WinMagicBattery.7z
- SHA256 5788e23d4830544a93e8bed998105aed8f85258200a138b60d7131cbb00c94bc
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
WinMagicBattery.7z
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral2
Sample
WinMagicBattery.7z
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
900 seconds
General
- Target WinMagicBattery.7z
- Size 47.6MB
- Sample260804-1dktas1bre
- SHA256 5788e23d4830544a93e8bed998105aed8f85258200a138b60d7131cbb00c94bc
- MD5 3e201f14e569236e66e9dbbdc1354b4f
- SHA1 9709d0784d6059d7bfa0ba2184919e52c3eecc88
- SHA512 839dfc4f62d99e79e6df47be11f9a23072ab23d95e07570fde799952b7d1c34d9a7dbfd51f43c470225efcd7b0c2556a4dcd052f32a12f4c2dfe5b0c23eda74f
- SSDEEP 786432:VrSteeqxKTzBkcdzGVd+Wr6JkEciuVd1Z9V18fmG/dGHZQs0TUelGqfQk7ZSyjcv:VrSteeqIHB1NKA57ciWdRVFc0HZQskUd
- TLSH T114B733344CDFCB33C9B510975208A79A613BB4DF6076B3888B2E966856BD3E4D311D3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/WinMagicBattery/APP.exe
File Explorer
-
WinMagicBattery.7z.7z 47.6MB
-
WinMagicBattery/APP.dll.config791B
-
WinMagicBattery/APP.exe.exe 157.2MB
-
WinMagicBattery/APP.pdb17KB
-
WinMagicBattery/D3DCompiler_47_cor3.dll.dll 4.7MB
-
WinMagicBattery/PenImc_cor3.dll.dll 154KB
-
WinMagicBattery/PresentationNative_cor3.dll.dll 1.2MB
-
WinMagicBattery/vcruntime140_cor3.dll.dll 121KB
-
WinMagicBattery/wpfgfx_cor3.dll.dll 1.9MB
WinMagicBattery/APP.dll.config
- SHA256 9824fbe21d69010c8099eae32ea06da0de3d37c544e063cc08e22d67a93e88f8
- MD5 b4326ad9cadda56dff438e7760bf055c
- SHA1 191393c7c74021ddbe48804294ac6182a1d5794f
- SHA512 909e04d38de23735577e6895fd9fb5a9326faf599feac35e6420526666ed925f5f272d7f76364ad583ec67ea55459dc4366ef5fc42fca2e8fd14b545cd62fba7
- TLSH T12101471521C4BEAF02632F32CA128644DEB143D781362528B53D72BB8F315CA07C33AA
- MD5 SHA1 SHA512 TLSH
WinMagicBattery/APP.exe
- IMPHASH de665e653fb1de074ec7c2f2365fba8c
- SHA256 5028e5acff9524930cfd07e5a31daa7056f1ff41115df9594c5b87e9d29a2d3e
- MD5 7153556c16eb8ea063aaa9dacc7ec16d
- SHA1 4cb21df980e3b8b043661f39b90c19f2aa4227c1
- SHA512 572cb62239746e5e8a7a41f0d26da798fc6f3c744e7fedc3fd0f1dad8090e5da84a37c477f0f03b77a3c700e6b8b864696bf32dd608e5828249b057a2c170d29
- SSDEEP 786432:Z7tBg1x6s2zGLo7VOH0qocJRdW9hSamg0I1AtcQINqk9X6KPuUDf09N3j:ZRG1xT+qlyT0IbBP9X6KPuuml
- TLSH T1C9787C11A3E85A45E27B8678977382A1E6B5BC525311C2CF0094FD4A3F73BC1BA36376
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
6053504
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\src\runtime\artifacts\obj\coreclr\windows.x64.Release\Corehost.Static\singlefilehost.pdb
kernel32
ActivateActCtx
FindResourceW
GetWindowsDirectoryW
GetModuleHandleW
LoadLibraryExW
LoadLibraryExA
RtlCaptureContext
WideCharToMultiByte
GetConsoleOutputCP
MapViewOfFileEx
SetLastError
SetThreadErrorMode
RaiseException
SetConsoleCtrlHandler
DebugBreak
FlsAlloc
FlsSetValue
FlsGetValue
GetLocaleInfoEx
GetUserDefaultLocaleName
FlushProcessWriteBuffers
ReadFile
CreateNamedPipeA
GetCurrentProcess
WriteFile
WaitForMultipleObjects
WaitForSingleObject
DuplicateHandle
DisconnectNamedPipe
CreateEventW
CreateFileA
CancelIoEx
GetOverlappedResult
ConnectNamedPipe
FlushFileBuffers
SetEvent
ResetEvent
WaitForSingleObjectEx
VirtualAlloc
VirtualFree
VirtualQuery
VirtualProtect
SleepEx
SwitchToThread
MultiByteToWideChar
SuspendThread
ResumeThread
LCMapStringEx
FormatMessageW
LocalFree
GetModuleFileNameW
GetEnvironmentVariableW
CreateFileW
GetFullPathNameW
HeapAlloc
HeapFree
CreateFileMappingW
HeapCreate
GetProcessHeap
HeapDestroy
VerSetConditionMask
VerifyVersionInfoW
QueueUserAPC
SetThreadPriority
GetThreadPriority
TlsSetValue
TlsAlloc
WaitForMultipleObjectsEx
SignalObjectAndWait
RtlLookupFunctionEntry
SetThreadStackGuarantee
LocateXStateFeature
SetErrorMode
RaiseFailFastException
GetExitCodeProcess
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
AddVectoredExceptionHandler
GetThreadContext
SetThreadContext
GetEnabledXStateFeatures
InitializeContext
RtlRestoreContext
SetXStateFeaturesMask
CopyContext
GetModuleHandleExW
GetCommandLineW
CreateProcessW
GetCPInfo
ExitProcess
OutputDebugStringW
RtlInstallFunctionTableCallback
GetLogicalProcessorInformationEx
SetThreadGroupAffinity
UnmapViewOfFile
GetProcessGroupAffinity
GetProcessAffinityMask
QueryInformationJobObject
FlushInstructionCache
RtlDeleteFunctionTable
CreateMemoryResourceNotification
WerRegisterRuntimeExceptionModule
RtlUnwind
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
OpenEventW
ExitThread
HeapReAlloc
TlsGetValue
GetFileSize
RtlAddFunctionTable
CreateSemaphoreExW
ReleaseSemaphore
GetSystemDefaultLCID
GetUserDefaultLCID
OutputDebugStringA
QueryThreadCycleTime
SetFilePointer
MapViewOfFile
FindClose
Sleep
RemoveDirectoryW
CreateDirectoryW
GetEnvironmentStringsW
GetSystemTime
GetSystemTimeAsFileTime
FreeLibrary
GetCurrentProcessId
GetProcAddress
CreateThread
GetSystemInfo
CloseHandle
GetActiveProcessorGroupCount
GetCurrentThread
GetLastError
FreeEnvironmentStringsW
GetCurrentThreadId
CreateActCtxW
GetTempPathW
InitializeCriticalSection
LeaveCriticalSection
GetStdHandle
FindNextFileW
EnterCriticalSection
FindFirstFileExW
GetFileSizeEx
GetConsoleMode
GetFileAttributesExW
