Assessment Notice.zip
- SHA256 e2db442adb39a41b5db2738a981fc4a6fd5c00769dee6420c4f6d368f6082c8b
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
202607303544.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
tedutil.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
tedutil.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
tedutil_original.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target Assessment Notice.zip
- Size 6.3MB
- Sample260731-gvbgeabl8s
- SHA256 e2db442adb39a41b5db2738a981fc4a6fd5c00769dee6420c4f6d368f6082c8b
- MD5 9d7d1eda9e178c86b405c2623d2dea59
- SHA1 5874d84867169a4f8e1d3a392274254d2a46206e
- SHA512 bdde20ec289c3b53eb4e550f782840e3bbbae4e9945ad7210dde112cfcc551b9f56401a4ec0b8bf417c63d80c15c984e77afc7c9fd4983e5cbaeb3fb87e9ead6
- SSDEEP 98304:2sMLn1fyzWe/k8PyeYU3YubsSkrgsedxt6L8ul8DhHi3aE9RCYqomc6SroQ:Hxk8PywQ9rafAL8ul8gIw6Srz
- TLSH T1EE663337240A61CDB360608052FEA1750CB9EFD53EAD07258E053BDB2A7FE7FA4A9415
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Codesign digest Mismatch 1 IoCs
File was altered after it was signed.
resource unpack001/tedutil.dll - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/202607303544.exe
File Explorer
-
Assessment Notice.zip.zip 6.3MB
-
202607303544.exe.exe 6.3MB
-
tedutil.dll.dll 55KB
-
tedutil_original.dll.dll 298KB
202607303544.exe
- IMPHASH fcd89eebe7a883ae62c53452b4abddf8
- SHA256 46e22c3febad57d20dfb3b3a349ed43570794edc7a5f80008c3dc5970d84c3b9
- MD5 5f37017ca5051bc6df07f398b59f2e50
- SHA1 3f7a740d898a7d4878afcab409a09eefcc55da0b
- SHA512 dd1345fea101b9f3456040fe7b801ee249a92dea8650d7a5809d77fafa90a49d698fad4dc5874af78103ba1488fa96a6ca0806de33699965d8b5cbc0c4a99e55
- SSDEEP 98304:y5tpLkt6IPYonsoseROg7OcqV0yExvfUJSAjk/PTiJay9tc08gsM+cZs:ym5YonsCqdVu9cJSAjkGcq+cZ
- TLSH T1AD66332321885084F3A463348576D569DAB1BC617BA547CF87043ABA1F3BBE79C3B319
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
104000
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
TopoEdit.pdb
kernel32
SetEvent
ResetEvent
WaitForSingleObject
CreateEventW
CreateThread
GetCurrentThreadId
FindResourceExW
FreeLibrary
LeaveCriticalSection
LoadLibraryExW
LoadResource
LockResource
SizeofResource
LocalFree
FormatMessageW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
DelayLoadFailureHook
EnterCriticalSection
HeapSetInformation
SetLastError
GetLastError
RaiseException
CloseHandle
GetFileTime
GetModuleFileNameW
CreateFileW
ResolveDelayLoadedAPI
gdi32
MoveToEx
SelectObject
LineTo
CreateSolidBrush
CreatePen
DeleteObject
CreateFontIndirectW
Rectangle
user32
UpdateWindow
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
GetClientRect
GetWindowRect
MessageBoxW
GetWindowLongPtrW
SetWindowLongPtrW
LoadCursorW
DestroyAcceleratorTable
GetParent
GetFocus
SetCapture
EnableMenuItem
BeginPaint
EndPaint
GetSysColor
FillRect
SetClassLongPtrW
LockWindowUpdate
LoadAcceleratorsW
KillTimer
LoadStringW
SetTimer
GetActiveWindow
LoadMenuW
SendDlgItemMessageW
SetDlgItemTextW
GetDlgItem
EndDialog
ReleaseCapture
TranslateAcceleratorW
DialogBoxParamW
SetWindowPos
ShowWindow
DestroyWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
PostQuitMessage
DefWindowProcW
PostMessageW
SendMessageW
DispatchMessageW
LoadIconW
TranslateMessage
GetMessageW
api-ms-win-crt-string-l1-1-0
memset
wcscmp
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
_c_exit
_register_thread_local_exe_atexit_callback
api-ms-win-crt-private-l1-1-0
_o__configthreadlocale
_o__configure_wide_argv
_o__crt_atexit
_o__errno
_o__exit
_o__get_wide_winmain_command_line
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__recalloc
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_new_mode
_o__wcsicmp
_o__wtoi
_o__wtol
_o_calloc
_o_exit
_o_free
_o_malloc
_o_terminate
_o_wcscpy_s
_o_wcstoul
_o_wmemcpy_s
__C_specific_handler
__current_exception
__current_exception_context
memmove
memcpy
_o__cexit
_o__callnewh
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___p__commode
_o___stdio_common_vswprintf
wcschr
_o__set_fmode
tedutil
TEDGetAttributeType
TEDCreateMediaTypeViewer
TEDCreateDataLoader
TEDCreateTopoViewer
TEDMTStringFromGUID
TEDGetAttributeTypeFromGUID
TEDGetMTKnownAttributes
TEDGetMTKnownGUIDStrings
TEDGetAttributeListLength
TEDGetAttributeName
TEDGetAttributeCategory
api-ms-win-core-com-l1-1-0
PropVariantClear
CoInitializeEx
CoCreateInstance
IIDFromString
StringFromGUID2
CoTaskMemFree
CoUninitialize
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
InitializeCriticalSection
api-ms-win-core-heap-l1-1-0
