1af30897308adc5597a9806f7940202676ed2a32d0b8df87e2f36a2a6b30af22.zip
- SHA256 1af30897308adc5597a9806f7940202676ed2a32d0b8df87e2f36a2a6b30af22
Overview
overview
10Static
static
3proxy.XmSP...C0.dll
windows10-2004-x64
1proxy.XmSP...83.dll
windows7-x64
3proxy.XmSP...83.dll
windows10-2004-x64
3proxy.XmSP...sg.dll
windows10-2004-x64
1proxy.XmSP...ME.dll
windows10-2004-x64
1proxy.XmSP...re.dll
windows7-x64
3proxy.XmSP...re.dll
windows10-2004-x64
3proxy.XmSP...ta.dll
windows7-x64
3proxy.XmSP...ta.dll
windows10-2004-x64
3proxy.XmSP...UN.exe
windows7-x64
10proxy.XmSP...UN.exe
windows10-2004-x64
10proxy.XmSP...on.dll
windows10-2004-x64
1proxy.XmSP...ne.dll
windows10-2004-x64
1proxy.XmSP...ss.dll
windows10-2004-x64
1proxy.XmSP...nt.dll
windows10-2004-x64
1proxy.XmSP...ib.dll
windows7-x64
3proxy.XmSP...ib.dll
windows10-2004-x64
3proxy.XmSP...ME.dll
windows10-2004-x64
1proxy.XmSP...32.dll
windows10-2004-x64
3proxy.XmSP...pi.dll
windows10-2004-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
proxy.XmSProject/0FC343C0.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
proxy.XmSProject/B7091C83.dll
Resource
win7-20241010-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
proxy.XmSProject/B7091C83.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
proxy.XmSProject/CbsMsg.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
proxy.XmSProject/DICTS/mshwchtrIME.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
proxy.XmSProject/PresentationCore/PresentationCore.dll
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
proxy.XmSProject/PresentationCore/PresentationCore.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
proxy.XmSProject/PresentationCore/System.Data.dll
Resource
win7-20240708-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
proxy.XmSProject/PresentationCore/System.Data.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
proxy.XmSProject/RUN.exe
Resource
win7-20240903-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral11
Sample
proxy.XmSProject/RUN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral12
Sample
proxy.XmSProject/mscorlib/SettingsHandlers_InputPersonalization.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
proxy.XmSProject/mscorlib/SettingsHandlers_ManagePhone.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
proxy.XmSProject/mscorlib/SettingsHandlers_WorkAccess.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
proxy.XmSProject/mscorlib/SettingsHandlers_nt.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
proxy.XmSProject/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll
Resource
win7-20241010-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
proxy.XmSProject/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral18
Sample
proxy.XmSProject/mshwkorrIME.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
proxy.XmSProject/twain_32.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral20
Sample
proxy.XmSProject/wrpintapi.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target 1af30897308adc5597a9806f7940202676ed2a32d0b8df87e2f36a2a6b30af22.zip
- Size 20.8MB
- Sample241011-blejtasepp
- SHA256 1af30897308adc5597a9806f7940202676ed2a32d0b8df87e2f36a2a6b30af22
- MD5 295cfb6ae8b388a5c8d80f874d5e8a91
- SHA1 ef9493dd22399b1874dfd311babc26b6081f7f79
- SHA512 e0000bf6829e5c4255ffbe8cd55761c4810a55fdb9ca571a9f2da4264ef90943137e95cc2625e42c0f320b0f6e9621375ed5a3021776cd10dd21ca0e0110e9ea
- SSDEEP 393216:m2pdj5VJaGomoUsR8dFMuqlLOzrYB/mcFT1MCzP1rs7XX5hDv6zIoZw7h2AyZz2c:mi1PH/cmMZl2amuOGParXXyzIoZwlapd
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 9 IoCs
Checks for missing Authenticode signature.
resource unpack001/proxy.XmSProject/DICTS/mshwchtrIME.dll unpack001/proxy.XmSProject/RUN.exe unpack001/proxy.XmSProject/mscorlib/SettingsHandlers_InputPersonalization.dll unpack001/proxy.XmSProject/mscorlib/SettingsHandlers_ManagePhone.dll unpack001/proxy.XmSProject/mscorlib/SettingsHandlers_WorkAccess.dll unpack001/proxy.XmSProject/mscorlib/SettingsHandlers_nt.dll unpack001/proxy.XmSProject/mshwkorrIME.dll unpack001/proxy.XmSProject/twain_32.dll unpack001/proxy.XmSProject/wrpintapi.dll
File Explorer
-
1af30897308adc5597a9806f7940202676ed2a32d0b8df87e2f36a2a6b30af22.zip.zip 20.8MB
-
proxy.XmSProject/0FC343C0.dll.dll 185KB
-
proxy.XmSProject/B7091C83.dll.dll 5.3MB
-
proxy.XmSProject/CbsMsg.dll.dll 53KB
-
proxy.XmSProject/DICTS/mshwchtrIME.dll.dll 7.1MB
-
proxy.XmSProject/PresentationCore/PresentationCore.dll.dll 3.6MB
-
proxy.XmSProject/PresentationCore/System.Data.dll.dll 3.3MB
-
proxy.XmSProject/RUN.exe.exe 1.5MB
-
proxy.XmSProject/mscorlib/SettingsHandlers_InputPersonalization.dll.dll 331KB
-
proxy.XmSProject/mscorlib/SettingsHandlers_ManagePhone.dll.dll 299KB
-
proxy.XmSProject/mscorlib/SettingsHandlers_WorkAccess.dll.dll 437KB
-
proxy.XmSProject/mscorlib/SettingsHandlers_nt.dll.dll 3.4MB
-
proxy.XmSProject/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll.dll 5.5MB
-
proxy.XmSProject/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/normidna.nlp57KB
-
proxy.XmSProject/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/normnfc.nlp45KB
-
proxy.XmSProject/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/normnfd.nlp39KB
-
proxy.XmSProject/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/normnfkc.nlp66KB
-
proxy.XmSProject/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/normnfkd.nlp60KB
-
proxy.XmSProject/mshwkorrIME.dll.dll 7.0MB
-
proxy.XmSProject/twain_32.dll.dll 63KB
-
proxy.XmSProject/wrpintapi.dll.dll 14KB
proxy.XmSProject/0FC343C0.dll
- IMPHASH 482ab440211976ea17ec54e3ce97e53d
- SHA256 58832b5533b8b0f44ff523c921dcd795c0c461cb89cbd92e808e856e864a55b3
- MD5 8a3d01666b5298d61b015e693747f5a9
- SHA1 34c46fa33d7b582839e4c2fd9a80ac0c22485d83
- SHA512 688e636ee3d06d575e71c0a6bc70a737bbfee395c3ff8858dc557911d15baead1d1fad6a37555b9a1472b40bd84bfca07487ab894b30442e008cafa6bdc03aab
- SSDEEP 3072:+qDD5P+vXIZX1LXHuYGCTMDxHHI4fyj1yCnmh2m5sHrE8VW:HAvyXHuYGCTMD5IX1yimh2m5sHro
- MD5 SHA1 SHA512 SSDEEP
Digest
3e:06:22:26:1f:ee:f9:26:5d:26:d2:90:b9:f6:6b:3e:d3:12:9f:16:11:0e:8c:d6:25:ac:11:4b:c4:d6:bd:f9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 9, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Minor OS version
0
Major OS version
10
Entry point
5328
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
imm32.pdb
user32
GetKeyboardLayout
IsWindow
SendMessageW
WCSToMBEx
PostMessageA
PostMessageW
SendMessageA
GetWindowThreadProcessId
GetKeyboardLayoutList
GetClassInfoW
LoadKeyboardLayoutW
GetFocus
GetActiveWindow
User32InitializeImmEntryTable
CharUpperW
UnloadKeyboardLayout
ord2521
LoadBitmapW
SetWindowLongPtrW
GetClientRect
GetDC
ReleaseDC
GetWindowLongPtrW
GetWindow
DrawTextExW
GetSystemMetrics
GetWindowRect
SetCapture
MessageBeep
SetCursor
LoadCursorW
GetCursorPos
ScreenToClient
ReleaseCapture
SetWindowPos
keybd_event
BeginPaint
EndPaint
DefWindowProcW
InvalidateRect
DrawEdge
GetCapture
GetParent
GetClassInfoExW
LoadIconW
RegisterClassExW
SystemParametersInfoW
MonitorFromWindow
GetMonitorInfoW
MapVirtualKeyW
CreateWindowExW
ShowWindow
UpdateWindow
DestroyWindow
GetKeyboardState
ToUnicode
ToAsciiEx
ClientToScreen
MapWindowPoints
GetForegroundWindow
IsWindowUnicode
CharNextA
CharNextW
GetDesktopWindow
SendMessageTimeoutW
ntdll
RtlDllShutdownInProgress
RtlUnicodeStringToInteger
RtlUnicodeToMultiByteSize
RtlVirtualUnwind
RtlCaptureContext
RtlIntegerToUnicodeString
memcpy
memcmp
memset
RtlInitializeCriticalSection
__C_specific_handler
wcstol
RtlEnterCriticalSection
RtlLeaveCriticalSection
_vsnwprintf
_wcsicmp
RtlIsThreadWithinLoaderCallout
RtlLookupFunctionEntry
RtlSetLastWin32Error
NtQuerySystemInformation
RtlDeleteCriticalSection
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
TerminateProcess
CreateThread
GetCurrentProcess
api-ms-win-core-heap-l2-1-0
GlobalFree
LocalFree
LocalLock
GlobalAlloc
LocalUnlock
LocalAlloc
LocalReAlloc
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-localization-l1-2-0
GetLocaleInfoW
IsDBCSLeadByteEx
GetThreadLocale
GetACP
GetSystemDefaultLCID
IsDBCSLeadByte
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
FreeLibrary