LoadLibraryA
GetCurrentDirectoryW
WriteConsoleW
DeleteCriticalSection
CreateFileMappingA
GetTickCount64
QueryPerformanceFrequency
QueryPerformanceCounter
IsDebuggerPresent
GetNumaHighestNodeNumber
SetThreadAffinityMask
GetFileAttributesW
SetThreadIdealProcessorEx
GetThreadIdealProcessorEx
VirtualAllocExNuma
GetNumaProcessorNodeEx
VirtualUnlock
GetLargePageMinimum
IsProcessInJob
K32GetProcessMemoryInfo
GetLogicalProcessorInformation
GlobalMemoryStatusEx
RtlVirtualUnwind
IsProcessorFeaturePresent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsFree
TryAcquireSRWLockExclusive
GetExitCodeThread
GetStringTypeW
InitializeCriticalSectionEx
DecodePointer
SetEnvironmentVariableW
GetThreadGroupAffinity
GetCurrentProcessorNumberEx
advapi32
LookupPrivilegeValueW
RegGetValueW
SetKernelObjectSecurity
RegQueryValueExW
RegOpenKeyExW
GetSidSubAuthorityCount
GetSidSubAuthority
GetTokenInformation
OpenProcessToken
RegCloseKey
SetThreadToken
RevertToSelf
OpenThreadToken
EventWrite
EventRegister
EventWriteTransfer
DeregisterEventSource
RegisterEventSourceW
ReportEventW
AdjustTokenPrivileges
ole32
CLSIDFromProgID
CoCreateGuid
CoTaskMemAlloc
CoUnmarshalInterface
CoMarshalInterface
CoGetMarshalSizeMax
CoCreateFreeThreadedMarshaler
CoGetClassObject
CoGetContextToken
CoGetObjectContext
CoReleaseMarshalData
CoInitializeEx
CoRegisterInitializeSpy
CoWaitForMultipleHandles
CoUninitialize
CoRevokeInitializeSpy
CoTaskMemFree
oleaut32
SetErrorInfo
GetErrorInfo
SysFreeString
SysStringLen
CreateErrorInfo
QueryPathOfRegTypeLi
SafeArrayGetVartype
VariantChangeType
SysAllocString
LoadRegTypeLi
SysAllocStringLen
VariantClear
VariantInit
VarCyFromDec
SafeArrayDestroy
SafeArrayAllocDescriptorEx
GetRecordInfoFromTypeInfo
SafeArraySetRecordInfo
SafeArrayAllocData
SafeArrayGetElemsize
SysStringByteLen
SysAllocStringByteLen
SafeArrayCreateVector
SafeArrayPutElement
SafeArrayGetDim
SafeArrayGetLBound
LoadTypeLibEx
user32
LoadStringW
MessageBoxW
shell32
ShellExecuteW
api-ms-win-crt-string-l1-1-0
iswspace
strncpy
iswascii
iswupper
wcsncpy_s
isalpha
strncmp
strncpy_s
towlower
wcscat_s
_wcsdup
wcscpy_s
isdigit
strnlen
wcsnlen
strncat_s
towupper
strcmp
strcpy_s
_stricmp
strcat_s
isspace
tolower
wcsncmp
_strdup
strtok_s
wcsncat_s
strlen
_wcsnicmp
_wcsicmp
_strnicmp
api-ms-win-crt-heap-l1-1-0
_aligned_malloc
malloc
_callnewh
realloc
free
_set_new_mode
_aligned_free
calloc
api-ms-win-crt-convert-l1-1-0
atoi
_wcstoui64
_wtoi
strtoull
strtol
wcstoul
_ltow_s
_atoi64
atol
strtoul
api-ms-win-crt-stdio-l1-1-0
fputwc
__stdio_common_vsprintf_s
__stdio_common_vfprintf
__acrt_iob_func
_set_fmode
__stdio_common_vsprintf
ftell
fseek
_wfsopen
__stdio_common_vfwprintf
fclose
setvbuf
_setmode
_dup
_fileno
fwrite
__p__commode
_flushall
__stdio_common_vswprintf
__stdio_common_vsnprintf_s
fopen
_write
_wfopen
__stdio_common_vsscanf
fgets
fflush
fputs
__stdio_common_vsnwprintf_s
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-runtime-l1-1-0
_invoke_watson
_invalid_parameter_noinfo
_beginthreadex
terminate
_wcserror_s
_register_thread_local_exe_atexit_callback
_c_exit
__p___wargv
__p___argc
abort
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_errno
_controlfp_s
api-ms-win-crt-filesystem-l1-1-0
_wrename
_wremove
api-ms-win-crt-math-l1-1-0
truncf
atanf
trunc
ilogbf
ceil
atan2
copysign
ceilf
round
fmodf
asinh
cbrt
acosh
atanh
modf
acoshf
cbrtf
atanhf
tanhf
modff
asinhf
fmod
__setusermatherr
_fdopen
fmaf
fma
floorf
floor
acos
acosf
asin
asinf
log10
expf
exp
log10f
log
log2
coshf
cosh
log2f
cosf
logf
pow
cos
powf
roundf
atan2f
sin
sinf
sinh
sinhf
sqrt
sqrtf
tan
tanf
tanh
copysignf
atan
api-ms-win-crt-time-l1-1-0
_gmtime64_s
_time64
wcsftime
api-ms-win-crt-locale-l1-1-0
setlocale
__pctype_func
___lc_locale_name_func
___lc_codepage_func
_lock_locales
_free_locale
_configthreadlocale
_unlock_locales
___mb_cur_max_func
_create_locale
BrotliDecoderAttachDictionary
BrotliDecoderCreateInstance
BrotliDecoderDecompress
BrotliDecoderDecompressStream
BrotliDecoderDestroyInstance
BrotliDecoderErrorString
BrotliDecoderGetErrorCode
BrotliDecoderHasMoreOutput
BrotliDecoderIsFinished
BrotliDecoderIsUsed
BrotliDecoderSetMetadataCallbacks
BrotliDecoderSetParameter
BrotliDecoderTakeOutput
BrotliDecoderVersion
BrotliDefaultAllocFunc
BrotliDefaultFreeFunc
BrotliEncoderAttachPreparedDictionary
BrotliEncoderCompress
BrotliEncoderCompressStream
BrotliEncoderCreateInstance
BrotliEncoderDestroyInstance
BrotliEncoderDestroyPreparedDictionary
BrotliEncoderHasMoreOutput
BrotliEncoderIsFinished
BrotliEncoderMaxCompressedSize
BrotliEncoderPrepareDictionary
BrotliEncoderSetParameter
BrotliEncoderTakeOutput
BrotliEncoderVersion
BrotliGetDictionary
BrotliGetTransforms
BrotliSetDictionaryData
BrotliSharedDictionaryAttach
BrotliSharedDictionaryCreateInstance
BrotliSharedDictionaryDestroyInstance
BrotliTransformDictionaryWord
CLRJitAttachState
DotNetRuntimeContractDescriptor
DotNetRuntimeInfo
MetaDataGetDispenser
_kBrotliContextLookupTable
_kBrotliPrefixCodeRanges
g_CLREngineMetrics
g_dacTable
Name
.text
Size
6.4MB
Virtual Size
6.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.CLR_UEF
Size
512B
Virtual Size
