f4cdee31063f9c4ab7be04464a4b6bf384755f0cd90c5744b7487788a5dd1408.bin
- SHA256 f4cdee31063f9c4ab7be04464a4b6bf384755f0cd90c5744b7487788a5dd1408
Overview
overview
7Static
static
3NFCProvisi...in.dll
windows10-2004-x64
1NPSM.dll
windows10-2004-x64
1NPSMDeskto...er.dll
windows10-2004-x64
1NetworkBin...in.dll
windows10-2004-x64
1NetworkCol...nt.dll
windows10-2004-x64
1NetworkDes...gs.dll
windows10-2004-x64
1NetworkIcon.dll
windows10-2004-x64
1NetworkMob...gs.dll
windows10-2004-x64
1NetworkProxyCsp.dll
windows10-2004-x64
1NetworkQoS...SP.dll
windows10-2004-x64
1NetworkUXBroker.dll
windows10-2004-x64
7NfcRadioMedia.dll
windows10-2004-x64
1NgcCtnr.dll
windows10-2004-x64
1NgcCtnrGid...er.dll
windows10-2004-x64
1NgcCtnrSvc.dll
windows10-2004-x64
1NgcIsoCtnr.dll
windows10-2004-x64
1NgcProCsp.dll
windows10-2004-x64
1NlsData0000.dll
windows10-2004-x64
1NlsData0009.dll
windows10-2004-x64
1NlsLexicons0009.dll
windows10-2004-x64
1Nlsdl.dll
windows10-2004-x64
1NmaDirect.dll
windows10-2004-x64
1Notificati...er.dll
windows10-2004-x64
1Notificati...PS.dll
windows10-2004-x64
7Notificati...rm.dll
windows10-2004-x64
1NtlmShared.dll
windows10-2004-x64
1NvAgent.dll
windows10-2004-x64
1OEMDefault...ns.dll
windows10-2004-x64
1OmaDmAgent.dll
windows10-2004-x64
1OnDemandBr...nt.dll
windows10-2004-x64
1OnDemandCo...er.dll
windows10-2004-x64
1networkexplorer.dll
windows10-2004-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NFCProvisioningPlugin.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
NPSM.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
NPSMDesktopProvider.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
NetworkBindingEngineMigPlugin.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
NetworkCollectionAgent.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
NetworkDesktopSettings.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
NetworkIcon.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
NetworkMobileSettings.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
NetworkProxyCsp.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
NetworkQoSPolicyCSP.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
NetworkUXBroker.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
NfcRadioMedia.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
NgcCtnr.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
NgcCtnrGidsHandler.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
NgcCtnrSvc.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
NgcIsoCtnr.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
NgcProCsp.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
NlsData0000.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
NlsData0009.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
NlsLexicons0009.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
Nlsdl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
NmaDirect.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
NotificationController.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
NotificationControllerPS.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral25
Sample
NotificationIntelligencePlatform.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
NtlmShared.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
NvAgent.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
OEMDefaultAssociations.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
OmaDmAgent.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
OnDemandBrokerClient.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
OnDemandConnRouteHelper.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
networkexplorer.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target f4cdee31063f9c4ab7be04464a4b6bf384755f0cd90c5744b7487788a5dd1408.bin
- Size 15.2MB
- Sample260812-a4djsshf92
- SHA256 f4cdee31063f9c4ab7be04464a4b6bf384755f0cd90c5744b7487788a5dd1408
- MD5 d4851d55ed3a0f384ab974713424d5e6
- SHA1 ca975e3e2b1dace0e25182e836f54809b2945700
- SHA512 c2749a974e968e7666e70504cddee506a4cc8e6919b002f283b160e8ed7384837c72a4bbf8e9f650f0d3b931e068ed067528c8e7264a29710a192ed9211ef3bb
- SSDEEP 393216:KGYUs2cVAEVKQahYdNAhoBs/b52lGvisVzVkXSRu1eiZ111:K1KcVAEx2toS/ApsVzVxU1e6
- TLSH T1B5F633A2D6DA5130F21A0B373674B53D142AEA16C23739D6EF62A2B307493D3D57AC0D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 77 IoCs
Checks for missing Authenticode signature.
resource unpack001/NFCProvisioningPlugin.dll unpack001/NPSM.dll unpack001/NPSMDesktopProvider.dll unpack001/NetworkCollectionAgent.dll unpack001/NetworkDesktopSettings.dll unpack001/NetworkIcon.dll unpack001/NetworkMobileSettings.dll unpack001/NetworkQoSPolicyCSP.dll unpack001/NetworkUXBroker.dll unpack001/NfcRadioMedia.dll unpack001/NgcCtnrGidsHandler.dll unpack001/NgcProCsp.dll unpack001/NlsData0000.dll unpack001/NlsData0009.dll unpack001/NlsLexicons0009.dll unpack001/Nlsdl.dll unpack001/NmaDirect.dll unpack001/NotificationController.dll unpack001/NotificationControllerPS.dll unpack001/NotificationIntelligencePlatform.dll unpack001/OEMDefaultAssociations.dll unpack001/OmaDmAgent.dll unpack001/OnDemandBrokerClient.dll unpack001/OnDemandConnRouteHelper.dll unpack001/networkexplorer.dll unpack001/networkhelper.dll unpack001/networkitemfactory.dll unpack001/newdev.dll unpack001/ngccredprov.dll unpack001/ngckeyenum.dll unpack001/ngcksp.dll unpack001/ngclocal.dll unpack001/ngcpopkeysrv.dll unpack001/ngcrecovery.dll unpack001/ngcsvc.dll unpack001/ngctasks.dll unpack001/ngcutils.dll unpack001/ninput.dll unpack001/nlaapi.dll unpack001/nlansp_c.dll unpack001/nlmgp.dll unpack001/nlmproxy.dll unpack001/nlmsprep.dll unpack001/nmwcdclsx64.dll unpack001/noise.dll unpack001/normaliz.dll unpack001/notificationplatformcomponent.dll unpack001/npmproxy.dll unpack001/nrtapi.dll unpack001/nshipsec.dll unpack001/nshwfp.dll unpack001/nsisvc.dll unpack001/ntdsapi.dll unpack001/ntfsres.dll unpack001/ntlanman.dll unpack001/ntlanui2.dll unpack001/ntprint.dll unpack001/ntshrui.dll unpack001/ntvdm64.dll unpack001/objsel.dll unpack001/occache.dll unpack001/ocsetapi.dll unpack001/odbc32.dll unpack001/odbcbcp.dll unpack001/odbcconf.dll unpack001/odbccp32.dll unpack001/odbccr32.dll unpack001/odbccu32.dll unpack001/odbcint.dll unpack001/odbctrac.dll unpack001/officecsp.dll unpack001/offreg.dll unpack001/oleacc.dll unpack001/oleacchooks.dll unpack001/oleaccrc.dll unpack001/oledlg.dll unpack001/oleprn.dll
File Explorer
-
f4cdee31063f9c4ab7be04464a4b6bf384755f0cd90c5744b7487788a5dd1408.bin.zip 15.2MB
-
NFCProvisioningPlugin.dll.dll 136KB
-
NPSM.dll.dll 232KB
-
NPSMDesktopProvider.dll.dll 196KB
-
NetworkBindingEngineMigPlugin.dll.dll 381KB
-
NetworkCollectionAgent.dll.dll 140KB
-
NetworkDesktopSettings.dll.dll 244KB
-
NetworkIcon.dll.dll 300KB
-
NetworkMobileSettings.dll.dll 3.4MB
-
NetworkProxyCsp.dll.dll 57KB
-
NetworkQoSPolicyCSP.dll.dll 104KB
-
NetworkUXBroker.dll.dll 560KB
-
NfcRadioMedia.dll.dll 80KB
-
NgcCtnr.dll.dll 605KB
-
NgcCtnrGidsHandler.dll.dll 428KB
-
NgcCtnrSvc.dll.dll 821KB
-
NgcIsoCtnr.dll.dll 833KB
-
NgcProCsp.dll.dll 208KB
-
NlsData0000.dll.dll 1.5MB
-
NlsData0009.dll.dll 6.3MB
-
NlsLexicons0009.dll.dll 2.5MB
-
Nlsdl.dll.dll 36KB
-
NmaDirect.dll.dll 224KB
-
NotificationController.dll.dll 1.3MB
-
NotificationControllerPS.dll.dll 404KB
-
NotificationIntelligencePlatform.dll.dll 216KB
-
NtlmShared.dll.dll 110KB
-
NvAgent.dll.dll 69KB
-
OEMDefaultAssociations.dll.dll 40KB
-
OmaDmAgent.dll.dll 192KB
-
OnDemandBrokerClient.dll.dll 72KB
-
OnDemandConnRouteHelper.dll.dll 96KB
-
networkexplorer.dll.dll 108KB
-
networkhelper.dll.dll 152KB
-
networkitemfactory.dll.dll 88KB
-
newdev.dll.dll 340KB
-
ngccredprov.dll.dll 684KB
-
ngckeyenum.dll.dll 256KB
-
ngcksp.dll.dll 180KB
-
ngclocal.dll.dll 136KB
-
ngcpopkeysrv.dll.dll 264KB
-
ngcrecovery.dll.dll 252KB
-
ngcsvc.dll.dll 1.2MB
-
ngctasks.dll.dll 228KB
-
ngcutils.dll.dll 548KB
-
ninput.dll.dll 508KB
-
nlaapi.dll.dll 52KB
-
nlansp_c.dll.dll 136KB
-
nlhtml.dll.dll 281KB
-
nlmgp.dll.dll 196KB
-
nlmproxy.dll.dll 52KB
-
nlmsprep.dll.dll 48KB
-
nlsbres.dll.dll 101KB
-
nmwcdclsx64.dll.dll 67KB
-
noise.dll.dll 132KB
-
normaliz.dll.dll 32KB
-
notificationplatformcomponent.dll.dll 68KB
-
npmproxy.dll.dll 100KB
-
nrpsrv.dll.dll 37KB
-
nrtapi.dll.dll 28KB
-
nshdnsclient.dll.dll 142KB
-
nshhttp.dll.dll 126KB
-
nshipsec.dll.dll 332KB
-
nshwfp.dll.dll 848KB
-
nsi.dll.dll 49KB
-
nsisvc.dll.dll 60KB
-
ntasn1.dll.dll 263KB
-
ntdll.dll.dll 2.4MB
-
ntdsapi.dll.dll 172KB
-
ntfsres.dll.dll 740KB
-
ntlanman.dll.dll 144KB
-
ntlanui2.dll.dll 44KB
-
ntmarta.dll.dll 219KB
-
ntprint.dll.dll 468KB
-
ntshrui.dll.dll 668KB
-
ntvdm64.dll.dll 40KB
-
objsel.dll.dll 636KB
-
occache.dll.dll 224KB
-
ocsetapi.dll.dll 236KB
-
odbc32.dll.dll 776KB
-
odbcbcp.dll.dll 72KB
-
odbcconf.dll.dll 52KB
-
odbccp32.dll.dll 144KB
-
odbccr32.dll.dll 104KB
-
odbccu32.dll.dll 104KB
-
odbcint.dll.dll 228KB
-
odbctrac.dll.dll 172KB
-
oemlicense.dll.dll 149KB
-
offfilt.dll.dll 365KB
-
officecsp.dll.dll 144KB
-
offlinelsa.dll.dll 181KB
-
offlinesam.dll.dll 337KB
-
offreg.dll.dll 112KB
-
ole32.dll.dll 1.6MB
-
oleacc.dll.dll 464KB
-
oleacchooks.dll.dll 44KB
-
oleaccrc.dll.dll 12KB
-
oleaut32.dll.dll 877KB
-
oledlg.dll.dll 228KB
-
oleprn.dll.dll 192KB
-
omadmapi.dll.dll 235KB
NFCProvisioningPlugin.dll
- IMPHASH 33241c99e8a36afdbee04ba36d915a1d
- SHA256 ddb0e7a5ab4e17f8f7349a1f71e29a5e03a8e5e73c7f4fe5e25b62693b94363b
- MD5 3f0d822d75c7ca97486baa4ac7f2d0f3
- SHA1 99d345ab7757eaf5a37912671d66eb89b6625c4a
- SHA512 3a3bd6ae00b07efd3667a650138ace226a9778085b814460ed6e84aa521d11481957394befa9a64d8cc01957cd53dee20219712054d0734c751e07049ea70b8a
- SSDEEP 3072:jhCKXKD3FcHztU9xp7yTVQSgv4Ce6u//isia:jsK6DVcHZCx5yTVtqu3iZ
- TLSH T182D35C2E35AC10F5E2B591BC85570A0AE7B1B061131267FF0690C1BD5F67BE86C3AFA1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
8880
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
NFCProvisioningPlugin.pdb
msvcrt
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
_purecall
??3@YAXPEAX@Z
??0exception@@QEAA@AEBV0@@Z
_XcptFilter
_amsg_exit
free
_initterm
__C_specific_handler
__CxxFrameHandler3
?terminate@@YAXXZ
_unlock
__dllonexit
_onexit
??1type_info@@UEAA@XZ
memmove
_CxxThrowException
memcpy
malloc
wcsncmp
_wcsicmp
_callnewh
memcpy_s
_vsnwprintf
??_V@YAXPEAX@Z
__CxxFrameHandler4
_lock
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
DisableThreadLibraryCalls
GetModuleHandleExW
GetModuleFileNameA
GetProcAddress
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
Sleep
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-synch-l1-1-0
SetEvent
WaitForSingleObject
EnterCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
LeaveCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
CreateSemaphoreExW
OpenSemaphoreW
ReleaseSemaphore
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseMutex
CreateEventExW
CreateMutexExW
ResetEvent
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
SetLastError
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
RaiseException
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventSetInformation
EventActivityIdControl
EventWriteTransfer
EventRegister
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
RoOriginateErrorW
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
policymanager
PolicyManager_GetConnectivityPolicy_AllowNFC
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-winrt-l1-1-0
RoInitialize
RoGetActivationFactory
RoUninitialize
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoCreateGuid
CoTaskMemFree
api-ms-win-core-file-l1-1-0
CreateFileW
CreateDirectoryW
FindFirstFileW
RemoveDirectoryW
GetTempFileNameW
WriteFile
GetFileAttributesW
FindClose
SetFileAttributesW
DeleteFileW
SetFileInformationByHandle
GetFullPathNameW
FindNextFileW
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
MoveFileExW
api-ms-win-core-path-l1-1-0
PathCchAppendEx
PathCchCombineEx
PathCchCanonicalizeEx
PathAllocCombine
PathCchFindExtension
PathCchCombine
api-ms-win-core-registry-l1-1-0
RegGetValueW
api-ms-win-devices-config-l1-1-1
CM_Register_Notification
CM_Unregister_Notification
api-ms-win-core-file-l1-2-3
GetTempPath2W
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFindFileNameW
profapi
ord117
crypt32
CryptBinaryToStringW
msvcp110_win
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Winerror_map@std@@YAPEBDH@Z
?_Syserror_map@std@@YAPEBDH@Z
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
76KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
632B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=66, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=17, id=260, version=33145,
count=179, id=1, productName=Unmarked objects,
count=11, id=257, version=33145,
count=10, id=261, version=33145,
count=1, id=256, version=33145,
count=16, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
NPSM.dll
- IMPHASH b71485c8639c33ef14e6b613607e8c0f
- SHA256 50f0169d8f1c8a819c467f27d0bb90ff46138b4d2246a0dc75f379884a865a7b
- MD5 ed1fc3201bb3ac564138db79df7941bd
- SHA1 a1beaf4170470e1bf341bc1055b33d6efb62af14
- SHA512 076ea7eb0dba81d96a4959b8b5324d7154e6df7b01ea4bb1e6d9bb5f9fa2def34791d0450aa86b47a1da81aafd7751be489dff0eff89e4db048a09e5a597ae60
- SSDEEP 3072:1HSexvXf7R1Jp/BPWK9XPjN6nJ217q2oKhXBVXC+kXYgXla9WOEKNaF:FzvP7RHp/BWK9P5sJ2Fq215eXlFOVN
- TLSH T1A7343B6E26E904E6F977D27CC5934A0AE672B4110722D2CF02D0427D4F67FE8AD39B91
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
12512
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
NPSM.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_ceilf
_o_free
_o_malloc
_o_memcpy_s
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
_CxxThrowException
__CxxFrameHandler3
wcschr