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
api-ms-win-core-processthreads-l1-1-1
GetProcessMitigationPolicy
api-ms-win-core-registry-l1-1-0
RegDeleteKeyExW
RegEnumKeyExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
api-ms-win-core-wow64-l1-1-1
GetSystemWow64DirectoryW
api-ms-win-core-sysinfo-l1-1-0
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-file-l1-1-0
GetFullPathNameW
CreateFileW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-errorhandling-l1-1-0
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
api-ms-win-core-memory-l1-1-0
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
OpenFileMappingW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-security-base-l1-1-0
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
api-ms-win-security-base-l1-2-0
CheckTokenMembershipEx
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-kernel32-legacy-l1-1-0
OpenFile
api-ms-win-core-string-obsolete-l1-1-0
lstrlenA
lstrcmpW
lstrlenW
api-ms-win-core-heap-obsolete-l1-1-0
GlobalSize
GlobalUnlock
GlobalLock
LocalFlags
LocalSize
api-ms-win-core-privateprofile-l1-1-0
GetProfileIntW
api-ms-win-core-appcompat-l1-1-0
BaseCheckAppcompatCache
win32u
NtUserSetAppImeLevel
NtUserGetAppImeLevel
NtUserGetImeInfoEx
NtUserUpdateInputContext
NtUserDisableThreadIme
NtUserSetThreadLayoutHandles
NtUserSetImeInfoEx
NtUserGetImeHotKey
NtUserBuildHimcList
NtUserQueryInputContext
NtUserNotifyIMEStatus
NtUserQueryWindow
NtUserAssociateInputContext
NtUserCallOneParam
NtUserValidateHandleSecure
NtUserGetThreadState
NtUserCreateInputContext
NtUserDestroyInputContext
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
CtfImmAppCompatEnableIMEonProtectedCode
CtfImmCoUninitialize
CtfImmDispatchDefImeMessage
CtfImmEnterCoInitCountSkipMode
CtfImmGenerateMessage
CtfImmGetCompatibleKeyboardLayout
CtfImmGetGlobalIMEStatus
CtfImmGetGuidAtom
CtfImmGetIMEFileName
CtfImmGetTMAEFlags
CtfImmHideToolbarWnd
CtfImmIsCiceroEnabled
CtfImmIsCiceroStartedInThread
CtfImmIsComStartedInThread
CtfImmIsGuidMapEnable
CtfImmIsTextFrameServiceDisabled
CtfImmLastEnabledWndDestroy
CtfImmLeaveCoInitCountSkipMode
CtfImmNotify
CtfImmRestoreToolbarWnd
CtfImmSetAppCompatFlags
CtfImmSetCiceroStartInThread
CtfImmSetDefaultRemoteKeyboardLayout
CtfImmTIMActivate
GetKeyboardLayoutCP
ImmActivateLayout
ImmAssociateContext
ImmAssociateContextEx
ImmCallImeConsoleIME
ImmConfigureIMEA
ImmConfigureIMEW
ImmCreateContext
ImmCreateIMCC
ImmCreateSoftKeyboard
ImmDestroyContext
ImmDestroyIMCC
ImmDestroySoftKeyboard
ImmDisableIME
ImmDisableIme
ImmDisableLegacyIME
ImmDisableTextFrameService
ImmEnumInputContext
ImmEnumRegisterWordA
ImmEnumRegisterWordW
ImmEscapeA
ImmEscapeW
ImmFreeLayout
ImmGenerateMessage
ImmGetAppCompatFlags
ImmGetCandidateListA
ImmGetCandidateListCountA
ImmGetCandidateListCountW
ImmGetCandidateListW
ImmGetCandidateWindow
ImmGetCompositionFontA
ImmGetCompositionFontW
ImmGetCompositionStringA
ImmGetCompositionStringW
ImmGetCompositionWindow
ImmGetContext
ImmGetConversionListA
ImmGetConversionListW
ImmGetConversionStatus
ImmGetDefaultIMEWnd
ImmGetDescriptionA
ImmGetDescriptionW
ImmGetGuideLineA
ImmGetGuideLineW
ImmGetHotKey
ImmGetIMCCLockCount
ImmGetIMCCSize
ImmGetIMCLockCount
ImmGetIMEFileNameA
ImmGetIMEFileNameW
ImmGetImeInfoEx
ImmGetImeMenuItemsA
ImmGetImeMenuItemsW
ImmGetOpenStatus
ImmGetProperty
ImmGetRegisterWordStyleA
ImmGetRegisterWordStyleW
ImmGetStatusWindowPos
ImmGetVirtualKey
ImmIMPGetIMEA
ImmIMPGetIMEW
ImmIMPQueryIMEA
ImmIMPQueryIMEW
ImmIMPSetIMEA
ImmIMPSetIMEW
ImmInstallIMEA
ImmInstallIMEW
ImmIsIME
ImmIsUIMessageA
ImmIsUIMessageW
ImmLoadIME
ImmLoadLayout
ImmLockClientImc
ImmLockIMC
ImmLockIMCC
ImmLockImeDpi
ImmNotifyIME
ImmProcessKey
ImmPutImeMenuItemsIntoMappedFile
ImmReSizeIMCC
ImmRegisterClient
ImmRegisterWordA
ImmRegisterWordW
ImmReleaseContext
ImmRequestMessageA
ImmRequestMessageW
ImmSendIMEMessageExA
ImmSendIMEMessageExW
ImmSetActiveContext
ImmSetActiveContextConsoleIME
ImmSetCandidateWindow
ImmSetCompositionFontA
ImmSetCompositionFontW
ImmSetCompositionStringA
ImmSetCompositionStringW
ImmSetCompositionWindow
ImmSetConversionStatus
ImmSetHotKey
ImmSetOpenStatus
ImmSetStatusWindowPos
ImmShowSoftKeyboard
ImmSimulateHotKey
ImmSystemHandler
ImmTranslateMessage
ImmUnlockClientImc
ImmUnlockIMC
ImmUnlockIMCC
ImmUnlockImeDpi
ImmUnregisterWordA
ImmUnregisterWordW
ImmWINNLSEnableIME
ImmWINNLSGetEnableStatus
ImmWINNLSGetIMEHotkey
Name
.text
Size
122KB
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
504B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
228B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=52, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=257, version=27412,
count=246, id=1, productName=Unmarked objects,
count=9, id=260, version=27412,
count=2, id=259, version=27412,
count=1, id=256, version=27412,
count=29, id=269, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
proxy.XmSProject/B7091C83.dll
- IMPHASH d811d71710ad58776155b7a8da1fa9db
- SHA256 126eca08930ad2fafe002a1f00c024193b20974519e77a7abe22e509b469d858
- MD5 aa1be9b9e40060a624164b01eaa6e55c
- SHA1 6c8cca8965b325f17989d83be13c099bab4c0824
- SHA512 f1dccb50b186c004389556dbc9bd0f68cc446494a28a896199bd555ef0bd0fc71bd003c5b0d3b8134f92a2e6ab6248ee21d447ecfdb81ef38aa2b92624b213c2
- SSDEEP 98304:RtT7NoG8VgjPsRLoLvPNdVWoI69knRedI:RteSsdoxWOknRedI
- MD5 SHA1 SHA512 SSDEEP
Digest
fd:2c:73:70:89:f7:1d:34:a8:2c:2c:64:43:2e:d5:02:3b:da:7d:bb:77:d3:65:05:c0:83:20:24:4f:76:09:5b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=SoftEther Corporation,O=SoftEther Corporation,ST=Ibaraki,C=JP
Chains
Aug 31, 2023
CN=SoftEther Corporation,O=SoftEther Corporation,ST=Ibaraki,C=JP
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Digest
d8:43:8b:ae:65:fd:2d:6c:1d:2f:59:c9:07:da:65:04:8c:ae:aa:c1
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=SoftEther Corporation,O=SoftEther Corporation,ST=Ibaraki,C=JP
Chains
Aug 31, 2023
CN=SoftEther Corporation,O=SoftEther Corporation,ST=Ibaraki,C=JP
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=SoftEther Corporation,O=SoftEther Corporation,ST=Ibaraki,C=JP
Serial Number
f1:8d:45:d8:09:2f:ce:7d:83:51:fc:ac:cc:cb:5c:35
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 6, 2023 - Jan 5, 2026
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=SoftEther Corporation,O=SoftEther Corporation,ST=Ibaraki,C=JP
Serial Number
f1:8d:45:d8:09:2f:ce:7d:83:51:fc:ac:cc:cb:5c:35
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 6, 2023 - Jan 5, 2026
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
5
Entry point
4836
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\tmp\softether_build_dir\Main\DebugFiles\pdb\Win32_Release\PenCore.pdb
kernel32
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
WriteFile
LeaveCriticalSection
EnterCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LoadLibraryA
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5.2MB
Virtual Size
5.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=125, productName=VS2005 build 50727, version=50727,
count=25, id=110, productName=VS2005 build 50727, version=50727,
count=72, id=109, productName=VS2005 build 50727, version=50727,
count=3, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=75, id=1, productName=Unmarked objects,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=151,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
proxy.XmSProject/CbsMsg.dll
- IMPHASH 3a6fd3b46b76f3ce7178b2e11f50b05a
- SHA256 c8d8885e53c0396d441344a9bc996964b28caef4805bf7e2978f1b96bc2d0fa3
- MD5 a58a5aca4fcf07434202bd4decf0dfed
- SHA1 290abf765b488fc89a0fc63e638b2a7bbf267d21
- SHA512 349f27bcf01a57c81f92865165b93360f6c2c150f881ae6ee3093dd6e6ed8507e67f50632715f994b250466b861bf8cdf9a0b5c773e7f70f1a780a4420c81349
- SSDEEP 768:W9F+BgRT7gcMp3MBWm21P8dDwER9zVY69X:Wn+UT7gf3ZDP8dNzy69X
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
3d:75:de:d0:b9:ac:94:38:c0:57:50:1c:5a:8a:d4:3b:fd:45:7a:05:ac:78:a3:da:a2:7c:5d:64:c8:c1:bc:c7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 9, 2024
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 3, 2023 - Feb 1, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Minor OS version
0
