c859cc3c802763f048ca2be4419e2696b183818ff5dbd80aa455c91208a278c4
- SHA256 c859cc3c802763f048ca2be4419e2696b183818ff5dbd80aa455c91208a278c4
Overview
overview
10Static
static
3Imperium.exe
windows7-x64
10Imperium.exe
windows10-2004-x64
10advpack.dll
windows10-2004-x64
1aeevts.dll
windows10-2004-x64
1aeinv.dll
windows10-2004-x64
1aeinvext.dll
windows10-2004-x64
1aemarebackup.dll
windows10-2004-x64
1aepic.dll
windows10-2004-x64
1agentactiv...me.dll
windows10-2004-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Imperium.exe
Resource
win7-20241010-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
Imperium.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
advpack.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
aeevts.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
aeinv.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
aeinvext.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
aemarebackup.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
aepic.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
agentactivationruntime.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target c859cc3c802763f048ca2be4419e2696b183818ff5dbd80aa455c91208a278c4
- Size 2.5MB
- Sample241204-sfl55strgm
- SHA256 c859cc3c802763f048ca2be4419e2696b183818ff5dbd80aa455c91208a278c4
- MD5 b92517f43a1d4008515c9f91d055d26f
- SHA1 fc6e24810f86356e74df241d92b9f03aeaebcf93
- SHA512 29236146075de6215bb425c6e1e162930eaf99d215a0eecd7ae304ca7ea8314b0eb44a940edd382bcf306e5c3fda699ec720dd905390e118d86840f90323cadb
- SSDEEP 49152:mv0ZGMGEClXTCWYECZVu5Cx7L0V3dyyR4XKo+CsXghlKiA2k0kET1xxsn4:mvCXTAnJdiX23FOaY4ivk0kE1xxT
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/Imperium.exe unpack001/advpack.dll unpack001/aeevts.dll unpack001/agentactivationruntime.dll
File Explorer
-
c859cc3c802763f048ca2be4419e2696b183818ff5dbd80aa455c91208a278c4.zip 2.5MB
-
Imperium.exe.exe 895KB
-
PASSWORD.txt8B
-
advpack.dll.dll 176KB
-
aeevts.dll.dll 40KB
-
aeinv.dll.dll 1.1MB
-
aeinvext.dll.dll 137KB
-
aemarebackup.dll.dll 865KB
-
aepic.dll.dll 614KB
-
agentactivationruntime.dll.dll 1012KB
Imperium.exe
- IMPHASH bf5a4aa99e5b160f8521cadd6bfe73b8
- SHA256 fe21d4c63aa2ec21a4311955decfcf4d8dd7ec73bc9fa07655e14de6762489e7
- MD5 2e627886f546dec55fd0243de22f966e
- SHA1 32bcbfd80baef07a2e05b8ed673a469741b74828
- SHA512 9642e596de2c2f2995180d5c4ec87619b10aaad1ca846eff55ed9c32c513b6994f47d87b3dc52e7a9f5990c4bac019d57dc8bcb3ea6381a43a176169067fdb3d
- SSDEEP 12288:Wh1Lk70TnvjcQexF/3hr9mvqXO/bW8/1Ci9uJ41I8opwxcHXi2jlXWnbkQ:6k70Trc7F/3aWO98PZUqXieXWnb
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
52527
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
RaiseException
GetLastError
MultiByteToWideChar
lstrlenA
InterlockedDecrement
GetProcAddress
LoadLibraryA
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
GetModuleHandleA
Module32Next
CloseHandle
Module32First
CreateToolhelp32Snapshot
GetCurrentProcessId
SetEndOfFile
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetLocaleInfoA
HeapFree
GetProcessHeap
HeapAlloc
GetCommandLineA
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
HeapSize
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
ReadFile
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
FlushFileBuffers
SetFilePointer
SetHandleCount
GetFileType
GetStartupInfoA
RtlUnwind
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CompareStringA
CompareStringW
SetEnvironmentVariableA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA
ole32
OleInitialize
oleaut32
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SafeArrayCreateVector
VariantClear
VariantInit
SysFreeString
SysAllocString
Name
.text
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
759KB
Virtual Size
759KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=19, id=149, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=112, id=1, productName=Unmarked objects,
count=48, id=132, productName=VS2008 build 21022, version=21022,
count=142, id=131, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
PASSWORD.txt
- SHA256 5aabe6e0fc76d252fa6cf1ddbbe79298da4914af6b576d46d140c616abdcd878
- MD5 668f41556b0b778a12fad00473cf9506
- SHA1 1b9b7a2fe2ec8599c2073fc4aea7a62aab2b9a42
- SHA512 06930981445905b375e0e5548e4bf6c29f90b3d3ea74d431596ac5e583b6da711e7a09809d0cb7a9e89f6848addcedce48a0aae7e5b8c2e952c3873d75ef6b46
- MD5 SHA1 SHA512
advpack.dll
- IMPHASH 9f54aec8ee18f83bbe291a2f6d33e648
- SHA256 d91af176c416e14d9533614287fe1175fcd193ee8125280ee777c92ef7e683b9
- MD5 327c4cbba43881847674c831e4b1a672
- SHA1 1277cf5c846a25b9b9e19f9a7ca92377b91a92c9
- SHA512 5cf4d9ca80f43bd845ca428a63fc1267a5a688b7378758b950be5b3d06d81e3011bfe2ff32d50fc30b2bd58632490190b9a5e98d59a121644550adee1b27d38f
- SSDEEP 3072:glgx98bHDj0qjbcB6hRu+0GU0AuJ9UqhE7LMxQcWVrFO8h:MgxwMDURu+0LvuJ9UsEkxQcW28
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4976
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
advpack.pdb
msvcrt
__C_specific_handler
_lock
_unlock
_setjmp
__dllonexit
_onexit
wcspbrk
iswalpha
wcschr
wcsncmp
memmove
_initterm
malloc
free
_amsg_exit
_XcptFilter
_ultow_s
longjmp
_wtoi
memcpy_s
_wtol
_vsnwprintf
_vsnprintf
memset
user32
ExitWindowsEx
IsWindow
SendDlgItemMessageW
PeekMessageW
CharNextW
SystemParametersInfoW
CharPrevW
MessageBeep
MessageBoxW
DialogBoxParamW
GetDesktopWindow
SetWindowTextW
CharNextA
DestroyWindow
UpdateWindow
ShowWindow
SetDlgItemTextW
EndDialog