215B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
228KB
Virtual Size
228KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Section
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
30KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=11, id=259, version=35207,
count=19, id=260, version=35207,
count=68, id=260, version=35220,
count=101, id=261, version=35207,
count=8, id=260, version=33145,
count=13, id=257, version=33145,
count=505, id=1, productName=Unmarked objects,
count=22, id=259, version=35220,
count=571, id=265, version=35220,
count=1, id=256, version=35220,
count=1, id=255, version=35220,
count=1, id=258, version=35220,
WinMagicBattery/APP.pdb
- SHA256 c4c458811f47b63981a271d4ea69f7d05fa879f016cb8f633c9efee35fc271c5
- MD5 c6dd1f7db1343c55e87582a98bbcc9b7
- SHA1 31222caa259717b7cfa466831b02a4d23c477359
- SHA512 c48335ada239a431d5e691136b368cf5956e3c62990c871c421106c7013561902b2f317a87e8fae92487d0010719e148e132fd44a61ca5de39391399001ba538
- SSDEEP 384:Hi9WQsU0uw4F792bpKCa+EI3rey6YqJHV8d7eOx347IPLgbqWHgfJJlaOjKGV2TF:qtxw41RcCVQrG2pcTIs
- TLSH T1F2820777575CC632C60259779926C68C3B30C3213741EE79F1C97A08EDBF68A03BA5A5
- MD5 SHA1 SHA512 SSDEEP TLSH
WinMagicBattery/D3DCompiler_47_cor3.dll
- IMPHASH 8235041cfd6fffb926142c2c78013446
- SHA256 a05d04a270f68c8c6d6ea2d23bebf8cd1d5453b26b5442fa54965f90f1c62082
- MD5 a7349236212b0e5cec2978f2cfa49a1a
- SHA1 5abb08949162fd1985b89ffad40aaf5fc769017e
- SHA512 c7ff4f9146fefedc199360aa04236294349c881b3865ebc58c5646ad6b3f83fca309de1173f5ebf823a14ba65e5ada77b46f20286d1ea62c37e17adbc9a82d02
- SSDEEP 49152:FCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvpiD0N+YEzI4og/RfzHLeHTRhFRNS:EG2QCwmHXnog/pzHAo/A2L
- TLSH T19A367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ad:54:a4:50:8b:00:14:34:bf:a8:99:78:9a:09:cf:95:71:9c:d3:a2:9e:7b:b9:45:32:1e:9b:0e:17:89:9e:16
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 22, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:57:cf:90:dd:c7:d1:c0:88:8c:00:00:00:00:05:57
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 19, 2023 - Oct 16, 2024
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:F002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:f2:3e:32:d7:64:ac:70:91:94:00:01:00:00:01:f2
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
2702512
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D3DCompiler_47.pdb
kernel32
WriteFile
FreeLibrary
Sleep
TlsAlloc
TlsSetValue
HeapDestroy
TlsGetValue
TlsFree
GetFullPathNameW
GetFullPathNameA
GetEnvironmentVariableA
VirtualFree
VirtualAlloc
GetSystemInfo
GetProcAddress
LoadLibraryExW
SetLastError
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentThreadId
GetStdHandle
GetFileType
GetStartupInfoW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
GetModuleHandleW
GetModuleHandleExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetFilePointerEx
GetStringTypeW
ReadFile
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
RaiseException
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetModuleFileNameW
ReadConsoleW
HeapSize
HeapReAlloc
WriteConsoleW
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
RtlUnwindEx
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionEx
RtlPcToFileHeader
LocalAlloc
LocalFree
GetFileSizeEx
GetLastError
CreateFileW
HeapFree
GetProcessHeap
UnmapViewOfFile
GetFileSize
CreateFileMappingW
MapViewOfFile
GetFileAttributesW
SetFileAttributesW
DeleteFileW
SetEndOfFile
DeviceIoControl
MapViewOfFileEx
CreateFileMappingA
ExpandEnvironmentStringsW
HeapAlloc
OutputDebugStringA
CloseHandle
LeaveCriticalSection
EnterCriticalSection
lstrcmpiA
HeapCreate
GetModuleFileNameA
CreateFileA
DeleteCriticalSection
InitializeCriticalSection
WideCharToMultiByte
FindClose
FindFirstFileExW
FindNextFileW
GetCommandLineA
GetCommandLineW
GetDriveTypeW
GetCurrentDirectoryW
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
MultiByteToWideChar
SetStdHandle
DisableThreadLibraryCalls
advapi32
CryptDestroyHash
CryptAcquireContextW
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
CryptGetHashParam
CryptCreateHash
CryptHashData
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
CryptReleaseContext
rpcrt4
UuidCreate
D3DAssemble
D3DCompile
D3DCompile2
D3DCompileFromFile
D3DCompressShaders
D3DCreateBlob
D3DCreateFunctionLinkingGraph
D3DCreateLinker
D3DDecompressShaders
D3DDisassemble
D3DDisassemble10Effect
D3DDisassemble11Trace
D3DDisassembleRegion
D3DGetBlobPart
D3DGetDebugInfo
D3DGetInputAndOutputSignatureBlob
D3DGetInputSignatureBlob
D3DGetOutputSignatureBlob
D3DGetTraceInstructionOffsets
D3DLoadModule
D3DPreprocess
D3DReadFileToBlob
D3DReflect
D3DReflectLibrary
D3DReturnFailure1
D3DSetBlobPart
D3DStripShader
D3DWriteBlobToFile
DebugSetMute
Name
.text
Size
3.6MB
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
916KB
Virtual Size
913KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
64KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
128KB
Virtual Size
127KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
36KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=30795,