Major OS version
10
Entry point
5104
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
cbsmsg.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___std_type_info_destroy_list
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
__C_specific_handler
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-libraryloader-l1-1-0
DisableThreadLibraryCalls
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
396B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
28B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=25, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1058, id=1, productName=Unmarked objects,
count=1, id=259, version=27412,
count=7, id=260, version=27412,
count=1, id=264, version=27412,
count=1, id=256, version=27412,
count=13, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
proxy.XmSProject/DICTS/mshwchtrIME.dll
- SHA256 25f3237a5c72a87625fc90eef7859ea1bfbd041150befad7483c697aac20d872
- MD5 df0257dfb0f880e0d550174a3377ab6e
- SHA1 27dcbbe2bcfcd67774be04d4fd05fdc4ababe77f
- SHA512 2e9e3e4ec6b381ec97f337a2c212b0668f46b4f7b9a39264ced0d76197d67e4099408924be8f04d3a04e35a967f6861dec9931f9fcb8c7b09717bf6bb5a9fa4f
- SSDEEP 98304:85fUB7+6mFZEcw1xCHyvM7rveXaoL4/5ob:sUhlkLaxCSokapRob
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
7.0MB
Virtual Size
7.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
proxy.XmSProject/PresentationCore/PresentationCore.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0831ef1b10ec42bc941c86504d5d7ef24654d469e4a97ccf9b3ac7070d74ba6c
- MD5 a40fc39482b6f65c06cf0417643d8131
- SHA1 b148b13094a841134051f6c968613c92124cdebc
- SHA512 da263ddc4d881bc562ab5b76424645747ceac8de6f086d3fd51b4d6d4238281e5ba7fe007d823c53f9733e8831672b1924a70fca44357f955ef69e0270004a26
- SSDEEP 24576:wnkHcjsgvz/CXn04pV4HOAX03xHr37AOyLL24w+MF9jC649AF615VlUSrIJH9RAf:wKc4gv+V4RKHr37StqCXAI0uNHI
- MD5 SHA1 SHA512 SSDEEP
Digest
4f:ca:31:93:6d:5d:76:77:e4:ac:c1:b2:59:02:02:22:99:b2:21:9f:8e:88:f6:b1:3f:c3:00:49:2c:3b:b2:66
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 9, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:af
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
6032
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
PresentationCore.pdb
mscoree
_CorDllMain
Name
.text
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
151KB
Virtual Size
150KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
proxy.XmSProject/PresentationCore/System.Data.dll
- IMPHASH 025065f1f653f3ecea3431275b0ac9ea
- SHA256 a2e9a2caec0547767219ddb6a9891458d125bf27c63f27074e038c7266046ae1
- MD5 83a2b80e3da259deb5e9c5fa94f9bd4a
- SHA1 e0bac10318e87746486d0d18bf699472277829ac
- SHA512 04ac56038159af5e7f48e161b1b6bda80e25d7a89b0c6f7a8b4ad168bef5b4f7b8a7138cc1efe537bad16c4244682972a20f9f331a3241c51c6f0494e8a79c05
- SSDEEP 49152:VaAygWgelDp0nh0dibjHms52Ng9fUNLs2l68ezWm6/6GSeHLnK+cgioq/5AeC8C:Vh43E3EK7mvg02/z
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
b2:73:10:01:aa:6c:8c:0d:ec:b0:3b:a2:6d:7f:b0:35:83:6e:4b:4f:45:7c:4a:c6:b5:ed:80:35:d7:c0:de:d5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 9, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 16, 2023 - Mar 14, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
3403532
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Data.pdb
advapi32
IsTokenRestricted
RegQueryInfoKeyA
RegEnumKeyExA
RegCreateKeyExA
CryptDestroyKey
CryptReleaseContext
RegQueryValueExA
RegOpenKeyExW
RegOpenKeyExA
RegCloseKey
RevertToSelf
RegQueryValueExW
ImpersonateNamedPipeClient
kernel32
GetDriveTypeW
GetFullPathNameW
OutputDebugStringW
VirtualQuery
GetModuleFileNameW
LoadLibraryW
lstrcpynW
lstrlenW
SystemTimeToFileTime
GlobalAlloc
Sleep
DeleteCriticalSection
CloseHandle
InitializeCriticalSection
CreateSemaphoreA
GetLastError
SetLastError
ReleaseSemaphore
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
ExpandEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
VerSetConditionMask
SearchPathW
GetQueuedCompletionStatus
PostQueuedCompletionStatus
SetEvent
CreateEventW
WaitForMultipleObjects
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
CreateThread
GetTickCount
GetSystemDirectoryA
GetVersionExW
LoadLibraryA
GetComputerNameW
VerifyVersionInfoW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
CompareStringW
CompareStringA
LCMapStringW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FormatMessageA
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
GetProcAddress
CreateFileW
ReadFile
WriteFile
DisconnectNamedPipe
SetNamedPipeHandleState
PeekNamedPipe
WaitNamedPipeW
GetOverlappedResult
SetFileCompletionNotificationModes
SetHandleInformation
CreateSemaphoreW
LCMapStringA
LCMapStringEx
CreateIoCompletionPort
vcruntime140_clr0400
_purecall
__std_type_info_destroy_list
strchr
wcschr
__current_exception_context
__current_exception
memcpy
__CxxFrameHandler3
memcmp
__FrameUnwindFilter
_except_handler4_common
__std_terminate
memmove
memset
ucrtbase_clr0400
__stdio_common_vsprintf
terminate
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
free
_initterm_e
_atoi_l
_wcsnicmp_l
srand
atoi
_wdupenv_s
strncmp
_stricmp
_wcsicmp
_initterm
malloc
_callnewh
_wtoi_l
_wtoi
_wcsnicmp
wcsncmp
wcsncpy_s
wmemmove_s
__stdio_common_vswprintf
_wcsicmp_l
_errno
abort
_invalid_parameter_noinfo
_time64
wcsspn
ws2_32
WSAPoll
GetNameInfoW
__WSAFDIsSet
closesocket
htonl
htons
recv
select
sendto
setsockopt
socket
WSAStartup
WSACleanup
WSAGetLastError
WSAStringToAddressA
GetAddrInfoW
FreeAddrInfoW
bind
connect
getpeername
getsockname
ntohs
shutdown
WSAEnumProtocolsW
WSAIoctl
WSARecv
WSASend
WSAStringToAddressW
crypt32
CertFreeCertificateContext
CertGetNameStringW
CertGetCertificateChain
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
user32
CharNextW
CharNextExA
CharNextA
rpcrt4
UuidCreate
ole32
CoUninitialize
CoInitializeEx
mscoree
_CorDllMain
DllBidScopeEnterCW
DllBidTraceCW
_DllBidAssert@12
_DllBidCtlProc@24
_DllBidEnabledW@16
_DllBidEntryPoint@36
_DllBidFinalize@0
_DllBidIndent@8
_DllBidInitialize@0
_DllBidPutStrW@16
_DllBidScopeLeave@16
_DllBidSnap@16
_DllBidTouch@20
Name
.text
Size
3.3MB
Virtual Size
3.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.sdbid
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=260, version=29395,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=4, id=257, version=30034,
count=12, id=260, version=30034,
count=1, id=259, version=30034,
count=21, id=257, version=29395,
count=232, id=1, productName=Unmarked objects,
count=23, id=261, version=30034,
count=23, id=261, productName=VS2019 v16.11.5 build 30136, version=30136,
count=1, id=266, version=30136,
count=1, id=256, productName=VS2019 v16.11.5 build 30136, version=30136,
count=1, id=255, productName=VS2019 v16.11.5 build 30136, version=30136,
count=1, id=258, productName=VS2019 v16.11.5 build 30136, version=30136,
proxy.XmSProject/RUN.exe
- IMPHASH bd57c285d6a5e2a5490823348902be43
- SHA256 7c2f43b18bb5f18cb9b8967323a3c68befff6fbf8dceae39f786e8152f493a65
- MD5 80fb69110342f1a031b10484ea356055
- SHA1 70a77fd61066eaf936feec994301f1c3693c7a28
- SHA512 bfacbb61f1c68e0b4e5d7a249512f839933377acb0070d865d202947e948a7e74f84cc55618adfb34a205f8de466ee43962f087aaa27beac5d09f57497783d23
- SSDEEP 24576:K9hSDFEfJ3HW802gQzSMZs8A+xoZYqPLYnNBa1ndKFyzqxVAPI4WTG+G0lzOp91v:K9hMFEfVHW802gQmMZs8A+uX0nNBvFy5
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5280
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
DeleteCriticalSection
EnterCriticalSection
FormatMessageA
FreeLibrary
GetCurrentProcess
GetExitCodeProcess
GetLastError
GetModuleHandleW
GetProcAddress
GetStartupInfoA
GetThreadId
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryW
LocalFree
MultiByteToWideChar
Process32First
Process32Next
RaiseException
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetLastError
SetUnhandledExceptionFilter
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WideCharToMultiByte
msvcrt
__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_commode
_errno
_fmode
_initterm
_onexit
_strlwr
abort
calloc
exit
fprintf
fputc
fputs
free
fwrite
getenv
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
realloc
remove
signal
strchr
strcmp
strcpy_s