EnableWindow
GetDlgItem
GetDlgItemTextW
SendMessageW
GetWindowRect
GetDC
ReleaseDC
SetWindowPos
OemToCharA
CharUpperW
MsgWaitForMultipleObjects
DispatchMessageW
GetSystemMetrics
CreateDialogParamW
LoadStringW
gdi32
GetStockObject
DeleteObject
GetDeviceCaps
CreateFontIndirectW
kernel32
IsDebuggerPresent
DebugBreak
GetModuleHandleW
GetModuleFileNameA
CreateSemaphoreExW
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
ReleaseMutex
OutputDebugStringW
MulDiv
GetDiskFreeSpaceW
EnumResourceLanguagesW
WideCharToMultiByte
MultiByteToWideChar
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
WaitForSingleObjectEx
OpenSemaphoreW
HeapFree
GetLastError
LocalFree
GetDriveTypeW
GetEnvironmentVariableW
GetTempPath2W
GetWindowsDirectoryW
GetTempFileNameW
FindResourceW
SizeofResource
LockResource
LoadResource
WritePrivateProfileStringW
CreateFileW
WriteFile
CloseHandle
LocalAlloc
SetFilePointer
GetModuleFileNameW
DeleteFileW
EnterCriticalSection
LeaveCriticalSection
LocalReAlloc
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
GetFullPathNameW
GetFileAttributesW
CompareStringW
FormatMessageW
GetPrivateProfileIntW
GetCurrentProcess
SearchPathW
GetPrivateProfileStringW
lstrcmpW
FreeLibrary
GetVersionExW
lstrcmpiW
LoadLibraryExW
GetProcAddress
GetShortPathNameW
ExpandEnvironmentStringsW
GetSystemDirectoryW
GetFileSize
GetVolumeInformationW
CreateDirectoryW
SetFileAttributesW
CreateProcessW
CopyFileW
GetPrivateProfileSectionW
LoadLibraryW
CreateFileMappingW
MapViewOfFileEx
SetLastError
UnmapViewOfFile
MoveFileExW
MoveFileW
RemoveDirectoryW
FindFirstFileW
FindNextFileW
FindClose
GetSystemInfo
GetCurrentProcessId
GetProcessHeap
GetLocalTime
HeapAlloc
lstrcmpiA
GetProfileStringW
WritePrivateProfileSectionW
GetFileTime
ReadFile
SetFileTime
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
CreateMutexExW
advapi32
AllocateAndInitializeSid
RegUnLoadKeyW
RegLoadKeyW
RegCreateKeyExW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegEnumValueW
RegSetValueExW
OpenProcessToken
RegSaveKeyW
RegFlushKey
LookupPrivilegeValueW
AdjustTokenPrivileges
RegSetValueW
RegDeleteValueW
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyW
GetTokenInformation
RegDeleteKeyW
EqualSid
FreeSid
RegQueryInfoKeyW
ole32
OleInitialize
OleUninitialize
CoTaskMemFree
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
setupapi
SetupOpenInfFileW
SetupOpenAppendInfFileW
SetupInstallFromInfSectionW
SetupDefaultQueueCallbackW
SetupCloseFileQueue
SetupCommitFileQueueW
SetupCloseInfFile
SetupTermDefaultQueueCallback
SetupQueueCopyW
SetupOpenFileQueue
SetupGetStringFieldW
SetupFindNextLine
SetupFindFirstLineW
SetupGetLineTextW
SetupSetDirectoryIdW
SetupInitDefaultQueueCallbackEx
shlwapi
StrChrW
ord215
ord217
StrStrIW
StrRChrW
PathRemoveFileSpecW
PathFileExistsW
PathBuildRootW
PathCombineW
PathAddBackslashW
AddDelBackupEntry
AddDelBackupEntryA
AddDelBackupEntryW
AdvInstallFile
AdvInstallFileA
AdvInstallFileW
CloseINFEngine
DelNode
DelNodeA
DelNodeRunDLL32
DelNodeRunDLL32A
DelNodeRunDLL32W
DelNodeW
DoInfInstall
DoInfInstallA
DoInfInstallW
ExecuteCab
ExecuteCabA
ExecuteCabW
ExtractFiles
ExtractFilesA
ExtractFilesW
FileSaveMarkNotExist
FileSaveMarkNotExistA
FileSaveMarkNotExistW
FileSaveRestore
FileSaveRestoreA
FileSaveRestoreOnINF
FileSaveRestoreOnINFA
FileSaveRestoreOnINFW
FileSaveRestoreW
GetVersionFromFile
GetVersionFromFileA
GetVersionFromFileEx
GetVersionFromFileExA
GetVersionFromFileExW
GetVersionFromFileW
IsNTAdmin
LaunchINFSection
LaunchINFSectionA
LaunchINFSectionEx
LaunchINFSectionExA
LaunchINFSectionExW
LaunchINFSectionW
NeedReboot
NeedRebootInit
OpenINFEngine
OpenINFEngineA
OpenINFEngineW
RebootCheckOnInstall
RebootCheckOnInstallA
RebootCheckOnInstallW
RegInstall
RegInstallA
RegInstallW
RegRestoreAll
RegRestoreAllA
RegRestoreAllW
RegSaveRestore
RegSaveRestoreA
RegSaveRestoreOnINF
RegSaveRestoreOnINFA
RegSaveRestoreOnINFW
RegSaveRestoreW
RegisterOCX
RegisterOCXW
RunSetupCommand
RunSetupCommandA
RunSetupCommandW
SetPerUserSecValues
SetPerUserSecValuesA
SetPerUserSecValuesW
TranslateInfString
TranslateInfStringA
TranslateInfStringEx
TranslateInfStringExA
TranslateInfStringExW
TranslateInfStringW
UserInstStubWrapper
UserInstStubWrapperA
UserInstStubWrapperW
UserUnInstStubWrapper
UserUnInstStubWrapperA
UserUnInstStubWrapperW
Name
.text
Size
116KB
Virtual Size
115KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
196B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33138,
count=5, id=259, version=33138,
count=226, id=1, productName=Unmarked objects,
count=19, id=257, version=33138,
count=1, id=256, version=33138,
count=25, id=264, version=33138,
count=1, id=255, version=33138,
count=1, id=258, version=33138,
aeevts.dll
- SHA256 3e9eeef724a1cfc8efd28d844c2ef93fbc9c589fb967972826ec1e85f7b30e1a
- MD5 b1fb90460e64ff5fb355015e0aaa8f55
- SHA1 b29edfe643774951f26555c39ab0d89e6cbea62a
- SHA512 f89fbdd78203709a3aac5490295f987869754fc9c4e260be8b5c05c7d31888d984655d453aa9b9e5070cf3f6a2214e2a669d5acddb8263c4b5255d096128491c
- SSDEEP 384:TWtTWJjQAI2mNChgCweNvpBJG9EgRVLFMmBeJ71aLa0aua0MR9nil8pf:+EBuFMPp
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
4KB
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
32KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=33136,
count=1, id=258, version=33136,
aeinv.dll
- IMPHASH 54e9f77a6459c60a424282fc4e52dba5
- SHA256 bc298d57abe6d3537a02373da2de4cfb489ccaa789bfb38d06f45dfe0d3a8ffe