_o__execute_onexit_table
_o__errno
_o__difftime64
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
memcpy
api-ms-win-crt-string-l1-1-0
memset
wcscmp
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-winrt-string-l1-1-0
WindowsStringHasEmbeddedNull
WindowsGetStringRawBuffer
WindowsCreateString
WindowsIsStringEmpty
WindowsCreateStringReference
WindowsDeleteString
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-eventing-obsolete-l1-1-0
RegisterTraceGuidsA
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableFlags
TraceMessage
UnregisterTraceGuids
GetTraceEnableLevel
GetTraceLoggerHandle
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
RoOriginateErrorW
RoOriginateError
SetRestrictedErrorInfo
api-ms-win-core-synch-l1-1-0
CreateMutexExW
CreateSemaphoreExW
CreateEventW
SetEvent
ReleaseSemaphore
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
CreateEventExW
DeleteCriticalSection
InitializeCriticalSectionEx
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
ReleaseSRWLockExclusive
LeaveCriticalSection
WaitForSingleObject
EnterCriticalSection
InitializeSRWLock
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetProcAddress
GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleFileNameA
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
OpenProcessToken
GetCurrentThreadId
GetProcessId
TerminateProcess
GetCurrentProcessId
ProcessIdToSessionId
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
RaiseException
SetUnhandledExceptionFilter
SetLastError
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
api-ms-win-core-com-l1-1-0
CoIncrementMTAUsage
CoInitializeEx
CoSetProxyBlanket
CoGetCallContext
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoRevertToSelf
CoUninitialize
CoFreeUnusedLibrariesEx
CoTaskMemFree
CoCreateFreeThreadedMarshaler
CoResumeClassObjects
CoWaitForMultipleHandles
CoRegisterClassObject
CoImpersonateClient
CoDecrementMTAUsage
CLSIDFromString
CoGetMalloc
PropVariantClear
CoDisconnectContext
CoRevokeClassObject
CoDisableCallCancellation
CoEnableCallCancellation
CoCancelCall
ntdll
RtlPublishWnfStateData
RtlSubscribeWnfStateChangeNotification
NtQueryWnfStateData
RtlEqualSid
RtlRandomEx
RtlCompareUnicodeString
RtlNtStatusToDosErrorNoTeb
RtlAllocateHeap
RtlInitUnicodeString
NtQueryInformationToken
RtlFreeHeap
RtlUnsubscribeWnfStateChangeNotification
RtlQueryPackageClaims
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoRevokeActivationFactories
RoRegisterActivationFactories
RoActivateInstance
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventRegister
EventUnregister
EventWriteTransfer
EventActivityIdControl
api-ms-win-core-featurestaging-l1-1-0
GetFeatureEnabledState
RecordFeatureUsage
UnsubscribeFeatureStateChangeNotification
SubscribeFeatureStateChangeNotification
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolWait
CreateThreadpoolTimer
CloseThreadpoolWait
CreateThreadpoolWait
SetThreadpoolTimer
WaitForThreadpoolWaitCallbacks
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringOrdinal
api-ms-win-service-core-l1-1-0
RegisterServiceCtrlHandlerExW
SetServiceStatus
api-ms-win-power-setting-l1-1-0
PowerSettingRegisterNotification
PowerSettingUnregisterNotification
api-ms-win-core-kernel32-legacy-l1-1-0
UnregisterWait
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolGetUniqueContext
SHTaskPoolQueueTask
api-ms-win-core-registry-l1-1-0
RegGetValueW
rpcrt4
I_RpcBindingInqLocalClientPID
api-ms-win-security-base-l1-1-0
CopySid
GetLengthSid
GetTokenInformation
api-ms-win-security-capability-l1-1-0
CapabilityCheck
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
api-ms-win-core-threadpool-legacy-l1-1-0
DeleteTimerQueueTimer
CreateTimerQueueTimer
api-ms-win-shcore-thread-l1-1-0
SHCreateThread
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-shcore-stream-winrt-l1-1-0
CreateStreamOverRandomAccessStream
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-core-atoms-l1-1-0
GlobalGetAtomNameW
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
combase
ord68
ord66
ord67
propsys
PSPropertyKeyFromString
PSGetPropertyKeyFromName
ord436
PSCreateMemoryPropertyStore
msvcp_win
_Mtx_lock
_Mtx_unlock
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_init_in_situ
_Mtx_destroy_in_situ
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
ServiceMain
SvchostPushServiceGlobals
Name
.text
Size
140KB
Virtual Size
137KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
56KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=103, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33145,
count=5, id=259, version=33145,
count=1287, id=1, productName=Unmarked objects,
count=6, id=257, version=33145,
count=30, id=261, version=33145,
count=1, id=256, version=33145,
count=21, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
NPSMDesktopProvider.dll
- IMPHASH 55be1ad5fea1280892bdfd60613edec2
- SHA256 c347224b6c17ef768c44b8c2b929e0779ae367c4d29572c36eb28331841627aa
- MD5 26b0ee2bf9c6aacc7adf6497630bbddf
- SHA1 259e3d211737b2ae1a80f0a575ca72beda08d4ec
- SHA512 c02cf2876e3a56953c1b89a7b6eebfec544cf6dc4ad8258fc0d063cd4c194bf47a0162d1bf348401238d1f05e46c67a47871c02197978941a986af93bdbfffb0
- SSDEEP 3072:SX0XwrcmKNOqCLica0Tj+0i3yK5svEE9bAHTf06KTM:dXwQmbRLXa020i3yCszd6KT
- TLSH T1B3142B2E32EA10E6E57A913C84974A09F672B461172261DF03D081BD5F6BFE4BC3DB61
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
10496
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
NPSMDesktopProvider.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wsplitpath_s
_o_free
_o_malloc
__C_specific_handler
__CxxFrameHandler3
__CxxFrameHandler4
_CxxThrowException
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
wcschr
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExA
GetModuleHandleW
GetProcAddress
GetModuleHandleExW
LoadStringW
GetModuleFileNameA
FreeLibrary
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-localization-l1-2-0
GetLocaleInfoW
FormatMessageW
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
ReleaseSRWLockShared
CreateSemaphoreExW
WaitForSingleObject
ReleaseSemaphore
OpenSemaphoreW
InitializeCriticalSectionEx
ReleaseMutex
WaitForSingleObjectEx
CreateMutexExW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockShared
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
OpenProcessToken
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetLastError
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-1
OpenProcess
IsProcessorFeaturePresent
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
SetThreadpoolTimer
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
IsThreadpoolTimerSet
CloseThreadpoolWait
CreateThreadpoolTimer
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventActivityIdControl
EventUnregister
EventWriteTransfer
EventSetInformation
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-security-base-l1-1-0
DuplicateTokenEx
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
WideCharToMultiByte
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
ntdll
NtQueryWnfStateData
RtlUnsubscribeWnfStateChangeNotification
RtlSubscribeWnfStateChangeNotification
RtlInitUnicodeString
RtlDeriveCapabilitySidsFromName
RtlEqualSid
RtlQueryTokenHostIdAsUlong64
RtlCompareUnicodeString
RtlNtStatusToDosErrorNoTeb
RtlAllocateHeap
RtlFreeHeap
NtQueryInformationToken
api-ms-win-core-localization-obsolete-l1-2-0
GetUserDefaultUILanguage
api-ms-win-core-threadpool-legacy-l1-1-0
CreateTimerQueueTimer
DeleteTimerQueueTimer
api-ms-win-appmodel-runtime-l1-1-1
GetPackageFullNameFromToken
ext-ms-win-security-capauthz-l1-1-0
QueryApplicationCapabilities
api-ms-win-core-memory-l1-1-0
VirtualProtect
VirtualQuery
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
124KB
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=33145,
count=73, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1258, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=11, id=260, version=33145,
count=5, id=259, version=33145,
count=24, id=261, version=33145,
count=1, id=256, version=33145,
count=22, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
NetworkBindingEngineMigPlugin.dll
- IMPHASH 9721fa1f99040d505e8cf7414d875192
- SHA256 0a8a3df97c267445c2956ac025b15f61dd7286b889062affd9d2ce0c08eecd59
- MD5 3c35978dfe14f044299180c549217ac5
- SHA1 1a5f1f5c9c6e287d79e392ed65842431e998e42f
- SHA512 ae5531507d9308e39467631730deebd45de7ca8e17f2aba888267d8cbc2b8aa88bc494e49473cdc8f0b8834033af127d3bdba24d68e771571fa62e5e92fc0798
- SSDEEP 6144:XbnCzSBa+0VyJ6ZThiNFsYC+sSzzkR/JwWh0fzsyKkeiwTfvS8bk53i3LLgK+H:bC+4+0VvBhdYGcMibys
- TLSH T1D0845C2EAA980CA0E177D17C89AB8546F7F278551B32C9CF0255817E2E37EE4CD39712
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
05:40:de:d1:09:5f:64:b7:a1:ff:7e:96:dc:69:50:6c:a7:9a:a6:67:dd:78:8f:31:68:b5:e5:e4:58:6f:f4:05
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:401A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:19:5e:b2:d8:54:75:f4:b1:8d:00:01:00:00:02:19
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
6768
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB paths
NetworkBindingEngineMigPlugin.pdb
msvcrt
memcmp
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
??0exception@@QEAA@AEBQEBDH@Z
_callnewh
_wcsicmp
vswprintf_s
wcsrchr
_wfopen_s
fclose
fputwc
fputws
_vscwprintf
swprintf_s
??8type_info@@QEBAHAEBV0@@Z
iswdigit
_wcsnicmp
swscanf_s
??0exception@@QEAA@AEBQEBD@Z
?what@exception@@UEBAPEBDXZ
wcsncmp
memmove_s
__C_specific_handler
malloc
free
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
_purecall
memcpy_s
_vsnwprintf
__CxxFrameHandler3
memset
ntdll
NtQueryKey
NtDeleteKey
RtlCaptureStackBackTrace
EtwTraceMessage
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
kernel32
RegQueryInfoKeyW
LoadLibraryExW
RegCreateKeyExW
RegEnumKeyExW
DuplicateHandle
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegEnumValueW
RegQueryValueExW
GetTimeFormatEx
LoadLibraryExA
DelayLoadFailureHook
FreeLibrary
TerminateProcess
SleepConditionVariableSRW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
SetLastError
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
HeapAlloc
GetProcAddress
CreateMutexExW
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
WideCharToMultiByte
DebugBreak
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
SetThreadpoolTimer
CreateThreadpoolTimer
DeleteCriticalSection
InitializeCriticalSectionEx
GetCurrentProcess
GetModuleFileNameW
InitializeCriticalSection
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
DisableThreadLibraryCalls
RaiseException
Sleep
WakeAllConditionVariable
QueryPerformanceCounter
GetDateFormatEx
oleaut32
LoadRegTypeLi
SysStringLen
SysAllocString
LoadTypeLi
SysFreeString
ole32
CLSIDFromString
CoCreateInstance
StringFromCLSID
CoTaskMemFree
advapi32
EventWriteTransfer
RegOpenKeyTransactedW
RegCreateKeyTransactedW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCloseKey
cfgmgr32
CM_Open_DevNode_Key
CM_Get_Device_ID_List_SizeW
CM_Locate_DevNodeW
CM_Get_Device_ID_ListW
DllCanUnloadNow
DllGetClassObject
NetworkBindingEngineFinishMigration
Name
.text
Size
236KB
Virtual Size
232KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
100KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=18, id=260, version=33145,
count=194, id=1, productName=Unmarked objects,
count=19, id=257, version=33145,
count=1, id=256, version=33145,
count=38, id=264, version=33145,
count=11, id=261, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
NetworkCollectionAgent.dll
- IMPHASH 497c96194ea5966de4727537331ee182
- SHA256 4f8684a3a0983d74dae0405f7ca87742bca7d79a016867871775bd06bf9b7b10
- MD5 15f13dbcc6b748b72199c9fe4268f0eb
- SHA1 e04f7ee29d83d550721806dbc883377c4dc6fe7d
- SHA512 e1d00e71e25e7b87dae31c699838b6f30ed02dc896500530c984fd4825e4a4de8825d23f6947cbdd2aef61fe0a37995b4954955bc6cd082faf7570f049afb6f3
- SSDEEP 3072:18F23HRvBxyHzabnNP0yewflwigO6TKaP9CtfF3T:SGJxqaNewdtg739WfF3
- TLSH T152E3A57A3D9C00E3E175B079C9C38A1797A6BCA10B6267CF2190230D4D7BFD99D39A21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
18112
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
NetworkCollectionAgent.pdb
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
wincorlib
?__abi_WinRTraiseInvalidCastException@@YAXXZ
?__abi_WinRTraiseObjectDisposedException@@YAXXZ
??0Object@Platform@@QE$AAA@XZ
?Free@Heap@Details@Platform@@SAXPEAX@Z
?AlignedFree@Heap@Details@Platform@@SAXPEAX@Z
?__abi_WinRTraiseNotImplementedException@@YAXXZ
?__abi_WinRTraiseDisconnectedException@@YAXXZ
?__abi_WinRTraiseWrongThreadException@@YAXXZ
?__abi_WinRTraiseOutOfBoundsException@@YAXXZ
?__abi_WinRTraiseChangedStateException@@YAXXZ
?__abi_WinRTraiseNullReferenceException@@YAXXZ
?__abi_WinRTraiseCOMException@@YAXJ@Z
?__abi_WinRTraiseClassNotRegisteredException@@YAXXZ
?__abi_WinRTraiseInvalidArgumentException@@YAXXZ
?__abi_WinRTraiseAccessDeniedException@@YAXXZ
?ReleaseTarget@ControlBlock@Details@Platform@@AEAAXXZ
?Allocate@Heap@Details@Platform@@SAPEAX_K0@Z
?AllocateException@Heap@Details@Platform@@SAPEAX_K0@Z
??0OutOfBoundsException@Platform@@QE$AAA@XZ
??0ChangedStateException@Platform@@QE$AAA@XZ
??0OutOfMemoryException@Platform@@QE$AAA@XZ
??0FailureException@Platform@@QE$AAA@XZ
?EventSourceUninitialize@Details@Platform@@YAXPEAPEAX@Z
?EventSourceRemove@Details@Platform@@YAXPEAPEAXPEAUEventLock@12@VEventRegistrationToken@Foundation@Windows@@@Z
?EventSourceAdd@Details@Platform@@YA?AVEventRegistrationToken@Foundation@Windows@@PEAPEAXPEAUEventLock@12@PE$AAVDelegate@2@@Z
?__abi_WinRTraiseOperationCanceledException@@YAXXZ
?__abi_WinRTraiseFailureException@@YAXXZ
?EventSourceInitialize@Details@Platform@@YAXPEAPEAX@Z