strerror
strlen
strncmp
strstr
strtoul
vfprintf
wcslen
_read
Name
.text
Size
244KB
Virtual Size
243KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
560B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
proxy.XmSProject/mscorlib/SettingsHandlers_InputPersonalization.dll
- IMPHASH b1ed2f734ce31b7a7587324d68b842c5
- SHA256 a52795d441653748f8769281235017fadeb52b1a9846e4022e5e0411cbee6419
- MD5 2fe68dcb804879afb1213f99830ee39c
- SHA1 7eafdd8c19cacbc0ecf009a8ea6ddfd59bcbab90
- SHA512 bc3aff446edaafac9a75dee79de37ca371d80856b0e1955f679a0cf8cd8cfcef1ea928fe69643cbb4152c7d3d8c7519524903b42047728679ff356ee7c37e17c
- SSDEEP 6144:qyc/k1NugdBxoouvr+dTMywX4OZWLMHr/xgq7ZTAV4qRE04uUsmk6:3c/kvuQBxoo8idTv1NMHzxgq7mRE0/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
208384
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
SettingsHandlers_InputPersonalization.pdb
msvcrt
realloc
strcspn
__ExceptionPtrDestroy
_purecall
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
__ExceptionPtrCurrentException
__ExceptionPtrRethrow
??0bad_cast@@QEAA@AEBV0@@Z
localeconv
_vsnprintf_s
memmove_s
sprintf_s
fputc
fflush
fclose
fgetc
fwrite
fgetpos
setvbuf
ungetc
fsetpos
_fseeki64
_wcsicmp
_errno
_callnewh
setlocale
_CxxThrowException
memcpy
memmove
__uncaught_exception
??0bad_cast@@QEAA@PEBD@Z
__ExceptionPtrCopy
??1bad_cast@@UEAA@XZ
___lc_codepage_func
calloc
___mb_cur_max_func
_ismbblead
_wcsdup
__crtLCMapStringW
__crtLCMapStringA
_wsetlocale
fseek
_wfsopen
islower
abort
memset
memcmp
??1type_info@@UEAA@XZ
isupper
__CxxFrameHandler3
__ExceptionPtrCreate
memcpy_s
_onexit
__dllonexit
_unlock
_vsnwprintf
___lc_handle_func
_lock
?terminate@@YAXXZ
??_V@YAXPEAX@Z
__C_specific_handler
_initterm
malloc
__pctype_func
free
_amsg_exit
_XcptFilter
bsearch_s
??3@YAXPEAX@Z
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
GetModuleHandleW
GetModuleFileNameA
LoadLibraryExA
GetProcAddress
GetModuleHandleExW
DisableThreadLibraryCalls
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsCreateString
WindowsCreateStringReference
WindowsDuplicateString
WindowsGetStringRawBuffer
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
RoTransformError
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
LeaveCriticalSection
ReleaseMutex
WaitForSingleObject
WaitForSingleObjectEx
ResetEvent
AcquireSRWLockShared
ReleaseSemaphore
InitializeSRWLock
ReleaseSRWLockShared
ReleaseSRWLockExclusive
EnterCriticalSection
CreateMutexExW
InitializeCriticalSectionEx
DeleteCriticalSection
CreateEventW
CreateEventExW
SetEvent
OpenSemaphoreW
SleepEx
CreateSemaphoreExW
api-ms-win-core-synch-l1-2-0
WakeAllConditionVariable
InitOnceBeginInitialize
InitOnceExecuteOnce
Sleep
InitOnceComplete
SleepConditionVariableSRW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
OpenThreadToken
CreateThread
GetCurrentThread
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount
GetSystemDirectoryW
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
SetLastError
SetUnhandledExceptionFilter
RaiseException
api-ms-win-security-base-l1-1-0
RevertToSelf
IsValidSid
ImpersonateLoggedOnUser
GetTokenInformation
api-ms-win-core-file-l1-1-0
CreateFileW
FindClose
GetFileAttributesW
FindNextFileW
GetDriveTypeW
WriteFile
ReadFile
CreateDirectoryW
GetFileSizeEx
FindFirstFileExW
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CreateThreadpoolWork
CloseThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolTimer
api-ms-win-core-threadpool-legacy-l1-1-0
QueueUserWorkItem
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-com-l1-1-0
CoUninitialize
CoCreateInstance
CoWaitForMultipleHandles
CoInitializeEx
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoGetMalloc
CoDecrementMTAUsage
CoIncrementMTAUsage
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegCloseKey
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer
api-ms-win-core-winrt-error-l1-1-1
RoReportFailedDelegate
IsErrorPropagationEnabled
RoGetMatchingRestrictedErrorInfo
api-ms-win-core-winrt-l1-1-0
RoInitialize
RoGetActivationFactory
RoUninitialize
api-ms-win-shcore-obsolete-l1-1-0
SHStrDupW
api-ms-win-core-localization-l1-2-0
FormatMessageW
LocaleNameToLCID
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-registry-l1-1-1
RegDeleteKeyValueW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
ext-ms-win-shell32-shellfolders-l1-1-0
SHGetKnownFolderPath
api-ms-win-shcore-thread-l1-1-0
SHCreateThread
api-ms-win-core-shlwapi-legacy-l1-1-0
PathIsPrefixW
PathFileExistsW
PathIsUNCW
PathAppendW
PathGetDriveNumberW
PathFindNextComponentW
PathCombineW
ntdll
RtlIsMultiSessionSku
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
api-ms-win-core-shlwapi-obsolete-l1-1-0
StrStrIW
api-ms-win-core-memory-l1-1-0
VirtualQuery
VirtualProtect
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
profapi
ord104
GetSetting
Name
.text
Size
222KB
Virtual Size
222KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
86KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=86, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=27412,
count=272, id=1, productName=Unmarked objects,
count=3, id=257, version=27412,
count=25, id=261, version=27412,
count=60, id=260, version=27412,
count=1, id=256, version=27412,
count=13, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
proxy.XmSProject/mscorlib/SettingsHandlers_ManagePhone.dll
- IMPHASH d0cb94157f279cdb57d7e3c1d820c74a
- SHA256 47db47684cb533239b5d1ab667e307bdcbeafef4336dddee3ee80b25916d9f7f
- MD5 6f186dad5e59ee35373e9c3276a83693
- SHA1 e0efa75d1a8c8417b58af954a097d354cf652127
- SHA512 f5432134057773406b76342af1d16537ba75543919f1f3318ab5d14931e00229fa6d0a56a6647fcde5df9269dba3a5bb840153b8bc156e8295ceb72c69f8bc1f
- SSDEEP 3072:RlGIwzVYbiZP4AMWWakLPXnDz1MTvtVrXwszBZNun65Z+vAfODa42jS0lq6xeJaG:nimGZP4A8LVMTvtKszlun6iW7N50Jv
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
195040
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
SettingsHandlers_ManagePhone.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__get_errno
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
memmove
_o_bsearch_s
_o_free
_o_iswspace
_o_malloc
_o_realloc
_o_terminate
_o_wcsncpy_s
__C_specific_handler
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler3
_CxxThrowException
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
wcscspn
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
MultiByteToWideChar
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
GetModuleHandleW
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
WindowsGetStringLen
WindowsCompareStringOrdinal
WindowsDuplicateString
WindowsCreateString
WindowsPromoteStringBuffer
WindowsDeleteStringBuffer
WindowsPreallocateStringBuffer
WindowsGetStringRawBuffer
WindowsDeleteString
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedPushEntrySList
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
kernel32
InitializeCriticalSectionEx
AcquireSRWLockShared
ReleaseSRWLockShared
SetThreadpoolTimer
CreateSemaphoreExW
LeaveCriticalSection
WaitForSingleObject
ReleaseSemaphore
OpenSemaphoreW
SetLastError
ReleaseMutex
GetPackagesByPackageFamily
WaitForThreadpoolTimerCallbacks
CreateThreadpoolWait
CloseThreadpoolTimer
VerifyVersionInfoW
VerSetConditionMask
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
DebugBreak
GetModuleFileNameA
CreateEventExW
ExpandEnvironmentStringsW
WaitForSingleObjectEx
HeapAlloc
GetProcessHeap
HeapFree
FindStringOrdinal
CreateMutexExW
FreeLibrary
FindResourceExW
LoadResource
LockResource
GetProcAddress
AcquireSRWLockExclusive
QueueUserWorkItem
GetModuleHandleExW
GetCurrentThread
ReleaseSRWLockExclusive
GetLastError
FormatMessageW
OutputDebugStringW
CompareStringA
CloseHandle
DeleteCriticalSection
ResetEvent
RaiseException
CreateThreadpoolTimer
CreateThread
InitOnceComplete
InitializeSRWLock
InitOnceBeginInitialize
SetEvent
CreateEventW
EnterCriticalSection
advapi32
RegSetValueExW
RegGetValueW
EventRegister
EventSetInformation
EventUnregister
EventWriteTransfer
OpenThreadToken
RevertToSelf
ImpersonateLoggedOnUser
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegCreateKeyExW
EventActivityIdControl
RegNotifyChangeKeyValue
RegSetKeyValueW
ole32