count=146, id=1, productName=Unmarked objects,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=60, id=261, version=27316,
count=1, id=260, version=27316,
count=30, id=259, version=30795,
count=222, id=261, version=30795,
count=55, id=260, version=30795,
count=1, id=256, version=30795,
count=136, id=264, version=30795,
count=1, id=255, version=30795,
count=1, id=258, version=30795,
WinMagicBattery/PenImc_cor3.dll
- IMPHASH 4973eef226ec884d2aa44d1f0ef49fd5
- SHA256 771544b6befc2eb3c4f50e25c332cb2e993e5555be8ac7c66037219ce3f9e919
- MD5 9d03062951522f12c55b82786cb8a38b
- SHA1 52af07cbbd7380d132cddb8b8d897634af2934c6
- SHA512 b9fe7547db1a9f986d852a8d9c6f171bbdaf168e01d068bec180ed9483616c17c5e76cb9ffcc370668faf919e19e2d4945d9bba910324cb5e41bcd259c08ebec
- SSDEEP 3072:dPIUmScNzkWw61m48jowNIVHL6nUUDFMyWeduEd3zvworAMFj2Hz5CEdZTZqtiYz:FIlRNz+6/8UwNzDDFMypuEGHz5RW/h
- TLSH T1ACF33913B6AC40ABC029D17E85D70649F772B8111B228BDF2264A32E1F777D4BE3A355
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
12:36:2d:a4:99:f2:08:6d:de:3e:c8:d0:73:5c:38:8f:32:ea:6f:df:b3:5f:6d:91:0a:fd:6d:dc:2a:f1:85:64
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 25, 2026
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:ac:76:2f:fe:6e:d2:8c:84:68:00:00:00:00:04:ac
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 18, 2025 - Jul 6, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9600-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:04:d8:e0:0e:07:97:32:58:98:00:01:00:00:02:04
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
74016
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\src\wpf\artifacts\bin\PenImc\x64\Release\PenImc_cor3.pdb
kernel32
SetThreadLocale
DeleteCriticalSection
RaiseException
InitializeCriticalSectionEx
DecodePointer
EncodePointer
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
ReleaseMutex
InitializeCriticalSection
CreateEventW
GetCurrentProcessId
OpenEventW
OpenMutexW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
SetEvent
LocalFree
SignalObjectAndWait
IsWow64Process
GetCurrentProcess
OutputDebugStringW
GetThreadLocale
CreateThread
QueueUserAPC
SetWaitableTimer
CancelWaitableTimer
CreateActCtxW
ActivateActCtx
VerSetConditionMask
LoadLibraryW
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsDebuggerPresent
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
RtlPcToFileHeader
InterlockedFlushSList
CreateMutexW
CloseHandle
GetModuleFileNameW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
GetLastError
lstrcmpiW
GetModuleHandleW
GetProcAddress
FreeLibrary
CreateWaitableTimerW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
RtlUnwindEx
RtlLookupFunctionEntry
GetCurrentThreadId
user32
SetWindowsHookExW
CallNextHookEx
GetWindowRect
EqualRect
GetWindow
MsgWaitForMultipleObjectsEx
IsWindow
GetParent
GetWindowThreadProcessId
CharNextW
UnhookWindowsHookEx
GetSystemMetrics
GetMonitorInfoW
MonitorFromWindow
GetDesktopWindow
PeekMessageW
advapi32
ConvertSidToStringSidW
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
shell32
ShellExecuteExW
ole32
CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance
CoTaskMemFree
CoLockObjectExternal
CoGetApartmentType
oleaut32
SysAllocString
UnRegisterTypeLi
VarUI4FromStr
SysFreeString
RegisterTypeLi
SysStringLen
LoadTypeLi
api-ms-win-crt-string-l1-1-0
strlen
strcmp
wcscpy_s
wcscat_s
wcsncmp
strcpy_s
wcsncpy_s
api-ms-win-crt-heap-l1-1-0
_callnewh
malloc
free
calloc
_recalloc
realloc
api-ms-win-crt-runtime-l1-1-0
_seh_filter_dll
_configure_narrow_argv
abort
_initialize_narrow_environment
_invalid_parameter_noinfo
terminate
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_errno
_initterm_e
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
rpcrt4
NdrCStdStubBuffer_Release
CStdStubBuffer_Connect
NdrDllCanUnloadNow
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
NdrDllGetClassObject
NdrDllRegisterProxy
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs
NdrDllUnregisterProxy
IUnknown_AddRef_Proxy
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
IUnknown_Release_Proxy
CStdStubBuffer_Invoke
CreateResetEvent
DestroyResetEvent
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetLastSystemEventData
GetPenEvent
GetPenEventMultiple
GetProxyDllInfo
LockWispObjectFromGit
RaiseResetEvent
RegisterDllForSxSCOM
UnlockWispObjectFromGit
Name
.text
Size
81KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.orpc
Size
512B
Virtual Size
201B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=259, version=35207,
count=11, id=260, version=35207,
count=46, id=261, version=35207,
count=3, id=260, version=27412,
count=15, id=257, version=27412,
count=172, id=1, productName=Unmarked objects,
count=13, id=264, version=35220,
count=1, id=256, version=35220,
count=1, id=255, version=35220,
count=1, id=151,
count=1, id=258, version=35220,
WinMagicBattery/PresentationNative_cor3.dll
- IMPHASH 5de612d168dd4f3cbdf371592277147a
- SHA256 93866536b0861474aaba4ae466adacfc9fd1a7ba87568074d8d76a04a6f5c7f3
- MD5 25f884df7c0931360afc8d1382d59c65
- SHA1 1e69d0065ebcb5b57d46babd811b02c7aeff911a
- SHA512 23ab3bbe9628d34a2db36e56c0779fef32264a2c58ed814574a5656e0828d12233b492f3babd3c470f972d1be12c4c759bb0d7b201c9920680eff92aff730258
