl/Windows.Management.0.h

Compiler/include/winrt/impl/Windows.Management.1.h

Compiler/include/winrt/impl/Windows.Management.2.h

Compiler/include/winrt/impl/Windows.Management.Core.0.h

Compiler/include/winrt/impl/Windows.Management.Core.1.h

Compiler/include/winrt/impl/Windows.Management.Core.2.h

Compiler/include/winrt/impl/Windows.Management.Deployment.0.h

Compiler/include/winrt/impl/Windows.Management.Deployment.1.h

Compiler/include/winrt/impl/Windows.Management.Deployment.2.h

Compiler/include/winrt/impl/Windows.Management.Deployment.Preview.0.h

Compiler/include/winrt/impl/Windows.Management.Deployment.Preview.1.h

Compiler/include/winrt/impl/Windows.Management.Deployment.Preview.2.h

Compiler/include/winrt/impl/Windows.Management.Policies.0.h

Compiler/include/winrt/impl/Windows.Management.Policies.1.h

Compiler/include/winrt/impl/Windows.Management.Policies.2.h

Compiler/include/winrt/impl/Windows.Management.Setup.0.h

Compiler/include/winrt/impl/Windows.Management.Setup.1.h

Compiler/include/winrt/impl/Windows.Management.Setup.2.h

Compiler/include/winrt/impl/Windows.Management.Update.0.h

Compiler/include/winrt/impl/Windows.Management.Update.1.h

Compiler/include/winrt/impl/Windows.Management.Update.2.h

Compiler/include/winrt/impl/Windows.Management.Workplace.0.h

Compiler/include/winrt/impl/Windows.Management.Workplace.1.h

Compiler/include/winrt/impl/Windows.Management.Workplace.2.h

Compiler/include/winrt/impl/Windows.Media.0.h

Compiler/include/winrt/impl/Windows.Media.1.h

Compiler/include/winrt/impl/Windows.Media.2.h

Compiler/include/winrt/impl/Windows.Media.AppBroadcasting.0.h

Compiler/include/winrt/impl/Windows.Media.AppBroadcasting.1.h

Compiler/include/winrt/impl/Windows.Media.AppBroadcasting.2.h

Compiler/include/winrt/impl/Windows.Media.AppRecording.0.h

Compiler/include/winrt/impl/Windows.Media.AppRecording.1.h

Compiler/include/winrt/impl/Windows.Media.AppRecording.2.h

Compiler/include/winrt/impl/Windows.Media.Audio.0.h

Compiler/include/winrt/impl/Windows.Media.Audio.1.h

Compiler/include/winrt/impl/Windows.Media.Audio.2.h

Compiler/include/winrt/impl/Windows.Media.Capture.0.h

Compiler/include/winrt/impl/Windows.Media.Capture.1.h

Compiler/include/winrt/impl/Windows.Media.Capture.2.h

Compiler/include/winrt/impl/Windows.Media.Capture.Core.0.h

Compiler/include/winrt/impl/Windows.Media.Capture.Core.1.h

Compiler/include/winrt/impl/Windows.Media.Capture.Core.2.h

Compiler/include/winrt/impl/Windows.Media.Capture.Frames.0.h

Compiler/include/winrt/impl/Windows.Media.Capture.Frames.1.h

Compiler/include/winrt/impl/Windows.Media.Capture.Frames.2.h

Compiler/include/winrt/impl/Windows.Media.Casting.0.h

Compiler/include/winrt/impl/Windows.Media.Casting.1.h

Compiler/include/winrt/impl/Windows.Media.Casting.2.h

Compiler/include/winrt/impl/Windows.Media.ClosedCaptioning.0.h

Compiler/include/winrt/impl/Windows.Media.ClosedCaptioning.1.h

Compiler/include/winrt/impl/Windows.Media.ClosedCaptioning.2.h

Compiler/include/winrt/impl/Windows.Media.ContentRestrictions.0.h

Compiler/include/winrt/impl/Windows.Media.ContentRestrictions.1.h

Compiler/include/winrt/impl/Windows.Media.ContentRestrictions.2.h

Compiler/include/winrt/impl/Windows.Media.Control.0.h

Compiler/include/winrt/impl/Windows.Media.Control.1.h

Compiler/include/winrt/impl/Windows.Media.Control.2.h

Compiler/include/winrt/impl/Windows.Media.Core.0.h

Compiler/include/winrt/impl/Windows.Media.Core.1.h

Compiler/include/winrt/impl/Windows.Media.Core.2.h

Compiler/include/winrt/impl/Windows.Media.Core.Preview.0.h

Compiler/include/winrt/impl/Windows.Media.Core.Preview.1.h

Compiler/include/winrt/impl/Windows.Media.Core.Preview.2.h

Compiler/include/winrt/impl/Windows.Media.Devices.0.h

Compiler/include/winrt/impl/Windows.Media.Devices.1.h

Compiler/include/winrt/impl/Windows.Media.Devices.2.h

Compiler/include/winrt/impl/Windows.Media.Devices.Core.0.h

Compiler/include/winrt/impl/Windows.Media.Devices.Core.1.h

Compiler/include/winrt/impl/Windows.Media.Devices.Core.2.h

Compiler/include/winrt/impl/Windows.Media.DialProtocol.0.h

Compiler/include/winrt/impl/Windows.Media.DialProtocol.1.h

Compiler/include/winrt/impl/Windows.Media.DialProtocol.2.h

Compiler/include/winrt/impl/Windows.Media.Editing.0.h

Compiler/include/winrt/impl/Windows.Media.Editing.1.h

Compiler/include/winrt/impl/Windows.Media.Editing.2.h

Compiler/include/winrt/impl/Windows.Media.Effects.0.h

Compiler/include/winrt/impl/Windows.Media.Effects.1.h

Compiler/include/winrt/impl/Windows.Media.Effects.2.h

Compiler/include/winrt/impl/Windows.Media.FaceAnalysis.0.h

Compiler/include/winrt/impl/Windows.Media.FaceAnalysis.1.h

Compiler/include/winrt/impl/Windows.Media.FaceAnalysis.2.h

Compiler/include/winrt/impl/Windows.Media.Import.0.h

Compiler/include/winrt/impl/Windows.Media.Import.1.h

Compiler/include/winrt/impl/Windows.Media.Import.2.h

Compiler/include/winrt/impl/Windows.Media.MediaProperties.0.h

Compiler/include/winrt/impl/Windows.Media.MediaProperties.1.h

Compiler/include/winrt/impl/Windows.Media.MediaProperties.2.h

Compiler/include/winrt/impl/Windows.Media.Miracast.0.h

Compiler/include/winrt/impl/Windows.Media.Miracast.1.h

Compiler/include/winrt/impl/Windows.Media.Miracast.2.h

Compiler/include/winrt/impl/Windows.Media.Ocr.0.h

Compiler/include/winrt/impl/Windows.Media.Ocr.1.h

Compiler/include/winrt/impl/Windows.Media.Ocr.2.h

Compiler/include/winrt/impl/Windows.Media.PlayTo.0.h

Compiler/include/winrt/impl/Windows.Media.PlayTo.1.h

Compiler/include/winrt/impl/Windows.Media.PlayTo.2.h

Compiler/include/winrt/impl/Windows.Media.Playback.0.h

Compiler/include/winrt/impl/Windows.Media.Playback.1.h

Compiler/include/winrt/impl/Windows.Media.Playback.2.h

Compiler/include/winrt/impl/Windows.Media.Playlists.0.h

Compiler/include/winrt/impl/Windows.Media.Playlists.1.h

Compiler/include/winrt/impl/Windows.Media.Playlists.2.h

Compiler/include/winrt/impl/Windows.Media.Protection.0.h

Compiler/include/winrt/impl/Windows.Media.Protection.1.h

Compiler/include/winrt/impl/Windows.Media.Protection.2.h

Compiler/include/winrt/impl/Windows.Media.Protection.PlayReady.0.h

Compiler/include/winrt/impl/Windows.Media.Protection.PlayReady.1.h

Compiler/include/winrt/impl/Windows.Media.Protection.PlayReady.2.h

Compiler/include/winrt/impl/Windows.Media.Render.0.h

Compiler/include/winrt/impl/Windows.Media.Render.1.h

Compiler/include/winrt/impl/Windows.Media.Render.2.h

Compiler/include/winrt/impl/Windows.Media.SpeechRecognition.0.h

Compiler/include/winrt/impl/Windows.Media.SpeechRecognition.1.h

Compiler/include/winrt/impl/Windows.Media.SpeechRecognition.2.h

Compiler/include/winrt/impl/Windows.Media.SpeechSynthesis.0.h

Compiler/include/winrt/impl/Windows.Media.SpeechSynthesis.1.h

Compiler/include/winrt/impl/Windows.Media.SpeechSynthesis.2.h

Compiler/include/winrt/impl/Windows.Media.Streaming.Adaptive.0.h

Compiler/include/winrt/impl/Windows.Media.Streaming.Adaptive.1.h

Compiler/include/winrt/impl/Windows.Media.Streaming.Adaptive.2.h

Compiler/include/winrt/impl/Windows.Media.Transcoding.0.h

Compiler/include/winrt/impl/Windows.Media.Transcoding.1.h

Compiler/include/winrt/impl/Windows.Media.Transcoding.2.h

Compiler/include/winrt/impl/Windows.Networking.0.h

Compiler/include/winrt/impl/Windows.Networking.1.h

Compiler/include/winrt/impl/Windows.Networking.2.h

Compiler/include/winrt/impl/Windows.Networking.BackgroundTransfer.0.h

Compiler/include/winrt/impl/Windows.Networking.BackgroundTransfer.1.h

Compiler/include/winrt/impl/Windows.Networking.BackgroundTransfer.2.h

Compiler/include/winrt/impl/Windows.Networking.Connectivity.0.h

Compiler/include/winrt/impl/Windows.Networking.Connectivity.1.h

Compiler/include/winrt/impl/Windows.Networking.Connectivity.2.h

Compiler/include/winrt/impl/Windows.Networking.NetworkOperators.0.h

Compiler/include/winrt/impl/Windows.Networking.NetworkOperators.1.h

Compiler/include/winrt/impl/Windows.Networking.NetworkOperators.2.h

Compiler/include/winrt/impl/Windows.Networking.Proximity.0.h

Compiler/include/winrt/impl/Windows.Networking.Proximity.1.h

Compiler/include/winrt/impl/Windows.Networking.Proximity.2.h

Compiler/include/winrt/impl/Windows.Networking.PushNotifications.0.h

Compiler/include/winrt/impl/Windows.Networking.PushNotifications.1.h

Compiler/include/winrt/impl/Windows.Networking.PushNotifications.2.h

Compiler/include/winrt/impl/Windows.Networking.ServiceDiscovery.Dnssd.0.h

Compiler/include/winrt/impl/Windows.Networking.ServiceDiscovery.Dnssd.1.h

Compiler/include/winrt/impl/Windows.Networking.ServiceDiscovery.Dnssd.2.h

Compiler/include/winrt/impl/Windows.Networking.Sockets.0.h

Compiler/include/winrt/impl/Windows.Networking.Sockets.1.h

Compiler/include/winrt/impl/Windows.Networking.Sockets.2.h

Compiler/include/winrt/impl/Windows.Networking.Vpn.0.h

Compiler/include/winrt/impl/Windows.Networking.Vpn.1.h

Compiler/include/winrt/impl/Windows.Networking.Vpn.2.h

Compiler/include/winrt/impl/Windows.Networking.XboxLive.0.h

Compiler/include/winrt/impl/Windows.Networking.XboxLive.1.h

Compiler/include/winrt/impl/Windows.Networking.XboxLive.2.h

Compiler/include/winrt/impl/Windows.Perception.0.h

Compiler/include/winrt/impl/Windows.Perception.1.h

Compiler/include/winrt/impl/Windows.Perception.2.h

Compiler/include/winrt/impl/Windows.Perception.Automation.Core.0.h

Compiler/include/winrt/impl/Windows.Perception.Automation.Core.1.h

Compiler/include/winrt/impl/Windows.Perception.Automation.Core.2.h

Compiler/include/winrt/impl/Windows.Perception.People.0.h

Compiler/include/winrt/impl/Windows.Perception.People.1.h

Compiler/include/winrt/impl/Windows.Perception.People.2.h

Compiler/include/winrt/impl/Windows.Perception.Spatial.0.h

Compiler/include/winrt/impl/Windows.Perception.Spatial.1.h

Compiler/include/winrt/impl/Windows.Perception.Spatial.2.h

Compiler/include/winrt/impl/Windows.Perception.Spatial.Preview.0.h

Compiler/include/winrt/impl/Windows.Perception.Spatial.Preview.1.h

Compiler/include/winrt/impl/Windows.Perception.Spatial.Preview.2.h

Compiler/include/winrt/impl/Windows.Perception.Spatial.Surfaces.0.h

Compiler/include/winrt/impl/Windows.Perception.Spatial.Surfaces.1.h

Compiler/include/winrt/impl/Windows.Perception.Spatial.Surfaces.2.h

Compiler/include/winrt/impl/Windows.Security.Authentication.Identity.0.h

Compiler/include/winrt/impl/Windows.Security.Authentication.Identity.1.h

Compiler/include/winrt/impl/Windows.Security.Authentication.Identity.2.h

Compiler/include/winrt/impl/Windows.Security.Authentication.Identity.Core.0.h

Compiler/include/winrt/impl/Windows.Security.Authentication.Identity.Core.1.h

Compiler/include/winrt/impl/Windows.Security.Authentication.Identity.Core.2.h

Compiler/include/winrt/impl/Windows.Security.Authentication.Identity.Provider.0.h

Compiler/include/winrt/impl/Windows.Security.Authentication.Identity.Provider.1.h

Compiler/include/winrt/impl/Windows.Security.Authentication.Identity.Provider.2.h

Compiler/include/winrt/impl/Windows.Security.Authentication.OnlineId.0.h

Compiler/include/winrt/impl/Windows.Security.Authentication.OnlineId.1.h

Compiler/include/winrt/impl/Windows.Security.Authentication.OnlineId.2.h

Compiler/include/winrt/impl/Windows.Security.Authentication.Web.0.h

Compiler/include/winrt/impl/Windows.Security.Authentication.Web.1.h

Compiler/include/winrt/impl/Windows.Security.Authentication.Web.2.h

Compiler/include/winrt/impl/Windows.Security.Authentication.Web.Core.0.h

Compiler/include/winrt/impl/Windows.Security.Authentication.Web.Core.1.h

Compiler/include/winrt/impl/Windows.Security.Authentication.Web.Core.2.h

Compiler/include/winrt/impl/Windows.Security.Authentication.Web.Provider.0.h

Compiler/include/winrt/impl/Windows.Security.Authentication.Web.Provider.1.h

Compiler/include/winrt/impl/Windows.Security.Authentication.Web.Provider.2.h

Compiler/include/winrt/impl/Windows.Security.Authorization.AppCapabilityAccess.0.h

Compiler/include/winrt/impl/Windows.Security.Authorization.AppCapabilityAccess.1.h

Compiler/include/winrt/impl/Windows.Security.Authorization.AppCapabilityAccess.2.h