- MD5 83801773bdc161a1a6cf03615acffb76
- SHA1 3cd3c85b815df66e1672dbbcc7008b90a9501bda
- SHA512 489159edf0a6a701ef2d183ab9a635e1be9c8e648eb747e6dce5d3f3c85ce7a5d582360197835852f160d6d3fd632cf43951eb8d2fd3ab9306fefe946ebd4818
- SSDEEP 24576:/eOYWsOYk8nuolHY5tgbechOUuggnnMxV54:SWs7kAHCcgnnMx4
- MD5 SHA1 SHA512 SSDEEP
Digest
bf:59:f4:7f:5f:b7:68:63:f3:21:96:d7:af:62:ec:35:71:c4:24:f3:8f:af:93:93:1d:4c:5e:86:61:3e:91:f1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 29, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:a8:82:e6:b8:ac:1c:5d:5f:f0:00:00:00:00:04:a8
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2024 - Sep 11, 2025
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Minor OS version
0
Major OS version
10
Entry point
341328
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
aeinv.pdb
msvcrt
islower
_wcsdup
__crtCompareStringW
__crtLCMapStringW
__crtLCMapStringA
_wsetlocale
abort
memset
wcsspn
iswspace
ungetwc
ungetc
fgetwc
fgetc
memcmp
towlower
_wtoi
iswdigit
wcsncmp
strncmp
toupper
wcsrchr
wcstoul
_wsplitpath_s
wcspbrk
___lc_collate_cp_func
wcschr
strcpy_s
_wcslwr
wcscat_s
__uncaught_exception
calloc
isupper
__pctype_func
setlocale
_wfsopen
fseek
_ismbblead
___lc_codepage_func
___lc_handle_func
___mb_cur_max_func
memmove_s
iswprint
fputc
isdigit
towupper
wcstok_s
realloc
??0bad_cast@@QEAA@PEBD@Z
??1bad_cast@@UEAA@XZ
??0bad_cast@@QEAA@AEBV0@@Z
fclose
fwrite
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
??0exception@@QEAA@AEBQEBDH@Z
__mb_cur_max
fgetpos
_fseeki64
fsetpos
setvbuf
fflush
_vsnwprintf_s
_vscwprintf
iswalpha
tolower
_wtoi64
iswcntrl
??0exception@@QEAA@AEBQEBD@Z
_wcsnicmp
_vsnprintf
wcsstr
?what@exception@@UEBAPEBDXZ
_wcsicmp
wcscpy_s
strchr
_set_errno
strtol
_errno
strncpy_s
sprintf_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
_purecall
memcpy_s
_vsnwprintf
fputwc
__CxxFrameHandler3
wcscmp
ntdll
ZwOpenKey
LdrResSearchResource
ZwQueryInformationFile
ZwOpenFile
ZwQueryValueKey
RtlFormatCurrentUserKeyPath
ZwMapViewOfSection
RtlInitUnicodeStringEx
ZwSetInformationProcess
ZwQueryDirectoryFile
RtlVerifyVersionInfo
RtlGetFullPathName_UEx
RtlSecondsSince1970ToTime
RtlGetNativeSystemInformation
RtlpEnsureBufferSize
ZwQueryInformationProcess
RtlxAnsiStringToUnicodeSize
RtlFreeUnicodeString
ZwCreateSection
RtlUpcaseUnicodeString
RtlUpcaseUnicodeChar
RtlTimeToTimeFields
ZwCreateFile
RtlAppendUnicodeToString
RtlNtPathNameToDosPathName
RtlAppendUnicodeStringToString
ZwUnmapViewOfSection
EtwTraceMessage
RtlComputeCrc32
RtlCompareMemory
ZwQuerySystemInformation
RtlAnsiStringToUnicodeString
ZwClose
EtwEventRegister
EtwEventWrite
EtwEventUnregister
RtlLeaveCriticalSection
RtlFreeHeap
RtlInitializeCriticalSection
ZwEnumerateKey
RtlMultiByteToUnicodeN
RtlInitAnsiString
RtlEnterCriticalSection
RtlReAllocateHeap
RtlEqualString
RtlAllocateHeap
RtlDeleteCriticalSection
RtlDosPathNameToNtPathName_U_WithStatus
ZwEnumerateValueKey
RtlRunOnceExecuteOnce
RtlCopyUnicodeString
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EtwEventWriteNoRegistration
RtlAllocateAndInitializeSid
RtlNtStatusToDosError
RtlFreeSid
WinSqmIsOptedInEx
VerSetConditionMask
RtlInitUnicodeString
LdrGetDllHandle
RtlInitString
LdrGetProcedureAddress
RtlDosPathNameToRelativeNtPathName_U_WithStatus
NtCreateFile
NtQueryInformationFile
NtClose
RtlGetVersion
advapi32
CryptAcquireContextW
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
TraceEvent
CryptCreateHash
EventUnregister
SetEntriesInAclW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
EventWriteTransfer
RegGetValueW
EventRegister
RegLoadAppKeyW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetKeyValueW
RegDeleteKeyValueW
GetTokenInformation
RegCloseKey
ConvertSidToStringSidW
OpenThreadToken
OpenProcessToken
kernel32
WriteFile
ExpandEnvironmentStringsW
InitializeSRWLock
TryAcquireSRWLockExclusive
RaiseException
GetCommandLineW
DeviceIoControl
GetVolumeInformationByHandleW
InitOnceExecuteOnce
GetFullPathNameW
OutputDebugStringA
GetModuleFileNameW
CreateFileW
GetSystemInfo
GetModuleHandleExA
GetLocalTime
DebugBreak
WaitNamedPipeW
FindFirstFileW
FindNextFileW
SetNamedPipeHandleState
HeapFree
SetLastError
GetModuleHandleExW
WaitForThreadpoolTimerCallbacks
GetCurrentThreadId
FormatMessageW
GetLastError
ReleaseSRWLockExclusive
CloseThreadpoolTimer
AcquireSRWLockExclusive
SetThreadpoolTimer
ReleaseSRWLockShared
HeapAlloc
GetProcAddress
AcquireSRWLockShared
GetProcessHeap
GetModuleHandleW
GetLongPathNameW
WideCharToMultiByte
GetTickCount
QueryThreadCycleTime
GetCurrentThread
Sleep
VerifyVersionInfoW
LoadLibraryW
LoadLibraryExW
CloseHandle
UnmapViewOfFile
ReleaseMutex
SetEvent
WaitForSingleObject
SetWaitableTimer
ReleaseSemaphore
WaitForMultipleObjects
LocalFree
CreateWaitableTimerW
OpenWaitableTimerW
CreateSemaphoreW
CreateEventW
LeaveCriticalSection
EnterCriticalSection
GetSystemTimeAsFileTime
LocaleNameToLCID
FileTimeToSystemTime
LocalAlloc
GetSystemDirectoryW
GetFileAttributesW
SignalObjectAndWait
HeapReAlloc
OutputDebugStringW
IsDebuggerPresent
WaitForSingleObjectEx
MapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetCurrentProcessId
CreateMutexExW
CreateMutexW
GetCurrentDirectoryW
InitializeCriticalSection
GetFileTime
K32EnumProcesses
OpenProcess
QueryFullProcessImageNameW
RegisterWaitForSingleObject
UnregisterWait
QueryUnbiasedInterruptTime
GetSystemPowerStatus
GetCurrentProcess
GetProcessTimes
K32GetProcessMemoryInfo