- SSDEEP 24576:ygaltAn1r1sE33slrVCP0QSeDOM8zT3n6kcNbNUdah6ox3GmOBlIefATbpwwPmFc:jnR+g8lYP00OM8zT3GbNUdvoxWZBlIuk
- TLSH T157453A22E2E642E5C47FC1B8C6469717FBB1740A131C66DB87608B652F27FE0963E364
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
dc:6d:39:44:99:09:3d:a3:31:78:f3:9e:8c:d8:72:a5:12:91:b4:a8:a3:ae:be:df:c7:9e:90:c3:97:60:3a:43
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 5, 2026
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:ab:af:3a:c8:82:4e:48:55:5d:00:00:00:00:04:ab
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 18, 2025 - Jul 6, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:2A1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:10:ab:cd:e4:16:18:ef:39:b0:00:01:00:00:02:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
5680
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\artifacts\bin\PresentationNative\x64\Release\PresentationNative_cor3.pdb
kernel32
UnhandledExceptionFilter
GetCurrentThread
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
TerminateThread
GetProcAddress
VerSetConditionMask
FreeLibrary
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
OutputDebugStringW
DeleteCriticalSection
DisableThreadLibraryCalls
LoadLibraryW
InitializeCriticalSection
InitializeCriticalSectionEx
GlobalDeleteAtom
DebugBreak
OutputDebugStringA
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
LeaveCriticalSection
EnterCriticalSection
InterlockedFlushSList
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RaiseException
EncodePointer
SetLastError
GetLastError
ntdll
DbgBreakPoint
DbgPrompt
DbgPrintEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnwindEx
RtlPcToFileHeader
NtQuerySystemInformation
api-ms-win-crt-runtime-l1-1-0
terminate
_cexit
_crt_atexit
abort
_execute_onexit_table
_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
api-ms-win-crt-heap-l1-1-0
malloc
free
calloc
api-ms-win-crt-string-l1-1-0
iswpunct
strlen
strcmp
wcsncmp
strcpy_s
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
user32
SetWindowLongPtrW
SetWindowLongW
SetScrollPos
SetFocus
MapWindowPoints
GetWindowTextLengthW
GetWindowTextW
GetWindowLongPtrW
GetWindowLongW
GetWindow
GetParent
GetMenuBarInfo
GetKeyboardLayoutList
GetAncestor
EnableWindow
FindWindowExW
gdi32
GetTextExtentPoint32W
ole32
CoTaskMemFree
CoCreateInstance
oleaut32
VariantInit
SysAllocString
VariantChangeType
VariantClear
CreateDocContext
CreateInstalledObjectsInfo
CreateTextAnalysisSink
CreateTextAnalysisSource
DestroyDocContext
DestroyInstalledObjectsInfo
EnableWindowWrapper
FindWindowExWrapper
FsAddFigureObstacle
FsClearUpdateInfoInPage
FsClearUpdateInfoInSubpage
FsClearUpdateInfoInSubtrack
FsClearUpdateInfoInTableSrv
FsCommitFilledRectangle
FsCompareSubpages
FsCompareSubtrack
FsCompareTableSrv
FsCreateDocContext
FsCreateDummyFootnoteRejector
FsCreatePageBottomless
FsCreatePageFinite
FsCreateSubpageBottomless
FsCreateSubpageFinite
FsDestroyDocContext
FsDestroyFootnoteRejector
FsDestroyPage
FsDestroyPageBreakRecord
FsDestroySubpage
FsDestroySubpageBreakRecord
FsDestroySubtrack
FsDestroySubtrackBreakRecord
FsDestroyTableSrv
FsDestroyTableSrvBreakRecord
FsDuplicateGeometry
FsDuplicatePageBreakRecord
FsDuplicateSubpageBreakRecord
FsDuplicateSubtrackBreakRecord
FsDuplicateTableSrvBreakRecord
FsFAllFootnotesAllowed
FsFFootnoteAllowed
FsFormatSubtrackBottomless
FsFormatSubtrackFinite
FsFormatTableSrvBottomless
FsFormatTableSrvFinite
FsGetClientHandle
FsGetColumnRectangle
FsGetEmptySpaces
FsGetFigureObstacleData
FsGetFloaterFsimethods
FsGetIntervals
FsGetMaxNumberEmptySpaces
FsGetMaxNumberIntervals
FsGetNextTick
FsGetNumberSubpageFootnotes
FsGetNumberSubtrackFootnotes
FsGetPageRectangle
FsGetShiftOffset
FsGetSubpageColumnBalancingInfo
FsGetSubpageFootnoteInfo
FsGetSubtrackColumnBalancingInfo
FsGetSubtrackFootnoteInfo
FsGetTableObjFsimethods
FsGetTableSrvColumnBalancingInfo
FsGetTableSrvFootnoteInfo
FsGetTableSrvNumberFootnotes
FsJustifySubpage
FsQueryAttachedObjectList
FsQueryCompositeColumnDetails
FsQueryCompositeColumnFootnoteList
FsQueryDcpLineVariantsFromCachedTextPara
FsQueryEndnoteColumnDetails
FsQueryFigureObjectDetails
FsQueryFloaterDetails
FsQueryFootnoteColumnDetails
FsQueryFootnoteColumnTrackList
FsQueryHeightDefinedColumnSpanAreaList
FsQueryLineCompositeElementList
FsQueryLineListComposite
FsQueryLineListSingle
FsQueryPageDetails
FsQueryPageFootnoteColumnList
FsQueryPageSectionList
FsQuerySectionBasicColumnList
FsQuerySectionCompositeColumnList
FsQuerySectionDetails
FsQuerySectionEndnoteColumnList
FsQuerySegmentDefinedColumnSpanAreaList
FsQuerySubpageBasicColumnList
FsQuerySubpageDetails
FsQuerySubpageHeightDefinedColumnSpanAreaList
FsQuerySubpageSegmentDefinedColumnSpanAreaList
FsQuerySubtrackDetails
FsQuerySubtrackParaList
FsQueryTableObjCellList
FsQueryTableObjDetails
FsQueryTableObjFigureCountWord
FsQueryTableObjFigureListWord
FsQueryTableObjRowDetails
FsQueryTableObjRowList
FsQueryTableObjTableProperDetails
FsQueryTableSrvCellList
FsQueryTableSrvRowDetails
FsQueryTableSrvRowList
FsQueryTableSrvTableDetails
FsQueryTextDetails
FsQueryTrackDetails
FsQueryTrackParaList