Compiler/include/winrt/impl/Windows.Security.Credentials.0.h

Compiler/include/winrt/impl/Windows.Security.Credentials.1.h

Compiler/include/winrt/impl/Windows.Security.Credentials.2.h

Compiler/include/winrt/impl/Windows.Security.Credentials.UI.0.h

Compiler/include/winrt/impl/Windows.Security.Credentials.UI.1.h

Compiler/include/winrt/impl/Windows.Security.Credentials.UI.2.h

Compiler/include/winrt/impl/Windows.Security.Cryptography.0.h

Compiler/include/winrt/impl/Windows.Security.Cryptography.1.h

Compiler/include/winrt/impl/Windows.Security.Cryptography.2.h

Compiler/include/winrt/impl/Windows.Security.Cryptography.Certificates.0.h

Compiler/include/winrt/impl/Windows.Security.Cryptography.Certificates.1.h

Compiler/include/winrt/impl/Windows.Security.Cryptography.Certificates.2.h

Compiler/include/winrt/impl/Windows.Security.Cryptography.Core.0.h

Compiler/include/winrt/impl/Windows.Security.Cryptography.Core.1.h

Compiler/include/winrt/impl/Windows.Security.Cryptography.Core.2.h

Compiler/include/winrt/impl/Windows.Security.Cryptography.DataProtection.0.h

Compiler/include/winrt/impl/Windows.Security.Cryptography.DataProtection.1.h

Compiler/include/winrt/impl/Windows.Security.Cryptography.DataProtection.2.h

Compiler/include/winrt/impl/Windows.Security.DataProtection.0.h

Compiler/include/winrt/impl/Windows.Security.DataProtection.1.h

Compiler/include/winrt/impl/Windows.Security.DataProtection.2.h

Compiler/include/winrt/impl/Windows.Security.EnterpriseData.0.h

Compiler/include/winrt/impl/Windows.Security.EnterpriseData.1.h

Compiler/include/winrt/impl/Windows.Security.EnterpriseData.2.h

Compiler/include/winrt/impl/Windows.Security.ExchangeActiveSyncProvisioning.0.h

Compiler/include/winrt/impl/Windows.Security.ExchangeActiveSyncProvisioning.1.h

Compiler/include/winrt/impl/Windows.Security.ExchangeActiveSyncProvisioning.2.h

Compiler/include/winrt/impl/Windows.Security.Isolation.0.h

Compiler/include/winrt/impl/Windows.Security.Isolation.1.h

Compiler/include/winrt/impl/Windows.Security.Isolation.2.h

Compiler/include/winrt/impl/Windows.Services.Cortana.0.h

Compiler/include/winrt/impl/Windows.Services.Cortana.1.h

Compiler/include/winrt/impl/Windows.Services.Cortana.2.h

Compiler/include/winrt/impl/Windows.Services.Maps.0.h

Compiler/include/winrt/impl/Windows.Services.Maps.1.h

Compiler/include/winrt/impl/Windows.Services.Maps.2.h

Compiler/include/winrt/impl/Windows.Services.Maps.Guidance.0.h

Compiler/include/winrt/impl/Windows.Services.Maps.Guidance.1.h

Compiler/include/winrt/impl/Windows.Services.Maps.Guidance.2.h

Compiler/include/winrt/impl/Windows.Services.Maps.LocalSearch.0.h

Compiler/include/winrt/impl/Windows.Services.Maps.LocalSearch.1.h

Compiler/include/winrt/impl/Windows.Services.Maps.LocalSearch.2.h

Compiler/include/winrt/impl/Windows.Services.Maps.OfflineMaps.0.h

Compiler/include/winrt/impl/Windows.Services.Maps.OfflineMaps.1.h

Compiler/include/winrt/impl/Windows.Services.Maps.OfflineMaps.2.h

Compiler/include/winrt/impl/Windows.Services.Store.0.h

Compiler/include/winrt/impl/Windows.Services.Store.1.h

Compiler/include/winrt/impl/Windows.Services.Store.2.h

Compiler/include/winrt/impl/Windows.Services.TargetedContent.0.h

Compiler/include/winrt/impl/Windows.Services.TargetedContent.1.h

Compiler/include/winrt/impl/Windows.Services.TargetedContent.2.h

Compiler/include/winrt/impl/Windows.Storage.0.h

Compiler/include/winrt/impl/Windows.Storage.1.h

Compiler/include/winrt/impl/Windows.Storage.2.h

Compiler/include/winrt/impl/Windows.Storage.AccessCache.0.h

Compiler/include/winrt/impl/Windows.Storage.AccessCache.1.h

Compiler/include/winrt/impl/Windows.Storage.AccessCache.2.h

Compiler/include/winrt/impl/Windows.Storage.BulkAccess.0.h

Compiler/include/winrt/impl/Windows.Storage.BulkAccess.1.h

Compiler/include/winrt/impl/Windows.Storage.BulkAccess.2.h

Compiler/include/winrt/impl/Windows.Storage.Compression.0.h

Compiler/include/winrt/impl/Windows.Storage.Compression.1.h

Compiler/include/winrt/impl/Windows.Storage.Compression.2.h

Compiler/include/winrt/impl/Windows.Storage.FileProperties.0.h

Compiler/include/winrt/impl/Windows.Storage.FileProperties.1.h

Compiler/include/winrt/impl/Windows.Storage.FileProperties.2.h

Compiler/include/winrt/impl/Windows.Storage.Pickers.0.h

Compiler/include/winrt/impl/Windows.Storage.Pickers.1.h

Compiler/include/winrt/impl/Windows.Storage.Pickers.2.h

Compiler/include/winrt/impl/Windows.Storage.Pickers.Provider.0.h

Compiler/include/winrt/impl/Windows.Storage.Pickers.Provider.1.h

Compiler/include/winrt/impl/Windows.Storage.Pickers.Provider.2.h

Compiler/include/winrt/impl/Windows.Storage.Provider.0.h

Compiler/include/winrt/impl/Windows.Storage.Provider.1.h

Compiler/include/winrt/impl/Windows.Storage.Provider.2.h

Compiler/include/winrt/impl/Windows.Storage.Search.0.h

Compiler/include/winrt/impl/Windows.Storage.Search.1.h

Compiler/include/winrt/impl/Windows.Storage.Search.2.h

Compiler/include/winrt/impl/Windows.Storage.Streams.0.h

Compiler/include/winrt/impl/Windows.Storage.Streams.1.h

Compiler/include/winrt/impl/Windows.Storage.Streams.2.h

Compiler/include/winrt/impl/Windows.System.0.h

Compiler/include/winrt/impl/Windows.System.1.h

Compiler/include/winrt/impl/Windows.System.2.h

Compiler/include/winrt/impl/Windows.System.Diagnostics.0.h

Compiler/include/winrt/impl/Windows.System.Diagnostics.1.h

Compiler/include/winrt/impl/Windows.System.Diagnostics.2.h

Compiler/include/winrt/impl/Windows.System.Diagnostics.DevicePortal.0.h

Compiler/include/winrt/impl/Windows.System.Diagnostics.DevicePortal.1.h

Compiler/include/winrt/impl/Windows.System.Diagnostics.DevicePortal.2.h

Compiler/include/winrt/impl/Windows.System.Diagnostics.Telemetry.0.h

Compiler/include/winrt/impl/Windows.System.Diagnostics.Telemetry.1.h

Compiler/include/winrt/impl/Windows.System.Diagnostics.Telemetry.2.h

Compiler/include/winrt/impl/Windows.System.Diagnostics.TraceReporting.0.h

Compiler/include/winrt/impl/Windows.System.Diagnostics.TraceReporting.1.h

Compiler/include/winrt/impl/Windows.System.Diagnostics.TraceReporting.2.h

Compiler/include/winrt/impl/Windows.System.Display.0.h

Compiler/include/winrt/impl/Windows.System.Display.1.h

Compiler/include/winrt/impl/Windows.System.Display.2.h

Compiler/include/winrt/impl/Windows.System.Implementation.FileExplorer.0.h

Compiler/include/winrt/impl/Windows.System.Implementation.FileExplorer.1.h

Compiler/include/winrt/impl/Windows.System.Implementation.FileExplorer.2.h

Compiler/include/winrt/impl/Windows.System.Inventory.0.h

Compiler/include/winrt/impl/Windows.System.Inventory.1.h

Compiler/include/winrt/impl/Windows.System.Inventory.2.h

Compiler/include/winrt/impl/Windows.System.Power.0.h

Compiler/include/winrt/impl/Windows.System.Power.1.h

Compiler/include/winrt/impl/Windows.System.Power.2.h

Compiler/include/winrt/impl/Windows.System.Power.Diagnostics.0.h

Compiler/include/winrt/impl/Windows.System.Power.Diagnostics.1.h

Compiler/include/winrt/impl/Windows.System.Power.Diagnostics.2.h

Compiler/include/winrt/impl/Windows.System.Preview.0.h

Compiler/include/winrt/impl/Windows.System.Preview.1.h

Compiler/include/winrt/impl/Windows.System.Preview.2.h

Compiler/include/winrt/impl/Windows.System.Profile.0.h

Compiler/include/winrt/impl/Windows.System.Profile.1.h

Compiler/include/winrt/impl/Windows.System.Profile.2.h

Compiler/include/winrt/impl/Windows.System.Profile.SystemManufacturers.0.h

Compiler/include/winrt/impl/Windows.System.Profile.SystemManufacturers.1.h

Compiler/include/winrt/impl/Windows.System.Profile.SystemManufacturers.2.h

Compiler/include/winrt/impl/Windows.System.RemoteDesktop.0.h

Compiler/include/winrt/impl/Windows.System.RemoteDesktop.1.h

Compiler/include/winrt/impl/Windows.System.RemoteDesktop.2.h

Compiler/include/winrt/impl/Windows.System.RemoteDesktop.Input.0.h

Compiler/include/winrt/impl/Windows.System.RemoteDesktop.Input.1.h

Compiler/include/winrt/impl/Windows.System.RemoteDesktop.Input.2.h

Compiler/include/winrt/impl/Windows.System.RemoteDesktop.Provider.0.h

Compiler/include/winrt/impl/Windows.System.RemoteDesktop.Provider.1.h

Compiler/include/winrt/impl/Windows.System.RemoteDesktop.Provider.2.h

Compiler/include/winrt/impl/Windows.System.RemoteSystems.0.h

Compiler/include/winrt/impl/Windows.System.RemoteSystems.1.h

Compiler/include/winrt/impl/Windows.System.RemoteSystems.2.h

Compiler/include/winrt/impl/Windows.System.Threading.0.h

Compiler/include/winrt/impl/Windows.System.Threading.1.h

Compiler/include/winrt/impl/Windows.System.Threading.2.h

Compiler/include/winrt/impl/Windows.System.Threading.Core.0.h

Compiler/include/winrt/impl/Windows.System.Threading.Core.1.h

Compiler/include/winrt/impl/Windows.System.Threading.Core.2.h

Compiler/include/winrt/impl/Windows.System.Update.0.h

Compiler/include/winrt/impl/Windows.System.Update.1.h

Compiler/include/winrt/impl/Windows.System.Update.2.h

Compiler/include/winrt/impl/Windows.System.UserProfile.0.h

Compiler/include/winrt/impl/Windows.System.UserProfile.1.h

Compiler/include/winrt/impl/Windows.System.UserProfile.2.h

Compiler/include/winrt/impl/Windows.UI.0.h

Compiler/include/winrt/impl/Windows.UI.1.h

Compiler/include/winrt/impl/Windows.UI.2.h

Compiler/include/winrt/impl/Windows.UI.Accessibility.0.h

Compiler/include/winrt/impl/Windows.UI.Accessibility.1.h

Compiler/include/winrt/impl/Windows.UI.Accessibility.2.h

Compiler/include/winrt/impl/Windows.UI.ApplicationSettings.0.h

Compiler/include/winrt/impl/Windows.UI.ApplicationSettings.1.h

Compiler/include/winrt/impl/Windows.UI.ApplicationSettings.2.h

Compiler/include/winrt/impl/Windows.UI.Composition.0.h

Compiler/include/winrt/impl/Windows.UI.Composition.1.h

Compiler/include/winrt/impl/Windows.UI.Composition.2.h

Compiler/include/winrt/impl/Windows.UI.Composition.Core.0.h

Compiler/include/winrt/impl/Windows.UI.Composition.Core.1.h

Compiler/include/winrt/impl/Windows.UI.Composition.Core.2.h

Compiler/include/winrt/impl/Windows.UI.Composition.Desktop.0.h

Compiler/include/winrt/impl/Windows.UI.Composition.Desktop.1.h

Compiler/include/winrt/impl/Windows.UI.Composition.Desktop.2.h

Compiler/include/winrt/impl/Windows.UI.Composition.Diagnostics.0.h

Compiler/include/winrt/impl/Windows.UI.Composition.Diagnostics.1.h

Compiler/include/winrt/impl/Windows.UI.Composition.Diagnostics.2.h

Compiler/include/winrt/impl/Windows.UI.Composition.Effects.0.h

Compiler/include/winrt/impl/Windows.UI.Composition.Effects.1.h

Compiler/include/winrt/impl/Windows.UI.Composition.Effects.2.h

Compiler/include/winrt/impl/Windows.UI.Composition.Interactions.0.h

Compiler/include/winrt/impl/Windows.UI.Composition.Interactions.1.h

Compiler/include/winrt/impl/Windows.UI.Composition.Interactions.2.h

Compiler/include/winrt/impl/Windows.UI.Composition.Scenes.0.h

Compiler/include/winrt/impl/Windows.UI.Composition.Scenes.1.h

Compiler/include/winrt/impl/Windows.UI.Composition.Scenes.2.h

Compiler/include/winrt/impl/Windows.UI.Core.0.h

Compiler/include/winrt/impl/Windows.UI.Core.1.h

Compiler/include/winrt/impl/Windows.UI.Core.2.h

Compiler/include/winrt/impl/Windows.UI.Core.AnimationMetrics.0.h

Compiler/include/winrt/impl/Windows.UI.Core.AnimationMetrics.1.h

Compiler/include/winrt/impl/Windows.UI.Core.AnimationMetrics.2.h

Compiler/include/winrt/impl/Windows.UI.Core.Preview.0.h

Compiler/include/winrt/impl/Windows.UI.Core.Preview.1.h

Compiler/include/winrt/impl/Windows.UI.Core.Preview.2.h

Compiler/include/winrt/impl/Windows.UI.Input.0.h

Compiler/include/winrt/impl/Windows.UI.Input.1.h

Compiler/include/winrt/impl/Windows.UI.Input.2.h

Compiler/include/winrt/impl/Windows.UI.Input.Core.0.h

Compiler/include/winrt/impl/Windows.UI.Input.Core.1.h

Compiler/include/winrt/impl/Windows.UI.Input.Core.2.h

Compiler/include/winrt/impl/Windows.UI.Input.Inking.0.h

Compiler/include/winrt/impl/Windows.UI.Input.Inking.1.h

Compiler/include/winrt/impl/Windows.UI.Input.Inking.2.h

Compiler/include/winrt/impl/Windows.UI.Input.Inking.Analysis.0.h

Compiler/include/winrt/impl/Windows.UI.Input.Inking.Analysis.1.h

Compiler/include/winrt/impl/Windows.UI.Input.Inking.Analysis.2.h

Compiler/include/winrt/impl/Windows.UI.Input.Inking.Core.0.h

Compiler/include/winrt/impl/Windows.UI.Input.Inking.Core.1.h

Compiler/include/winrt/impl/Windows.UI.Input.Inking.Core.2.h

Compiler/include/winrt/impl/Windows.UI.Input.Inking.Preview.0.h

Compiler/include/winrt/impl/Windows.UI.Input.Inking.Preview.1.h

Compiler/include/winrt/impl/Windows.UI.Input.Inking.Preview.2.h

Compiler/include/winrt/impl/Windows.UI.Input.Preview.0.h

Compiler/include/winrt/impl/Windows.UI.Input.Preview.1.h

Compiler/include/winrt/impl/Windows.UI.Input.Preview.2.h

Compiler/include/winrt/impl/Windows.UI.Input.Preview.Injection.0.h

Compiler/include/winrt/impl/Windows.UI.Input.Preview.Injection.1.h

Compiler/include/winrt/impl/Windows.UI.Input.Preview.Injection.2.h

Compiler/include/winrt/impl/Windows.UI.Input.Spatial.0.h

Compiler/include/winrt/impl/Windows.UI.Input.Spatial.1.h

Compiler/include/winrt/impl/Windows.UI.Input.Spatial.2.h

Compiler/include/winrt/impl/Windows.UI.Notifications.0.h