CreateThreadpoolTimer
CreateThread
CreateEventExW
DeleteCriticalSection
InitializeCriticalSectionEx
GetModuleFileNameA
CreateSemaphoreExW
OpenSemaphoreW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
LoadLibraryExA
DelayLoadFailureHook
MultiByteToWideChar
GetStringTypeW
EncodePointer
DecodePointer
WakeAllConditionVariable
SleepConditionVariableSRW
FindClose
FreeLibrary
CreateActCtxW
QueryActCtxW
ReleaseActCtx
GetLogicalDriveStringsW
QueryDosDeviceW
GetEnvironmentStringsW
FreeEnvironmentStringsW
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
oleaut32
VariantCopy
SysFreeString
SysStringLen
VariantClear
VariantChangeType
SysAllocString
VariantInit
rpcrt4
UuidCreate
msi
ord8
ord141
ord32
ord159
ord166
ord115
ord92
ord113
ord118
ord248
ord160
ord294
shlwapi
ord487
SHCreateStreamOnFileEx
PathCommonPrefixW
PathFindFileNameW
PathFileExistsW
PathUnExpandEnvStringsW
PathIsNetworkPathW
CreateAppxPackageInventory
CreateAppxPackageInventoryExtracted
CreateSoftwareInventory
GetAppInfo
GetAppInfo2
GetAppInventory
GetApplicationKBsTC2
GetCachedAppInventory
GetDetailedAppInventory
GetDetailedAppInventoryFile
GetDetailedAppInventoryOrphanFile
UpdateSoftwareInventoryW
UpdateSoftwareInventoryWTCEx
Name
.text
Size
780KB
Virtual Size
779KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
308KB
Virtual Size
306KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
280B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33140,
count=469, id=1, productName=Unmarked objects,
count=11, id=257, version=33140,
count=22, id=261, version=33140,
count=68, id=260, version=33140,
count=1, id=256, version=33140,
count=68, id=264, version=33140,
count=1, id=255, version=33140,
count=1, id=258, version=33140,
aeinvext.dll
- IMPHASH bf8af2c82e732beed41735a4c5bbd996
- SHA256 5798ca103742e38b0f3fd76d7d4ea67969448b42d1773fcb5a0044b973c3bb8e
- MD5 b077dca3a3302c6698704db7dc479f83
- SHA1 fb32cd263cca1bc4c161845170e2bc457b1218fa
- SHA512 f11b86857b8f3b0d60c34348184d795c8c15bf8c0c9e88aa22dda842b9bfea678bd589b5aad71f4cbcd5993f9fdc2787b17ed58ceba9519a93147e69b373d46c
- SSDEEP 3072:D3iMxAOK2PfVvIuHFIZBsXI8+4KyhmX6Fym:GMxTtvIuHqfs+yhmKj
- MD5 SHA1 SHA512 SSDEEP
Digest
b8:e8:50:d1:ed:6a:80:d0:10:2b:54:ce:43:b4:de:ed:0f:20:77:bc:70:e8:e2:d8:b8:3c:be:18:4d:0d:b2:a8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 29, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:a8:82:e6:b8:ac:1c:5d:5f:f0:00:00:00:00:04:a8
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2024 - Sep 11, 2025
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Minor OS version
0
Major OS version
10
Entry point
6576
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
aeinvext.pdb
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o__wcslwr
_o__wcsnicmp
_o_abort
_o_free
_o_iswspace
_o_malloc
_o_strcpy_s
_o_wcscat_s
_o_wcscpy_s
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__configure_narrow_argv
wcschr
wcsstr
strchr
wcsrchr
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
FreeLibrary
GetModuleFileNameW
LoadLibraryExW
GetModuleHandleExA
GetModuleHandleExW
GetProcAddress
GetModuleHandleW
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
CreateMutexExW
DeleteCriticalSection
ReleaseMutex
CreateEventW
WaitForSingleObject
ResetEvent
ReleaseSemaphore
SetEvent
LeaveCriticalSection
CreateSemaphoreExW
OpenSemaphoreW
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
GetLastError
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
OpenProcessToken
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringA
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
ntdll
RtlReAllocateHeap
RtlEqualString
RtlAppendUnicodeToString
RtlUpcaseUnicodeChar
RtlAllocateHeap
RtlDeleteCriticalSection
RtlGetNativeSystemInformation
RtlInitUnicodeStringEx
RtlEnterCriticalSection
ZwQuerySystemInformation
ZwQueryValueKey
RtlAppendUnicodeStringToString
RtlInitAnsiString
ZwOpenKey
RtlMultiByteToUnicodeN
RtlInitUnicodeString
LdrGetDllHandle
RtlInitString
ZwEnumerateKey
LdrGetProcedureAddress
RtlDosPathNameToRelativeNtPathName_U_WithStatus
NtCreateFile
NtQueryInformationFile
NtClose
ZwClose
EtwEventRegister
EtwEventWrite
EtwEventUnregister
RtlLeaveCriticalSection
RtlFreeHeap
RtlInitializeCriticalSection
api-ms-win-security-base-l1-1-0
RevertToSelf
GetTokenInformation
ImpersonateLoggedOnUser
api-ms-win-core-sysinfo-l2-1-0
GetUserNameW
api-ms-win-core-sysinfo-l1-1-0
GetWindowsDirectoryW
GetSystemTimeAsFileTime
GetLocalTime
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
K32EnumProcesses
api-ms-win-core-processthreads-l1-1-1
OpenProcess
IsProcessorFeaturePresent
api-ms-win-core-com-l1-1-0
CoUninitialize
CoCreateInstance
CoInitializeEx
CoTaskMemFree
CoTaskMemAlloc
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-namedpipe-l1-1-0
WaitNamedPipeW
SetNamedPipeHandleState
api-ms-win-core-file-l1-1-0
WriteFile
CreateFileW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventUnregister
EventRegister
oleaut32
SysAllocString
GetErrorInfo
SetErrorInfo
SysStringLen
SysFreeString
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
GetSparkId
Name
.text
Size
76KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
380B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=60, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33140,
count=5, id=259, version=33140,
count=1234, id=1, productName=Unmarked objects,
count=3, id=257, version=33140,
count=26, id=261, version=33140,