FsRegisterFloatObstacle
FsReleaseGeometry
FsResolveOverlap
FsRestoreGeometry
FsShiftSubtrackVertical
FsSynchronizeBottomlessSubtrack
FsTransferDisplayInfoSubpage
FsTransferDisplayInfoSubtrack
FsTransferDisplayInfoTableSrv
FsTransformBbox
FsTransformPoint
FsTransformRectangle
FsTransformVector
FsUpdateBottomlessPage
FsUpdateBottomlessSubpage
FsUpdateBottomlessSubtrack
FsUpdateBottomlessTableSrv
FsUpdateFinitePage
GetAncestorWrapper
GetFloaterHandlerInfo
GetKeyboardLayoutListWrapper
GetMenuBarInfoWrapper
GetNumberSubstitutionList
GetParentWrapper
GetScriptAnalysisList
GetTableObjHandlerInfo
GetTextExtentPoint32Wrapper
GetWindowLongPtrWrapper
GetWindowLongWrapper
GetWindowTextLengthWrapper
GetWindowTextWrapper
GetWindowWrapper
GlobalDeleteAtomWrapper
IsPrintPackageTargetSupported
IsStartXpsPrintJobSupported
IsWindows10OrGreater
IsWindows10RS1OrGreater
IsWindows10RS2OrGreater
IsWindows10RS3OrGreater
IsWindows10RS4OrGreater
IsWindows10RS5OrGreater
IsWindows10TH1OrGreater
IsWindows10TH2OrGreater
IsWindows7OrGreater
IsWindows7SP1OrGreater
IsWindows8OrGreater
IsWindows8Point1OrGreater
IsWindowsServer
IsWindowsVistaOrGreater
IsWindowsVistaSP1OrGreater
IsWindowsVistaSP2OrGreater
IsWindowsXPOrGreater
IsWindowsXPSP1OrGreater
IsWindowsXPSP2OrGreater
IsWindowsXPSP3OrGreater
LateBoundStartXpsPrintJob
LoAcquireBreakRecord
LoAcquirePenaltyModule
LoCloneBreakRecord
LoCreateBreaks
LoCreateContext
LoCreateLine
LoCreateParaBreakingSession
LoDestroyContext
LoDisplayLine
LoDisposeBreakRecord
LoDisposeLine
LoDisposeParaBreakingSession
LoDisposePenaltyModule
LoEnumLine
LoGetEscString
LoGetPenaltyModuleInternalHandle
LoQueryLineCpPpoint
LoQueryLinePointPcp
LoRelievePenaltyResource
LoSetBreaking
LoSetDoc
LoSetTabs
LocbkGetObjectHandlerInfo
LsDisableSpecialCharacterLigature
MILGetClassificationTables
MapWindowPointsWrapper
NlCreateHyphenator
NlDestroyHyphenator
NlGetClassObject
NlHyphenate
NlLoad
NlUnload
PrintToPackageTarget
SetFocusWrapper
SetScrollPosWrapper
SetWindowLongPtrWrapper
SetWindowLongWrapper
Name
.text
Size
947KB
Virtual Size
947KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
196KB
Virtual Size
196KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=259, version=35207,
count=10, id=260, version=35207,
count=33, id=261, version=35207,
count=15, id=257, version=27412,
count=113, id=1, productName=Unmarked objects,
count=228, id=265, version=35217,
count=1, id=256, version=35217,
count=1, id=255, version=35217,
count=2, id=151,
count=1, id=258, version=35217,
WinMagicBattery/vcruntime140_cor3.dll
- IMPHASH 6b799efc51fdd03aa3707013f22955b8
- SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
- MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
- SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
- SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
- SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
- TLSH T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
16:1c:67:8a:c5:2f:a0:39:a4:a9:0f:75:90:8c:e8:cb:7d:a9:39:8b:9d:1e:9f:21:df:a7:31:d7:8e:36:45:9a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 10, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
16:1c:67:8a:c5:2f:a0:39:a4:a9:0f:75:90:8c:e8:cb:7d:a9:39:8b:9d:1e:9f:21:df:a7:31:d7:8e:36:45:9a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 10, 2025
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:0d:c4:e7:bb:f4:af:f8:f0:90:00:00:00:00:01:0d
Issuer
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 15, 2025 - May 15, 2026
Subject
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:14:9d:fb:c3:1f:1f:63:c3:10:00:00:00:00:00:14
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
May 1, 2013 - May 1, 2028
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6F1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:fc:18:a0:af:cc:69:5a:87:3a:00:01:00:00:01:fc
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:7f:2f:42:2a:73:53:08:de:ea:00:00:00:00:04:7f
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 15, 2025 - May 15, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:651A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:f5:99:09:94:bc:f1:c6:50:8c:00:01:00:00:01:f5
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Minor OS version
0
Major OS version
6
Entry point
66448
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb
api-ms-win-crt-runtime-l1-1-0
terminate
abort
api-ms-win-crt-string-l1-1-0
strncmp
wcsncmp
strcmp
strcpy_s
strlen
api-ms-win-crt-heap-l1-1-0
free
malloc
calloc
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
__stdio_common_vsprintf
api-ms-win-crt-convert-l1-1-0
atol
kernel32
GetLastError
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
RtlLookupFunctionEntry
RtlUnwindEx
RtlUnwind
GetModuleHandleW
GetModuleFileNameW
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
InterlockedPushEntrySList
InterlockedFlushSList
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FreeLibrary
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetProcAddress
_CreateFrameInfo
_CxxThrowException
_FindAndUnlinkFrame
_IsExceptionObjectToBeDestroyed
_SetWinRTOutOfMemoryExceptionCallback