CoCreateFreeThreadedMarshaler
CoWaitForMultipleHandles
CoDecrementMTAUsage
CoInitializeEx
CoUninitialize
CoIncrementMTAUsage
CoTaskMemFree
CoTaskMemAlloc
CoGetMalloc
CoTaskMemRealloc
CoCreateInstance
CoGetClassObject
shlwapi
SHStrDupW
ord16
secur32
GetUserNameExW
msvcp_win
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z
?_Incref@facet@locale@std@@UEAAXXZ
?in@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
?_Xlength_error@std@@YAXPEBD@Z
??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
api-ms-win-core-winrt-error-l1-1-0
GetRestrictedErrorInfo
RoOriginateError
SetRestrictedErrorInfo
RoTransformError
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoGetActivationFactory
RoUninitialize
RoInitialize
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate
RoOriginateLanguageException
IsErrorPropagationEnabled
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolGetUniqueContext
SHTaskPoolQueueTask
shcore
ord190
oleaut32
SysFreeString
SysStringLen
api-ms-win-core-com-l1-1-0
CoGetObjectContext
api-ms-win-core-com-l1-1-1
RoGetAgileReference
GetSetting
Name
.text
Size
208KB
Virtual Size
208KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
70KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=59, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=260, version=27412,
count=3, id=259, version=27412,
count=1225, id=1, productName=Unmarked objects,
count=4, id=257, version=27412,
count=1, id=256, version=27412,
count=21, id=264, version=27412,
count=29, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
proxy.XmSProject/mscorlib/SettingsHandlers_WorkAccess.dll
- IMPHASH f0058412f3431590bb1827e4300affd4
- SHA256 8162b5cfde31f9ce630459624a2051f88427a9ec79a860ad74a6c60c13b7b6ad
- MD5 219db4095e0f1f0fb69768d1faa5b2da
- SHA1 acc4880b23eaabbda5608ae35a8eec4f94b888d6
- SHA512 165bb9085336a0cdb1a3d1265ab00da2d7d7e498255a415529bf330ea9bd27008fb5e85b72f33b06727c31d8c2891b8a1778bc2839db643f42c4617567d2c636
- SSDEEP 6144:1V3F725fEgAUeEN5g9XsavS3cDGj4WmDVqRVCmFXG+v7gVGc4/OiG:bk58fUn0XJvS3J1M+zqGc4Gi
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
313040
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
SettingsHandlers_WorkAccess.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__get_errno
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__wcsnicmp
memmove
_o_bsearch_s
_o_free
_o_malloc
_o_realloc
_o_terminate
_o_toupper
_o_wcscat_s
_o_wcscpy_s
_o_wmemcpy_s
__C_specific_handler
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
wcsstr
strchr
wcsrchr
wcschr
__CxxFrameHandler3
_CxxThrowException
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
wcscmp
memset
wcsnlen
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
LockResource
SizeofResource
FreeLibrary
LoadLibraryExW
GetModuleHandleW
FindResourceExW
LoadResource
GetModuleHandleExW
GetModuleFileNameA
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
LeaveCriticalSection
CreateMutexExW
EnterCriticalSection
WaitForSingleObjectEx
WaitForMultipleObjectsEx
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseMutex
CreateEventExW
WaitForSingleObject
SetEvent
ReleaseSemaphore
OpenSemaphoreW
DeleteCriticalSection
CreateSemaphoreExW
InitializeCriticalSectionEx
InitializeSRWLock
ResetEvent
CreateEventW
InitializeCriticalSection
api-ms-win-core-heap-l1-1-0
HeapDestroy
HeapReAlloc
GetProcessHeap
HeapSize
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
RaiseException
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
api-ms-win-core-processthreads-l1-1-0
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
CreateThread
GetCurrentThreadId
GetExitCodeProcess
GetProcessId
OpenProcessToken
OpenThreadToken
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventProviderEnabled
EventSetInformation
EventActivityIdControl
EventWriteTransfer
EventUnregister
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsDeleteString
WindowsConcatString
WindowsCreateStringReference
WindowsCompareStringOrdinal
WindowsGetStringRawBuffer
WindowsDuplicateString
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
RoTransformError
SetRestrictedErrorInfo
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
InitOnceComplete
InitOnceBeginInitialize
Sleep
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
GetTickCount64
GetSystemDirectoryW
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
ntdll
RtlGetDeviceFamilyInfoEnum
RtlIsStateSeparationEnabled
RtlIsMultiSessionSku
NtQueryInformationToken
netapi32
NetApiBufferFree
NetGetJoinInformation
DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation
mdmdiagnostics
ord2
dmiso8601utils
ISO8601StringToSystemTime
omadmapi
ord90
ord89
ord34
ord38
ord47
ord56
ord23
ord39
ord86
dmenrollengine
GetEnrollmentPartnerOpaqueID
ord10
GetRecoveryInitiatedByServer
GetEnrollmentState
GetEnrollmentLinkedEnrollmentId
GetEnrollmentDiscoveryService
GetIsRecoveryAllowed
ord5
GetEnrollmentAadResourceUrl
GetEnrollmentUPN
dynamoapi
DynamoCheckIfAreaIsDynamicallyManaged
policymanager
PolicyManager_GetPolicyInt
EnterprisePolicyManagerStore_GetAllProviderIds
EnterprisePolicyManagerStore_GetAllProviderContextSidAreas
dmcmnutils
DmGetAadEnrollmentResource
CopyString
authbroker
AuthBrokerCreateClientContext
AuthBrokerSetThreadClientContext
msvcp_win
_Wcsxfrm
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
??1_Lockit@std@@QEAA@XZ
??Bid@locale@std@@QEAA_KXZ
?id@?$collate@G@std@@2V0locale@2@A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
_Wcscoll
??0_Lockit@std@@QEAA@H@Z
?id@?$ctype@G@std@@2V0locale@2@A
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?tolower@?$ctype@G@std@@QEBAGG@Z
?is@?$ctype@G@std@@QEBA_NFG@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
dsreg
DsrFreeJoinInfo
DsrGetJoinInfo
DsrIsDeviceJoined
api-ms-win-core-winrt-error-l1-1-1
RoReportFailedDelegate
IsErrorPropagationEnabled
RoGetMatchingRestrictedErrorInfo
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoUninitialize
RoInitialize
RoActivateInstance
api-ms-win-core-threadpool-l1-2-0
SubmitThreadpoolWork
WaitForThreadpoolTimerCallbacks
CreateThreadpoolWork
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-security-lsalookup-l2-1-0
LookupAccountNameW
oleaut32
VariantInit
SysStringByteLen
SysAllocStringByteLen
SysFreeString
SysAllocString
VariantClear
api-ms-win-security-base-l1-1-0
IsValidSid
CopySid
CreateWellKnownSid
CheckTokenMembership
DuplicateToken
RevertToSelf
ImpersonateLoggedOnUser
GetTokenInformation
GetLengthSid
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-sysinfo-l1-2-0
GetProductInfo
api-ms-win-core-registry-l1-1-0
RegQueryInfoKeyW
RegNotifyChangeKeyValue
RegCloseKey
RegEnumValueW
RegOpenKeyExW
RegEnumKeyExW
api-ms-win-core-url-l1-1-0
UrlUnescapeW
UrlEscapeW
api-ms-win-core-threadpool-legacy-l1-1-0
QueueUserWorkItem
api-ms-win-core-path-l1-1-0
PathCchAppend
api-ms-win-shcore-stream-winrt-l1-1-0
CreateRandomAccessStreamOnFile
api-ms-win-core-datetime-l1-1-1
GetTimeFormatEx
GetDateFormatEx
rpcrt4
UuidFromStringW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-security-lsalookup-l1-1-2
LsaLookupUserAccountType
DllCanUnloadNow
DllGetClassObject
GetSetting
Name
.text
Size
320KB
Virtual Size
320KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
90KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
376B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=97, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=260, version=27412,
count=3, id=259, version=27412,
count=1334, id=1, productName=Unmarked objects,
count=24, id=257, version=27412,
count=1, id=256, version=27412,
count=29, id=264, version=27412,
count=28, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
proxy.XmSProject/mscorlib/SettingsHandlers_nt.dll
- IMPHASH 7ae06e70115094afbbb6316378531a7e
- SHA256 fd9f50cb087c81b1f515485e2834ed3d1016a83c251207def1653648ed4f3cd5
- MD5 a68cc23a379fcb31da09b93b5b96ab9b
- SHA1 7fe463ad91b5ad02fae791ae3516b9212af7488b
- SHA512 fa18a8872634804383da07f2586f3e94b19fb63c13c2e0f1f3619d6c98f648b75684666f1fb17fa52f8f0d37876301900dfce7b5f1148eabce5990a056dd4089
- SSDEEP 49152:8n4KebvJNzQko+otm1kzmeqBJD0LlYD7pxdalXve54oYFf+:nB9eQYXx
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