Compiler/include/winrt/impl/Windows.UI.Notifications.1.h

Compiler/include/winrt/impl/Windows.UI.Notifications.2.h

Compiler/include/winrt/impl/Windows.UI.Notifications.Management.0.h

Compiler/include/winrt/impl/Windows.UI.Notifications.Management.1.h

Compiler/include/winrt/impl/Windows.UI.Notifications.Management.2.h

Compiler/include/winrt/impl/Windows.UI.Notifications.Preview.0.h

Compiler/include/winrt/impl/Windows.UI.Notifications.Preview.1.h

Compiler/include/winrt/impl/Windows.UI.Notifications.Preview.2.h

Compiler/include/winrt/impl/Windows.UI.Popups.0.h

Compiler/include/winrt/impl/Windows.UI.Popups.1.h

Compiler/include/winrt/impl/Windows.UI.Popups.2.h

Compiler/include/winrt/impl/Windows.UI.Shell.0.h

Compiler/include/winrt/impl/Windows.UI.Shell.1.h

Compiler/include/winrt/impl/Windows.UI.Shell.2.h

Compiler/include/winrt/impl/Windows.UI.StartScreen.0.h

Compiler/include/winrt/impl/Windows.UI.StartScreen.1.h

Compiler/include/winrt/impl/Windows.UI.StartScreen.2.h

Compiler/include/winrt/impl/Windows.UI.Text.0.h

Compiler/include/winrt/impl/Windows.UI.Text.1.h

Compiler/include/winrt/impl/Windows.UI.Text.2.h

Compiler/include/winrt/impl/Windows.UI.Text.Core.0.h

Compiler/include/winrt/impl/Windows.UI.Text.Core.1.h

Compiler/include/winrt/impl/Windows.UI.Text.Core.2.h

Compiler/include/winrt/impl/Windows.UI.UIAutomation.0.h

Compiler/include/winrt/impl/Windows.UI.UIAutomation.1.h

Compiler/include/winrt/impl/Windows.UI.UIAutomation.2.h

Compiler/include/winrt/impl/Windows.UI.UIAutomation.Core.0.h

Compiler/include/winrt/impl/Windows.UI.UIAutomation.Core.1.h

Compiler/include/winrt/impl/Windows.UI.UIAutomation.Core.2.h

Compiler/include/winrt/impl/Windows.UI.ViewManagement.0.h

Compiler/include/winrt/impl/Windows.UI.ViewManagement.1.h

Compiler/include/winrt/impl/Windows.UI.ViewManagement.2.h

Compiler/include/winrt/impl/Windows.UI.ViewManagement.Core.0.h

Compiler/include/winrt/impl/Windows.UI.ViewManagement.Core.1.h

Compiler/include/winrt/impl/Windows.UI.ViewManagement.Core.2.h

Compiler/include/winrt/impl/Windows.UI.WebUI.0.h

Compiler/include/winrt/impl/Windows.UI.WebUI.1.h

Compiler/include/winrt/impl/Windows.UI.WebUI.2.h

Compiler/include/winrt/impl/Windows.UI.WindowManagement.0.h

Compiler/include/winrt/impl/Windows.UI.WindowManagement.1.h

Compiler/include/winrt/impl/Windows.UI.WindowManagement.2.h

Compiler/include/winrt/impl/Windows.UI.WindowManagement.Preview.0.h

Compiler/include/winrt/impl/Windows.UI.WindowManagement.Preview.1.h

Compiler/include/winrt/impl/Windows.UI.WindowManagement.Preview.2.h

Compiler/include/winrt/impl/Windows.UI.Xaml.0.h

Compiler/include/winrt/impl/Windows.UI.Xaml.1.h

Compiler/include/winrt/impl/Windows.UI.Xaml.2.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Automation.0.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Automation.1.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Automation.2.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Automation.Peers.0.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Automation.Peers.1.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Automation.Peers.2.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Automation.Provider.0.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Automation.Provider.1.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Automation.Provider.2.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Automation.Text.0.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Automation.Text.1.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Automation.Text.2.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Controls.0.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Controls.1.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Controls.2.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Controls.Maps.0.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Controls.Maps.1.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Controls.Maps.2.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Controls.Primitives.0.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Controls.Primitives.1.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Controls.Primitives.2.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Core.Direct.0.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Core.Direct.1.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Core.Direct.2.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Data.0.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Data.1.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Data.2.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Documents.0.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Documents.1.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Documents.2.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Hosting.0.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Hosting.1.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Hosting.2.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Input.0.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Input.1.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Input.2.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Interop.0.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Interop.1.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Interop.2.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Markup.0.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Markup.1.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Markup.2.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Media.0.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Media.1.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Media.2.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Media.Animation.0.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Media.Animation.1.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Media.Animation.2.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Media.Imaging.0.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Media.Imaging.1.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Media.Imaging.2.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Media.Media3D.0.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Media.Media3D.1.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Media.Media3D.2.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Navigation.0.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Navigation.1.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Navigation.2.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Printing.0.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Printing.1.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Printing.2.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Resources.0.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Resources.1.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Resources.2.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Shapes.0.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Shapes.1.h

Compiler/include/winrt/impl/Windows.UI.Xaml.Shapes.2.h

Compiler/include/winrt/impl/Windows.Web.0.h

Compiler/include/winrt/impl/Windows.Web.1.h

Compiler/include/winrt/impl/Windows.Web.2.h

Compiler/include/winrt/impl/Windows.Web.AtomPub.0.h

Compiler/include/winrt/impl/Windows.Web.AtomPub.1.h

Compiler/include/winrt/impl/Windows.Web.AtomPub.2.h

Compiler/include/winrt/impl/Windows.Web.Http.0.h

Compiler/include/winrt/impl/Windows.Web.Http.1.h

Compiler/include/winrt/impl/Windows.Web.Http.2.h

Compiler/include/winrt/impl/Windows.Web.Http.Diagnostics.0.h

Compiler/include/winrt/impl/Windows.Web.Http.Diagnostics.1.h

Compiler/include/winrt/impl/Windows.Web.Http.Diagnostics.2.h

Compiler/include/winrt/impl/Windows.Web.Http.Filters.0.h

Compiler/include/winrt/impl/Windows.Web.Http.Filters.1.h

Compiler/include/winrt/impl/Windows.Web.Http.Filters.2.h

Compiler/include/winrt/impl/Windows.Web.Http.Headers.0.h

Compiler/include/winrt/impl/Windows.Web.Http.Headers.1.h

Compiler/include/winrt/impl/Windows.Web.Http.Headers.2.h

Compiler/include/winrt/impl/Windows.Web.Syndication.0.h

Compiler/include/winrt/impl/Windows.Web.Syndication.1.h

Compiler/include/winrt/impl/Windows.Web.Syndication.2.h

Compiler/include/winrt/impl/Windows.Web.UI.0.h

Compiler/include/winrt/impl/Windows.Web.UI.1.h

Compiler/include/winrt/impl/Windows.Web.UI.2.h

Compiler/include/winrt/impl/Windows.Web.UI.Interop.0.h

Compiler/include/winrt/impl/Windows.Web.UI.Interop.1.h

Compiler/include/winrt/impl/Windows.Web.UI.Interop.2.h

Compiler/include/winrt/winrt.ixx

Compiler/x86_64-w64-mingw32/bin/windhawk-mod-shim.dll

.dll windows:6 windows x64 arch:x64

b2cde532f9f14e59304f1d028d981c5d

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

cb:bf:3d:73:b5:02:21:79:28:5f:ba:16:9d:66:f0:30
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

26-07-2022 00:00

Not After

25-07-2024 23:59

Subject

CN=Michael Maltsev,O=Michael Maltsev,ST=HaMerkaz,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

cb:bf:3d:73:b5:02:21:79:28:5f:ba:16:9d:66:f0:30
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

26-07-2022 00:00

Not After

25-07-2024 23:59

Subject

CN=Michael Maltsev,O=Michael Maltsev,ST=HaMerkaz,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

cd:48:44:64:87:38:c0:bd:43:20:6b:65:a9:f2:7d:89:95:0e:37:6b:bf:b4:9f:3a:92:e1:ed:b3:85:60:08:14
Signer

Actual PE Digest

cd:48:44:64:87:38:c0:bd:43:20:6b:65:a9:f2:7d:89:95:0e:37:6b:bf:b4:9f:3a:92:e1:ed:b3:85:60:08:14

Digest Algorithm

sha256

PE Digest Matches

true

2d:0f:fc:f7:51:8b:4c:54:7c:c0:a7:58:97:25:b2:e4:d8:65:7d:2a
Signer

Actual PE Digest

2d:0f:fc:f7:51:8b:4c:54:7c:c0:a7:58:97:25:b2:e4:d8:65:7d:2a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

PDB Paths

Imports

windhawk

InternalWh_HookSymbols

libc++

_ZNSt11logic_errorC2EPKc

_ZNSt12length_errorD1Ev

_ZNSt20bad_array_new_lengthC1Ev

_ZNSt20bad_array_new_lengthD1Ev

_ZTVN10__cxxabiv117__class_type_infoE

_ZTVN10__cxxabiv120__si_class_type_infoE

_ZTVSt12length_error

_ZdaPv

_ZdlPv

_Znay

_Znwy

__cxa_allocate_exception

__cxa_free_exception

__cxa_throw

__gxx_personality_seh0

libunwind

_Unwind_Resume

msvcrt

__iob_func

_amsg_exit

_initterm

_lock

_unlock

abort

calloc

free

fwrite

memcpy

memset

realloc

strlen

strncmp

vfprintf

kernel32

DeleteCriticalSection

EnterCriticalSection

GetLastError

GetModuleHandleExW

GetProcAddress

InitializeCriticalSection

LeaveCriticalSection

Sleep

TlsGetValue

VirtualProtect

VirtualQuery

Exports

_Z15CmwfHookSymbolsP11HINSTANCE__PK16CMWF_SYMBOL_HOOKy

_Z25GetCallerInternalWhModPtrPv

_ZN13WindhawkUtils11HookSymbolsEP11HINSTANCE__PKNS_17SYMBOL_HOOK_OLD_1Ey

_ZN13WindhawkUtils11HookSymbolsEP11HINSTANCE__PKNS_17SYMBOL_HOOK_OLD_2EyPKNS_29tagWH_FIND_SYMBOL_OPTIONS_OLDE

_ZNKSt3__16vectorIN13WindhawkUtils15SYMBOL_HOOK_NEWENS_9allocatorIS2_EEE20__throw_length_errorB6v15000Ev

_ZNSt12length_errorC2B6v15000EPKc

_ZNSt3__114__split_bufferIN13WindhawkUtils15SYMBOL_HOOK_NEWERNS_9allocatorIS2_EEED2Ev

_ZNSt3__120__throw_length_errorB6v15000EPKc

_ZNSt3__16vectorIN13WindhawkUtils15SYMBOL_HOOK_NEWENS_9allocatorIS2_EEE24__emplace_back_slow_pathIJRKNS0_INS_12basic_stringIwNS_11char_traitsIwEENS3_IwEEEENS3_ISB_EEEERKPPvRKSG_RKbEEEvDpOT_

_ZNSt3__16vectorIN13WindhawkUtils15SYMBOL_HOOK_NEWENS_9allocatorIS2_EEE24__emplace_back_slow_pathIJRKNS0_INS_17basic_string_viewIwNS_11char_traitsIwEEEENS3_ISA_EEEERKPPvRKSF_RKbEEEvDpOT_

_ZNSt3__16vectorIN13WindhawkUtils15SYMBOL_HOOK_NEWENS_9allocatorIS2_EEE7reserveEy

_ZNSt3__16vectorIN13WindhawkUtils15SYMBOL_HOOK_NEWENS_9allocatorIS2_EEED2B6v15000Ev

_ZSt28__throw_bad_array_new_lengthB6v15000v

_ZTISt11logic_error

_ZTISt12length_error

_ZTISt20bad_array_new_length

_ZTISt9bad_alloc

_ZTISt9exception

_ZTSSt11logic_error

_ZTSSt12length_error

_ZTSSt20bad_array_new_length

_ZTSSt9bad_alloc

_ZTSSt9exception

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.buildid
Size: 512B - Virtual size: 53B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 228B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 372B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/4
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/18
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/30
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/42
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/53
Size: 1024B - Virtual size: 720B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

/67
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

Engine/$R1/32/msdia140_windhawk.dll

.dll regsvr32 windows:6 windows x86 arch:x86

c93a45706d54086da5017dc5af2afbdb

Code Sign

33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12-05-2022 20:46

Not After

11-05-2023 20:46

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

05:9b:e5:96:77:ab:18:a2:33:25:fd:01:42:1b:b9:60:e0:54:4f:17:ec:30:18:6f:4c:3a:f4:78:be:1b:a0:a5
Signer

Actual PE Digest

05:9b:e5:96:77:ab:18:a2:33:25:fd:01:42:1b:b9:60:e0:54:4f:17:ec:30:18:6f:4c:3a:f4:78:be:1b:a0:a5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\s\binaries\x86ret\bin\i386\msdia140.pdb