count=1, id=256, version=33140,
count=7, id=264, version=33140,
count=1, id=253, version=33140,
count=1, id=255, version=33140,
count=1, id=258, version=33140,
aemarebackup.dll
- IMPHASH a12bc75e1888b8d0ab7f486031c78609
- SHA256 7a2ad332f71754ded3a208ccc8c895a8a6f2d3fddaf44dd1d06a65f723c397e2
- MD5 3406bc45650f31a6290a065f88eb63e6
- SHA1 e41c610ff423f2e5099f106c656b546b3e0e9983
- SHA512 00916db3fa133e81518069ba806848ae1811f347c0c6ff015ab5a14c6630f40d7609b5f666cd78466801a621829c3a97ebe9b564f3aedb77f16e5fc8b368dd57
- SSDEEP 24576:w3pg8cKANDLlG8YR93n6YlVnfKIBTSBrE:Qpg8cKYLl8R9X6YlVn1tYI
- MD5 SHA1 SHA512 SSDEEP
Digest
e6:6e:9f:59:18:09:1f:67:52:db:e3:ae:81:39:c8:c6:13:20:46:e3:28:df:34:46:2f:24:88:0b:8a:bf:69:dd
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 29, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:a8:82:e6:b8:ac:1c:5d:5f:f0:00:00:00:00:04:a8
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2024 - Sep 11, 2025
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Minor OS version
0
Major OS version
10
Entry point
22480
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
AeMareBackup.pdb
msvcrt
memcpy
_W_Getdays
__crtLCMapStringA
_wsetlocale
strncmp
_W_Getmonths
memmove
__uncaught_exception
__crtCompareStringA
__crtCompareStringW
wcsrchr
strcpy_s
wcscat_s
_vsnprintf
realloc
??0exception@@QEAA@AEBQEBDH@Z
_W_Gettnames
_Getmonths
wcscmp
__CxxFrameHandler3
iswalpha
islower
iswcntrl
iswspace
_wcsnicmp
_wcslwr
_wtoi64
setlocale
___mb_cur_max_func
_Wcsftime
_Strftime
tolower
wcsncmp
_wcsdup
wcstol
__crtLCMapStringW
___lc_handle_func
___lc_codepage_func
fgetc
memcmp
___lc_collate_cp_func
_errno
swprintf_s
strcspn
memset
_vscwprintf
localeconv
fwrite
fgetpos
fgetwc
_fseeki64
ldexp
wcstoul
_CxxThrowException
fsetpos
setvbuf
fflush
isspace
__mb_cur_max
??0bad_cast@@QEAA@PEBD@Z
??1bad_cast@@UEAA@XZ
??0bad_cast@@QEAA@AEBV0@@Z
_Gettnames
sprintf_s
wcscpy_s
fclose
localtime
strftime
time
??0exception@@QEAA@AEBQEBD@Z
_wsplitpath_s
wcsstr
??1type_info@@UEAA@XZ
wcschr
towlower
_Getdays
_wfopen_s
_onexit
_wfsopen
__dllonexit
fseek
_unlock
_lock
_initterm
malloc
fwprintf_s
free
_amsg_exit
_wcsicmp
?what@exception@@UEBAPEBDXZ
ungetwc
_XcptFilter
ungetc
__C_specific_handler
?terminate@@YAXXZ
_vsnwprintf_s
isdigit
isalnum
memchr
_wtoi
memmove_s
calloc
isupper
??0exception@@QEAA@AEBV0@@Z
__pctype_func
strchr
fputwc
_ismbblead
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
_purecall
memcpy_s
_vsnwprintf
abort
__CxxFrameHandler4
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExA
GetModuleFileNameA
FreeLibrary
GetProcAddress
GetModuleHandleExW
GetModuleHandleW
GetModuleFileNameW
LoadLibraryExW
ntdll
ZwQueryValueKey
RtlInitUnicodeStringEx
ZwQueryInformationFile
LdrResSearchResource
ZwOpenKey
RtlVerifyVersionInfo
RtlSecondsSince1970ToTime
RtlGetNativeSystemInformation
RtlxAnsiStringToUnicodeSize
RtlFreeUnicodeString
ZwCreateSection
EtwTraceMessage
RtlDosPathNameToNtPathName_U_WithStatus
RtlUpcaseUnicodeChar
RtlTimeToTimeFields
ZwCreateFile
RtlAppendUnicodeToString
RtlAppendUnicodeStringToString
ZwUnmapViewOfSection
ZwQuerySystemInformation
RtlAnsiStringToUnicodeString
ZwClose
EtwEventRegister
EtwEventWrite
EtwEventUnregister
RtlLeaveCriticalSection
RtlInitializeCriticalSection
ZwEnumerateKey
RtlMultiByteToUnicodeN
RtlInitAnsiString
RtlEnterCriticalSection
RtlEqualString
RtlDeleteCriticalSection
RtlAllocateAndInitializeSid
RtlNtStatusToDosError
RtlFreeSid
ZwMapViewOfSection
LdrGetProcedureAddress
LdrGetDllHandle
RtlDosPathNameToRelativeNtPathName_U_WithStatus
RtlInitUnicodeString
NtClose
NtQueryInformationFile
RtlFreeHeap
RtlReAllocateHeap
RtlAllocateHeap
NtCreateFile
RtlInitString
WinSqmIsOptedInEx
api-ms-win-core-synch-l1-1-0
InitializeCriticalSection
AcquireSRWLockShared
CreateMutexExW
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
CreateMutexW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseMutex
WaitForSingleObject
InitializeCriticalSectionEx
CreateEventW
SetWaitableTimer
CreateEventExW
SetEvent
LeaveCriticalSection
ReleaseSemaphore
InitializeSRWLock
TryAcquireSRWLockExclusive
EnterCriticalSection
CreateSemaphoreExW
DeleteCriticalSection
OpenWaitableTimerW
api-ms-win-core-heap-l1-1-0
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegQueryInfoKeyW
RegLoadAppKeyW
RegCloseKey
RegEnumValueW
RegEnumKeyExW
RegOpenKeyExW
RegGetValueW
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
CreateThread
api-ms-win-core-localization-l1-2-0
GetLocaleInfoW
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
OutputDebugStringA
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
GetStringTypeW
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-synch-l1-2-0
WakeAllConditionVariable
SleepConditionVariableSRW
SignalObjectAndWait
Sleep
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetLocalTime
GetSystemTimeAsFileTime
GetSystemDirectoryW
ole32
PropVariantClear
CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitialize
CoTaskMemAlloc
aepic
ord101
ord107
ord109
ord106
ord100
ord102
ord104
ord105
ord103
ord108
psapi
GetDeviceDriverBaseNameW
EnumDeviceDrivers
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventWriteTransfer
EventUnregister
EventSetInformation
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-kernel32-legacy-l1-1-1
VerifyVersionInfoW
api-ms-win-core-sysinfo-l1-2-0
VerSetConditionMask
rpcrt4
UuidCreate
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