2237744
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
SettingsHandlers_nt.pdb
api-ms-win-crt-string-l1-1-0
memset
wcsncmp
strncmp
wcscspn
wcsspn
wcscmp
memmove_s
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__wtoi
_o__wtoi64
_o_bsearch
_o_bsearch_s
_o_calloc
_o_free
_o_iswdigit
_o_iswspace
_o_malloc
_o_memcpy_s
_o_pow
_o_realloc
_o_terminate
_o_toupper
_o_towlower
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstol
memmove
_CxxThrowException
_o__wcsnicmp
_o__wcslwr_s
_o__wcsicmp
_o__set_errno
_o__seh_filter_dll
_o__register_onexit_function
_o__recalloc
_o__purecall
_o__ltow_s
_o__itow_s
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__get_errno
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__C_specific_handler
__CxxFrameHandler4
memcmp
memcpy
_o_iswctype
_o_wcstombs_s
__CxxFrameHandler3
wcsrchr
strchr
wcschr
wcsstr
__std_type_info_compare
combase
NdrCStdStubBuffer_Release
api-ms-win-core-kernel32-legacy-l1-1-0
RegisterWaitForSingleObject
UnregisterWait
GetComputerNameW
LoadLibraryW
rpcrt4
CStdStubBuffer_Connect
UuidCreate
CStdStubBuffer_Invoke
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
NdrOleFree
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
CStdStubBuffer_CountRefs
CStdStubBuffer_QueryInterface
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
IUnknown_QueryInterface_Proxy
CStdStubBuffer_IsIIDSupported
NdrDllCanUnloadNow
NdrDllGetClassObject
api-ms-win-core-string-l1-1-0
CompareStringEx
GetStringTypeExW
WideCharToMultiByte
CompareStringW
MultiByteToWideChar
CompareStringOrdinal
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventRegister
EventWriteTransfer
EventActivityIdControl
EventProviderEnabled
EventSetInformation
api-ms-win-core-localization-l1-2-0
GetLocaleInfoEx
GetCalendarInfoEx
SetUserGeoID
GetUserDefaultLocaleName
LocaleNameToLCID
GetUserPreferredUILanguages
FormatMessageW
EnumSystemGeoID
GetUserGeoID
SetLocaleInfoW
GetGeoInfoW
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
OpenProcessToken
TerminateProcess
CreateThread
GetCurrentThreadId
GetCurrentThread
GetExitCodeProcess
GetProcessId
GetCurrentProcess
OpenThreadToken
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapDestroy
HeapSize
HeapAlloc
api-ms-win-core-libraryloader-l1-2-0
LoadStringW
LoadResource
LoadLibraryExW
SizeofResource
GetModuleHandleW
FindResourceExW
FindStringOrdinal
DisableThreadLibraryCalls
GetProcAddress
FreeLibrary
GetModuleHandleExW
GetModuleFileNameW
GetModuleFileNameA
LockResource
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
OutputDebugStringA
IsDebuggerPresent
DebugBreak
api-ms-win-core-errorhandling-l1-1-0
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
RaiseException
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
AcquireSRWLockShared
EnterCriticalSection
DeleteCriticalSection
WaitForSingleObject
OpenSemaphoreW
AcquireSRWLockExclusive
InitializeCriticalSectionEx
ReleaseSemaphore
WaitForSingleObjectEx
ResetEvent
TryEnterCriticalSection
InitializeCriticalSection
WaitForMultipleObjectsEx
CreateEventW
InitializeSRWLock
CreateEventExW
CreateSemaphoreExW
ReleaseSRWLockShared
CreateMutexExW
SetEvent
ReleaseMutex
ReleaseSRWLockExclusive
InitializeCriticalSectionAndSpinCount
api-ms-win-core-com-l1-1-0
CoGetMalloc
CoCreateFreeThreadedMarshaler
CoIncrementMTAUsage
CoUninitialize
CoDecrementMTAUsage
CoWaitForMultipleHandles
CoSetProxyBlanket
IIDFromString
CLSIDFromString
CoGetClassObject
CreateStreamOnHGlobal
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
StringFromIID
PropVariantCopy
CoCreateInstance
StringFromCLSID
CoTaskMemRealloc
CoGetApartmentType
PropVariantClear
StringFromGUID2
CoCreateGuid
CoInitializeEx
CoTaskMemFree
CoTaskMemAlloc
CoGetCallContext
CoGetStdMarshalEx
CoReleaseMarshalData
api-ms-win-core-string-l2-1-0
CharNextW
CharLowerBuffW
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegDeleteValueW
RegOpenKeyExW
RegLoadMUIStringW
RegCreateKeyExW
RegQueryValueExW
RegEnumKeyExW
RegGetValueW
RegNotifyChangeKeyValue
RegQueryInfoKeyW
RegCloseKey
RegEnumValueW
oleaut32
LPSAFEARRAY_UserUnmarshal64
LPSAFEARRAY_UserMarshal64
LPSAFEARRAY_UserFree64
LPSAFEARRAY_UserUnmarshal
LPSAFEARRAY_UserFree
LPSAFEARRAY_UserSize
SafeArrayUnaccessData
SafeArrayAccessData
VariantClear
VariantInit
SafeArrayGetElement
SafeArrayGetUBound
LPSAFEARRAY_UserMarshal
SafeArrayDestroy
SysAllocStringByteLen
SysStringByteLen
SysStringLen
VariantChangeType
SysAllocString
SysFreeString
VarUI4FromStr
VarBstrCat
LPSAFEARRAY_UserSize64
SafeArrayGetLBound
SysAllocStringLen
VarBstrCmp
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
GetRestrictedErrorInfo
RoOriginateError
SetRestrictedErrorInfo
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-synch-l1-2-0
InitOnceComplete
Sleep
InitOnceBeginInitialize
InitOnceExecuteOnce
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-1
OpenProcess
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetVersionExW
GetLocalTime
GetSystemTimeAsFileTime
GetTickCount
GetComputerNameExW
GetSystemWindowsDirectoryW
GetSystemDirectoryW
GetTickCount64
GetSystemTime
api-ms-win-core-interlocked-l1-1-0
InterlockedPushEntrySList
InitializeSListHead
api-ms-win-core-misc-l1-1-0
lstrcmpiW
api-ms-win-core-sidebyside-l1-1-0
FindActCtxSectionStringW
CreateActCtxW
QueryActCtxW
ActivateActCtx
DeactivateActCtx
api-ms-win-core-localization-obsolete-l1-2-0
GetUserDefaultUILanguage
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
RoOriginateLanguageException
IsErrorPropagationEnabled
RoReportFailedDelegate
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CreateThreadpoolWork
CloseThreadpoolTimer
SubmitThreadpoolWork
SetThreadpoolTimer
CreateThreadpoolTimer
TrySubmitThreadpoolCallback
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait
SetThreadpoolWait
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-security-base-l1-1-0
CheckTokenMembership
FreeSid
ImpersonateLoggedOnUser
DuplicateToken
AllocateAndInitializeSid
RevertToSelf
GetTokenInformation
DestroyPrivateObjectSecurity
CreateWellKnownSid
EqualSid
CopySid
GetLengthSid
IsValidSid
api-ms-win-core-file-l1-1-0
FileTimeToLocalFileTime
CreateFileW
FindFirstFileExW
FindNextFileW
FindFirstFileW
FindClose
GetFileAttributesW
WriteFile
CreateDirectoryW
DeleteFileW
api-ms-win-core-file-l2-1-2
CopyFileW
api-ms-win-core-sysinfo-l1-2-0
GetNativeSystemInfo
GetOsSafeBootMode
VerSetConditionMask
GetProductInfo
api-ms-win-core-datetime-l1-1-1
GetDateFormatEx
GetTimeFormatEx
api-ms-win-core-file-l1-2-0
GetTempPathW
api-ms-win-core-registry-l1-1-1
RegDeleteKeyValueW
RegSetKeyValueW
api-ms-win-core-localization-l1-2-3
GetUserDefaultGeoName
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
K32GetModuleFileNameExW
K32GetProcessImageFileNameW
api-ms-win-core-localization-l2-1-0
EnumCalendarInfoExEx
EnumTimeFormatsEx
api-ms-win-core-datetime-l1-1-0
GetDateFormatW
GetTimeFormatW
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-security-lsalookup-l2-1-0
LookupPrivilegeValueW
LookupAccountSidW
api-ms-win-core-wow64-l1-1-1
IsWow64Process2
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-com-midlproxystub-l1-1-0
ObjectStublessClient8
ObjectStublessClient5
ObjectStublessClient10
ObjectStublessClient6
ObjectStublessClient7
ObjectStublessClient11
ObjectStublessClient3
ObjectStublessClient9
ObjectStublessClient4
api-ms-win-shcore-obsolete-l1-1-0
SHStrDupW
api-ms-win-core-shlwapi-obsolete-l1-1-0
StrCmpNIW
QISearch
StrPBrkW
StrChrW
api-ms-win-core-string-obsolete-l1-1-0
lstrlenW
api-ms-win-core-registryuserspecific-l1-1-0
SHRegGetBoolUSValueW
SHRegQueryUSValueW
SHRegWriteUSValueW
SHRegSetUSValueW
SHRegCloseUSKey
SHRegGetUSValueW
SHRegCreateUSKeyW
SHRegEnumUSKeyW
SHRegOpenUSKeyW
api-ms-win-core-localization-private-l1-1-0
NlsCheckPolicy
api-ms-win-core-url-l1-1-0
UrlEscapeW
api-ms-win-core-threadpool-legacy-l1-1-0
UnregisterWaitEx
QueueUserWorkItem
api-ms-win-core-shlwapi-legacy-l1-1-0
PathCommonPrefixW
PathRemoveExtensionW
PathFindFileNameW
SHExpandEnvironmentStringsW
PathFindExtensionW
PathFileExistsW
api-ms-win-core-registry-l2-1-0
RegQueryValueW
RegOpenKeyW
api-ms-win-core-kernel32-legacy-l1-1-1
VerifyVersionInfoW
GetFirmwareType