Imports

kernel32

SetLastError

FindResourceExW

LoadResource

LockResource

SizeofResource

MultiByteToWideChar

LoadLibraryExW

GetProcAddress

LocalAlloc

LocalFree

GetModuleFileNameW

GetLastError

GetSystemInfo

InitializeCriticalSection

DeleteCriticalSection

CopyFileW

CreateDirectoryW

GetTempPathW

LCMapStringW

UnmapViewOfFile

CloseHandle

EnterCriticalSection

LeaveCriticalSection

CreateFileW

GetFileSize

CreateFileMappingW

MapViewOfFile

GetNativeSystemInfo

RaiseException

VirtualProtect

VirtualQuery

FreeLibrary

GetModuleHandleW

LoadLibraryExA

UnhandledExceptionFilter

SetUnhandledExceptionFilter

GetCurrentProcess

TerminateProcess

IsProcessorFeaturePresent

QueryPerformanceCounter

GetCurrentProcessId

GetCurrentThreadId

GetSystemTimeAsFileTime

InitializeSListHead

IsDebuggerPresent

GetStartupInfoW

RtlUnwind

InterlockedFlushSList

EncodePointer

InitializeCriticalSectionAndSpinCount

TlsAlloc

TlsGetValue

TlsSetValue

TlsFree

GetFullPathNameW

SetStdHandle

GetFileType

SetFilePointerEx

ReadFile

GetConsoleMode

ReadConsoleW

ExitProcess

GetModuleHandleExW

HeapFree

HeapAlloc

GetStdHandle

FlushFileBuffers

WriteFile

GetConsoleOutputCP

GetFileSizeEx

GetDriveTypeW

WideCharToMultiByte

CompareStringW

FindClose

FindFirstFileExW

FindNextFileW

IsValidCodePage

GetACP

GetOEMCP

GetCPInfo

GetCommandLineA

GetCommandLineW

GetEnvironmentStringsW

FreeEnvironmentStringsW

SetEnvironmentVariableW

GetProcessHeap

GetStringTypeW

GetCurrentDirectoryW

HeapSize

HeapReAlloc

WriteConsoleW

SetEndOfFile

DecodePointer

InitializeSRWLock

ReleaseSRWLockExclusive

AcquireSRWLockExclusive

TryAcquireSRWLockExclusive

InitializeCriticalSectionEx

CreateThreadpoolWork

SubmitThreadpoolWork

CloseThreadpoolWork

VirtualAlloc

VirtualFree

GetFileAttributesW

SetFileAttributesW

DeleteFileW

DeviceIoControl

MapViewOfFileEx

CreateFileMappingA

ReleaseSRWLockShared

AcquireSRWLockShared

ExpandEnvironmentStringsW

WaitForThreadpoolWorkCallbacks

ole32

StringFromGUID2

CoCreateGuid

shlwapi

PathFileExistsW

PathFindFileNameW

Exports

DllCanUnloadNow

DllGetClassObject

DllRegisterServer

DllUnregisterServer

VSDllRegisterServer

VSDllUnregisterServer

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

Engine/$R1/32/symsrv.yes

Engine/$R1/32/symsrv_windhawk.dll

.dll windows:10 windows x86 arch:x86

9c879a302e1ea2f7ff7a7efad15dcc8f

Code Sign

33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12-05-2022 20:46

Not After

11-05-2023 20:46

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

38:41:65:04:a8:90:b3:82:6a:8c:35:13:36:3a:ca:c0:92:be:14:49:ec:22:1f:d0:bf:43:fd:a2:ea:22:58:1d
Signer

Actual PE Digest

38:41:65:04:a8:90:b3:82:6a:8c:35:13:36:3a:ca:c0:92:be:14:49:ec:22:1f:d0:bf:43:fd:a2:ea:22:58:1d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

symsrv.pdb

Imports

msvcrt

__CxxFrameHandler3

_wcsdup

_callnewh

_stricmp

getenv

??0exception@@QAE@ABQBDH@Z

?what@exception@@UBEPBDXZ

swprintf_s

free

_vscwprintf

_vscprintf

_CxxThrowException

memcpy

memmove

_XcptFilter

_vsnwprintf_s

vswprintf_s

_amsg_exit

wcsstr

_wmakepath_s

_initterm

iswspace

swscanf_s

_wcsicmp

fgetws

_wcsnicmp

wcschr

_vsnprintf_s

??0exception@@QAE@ABV0@@Z

?terminate@@YAXXZ

_lock

??0exception@@QAE@XZ

_unlock

__dllonexit

_onexit

??1type_info@@UAE@XZ

??1exception@@UAE@XZ

_purecall

memcpy_s

calloc

wcsnlen

strnlen

_wtoi64

_wcslwr_s

wcsrchr

tolower

strcat_s

strpbrk

strstr

realloc

iswprint

strrchr

towlower

_vsnwprintf

_wfopen

fclose

wcscpy_s

_errno

??0exception@@QAE@ABQBD@Z

wcsncmp

wcscat_s

_except_handler4_common

_wcslwr

??3@YAXPAX@Z

isspace

_wcsupr

memset

wcsncpy_s

malloc

strcpy_s

memcmp

api-ms-win-core-libraryloader-l1-1-0

GetModuleHandleExW

FreeLibrary

LoadLibraryExW

GetProcAddress

LoadLibraryExA

GetModuleFileNameA

GetModuleHandleW

GetModuleFileNameW

api-ms-win-core-heap-l1-1-0

HeapFree

HeapAlloc

GetProcessHeap

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess

GetCurrentThreadId

OpenProcessToken

GetExitCodeThread

GetCurrentProcessId

TerminateProcess

CreateThread

api-ms-win-core-misc-l1-1-0

LocalAlloc

FormatMessageW

LocalFree

LocalReAlloc

GlobalFree

Sleep

api-ms-win-core-debug-l1-1-0

DebugBreak

OutputDebugStringW

IsDebuggerPresent

api-ms-win-security-base-l1-1-0

GetTokenInformation

AllocateAndInitializeSid

EqualSid

FreeSid

api-ms-win-core-file-l1-1-0

CreateFileW

GetFileAttributesExW

GetFileTime

CreateDirectoryW

WriteFile

GetFileSizeEx

GetFullPathNameW

GetFinalPathNameByHandleW

RemoveDirectoryW

DeleteFileW

GetFileAttributesW

GetDriveTypeW

GetFileSize

FileTimeToLocalFileTime

DeleteFileA

CreateFileA

LocalFileTimeToFileTime

GetFileInformationByHandle

SetFilePointer

SetFileTime

ReadFile

SetFilePointerEx

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter

UnhandledExceptionFilter

RaiseException

GetLastError

SetErrorMode

SetLastError

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW

ExpandEnvironmentStringsW

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW

GetVersionExW

GetSystemInfo

GetTickCount

GetSystemTimeAsFileTime

GetTickCount64

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

MultiByteToWideChar

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection

InitializeCriticalSection

AcquireSRWLockShared

EnterCriticalSection

WaitForSingleObject

ReleaseSemaphore

ReleaseSRWLockShared

OpenSemaphoreW

CreateMutexExW

CreateSemaphoreExW

CreateEventW

AcquireSRWLockExclusive

TryAcquireSRWLockExclusive

ReleaseMutex

SetEvent

ReleaseSRWLockExclusive

WaitForSingleObjectEx

OpenMutexW

SetWaitableTimer

DeleteCriticalSection

ResetEvent

InitializeCriticalSectionAndSpinCount

InitializeSRWLock

api-ms-win-core-handle-l1-1-0

CloseHandle

rpcrt4

UuidCreate

api-ms-win-core-localregistry-l1-1-0

RegEnumValueW

RegQueryValueExW

RegCloseKey

RegOpenKeyExW

ws2_32

WSAStartup

GetAddrInfoW

WSACleanup

FreeAddrInfoW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

oleaut32

SysFreeString

shlwapi

PathFindFileNameW

kernel32

WaitForMultipleObjects

IsProcessorFeaturePresent

CancelSynchronousIo

ntdll

RtlRunOnceExecuteOnce

RtlUTF8ToUnicodeN

crypt32

CryptStringToBinaryW

CryptBinaryToStringW

bcrypt

BCryptHashData

BCryptDestroyHash

BCryptCloseAlgorithmProvider

BCryptFinishHash

BCryptOpenAlgorithmProvider

BCryptGetProperty

BCryptCreateHash

api-ms-win-core-memory-l1-1-0

VirtualProtect

VirtualQuery

api-ms-win-core-threadpool-l1-1-0

CreateThreadpoolTimer

CloseThreadpoolTimer

WaitForThreadpoolTimerCallbacks

SetThreadpoolTimer

Exports

EulaDlgProc

RunDllEntry

SymbolServer

SymbolServerByIndex

SymbolServerByIndexAndChecksumsW

SymbolServerByIndexW

SymbolServerClose

SymbolServerDeltaName

SymbolServerDeltaNameW

SymbolServerGetIndexString

SymbolServerGetIndexStringW

SymbolServerGetOptionData

SymbolServerGetOptions

SymbolServerGetSupplement

SymbolServerGetSupplementW

SymbolServerGetVersion

SymbolServerIsStore

SymbolServerIsStoreW

SymbolServerPing

SymbolServerPingW

SymbolServerPingWEx

SymbolServerSetHttpAuthHeader

SymbolServerSetOptions

SymbolServerSetOptionsW

SymbolServerStoreFile

SymbolServerStoreFileW

SymbolServerStoreSupplement

SymbolServerStoreSupplementW

SymbolServerW

SymbolServerWEx

SymbolServerWithChecksumsW

httpCloseHandle

httpOpenFileHandle

httpOpenFileHandleW

httpQueryDataAvailable

httpReadFile

Sections

.text
Size: 240KB - Virtual size: 240KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 204KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.mrdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

Engine/$R1/32/windhawk.dll

.dll windows:6 windows x86 arch:x86

eafa7f610f9eb1216d6e25a664188026

Code Sign

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

16-04-2020 18:36

Not After

16-04-2045 18:44

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:01:47:a6:31:52:5c:23:53:35:c2:56:00:00:00:01:47:a6
Certificate

Issuer

CN=Microsoft ID Verified CS AOC CA 02,O=Microsoft Corporation,C=US

Not Before

28-07-2024 21:14

Not After

31-07-2024 21:14

Subject

CN=Michael Maltsev,O=Michael Maltsev,L=Rishon LeZion,ST=Central,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:01:47:a6:31:52:5c:23:53:35:c2:56:00:00:00:01:47:a6
Certificate

Issuer

CN=Microsoft ID Verified CS AOC CA 02,O=Microsoft Corporation,C=US

Not Before

28-07-2024 21:14

Not After

31-07-2024 21:14

Subject

CN=Michael Maltsev,O=Michael Maltsev,L=Rishon LeZion,ST=Central,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:00:00:04:96:50:4b:d2:db:ee:cb:88:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Not Before

13-04-2021 17:31

Not After

13-04-2026 17:31

Subject

CN=Microsoft ID Verified CS AOC CA 02,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

01-04-2021 20:05

Not After

01-04-2036 20:15

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

19-11-2020 20:32

Not After

19-11-2035 20:42

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:00:3f:04:1a:e9:7e:6d:27:fe:eb:00:00:00:00:00:3f
Certificate

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Not Before

18-04-2024 17:59

Not After

17-04-2025 17:59

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:F5D6-96D6-909E,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:8b:81:65:43:7d:3d:bb:75:85:4c:45:46:47:b5:37:48:5e:65:9d:3d:ce:8d:ff:e7:21:60:5e:0a:58:a0:c9
Signer

Actual PE Digest

16:8b:81:65:43:7d:3d:bb:75:85:4c:45:46:47:b5:37:48:5e:65:9d:3d:ce:8d:ff:e7:21:60:5e:0a:58:a0:c9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

Imports

winhttp

WinHttpOpen

WinHttpCloseHandle

WinHttpReadData

WinHttpQueryDataAvailable

WinHttpQueryHeaders

WinHttpReceiveResponse

WinHttpSendRequest

WinHttpOpenRequest

WinHttpConnect

WinHttpCrackUrl

kernel32

GetPrivateProfileStringW

GetLastError

WritePrivateProfileStringW

ClosePrivateNamespace

GetCurrentProcessId

GetCurrentThreadId

FormatMessageW

IsDebuggerPresent

CreateMutexW

OpenMutexW

GetModuleHandleW

GetProcAddress

GetNativeSystemInfo

WaitForSingleObject

GetProcessId

ResumeThread

SuspendThread

GetThreadContext

ReleaseMutex

GetCurrentProcess

LocalFree

QueryFullProcessImageNameW

IsWow64Process

DuplicateHandle

VirtualFreeEx

VirtualAllocEx

WriteProcessMemory

VirtualProtectEx

LCMapStringEx

lstrcmpiA

lstrcmpA

GetVersionExW

ExpandEnvironmentStringsW

HeapFree

HeapAlloc

GetProcessHeap

FlsFree

FlsGetValue

FlsSetValue

FlsAlloc

FindResourceW

LoadResource

LockResource

VirtualProtect

LoadLibraryExW

SetLastError

GetTickCount

FreeLibrary

K32GetModuleFileNameExW

GetModuleFileNameW

Sleep

ReleaseSemaphore

GetProcessTimes

WaitForMultipleObjects

SetThreadErrorMode

FreeLibraryAndExitThread

GetModuleHandleExW

FindCloseChangeNotification

CreateSemaphoreExW

CreateBoundaryDescriptorW

AddSIDToBoundaryDescriptor

AddIntegrityLabelToBoundaryDescriptor

CreatePrivateNamespaceW

OpenPrivateNamespaceW

DeleteBoundaryDescriptor

GetEnvironmentVariableW

SetFilePointer

SetEndOfFile

FindFirstChangeNotificationW

CreateEventW

FindNextChangeNotification

GetModuleFileNameA

OpenSemaphoreW

CreateMutexExW

WideCharToMultiByte

DebugBreak

HeapCreate

Thread32Next

Thread32First

CreateToolhelp32Snapshot

HeapReAlloc

HeapDestroy

GetThreadId

FlushInstructionCache

SetThreadContext

OpenThread

VirtualFree

VirtualAlloc

VirtualQuery

GetEnvironmentStringsW

CloseHandle

WriteFile

CreateFileW

OutputDebugStringW

FreeEnvironmentStringsW

SetStdHandle

WriteConsoleW

FlushFileBuffers

GetConsoleOutputCP

GetConsoleMode

HeapSize

DecodePointer

WaitForSingleObjectEx

RaiseException

GetSystemInfo

LoadLibraryExA

InitOnceBeginInitialize

InitOnceComplete

ReleaseSRWLockExclusive

AcquireSRWLockExclusive

TryAcquireSRWLockExclusive

FormatMessageA

GetLocaleInfoEx

CreateDirectoryW

FindClose

FindFirstFileW

FindFirstFileExW

FindNextFileW

GetFileAttributesExW

AreFileApisANSI

GetFileInformationByHandleEx

MultiByteToWideChar

QueryPerformanceCounter

GetSystemTimeAsFileTime

UnhandledExceptionFilter

SetUnhandledExceptionFilter

TerminateProcess

IsProcessorFeaturePresent

GetStartupInfoW

InitializeSListHead

RtlUnwind

InterlockedFlushSList

EncodePointer

EnterCriticalSection

LeaveCriticalSection

DeleteCriticalSection

InitializeCriticalSectionAndSpinCount

TlsAlloc

TlsGetValue

TlsSetValue

TlsFree

GetCPInfo

ExitProcess

GetStdHandle

GetFileType

LCMapStringW

SetFilePointerEx

GetStringTypeW

IsValidCodePage

GetACP

GetOEMCP

GetCommandLineA

GetCommandLineW

advapi32

RegCloseKey

RegNotifyChangeKeyValue

RegEnumKeyExW

FreeSid

AllocateAndInitializeSid

ConvertStringSecurityDescriptorToSecurityDescriptorW

LsaNtStatusToWinError

RegEnumValueW

RegQueryInfoKeyW

RegQueryValueExW

RegDeleteValueW

RegSetValueExW

RegCreateKeyExW

Exports

GlobalHookSessionEnd

GlobalHookSessionHandleNewProcesses

GlobalHookSessionStart

InjectInit

InternalWh_ApplyHookOperations

InternalWh_DeleteValue

InternalWh_Disasm

InternalWh_FindCloseSymbol

InternalWh_FindFirstSymbol

InternalWh_FindFirstSymbol2

InternalWh_FindFirstSymbol3

InternalWh_FindFirstSymbol4

InternalWh_FindNextSymbol

InternalWh_FindNextSymbol2

InternalWh_FreeStringSetting

InternalWh_FreeUrlContent

InternalWh_GetBinaryValue

InternalWh_GetIntSetting

InternalWh_GetIntValue

InternalWh_GetStringSetting

InternalWh_GetStringValue

InternalWh_GetUrlContent

InternalWh_HookSymbols

InternalWh_IsLogEnabled

InternalWh_Log

InternalWh_RemoveFunctionHook

InternalWh_SetBinaryValue

InternalWh_SetFunctionHook

InternalWh_SetIntValue

InternalWh_SetStringValue

Sections

.text
Size: 307KB - Virtual size: 306KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 514KB - Virtual size: 513KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 664B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