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
HeapSize
HeapDestroy
api-ms-win-core-memory-l1-1-0
VirtualFree
VirtualAlloc
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetStartupInfoW
TerminateProcess
GetCurrentProcessId
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
LoadLibraryExA
GetModuleHandleW
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
FlushInstructionCache
api-ms-win-core-interlocked-l1-1-0
InterlockedPopEntrySList
InterlockedPushEntrySList
InitializeSListHead
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
mf
MFCreateTopology
MFCreateMediaSession
MFEnumDeviceSources
MFTranscodeGetAudioOutputAvailableTypes
MFCreateTranscodeTopology
MFCreateTranscodeProfile
MFCreateTopoLoader
MFCreateVideoRendererActivate
MFCreateAudioRendererActivate
MFRequireProtectedEnvironment
MFGetService
MFCreateTopologyNode
MFCreatePMPMediaSession
mfplat
MFCreateSourceResolver
MFTEnumEx
MFCreateMediaType
MFCreateAttributes
MFStartup
MFShutdown
MFInvokeCallback
MFCreateAsyncResult
wmvcore
WMCreateReader
Name
.text
Size
104KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
80B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
52KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
664B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=50, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=15, id=257, version=33145,
count=1253, id=1, productName=Unmarked objects,
count=5, id=265, version=33145,
count=39, id=261, version=33145,
count=1, id=253, version=33145,
count=15, id=260, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
tedutil.dll
- IMPHASH 306106bbb2003465d5caaed96ffe3518
- SHA256 cc873c23a5d2eae22dc0268e8c4ea1238313173e8bc0dac4c33283b94ba20b4d
- MD5 6334f9a1cd33220d47224000e8883499
- SHA1 6ab74dcbc84ee90d178c542e5d1ae10cde150332
- SHA512 b663e275e7d965b492e51917219b5260f21e8fe1f3035bab256d1c08b17f68d53720d0e51527923dcd0455c2061c1e8aa058b5e15c3c8deca926a949e0f09b59
- SSDEEP 1536:fCa7a7ccMADZKIn7CJ33ous2ePhnDb8KxcG3yUcWzxU:fCr12eZnDY8yUcWi
- TLSH T1CA431883F36560ADC127C134C7E9A273F6B4B9A91A302D5E4A90CE762C54F40573EF2A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
32:27:e8:35:0b:f5:5e:7d:7c:15:c1:9f:6f:1e:49:1c:79:ae:08:50:a8:38:da:be:9f:d7:86:84:ef:96:f1:b2
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 27, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Jun 23, 2035
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:86:e7:71:94:b9:4d:ff:09:fb:00:00:00:00:00:86
Issuer
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 8, 2025 - May 6, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:09:08:07:e0:f9:5c:8c:e6:55:00:01:00:00:02:09
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
4592
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
advapi32
GetUserNameA
RegCloseKey
RegCreateKeyExW
RegOpenKeyExA
RegQueryInfoKeyA
RegSetValueExW
kernel32
CloseHandle
CopyFileA
CopyFileW
CreateDirectoryA
CreateEventA
CreateFileA
CreateFileW
CreateMutexA
CreateToolhelp32Snapshot
DeleteCriticalSection
DeviceIoControl
DisableThreadLibraryCalls
EnterCriticalSection
ExitProcess
GetComputerNameA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentVariableA
GetExitCodeProcess
GetFileAttributesA
GetFileAttributesW
GetFileSize
GetLastError
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetOEMCP
GetProcAddress
GetSystemDirectoryA
GetSystemInfo
GetTickCount
GlobalMemoryStatusEx
InitializeCriticalSection
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
Process32First
Process32Next
QueryPerformanceFrequency
ReadFile
SetEnvironmentVariableA
SetEnvironmentVariableW
Sleep
TlsGetValue
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForSingleObject
lstrcatA
lstrcpyA
lstrlenA
lstrlenW
msvcrt
__iob_func
_amsg_exit
_initterm
_lock
_strnicmp
_unlock
abort
calloc
fprintf
free
memcpy
realloc
strlen
strncmp
strrchr
strstr
vfprintf
wcsrchr
user32
EnumDisplayDevicesA
wsprintfA
wsprintfW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
TEDCreateDataLoader
TEDCreateDataSaver
TEDCreateMediaTypeViewer
TEDCreateTopoViewer
TEDCreateTopoViewerWindow
TEDGetAttributeCategory
TEDGetAttributeGUID
TEDGetAttributeListLength
TEDGetAttributeName
TEDGetAttributeType
TEDGetAttributeTypeFromGUID
TEDGetMTKnownAttributes
TEDGetMTKnownGUIDStrings
TEDMTStringFromGUID
Name
.text
Size
30KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
1024B
Virtual Size
621B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
704B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
tedutil_original.dll
- IMPHASH 39581144b1c8b1bade166ec9ba48bdf5