CreateWaitableTimerW
CreateSemaphoreW
api-ms-win-core-memory-l1-1-0
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
OpenFileMappingW
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-security-base-l1-1-0
IsWellKnownSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
api-ms-win-security-provider-l1-1-0
SetEntriesInAclW
api-ms-win-core-version-l1-1-0
VerQueryValueW
api-ms-win-core-version-l1-1-1
GetFileVersionInfoSizeW
GetFileVersionInfoW
api-ms-win-core-file-l1-1-0
CreateFileW
GetFileAttributesW
QueryDosDeviceW
GetLogicalDriveStringsW
GetFileAttributesExW
WriteFile
GetVolumeInformationByHandleW
GetLongPathNameW
CompareFileTime
CreateDirectoryW
FindFirstFileW
FindNextFileW
FindClose
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
GetCurrentDirectoryW
GetCommandLineW
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
api-ms-win-security-sddl-l1-1-0
ConvertStringSidToSidW
api-ms-win-core-winrt-l1-1-0
RoInitialize
RoUninitialize
api-ms-win-core-path-l1-1-0
PathCchCanonicalizeEx
PathCchRemoveFileSpec
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
api-ms-win-core-shlwapi-legacy-l1-1-0
PathUnExpandEnvStringsW
PathFileExistsW
api-ms-win-shcore-path-l1-1-0
ord170
api-ms-win-core-commandlinetoargv-l1-1-0
CommandLineToArgvW
api-ms-win-core-namedpipe-l1-1-0
WaitNamedPipeW
SetNamedPipeHandleState
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-security-cryptoapi-l1-1-0
CryptAcquireContextW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
api-ms-win-core-sidebyside-l1-1-0
CreateActCtxW
ReleaseActCtx
QueryActCtxW
api-ms-win-eventing-classicprovider-l1-1-0
TraceEvent
BackupMareDataTC2
Name
.text
Size
644KB
Virtual Size
643KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
156KB
Virtual Size
152KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
28KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=100, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33140,
count=398, id=1, productName=Unmarked objects,
count=11, id=257, version=33140,
count=21, id=261, version=33140,
count=67, id=260, version=33140,
count=1, id=256, version=33140,
count=32, id=264, version=33140,
count=1, id=255, version=33140,
count=1, id=258, version=33140,
aepic.dll
- IMPHASH 12066b57b608f43e6ee2eb47d5ab9216
- SHA256 5ae3b209390d6e5a6a25e3cd9fc15f5a58c8167d6edc6488cc65b854ef234681
- MD5 a039814fa8bb5e0258fc75da497f3ca5
- SHA1 baaaa523c51e7053937c46f1b706f1ef928dea43
- SHA512 0aae23dbc7a3cc95993bf146fe651e5f0bcd55d223aaa80bcbdbbefcce812483d204e003fc9d9d2690502291f2b413ff195e5821fa533b74331cf63ccac9eb58
- SSDEEP 12288:YqKwm5+thXf9VWazkipXdCQwJmCSlfWY/p3Tt4WGU:w35+tZV0okipXdCQwTS0Y/p3Tt4WGU
- MD5 SHA1 SHA512 SSDEEP
Digest
1b:10:c1:2a:82:1b:7d:c9:48:37:ca:9d:80:cc:a9:3b:1b:14:3e:df:f1:3b:a9:9f:2b:22:d4:e3:ba:83:10:cd
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 29, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:a7:04:3e:e4:22:c8:34:fa:fc:00:00:00:00:04:a7
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2024 - Sep 11, 2025
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Minor OS version
0
Major OS version
10
Entry point
19696
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
aepic.pdb
msvcp_win
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBGHH@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?in@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
?tolower@?$ctype@G@std@@QEBAGG@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ
?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?eof@ios_base@std@@QEBA_NXZ
?_Gninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?_Getcat@?$codecvt@GDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGD@Z
?getloc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXXZ
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA_N_N@Z
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
_Wcscoll
_Wcsxfrm
?id@?$collate@G@std@@2V0locale@2@A
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??1?$basic_istream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xbad_alloc@std@@YAXXZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?is@?$ctype@G@std@@QEBA_NFG@Z
??1_Locinfo@std@@QEAA@XZ
??1_Lockit@std@@QEAA@XZ
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??0_Locinfo@std@@QEAA@PEBD@Z
??0_Lockit@std@@QEAA@H@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$ctype@G@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__lock_file
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__unlock_file
_o__wcsicmp
_o__wcslwr
_o__wcsnicmp
memmove
_o__wsplitpath_s
_o__wtoi
_o__wtoi64
_o_fclose
_o_fflush
_o_fgetc
_o_fgetpos
_o_fgetwc
_o_fputwc
_o_free
_o_fsetpos
_o_fwrite
_o_iswalpha
_o_iswcntrl
_o_iswspace
_o_rand
_o_realloc
_o_setvbuf
_o_srand
_o_strcpy_s
_o_strncpy_s
_o_strtol
_o_terminate
_o_tolower
_o_towlower
_o_ungetc
_o_ungetwc
_o_wcscat_s
_o_wcscpy_s
_o_wcstoul
_o_wmemcpy_s
__current_exception
__current_exception_context
__CxxFrameHandler3
_o__execute_onexit_table
_o__errno
__C_specific_handler
wcsstr
wcschr
_o__fseeki64
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
strchr
wcsrchr
__std_terminate
__CxxFrameHandler4
_CxxThrowException
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
_o___stdio_common_vsnwprintf_s
memcmp
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
memcpy
api-ms-win-crt-string-l1-1-0
strncmp
memset
wcscmp
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