__AdjustPointer
__BuildCatchObject
__BuildCatchObjectHelper
__C_specific_handler
__C_specific_handler_noexcept
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxFrameHandler2
__CxxFrameHandler3
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__FrameUnwindFilter
__GetPlatformExceptionInfo
__NLG_Dispatch2
__NLG_Return2
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__TypeMatch
__current_exception
__current_exception_context
__intrinsic_setjmp
__intrinsic_setjmpex
__processing_throw
__report_gsfailure
__std_exception_copy
__std_exception_destroy
__std_terminate
__std_type_info_compare
__std_type_info_destroy_list
__std_type_info_hash
__std_type_info_name
__telemetry_main_invoke_trigger
__telemetry_main_return_trigger
__unDName
__unDNameEx
__uncaught_exception
__uncaught_exceptions
__vcrt_GetModuleFileNameW
__vcrt_GetModuleHandleW
__vcrt_InitializeCriticalSectionEx
__vcrt_LoadLibraryExW
_get_purecall_handler
_get_unexpected
_is_exception_typeof
_local_unwind
_purecall
_set_purecall_handler
_set_se_translator
longjmp
memchr
memcmp
memcpy
memmove
memset
set_unexpected
strchr
strrchr
strstr
unexpected
wcschr
wcsrchr
wcsstr
Name
.text
Size
72KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
504B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
976B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
744B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=30795,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=47, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=16, id=260, version=35207,
count=31, id=261, version=35207,
count=21, id=259, version=35207,
count=1, id=256, version=35207,
count=1, id=255, version=35207,
count=1, id=258, version=35207,
WinMagicBattery/wpfgfx_cor3.dll
- IMPHASH a7a4bc1cfd4ccd11a03308e5252f02e0
- SHA256 4753d8cf5b10d5a3e957c85f830703c02367ee37d93a0bdf24dda115cc72fa8b
- MD5 0b49119950a378d32d79cb4449972518
- SHA1 efd6f315a6394e70bfaec996e2eecb131ed43d27
- SHA512 287ef30a50e0d9e974d493ac8673d9d2fc046932a2d1e9180a3e21e87b39913cc589398d7907e98d851e30bfc7b4985fcd151fce11f4094c0e6c6d17a75c826b
- SSDEEP 24576:9IxIZGnThquyQ2wv/JYIjXeIn/9FD3xBfveqZD1Eycg3wKXnaERDJNg4C:JwTUuyQ2wZYIbNFjvfGMEycowKX9zg9
- TLSH T1B7955A46B6AC40EAD47AE23CDAD7461FF27178102761A7CF23A0479D6F27BD0497A360
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
36:3b:13:13:1d:12:90:db:c7:ba:d8:70:e8:df:25:38:d5:76:dc:5e:b8:04:da:e0:2c:73:e3:19:4c:3c:a4:7c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 25, 2026
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:ac:76:2f:fe:6e:d2:8c:84:68:00:00:00:00:04:ac
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 18, 2025 - Jul 6, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:09:08:07:e0:f9:5c:8c:e6:55:00:01:00:00:02:09
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
334480
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\src\wpf\artifacts\bin\wpfgfx\x64\Release\wpfgfx_cor3.pdb
kernel32
WaitForSingleObject
CloseHandle
CreateEventW
CreateThread
GetCurrentThreadId
ResetEvent
TryEnterCriticalSection
MulDiv
QueryPerformanceCounter
Sleep
FindResourceW
LoadResource
LockResource
GlobalUnlock
QueryPerformanceFrequency
InitializeSListHead
InterlockedPushEntrySList
QueryDepthSList
InterlockedFlushSList
SleepEx
RtlCaptureStackBackTrace
IsDebuggerPresent
ExitProcess
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
TerminateThread
GetCurrentThread
GetCurrentProcessId
SetThreadPriority
LoadLibraryExW
TryAcquireSRWLockExclusive
GetLocaleInfoEx
LocalFree
FormatMessageA
GetSystemTimeAsFileTime
SleepConditionVariableSRW
WakeAllConditionVariable
FindClose
FindFirstFileW
GetSystemDirectoryW
SystemTimeToFileTime
LoadLibraryA
LoadLibraryExA
DebugBreak
GetModuleFileNameW
FreeLibrary
OutputDebugStringW
LoadLibraryW
LeaveCriticalSection
GetVersionExW
SetEvent
EnterCriticalSection
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
GetLastError
DisableThreadLibraryCalls
IsProcessorFeaturePresent
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RaiseException
EncodePointer
VirtualQuery
VerSetConditionMask
VirtualAlloc
VirtualFree
TerminateProcess
GetCurrentProcess
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
SizeofResource
GetTickCount
WaitForMultipleObjects
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemInfo
GetModuleHandleW
GetProcAddress
VirtualProtect
advapi32
UnregisterTraceGuids
RegQueryValueExW
RegCloseKey
AllocateLocallyUniqueId
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
TraceMessage
TraceEvent
RegOpenKeyExW
ntdll
DbgPrintEx
RtlClearBits
RtlFindClearBitsAndSet
RtlSetBits
RtlInitializeBitMap
DbgPrompt
RtlInterlockedFlushSList
RtlCaptureContext
NtQuerySystemInformation
DbgBreakPoint
RtlUnwindEx
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlPcToFileHeader
user32
SetLayeredWindowAttributes
OffsetRect
MonitorFromWindow
SystemParametersInfoW
EnumDisplaySettingsW
GetWindowLongW
ClientToScreen
GetClientRect
InvalidateRect
GetWindowRect
GetParent
GetDC
GetWindowDC
ScreenToClient
UpdateLayeredWindow
IsWindow
PeekMessageW
TranslateMessage
DispatchMessageW
GetGuiResources
MsgWaitForMultipleObjects
WindowFromDC
GetMonitorInfoW