- SHA256 02803028ea10dd92e8856c6553fc4ba6b3c09d973f4fc82226bfd2c42f0e6b06
- MD5 d0e37647c1e6819fff84835b5f435241
- SHA1 6afe9c9912d5e3031e7f0450cea9642054f8fa7d
- SHA512 7a1fd746500432830cfa0da5b0c083b9cbcea2c35eac5f9e26509ac562262e9ea21261c51b649ab6b38d3aec1d4504bd61515bf91912e4f833b8df50722bbbbf
- SSDEEP 3072:tjzJ49xlJjz+GR6Z37S1NeAq7ng5vd7elS3QYgsKDSHxsgsqAfJcarjtcxcWi:tjzJWtjz+GcZ37Z7gzvgYgCHgq5arjh
- TLSH T19254F99633E80CE5F7A671BD8657C64EEBB27881175382CB0224015A4FBBFE45D3A361
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
9d:b4:55:6e:fd:3c:35:42:47:14:ba:61:aa:43:37:7f:b9:42:c4:2d:f9:b3:14:8a:68:d2:74:a6:58:3f:4a:2a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 27, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Jun 23, 2035
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:86:e7:71:94:b9:4d:ff:09:fb:00:00:00:00:00:86
Issuer
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 8, 2025 - May 6, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:09:08:07:e0:f9:5c:8c:e6:55:00:01:00:00:02:09
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
176496
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
TEDUTIL.pdb
api-ms-win-crt-string-l1-1-0
memset
wcscmp
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
_o__wtof
_o__wtoi
_o__wtoi64
_o__wtol
_o_calloc
_o_free
_o_malloc
_o_strcpy_s
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstod
_o_wcstoul
_o_wmemcpy_s
_o___std_type_info_destroy_list
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
wcschr
memmove
wcsrchr
memcpy
memcmp
__C_specific_handler
oleaut32
UnRegisterTypeLi
LoadRegTypeLi
SysFreeString
SysAllocString
SysStringLen
LoadTypeLi
VarUI4FromStr
VarBstrCmp
VariantClear
VariantInit
RegisterTypeLi
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
RaiseException
api-ms-win-core-synch-l1-1-0
SetEvent
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
CreateEventW
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
ResetEvent
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
LoadResource
LoadLibraryExA
GetModuleHandleW
FindResourceExW
SizeofResource
LockResource
GetModuleFileNameW
GetProcAddress
FreeLibrary
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-localization-l1-2-0
GetThreadLocale
SetThreadLocale
api-ms-win-core-registry-l1-1-0
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCloseKey
RegCreateKeyExW
RegDeleteValueW
api-ms-win-core-com-l1-1-0
IIDFromString
PropVariantClear
StringFromCLSID
CoCreateInstance
StringFromGUID2
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
api-ms-win-core-file-l1-1-0
CreateFileW
WriteFile
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-timezone-l1-1-0
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SystemTimeToFileTime
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
HeapReAlloc
HeapDestroy
HeapSize
GetProcessHeap
api-ms-win-core-memory-l1-1-0
VirtualFree
VirtualAlloc
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-processthreads-l1-1-1
FlushInstructionCache
IsProcessorFeaturePresent
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedPushEntrySList
InterlockedPopEntrySList
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
mf
MFRequireProtectedEnvironment
MFCreateVideoRendererActivate
MFCreateMPEG4MediaSink
MFCreateSequencerSource
MFCreateTranscodeProfile
MFCreateTopology
MFCreateTopologyNode
MFCreateTranscodeSinkActivate
MFCreateASFProfile
MFCreateASFMediaSink
MFCreateAudioRendererActivate
mfplat
MFCreateSourceResolver
MFCreateFile
MFCreateAttributes
MFTEnumEx
MFCreateEventQueue
MFInitAMMediaTypeFromMFMediaType
MFCreateMediaType
MFCreateCollection
propsys
VariantToPropVariant
PropVariantToVariant
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
TEDCreateDataLoader
TEDCreateDataSaver
TEDCreateMediaTypeViewer
TEDCreateTopoViewer
TEDCreateTopoViewerWindow
TEDGetAttributeCategory
TEDGetAttributeGUID
TEDGetAttributeListLength
TEDGetAttributeName
TEDGetAttributeType
TEDGetAttributeTypeFromGUID
TEDGetMTKnownAttributes
TEDGetMTKnownGUIDStrings
TEDMTStringFromGUID
Name
.text
Size
180KB
Virtual Size
176KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
68KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
408B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=257, version=33145,
count=65, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1233, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=6, id=265, version=33145,
count=1, id=256, version=33145,
count=19, id=260, version=33145,
count=41, id=261, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,