?EventSourceGetTargetArray@Details@Platform@@YAPEAXPEAXPEAUEventLock@12@@Z
?EventSourceGetTargetArraySize@Details@Platform@@YAIPEAX@Z
?EventSourceGetTargetArrayEvent@Details@Platform@@YAPEAXPEAXIPEBXPEA_J@Z
?GetIBoxArrayVtable@Details@Platform@@YAPEAXPEAX@Z
?InitializeData@Details@Platform@@YAJH@Z
?UninitializeData@Details@Platform@@YAXH@Z
?__abi_FailFast@@YAXXZ
?ReCreateFromException@Details@Platform@@YAJPE$AAVException@2@@Z
?GetIidsFn@@YAJHPEAKPEBU__s_GUID@@PEAPEAVGuid@Platform@@@Z
?__abi_WinRTraiseOutOfMemoryException@@YAXXZ
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_ceilf
_o_free
_o_malloc
_o_terminate
_o_wcscpy_s
__CxxFrameHandler3
_CxxThrowException
__current_exception
__current_exception_context
__C_specific_handler
__std_terminate
__CxxFrameHandler4
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__C_specific_handler_noexcept
kernel32
InitializeCriticalSection
DeleteCriticalSection
HeapDestroy
HeapFree
HeapAlloc
HeapCreate
CloseHandle
EnterCriticalSection
LeaveCriticalSection
RaiseException
GetCurrentProcess
GetProcAddress
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleW
CreateEventW
InitializeCriticalSectionAndSpinCount
ReleaseSRWLockShared
AcquireSRWLockShared
InitOnceExecuteOnce
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
DecodePointer
HeapSize
HeapReAlloc
GetProcessHeap
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
ole32
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
user32
UnregisterClassA
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33140,
count=1310, id=1, productName=Unmarked objects,
count=21, id=257, version=33140,
count=31, id=261, version=33140,
count=7, id=259, version=33140,
count=1, id=256, version=33140,
count=35, id=265, version=33140,
count=1, id=253, version=33140,
count=1, id=255, version=33140,
count=1, id=258, version=33140,
NetworkDesktopSettings.dll
- IMPHASH db6cd0291d7156454eb47e02e315827a
- SHA256 54a510c0a252df8c4dafc54da17aa7605e8f3fbd57d33152c32dab82c6291bb0
- MD5 f68b5bc526f0330dbccef4ba8fdf14a0
- SHA1 4700112433c7060c593c89a8a0c6c7b8fb7aa563
- SHA512 061f5c7cc6c048f64c8984c8eb9edf9dc368169a860d34e7778aa40a3178bb2c8fc682e61af1740f59023957a17b34bd2f01c95483912170317a267e57d43555
- SSDEEP 3072:q64VEOELB0Nrj4G8++Z7Ee19XuyksUiP9M3OzKnCPJVxLPFFLiuHeWy3VGWb7suy:r4aOELBiMG8++Zoe19ogPqezvRVxm9e
- TLSH T1CB34F97B2DAC04A3E576B17EC5934B0AE3B27895435293CF0664036E4E1BFE86D39271
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
11152
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
NetworkDesktopSettings.pdb
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
wincorlib
?GetWeakReference@Details@Platform@@YAPEAU__abi_IUnknown@@QE$ADVObject@2@@Z
?EventSourceAdd@Details@Platform@@YA?AVEventRegistrationToken@Foundation@Windows@@PEAPEAXPEAUEventLock@12@PE$AAVDelegate@2@@Z
??0Delegate@Platform@@QE$AAA@XZ
??0DisconnectedException@Platform@@QE$AAA@XZ
?EventSourceInitialize@Details@Platform@@YAXPEAPEAX@Z
?EventSourceUninitialize@Details@Platform@@YAXPEAPEAX@Z
?__abi_ObjectToString@__abi_details@@YAPE$AAVString@Platform@@PE$AAVObject@3@_N@Z
?GetIBoxVtable@Details@Platform@@YAPEAXPEAX@Z
?CreateValue@Details@Platform@@YAPE$AAVObject@2@W4TypeCode@2@PEBX@Z
?__abi_make_type_id@@YAPE$AAVType@Platform@@AEBU__abi_type_descriptor@@@Z
?GetTypeCode@Type@Platform@@SA?AW4TypeCode@2@PE$AAV12@@Z
?EventSourceGetTargetArray@Details@Platform@@YAPEAXPEAXPEAUEventLock@12@@Z
?EventSourceGetTargetArraySize@Details@Platform@@YAIPEAX@Z
?EventSourceGetTargetArrayEvent@Details@Platform@@YAPEAXPEAXIPEBXPEA_J@Z
??0InvalidArgumentException@Platform@@QE$AAA@XZ
?__abi_cast_String_to_Object@__abi_details@@YAPE$AAVObject@Platform@@PE$AAVString@3@@Z
?CreateException@Exception@Platform@@SAPE$AAV12@H@Z
?GetIBoxArrayVtable@Details@Platform@@YAPEAXPEAX@Z
??0Object@Platform@@QE$AAA@XZ
?Allocate@Heap@Details@Platform@@SAPEAX_K0@Z
??0FailureException@Platform@@QE$AAA@XZ
??0OutOfBoundsException@Platform@@QE$AAA@XZ
??0ChangedStateException@Platform@@QE$AAA@XZ
?GetProxyImpl@Details@Platform@@YAJPEAUIUnknown@@AEBU_GUID@@0PEAPEAU3@@Z
?GetObjectContext@Details@Platform@@YAPEAUIUnknown@@XZ
??0OutOfMemoryException@Platform@@QE$AAA@XZ
?EventSourceRemove@Details@Platform@@YAXPEAPEAXPEAUEventLock@12@VEventRegistrationToken@Foundation@Windows@@@Z
?AllocateException@Heap@Details@Platform@@SAPEAX_K0@Z
??0NotImplementedException@Platform@@QE$AAA@XZ
?ReleaseTarget@ControlBlock@Details@Platform@@AEAAXXZ
?InitializeData@Details@Platform@@YAJH@Z
?UninitializeData@Details@Platform@@YAXH@Z
?__abi_FailFast@@YAXXZ
?ReCreateFromException@Details@Platform@@YAJPE$AAVException@2@@Z
?GetIidsFn@@YAJHPEAKPEBU__s_GUID@@PEAPEAVGuid@Platform@@@Z
?GetActivationFactoryByPCWSTR@@YAJPEAXAEAVGuid@Platform@@PEAPEAX@Z
?AlignedFree@Heap@Details@Platform@@SAXPEAX@Z
?Free@Heap@Details@Platform@@SAXPEAX@Z
?__abi_WinRTraiseObjectDisposedException@@YAXXZ
?__abi_WinRTraiseInvalidCastException@@YAXXZ
?__abi_WinRTraiseNotImplementedException@@YAXXZ
?CreateException@Exception@Platform@@SAPE$AAV12@HPE$AAVString@2@@Z
?get@Message@Exception@Platform@@QE$AAAPE$AAVString@3@XZ
?__abi_WinRTraiseDisconnectedException@@YAXXZ
?__abi_WinRTraiseFailureException@@YAXXZ
?__abi_WinRTraiseOperationCanceledException@@YAXXZ
?__abi_WinRTraiseAccessDeniedException@@YAXXZ
?__abi_WinRTraiseInvalidArgumentException@@YAXXZ
?__abi_WinRTraiseClassNotRegisteredException@@YAXXZ
?ResolveWeakReference@Details@Platform@@YAPE$AAVObject@2@AEBU_GUID@@PEAPEAU__abi_IUnknown@@@Z
?__abi_WinRTraiseCOMException@@YAXJ@Z
?__abi_WinRTraiseNullReferenceException@@YAXXZ
?__abi_WinRTraiseChangedStateException@@YAXXZ
?__abi_WinRTraiseOutOfBoundsException@@YAXXZ
?__abi_WinRTraiseWrongThreadException@@YAXXZ
?__abi_WinRTraiseOutOfMemoryException@@YAXXZ
?ReleaseInContextImpl@Details@Platform@@YAJPEAUIUnknown@@0@Z
api-ms-win-crt-string-l1-1-0
memset
wcslen
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o___std_type_info_destroy_list
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o_malloc
_o_terminate
__CxxFrameHandler3
_CxxThrowException
_o___std_exception_destroy
__C_specific_handler
__current_exception
__current_exception_context
_o___std_exception_copy
__std_terminate
wcsstr
__CxxFrameHandler4
_o___stdio_common_vswprintf
memcmp
memcpy
shcore
ord162
ord244
IUnknown_QueryService
IUnknown_SetSite
SHStrDupA
shell32
SHCreateItemFromParsingName
ShellExecuteExW
SHCreateShellItemArrayFromShellItem
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleHandleW
GetModuleFileNameA
GetModuleHandleExW
FindResourceExW
DisableThreadLibraryCalls
LockResource
LoadResource
api-ms-win-core-synch-l1-1-0
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
ReleaseMutex
LeaveCriticalSection
WaitForSingleObject
InitializeCriticalSectionEx
ReleaseSemaphore
DeleteCriticalSection
ReleaseSRWLockShared
CreateSemaphoreExW
AcquireSRWLockExclusive
InitializeSRWLock
AcquireSRWLockShared
EnterCriticalSection
ReleaseSRWLockExclusive
SetEvent
ResetEvent
CreateEventW
InitializeCriticalSectionAndSpinCount
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
SetLastError
GetLastError
api-ms-win-core-processthreads-l1-1-0
OpenProcessToken
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
CreateThread
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringOrdinal
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegCloseKey
RegOpenKeyExW
api-ms-win-core-util-l1-1-0
DecodePointer
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
InitOnceExecuteOnce
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventSetInformation
EventWriteTransfer
EventActivityIdControl
EventRegister
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
api-ms-win-core-winrt-l1-1-0
RoInitialize
RoUninitialize
RoGetActivationFactory
ntdll
RtlInitString
NtAllocateLocallyUniqueId
RtlNtStatusToDosError
ole32
CoAllowSetForegroundWindow
CreateBindCtx
user32
GetProcessDefaultLayout
AllowSetForegroundWindow
GetWindowRect
GetMenuDefaultItem
CreatePopupMenu
DestroyMenu
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
GetSetting
Name
.text
Size
140KB
Virtual Size
139KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
60KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
264B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=50, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=15, id=260, version=33145,
count=1282, id=1, productName=Unmarked objects,
count=15, id=257, version=33145,
count=34, id=261, version=33145,
count=1, id=256, version=33145,
count=12, id=265, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
NetworkIcon.dll
- IMPHASH e953e5a9081e4fae122443d0754e7a42
- SHA256 0781a63d2f840d4195355cc98cce115b14dc915c23892dcc3efb7a02e3ec1fcd
- MD5 050de6219d1d58ca4153d76b0a240b41
- SHA1 e2139c14f10c67719cb54e54ab09b57e5bd38573
- SHA512 22bb082df811cc3477aff39feee63a559cbd25d5c14270013fc8d5b21711f840cd3f341015d44f877433d3cc82c11fd19b39d0f53504a00be1fdeaa0ca52ba0b
- SSDEEP 6144:Wjr8mZTUrFcixXKbnBh0a8Qzxx+hfHCMgr1l:BmZgrFct3mhPCT
- TLSH T10E644C6D66690CB6E57BD13DC6C38A0FE2B274554332C6CF069102AE1E5BFE8903E761
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
15120
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
NetworkIcon.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_abort
_o_ceilf
_o_free
_o_iswspace
_o_malloc
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
_CxxThrowException
__CxxFrameHandler3
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
GetProcAddress
LoadStringW
GetModuleHandleExW
GetModuleHandleW
LoadLibraryExW
FreeLibrary
GetModuleFileNameA
GetModuleHandleExA
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
EnterCriticalSection
CreateEventW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
DeleteCriticalSection
ResetEvent
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
InitializeCriticalSectionEx
ReleaseMutex
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
SetEvent
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventSetInformation
EventRegister
EventWriteTransfer
EventActivityIdControl
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedPushEntrySList
InterlockedFlushSList
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
TrySubmitThreadpoolCallback
SetThreadpoolTimerEx
SetThreadpoolTimer
CloseThreadpoolTimer
api-ms-win-service-management-l1-1-0
CloseServiceHandle
OpenServiceW
OpenSCManagerW
api-ms-win-service-winsvc-l1-1-0
QueryServiceStatus
api-ms-win-service-private-l1-1-0
SubscribeServiceChangeNotifications
UnsubscribeServiceChangeNotifications
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoIncrementMTAUsage
CoGetApartmentType
CoCreateInstance
CoSetProxyBlanket
CoCreateFreeThreadedMarshaler
CoTaskMemFree
StringFromIID
CoDecrementMTAUsage
CoGetObjectContext
ntdll
RtlIsMultiSessionSku
RtlGetDeviceFamilyInfoEnum
RtlSubscribeWnfStateChangeNotification
NtQueryWnfStateData
RtlUnsubscribeWnfStateChangeNotification
msvcp_win
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?_Xlength_error@std@@YAXPEBD@Z
_Thrd_yield
?__ExceptionPtrDestroy@@YAXPEAX@Z
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
RoFailFastWithErrorContext
api-ms-win-core-util-l1-1-0
EncodePointer
api-ms-win-core-com-l1-1-1
RoGetAgileReference
DllCanUnloadNow
DllGetActivationFactory
Name
.text
Size
196KB
Virtual Size
193KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=67, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33145,
count=5, id=259, version=33145,
count=1196, id=1, productName=Unmarked objects,
count=2, id=257, version=33145,
count=28, id=261, version=33145,
count=1, id=256, version=33145,
count=13, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
NetworkMobileSettings.dll
- IMPHASH 798362b2deb7ee6e6a8065ae1f4cb9dd
- SHA256 d85481e840a43ef89a5d35a6ddbe9a5e7b461d3d7d875d41b5f4304f43056b2c
- MD5 b911f3f8e5b6d4e465d54fcb1e1323bb
- SHA1 a675ed03a70e857569699b5ee43f2d2887f1aa52
- SHA512 6d378a3c2ca653da49889489ff5e0e71e4172837f13fa4fff197f2652318486080dc828bd600144b513308dca3a67860161594b44969c7b451e06e650865e9cd
- SSDEEP 49152:g8fndjL+ChyA6gi5gnrE8XO1AAlAOf5nKl8BW7mQNOEz8DGrIizudV2Gib1:LlbrE8XitnKl8BW7mQNOEz8DGrIIb1
- TLSH T108F55A2A56EC0298EAFAD67CC57B4907EAB178495331D1CF216C054D4F2BBE1893EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
47904
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
NetworkMobileSettings.pdb
msvcp_win
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@_K@Z
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@I@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?setbase@std@@YA?AU?$_Smanip@H@1@H@Z
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
?id@?$collate@G@std@@2V0locale@2@A
?tolower@?$ctype@G@std@@QEBAGG@Z
?is@?$ctype@G@std@@QEBA_NFG@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@_N@Z
??0_Locinfo@std@@QEAA@HPEBD@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?_Makeloc@_Locimp@locale@std@@CAPEAV123@AEBV_Locinfo@3@HPEAV123@PEBV23@@Z
?_Xruntime_error@std@@YAXPEBD@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@H@Z
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG0@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
?_Xout_of_range@std@@YAXPEBD@Z
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ
?_Assign@_ContextCallback@details@Concurrency@@AEAAXPEAX@Z
??0_Locinfo@std@@QEAA@PEBD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??1_Locinfo@std@@QEAA@XZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?widen@?$ctype@G@std@@QEBAGD@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?id@?$ctype@G@std@@2V0locale@2@A
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?width@ios_base@std@@QEBA_JXZ
??Bid@locale@std@@QEAA_KXZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
?is@?$ctype@_W@std@@QEBA_NF_W@Z