Engine/$R1/32/windhawk.lib

Engine/$R1/64/msdia140_windhawk.dll

.dll regsvr32 windows:6 windows x64 arch:x64

de831e503a4a7c3a7e01a1d49e6ff42b

Code Sign

33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12-05-2022 20:46

Not After

11-05-2023 20:46

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

6d:4d:c8:e5:5c:3b:30:f4:44:a7:1a:a0:e8:1b:47:9d:9e:14:a0:d5:2b:99:60:40:0f:c7:2f:a9:ca:c4:79:42
Signer

Actual PE Digest

6d:4d:c8:e5:5c:3b:30:f4:44:a7:1a:a0:e8:1b:47:9d:9e:14:a0:d5:2b:99:60:40:0f:c7:2f:a9:ca:c4:79:42

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\s\binaries\amd64ret\bin\amd64\msdia140.pdb

Imports

kernel32

SetLastError

FindResourceExW

LoadResource

LockResource

SizeofResource

MultiByteToWideChar

LoadLibraryExW

GetProcAddress

LocalAlloc

LocalFree

GetModuleFileNameW

GetLastError

GetSystemInfo

InitializeCriticalSection

DeleteCriticalSection

CopyFileW

CreateDirectoryW

GetTempPathW

LCMapStringW

UnmapViewOfFile

CloseHandle

EnterCriticalSection

LeaveCriticalSection

CreateFileW

GetFileSize

CreateFileMappingW

MapViewOfFile

GetNativeSystemInfo

RaiseException

VirtualProtect

VirtualQuery

FreeLibrary

GetModuleHandleW

LoadLibraryExA

RtlCaptureContext

RtlLookupFunctionEntry

RtlVirtualUnwind

UnhandledExceptionFilter

SetUnhandledExceptionFilter

GetCurrentProcess

TerminateProcess

IsProcessorFeaturePresent

QueryPerformanceCounter

GetCurrentProcessId

GetCurrentThreadId

GetSystemTimeAsFileTime

InitializeSListHead

IsDebuggerPresent

GetStartupInfoW

RtlUnwindEx

InterlockedFlushSList

EncodePointer

InitializeCriticalSectionAndSpinCount

TlsAlloc

TlsGetValue

TlsSetValue

TlsFree

RtlPcToFileHeader

RtlUnwind

GetFullPathNameW

SetStdHandle

GetFileType

SetFilePointerEx

ReadFile

GetConsoleMode

ReadConsoleW

ExitProcess

GetModuleHandleExW

HeapFree

HeapAlloc

GetStdHandle

FlushFileBuffers

WriteFile

GetConsoleOutputCP

GetFileSizeEx

GetDriveTypeW

WideCharToMultiByte

FlsAlloc

FlsGetValue

FlsSetValue

FlsFree

CompareStringW

FindClose

FindFirstFileExW

FindNextFileW

IsValidCodePage

GetACP

GetOEMCP

GetCPInfo

GetCommandLineA

GetCommandLineW

GetEnvironmentStringsW

FreeEnvironmentStringsW

SetEnvironmentVariableW

GetProcessHeap

GetStringTypeW

GetCurrentDirectoryW

HeapSize

HeapReAlloc

WriteConsoleW

SetEndOfFile

InitializeSRWLock

ReleaseSRWLockExclusive

AcquireSRWLockExclusive

TryAcquireSRWLockExclusive

InitializeCriticalSectionEx

CreateThreadpoolWork

SubmitThreadpoolWork

CloseThreadpoolWork

VirtualAlloc

VirtualFree

GetFileAttributesW

SetFileAttributesW

DeleteFileW

DeviceIoControl

MapViewOfFileEx

CreateFileMappingA

ReleaseSRWLockShared

AcquireSRWLockShared

ExpandEnvironmentStringsW

WaitForThreadpoolWorkCallbacks

ole32

StringFromGUID2

CoCreateGuid

shlwapi

PathFileExistsW

PathFindFileNameW

Exports

DllCanUnloadNow

DllGetClassObject

DllRegisterServer

DllUnregisterServer

VSDllRegisterServer

VSDllUnregisterServer

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 273KB - Virtual size: 273KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

Engine/$R1/64/symsrv.yes

Engine/$R1/64/symsrv_windhawk.dll

.dll windows:10 windows x64 arch:x64

e1ab4d385644d8a18ed1ce8881462330

Code Sign

33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12-05-2022 20:46

Not After

11-05-2023 20:46

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

23:95:98:82:7a:05:a0:c3:20:38:ec:fe:e3:e8:82:2c:21:77:7d:55:db:51:43:30:1a:c4:e0:59:99:85:93:03
Signer

Actual PE Digest

23:95:98:82:7a:05:a0:c3:20:38:ec:fe:e3:e8:82:2c:21:77:7d:55:db:51:43:30:1a:c4:e0:59:99:85:93:03

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

PDB Paths

symsrv.pdb

Imports

msvcrt

_wtoi64

getenv

strnlen

swprintf_s

_vscwprintf

wcsnlen

_callnewh

_vscprintf

_stricmp

_vsnwprintf_s

vswprintf_s

??0exception@@QEAA@AEBQEBDH@Z

?what@exception@@UEBAPEBDXZ

_CxxThrowException

memcpy

tolower

_wmakepath_s

memmove

iswspace

_wcsdup

_XcptFilter

_amsg_exit

_wcsicmp

??_V@YAXPEAX@Z

__C_specific_handler

fclose

_wcsnicmp

wcschr

_vsnprintf_s

??0exception@@QEAA@AEBV0@@Z

_errno

_initterm

_lock

??0exception@@QEAA@XZ

_unlock

__dllonexit

_onexit

??1exception@@UEAA@XZ

_purecall

??3@YAXPEAX@Z

free

__CxxFrameHandler3

_wcslwr_s

wcsrchr

fgetws

wcsstr

swscanf_s

_wfopen

strpbrk

strstr

realloc

iswprint

??0exception@@QEAA@AEBQEBD@Z

memcpy_s

towlower

wcsncmp

strcpy_s

_wcsupr

malloc

strcat_s

isspace

_wcslwr

?terminate@@YAXXZ

??1type_info@@UEAA@XZ

_vsnwprintf

wcscat_s

strrchr

memcmp

memset

wcsncpy_s

wcscpy_s

calloc

wcscmp

api-ms-win-core-libraryloader-l1-1-0

GetModuleHandleExW

FreeLibrary

GetModuleFileNameW

LoadLibraryExW

GetProcAddress

GetModuleFileNameA

GetModuleHandleW

LoadLibraryExA

api-ms-win-core-heap-l1-1-0

HeapAlloc

HeapFree

GetProcessHeap

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId

TerminateProcess

OpenProcessToken

CreateThread

GetCurrentProcess

GetCurrentProcessId

GetExitCodeThread

api-ms-win-core-misc-l1-1-0

LocalFree

FormatMessageW

LocalAlloc

Sleep

GlobalFree

LocalReAlloc

api-ms-win-core-debug-l1-1-0

OutputDebugStringW

DebugBreak

IsDebuggerPresent

api-ms-win-security-base-l1-1-0

AllocateAndInitializeSid

EqualSid

GetTokenInformation

FreeSid

api-ms-win-core-file-l1-1-0

CreateFileW

GetFileTime

GetFileSizeEx

CreateDirectoryW

SetFilePointerEx

DeleteFileW

GetDriveTypeW

RemoveDirectoryW

GetFullPathNameW

GetFinalPathNameByHandleW

GetFileAttributesW

GetFileAttributesExW

GetFileSize

FileTimeToLocalFileTime

DeleteFileA

CreateFileA

LocalFileTimeToFileTime

GetFileInformationByHandle

SetFilePointer

SetFileTime

ReadFile

WriteFile

api-ms-win-core-errorhandling-l1-1-0

SetLastError

SetUnhandledExceptionFilter

UnhandledExceptionFilter

RaiseException

GetLastError

SetErrorMode

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW

ExpandEnvironmentStringsW

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW

GetSystemInfo

GetSystemDirectoryW

GetTickCount

GetSystemTimeAsFileTime

GetTickCount64

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

MultiByteToWideChar

api-ms-win-core-synch-l1-1-0

CreateMutexExW

InitializeCriticalSection

WaitForSingleObjectEx

LeaveCriticalSection

ReleaseMutex

ReleaseSRWLockShared

OpenSemaphoreW

WaitForSingleObject

CreateSemaphoreExW

TryAcquireSRWLockExclusive

AcquireSRWLockExclusive

SetEvent

OpenMutexW

DeleteCriticalSection

EnterCriticalSection

SetWaitableTimer

ReleaseSRWLockExclusive

ResetEvent

InitializeCriticalSectionAndSpinCount

InitializeSRWLock

ReleaseSemaphore

AcquireSRWLockShared

CreateEventW

api-ms-win-core-handle-l1-1-0

CloseHandle

rpcrt4

UuidCreate

api-ms-win-core-localregistry-l1-1-0

RegEnumValueW

RegQueryValueExW

RegOpenKeyExW

RegCloseKey

ws2_32

GetAddrInfoW

WSAStartup

FreeAddrInfoW

WSACleanup

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind

RtlCaptureContext

RtlLookupFunctionEntry

oleaut32

SysFreeString

shlwapi

PathFindFileNameW

kernel32

WaitForMultipleObjects

IsProcessorFeaturePresent

CancelSynchronousIo

ntdll

RtlRunOnceExecuteOnce

RtlUTF8ToUnicodeN

crypt32

CryptStringToBinaryW

CryptBinaryToStringW

bcrypt

BCryptHashData

BCryptDestroyHash

BCryptCloseAlgorithmProvider

BCryptFinishHash

BCryptOpenAlgorithmProvider

BCryptGetProperty

BCryptCreateHash

api-ms-win-core-memory-l1-1-0

VirtualProtect

VirtualQuery

api-ms-win-core-threadpool-l1-1-0

WaitForThreadpoolTimerCallbacks

CloseThreadpoolTimer

CreateThreadpoolTimer

SetThreadpoolTimer

Exports

EulaDlgProc

RunDllEntry

SymbolServer

SymbolServerByIndex

SymbolServerByIndexAndChecksumsW

SymbolServerByIndexW

SymbolServerClose

SymbolServerDeltaName

SymbolServerDeltaNameW

SymbolServerGetIndexString

SymbolServerGetIndexStringW

SymbolServerGetOptionData

SymbolServerGetOptions

SymbolServerGetSupplement

SymbolServerGetSupplementW

SymbolServerGetVersion

SymbolServerIsStore

SymbolServerIsStoreW

SymbolServerPing

SymbolServerPingW

SymbolServerPingWEx

SymbolServerSetHttpAuthHeader

SymbolServerSetOptions

SymbolServerSetOptionsW

SymbolServerStoreFile

SymbolServerStoreFileW

SymbolServerStoreSupplement

SymbolServerStoreSupplementW

SymbolServerW

SymbolServerWEx

SymbolServerWithChecksumsW

httpCloseHandle

httpOpenFileHandle

httpOpenFileHandleW

httpQueryDataAvailable

httpReadFile

Sections

.text
Size: 200KB - Virtual size: 199KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 116KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 206KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.mrdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

Engine/$R1/64/windhawk.dll

.dll windows:6 windows x64 arch:x64

30b1a2203e981fc0bf01167cd01586d8

Code Sign

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

16-04-2020 18:36

Not After

16-04-2045 18:44

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:01:47:a6:31:52:5c:23:53:35:c2:56:00:00:00:01:47:a6
Certificate

Issuer

CN=Microsoft ID Verified CS AOC CA 02,O=Microsoft Corporation,C=US

Not Before

28-07-2024 21:14

Not After

31-07-2024 21:14

Subject

CN=Michael Maltsev,O=Michael Maltsev,L=Rishon LeZion,ST=Central,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:01:47:a6:31:52:5c:23:53:35:c2:56:00:00:00:01:47:a6
Certificate

Issuer

CN=Microsoft ID Verified CS AOC CA 02,O=Microsoft Corporation,C=US

Not Before

28-07-2024 21:14

Not After

31-07-2024 21:14

Subject

CN=Michael Maltsev,O=Michael Maltsev,L=Rishon LeZion,ST=Central,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:00:00:04:96:50:4b:d2:db:ee:cb:88:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Not Before

13-04-2021 17:31

Not After

13-04-2026 17:31

Subject

CN=Microsoft ID Verified CS AOC CA 02,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

01-04-2021 20:05

Not After

01-04-2036 20:15

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

19-11-2020 20:32

Not After

19-11-2035 20:42

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:00:3f:04:1a:e9:7e:6d:27:fe:eb:00:00:00:00:00:3f
Certificate

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Not Before

18-04-2024 17:59

Not After

17-04-2025 17:59

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:F5D6-96D6-909E,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

68:dc:60:76:46:92:fd:8f:af:cd:50:c8:a5:d4:8c:c6:28:38:80:9e:45:f9:50:63:2b:07:12:fc:76:8b:2e:05
Signer

Actual PE Digest

68:dc:60:76:46:92:fd:8f:af:cd:50:c8:a5:d4:8c:c6:28:38:80:9e:45:f9:50:63:2b:07:12:fc:76:8b:2e:05