api-ms-win-core-timezone-private-l1-1-0
IsTimeZoneRedirectionEnabled
user32
ord2521
SetPropW
GetPropW
DestroyMenu
GetMenuDefaultItem
CreatePopupMenu
GetKeyState
SendInput
UnregisterClassA
GetProcessDefaultLayout
GetWindowRect
SystemParametersInfoW
SendNotifyMessageW
SendMessageW
GetSysColor
PostMessageW
GetKeyboardLayout
MapVirtualKeyExW
GetWindowThreadProcessId
EnumWindows
GetForegroundWindow
GetSystemMetrics
ord2517
DispatchMessageW
GetWindowLongPtrW
LoadCursorW
SetCursor
TranslateMessage
PostQuitMessage
PeekMessageW
MsgWaitForMultipleObjectsEx
FindWindowW
IsWindow
DestroyIcon
LoadImageW
FindWindowExW
CopyIcon
AllowSetForegroundWindow
MonitorFromRect
GetMonitorInfoW
GetClassInfoExW
RegisterClassExW
CreateWindowExW
SetWindowLongPtrW
GetMessageW
DestroyWindow
UnregisterClassW
SetDesktopColorTransform
DefWindowProcW
CharUpperBuffW
GetUserObjectInformationW
GetShellWindow
GetActiveWindow
GetProcessWindowStation
EnumDesktopsW
CloseDesktop
EnumDesktopWindows
SetThreadDesktop
GetThreadDesktop
OpenDesktopW
GhostWindowFromHungWindow
IsWindowVisible
GetWindowLongW
GetWindow
GetClassNameW
InflateRect
ord2544
shlwapi
ord176
StrFormatByteSizeEx
ord629
ord214
ord568
ord174
ord560
ord213
ord12
SHDeleteValueW
SHRegGetValueW
ord199
ord433
SHGetThreadRef
ord548
ord630
ord618
ord544
ord154
ord437
SHSetValueW
SHGetValueW
SHDeleteKeyW
ord16
ord260
ord487
StrToIntW
PathIsRelativeW
PathMatchSpecExW
StrStrIW
ord158
StrChrIW
ord212
PathIsNetworkPathW
SHStrDupA
ord270
shell32
SHGetIDListFromObject
ord923
ord644
ord27
SHCreateShellItem
SHGetNameFromIDList
ord645
ord18
ord916
ord924
SHGetKnownFolderIDList
ord846
SHBindToFolderIDListParentEx
ord2
SHCreateItemInKnownFolder
ord921
ord901
SHCreateShellItemArrayFromIDLists
ord850
SHGetKnownFolderItem
ord155
SHGetKnownFolderPath
SHCreateItemFromParsingName
ord100
ord4
SHChangeNotify
ShellExecuteExW
SHGetFolderPathEx
ord165
shcore
ord233
ord232
ord230
SHTaskPoolQueueTask
ord241
CreateStreamOverRandomAccessStream
ord145
ord244
kernel32
OpenJobObjectW
OpenMutexW
DeleteProcThreadAttributeList
CreateProcessW
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
K32GetModuleBaseNameW
IsProcessInJob
K32EnumProcesses
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
OOBEComplete
SearchPathW
SetDynamicTimeZoneInformation
GetTimeZoneInformation
GetDynamicTimeZoneInformation
HeapReAlloc
K32EnumProcessModules
GlobalFree
CreateMutexW
LCMapStringW
FindNLSString
CeipIsOptedIn
FindPackagesByPackageFamily
OpenEventW
CloseThreadpoolWork
RegDeleteTreeW
ProcessIdToSessionId
lstrcmpW
GlobalAlloc
CompareFileTime
GetFileAttributesExW
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformationForYear
RegSetKeySecurity
RegDeleteKeyExW
LocalReAlloc
GetSystemPreferredUILanguages
ResolveLocaleName
GetSystemDefaultLCID
api-ms-win-appmodel-runtime-l1-1-0
OpenPackageInfoByFullName
ClosePackageInfo
GetPackageInfo
policymanager
PolicyManager_GetPolicy
PolicyManager_GetPolicyString
PolicyManager_FreeStringValue
PolicyManager_GetPolicyInt
PolicyManager_IsPolicySetByMobileDeviceManager
msvcp_win
?_Xbad_function_call@std@@YAXXZ
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_Xbad_alloc@std@@YAXXZ
?__ExceptionPtrToBool@@YA_NPEBX@Z
?_XGetLastError@std@@YAXXZ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Wcscoll
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@J@Z
?_Throw_C_error@std@@YAXH@Z
_Mtx_init_in_situ
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
_Wcsxfrm
_Mtx_destroy_in_situ
?__ExceptionPtrRethrow@@YAXPEBX@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Xout_of_range@std@@YAXPEBD@Z
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?__ExceptionPtrDestroy@@YAXPEAX@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$ctype@G@std@@2V0locale@2@A
?id@?$collate@G@std@@2V0locale@2@A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
_Mtx_lock
?_Assign@_ContextCallback@details@Concurrency@@AEAAXPEAX@Z
??0task_continuation_context@Concurrency@@AEAA@XZ
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
?tolower@?$ctype@G@std@@QEBAGG@Z
_Mtx_unlock
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
_Cnd_init_in_situ
?is@?$ctype@G@std@@QEBA_NFG@Z
_Cnd_destroy_in_situ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
??1facet@locale@std@@MEAA@XZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
??0facet@locale@std@@IEAA@_K@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
_Cnd_broadcast
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
_Cnd_wait
?_Xlength_error@std@@YAXPEBD@Z
?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?_Incref@facet@locale@std@@UEAAXXZ
??Bid@locale@std@@QEAA_KXZ
?clear@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@H@Z
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
appxdeploymentclient
ord23
ord25
ord24
api-ms-win-core-path-l1-1-0
PathCchAppend
PathCchCombine
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceLoggerHandle
TraceMessage
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
api-ms-win-service-management-l1-1-0
OpenSCManagerW
OpenServiceW
CloseServiceHandle
api-ms-win-service-winsvc-l1-1-0
QueryServiceStatus
api-ms-win-service-management-l2-1-0
QueryServiceConfigW
api-ms-win-core-memory-l1-1-0
VirtualQuery
winhttp
WinHttpReadData
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpDetectAutoProxyConfigUrl
WinHttpOpenRequest
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpCloseHandle
WinHttpSendRequest
WinHttpSetStatusCallback
WinHttpSetOption
WinHttpOpen
WinHttpCrackUrl
WinHttpConnect
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
ntdll
RtlIsMultiSessionSku
RtlPublishWnfStateData
RtlLookupElementGenericTableAvl
RtlInitializeGenericTableAvl
RtlInsertElementGenericTableAvl
RtlAcquireSRWLockExclusive
WinSqmAddToStreamEx
NtQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
WinSqmSetDWORD
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockShared
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlIpv4AddressToStringExW
RtlReleaseSRWLockShared
NtQueryInformationToken
RtlIpv6AddressToStringW
RtlIpv4AddressToStringW
RtlIpv6StringToAddressW
RtlIpv4StringToAddressW
WinSqmAddToStream
RtlInitUnicodeString
RtlCompareUnicodeString
RtlFreeUnicodeString
RtlConvertSidToUnicodeString
RtlNtStatusToDosError
RtlAllocateWnfSerializationGroup
RtlQueryWnfStateData
WinSqmIncrementDWORD
WinSqmIsOptedIn
NtClose
NtAdjustPrivilegesToken
NtOpenProcessToken
RtlGetDeviceFamilyInfoEnum
RtlGetVersion
RtlIpv6AddressToStringExW
RtlNtStatusToDosErrorNoTeb
RtlAllocateHeap
RtlFreeHeap
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-shlwapi-winrt-storage-l1-1-1
SHPinDllOfCLSID
ord317
ord448
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
api-ms-win-shell-shellcom-l1-1-0
SHCoCreateInstance
api-ms-win-appmodel-runtime-internal-l1-1-0
GetPackageContext
GetPackagePropertyString
api-ms-win-appmodel-state-l1-2-0
GetSystemAppDataKey
OpenStateExplicit
CloseState
api-ms-win-shcore-thread-l1-1-0
GetProcessReference
api-ms-win-shcore-comhelpers-l1-1-0
IUnknown_GetSite
sppc
SLpIsCurrentInstalledProductKeyDefaultKey
api-ms-win-core-atoms-l1-1-0
GlobalGetAtomNameW
errordetailscore
FreeErrorDetails
GetErrorDetailsWithContext
api-ms-win-crt-math-l1-1-0
ceilf
DllCanUnloadNow
DllGetClassObject
GetProxyDllInfo
GetSetting
Name
.text
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
946KB
Virtual Size
945KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
60KB
Virtual Size
117KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
104KB
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
54KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=199, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=26, id=260, version=27412,
count=3, id=259, version=27412,
count=2237, id=1, productName=Unmarked objects,
count=28, id=257, version=27412,
count=1, id=256, version=27412,
count=470, id=264, version=27412,
count=34, id=261, version=27412,
count=11, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
proxy.XmSProject/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c4abfac85ef278a98d894a949c436a8bb1e4aed2217a7db679775e9f05944f10
- MD5 5fca079e64eab4592a612d06e0043f98