?tolower@?$ctype@_W@std@@QEBA_W_W@Z
?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?id@?$collate@_W@std@@2V0locale@2@A
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?_Xbad_alloc@std@@YAXXZ
?width@ios_base@std@@QEAA_J_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
_Wcsxfrm
_Wcscoll
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
_Cnd_wait
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_Xbad_function_call@std@@YAXXZ
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
_Cnd_init_in_situ
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
_Mtx_init_in_situ
_Cnd_destroy_in_situ
_Mtx_destroy_in_situ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
_Mtx_lock
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_unlock
_Cnd_broadcast
?_Xlength_error@std@@YAXPEBD@Z
?_Getname@_Locinfo@std@@QEBAPEBDXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?good@ios_base@std@@QEBA_NXZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?flags@ios_base@std@@QEBAHXZ
?uncaught_exception@std@@YA_NXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGXZ
??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z
?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
wincorlib
?EventSourceInitialize@Details@Platform@@YAXPEAPEAX@Z
?EventSourceUninitialize@Details@Platform@@YAXPEAPEAX@Z
?AllocateException@Heap@Details@Platform@@SAPEAX_K0@Z
??0NotImplementedException@Platform@@QE$AAA@XZ
?Allocate@Heap@Details@Platform@@SAPEAX_K0@Z
?EventSourceAdd@Details@Platform@@YA?AVEventRegistrationToken@Foundation@Windows@@PEAPEAXPEAUEventLock@12@PE$AAVDelegate@2@@Z
?GetWeakReference@Details@Platform@@YAPEAU__abi_IUnknown@@QE$ADVObject@2@@Z
?__abi_cast_String_to_Object@__abi_details@@YAPE$AAVObject@Platform@@PE$AAVString@3@@Z
??0InvalidArgumentException@Platform@@QE$AAA@XZ
?__abi_cast_Object_to_String@__abi_details@@YAPE$AAVString@Platform@@_NPE$AAVObject@3@@Z
?Free@Heap@Details@Platform@@SAXPEAX@Z
??0OutOfMemoryException@Platform@@QE$AAA@XZ
??0FailureException@Platform@@QE$AAA@XZ
?__abi_WinRTraiseObjectDisposedException@@YAXXZ
?ToString@Guid@Platform@@QEAAPE$AAVString@2@XZ
?__abi_WinRTraiseInvalidCastException@@YAXXZ
??0ChangedStateException@Platform@@QE$AAA@XZ
?ReleaseInContextImpl@Details@Platform@@YAJPEAUIUnknown@@0@Z
?__abi_WinRTraiseNotImplementedException@@YAXXZ
?GetObjectContext@Details@Platform@@YAPEAUIUnknown@@XZ
??0Delegate@Platform@@QE$AAA@XZ
??0DisconnectedException@Platform@@QE$AAA@XZ
?GetTypeCode@Type@Platform@@SA?AW4TypeCode@2@PE$AAV12@@Z
?AlignedFree@Heap@Details@Platform@@SAXPEAX@Z
?CreateException@Exception@Platform@@SAPE$AAV12@HPE$AAVString@2@@Z
?CreateValue@Details@Platform@@YAPE$AAVObject@2@W4TypeCode@2@PEBX@Z
?GetIBoxVtable@Details@Platform@@YAPEAXPEAX@Z
?__abi_ObjectToString@__abi_details@@YAPE$AAVString@Platform@@PE$AAVObject@3@_N@Z
?GetIBoxArrayVtable@Details@Platform@@YAPEAXPEAX@Z
?get@Message@Exception@Platform@@QE$AAAPE$AAVString@3@XZ
?__abi_WinRTraiseDisconnectedException@@YAXXZ
?__abi_WinRTraiseFailureException@@YAXXZ
?__abi_WinRTraiseOperationCanceledException@@YAXXZ
?__abi_WinRTraiseAccessDeniedException@@YAXXZ
?GetProxyImpl@Details@Platform@@YAJPEAUIUnknown@@AEBU_GUID@@0PEAPEAU3@@Z
??0NullReferenceException@Platform@@QE$AAA@XZ
?get@FullName@Type@Platform@@QE$AAAPE$AAVString@3@XZ
?ResolveWeakReference@Details@Platform@@YAPE$AAVObject@2@AEBU_GUID@@PEAPEAU__abi_IUnknown@@@Z
?ReCreateFromException@Details@Platform@@YAJPE$AAVException@2@@Z
?CreateException@Exception@Platform@@SAPE$AAV12@H@Z
?__abi_WinRTraiseOutOfMemoryException@@YAXXZ
?InitializeData@Details@Platform@@YAJH@Z
?UninitializeData@Details@Platform@@YAXH@Z
?__abi_FailFast@@YAXXZ
?GetActivationFactoryByPCWSTR@@YAJPEAXAEAVGuid@Platform@@PEAPEAX@Z
?GetIidsFn@@YAJHPEAKPEBU__s_GUID@@PEAPEAVGuid@Platform@@@Z
??0Object@Platform@@QE$AAA@XZ
?EventSourceGetTargetArrayEvent@Details@Platform@@YAPEAXPEAXIPEBXPEA_J@Z
?EventSourceGetTargetArraySize@Details@Platform@@YAIPEAX@Z
?EventSourceGetTargetArray@Details@Platform@@YAPEAXPEAXPEAUEventLock@12@@Z
?__abi_WinRTraiseInvalidArgumentException@@YAXXZ
?__abi_WinRTraiseClassNotRegisteredException@@YAXXZ
?EventSourceRemove@Details@Platform@@YAXPEAPEAXPEAUEventLock@12@VEventRegistrationToken@Foundation@Windows@@@Z
?__abi_make_type_id@@YAPE$AAVType@Platform@@AEBU__abi_type_descriptor@@@Z
?ReleaseTarget@ControlBlock@Details@Platform@@AEAAXXZ
?__abi_WinRTraiseCOMException@@YAXJ@Z
?__abi_WinRTraiseNullReferenceException@@YAXXZ
?__abi_WinRTraiseChangedStateException@@YAXXZ
?__abi_WinRTraiseOutOfBoundsException@@YAXXZ
?__abi_WinRTraiseWrongThreadException@@YAXXZ
??0OutOfBoundsException@Platform@@QE$AAA@XZ
api-ms-win-crt-string-l1-1-0
wcsnlen
wcslen
wcsncmp
memset
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__get_errno
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__itow
_o__itow_s
_o__cexit
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o___stdio_common_vswscanf
_o__wcsicmp
_o__wcsnicmp
_o__wcsnicoll
memcmp
_o__wcsupr_s
_o__wtoi
_o_abort
_o_ceilf
_o_floor
_o_free
_o_isspace
_o_iswspace
_o_malloc
_o_mbstowcs_s
_o_qsort
_o_realloc
_o_terminate
_o_towlower
_o_wcscpy_s
_o_wcstod
_o_wcstok
_o_wcstok_s
_o_wcstol
_o_wcstoul
__CxxFrameHandler3
_CxxThrowException
_o__callnewh
__C_specific_handler
__current_exception
__current_exception_context
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
wcschr
memcpy
memmove
strchr
__std_terminate
wcsstr
__CxxFrameHandler4
policymanager
PolicyManager_GetPolicy
PolicyManager_GetWiFiPolicy_AllowManualWiFiConfiguration
PolicyManager_GetWiFiPolicy_AllowWiFi
PolicyManager_IsPolicySetByMobileDeviceManager
PolicyManager_GetPolicyInt
PolicyManager_FreeGetPolicyData
api-ms-win-core-heap-obsolete-l1-1-0
GlobalFree
LocalFree
LocalAlloc
api-ms-win-core-misc-l1-1-0
FormatMessageW
lstrcmpW
Sleep
api-ms-win-core-threadpool-legacy-l1-1-0
UnregisterWaitEx
QueueUserWorkItem
api-ms-win-core-shlwapi-obsolete-l1-1-0
QISearch
StrStrW
StrCmpIW
StrCmpW
StrTrimW
StrStrIW
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFindFileNameW
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExA
GetModuleFileNameA
LoadLibraryExW
GetProcAddress
GetModuleFileNameW
FreeLibrary
GetModuleHandleExW
GetModuleHandleW
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-1-0
WaitForSingleObjectEx
AcquireSRWLockExclusive
OpenSemaphoreW
ReleaseSRWLockShared
WaitForMultipleObjectsEx
InitializeSRWLock
ReleaseMutex
WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection
CreateEventExW
ReleaseSemaphore
EnterCriticalSection
CreateMutexExW
AcquireSRWLockShared
CreateSemaphoreExW
InitializeCriticalSection
CreateEventW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
ReleaseSRWLockExclusive
ResetEvent
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
SetLastError
RaiseException
UnhandledExceptionFilter
GetLastError
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolWork
SubmitThreadpoolWork
CreateThreadpool
SetThreadpoolThreadMaximum
SetThreadpoolThreadMinimum
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
TrySubmitThreadpoolCallback
CloseThreadpoolCleanupGroupMembers
CreateThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolWait
CloseThreadpoolTimer
CloseThreadpoolCleanupGroup
WaitForThreadpoolTimerCallbacks
CloseThreadpool
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks
CreateThreadpoolCleanupGroup
api-ms-win-core-processthreads-l1-1-0
GetExitCodeProcess
GetThreadId
ProcessIdToSessionId
GetCurrentProcess
TerminateProcess
GetCurrentThread
OpenThreadToken
GetCurrentThreadId
GetCurrentProcessId
OpenProcessToken
TlsSetValue
GetProcessId
TlsAlloc
CreateThread
TlsFree
SetThreadToken
TlsGetValue
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
CompareStringEx
CompareStringOrdinal
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventActivityIdControl
EventUnregister
EventRegister
EventSetInformation
api-ms-win-core-sysinfo-l1-1-0
GetTickCount64
GetSystemTime
GetWindowsDirectoryW
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-eventing-classicprovider-l1-1-0
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
TraceMessage
RegisterTraceGuidsW
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
InitOnceExecuteOnce
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegOpenKeyExW
RegLoadMUIStringW
RegCloseKey
RegGetValueW
RegCreateKeyExW
RegNotifyChangeKeyValue
RegQueryValueExW
RegDisablePredefinedCacheEx
ntdll
RtlNtStatusToDosError
RtlInitString
RtlPublishWnfStateData
RtlSubscribeWnfStateChangeNotification
NtQueryWnfStateData
RtlUnsubscribeWnfStateChangeNotification
RtlSecondsSince1970ToTime
RtlIpv4AddressToStringExW
RtlGetPersistedStateLocation
RtlGetDeviceFamilyInfoEnum
RtlIsStateSeparationEnabled
RtlIsMultiSessionSku
NtAllocateLocallyUniqueId
RtlUnsubscribeWnfNotificationWaitForCompletion
WinSqmSetDWORD
RtlGetCurrentServiceSessionId
RtlQueryWnfStateData
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolQueueTask
SHTaskPoolGetUniqueContext
api-ms-win-security-base-l1-1-0
DuplicateTokenEx
GetTokenInformation
IsWellKnownSid
EqualSid
RevertToSelf
ImpersonateLoggedOnUser
api-ms-win-security-credentials-l1-1-0
CredMarshalCredentialW
CredIsProtectedW
CredUnprotectW
CredFree
api-ms-win-rtcore-ntuser-window-l1-1-0
FindWindowW
GetActiveWindow
SendMessageW
GetWindowThreadProcessId
AllowSetForegroundWindow
EnumWindows
api-ms-win-core-util-l1-1-0
DecodePointer
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
OpenProcess
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InterlockedPushEntrySList
InitializeSListHead
api-ms-win-core-localization-l1-2-0
GetGeoInfoW
GetUserGeoID
GetLocaleInfoEx
GetUserPreferredUILanguages
GetLocaleInfoW
rpcrt4
UuidCreate
I_RpcBindingInqLocalClientPID
UuidCompare
UuidHash
UuidToStringW
RpcStringFreeW
api-ms-win-core-url-l1-1-0
UrlEscapeW
oleaut32
SysStringLen
GetErrorInfo
SetErrorInfo
VariantClear
SysAllocString
SysFreeString
api-ms-win-core-localization-obsolete-l1-2-0
GetNumberFormatW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-oobe-notification-l1-1-0
OOBEComplete
api-ms-win-core-file-l1-1-0
QueryDosDeviceW
FileTimeToLocalFileTime
GetLogicalDriveStringsW
CreateFileW
api-ms-win-core-kernel32-legacy-l1-1-0
RegisterWaitForSingleObject
userenv
RegisterGPNotification
UnregisterGPNotification
api-ms-win-shcore-obsolete-l1-1-0
SHStrDupW
api-ms-win-security-appcontainer-l1-1-0
GetAppContainerNamedObjectPath
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-appmodel-runtime-l1-1-1
FindPackagesByPackageFamily
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-datetime-l1-1-1
GetDateFormatEx
GetTimeFormatEx
api-ms-win-core-timezone-l1-1-0
GetDynamicTimeZoneInformation
TzSpecificLocalTimeToSystemTimeEx
SystemTimeToTzSpecificLocalTimeEx
FileTimeToSystemTime
SystemTimeToFileTime
api-ms-win-service-management-l1-1-0
OpenSCManagerW
OpenServiceW
CloseServiceHandle
api-ms-win-service-management-l2-1-0
QueryServiceConfigW
api-ms-win-shell-namespace-l1-1-0
SHCreateItemFromParsingName
api-ms-win-core-datetime-l1-1-0
GetTimeFormatW
GetDateFormatW
api-ms-win-shcore-stream-winrt-l1-1-0
CreateRandomAccessStreamOnFile
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
eappcfg
EapHostPeerGetMethods
EapHostPeerFreeErrorMemory
EapHostPeerConfigXml2Blob
EapHostPeerFreeMemory
EapHostPeerConfigBlob2Xml
nlaapi
NlaIndicateReprobe
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
GetSetting
GetSettingForUser
Name
.text
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
796KB
Virtual Size
795KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
72KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
108KB
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
44KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=120, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=21, id=260, version=33145,
count=1802, id=1, productName=Unmarked objects,
count=11, id=257, version=33145,
count=44, id=261, version=33145,
count=7, id=259, version=33145,
count=1, id=256, version=33145,
count=95, id=265, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
NetworkProxyCsp.dll
- IMPHASH c5b7d9b4b46cf38641562b06cdb80be2
- SHA256 4c3d80bb8e5476088c746b4d122c5aad19b59a02c7daebacf4541198d9f22333
- MD5 b9f60ea71bcacd3fe15c048f17738439
- SHA1 adc2c989fcf44162bf3fa50d770c2c296390bbb0
- SHA512 ebc1ac0d302ca28e6ce07e1a92a8880efca2e953080df089ac09a3dbb24083d57b316a26c1f8eea4696a0a32f36ebd3051b664ae63571fd33b51dbf239ddaaa5
- SSDEEP 768:UJjPohAhhppylxvwamWcmgCmxrLJLO01Pic9z0E:UpBhhpplatl4rLJLOEPiUz0E
- TLSH T1EB437C8963381095E17AD13CC5A7CE06E879F1112B6156EF8370D1AD1F6B7C0EA38BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
7a:68:80:bd:46:83:cc:f5:e8:1b:b3:3b:07:ba:f1:f8:64:d8:a4:e0:3b:d8:6e:9f:dd:ed:95:d7:9b:2e:e8:12
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 3, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:0842-4BE6-C29A,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:da:8e:d5:c9:5a:00:d1:11:b1:00:01:00:00:01:da
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 12, 2023 - Jan 10, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
4912
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
NetworkProxyCSP.pdb
msvcrt
__C_specific_handler
_initterm
free
_vsnwprintf
_amsg_exit
_wcsicmp
memcpy_s
malloc
wcsstr
_XcptFilter
__CxxFrameHandler4
_callnewh
memset
ntdll
RtlCaptureContext
RtlNtStatusToDosError
RtlGetPersistedStateLocation
RtlLookupFunctionEntry
RtlVirtualUnwind
winhttp
WinHttpSetProxySettingsPerUser
WinHttpOpen
WinHttpReadProxySettings
WinHttpWriteProxySettings
WinHttpGetIEProxyConfigForCurrentUser
WinHttpFreeProxySettings
WinHttpCloseHandle
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetModuleHandleExA
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
oleaut32
VariantInit
SysFreeString
SysAllocStringLen
VariantChangeType
SysAllocString
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoTaskMemAlloc
api-ms-win-core-registry-l1-1-0
RegGetValueW
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-heap-l2-1-0
GlobalFree
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
364B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=24, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33138,
count=15, id=260, version=33138,
count=59, id=1, productName=Unmarked objects,
count=7, id=257, version=33138,
count=3, id=261, version=33138,
count=1, id=256, version=33138,
count=14, id=264, version=33138,
count=1, id=255, version=33138,
count=1, id=258, version=33138,
NetworkQoSPolicyCSP.dll
- IMPHASH ba2782d2c385de3a55f82d5d93d24854
- SHA256 24e273ff6d7de12c6179403a44c432afdf606b08be5303c7aa33d9ded66e07df
- MD5 aa3f5a291500c0e8401eb9aa49e77b61
- SHA1 6f3530bcc68ad773b08c88bde3c39aff11fc984f
- SHA512 d2ddd408f29e2209b5cefeedcfa9b48a07b1a17486b59872ed9cf442e186f6cd8c2ddcd6a452c3c55713cc3f1a3bc621a0c83e2162f4ab132bb8edd7aec6fa09
- SSDEEP 1536:9CLlKWFauhX4dxYx1YOKmv+toAhpjQSDASGlhQJIT+YdVtj:9P8dxy0v+toAhXsS/JIqYBj
- TLSH T105A35C3DA26C10B9D1B6D27C89934A2AE7B1B41D6B2247EF0360826E5F13FE45D3DB11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5344
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
NetworkQoSPolicyCSP.pdb
msvcp_win
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o___stdio_common_vswprintf
_o__wcsicmp
_o_ceilf
_o_free
_o_malloc
_o_memcpy_s
_o_wcstol
__C_specific_handler
_CxxThrowException
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
memcpy
api-ms-win-crt-string-l1-1-0
wcscmp
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExA
GetModuleFileNameA
GetProcAddress
FreeLibrary
LoadLibraryExW
DisableThreadLibraryCalls
GetModuleHandleExW
GetModuleHandleW
api-ms-win-core-synch-l1-1-0
WaitForSingleObjectEx
CreateSemaphoreExW
OpenSemaphoreW
ReleaseSemaphore
WaitForSingleObject
CreateMutexExW
ReleaseMutex
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableLevel
UnregisterTraceGuids
GetTraceEnableFlags
GetTraceLoggerHandle
TraceMessage
api-ms-win-eventing-obsolete-l1-1-0
RegisterTraceGuidsA
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
oleaut32
SysAllocString
SysFreeString
VariantInit
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
452B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=42, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=24, id=261, version=33145,
count=1126, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=1, id=256, version=33145,
count=17, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
NetworkUXBroker.dll
- IMPHASH 4ff415256a0e475aa49476773f0196d1
- SHA256 9d29773850f4267eb74daeb512978a7b72225e2379017938df3f92bc870328c0
- MD5 bdb5abc971682001be69a2d4d290b2eb
- SHA1 ce398e615fac7452b3f9155bbde2fa61b3786219
- SHA512 54e9ff1e9e6575f36853e3661c11488fd51f4c4340ed2bbc6924322b3c6ff5c9ad31d9363fe48bb82d0a4401393ba56e9b81c462f6f854e24984a0e49eb8a86d
- SSDEEP 6144:ntVay88nd/2en6rQSo+8xoSXMXs4hmJCjKYltyc9nSzeTev7pXilfliuGc3zz0VI:7ay88nd/1n6rQ48isSm8ltLl9S3V0
- TLSH T110C4292DBA9802A6D17DE13980A74915E371BC1197A2D7CF01D0727E4E3BBE15F3AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
9680
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
NetworkUXBroker.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_abort
_o_ceilf
_o_free
_o_iswspace
_o_malloc
_o_mbstowcs_s
_o_realloc
_o_strtok
_o_terminate
_o_wcscpy_s
_o_wcstok_s
_o_wcstombs_s
_o_wcstoull
_o_wmemcpy_s
__C_specific_handler
__current_exception
__current_exception_context
__CxxFrameHandler3
__std_terminate
_CxxThrowException
__CxxFrameHandler4
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o__crt_atexit
_o__configure_narrow_argv
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o__cexit
_o___std_exception_copy
_o__callnewh
wcschr
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
strncmp
memset
wcscmp
wcsnlen
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExA
DisableThreadLibraryCalls
GetModuleHandleW
GetModuleFileNameA
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleExW
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetProcessId
SetThreadToken
GetCurrentThread
GetCurrentThreadId
OpenThreadToken
OpenProcessToken
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringOrdinal
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-synch-l1-1-0
InitializeSRWLock
WaitForSingleObject
AcquireSRWLockExclusive
InitializeCriticalSectionAndSpinCount
CreateEventW
SetEvent
AcquireSRWLockShared
ReleaseSemaphore
CreateSemaphoreExW
ResetEvent
InitializeCriticalSection
CreateEventExW
ReleaseSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
LeaveCriticalSection
ReleaseMutex
CreateMutexExW
InitializeCriticalSectionEx
DeleteCriticalSection
EnterCriticalSection
ReleaseSRWLockShared
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-errorhandling-l1-1-0
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
InitOnceExecuteOnce
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedPushEntrySList
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventWriteTransfer
EventActivityIdControl
EventSetInformation
EventRegister
api-ms-win-core-registry-l1-1-0
RegEnumKeyExW
RegGetValueW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-security-base-l1-1-0
DuplicateTokenEx
GetTokenInformation
msvcp_win
?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
ntdll
RtlAllocateHeap
RtlInitUnicodeString
NtQueryInformationToken
RtlFreeHeap
NtOpenFile
RtlNtStatusToDosErrorNoTeb
RtlIpv6StringToAddressExW
RtlCompareUnicodeString
RtlIpv4StringToAddressExW
RtlIpv4AddressToStringExW
RtlIpv6AddressToStringExW
oleaut32
SysFreeString
VariantInit
VariantClear
SysStringLen
GetErrorInfo
SetErrorInfo
SysAllocString
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
Name
.text
Size
284KB
Virtual Size
283KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
216KB
Virtual Size
214KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=67, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33145,
count=5, id=259, version=33145,
count=1304, id=1, productName=Unmarked objects,
count=2, id=257, version=33145,
count=30, id=261, version=33145,
count=1, id=256, version=33145,
count=26, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
NfcRadioMedia.dll
- IMPHASH f27a29acbf4141d57581962da8a45cc9
- SHA256 b67698891ec200559f5c7849b419477441e302f15d29acdbd545f6ddd07bf14c
- MD5 59e2ec8fbe78f078de140b9f963ca3fe
- SHA1 a3ed1934f4eb64427418c3d7b94b75bf8203056f
- SHA512 594315cc93bb6cad9c33d0fea65903ad5eb4f7c0beb6666282d8151208c01a3c3fefa7838de522f0e00188a6a41a8552c1e82640308da7efc15758c77b8837fd
- SSDEEP 1536:fVJkN5gJPhyi9gr/adxGzQn88KNVtm6QrYb7:fVI5WhejadxGFNm6AQ7
- TLSH T10B832C5D63E82495F6B6D17C84A34B06E270B4245712A3EF07A0827D9F2BFE4DA38F51
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5248
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
NfcRadioMedia.pdb
msvcrt
memcpy
__CxxFrameHandler4
__dllonexit
realloc
_purecall
_callnewh
wcscat_s
_resetstkoflw
free
calloc
malloc
_errno
??1type_info@@UEAA@XZ
_XcptFilter
_onexit
_initterm
?terminate@@YAXXZ
_lock
wcscpy_s
_unlock
_CxxThrowException
__C_specific_handler
_amsg_exit
memset
ntdll
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwTraceMessage
api-ms-win-core-synch-l1-1-0
InitializeCriticalSection
WaitForSingleObject
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CreateEventW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetEvent
api-ms-win-core-io-l1-1-0
GetOverlappedResult
DeviceIoControl
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
api-ms-win-core-io-l1-1-1
CancelIo
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-localization-l1-2-0
SetThreadLocale
GetThreadLocale
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
LoadStringW
GetModuleFileNameW
LoadLibraryExW
GetModuleHandleW
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegQueryInfoKeyW
RegOpenKeyExW
api-ms-win-core-synch-l1-2-0
SleepConditionVariableSRW
WakeAllConditionVariable
Sleep
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolWork
CloseThreadpoolCleanupGroup
CreateThreadpoolCleanupGroup
SetThreadpoolThreadMaximum
CloseThreadpool
SubmitThreadpoolWork
CreateThreadpool
WaitForThreadpoolWorkCallbacks
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolWork
api-ms-win-core-file-l1-1-0
CreateFileW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
36KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
388B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=48, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33140,
count=19, id=260, version=33140,
count=116, id=1, productName=Unmarked objects,
count=5, id=257, version=33140,
count=11, id=261, version=33140,
count=1, id=256, version=33140,
count=11, id=264, version=33140,
count=1, id=255, version=33140,
count=1, id=258, version=33140,
NgcCtnr.dll
- IMPHASH ce0fce3937b6effceb8b7e981f752cff
- SHA256 0e853216865d4bdaaa8bf59b9ff2e3c2f69548caaf4fd021a1cdb1765261b90d
- MD5 31b21127d4b435c993ba125c2c6fcb97
- SHA1 1bf1807dc87282293d59819b001794330c94b941
- SHA512 50efcd620855169a4452172f6803f390ae4491227d810f50dfd51afd3fd3281fe942493f351e5caffc262ccbae763bc4817e8a46752de8b0b6033885118a0e7b
- SSDEEP 6144:b1zjolwn+qMpnajqX/weOMIxVuTvIhw1mKQTkAvgCqJtLeFRQ36ujlDmTT+0K6Kw:4wn+PpajqweFuVuTvIy1/RSRQS06cKtX
- TLSH T180D44D3D22E817A8E1F6C2BCC9934516FAB23815173599DF025181AC5E3BFE4D73AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
f8:37:cc:c0:38:9f:0d:9e:84:3e:b9:b0:b4:56:fe:22:7c:0e:27:ef:89:ad:92:d5:b0:d5:de:42:da:07:ea:fa
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 24, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:591A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:14:8d:cd:23:44:ee:06:df:72:00:01:00:00:02:14
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
177520
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
NgcCtnr.pdb
msvcp_win
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?in@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
?_Incref@facet@locale@std@@UEAAXXZ
?do_always_noconv@?$codecvt@GDU_Mbstatet@@@std@@MEBA_NXZ
?do_max_length@?$codecvt@GDU_Mbstatet@@@std@@MEBAHXZ
?do_encoding@?$codecvt@GDU_Mbstatet@@@std@@MEBAHXZ
?do_in@?$codecvt@GDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
?do_out@?$codecvt@GDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
?do_unshift@?$codecvt@GDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?do_length@?$codecvt@GDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBD1_K@Z
??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z
??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_lock
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_unlock
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-time-l1-1-0
clock
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__errno
_o__wcserror
_o__wcsicmp
_o__wcsnicmp
memmove
_o_ceilf
_o_free
_o_iswascii
_o_iswcntrl
_o_iswdigit
_o_iswlower
_o_iswpunct
_o_iswspace
_o_iswupper
_o_malloc
_o_memcpy_s
_o_terminate
_o_wcsncpy_s
__C_specific_handler
__current_exception
__current_exception_context
__CxxFrameHandler3
_CxxThrowException
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__execute_onexit_table
__std_terminate
__CxxFrameHandler4
memcmp
wcsstr
memcpy
api-ms-win-crt-string-l1-1-0
wcsnlen
memset
wcscmp
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleHandleExA
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleExW
LoadStringW
FreeLibrary
GetModuleFileNameA
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
CreateEventExW
EnterCriticalSection
DeleteCriticalSection
AcquireSRWLockShared
InitializeCriticalSection
ReleaseSemaphore
CreateEventW
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
CreateSemaphoreExW
InitializeCriticalSectionEx
WaitForSingleObject
ReleaseMutex
InitializeSRWLock
ReleaseSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
api-ms-win-core-heap-l1-1-0
HeapDestroy
HeapCreate
GetProcessHeap
HeapFree
HeapSetInformation
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter
SetLastError
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
CreateThreadpoolCleanupGroup
TrySubmitThreadpoolCallback
CloseThreadpoolCleanupGroupMembers
WaitForThreadpoolTimerCallbacks
CloseThreadpoolCleanupGroup
SetThreadpoolTimer
CreateThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
OpenThreadToken
GetCurrentThread
SetThreadToken
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
CompareStringEx
WideCharToMultiByte
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoTaskMemFree
StringFromGUID2
CoGetMalloc
CoCreateFreeThreadedMarshaler
CoCreateGuid
api-ms-win-security-sddl-l1-1-0
ConvertStringSidToSidW
ConvertSidToStringSidW
api-ms-win-security-base-l1-1-0
EqualSid
GetTokenInformation
GetLengthSid
IsValidSid
CopySid
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemInfo
GetTickCount
ntdll
NtFlushBuffersFileEx
RtlPublishWnfStateData
RtlGetPersistedStateLocation
NtQueryKey
RtlIsMultiSessionSku
RtlNtStatusToDosError
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-libraryloader-l2-1-0
QueryOptionalDelayLoadedAPI
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventUnregister
EventActivityIdControl
EventRegister
EventSetInformation
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsCreateStringReference
WindowsGetStringRawBuffer
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceExecuteOnce
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-registry-l1-1-0
RegFlushKey
RegSetValueExW
RegUnLoadKeyW
RegQueryInfoKeyW
RegEnumKeyExW
RegGetValueW
RegOpenKeyExW