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Imports

winhttp

WinHttpOpen

WinHttpCloseHandle

WinHttpReadData

WinHttpQueryDataAvailable

WinHttpQueryHeaders

WinHttpReceiveResponse

WinHttpSendRequest

WinHttpOpenRequest

WinHttpConnect

WinHttpCrackUrl

kernel32

GetPrivateProfileStringW

GetLastError

WritePrivateProfileStringW

GetCurrentThreadId

FormatMessageW

IsDebuggerPresent

ClosePrivateNamespace

GetCurrentProcessId

CreateMutexW

OpenMutexW

GetModuleHandleW

GetProcAddress

WaitForSingleObject

GetProcessId

ResumeThread

SuspendThread

GetThreadContext

ReleaseMutex

GetCurrentProcess

LocalFree

QueryFullProcessImageNameW

IsWow64Process

DuplicateHandle

VirtualFreeEx

VirtualAllocEx

WriteProcessMemory

VirtualProtectEx

LCMapStringEx

lstrcmpiA

lstrcmpA

GetVersionExW

ExpandEnvironmentStringsW

FlsFree

FlsGetValue

FlsSetValue

FlsAlloc

FindResourceW

LoadResource

LockResource

VirtualProtect

LoadLibraryExW

WaitForSingleObjectEx

GetTickCount

FreeLibrary

K32GetModuleFileNameExW

SetLastError

Sleep

ReleaseSemaphore

GetProcessTimes

WaitForMultipleObjects

SetThreadErrorMode

FreeLibraryAndExitThread

GetModuleHandleExW

FindCloseChangeNotification

CreateSemaphoreExW

CreateBoundaryDescriptorW

AddSIDToBoundaryDescriptor

AddIntegrityLabelToBoundaryDescriptor

CreatePrivateNamespaceW

OpenPrivateNamespaceW

DeleteBoundaryDescriptor

GetEnvironmentVariableW

SetFilePointer

SetEndOfFile

FindFirstChangeNotificationW

CreateEventW

FindNextChangeNotification

GetModuleFileNameA

HeapFree

OpenSemaphoreW

HeapAlloc

CreateMutexExW

GetProcessHeap

WideCharToMultiByte

DebugBreak

HeapCreate

Thread32Next

Thread32First

CreateToolhelp32Snapshot

HeapReAlloc

HeapDestroy

GetThreadId

FlushInstructionCache

SetThreadContext

OpenThread

VirtualFree

VirtualAlloc

GetSystemInfo

VirtualQuery

GetEnvironmentStringsW

CloseHandle

WriteFile

CreateFileW

OutputDebugStringW

FreeEnvironmentStringsW

SetStdHandle

FlushFileBuffers

GetConsoleOutputCP

GetConsoleMode

HeapSize

WriteConsoleW

GetModuleFileNameW

RaiseException

LoadLibraryExA

InitOnceBeginInitialize

InitOnceComplete

ReleaseSRWLockExclusive

AcquireSRWLockExclusive

TryAcquireSRWLockExclusive

FormatMessageA

GetLocaleInfoEx

CreateDirectoryW

FindClose

FindFirstFileW

FindFirstFileExW

FindNextFileW

GetFileAttributesExW

AreFileApisANSI

GetFileInformationByHandleEx

MultiByteToWideChar

QueryPerformanceCounter

GetSystemTimeAsFileTime

RtlCaptureContext

RtlLookupFunctionEntry

RtlVirtualUnwind

UnhandledExceptionFilter

SetUnhandledExceptionFilter

TerminateProcess

IsProcessorFeaturePresent

GetStartupInfoW

InitializeSListHead

RtlUnwindEx

RtlPcToFileHeader

InterlockedFlushSList

EncodePointer

EnterCriticalSection

LeaveCriticalSection

DeleteCriticalSection

InitializeCriticalSectionAndSpinCount

TlsAlloc

TlsGetValue

TlsSetValue

TlsFree

GetCPInfo

ExitProcess

GetStdHandle

GetFileType

LCMapStringW

SetFilePointerEx

GetStringTypeW

IsValidCodePage

GetACP

GetOEMCP

GetCommandLineA

GetCommandLineW

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW

RegNotifyChangeKeyValue

RegEnumKeyExW

FreeSid

AllocateAndInitializeSid

LsaNtStatusToWinError

RegCloseKey

RegEnumValueW

RegQueryInfoKeyW

RegQueryValueExW

RegDeleteValueW

RegSetValueExW

RegCreateKeyExW

Exports

GlobalHookSessionEnd

GlobalHookSessionHandleNewProcesses

GlobalHookSessionStart

InjectInit

InternalWh_ApplyHookOperations

InternalWh_DeleteValue

InternalWh_Disasm

InternalWh_FindCloseSymbol

InternalWh_FindFirstSymbol

InternalWh_FindFirstSymbol2

InternalWh_FindFirstSymbol3

InternalWh_FindFirstSymbol4

InternalWh_FindNextSymbol

InternalWh_FindNextSymbol2

InternalWh_FreeStringSetting

InternalWh_FreeUrlContent

InternalWh_GetBinaryValue

InternalWh_GetIntSetting

InternalWh_GetIntValue

InternalWh_GetStringSetting

InternalWh_GetStringValue

InternalWh_GetUrlContent

InternalWh_HookSymbols

InternalWh_IsLogEnabled

InternalWh_Log

InternalWh_RemoveFunctionHook

InternalWh_SetBinaryValue

InternalWh_SetFunctionHook

InternalWh_SetIntValue

InternalWh_SetStringValue

Sections

.text
Size: 335KB - Virtual size: 335KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 556KB - Virtual size: 555KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 664B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

Engine/$R1/64/windhawk.lib

UI/resources/app/extensions/clangd/CHANGELOG.md

UI/resources/app/extensions/clangd/DEVELOPING.md

UI/resources/app/extensions/clangd/README.md

UI/resources/app/extensions/clangd/doc-assets/complete.png

.png

UI/resources/app/extensions/clangd/doc-assets/diagnostics.png

.png

UI/resources/app/extensions/clangd/doc-assets/extract.png

.png

UI/resources/app/extensions/clangd/doc-assets/format.png

.png

UI/resources/app/extensions/clangd/doc-assets/hover.png

.png

UI/resources/app/extensions/clangd/doc-assets/include.png

.png

UI/resources/app/extensions/clangd/doc-assets/symbolsearch.png

.png

UI/resources/app/extensions/clangd/doc-assets/xrefs.png

.png

UI/resources/app/extensions/clangd/icon.png

.png

UI/resources/app/extensions/clangd/out/bundle.js

.js

UI/resources/app/extensions/clangd/package.json

UI/resources/app/extensions/windhawk/LICENSE.txt

UI/resources/app/extensions/windhawk/README.md

UI/resources/app/extensions/windhawk/assets/main-icon.png

.png

UI/resources/app/extensions/windhawk/assets/main-icon.svg

UI/resources/app/extensions/windhawk/assets/tab-icon-black.svg

UI/resources/app/extensions/windhawk/assets/tab-icon-white.svg

UI/resources/app/extensions/windhawk/dist/e0f1dd0fc5bc2e5c289962389cb164c4.node

.dll windows:6 windows x86 arch:x86

6f8ad1eaf7b6edeb3ab71b8cbfb27563

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

C:\RaMMicHaeL\Sources\Visual C++\Windhawk\vscode-windhawk\vscode-windhawk\node_modules\fs-ext\build\Release\fs-ext.pdb

Imports

kernel32

GetModuleHandleA

LockFileEx

SetFilePointerEx

UnlockFileEx

GetLastError

VirtualQuery

UnhandledExceptionFilter

SetUnhandledExceptionFilter

GetCurrentProcess

TerminateProcess

IsProcessorFeaturePresent

QueryPerformanceCounter

GetCurrentProcessId

GetCurrentThreadId

GetSystemTimeAsFileTime

InitializeSListHead

IsDebuggerPresent

GetStartupInfoW

GetModuleHandleW

RaiseException

InterlockedPushEntrySList

InterlockedFlushSList

RtlUnwind

SetLastError

EnterCriticalSection

LeaveCriticalSection

DeleteCriticalSection

InitializeCriticalSectionAndSpinCount

TlsAlloc

TlsGetValue

TlsSetValue

TlsFree

FreeLibrary

GetProcAddress

LoadLibraryExW

EncodePointer

GetStdHandle

GetFileType

GetModuleFileNameW

GetModuleHandleExW

WriteConsoleW

ExitProcess

GetCurrentThread

HeapFree

HeapAlloc

WriteFile

OutputDebugStringW

SetConsoleCtrlHandler

FindClose

FindFirstFileExW

FindNextFileW

IsValidCodePage

GetACP

GetOEMCP

GetCPInfo

GetCommandLineA

GetCommandLineW

MultiByteToWideChar

WideCharToMultiByte

GetEnvironmentStringsW

FreeEnvironmentStringsW

SetEnvironmentVariableW

GetTempPathW

GetDateFormatW

GetTimeFormatW

CompareStringW

LCMapStringW

GetLocaleInfoW

IsValidLocale

GetUserDefaultLCID

EnumSystemLocalesW

GetProcessHeap

GetStringTypeW

FlushFileBuffers

GetConsoleOutputCP

GetConsoleMode

HeapSize

HeapReAlloc

SetStdHandle

GetFileSizeEx

ReadFile

ReadConsoleW

CloseHandle

CreateFileW

DecodePointer

GetSystemInfo

VirtualProtect

LoadLibraryExA

Exports

_register_fs_ext_

Sections

.text
Size: 427KB - Virtual size: 426KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.didat
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 270B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

UI/resources/app/extensions/windhawk/dist/extension.js

.js

UI/resources/app/extensions/windhawk/dist/extension.js.LICENSE.txt

UI/resources/app/extensions/windhawk/dist/extension.js.map

UI/resources/app/extensions/windhawk/files/DbgViewMini.exe

.exe windows:6 windows x86 arch:x86

261affb8a7ac3ff4562e0a26e1981cb2

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

cb:bf:3d:73:b5:02:21:79:28:5f:ba:16:9d:66:f0:30
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

26-07-2022 00:00

Not After

25-07-2024 23:59

Subject

CN=Michael Maltsev,O=Michael Maltsev,ST=HaMerkaz,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

cb:bf:3d:73:b5:02:21:79:28:5f:ba:16:9d:66:f0:30
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

26-07-2022 00:00

Not After

25-07-2024 23:59

Subject

CN=Michael Maltsev,O=Michael Maltsev,ST=HaMerkaz,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

16:72:c4:06:1d:10:43:10:69:8a:a1:64:1d:d1:73:43:ea:2b:a2:dc:74:2a:d7:27:7a:38:29:10:f2:1e:cb:9f
Signer

Actual PE Digest

16:72:c4:06:1d:10:43:10:69:8a:a1:64:1d:d1:73:43:ea:2b:a2:dc:74:2a:d7:27:7a:38:29:10:f2:1e:cb:9f

Digest Algorithm

sha256

PE Digest Matches

true

42:f2:77:9f:48:3e:97:2a:2e:22:e1:91:a6:26:e9:3b:d5:96:5b:63
Signer

Actual PE Digest

42:f2:77:9f:48:3e:97:2a:2e:22:e1:91:a6:26:e9:3b:d5:96:5b:63

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitThread

OpenProcess

CreateEventW

GetLastError

QueryFullProcessImageNameA

SetEvent

UnmapViewOfFile

CreateThread

GetLocalTime

LocalFree

CreateFileMappingW

MapViewOfFile

WriteConsoleW

CloseHandle

WaitForSingleObject

ReleaseSRWLockExclusive

AcquireSRWLockExclusive

WakeAllConditionVariable

SleepConditionVariableSRW

UnhandledExceptionFilter

SetUnhandledExceptionFilter

GetCurrentProcess

TerminateProcess

IsProcessorFeaturePresent

IsDebuggerPresent

GetStartupInfoW

GetModuleHandleW

QueryPerformanceCounter

GetCurrentProcessId

GetCurrentThreadId

GetSystemTimeAsFileTime

InitializeSListHead

RtlUnwind

SetLastError

EncodePointer

EnterCriticalSection

LeaveCriticalSection

DeleteCriticalSection

InitializeCriticalSectionAndSpinCount

TlsAlloc

TlsGetValue

TlsSetValue

TlsFree

FreeLibrary

GetProcAddress

LoadLibraryExW

RaiseException

ExitProcess

GetModuleHandleExW

GetModuleFileNameW

GetStdHandle

WriteFile

GetCommandLineA

GetCommandLineW

HeapAlloc

HeapFree

CompareStringW

LCMapStringW

GetFileType

FindClose

FindFirstFileExW

FindNextFileW

IsValidCodePage

GetACP

GetOEMCP

GetCPInfo

MultiByteToWideChar

WideCharToMultiByte

GetEnvironmentStringsW

FreeEnvironmentStringsW

SetEnvironmentVariableW

GetProcessHeap

SetStdHandle

GetStringTypeW

FlushFileBuffers

GetConsoleOutputCP

GetConsoleMode

GetFileSizeEx

SetFilePointerEx

HeapSize

HeapReAlloc

CreateFileW

DecodePointer

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW

Sections

.text
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

UI/resources/app/extensions/windhawk/files/mod_template.wh.cpp

UI/resources/app/extensions/windhawk/package.json

UI/resources/app/extensions/windhawk/package.nls.json

UI/resources/app/extensions/windhawk/prebuilds/win32-arm64/node.napi.node

UI/resources/app/extensions/windhawk/prebuilds/win32-ia32/node.napi.node

.dll windows:6 windows x86 arch:x86

a9b6e7c43054fb89421820bb34a72491

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

C:\code\personal\npm-reg\build\Release\reg.pdb

Imports

kernel32

LocalFree

FormatMessageW

GetModuleHandleA

VirtualQuery

UnhandledExceptionFilter

SetUnhandledExceptionFilter

GetCurrentProcess

TerminateProcess

IsProcessorFeaturePresent

QueryPerformanceCounter

GetCurrentProcessId

GetCurrentThreadId

GetSystemTimeAsFileTime

InitializeSListHead

IsDebuggerPresent

GetStartupInfoW

GetModuleHandleW

RtlUnwind

RaiseException

InterlockedFlushSList

GetLastError

SetLastError

EncodePointer

EnterCriticalSection

LeaveCriticalSection

DeleteCriticalSection

InitializeCriticalSectionAndSpinCount

TlsAlloc

TlsGetValue

TlsSetValue

TlsFree

FreeLibrary

GetProcAddress

LoadLibraryExW

ExitProcess

GetModuleHandleExW

GetModuleFileNameW

HeapAlloc

HeapFree

FindClose

FindFirstFileExW

FindNextFileW

IsValidCodePage

GetACP

GetOEMCP

GetCPInfo

GetCommandLineA

GetCommandLineW

MultiByteToWideChar

WideCharToMultiByte

GetEnvironmentStringsW

FreeEnvironmentStringsW

LCMapStringW

GetProcessHeap

GetStdHandle

GetFileType

GetStringTypeW

HeapSize

HeapReAlloc

SetStdHandle

FlushFileBuffers

WriteFile

GetConsoleOutputCP

GetConsoleMode

SetFilePointerEx

CreateFileW

CloseHandle

WriteConsoleW

DecodePointer

GetSystemInfo

VirtualProtect

LoadLibraryExA

advapi32

RegDeleteTreeW

RegLoadAppKeyW

RegRenameKey

RegCloseKey

RegQueryValueExW

RegEnumValueW

RegDeleteValueW

RegGetValueW

RegOpenKeyExW

RegCopyTreeW

RegSetValueExW

RegQueryInfoKeyW

RegEnumKeyExW

RegCreateKeyExW

RegDeleteKeyValueW

RegDeleteKeyW

RegOpenCurrentUser

Exports

_register_reg_

Sections

.text
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

UI/resources/app/extensions/windhawk/prebuilds/win32-x64/node.napi.node

.dll windows:6 windows x64 arch:x64

6ccae87e9572989bc9e46dc2454766ea

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

PDB Paths

C:\code\personal\npm-reg\build\Release\reg.pdb

Imports

kernel32

LocalFree

FormatMessageW

GetModuleHandleA

VirtualQuery

RtlCaptureContext

RtlLookupFunctionEntry

RtlVirtualUnwind

UnhandledExceptionFilter

SetUnhandledExceptionFilter

GetCurrentProcess

TerminateProcess

IsProcessorFeaturePresent

QueryPerformanceCounter

GetCurrentProcessId

GetCurrentThreadId

GetSystemTimeAsFileTime

InitializeSListHead

IsDebuggerPresent

GetStartupInfoW

GetModuleHandleW

RtlUnwindEx

RtlPcToFileHeader

RaiseException

InterlockedFlushSList

GetLastError

SetLastError

EncodePointer

EnterCriticalSection

LeaveCriticalSection

DeleteCriticalSection

InitializeCriticalSectionAndSpinCount

TlsAlloc

TlsGetValue

TlsSetValue

TlsFree

FreeLibrary

GetProcAddress

LoadLibraryExW

RtlUnwind

ExitProcess

GetModuleHandleExW

GetModuleFileNameW

HeapAlloc

HeapFree

FindClose

FindFirstFileExW

FindNextFileW

IsValidCodePage

GetACP

GetOEMCP

GetCPInfo

GetCommandLineA

GetCommandLineW

MultiByteToWideChar

WideCharToMultiByte

GetEnvironmentStringsW

FreeEnvironmentStringsW

FlsAlloc

FlsGetValue

FlsSetValue

FlsFree

LCMapStringW

GetProcessHeap

GetStdHandle

GetFileType

GetStringTypeW

HeapSize

HeapReAlloc

SetStdHandle

FlushFileBuffers

WriteFile

GetConsoleOutputCP

GetConsoleMode

SetFilePointerEx

CreateFileW

CloseHandle

WriteConsoleW

GetSystemInfo

VirtualProtect

LoadLibraryExA

advapi32

RegDeleteTreeW

RegLoadAppKeyW

RegRenameKey

RegCloseKey

RegQueryValueExW

RegEnumValueW

RegDeleteValueW

RegGetValueW

RegOpenKeyExW

RegCopyTreeW

RegSetValueExW

RegQueryInfoKeyW

RegEnumKeyExW

RegCreateKeyExW

RegDeleteKeyValueW

RegDeleteKeyW

RegOpenCurrentUser

Exports

_register_reg_

Sections

.text
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

UI/resources/app/extensions/windhawk/syntaxes/cpp.injection.json

UI/resources/app/extensions/windhawk/webview/3rdpartylicenses.txt

UI/resources/app/extensions/windhawk/webview/Oxanium-Medium.7098beb1dc0482713448.ttf