ZwClose
RtlDosPathNameToNtPathName_U_WithStatus
RtlFreeUnicodeString
ZwOpenKey
ZwEnumerateKey
RtlInitUnicodeStringEx
ZwQueryValueKey
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
ZwCreateFile
ZwQueryInformationFile
ZwCreateSection
RtlSecondsSince1970ToTime
RtlxAnsiStringToUnicodeSize
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlUpcaseUnicodeChar
RtlDeleteCriticalSection
RtlEqualString
RtlEnterCriticalSection
RtlMultiByteToUnicodeN
RtlInitializeCriticalSection
RtlLeaveCriticalSection
EtwEventUnregister
EtwEventWrite
EtwEventRegister
RtlGetNativeSystemInformation
RtlFreeHeap
RtlAllocateHeap
ZwQuerySystemInformation
RtlInitUnicodeString
LdrGetDllHandle
RtlInitString
LdrGetProcedureAddress
RtlDosPathNameToRelativeNtPathName_U_WithStatus
NtCreateFile
NtQueryInformationFile
NtClose
WinSqmIsOptedInEx
ZwUnmapViewOfSection
RtlAllocateAndInitializeSid
RtlNtStatusToDosError
RtlFreeSid
VerSetConditionMask
ZwMapViewOfSection
RtlTimeToTimeFields
LdrResSearchResource
RtlVerifyVersionInfo
EtwTraceMessage
RtlAdjustPrivilege
RtlReAllocateHeap
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
FreeLibrary
GetModuleHandleW
GetModuleHandleExW
LoadLibraryExW
GetProcAddress
GetModuleFileNameW
GetModuleHandleExA
api-ms-win-core-synch-l1-1-0
SleepEx
InitializeSRWLock
CreateEventExW
InitializeCriticalSectionAndSpinCount
ResetEvent
CreateSemaphoreExW
EnterCriticalSection
TryAcquireSRWLockExclusive
CreateMutexW
LeaveCriticalSection
InitializeCriticalSectionEx
WaitForSingleObject
InitializeCriticalSection
CreateEventW
ReleaseMutex
OpenWaitableTimerW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SetWaitableTimer
SetEvent
ReleaseSemaphore
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapReAlloc
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
RaiseException
GetLastError
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-processthreads-l1-1-0
CreateThread
OpenProcessToken
OpenThreadToken
GetCurrentThreadId
GetProcessTimes
GetCurrentProcessId
GetCurrentThread
GetCurrentProcess
TerminateProcess
api-ms-win-core-localization-l1-2-0
LocaleNameToLCID
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
OutputDebugStringA
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-winrt-string-l1-1-0
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsGetStringRawBuffer
WindowsCreateString
WindowsDeleteString
WindowsDuplicateString
WindowsCreateStringReference
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoInitialize
RoGetActivationFactory
RoUninitialize
api-ms-win-core-memory-l1-1-0
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventUnregister
EventRegister
EventSetInformation
api-ms-win-core-kernel32-legacy-l1-1-1
VerifyVersionInfoW
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
CreateWaitableTimerW
CreateSemaphoreW
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-security-base-l1-1-0
GetTokenInformation
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
DuplicateTokenEx
InitializeSecurityDescriptor
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
GetSystemDirectoryW
GetTickCount
GetLocalTime
GetSystemTimeAsFileTime
GetSystemWindowsDirectoryW
api-ms-win-core-registry-l1-1-0
RegDeleteTreeW
RegSaveKeyExW
RegDeleteValueW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegDeleteKeyExW
RegLoadAppKeyW
RegQueryInfoKeyW
RegSetKeySecurity
RegGetValueW
RegOpenKeyExW
RegUnLoadKeyW
RegLoadKeyW
api-ms-win-core-version-l1-1-0
VerQueryValueW
api-ms-win-core-version-l1-1-1
GetFileVersionInfoW
GetFileVersionInfoSizeW
api-ms-win-core-file-l1-1-0
FindClose
FindNextFileW
WriteFile
CreateFileW
GetLongPathNameW
GetFileAttributesW
GetVolumeInformationByHandleW
QueryDosDeviceW
GetLogicalDriveStringsW
FindFirstFileW
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceBeginInitialize
InitOnceComplete
SignalObjectAndWait
InitOnceExecuteOnce
api-ms-win-core-realtime-l1-1-0
QueryUnbiasedInterruptTime
QueryThreadCycleTime
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
RoOriginateError
GetRestrictedErrorInfo
RoOriginateErrorW
SetRestrictedErrorInfo
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-com-l1-1-0
CoUninitialize
CoTaskMemFree
PropVariantClear
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoGetInterfaceAndReleaseStream
CoMarshalInterface
CreateStreamOnHGlobal
CoReleaseMarshalData
CoTaskMemAlloc
CoGetCallContext
CoInitializeEx
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-winrt-error-l1-1-1
RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
api-ms-win-service-management-l1-1-0
CloseServiceHandle
StartServiceW
OpenSCManagerW
OpenServiceW
api-ms-win-service-winsvc-l1-1-0
QueryServiceStatus
api-ms-win-service-management-l2-1-0
NotifyServiceStatusChangeW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-namedpipe-l1-1-0
WaitNamedPipeW
SetNamedPipeHandleState
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
GetCommandLineW
GetCurrentDirectoryW
api-ms-win-core-registry-l1-1-1
RegDeleteKeyValueW
RegSetKeyValueW
api-ms-win-core-file-l2-1-0
MoveFileExW
api-ms-win-core-path-l1-1-0
PathAllocCombine
PathCchCanonicalizeEx
PathCchRemoveFileSpec
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-shlwapi-legacy-l1-1-0
PathUnExpandEnvStringsW
PathFileExistsW
api-ms-win-core-commandlinetoargv-l1-1-0
CommandLineToArgvW
api-ms-win-core-psapi-l1-1-0
K32GetProcessMemoryInfo
api-ms-win-core-featurestaging-l1-1-0
SubscribeFeatureStateChangeNotification