RegCloseKey
RegOpenCurrentUser
RegLoadKeyW
api-ms-win-core-file-l1-1-0
FindClose
ReadFile
FindNextFileW
RemoveDirectoryW
GetFileAttributesExW
WriteFile
GetFileSizeEx
FindFirstFileExW
CompareFileTime
CreateFileW
CreateDirectoryW
DeleteFileW
bcrypt
BCryptGenRandom
BCryptGetProperty
BCryptCloseAlgorithmProvider
BCryptHash
BCryptDeriveKeyPBKDF2
BCryptGenerateSymmetricKey
BCryptDestroyKey
BCryptOpenAlgorithmProvider
BCryptDecrypt
BCryptEncrypt
crypt32
CryptEncodeObjectEx
CryptUnprotectData
CryptUnprotectMemory
CryptProtectMemory
CertFreeCertificateContext
CertDuplicateCertificateContext
CryptBinaryToStringW
CryptDecodeObjectEx
CryptExportPublicKeyInfoEx
CryptProtectData
CertFindExtension
CertGetCertificateContextProperty
CertOpenStore
CertFindCertificateInStore
CertCloseStore
api-ms-win-core-heap-obsolete-l1-1-0
LocalSize
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
rpcrt4
UuidIsNil
RpcStringFreeW
NdrDllCanUnloadNow
NdrDllGetClassObject
UuidFromStringW
UuidToStringW
api-ms-win-core-file-l2-1-0
MoveFileExW
samcli
NetLocalGroupGetMembers
netutils
NetApiBufferFree
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
api-ms-win-core-memory-l1-1-1
GetProcessWorkingSetSizeEx
VirtualLock
VirtualUnlock
SetProcessWorkingSetSizeEx
api-ms-win-core-memory-l1-1-0
VirtualFree
VirtualAlloc
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
404KB
Virtual Size
401KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
144KB
Virtual Size
140KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
24KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
384B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=122, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=11, id=260, version=33145,
count=5, id=259, version=33145,
count=1501, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=31, id=261, version=33145,
count=1, id=256, version=33145,
count=112, id=264, version=33145,
count=2, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
NgcCtnrGidsHandler.dll
- IMPHASH b60c9957ec0c2fb99d04dc331096a2d7
- SHA256 df1f7a31c1dd38639b8462592c0ab108d0bca6251a08d97354cb77c451dd295f
- MD5 76121d30136ff678a0d22830fe9c3dec
- SHA1 4455925559ed919c24fdd104ea92fab5ecafed98
- SHA512 d68faf5d7d4f595145e7164f575b8b1c8b944bab4fbb2cdeacc330a59654cc287f554c32bcb1cdeb00f7c98884cdc42708eeef057be2420f01471ae55375d576
- SSDEEP 12288:I8l7kq7ACiCVu/bi11G1jEQuhbFzBvbH/tOgICV+d:NpT7xiCVu/bJ1jEZhb3wWV+d
- TLSH T1E5945B2DE2E803F2D0BAC0BDCAD7450BE2F1385843725ACF169615991E1BFF4963A751
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
12592
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
NgcCtnrGidsHandler.pdb
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
_Thrd_detach
?_Xout_of_range@std@@YAXPEBD@Z
_Cnd_do_broadcast_at_thread_exit
?_Xbad_function_call@std@@YAXXZ
_Thrd_id
_Thrd_join
?_Throw_Cpp_error@std@@YAXH@Z
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__itoa_s
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o___std_type_info_destroy_list
_o__strtoui64
_o___stdio_common_vswprintf
memmove
_o_free
_o_malloc
_o_terminate
_o___std_exception_destroy
_CxxThrowException
_o___std_exception_copy
_o__cexit
_o___stdio_common_vsprintf_s
_o__callnewh
_o__beginthreadex
_o__crt_atexit
_o__configure_narrow_argv
__C_specific_handler
__std_terminate
__CxxFrameHandler4
memcpy
memchr
memcmp
api-ms-win-crt-string-l1-1-0
memset
wcsnlen
wcscmp
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleW
GetModuleFileNameA
api-ms-win-core-synch-l1-1-0
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
AcquireSRWLockShared
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CreateEventW
InitializeSRWLock
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetLastError
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
GetCPInfoExW
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
rpcrt4
RpcRaiseException
NdrServerCallAll
UuidToStringW
NdrServerCall2
NdrClientCall3
RpcImpersonateClient
RpcBindingFree
RpcExceptionFilter
RpcBindingBind
RpcBindingCreateW
RpcRevertToSelfEx
api-ms-win-eventing-provider-l1-1-0
EventActivityIdControl
EventUnregister
EventWriteTransfer
EventSetInformation
EventRegister
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoGetMalloc
CoInitializeEx
CoUninitialize
CoTaskMemAlloc
api-ms-win-security-base-l1-1-0
CheckTokenMembership
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-file-l1-1-0
WriteFile
FindNextFileW
ReadFile
FindClose
GetFileSizeEx
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
api-ms-win-core-string-obsolete-l1-1-0
lstrlenA
ntdll
WinSqmIsOptedIn
RtlUnicodeStringToAnsiString
RtlNtStatusToDosError
RtlInitUnicodeString
RtlFreeAnsiString
WinSqmIncrementDWORD
EtwTraceMessage
kernel32
CreateFileTransactedW
RemoveDirectoryTransactedW
DeleteFileTransactedW
CreateDirectoryTransactedW
SetFileAttributesTransactedW
FindFirstFileTransactedW
ktmw32
CommitTransaction
CreateTransaction
InitializeHandler
Name
.text
Size
296KB
Virtual Size
295KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
84KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=60, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=19, id=260, version=33145,
count=5, id=259, version=33145,
count=1228, id=1, productName=Unmarked objects,
count=15, id=257, version=33145,
count=26, id=261, version=33145,
count=1, id=256, version=33145,
count=49, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
NgcCtnrSvc.dll
- IMPHASH 8a691ff519c74761e855478577f71a57
- SHA256 ab6e7f0946a9a215b8d24d4fd6b763333a08e5f0300b37832df2bd93116f7173
- MD5 5522b3defe886edc744b18dd02d71273
- SHA1 15278a48b956b322f83ecf0c492b903a7669b55c
- SHA512 f52cdd15047f6070e7f4985bf2244f303185f2e187142423cad108c0beda7d2b2474dca12af519bec8f06a6aa946c35dc701677d5deede703218ca97edcfd204
- SSDEEP 24576:ZGQZ3HPH0pkVN8qC3Qz+xnS5YFVBFEvXSM2Tsx:ZGk8NwAnS5YXLEaZTsx
- TLSH T14C055D2D33EC02A9E0B6D1BDCA934656EBF17855177296CF0150426D4E3BFE48E3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c5:f2:fd:e2:30:66:59:e2:49:37:60:d1:f1:f9:67:7c:4c:d6:4c:c8:47:fa:47:ee:47:d8:61:22:40:4e:bc:d6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 24, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:7F00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1e:a3:ac:a4:6e:39:6f:7c:49:00:01:00:00:02:1e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
148736
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
NgcCtnrSvc.pdb
msvcp_win
?_Syserror_map@std@@YAPEBDH@Z
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?in@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
_Query_perf_counter
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
_Mtx_destroy_in_situ
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
_Cnd_broadcast
_Cnd_register_at_thread_exit
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
_Cnd_unregister_at_thread_exit
_Cnd_destroy_in_situ
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
_Cnd_wait
?__ExceptionPtrCurrentException@@YAXPEAX@Z
_Cnd_timedwait
_Mtx_current_owns
_Cnd_init_in_situ
??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ
??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z
?do_length@?$codecvt@GDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBD1_K@Z
?do_unshift@?$codecvt@GDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?do_out@?$codecvt@GDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
?do_in@?$codecvt@GDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
?do_encoding@?$codecvt@GDU_Mbstatet@@@std@@MEBAHXZ
?do_max_length@?$codecvt@GDU_Mbstatet@@@std@@MEBAHXZ
?do_always_noconv@?$codecvt@GDU_Mbstatet@@@std@@MEBA_NXZ
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
_Thrd_detach
_Mtx_unlock
_Mtx_lock
?_Throw_Cpp_error@std@@YAXH@Z
_Query_perf_frequency
_Thrd_sleep
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
_Mtx_init_in_situ
_Cnd_do_broadcast_at_thread_exit
_Xtime_get_ticks
?_Xout_of_range@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__wcreate_locale
_o__wcsicmp
_o__wcsicmp_l
_o_abort
_o_ceilf
memmove
_o_free
_o_iswspace
_o_ldexp
_o_malloc
_o_terminate
_o_wcscpy_s
__C_specific_handler
__current_exception
__current_exception_context
__CxxFrameHandler3
_CxxThrowException
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__free_locale
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
memcmp
memcpy
_o__callnewh
_o__beginthreadex
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
memchr
api-ms-win-crt-string-l1-1-0
wcsnlen
wcscmp
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
LoadLibraryExW
DisableThreadLibraryCalls
GetModuleHandleW
FreeLibrary
GetProcAddress
LoadStringW
GetModuleHandleExA
GetModuleFileNameA
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
AcquireSRWLockShared
ReleaseMutex
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
InitializeSRWLock
ReleaseSemaphore
CreateMutexExW
ReleaseSRWLockShared
EnterCriticalSection
WaitForSingleObject
CreateSemaphoreExW
ResetEvent
InitializeCriticalSectionAndSpinCount
SleepEx
SetEvent
CreateEventExW
CreateEventW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
GetLastError
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CreateThreadpoolCleanupGroup
CloseThreadpoolTimer
TrySubmitThreadpoolCallback
CloseThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
GetCurrentThread
OpenThreadToken
GetCurrentThreadId
OpenProcessToken
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
SetPriorityClass
GetPriorityClass
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-eventing-provider-l1-1-0
EventActivityIdControl
EventSetInformation
EventUnregister
EventRegister
EventWriteTransfer
api-ms-win-core-file-l1-1-0
CreateDirectoryW
FindClose
CreateFileW
CompareFileTime
GetFileAttributesExW
DeleteFileW
FindNextFileW
FindFirstFileExW
api-ms-win-core-com-l1-1-0
CoIncrementMTAUsage
CoTaskMemFree
CoCreateFreeThreadedMarshaler
CoDisconnectContext
CoRevokeClassObject
CoTaskMemAlloc
CoCreateInstance
CoDecrementMTAUsage
IIDFromString
CoUninitialize
CoInitializeEx
StringFromGUID2
CoGetMalloc
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
ConvertStringSidToSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-sysinfo-l1-1-0
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegCreateKeyExW
RegDeleteValueW
RegEnumKeyExW
RegFlushKey
RegQueryInfoKeyW
RegDeleteTreeW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsCreateStringReference
WindowsGetStringRawBuffer
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
InitOnceComplete
InitOnceBeginInitialize
Sleep
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
api-ms-win-core-winrt-l1-1-0
RoRevokeActivationFactories
RoGetActivationFactory
api-ms-win-service-core-l1-1-0
SetServiceStatus
RegisterServiceCtrlHandlerExW
api-ms-win-eventing-controller-l1-1-0
ControlTraceW
StartTraceW
EnableTraceEx2
api-ms-win-core-path-l1-1-0
PathCchCombine
api-ms-win-service-management-l1-1-0
OpenSCManagerW
OpenServiceW
CloseServiceHandle
api-ms-win-service-winsvc-l1-1-0
OpenSCManagerA
ControlService
QueryServiceStatus
StartServiceA
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedFlushSList
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-libraryloader-l2-1-0
QueryOptionalDelayLoadedAPI
rpcrt4
RpcRevertToSelf
I_RpcExceptionFilter
UuidToStringW
RpcRevertToSelfEx
NdrClientCall3
RpcServerInterfaceGroupCreateW
RpcExceptionFilter
RpcStringBindingComposeW
RpcStringFreeW
RpcBindingFromStringBindingW
RpcEpResolveBinding
RpcBindingSetAuthInfoExW
RpcBindingFree
NdrServerCall2
NdrServerCallAll
RpcRaiseException
RpcServerInterfaceGroupDeactivate
RpcServerInterfaceGroupActivate
RpcImpersonateClient
RpcServerInterfaceGroupClose
RpcBindingCreateW
RpcBindingBind
api-ms-win-security-base-l1-1-0
EqualSid
GetLengthSid
IsWellKnownSid
IsValidSid
DuplicateTokenEx
GetTokenInformation
CopySid
api-ms-win-core-sysinfo-l1-2-0
GetSystemFirmwareTable
api-ms-win-power-setting-l1-1-0
PowerSettingUnregisterNotification
PowerSettingRegisterNotification
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
K32EnumProcesses
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
profapi
ord104
devobj
DevObjOpenDevRegKey
DevObjGetClassDevs
DevObjDestroyDeviceInfoList
DevObjCreateDeviceInfoList
DevObjEnumDeviceInfo
DevObjEnumDeviceInterfaces
api-ms-win-security-lsalookup-l1-1-2
LsaLookupUserAccountType
api-ms-win-core-kernel32-legacy-l1-1-0
UnregisterWait
api-ms-win-core-heap-obsolete-l1-1-0
LocalSize
ntdll
RtlDosPathNameToNtPathName_U_WithStatus
NtQueryInformationProcess
NtTerminateProcess
NtCreateUserProcess
RtlFreeUnicodeString
RtlInitUnicodeString
NtQuerySystemInformation
RtlNtStatusToDosError
RtlIsMultiSessionSku
RtlPublishWnfStateData
RtlUnsubscribeWnfStateChangeNotification
RtlDestroyProcessParameters
NtQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
LdrAddRefDll
LdrUnloadDll
RtlWnfDllUnloadCallback
RtlUnsubscribeWnfNotificationWithCompletionCallback
NtClose
ZwQueryValueKey
ZwOpenKey
RtlCreateProcessParametersEx
api-ms-win-security-accesshlpr-l1-1-0
QueryTransientObjectSecurityDescriptor
FreeTransientObjectSecurityDescriptor
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
DllCanUnloadNow
DllGetActivationFactory
ServiceMain
SvchostPushServiceGlobals
Name
.text
Size
504KB
Virtual Size
500KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
240KB
Virtual Size
236KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
32KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
592B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=144, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=21, id=260, version=33145,
count=5, id=259, version=33145,
count=1694, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=35, id=261, version=33145,