UI/resources/app/extensions/windhawk/webview/favicon.ico

UI/resources/app/extensions/windhawk/webview/index.html

.html

UI/resources/app/extensions/windhawk/webview/local-mod-icon.70a258753b360ed1b8d4867fd77337e2.svg

.xml

UI/resources/app/extensions/windhawk/webview/locales/DO_NOT_EDIT.txt

UI/resources/app/extensions/windhawk/webview/locales/de/translation.json

UI/resources/app/extensions/windhawk/webview/locales/en/translation.json

UI/resources/app/extensions/windhawk/webview/locales/es/translation.json

UI/resources/app/extensions/windhawk/webview/locales/fr/translation.json

UI/resources/app/extensions/windhawk/webview/locales/it/translation.json

UI/resources/app/extensions/windhawk/webview/locales/ja/translation.json

UI/resources/app/extensions/windhawk/webview/locales/ko/translation.json

UI/resources/app/extensions/windhawk/webview/locales/nl/translation.json

UI/resources/app/extensions/windhawk/webview/locales/pl/translation.json

UI/resources/app/extensions/windhawk/webview/locales/pt-BR/translation.json

UI/resources/app/extensions/windhawk/webview/locales/ro/translation.json

UI/resources/app/extensions/windhawk/webview/locales/ru/translation.json

UI/resources/app/extensions/windhawk/webview/locales/sv-SE/translation.json

UI/resources/app/extensions/windhawk/webview/locales/tr/translation.json

UI/resources/app/extensions/windhawk/webview/locales/uk/translation.json

UI/resources/app/extensions/windhawk/webview/locales/zh-CN/translation.json

UI/resources/app/extensions/windhawk/webview/locales/zh-TW/translation.json

UI/resources/app/extensions/windhawk/webview/logo-white.8c7b2e26389a94a26b1ffdd44cf241b6.svg

UI/resources/app/extensions/windhawk/webview/main.a9b7337ddd17a808.css

UI/resources/app/extensions/windhawk/webview/main.c3d5128696c05f2b.js

.js

UI/resources/app/extensions/windhawk/webview/polyfills.3193e398f1119b0b.js

.js

UI/resources/app/extensions/windhawk/webview/runtime.4381133e3b4de8a0.js

.js

UI/resources/app/out/vs/code/electron-main/main.js

.js

UI/resources/app/out/vs/workbench/browser/media/code-icon.svg

UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-dark.svg

.xml

UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-hcDark.svg

.xml

UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-hcLight.svg

.xml

UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-light.svg

.xml

UI/resources/app/out/vs/workbench/workbench.desktop.main.css

UI/resources/app/out/vs/workbench/workbench.desktop.main.js

.js

UI/resources/app/product.json

UI/resources/app/resources/win32/windhawk.ico

command-line.txt

uninstall.exe

.exe windows:4 windows x86 arch:x86

9dda1a1d1f8a1d13ae0297b47046b26e

Code Sign

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

16-04-2020 18:36

Not After

16-04-2045 18:44

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:01:47:a6:31:52:5c:23:53:35:c2:56:00:00:00:01:47:a6
Certificate

Issuer

CN=Microsoft ID Verified CS AOC CA 02,O=Microsoft Corporation,C=US

Not Before

28-07-2024 21:14

Not After

31-07-2024 21:14

Subject

CN=Michael Maltsev,O=Michael Maltsev,L=Rishon LeZion,ST=Central,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:01:47:a6:31:52:5c:23:53:35:c2:56:00:00:00:01:47:a6
Certificate

Issuer

CN=Microsoft ID Verified CS AOC CA 02,O=Microsoft Corporation,C=US

Not Before

28-07-2024 21:14

Not After

31-07-2024 21:14

Subject

CN=Michael Maltsev,O=Michael Maltsev,L=Rishon LeZion,ST=Central,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:00:00:04:96:50:4b:d2:db:ee:cb:88:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Not Before

13-04-2021 17:31

Not After

13-04-2026 17:31

Subject

CN=Microsoft ID Verified CS AOC CA 02,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

01-04-2021 20:05

Not After

01-04-2036 20:15

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

19-11-2020 20:32

Not After

19-11-2035 20:42

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:00:41:76:11:b2:4d:aa:a9:ab:3f:00:00:00:00:00:41
Certificate

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Not Before

18-04-2024 17:59

Not After

17-04-2025 17:59

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:4E89-9666-FFE7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e9:92:45:a7:04:91:5a:e6:dd:9a:f8:ab:53:b7:1c:fd:ad:7f:00:22:78:12:41:06:78:14:bf:07:40:f9:5a:90
Signer

Actual PE Digest

e9:92:45:a7:04:91:5a:e6:dd:9a:f8:ab:53:b7:1c:fd:ad:7f:00:22:78:12:41:06:78:14:bf:07:40:f9:5a:90

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_NO_SEH

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LINE_NUMS_STRIPPED

IMAGE_FILE_LOCAL_SYMS_STRIPPED

IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegEnumValueW

RegEnumKeyW

RegQueryValueExW

RegSetValueExW

RegCloseKey

RegDeleteValueW

RegDeleteKeyW

AdjustTokenPrivileges

LookupPrivilegeValueW

OpenProcessToken

RegOpenKeyExW

RegCreateKeyExW

shell32

SHGetPathFromIDListW

SHBrowseForFolderW

SHGetFileInfoW

SHFileOperationW

ShellExecuteExW

ole32

CoCreateInstance

OleUninitialize

OleInitialize

IIDFromString

CoTaskMemFree

comctl32

ImageList_Destroy

ord17

ImageList_AddMasked

ImageList_Create

user32

MessageBoxIndirectW

GetDlgItemTextW

SetDlgItemTextW

CreatePopupMenu

AppendMenuW

TrackPopupMenu

OpenClipboard

EmptyClipboard

SetClipboardData

CloseClipboard

IsWindowVisible

CallWindowProcW

GetMessagePos

CheckDlgButton

LoadCursorW

SetCursor

GetSysColor

SetWindowPos

GetWindowLongW

IsWindowEnabled

SetClassLongW

GetSystemMenu

EnableMenuItem

GetWindowRect

ScreenToClient

EndDialog

RegisterClassW

SystemParametersInfoW

CharPrevW

GetClassInfoW

DialogBoxParamW

CharNextW

ExitWindowsEx

DestroyWindow

CreateDialogParamW

SetTimer

SetWindowTextW

PostQuitMessage

SetForegroundWindow

ShowWindow

wsprintfW

SendMessageTimeoutW

FindWindowExW

IsWindow

GetDlgItem

SetWindowLongW

LoadImageW

GetDC

ReleaseDC

EnableWindow

InvalidateRect

SendMessageW

DefWindowProcW

BeginPaint

GetClientRect

FillRect

DrawTextW

EndPaint

CharNextA

wsprintfA

DispatchMessageW

CreateWindowExW

PeekMessageW

GetSystemMetrics

gdi32

GetDeviceCaps

SetBkColor

SelectObject

DeleteObject

CreateBrushIndirect

CreateFontIndirectW

SetBkMode

SetTextColor

kernel32

RemoveDirectoryW

lstrcmpiA

GetTempFileNameW

CreateProcessW

CreateDirectoryW

GetLastError

CreateThread

GlobalLock

GlobalUnlock

GetDiskFreeSpaceW

WideCharToMultiByte

lstrcpynW

lstrlenW

SetErrorMode

GetVersionExW

GetCommandLineW

GetTempPathW

GetWindowsDirectoryW

SetEnvironmentVariableW

WriteFile

ExitProcess

GetCurrentProcess

GetModuleFileNameW

GetFileSize

CreateFileW

GetTickCount

Sleep

SetFileAttributesW

GetFileAttributesW

SetCurrentDirectoryW

MoveFileW

GetFullPathNameW

GetShortPathNameW

SearchPathW

CompareFileTime

SetFileTime

CloseHandle

lstrcmpiW

lstrcmpW

ExpandEnvironmentStringsW

GlobalFree

GlobalAlloc

GetModuleHandleW

LoadLibraryExW

FreeLibrary

WritePrivateProfileStringW

GetPrivateProfileStringW

lstrlenA

MultiByteToWideChar

ReadFile

SetFilePointer

FindClose

FindNextFileW

FindFirstFileW

DeleteFileW

MulDiv

lstrcpyA

MoveFileExW

lstrcatW

GetSystemDirectoryW

GetProcAddress

GetModuleHandleA

GetExitCodeProcess

WaitForSingleObject

CopyFileW

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 184KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

$PLUGINSDIR/LangDLL.dll

.dll windows:4 windows x86 arch:x86

fe3375e7e4529b73ba45ab2246b9269b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_NO_SEH

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LINE_NUMS_STRIPPED

IMAGE_FILE_LOCAL_SYMS_STRIPPED

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

Imports

kernel32

GlobalFree

lstrlenW

GlobalAlloc

lstrcmpW

GetModuleHandleW

MulDiv

lstrcpyW

lstrcpynW

user32

SetWindowTextW

SetDlgItemTextW

SendDlgItemMessageW

EndDialog

DialogBoxParamW

LoadIconW

SendMessageW

ShowWindow

GetDC

gdi32

CreateFontIndirectW

GetDeviceCaps

DeleteObject

Exports

LangDialog

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 681B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

$PLUGINSDIR/SimpleSC.dll

.dll windows:5 windows x86 arch:x86

a9546246ff97b887a4072a24f9106617

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LINE_NUMS_STRIPPED

IMAGE_FILE_LOCAL_SYMS_STRIPPED

IMAGE_FILE_BYTES_REVERSED_LO

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

EnterCriticalSection

SetFilePointer

GetACP

CloseHandle

LocalFree

SuspendThread

VirtualProtect

TlsAlloc

GetTickCount

IsDebuggerPresent

GetFullPathNameW

VirtualFree

HeapAlloc

GetStartupInfoW

ExitProcess

GetFileAttributesW

InitializeCriticalSection

GetCPInfoExW

GetThreadPriority

GetCurrentProcess

SetThreadPriority

VirtualAlloc

RtlUnwind

GetCPInfo

GetCommandLineW

GetSystemInfo

ResumeThread

GetProcAddress

LeaveCriticalSection

EnumSystemLocalesW

GetStdHandle

GetVersionExW

VerifyVersionInfoW

GetModuleHandleW

FreeLibrary

HeapCreate

HeapDestroy

ReadFile

GetDiskFreeSpaceW

VerSetConditionMask

GetUserDefaultUILanguage

FindFirstFileW

TlsFree

HeapSize

lstrcpynW

SetLastError

GetModuleFileNameW

GetLastError

GlobalAlloc

lstrlenW

SetEndOfFile

CompareStringW

CreateThread

HeapFree

WideCharToMultiByte

MultiByteToWideChar

FindClose

LoadLibraryA

ResetEvent

SetEvent

CreateFileW

GetLocaleInfoW

GetVersion

RaiseException

FormatMessageW

SwitchToThread

GetExitCodeThread

GetLocalTime

WaitForSingleObject

GetCurrentThread

WriteFile

ExitThread

DeleteCriticalSection

GetDateFormatW

TlsGetValue

IsValidLocale

TlsSetValue

LoadLibraryExW

GetSystemDefaultUILanguage

EnumCalendarInfoW

LocalAlloc

GetCurrentThreadId

UnhandledExceptionFilter

VirtualQuery

CreateEventW

GlobalFree

VirtualQueryEx

GetThreadLocale

Sleep

SetThreadLocale

version

GetFileVersionInfoSizeW

VerQueryValueW

GetFileVersionInfoW

user32

CharUpperBuffW

CharNextW

MsgWaitForMultipleObjects

FindWindowExW

CharLowerBuffW

LoadStringW

CharUpperW

PeekMessageW

GetSystemMetrics

MessageBoxW

oleaut32

SysAllocStringLen

SafeArrayPtrOfIndex

VariantCopy

SafeArrayGetLBound

SafeArrayGetUBound

VariantInit

VariantClear

SysFreeString

SysReAllocStringLen

VariantChangeType

SafeArrayCreate

netapi32

NetWkstaGetInfo

NetApiBufferFree

advapi32

CloseServiceHandle

ControlService

CreateServiceW

LookupAccountNameW

DeleteService

LsaAddAccountRights

StartServiceW

UnlockServiceDatabase

GetServiceKeyNameW

GetServiceDisplayNameW

ChangeServiceConfigW

LsaClose

LockServiceDatabase

OpenServiceW

ChangeServiceConfig2W

EnumDependentServicesW

QueryServiceConfig2W

LsaRemoveAccountRights

QueryServiceStatus

AdjustTokenPrivileges

QueryServiceConfigW

LookupPrivilegeValueW

OpenSCManagerW

LsaOpenPolicy

OpenProcessToken

RegOpenKeyExW

RegQueryValueExW

RegCloseKey

Exports

ContinueService

ExistsService

GetErrorMessage

GetServiceBinaryPath

GetServiceDelayedAutoStartInfo

GetServiceDescription

GetServiceDisplayName

GetServiceFailure

GetServiceFailureFlag

GetServiceLogon

GetServiceName

GetServiceStartType

GetServiceStatus

GrantServiceLogonPrivilege

InstallService

PauseService

RemoveService

RemoveServiceLogonPrivilege

RestartService

ServiceIsPaused

ServiceIsRunning

ServiceIsStopped

SetServiceBinaryPath

SetServiceDelayedAutoStartInfo

SetServiceDescription

SetServiceFailure

SetServiceFailureFlag

SetServiceLogon

SetServiceStartType

StartService

StopService

TMethodImplementationIntercept

__dbk_fcall_wrapper

dbkFCallWrapperAddr

Sections

.text
Size: 956KB - Virtual size: 956KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.itext
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 25KB

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.didata
Size: 512B - Virtual size: 490B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.edata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 69B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

$PLUGINSDIR/System.dll

.dll windows:4 windows x86 arch:x86

509a34b3a68a773e0afb4259e68f9f82

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_NO_SEH

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LINE_NUMS_STRIPPED

IMAGE_FILE_LOCAL_SYMS_STRIPPED

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc

GlobalFree

GlobalSize

lstrcpynW

lstrcpyW

GetProcAddress

WideCharToMultiByte

VirtualFree

FreeLibrary

lstrlenW

LoadLibraryW

GetModuleHandleW

MultiByteToWideChar

VirtualAlloc

VirtualProtect

GetLastError

user32

wsprintfW

ole32

StringFromGUID2

CLSIDFromString

Exports

Alloc

Call

Copy

Free

Get

Int64Op

Store

StrAlloc

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 867B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 662B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/nsExec.dll

.dll windows:4 windows x86 arch:x86

68b7023f8923dd087549802f8fa631c3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_NO_SEH