EnumDisplayMonitors
EnumDisplayDevicesW
ReleaseDC
GetDesktopWindow
IntersectRect
RegisterWindowMessageW
PostMessageW
IsRectEmpty
SetRect
EqualRect
gdi32
SetLayout
CreateCompatibleDC
RealizePalette
GetRandomRgn
SelectPalette
CreatePalette
GetSystemPaletteEntries
GetDIBits
OffsetRgn
GetRgnBox
SetRectRgn
CreateRectRgn
GetRegionData
RectInRegion
CombineRgn
CreateRectRgnIndirect
SelectObject
CreateDIBSection
DeleteObject
CreateICW
GetDeviceCaps
DeleteDC
BitBlt
CreateCompatibleBitmap
ole32
CoInitialize
CoCreateInstance
PropVariantClear
CoTaskMemAlloc
PropVariantCopy
CoTaskMemFree
CoUninitialize
oleaut32
SysAllocString
VariantInit
VariantClear
SysFreeString
d3dcompiler_47_cor3
D3DCompile
api-ms-win-crt-runtime-l1-1-0
_invoke_watson
abort
terminate
_cexit
_crt_atexit
_seh_filter_dll
_configure_narrow_argv
_initterm
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_initialize_narrow_environment
_initterm_e
api-ms-win-crt-convert-l1-1-0
_wtoi
api-ms-win-crt-math-l1-1-0
exp
cosf
_isnan
_finite
modf
fmod
cos
floorf
pow
fmodf
logf
_copysign
ceilf
atan2f
tan
sin
sinf
sqrt
sqrtf
nextafterf
floor
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
api-ms-win-crt-heap-l1-1-0
malloc
free
calloc
api-ms-win-crt-string-l1-1-0
strlen
strcpy_s
wcsncmp
strcmp
api-ms-win-crt-utility-l1-1-0
qsort
GetNextPerfElementId
IWICColorContext_GetExifColorSpace_Proxy
IWICColorContext_GetProfileBytes_Proxy
IWICColorContext_GetType_Proxy
InteropDeviceBitmap_AddDirtyRect
InteropDeviceBitmap_Create
InteropDeviceBitmap_Detach
InteropDeviceBitmap_GetAsSoftwareBitmap
MIL3DCalcProjected2DBounds
MILAddRef
MILCreateEventProxy
MILCreateFactory
MILCreateStreamFromStreamDescriptor
MILFactoryCreateBitmapRenderTarget
MILFactoryCreateMediaPlayer
MILFactoryCreateSWRenderTargetForBitmap
MILIStreamWrite
MILLoadResource
MILMediaCanPause
MILMediaClose
MILMediaGetBufferingProgress
MILMediaGetDownloadProgress
MILMediaGetMediaLength
MILMediaGetNaturalHeight
MILMediaGetNaturalWidth
MILMediaGetPosition
MILMediaHasAudio
MILMediaHasVideo
MILMediaIsBuffering
MILMediaNeedUIFrameUpdate
MILMediaOpen
MILMediaProcessExitHandler
MILMediaSetBalance
MILMediaSetIsScrubbingEnabled
MILMediaSetPosition
MILMediaSetRate
MILMediaSetVolume
MILMediaShutdown
MILMediaStop
MILQueryInterface
MILRelease
MILRenderTargetBitmapClear
MILRenderTargetBitmapGetBitmap
MILSwDoubleBufferedBitmapAddDirtyRect
MILSwDoubleBufferedBitmapCreate
MILSwDoubleBufferedBitmapGetBackBuffer
MILSwDoubleBufferedBitmapProtectBackBuffer
MILUpdateSystemParametersInfo
MilChannel_AppendCommandData
MilChannel_BeginCommand
MilChannel_CloseBatch
MilChannel_CommitChannel
MilChannel_EndCommand
MilChannel_GetMarshalType
MilChannel_SetNotificationWindow
MilChannel_SetReceiveBroadcastMessages
MilCompositionEngine_DeinitializePartitionManager
MilCompositionEngine_EnterCompositionEngineLock
MilCompositionEngine_ExitCompositionEngineLock
MilCompositionEngine_GetComposedEventId
MilCompositionEngine_InitializePartitionManager
MilCompositionEngine_UpdateSchedulerSettings
MilComposition_PeekNextMessage
MilComposition_SyncFlush
MilComposition_WaitForNextMessage
MilConnection_CreateChannel
MilConnection_DestroyChannel
MilContent_AttachToHwnd
MilContent_DetachFromHwnd
MilGlyphRun_GetGlyphOutline
MilGlyphRun_ReleasePathGeometryData
MilPlayer_Create
MilPlayer_Process
MilResource_CreateCWICWrapperBitmap
MilResource_CreateOrAddRefOnChannel
MilResource_DuplicateHandle
MilResource_GetRefCountOnChannel
MilResource_ReleaseOnChannel
MilResource_SendCommand
MilResource_SendCommandBitmapSource
MilResource_SendCommandMedia
MilUtility_ArcToBezier
MilUtility_CopyPixelBuffer
MilUtility_GeometryGetArea
MilUtility_GetPointAtLengthFraction
MilUtility_GetTileBrushMapping
MilUtility_PathGeometryBounds
MilUtility_PathGeometryCombine
MilUtility_PathGeometryFlatten
MilUtility_PathGeometryHitTest
MilUtility_PathGeometryHitTestPathGeometry
MilUtility_PathGeometryOutline
MilUtility_PathGeometryWiden
MilUtility_PolygonBounds
MilUtility_PolygonHitTest
MilVersionCheck
MilVisualTarget_AttachToHwnd
MilVisualTarget_DetachFromHwnd
RenderOptions_EnableHardwareAccelerationInRdp
RenderOptions_ForceSoftwareRenderingModeForProcess
RenderOptions_IsSoftwareRenderingForcedForProcess
SetMilPerfInstrumentationFlags
WgxConnection_Create
WgxConnection_Disconnect
WgxConnection_SameThreadPresent
WgxConnection_ShouldForceSoftwareForGraphicsStreamClient
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
345KB
Virtual Size
344KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
29KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
83KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
71KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=263, version=27412,
count=1, id=261, version=27412,
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=259, version=35207,
count=10, id=260, version=35207,
count=50, id=261, version=35207,
count=7, id=260, version=27412,
count=17, id=257, version=27412,
count=260, id=1, productName=Unmarked objects,
count=421, id=265, version=35220,
count=1, id=256, version=35220,
count=1, id=255, version=35220,
count=3, id=151,
count=1, id=258, version=35220,