count=1, id=256, version=33145,
count=230, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
NgcIsoCtnr.dll
- IMPHASH 3a485594cdc9fc1ca6c438cb7a1ebd9c
- SHA256 9c5376cfc39b8b59139acbdab1c735aa7ed4f37e1fbabc19575da74281ce1031
- MD5 25312850557b530dc6023d47490f62e2
- SHA1 5175ebf104a17df1db14019f7e3243a5d364317d
- SHA512 107f921ea1b33f7ac7190ddffac3f405b28ba27deb91c3e524b151dedb7d7acfef1b2ae4dbcfea674a85b8fb8f95a5b9c863b4a80dca28244f60b51f3bbcfacb
- SSDEEP 12288:3CkwlVUUbpNkEF6/Ld8iL7BCb8pynG5HI+4ix:3CVjF6/Ld8iL7QbEynG5t4O
- TLSH T1DB054B3C66EC01B9E0BBC27DDA938917FA72384147359ADF0190425C5EAFFE0593AB52
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
6f:a7:87:d9:d8:07:81:f6:0f:e5:1f:c0:23:7a:d9:eb:e1:59:bd:c6:9d:7e:44:11:1a:91:48:47:a9:8f:3a:00
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 24, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8603-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:25:80:c7:37:c6:cd:aa:77:49:00:01:00:00:02:25
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
29056
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
NgcIsoCtnr.pdb
msvcp_win
_Mtx_destroy_in_situ
_Cnd_destroy_in_situ
_Cnd_unregister_at_thread_exit
_Cnd_wait
?_Syserror_map@std@@YAPEBDH@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ
??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z
?do_length@?$codecvt@GDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBD1_K@Z
?do_unshift@?$codecvt@GDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?do_out@?$codecvt@GDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
?do_in@?$codecvt@GDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
?do_encoding@?$codecvt@GDU_Mbstatet@@@std@@MEBAHXZ
?do_max_length@?$codecvt@GDU_Mbstatet@@@std@@MEBAHXZ
?do_always_noconv@?$codecvt@GDU_Mbstatet@@@std@@MEBA_NXZ
?_Incref@facet@locale@std@@UEAAXXZ
?in@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
??Bid@locale@std@@QEAA_KXZ
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
?__ExceptionPtrDestroy@@YAXPEAX@Z
_Thrd_detach
?__ExceptionPtrToBool@@YA_NPEBX@Z
_Query_perf_frequency
_Query_perf_counter
_Thrd_id
_Mtx_unlock
_Mtx_lock
_Thrd_join
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_broadcast
?_Xbad_function_call@std@@YAXXZ
_Cnd_register_at_thread_exit
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?_Xout_of_range@std@@YAXPEBD@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
_Mtx_init_in_situ
_Xtime_get_ticks
_Mtx_current_owns
_Cnd_timedwait
_Cnd_do_broadcast_at_thread_exit
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
_Cnd_init_in_situ
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-time-l1-1-0
clock
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__wcserror
_o__wcsicmp
_o__wcsnicmp
memmove
_o_ceilf
_o_free
_o_iswascii
_o_iswcntrl
_o_iswdigit
_o_iswlower
_o_iswpunct
_o_iswspace
_o_iswupper
_o_ldexp
_o_localeconv
_o_malloc
_o_memcpy_s
_o_strtod
_o_strtoll
_o_strtoull
_o_terminate
_o_wcsncpy_s
__CxxFrameHandler3
__C_specific_handler
__current_exception
__current_exception_context
_o__dsign
_CxxThrowException
wcsstr
_o__dclass
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o__beginthreadex
_o__execute_onexit_table
_o__errno
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
__RTDynamicCast
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
wcsnlen
wcscmp
memset
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleExA
GetModuleHandleW
GetProcAddress
GetModuleHandleExW
api-ms-win-core-synch-l1-1-0
ReleaseSemaphore
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
EnterCriticalSection
CreateEventW
ResetEvent
InitializeCriticalSectionAndSpinCount
SetEvent
LeaveCriticalSection
InitializeCriticalSectionEx
WaitForSingleObject
WaitForSingleObjectEx
CreateEventExW
OpenSemaphoreW
ReleaseSRWLockShared
CreateSemaphoreExW
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
ReleaseMutex
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
HeapSize
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
RaiseException
GetLastError
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
TrySubmitThreadpoolCallback
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolCleanupGroup
WaitForThreadpoolTimerCallbacks
CreateThreadpoolCleanupGroup
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringEx
MultiByteToWideChar
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventWriteTransfer
EventRegister
EventActivityIdControl
EventUnregister
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
api-ms-win-core-com-l1-1-0
StringFromGUID2
CoCreateInstance
CoUninitialize
CoInitializeEx
CoTaskMemFree
CoTaskMemAlloc
CoCreateGuid
api-ms-win-core-file-l1-1-0
FindNextFileW
CompareFileTime
CreateDirectoryW
FindClose
RemoveDirectoryW
FindFirstFileExW
WriteFile
ReadFile
GetFileSizeEx
CreateFileW
GetFileAttributesExW
DeleteFileW
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-security-sddl-l1-1-0
ConvertStringSidToSidW
ConvertSidToStringSidW
api-ms-win-security-base-l1-1-0
IsValidSid
GetTokenInformation
FreeSid
CopySid
GetLengthSid
api-ms-win-core-heap-obsolete-l1-1-0
LocalSize
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
rpcrt4
RpcStringFreeW
RpcStringBindingComposeW
RpcExceptionFilter
NdrClientCall3
NdrServerCallAll
NdrServerCall2
RpcBindingFromStringBindingW
RpcEpResolveBinding
UuidToStringW
RpcBindingSetAuthInfoExW
UuidIsNil
RpcBindingFree
RpcRaiseException
UuidFromStringW
api-ms-win-core-registry-l1-1-0
RegQueryInfoKeyW
RegUnLoadKeyW
RegSetValueExW
RegGetValueW
RegCreateKeyExW
RegEnumKeyExW
RegOpenCurrentUser
RegOpenKeyExW
RegCloseKey
RegLoadKeyW
api-ms-win-core-file-l2-1-0
MoveFileExW
api-ms-win-core-sysinfo-l1-2-0
GetSystemFirmwareTable
ntdll
NtQuerySystemInformation
NtFlushBuffersFileEx
RtlIsMultiSessionSku
RtlPublishWnfStateData
NtQueryKey
RtlGetPersistedStateLocation
api-ms-win-security-lsalookup-l1-1-2
LsaLookupUserAccountType
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
devobj
DevObjCreateDeviceInfoList
DevObjGetClassDevs
DevObjEnumDeviceInterfaces
DevObjEnumDeviceInfo
DevObjOpenDevRegKey
DevObjDestroyDeviceInfoList
tpmcoreprovisioning
TpmGetRandomAuthValue
TpmIsLockedOut
TpmIsFIPS
TpmChangeOwnerAuth
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
DllCanUnloadNow
DllGetClassObject
NgcIsoCtnrInitialize
NgcIsoCtnrInitializePregenPool
NgcIsoCtnrTriggerPregen
NgcIsoCtnrUninitializePregenPool
Name
.text
Size
532KB
Virtual Size
531KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
228KB
Virtual Size
224KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
32KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
496B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=122, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33145,
count=5, id=259, version=33145,
count=1518, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=32, id=261, version=33145,
count=1, id=256, version=33145,
count=118, id=264, version=33145,
count=2, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
NgcProCsp.dll
- IMPHASH 4bb444cc6551582faa302eb2acc44e32
- SHA256 00b336a24ef66d0407b2e14b0bfe64d92eb8491d03f655152fa65578cef5d1ad
- MD5 2486c6605ea6688a147c1cde70eb2811
- SHA1 9cb1d8e20dcd49c00e22833caa81c04a7f87f3cb
- SHA512 7779cb2c4a554adedddf190f48521c40bcbceac82d20d0091690008cbaff9f96c79f0fcc5fe6dc0ac3f0c83a4e0a88bf0592d3513d577fb20e5b7725f4da6cc3
- SSDEEP 3072:I5LDJXwN6P/PUAiR1e/+lKwRaMut+P3fNs5xCx8jEuUfWAaEUqjVN:0DqNa0AifO+6O3fMIrUqjV
- TLSH T1EC24F71A27E80069F5F79679CDB38515EA72B8212B30D6CF0290817D5E37FD4A939F22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
6352
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
NgcProCsp.pdb
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__callnewh
memmove
_o__wcserror
_o__wcsicmp
_o__wcsnicmp
_o_ceilf
_o_free
_o_malloc
_o_memcpy_s
_o_wcsncpy_s
__C_specific_handler
_CxxThrowException
__CxxFrameHandler3
_o__crt_atexit
_o__configure_narrow_argv
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
wcsstr
__std_terminate
__CxxFrameHandler4
_o__cexit
__RTDynamicCast
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
wcsnlen
memset
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlIsMultiSessionSku
NtQueryKey
RtlVirtualUnwind
RtlPublishWnfStateData
RtlGetPersistedStateLocation
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetProcAddress
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleExA
GetModuleHandleExW
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
ReleaseSemaphore
LeaveCriticalSection
InitializeCriticalSectionEx
WaitForSingleObject
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseMutex
CreateSemaphoreExW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetLastError
GetLastError
RaiseException
SetUnhandledExceptionFilter
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringEx
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventUnregister
EventWriteTransfer
EventRegister
oleaut32
VariantClear
VariantInit
SysAllocString
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoTaskMemFree
rpcrt4
RpcStringFreeW
UuidFromStringW
UuidIsNil
UuidToStringW
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
api-ms-win-core-util-l1-1-0
DecodePointer
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegEnumValueW
RegGetValueW
RegSetValueExW
RegDeleteValueW
RegDeleteTreeW
RegLoadKeyW
RegCloseKey
RegOpenCurrentUser
RegCreateKeyExW
RegUnLoadKeyW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-heap-obsolete-l1-1-0
LocalFree
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
crypt32
CertFindCertificateInStore
CryptDecodeObjectEx
CryptBinaryToStringW
CertDuplicateCertificateContext
CertFreeCertificateContext
CertOpenStore
CertGetCertificateContextProperty
CertFindExtension
CertCloseStore
api-ms-win-core-file-l1-1-0
CompareFileTime
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
120KB
Virtual Size
117KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
56KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
816B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=68, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=1198, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=26, id=261, version=33145,
count=1, id=256, version=33145,
count=26, id=264, version=33145,
count=2, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
NlsData0000.dll
- IMPHASH bb8b540b52f58147f4432983fa00e2a1
- SHA256 e7cf3850a3afe5f437c27149904423596bb53008a8f9feb90106928a23c10f4f
- MD5 c95467289e43f6ee6eb9484462875cf2
- SHA1 3ba969023d1e281675191e2ef4c7fd52e978dc31
- SHA512 c968d59386896252a7ea917cae24e53f31f1f7435b431da79fded4f60eae3fdf80ee6b55aa1a326d1e9a6f869fc1c4f5012eb8729007ea87061d33707764d31a
- SSDEEP 12288:t1QKUjoyaTnGHjSnNLWEI+fI9tsGbSThLRdh6OBf/m3EEY+SdZLHF4:t1EjoyOGDSnNLU+fI7sGbEh1BlOy74
- TLSH T1DB7591E0F4724B36E3EB8D3181657A2B87D78C1EEB1190D6C4BB834C359A78719A4CD6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5776
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
NlsData0000.pdb
msvcrt
malloc
free
_isatty
__C_specific_handler
wcsncat_s
realloc
_initterm
_CxxThrowException
memcpy
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBV0@@Z
_lock
??0exception@@QEAA@AEBQEBDH@Z
_unlock
__dllonexit
??0exception@@QEAA@AEBQEBD@Z
swscanf_s
??1exception@@UEAA@XZ
wcsncpy_s
memmove
wcschr
_onexit
strncmp
??1type_info@@UEAA@XZ
__CxxFrameHandler3
_XcptFilter
?terminate@@YAXXZ
_amsg_exit
__iob_func
_wsplitpath_s
_purecall
_vsnwprintf
_fileno
memset
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
GetModuleHandleW
FreeLibrary
LoadResource
LockResource
GetProcAddress
GetModuleFileNameW
SizeofResource
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
api-ms-win-core-file-l1-1-0
CreateFileW
GetFileSize
api-ms-win-core-memory-l1-1-0
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-libraryloader-l1-2-1
FindResourceW
LoadLibraryW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
GetLocalTime
LangDataCall
Name
.text
Size
168KB
Virtual Size
165KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=38, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=17, id=260, version=33138,
count=5, id=259, version=33138,
count=95, id=1, productName=Unmarked objects,
count=3, id=257, version=33138,
count=6, id=261, version=33138,
count=1, id=256, version=33138,
count=21, id=264, version=33138,
count=1, id=255, version=33138,
count=1, id=258, version=33138,
NlsData0009.dll
- IMPHASH 7334846fb5b9d90c22fa27dbc906063c
- SHA256 aaab875c1aa277472a2b83e282529c7ebeeaca8431b55fa07c77cf8d1f654c61
- MD5 788e0f1cb28ba1954feec079293dcc73
- SHA1 5af23d1a1ec7342e5a8eafc15330e2ffdea557ed
- SHA512 b9f270350e06101e65124b9f106226c7390907af70c9818ea6ac9f6e1cace630c8fbdfe24f6e580acb2c391808e0900a91ba7db6ea862cb87d0583c7641a01cf
- SSDEEP 49152:q8G7Q2mH52DNNNNNNodAuw7kqdTecWYnCJ:p2NNNNNNodSoyTz
- TLSH T1DA669241B5E217A5FA9D803A817B2E3EB0AFF048C6502667667D8D17F3447EB07B4392
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
6480
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
NlsData0009.pdb
msvcrt
_amsg_exit
_initterm
__C_specific_handler
__CxxFrameHandler3
??0exception@@QEAA@AEBQEBD@Z
_lock
wcsncpy_s
wcsncat_s
_unlock
memcpy
memmove
wcschr
__dllonexit
strncmp
_fileno
_onexit
_isatty
realloc
_CxxThrowException
malloc
free
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBQEBDH@Z
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
swscanf_s
_XcptFilter
__iob_func
?_set_se_translator@@YAP6AXIPEAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_resetstkoflw
_wsplitpath_s
ftell
fclose
fseek
_wfopen
fread
memmove_s
??1exception@@UEAA@XZ
_purecall
memcpy_s
memcmp
_vsnwprintf
?what@exception@@UEBAPEBDXZ
expf
log
logf
memset