GetFeatureEnabledState
RecordFeatureUsage
UnsubscribeFeatureStateChangeNotification
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
api-ms-win-core-string-l2-1-1
SHLoadIndirectString
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-eventing-classicprovider-l1-1-0
TraceEvent
api-ms-win-core-sidebyside-l1-1-0
QueryActCtxW
CreateActCtxW
ReleaseActCtx
DllCanUnloadNow
DllGetActivationFactory
GetAppInventoryCore
GetPrivacyLevel
PicAmiClose
PicAmiInitialize
PicFreeFileInfo
PicRetrieveFileInfo
PicRetrieveFileInfoAppx
PicRetrieveFileLastRunTime
PicUpdateFileLastRunTime
UpdateSoftwareInventoryTC2
Name
.text
Size
428KB
Virtual Size
427KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
124KB
Virtual Size
121KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
320B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=114, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=11, id=260, version=33140,
count=5, id=259, version=33140,
count=1487, id=1, productName=Unmarked objects,
count=5, id=257, version=33140,
count=31, id=261, version=33140,
count=1, id=256, version=33140,
count=58, id=264, version=33140,
count=1, id=253, version=33140,
count=1, id=255, version=33140,
count=1, id=258, version=33140,
agentactivationruntime.dll
- IMPHASH c3ee4264e46ffd3967a8326990f1f38a
- SHA256 367f1fd7dcf1af6c3e1f1d8a37f471350fe8eb0a5b1680e990c2a5497b2b5cbe
- MD5 44dfa56134ed49e584a12780e5c2e9c9
- SHA1 f605d11115e0c4f98558fdcd13b61bfba452af43
- SHA512 766a4f471fa2c981199b9bd84f6a561f04f8a199377ad9c71a558d5281a636e3b8672bcd0d51f22ff6c7d47fcaa4cd836e103c2fb66cd2926b559109a5743648
- SSDEEP 12288:PbCYEaLDjT5G0AleAyCzRcdjv8nzsLJWd1XTfVATQjO/d:DVLDjQXlW8C7FJWd1XTdAZ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
290400
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
agentactivationruntime.pdb
msvcp_win
_Mtx_destroy_in_situ
??Bid@locale@std@@QEAA_KXZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?in@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z
??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
_Cnd_broadcast
_Thrd_detach
?_Xbad_function_call@std@@YAXXZ
?uncaught_exception@std@@YA_NXZ
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
_Cnd_timedwait
_Mtx_current_owns
_Xtime_get_ticks
_Query_perf_counter
_Thrd_sleep
_Query_perf_frequency
_Cnd_destroy_in_situ
_Thrd_join
_Thrd_id
_Cnd_wait
_Cnd_do_broadcast_at_thread_exit
?_Syserror_map@std@@YAPEBDH@Z
_Cnd_init_in_situ
_Cnd_signal
?_Xlength_error@std@@YAXPEBD@Z
_Mtx_unlock
_Mtx_init_in_situ
_Mtx_lock
?_Throw_Cpp_error@std@@YAXH@Z
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___stdio_common_vsprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vswprintf_s
_o__beginthreadex
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o___std_exception_copy
_o__register_onexit_function
_o__seh_filter_dll
__RTDynamicCast
_o__wfopen
_o__wgetenv
_o_ceilf
_o_cos
_o_cosf
_o_expf
_o_fclose
_o_fread
_o_free
_o_fseek
_o_ftell
_o_logf
_o_malloc
_o_rewind
_o_sin
_o_sinf
_o_sqrt
_o_terminate
_o_toupper
_o_towlower
_o_wcstol
__C_specific_handler
__current_exception
__current_exception_context
_CxxThrowException
_o___stdio_common_vfprintf
_o___std_type_info_destroy_list
_o___acrt_iob_func
__RTtypeid
__std_terminate
__std_type_info_compare
__CxxFrameHandler4
_o___std_exception_destroy
memchr
memcmp
memmove
memcpy
strchr
strrchr
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
LoadLibraryExA
FreeLibrary
GetModuleHandleW
GetModuleFileNameW
GetModuleFileNameA
GetProcAddress
api-ms-win-core-synch-l1-1-0
WaitForSingleObjectEx
AcquireSRWLockExclusive
DeleteCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
ReleaseMutex
OpenSemaphoreW
WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection
CreateMutexExW
ReleaseSemaphore
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
CreateSemaphoreExW
ResetEvent
CreateEventW
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-file-l1-1-0
FindFirstFileW
GetFileSizeEx
ReadFile
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
agentactivationruntimewindows
?GetAgentActivationRuntimePalComponentFactory@@YAPEAVIAgentActivationRuntimePalComponentFactory@VoiceAgentServices@Microsoft@@XZ
api-ms-win-core-path-l1-1-0
PathCchRemoveFileSpec
PathCchAddBackslash
api-ms-win-core-file-l1-2-0
CreateFile2
api-ms-win-core-libraryloader-l2-1-0
LoadPackagedLibrary
api-ms-win-appmodel-runtime-l1-1-0
GetPackageFamilyName
?CreateAgentActivationRuntime@@YA?AV?$shared_ptr@VIAgentActivationRuntime@VoiceAgentServices@Microsoft@@@std@@XZ
?GetAgentActivationRuntime@@YA?AV?$shared_ptr@VIAgentActivationRuntime@VoiceAgentServices@Microsoft@@@std@@XZ
?GetLoggerInstance@@YAAEAVLogger@VoiceAgentServices@Microsoft@@XZ
?ReleaseAgentActivationRuntime@@YAXXZ
Name
.text
Size
724KB
Virtual Size
721KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
208KB
Virtual Size
205KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
32KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=55, id=261, version=32217,
count=1, id=260, version=32217,
count=3, id=261, version=33523,
count=48, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33140,
count=5, id=259, version=33140,
count=1211, id=1, productName=Unmarked objects,
count=5, id=257, version=33140,
count=26, id=261, version=33140,
count=1, id=256, version=33140,
count=32, id=264, version=33140,
count=1, id=253, version=33140,
count=1, id=255, version=33140,
count=1, id=258, version=33140,