- SHA1 f78aba3a6eb6c74748a6c65518f01047be6fe285
- SHA512 758dcc4ab67ed5f32601a10f762f9ae2f6ec580a15e7fa6e7ecfff05d6cf02e21b21ac38e1a23e7d941cbdf14402466b982f37de7bcde78f0bf95d76931428af
- SSDEEP 49152:7u//QUyNVzD4zpClWx5qqWlgfMkkYISbYT3exOXMEFFmRh03ul92b9sk/IRUn+FV:cQJzDg8lW2qkgfMknJaJ3wum
- MD5 SHA1 SHA512 SSDEEP
Digest
90:22:da:ba:2a:45:f6:ee:b0:ab:f7:44:e4:ba:81:a4:3a:fe:6f:d4:8f:d7:62:7f:6b:92:31:10:a2:28:4b:97
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 9, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:ae:2d:35:51:c8:53:8f:55:1d:00:00:00:00:03:ae
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
5153186
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscorlib.pdb
mscoree
_CorDllMain
Name
.text
Size
5.0MB
Virtual Size
5.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
487KB
Virtual Size
487KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
proxy.XmSProject/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/normidna.nlp
- SHA256 157105a9940b35dc8f1800e0a14765b91513cd5906508fc7ec53a2b8d5038ee9
- MD5 da5748a89e22a3932387e65694b25bbb
- SHA1 c1ee3598b01c15d6e772971416eef2f51e8c0482
- SHA512 d937184c29cc6df2517b9de7389f72b065a383b49fb5d56b93d60fb48abae1d790ba90b08f3f86ca3c1e36c68288ccc77c1d4054ba7777058dc29b7a28170c79
- SSDEEP 768:TyLy9olP5ppV9tewIljbMvyH8UR+MRsTQCXpKcAXLRMe6ZM6oM1kS0u2oi2:TyLy2jvWWfXD+LReM601/2
- MD5 SHA1 SHA512 SSDEEP
proxy.XmSProject/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/normnfc.nlp
- SHA256 9d2f2d92e8fde1fd2d6ea45e3f62e4e174f2337f84b746ceb14c4bcfa2c71367
- MD5 ab0188447cfa74e646c9aeca1c232430
- SHA1 acf377c8503c3b9eadc2ae988fdfac30526cb927
- SHA512 d67b19d5b7c81bfaaeaac6f61e9a289372310f08aca276692b6dec044cc5a4a857f4c811935d551c0c4950349ce04170fccc44c9c30e2c2aafdb941e4d6d9274
- SSDEEP 768:QQ0pq+fVgEKI5UbgZjFQUpEwQECEaLR59:P0pzO/i9zZoR59
- MD5 SHA1 SHA512 SSDEEP
proxy.XmSProject/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/normnfd.nlp
- SHA256 90138996a68319099bca2f0f3015a90b0e4300a49c071a04614a99ea9d3bcd91
- MD5 a9bd54b9fde1a660dfdbecc9e94a8e22
- SHA1 a2503cf9849180c4396adc0b1a443bc5b9d4ae09
- SHA512 ec7295b89ddeb0b0184dfb65928d369a788932acfc385fc677d425d26a940d228b31231ab4ed044edf4e1bf924cd9cd1ba9b043d6da2aec848189b1f49760517
- SSDEEP 384:YxZD5Ay8UUDXdElnVYQMbzKMUnTweLJ8N9zgM+KkFFQUpEwROSj:qZD+yQ0nVYw9nTNY1gZjFQUpEwQ0
- MD5 SHA1 SHA512 SSDEEP
proxy.XmSProject/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/normnfkc.nlp
- SHA256 c0958d6f476e55be7458a55620f99826cbdde3bf66da94c6a5f7d08f88e77b60
- MD5 a52f03c8df33dcdfcc6c44e947eba685
- SHA1 a4e6ec137d8dcfd7beca4ee8bacba19eb878f37f
- SHA512 4829c7a449beaf4c6dfc2775246dd59563090456b7395fde1bad9a7e7353d9c638c7b32c549c28b5b572fec9947a16caa9dc230ce5f7de519af6761a2ac92efd
- SSDEEP 768:z0JlR1avaSWhVP6JoVb/1gFbCR3NjGvI4vkSOUhbBUB1TEXLRJz:z0naLWTE6bubCRtGJby4RJz
- MD5 SHA1 SHA512 SSDEEP
proxy.XmSProject/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/normnfkd.nlp
- SHA256 a1bd4e75958ccc7bb8073651950f23c7115054a32fbdbefe86f455a3480dbd9d
- MD5 4d8620e00dd771b58534a00218c60a58
- SHA1 5dc02a1757bbccbf388466bf6580864d99136e9c
- SHA512 d20b243f615b1232a1924bdcebdda5d89551daef20c6ad5256285097fbbab7ced5fdbbbdef34775889f689387c55622d4e15f3887a3a405d8685eda2d4d9e079
- SSDEEP 768:9BypmUEImoYQvP17WgVbFTylKjWvtZ4HkSOUhbBUB1a:ny0UEbQvt7F80jWvtAby6
- MD5 SHA1 SHA512 SSDEEP
proxy.XmSProject/mshwkorrIME.dll
- SHA256 7b9e1a1d1a10b16465bcaf3374dfafa8bcb3876c208fbf6b83549954b7449eb2
- MD5 25d0eb59bb5c2ed73203d9522ec65aee
- SHA1 af4520901299a4511088761f9e7846fb2978cef2
- SHA512 af39caa86fccb2491b2f7e2e2f644ef615c401fd63085057f69b355662fa745c04b5911138b832915d593aaac5387794658bf6e8f82ec5080f8216b74ad23dbe
- SSDEEP 98304:fFoX7nyokE7N3r3Jv112NMhpw0Oqa7jLUxa4d2bvLTs7:f67nVnZ3dvraDuT2bv/Y
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
7.0MB
Virtual Size
7.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
proxy.XmSProject/twain_32.dll
- IMPHASH 316cd668ed705c998eae8d3bd7bd168f
- SHA256 eec41d62ab5d2e1d880b338c47a2156a5ee7e58f3448f58cc8120392ddc8c730
- MD5 afe119dd4e17891b227684f38aa25d4d
- SHA1 2159772933e0ba4fb108edb93067cfdd067abf15
- SHA512 37309c74f3b6e356506c40c871a90294d9f874388a1417af9eb27cde085cf62a72af79b258c78cac0ac2ed8a183e349ffb8f67f2a9c3f46c1d19f2fe3ea9408f
- SSDEEP 768:uPC0xySqWNPwcKnReqpxORBoWNOMFN5cYsFx1gAmOURksWrk/VwLtkKavNi3IJzU:uPC0xyowcklqHw9xGkLrNLtBiNR
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
56320
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
twain_32.pdb
msvcrt
_chdir
strcpy_s
_getcwd
_errno
_strcmpi
_chdrive
strcat_s
sprintf_s
strncpy_s
_snprintf_s
_purecall
_ltoa
atol
free
_strnicmp
_vsnwprintf
memcpy_s
remove
_read
_close
_write
_lseek
_sopen
_locking
_vsnprintf
strncmp
_XcptFilter
_amsg_exit
_initterm
_lock
malloc
_getdrive
_unlock
__dllonexit
_onexit
_except_handler4_common
memcpy
memset
kernel32
SetLastError
GetTickCount
GetSystemTimeAsFileTime
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
GetTempPathA
IsDebuggerPresent
DebugBreak
GetModuleHandleW
GetProcessHeap
GetCurrentProcessId
CreateMutexExW
HeapAlloc
PowerClearRequest
OpenSemaphoreW
WaitForSingleObjectEx
InitOnceComplete
OutputDebugStringW
FormatMessageW
ReleaseMutex
GetCurrentThreadId
WaitForSingleObject
GetModuleHandleExW
ReleaseSemaphore
HeapFree
CreateSemaphoreExW
InitOnceBeginInitialize
PowerSetRequest
GetModuleFileNameA
WriteProfileStringA
GetCurrentProcess
lstrcmpiA
MultiByteToWideChar
lstrlenA
GlobalSize
GetVersion
GetLastError
GlobalFlags
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
PowerCreateRequest
CloseHandle
FindFirstFileA
FindNextFileA
FindClose
GetFileAttributesA
GetSystemDirectoryA
LoadLibraryA
GetWindowsDirectoryA
GetProcAddress
FreeLibrary
GetProfileStringA
GlobalHandle
OpenFile
user32
RegisterWindowMessageA
LoadStringA
SendMessageA
FindWindowA
PeekMessageA
DdeCmpStringHandles
DdeConnect
DdeQueryConvInfo
DdeClientTransaction
DdeDisconnect
DdeGetData
DdeGetLastError
DdeCreateStringHandleA
DdeCreateDataHandle
DdeUninitialize
DdeInitializeA
DdeFreeStringHandle
DispatchMessageA
TranslateMessage
UnhookWindowsHook
CallNextHookEx
EndDialog
DialogBoxParamA
SetFocus
SendDlgItemMessageA
SetWindowsHookA
GetDlgItem
EnableWindow
PostMessageA
IsWindow
CharUpperA
apphelp
ApphelpCheckExe
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventWriteTransfer
EventSetInformation
EventUnregister
AboutDlgProc
ChooseDlgProc
DSM_Entry
InfoHook
WGDlgProc
Name
.text
Size
53KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=12, id=260, version=27412,
count=133, id=1, productName=Unmarked objects,
count=9, id=257, version=27412,
count=1, id=256, version=27412,
count=3, id=259, version=27412,
count=21, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
proxy.XmSProject/wrpintapi.dll
- IMPHASH 88d112d340f48a8e711dbb236eff1b92
- SHA256 94d6e407276edb401b2f4c0741f66d1f440e19068c93c16f9a1dd095f934ef0e
- MD5 a55e16fe16e2f92228b8b47b301f9879
- SHA1 e8550ebaf849e6c07736bcd77b07b6e9a4c73906
- SHA512 aecdbeab4a95677f6b57162b344dd082cbc21b6572b823349f96c6a5719c8f02e144bd05b45f79efc9f926942fb48c01285396056143539e96c7ab2b47a9c7ae
- SSDEEP 192:PR1wf+fTfRDcmg6ZrA+Y1mR5pvUgFqTl8L5rjWVfW:PPwfeDng6ZrA/IOlwrjWVfW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5104
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wrpintapi.pdb
msvcrt
_amsg_exit
free
malloc
_initterm
__C_specific_handler
_XcptFilter
memcmp
kernel32
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
Sleep
QueryPerformanceCounter
rpcrt4
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
CStdStubBuffer_Connect
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_AddRef
CStdStubBuffer_Invoke
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
NdrOleFree
IUnknown_Release_Proxy
NdrOleAllocate
combase
ord2
ord3
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
264B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
320B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=259, version=27412,
count=11, id=260, version=27412,
count=43, id=1, productName=Unmarked objects,
count=7, id=257, version=27412,
count=1, id=256, version=27412,
count=4, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,