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LINE_NUMS_STRIPPED

IMAGE_FILE_LOCAL_SYMS_STRIPPED

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

Imports

advapi32

SetSecurityDescriptorDacl

InitializeSecurityDescriptor

IsTextUnicode

user32

CharNextExA

CharNextW

CharPrevW

FindWindowExW

wsprintfW

SendMessageW

kernel32

GetCommandLineW

lstrcpynW

ExitProcess

GetCurrentProcess

GetModuleHandleA

GetProcAddress

Sleep

TerminateProcess

GlobalReAlloc

MultiByteToWideChar

IsDBCSLeadByteEx

ReadFile

PeekNamedPipe

GetExitCodeProcess

WaitForSingleObject

GetTickCount

lstrcpyW

CreateProcessW

GetStartupInfoW

CreatePipe

GetVersion

DeleteFileW

lstrcmpiW

lstrlenW

lstrcatW

CloseHandle

UnmapViewOfFile

MapViewOfFile

CreateFileMappingW

CreateFileW

CopyFileW

GetTempFileNameW

GlobalFree

GlobalAlloc

GetModuleFileNameW

Exports

Exec

ExecToLog

ExecToStack

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 420B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

windhawk.exe

.exe windows:6 windows x86 arch:x86

9fb86ec7ba151366804e5ce5a4d38f85

Code Sign

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

16-04-2020 18:36

Not After

16-04-2045 18:44

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:01:47:a6:31:52:5c:23:53:35:c2:56:00:00:00:01:47:a6
Certificate

Issuer

CN=Microsoft ID Verified CS AOC CA 02,O=Microsoft Corporation,C=US

Not Before

28-07-2024 21:14

Not After

31-07-2024 21:14

Subject

CN=Michael Maltsev,O=Michael Maltsev,L=Rishon LeZion,ST=Central,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:01:47:a6:31:52:5c:23:53:35:c2:56:00:00:00:01:47:a6
Certificate

Issuer

CN=Microsoft ID Verified CS AOC CA 02,O=Microsoft Corporation,C=US

Not Before

28-07-2024 21:14

Not After

31-07-2024 21:14

Subject

CN=Michael Maltsev,O=Michael Maltsev,L=Rishon LeZion,ST=Central,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:00:00:04:96:50:4b:d2:db:ee:cb:88:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Not Before

13-04-2021 17:31

Not After

13-04-2026 17:31

Subject

CN=Microsoft ID Verified CS AOC CA 02,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

01-04-2021 20:05

Not After

01-04-2036 20:15

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

19-11-2020 20:32

Not After

19-11-2035 20:42

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:00:3f:04:1a:e9:7e:6d:27:fe:eb:00:00:00:00:00:3f
Certificate

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Not Before

18-04-2024 17:59

Not After

17-04-2025 17:59

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:F5D6-96D6-909E,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

b2:3e:9d:23:fc:99:2e:34:4b:33:aa:55:75:20:2b:0b:43:f6:24:51:ba:03:65:17:1d:8d:8a:78:0c:89:78:5b
Signer

Actual PE Digest

b2:3e:9d:23:fc:99:2e:34:4b:33:aa:55:75:20:2b:0b:43:f6:24:51:ba:03:65:17:1d:8d:8a:78:0c:89:78:5b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

Imports

userenv

DestroyEnvironmentBlock

CreateEnvironmentBlock

wevtapi

EvtNext

EvtClose

EvtSubscribe

EvtCreateRenderContext

EvtRender

wtsapi32

WTSQuerySessionInformationW

WTSFreeMemory

WTSQueryUserToken

WTSEnumerateSessionsW

kernel32

OpenEventW

Sleep

WaitForMultipleObjects

GetCurrentProcess

GetCurrentProcessId

GetCurrentThreadId

CreateProcessW

OpenProcess

GetTickCount

GetTickCount64

FindResourceExW

FreeLibrary

GetModuleFileNameW

GetModuleHandleW

GetProcAddress

LoadLibraryExW

LoadResource

LockResource

SizeofResource

FindResourceW

FormatMessageW

lstrcmpiW

QueryFullProcessImageNameW

MultiByteToWideChar

CreateToolhelp32Snapshot

Process32FirstW

Process32NextW

K32GetModuleFileNameExW

LoadLibraryW

ResetEvent

CreateEventW

LCMapStringEx

GetVersionExW

GetNativeSystemInfo

LocalFree

OpenMutexW

GetProcessTimes

ProcessIdToSessionId

GetSystemTimeAsFileTime

GetWindowsDirectoryW

OpenFileMappingW

MapViewOfFile

UnmapViewOfFile

LocaleNameToLCID

SetThreadUILanguage

WaitForMultipleObjectsEx

CreateFileMappingW

DebugBreak

ReleaseSemaphore

WaitForSingleObjectEx

OpenSemaphoreW

CreateMutexExW

CreateSemaphoreExW

GetModuleFileNameA

GetModuleHandleExW

WideCharToMultiByte

ExpandEnvironmentStringsW

FindFirstChangeNotificationW

FindNextChangeNotification

GetFileSizeEx

GetFileTime

MulDiv

lstrcmpW

SetEnvironmentVariableW

GetFileAttributesW

GetFileSize

SetEndOfFile

SetFilePointer

CreateMutexW

QueryPerformanceCounter

TryAcquireSRWLockExclusive

AcquireSRWLockExclusive

ReleaseSRWLockExclusive

GetFileInformationByHandleEx

AreFileApisANSI

SetFileInformationByHandle

GetFileInformationByHandle

GetFileAttributesExW

FindNextFileW

FindFirstFileExW

FindFirstFileW

FindClose

CreateDirectoryW

GetLocaleInfoEx

FormatMessageA

LoadLibraryExA

VirtualFree

VirtualAlloc

IsProcessorFeaturePresent

FlushInstructionCache

InterlockedPushEntrySList

InterlockedPopEntrySList

InitializeSListHead

GetStringTypeW

EncodePointer

GetCPInfo

UnhandledExceptionFilter

SetUnhandledExceptionFilter

TerminateProcess

WakeAllConditionVariable

SleepConditionVariableSRW

GetStartupInfoW

RtlUnwind

InitializeCriticalSectionAndSpinCount

TlsAlloc

TlsGetValue

TlsSetValue

TlsFree

GetCommandLineA

GetCommandLineW

ExitProcess

WaitForSingleObject

ReleaseMutex

SetEvent

EnumSystemLocalesW

DeleteCriticalSection

InitializeCriticalSectionEx

LeaveCriticalSection

EnterCriticalSection

GetProcessHeap

HeapSize

HeapFree

HeapAlloc

HeapReAlloc

HeapDestroy

RaiseException

DecodePointer

IsDebuggerPresent

ReadFile

FindCloseChangeNotification

DeleteFileW

WritePrivateProfileStringW

GetPrivateProfileStringW

SetLastError

GetLastError

CloseHandle

WriteFile

CreateFileW

OutputDebugStringW

FlushFileBuffers

GetConsoleOutputCP

GetConsoleMode

SetFilePointerEx

ReadConsoleW

IsValidCodePage

GetACP

GetOEMCP

GetEnvironmentStringsW

FreeEnvironmentStringsW

SetStdHandle

WriteConsoleW

GetStdHandle

GetFileType

GetUserDefaultLCID

IsValidLocale

GetLocaleInfoW

LCMapStringW

user32

EnumWindows

IsIconic

MonitorFromWindow

SystemParametersInfoW

LoadImageW

GetWindow

GetParent

GetDesktopWindow

FillRect

GetSysColorBrush

GetSysColor

MapWindowPoints

SetCursor

GetWindowRect

GetClientRect

SetWindowTextW

RedrawWindow

InvalidateRect

ReleaseDC

GetDlgCtrlID

SetDlgItemTextW

IsWindowVisible

IsWindow

ChangeWindowMessageFilterEx

GetMonitorInfoW

MonitorFromPoint

IsDialogMessageW

GetLastActivePopup

GetClassNameW

GetCursorPos

MessageBoxW

SetForegroundWindow

TrackPopupMenu

AppendMenuW

DestroyMenu

CreatePopupMenu

KillTimer

SetTimer

MsgWaitForMultipleObjectsEx

CreateDialogParamW

SetWindowPos

ShowWindow

CallWindowProcW

PostQuitMessage

DefWindowProcW

SendMessageW

UnregisterHotKey

RegisterHotKey

RegisterWindowMessageW

GetDC

GetSystemMetrics

LoadStringW

DestroyIcon

LoadCursorW

GetWindowThreadProcessId

FindWindowW

SetWindowLongW

MessageBoxA

AllowSetForegroundWindow

CharNextW

DestroyWindow

CreateWindowExW

GetClassInfoExW

RegisterClassExW

UnregisterClassW

PostMessageW

PeekMessageW

DispatchMessageW

TranslateMessage

GetMessageW

SetUserObjectInformationW

GetWindowLongW

GetDlgItem

gdi32

CreateCompatibleDC

DeleteObject

GetDeviceCaps

DeleteDC

SelectObject

CreateCompatibleBitmap

CreatePen

Polygon

advapi32

StartServiceW

StartServiceCtrlDispatcherW

SetServiceStatus

RegisterServiceCtrlHandlerExW

QueryServiceStatusEx

OpenServiceW

OpenSCManagerW

ControlService

CloseServiceHandle

ChangeServiceConfigW

CreateProcessAsUserW

ConvertStringSecurityDescriptorToSecurityDescriptorW

LookupPrivilegeValueW

FreeSid

CheckTokenMembership

AllocateAndInitializeSid

AdjustTokenPrivileges

OpenProcessToken

RegOpenKeyExW

RegEnumKeyExW

RegDeleteKeyW

RegSetValueExW

RegQueryValueExW

RegQueryInfoKeyW

RegEnumValueW

RegDeleteValueW

RegCreateKeyExW

RegCloseKey

shell32

Shell_NotifyIconW

SetCurrentProcessExplicitAppUserModelID

ShellExecuteW

ole32

CoTaskMemAlloc

CoUninitialize

CoTaskMemRealloc

CoTaskMemFree

CoInitialize

StringFromGUID2

CoCreateInstance

CoCreateGuid

IIDFromString

oleaut32

VariantClear

VariantInit

SysAllocString

VarUI4FromStr

SysFreeString

VarI4FromStr

VarR8FromStr

VarDateFromStr

VarDecFromStr

VarDecCmp

comctl32

ord345

ord381

uxtheme

SetWindowTheme

winhttp

WinHttpCrackUrl

WinHttpQueryHeaders

WinHttpReceiveResponse

WinHttpQueryAuthSchemes

WinHttpConnect

WinHttpSendRequest

WinHttpWriteData

WinHttpReadData

WinHttpCloseHandle

WinHttpSetStatusCallback

WinHttpOpen

WinHttpOpenRequest

WinHttpAddRequestHeaders

WinHttpSetOption

WinHttpSetCredentials

Sections

.text
Size: 481KB - Virtual size: 481KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9dda1a1d1f8a1d13ae0297b47046b26e

Code Sign

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99Certificate

Key Usages

33:00:01:47:a6:31:52:5c:23:53:35:c2:56:00:00:00:01:47:a6Certificate

Extended Key Usages

Key Usages

33:00:01:47:a6:31:52:5c:23:53:35:c2:56:00:00:00:01:47:a6Certificate

Extended Key Usages

Key Usages

33:00:00:00:04:96:50:4b:d2:db:ee:cb:88:00:00:00:00:00:04Certificate

Key Usages

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07Certificate

Key Usages

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05Certificate

Extended Key Usages

Key Usages

33:00:00:00:3d:d1:9f:e2:d4:41:cd:e3:40:00:00:00:00:00:3dCertificate

Extended Key Usages

Key Usages

80:88:7c:62:a2:47:6b:9c:59:52:22:e9:1a:75:bf:c5:4b:6c:df:72:a0:04:f4:24:0e:b2:bb:4b:bc:92:a2:9cSigner

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

Sections

.text Size: 26KB - Virtual size: 25KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1KB - Virtual size: 126KB

.ndata Size: - Virtual size: 172KB

.rsrc Size: 54KB - Virtual size: 53KB

08228c24f43f2cf986fabfde584eeecf

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

cb:bf:3d:73:b5:02:21:79:28:5f:ba:16:9d:66:f0:30Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

cb:bf:3d:73:b5:02:21:79:28:5f:ba:16:9d:66:f0:30Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

3f:2f:d9:31:0d:95:86:99:7b:8b:59:5a:0c:50:f8:a3:aa:d8:c0:4c:9c:80:fc:9a:19:d5:e1:75:5e:28:73:2cSigner

e5:6d:d7:66:2a:4b:e2:82:55:d7:e9:a1:f8:d0:e5:52:34:70:45:5aSigner

Headers

DLL Characteristics

File Characteristics

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Certificate

33:00:01:47:a6:31:52:5c:23:53:35:c2:56:00:00:00:01:47:a6
Certificate

33:00:01:47:a6:31:52:5c:23:53:35:c2:56:00:00:00:01:47:a6
Certificate

33:00:00:00:04:96:50:4b:d2:db:ee:cb:88:00:00:00:00:00:04
Certificate

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Certificate

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Certificate

33:00:00:00:3d:d1:9f:e2:d4:41:cd:e3:40:00:00:00:00:00:3d
Certificate

80:88:7c:62:a2:47:6b:9c:59:52:22:e9:1a:75:bf:c5:4b:6c:df:72:a0:04:f4:24:0e:b2:bb:4b:bc:92:a2:9c
Signer

.text
Size: 26KB - Virtual size: 25KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1KB - Virtual size: 126KB

.ndata
Size: - Virtual size: 172KB

.rsrc
Size: 54KB - Virtual size: 53KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

cb:bf:3d:73:b5:02:21:79:28:5f:ba:16:9d:66:f0:30
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

cb:bf:3d:73:b5:02:21:79:28:5f:ba:16:9d:66:f0:30
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

3f:2f:d9:31:0d:95:86:99:7b:8b:59:5a:0c:50:f8:a3:aa:d8:c0:4c:9c:80:fc:9a:19:d5:e1:75:5e:28:73:2c
Signer

e5:6d:d7:66:2a:4b:e2:82:55:d7:e9:a1:f8:d0:e5:52:34:70:45:5a
Signer

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 4KB - Virtual size: 3KB

.buildid
Size: 512B - Virtual size: 53B

.data
Size: 512B - Virtual size: 132B

.eh_fram
Size: 1KB - Virtual size: 1KB

.gcc_exc
Size: 512B - Virtual size: 184B

.tls
Size: 512B - Virtual size: 8B

.reloc
Size: 1024B - Virtual size: 572B

/4
Size: 3KB - Virtual size: 3KB

/18
Size: 2KB - Virtual size: 1KB

/31
Size: 11KB - Virtual size: 10KB

/43
Size: 5KB - Virtual size: 4KB

/55
Size: 4KB - Virtual size: 4KB

/66
Size: 512B - Virtual size: 408B

/80
Size: 9KB - Virtual size: 9KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

cb:bf:3d:73:b5:02:21:79:28:5f:ba:16:9d:66:f0:30
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

cb:bf:3d:73:b5:02:21:79:28:5f:ba:16:9d:66:f0:30
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

cd:48:44:64:87:38:c0:bd:43:20:6b:65:a9:f2:7d:89:95:0e:37:6b:bf:b4:9f:3a:92:e1:ed:b3:85:60:08:14
Signer

2d:0f:fc:f7:51:8b:4c:54:7c:c0:a7:58:97:25:b2:e4:d8:65:7d:2a
Signer