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
DisableThreadLibraryCalls
GetModuleFileNameA
LockResource
GetModuleHandleExW
SizeofResource
GetProcAddress
LoadResource
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
GetLastError
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
CreateSemaphoreExW
CreateMutexExW
OpenSemaphoreW
InitializeCriticalSectionEx
LeaveCriticalSection
WaitForSingleObjectEx
ReleaseSemaphore
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WaitForSingleObject
ReleaseMutex
api-ms-win-core-file-l1-1-0
CreateFileW
WriteFile
SetFilePointer
GetFileSize
FlushFileBuffers
api-ms-win-core-memory-l1-1-0
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
FindResourceW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
GetLocalTime
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
LangDataCall
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4.3MB
Virtual Size
4.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
80B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=40, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=17, id=260, version=33145,
count=5, id=259, version=33145,
count=142, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=6, id=261, version=33145,
count=1, id=256, version=33145,
count=48, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
NlsLexicons0009.dll
- SHA256 70795969439fccf5b6ab4e887b0758eea4dd6cdf35b3947993c18c10beed6e85
- MD5 0d90a16d94f32f6f0d8d205d37202f8b
- SHA1 fdefeddba5b303de158255564db01fe1090aac41
- SHA512 c7e9178496f396375b3b2d0d5f75316fa279d8f14490580d4edf5794a2dfaf917545ade09fb95b7822a1aabb726b53943c997fe893af03d79dbbaac242d1e11f
- SSDEEP 24576:s9omWG4w/tG/9IwBCHat/WFmvsyGqD2ONizqFpASfhR2ltPH8rWTkE+:YzWG4kG/k61WtydNrfAm6s
- TLSH T136C5BED3FD0B2E5CEA6F5B3512B19524A3BEA0AC6BF5DB43B0C141377A43B405E126A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
4KB
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=33136,
count=1, id=258, version=33136,
Nlsdl.dll
- IMPHASH 11f73f585fc2bb2af953f65a054340ce
- SHA256 50d42b7f0e17b2f583595b7183a503359e72bf845c0113440d992d55b1f4ed1b
- MD5 b4229a6544dc0be8d2398d3ac0847e36
- SHA1 f42856876968febbe199711b883118f29db7c4fe
- SHA512 37fcae75bee076231f6b8979f89ed4af1974e0ae0892ad23d3c198c582ef4759fe2adf9040c7c04cc5deaeafe7ac59a2ccc547326cae2bf8e3f507389d317a52
- SSDEEP 384:n06R2Imlg2mREAd+sVa6q+JYq0zrgRWWwW:BR2IHRxB46BJYq0/S
- TLSH T104F2F899BF5928FAF871C639C5A35A0DA17DF522472247DF03E201AD4C22FD46934F91
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5056
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
NlsDL.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___std_type_info_destroy_list
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
__C_specific_handler
api-ms-win-crt-string-l1-1-0
memset
ntdll
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
kernel32
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
QueryPerformanceCounter
LocaleNameToLCID
GetLocaleInfoW
SetLastError
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
DownlevelGetParentLocaleLCID
DownlevelGetParentLocaleName
DownlevelLCIDToLocaleName
DownlevelLocaleNameToLCID
Name
.text
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
528B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
132B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=33138,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1086, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33138,
count=4, id=259, version=33138,
count=12, id=261, version=33138,
count=1, id=256, version=33138,
count=2, id=264, version=33138,
count=1, id=253, version=33138,
count=1, id=255, version=33138,
count=1, id=258, version=33138,
NmaDirect.dll
- IMPHASH af5c8e5ffb5d758caf3c7c572090d64a
- SHA256 58cf7c93539a3ba98e963629f066682a64236922aafeef436503ffb58320427e
- MD5 257a63208af346f92d8ef00e2938389a
- SHA1 ced17e08fbd0a48d32a07e04283e64ee9b858f0f
- SHA512 0b06b239719e67e0bedce18bf2c06666f488292b8ca76157fa8cf782fbd9fbbfd4bdee7143a16d43428f68068a1e3da55a9b79322865d93a942330dc1635eadf
- SSDEEP 3072:4ZlzFgHbGkqharyPfxOlzfgbmtNjvZfzhzU15eFWFQ1HJmIKFc1i:45gSkqharyPElTjtSxF4HUf
- TLSH T107241B6F379D00A3E576A23DC5834909F272F462471397CF0AA5427E8E1BBEC6939B11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5824
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
NmaDirect.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o_malloc
_o_realloc
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
__CxxFrameHandler3
_CxxThrowException
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
RoOriginateErrorW
SetRestrictedErrorInfo
RoTransformError
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-synch-l1-1-0
ReleaseMutex
InitializeCriticalSectionAndSpinCount
AcquireSRWLockExclusive
OpenSemaphoreW
WaitForSingleObject
CreateMutexExW
EnterCriticalSection
SetEvent
CreateSemaphoreExW
DeleteCriticalSection
ReleaseSemaphore
CreateEventW
ResetEvent
ReleaseSRWLockExclusive
ReleaseSRWLockShared
InitializeCriticalSectionEx
WaitForSingleObjectEx
InitializeSRWLock
AcquireSRWLockShared
LeaveCriticalSection
api-ms-win-core-synch-l1-2-0
WakeByAddressAll
WaitOnAddress
InitOnceExecuteOnce
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoDecrementMTAUsage
CoIncrementMTAUsage
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsDeleteString
WindowsDuplicateString
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsCompareStringOrdinal
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetModuleHandleExW
DisableThreadLibraryCalls
FreeLibrary
GetModuleHandleW
GetProcAddress
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
SetLastError
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
ztrace_maps
ZTraceReportIgnore
ZTraceReportOrigination
ZTraceReportPropagationNoThis
ZTraceReportPropagation
ZTraceReportOriginationNoThis
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolWork
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
SubmitThreadpoolWork
CloseThreadpoolTimer
FreeLibraryWhenCallbackReturns
CreateThreadpoolTimer
CreateThreadpoolWork
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-winrt-error-l1-1-1
RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
api-ms-win-core-com-l1-1-1
RoGetAgileReference
mapcontrolcore
GetMosThreadInstance
?RestrictedAPIAccessCheck@ApiAccessCheck@@SAJXZ
maprouter
?getElapsedDistance@Guidance@nmacore@Microsoft@@QEBAHXZ
?getDestinationDistance@Guidance@nmacore@Microsoft@@QEBAHXZ
?getAfterNextManeuverDistance@Guidance@nmacore@Microsoft@@QEBAHXZ
?getNextManeuverDistance@Guidance@nmacore@Microsoft@@QEBAHXZ
??0RoadElement@ngeo@Microsoft@@QEAA@AEBV012@@Z
?get_attribute@RoadElement@ngeo@Microsoft@@QEBA_NW4Attribute@123@@Z
?get_form_of_way@RoadElement@ngeo@Microsoft@@QEBA?AW4FormOfWay@123@XZ
?get_identifier@RoadElement@ngeo@Microsoft@@QEBA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ
?get_geometry@RoadElement@ngeo@Microsoft@@QEBA?AW4ErrorCode@errorcodes@msngeo@@AEAVGeoPolyline@23@@Z
?get_travel_time_s@RoadElement@ngeo@Microsoft@@QEBAIXZ
?get_speed_limit_m_s@RoadElement@ngeo@Microsoft@@QEBAMXZ
?get_route_name@RoadElement@ngeo@Microsoft@@QEBAAEBV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ
?get_road_name@RoadElement@ngeo@Microsoft@@QEBAAEBV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ
?is_valid@RoadElement@ngeo@Microsoft@@QEBA_NXZ
?getSignpost@Maneuver@nmacore@Microsoft@@UEBAPEBVISignpost@msngeo@@XZ
?getMapOrientation@Maneuver@nmacore@Microsoft@@UEBAIXZ
?getTurn@Maneuver@nmacore@Microsoft@@UEBAIXZ
?getAction@Maneuver@nmacore@Microsoft@@UEBAIXZ
?getItineraryWarningAt@Maneuver@nmacore@Microsoft@@UEAAAEBVIItineraryWarning@msnma@@I@Z
?getItineraryWarningCount@Maneuver@nmacore@Microsoft@@UEAAIXZ
?getExitName@Maneuver@nmacore@Microsoft@@UEBAAEBV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ
?copy@Maneuver@nmacore@Microsoft@@UEBA?AV?$unique_ptr@VIManeuver@msnma@@U?$default_delete@VIManeuver@msnma@@@std@@@std@@XZ
?getInstructionText@Maneuver@nmacore@Microsoft@@UEBAAEBV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ
?signpost@Maneuver@nmacore@Microsoft@@QEBAPEBVSignpost@ngeo@3@XZ
?getEndAngle@Maneuver@nmacore@Microsoft@@UEBAIXZ
?getStartAngle@Maneuver@nmacore@Microsoft@@UEBAIXZ
?getIcon@Maneuver@nmacore@Microsoft@@UEBAIXZ
?getNextRouteName@Maneuver@nmacore@Microsoft@@UEBAAEBV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ
?getRouteName@Maneuver@nmacore@Microsoft@@UEBAAEBV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ
?getNextRoadName@Maneuver@nmacore@Microsoft@@UEBAAEBV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ
?getRoadName@Maneuver@nmacore@Microsoft@@UEBAAEBV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ
?getDistanceFromPreviousManeuver@Maneuver@nmacore@Microsoft@@UEBAIXZ
?getDistanceFromStart@Maneuver@nmacore@Microsoft@@QEBAIXZ
?getGeoCoordinates@Maneuver@nmacore@Microsoft@@UEBAAEBVIGeoCoordinates@msngeo@@XZ
??0GeoCoordinates@ngeo@Microsoft@@QEAA@AEBVIGeoCoordinates@msngeo@@@Z
??1Maneuver@nmacore@Microsoft@@UEAA@XZ
??0Maneuver@nmacore@Microsoft@@QEAA@AEBV012@@Z
??4GeoCoordinates@ngeo@Microsoft@@QEAAAEAV012@$$QEAV012@@Z
??4Location@ngeo@Microsoft@@QEAAAEAV012@AEBV012@@Z
?get_alpha@Color@ngeo@Microsoft@@QEBAEXZ
?get_blue@Color@ngeo@Microsoft@@QEBAEXZ
?get_green@Color@ngeo@Microsoft@@QEBAEXZ
?get_red@Color@ngeo@Microsoft@@QEBAEXZ
??AGeoPolyline@ngeo@Microsoft@@QEBAAEBVGeoCoordinates@12@_K@Z
?number_of_points@GeoPolyline@ngeo@Microsoft@@QEBA_KXZ
?set_timestamp@Location@ngeo@Microsoft@@QEAAX_J@Z
?set_location_method@Location@ngeo@Microsoft@@QEAAXW4LocationMethod@123@@Z
?set_course_degrees@Location@ngeo@Microsoft@@QEAAXN@Z
?set_speed_m_s@Location@ngeo@Microsoft@@QEAAXN@Z
?set_z_accuracy_m@Location@ngeo@Microsoft@@QEAAXM@Z
?set_y_accuracy_m@Location@ngeo@Microsoft@@QEAAXM@Z
?set_x_accuracy_m@Location@ngeo@Microsoft@@QEAAXM@Z
?get_bottom_right@GeoRect@ngeo@Microsoft@@QEBAAEBVGeoCoordinates@23@XZ
?get_top_left@GeoRect@ngeo@Microsoft@@QEBAAEBVGeoCoordinates@23@XZ
??0GeoCoordinates@ngeo@Microsoft@@QEAA@NNM@Z
?has_valid_altitude@GeoCoordinates@ngeo@Microsoft@@QEBA_NXZ
?setConnectionType@MapSensor@nmacore@Microsoft@@QEAAXW4NetworkMode@1ngeo@3@@Z
?uploadFrequency@MapSensor@nmacore@Microsoft@@QEAAGXZ
?setUploadFrequency@MapSensor@nmacore@Microsoft@@QEAAXG@Z
?speedTrigger@MapSensor@nmacore@Microsoft@@QEAANXZ
?setSpeedTrigger@MapSensor@nmacore@Microsoft@@QEAAXN@Z
?clearLocalData@MapSensor@nmacore@Microsoft@@QEAAXXZ
?setEnabled@MapSensor@nmacore@Microsoft@@QEAAX_N@Z
?isEnabled@MapSensor@nmacore@Microsoft@@QEBA_NXZ
??0MapSensor@nmacore@Microsoft@@QEAA@XZ
??1MapSensor@nmacore@Microsoft@@QEAA@XZ
??0IGuidanceListener@nmacore@Microsoft@@QEAA@XZ
??0Route@ngeo@Microsoft@@QEAA@AEBV012@@Z
??1LaneInfo@ngeo@Microsoft@@QEAA@XZ
?TrafficEnableRoutingStateChanged@IGuidanceListener@nmacore@Microsoft@@UEAAXXZ
?CountryChanged@IGuidanceListener@nmacore@Microsoft@@UEAAXAEBV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@0@Z
?StopoverReached@IGuidanceListener@nmacore@Microsoft@@UEAAXAEBVRoutePlan@ngeo@3@I@Z
?on_tts_prompt_db_load@TtsEngine@nmacore@Microsoft@@EEAAXW4ErrorCode@errorcodes@msngeo@@@Z
?on_tts_error@TtsEngine@nmacore@Microsoft@@EEAAXW4ErrorCode@errorcodes@msngeo@@@Z
?on_tts_completed@TtsEngine@nmacore@Microsoft@@EEAAXXZ
?on_tts_data@TtsEngine@nmacore@Microsoft@@EEAAXPEBX_K@Z
?on_tts_configured@TtsEngine@nmacore@Microsoft@@EEAAXHH@Z
?getPollInterval@TtsEngine@nmacore@Microsoft@@EEAAHXZ
?resumeEngine@BaseEngine@nmacore@Microsoft@@UEAA_NXZ
?suspendEngine@BaseEngine@nmacore@Microsoft@@UEAA_NXZ
?stop@BaseEngine@nmacore@Microsoft@@UEAAXXZ
?start@BaseEngine@nmacore@Microsoft@@UEAAXXZ
?poll@TtsEngine@nmacore@Microsoft@@EEAAXXZ
?getElapsedTime@Guidance@nmacore@Microsoft@@QEBAHXZ
??0LaneInfo@ngeo@Microsoft@@QEAA@XZ
?getRoute@Guidance@nmacore@Microsoft@@QEBAAEBVRoute@ngeo@3@XZ
?getAfterNextManeuver@Guidance@nmacore@Microsoft@@QEBA?AV?$unique_ptr@VManeuver@nmacore@Microsoft@@U?$default_delete@VManeuver@nmacore@Microsoft@@@std@@@std@@XZ
?getNextManeuver@Guidance@nmacore@Microsoft@@QEBA?AV?$unique_ptr@VManeuver@nmacore@Microsoft@@U?$default_delete@VManeuver@nmacore@Microsoft@@@std@@@std@@XZ
?getNavigationAudioEnabled@Guidance@nmacore@Microsoft@@QEBA_NXZ
?setNavigationAudioEnabled@Guidance@nmacore@Microsoft@@QEAAX_N@Z
??0Location@ngeo@Microsoft@@QEAA@AEBV012@@Z
?getPoller@Runtime@nmacore@Microsoft@@QEAAAEAVPoller@23@XZ
?pollEngineNow@Poller@nmacore@Microsoft@@QEAAXPEAVBaseEngine@23@@Z
?guidanceMode@Guidance@nmacore@Microsoft@@QEBA?AW4GuidanceMode@123@XZ
?runningState@Guidance@nmacore@Microsoft@@QEBA?AW4GuidanceState@123@XZ
?getSensors@Runtime@nmacore@Microsoft@@QEAAAEAVSensors@23@XZ
?updatePosition@Sensors@nmacore@Microsoft@@QEAAXAEBVLocation@ngeo@3@@Z
?set_coordinates@Location@ngeo@Microsoft@@QEAAXAEBVGeoCoordinates@23@@Z
??1GeoCoordinates@ngeo@Microsoft@@UEAA@XZ
??0GeoCoordinates@ngeo@Microsoft@@QEAA@XZ
?setAudioOutputEvents@Guidance@nmacore@Microsoft@@QEAAXI@Z
?getAudioOutputEvents@Guidance@nmacore@Microsoft@@QEBAIXZ
?setVoiceSkinId@Guidance@nmacore@Microsoft@@QEAAXIAEBV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?setDistanceUnit@Guidance@nmacore@Microsoft@@QEAAXI@Z
?getDistanceUnit@Guidance@nmacore@Microsoft@@QEBAIXZ
?repeat@Guidance@nmacore@Microsoft@@QEAAXXZ
?resume@Guidance@nmacore@Microsoft@@QEAAXXZ
?pause@Guidance@nmacore@Microsoft@@QEAAXXZ
?startTracking@Guidance@nmacore@Microsoft@@QEAAXXZ
??1Location@ngeo@Microsoft@@UEAA@XZ
??0Location@ngeo@Microsoft@@QEAA@XZ
?simulate@Guidance@nmacore@Microsoft@@QEAAXAEBVRoute@ngeo@3@0H@Z
?simulate@Guidance@nmacore@Microsoft@@QEAAXAEBVRoute@ngeo@3@H@Z
?navigate@Guidance@nmacore@Microsoft@@QEAAXAEBVRoute@ngeo@3@@Z
?clear@Guidance@nmacore@Microsoft@@QEAAXXZ
??1TtsEngine@nmacore@Microsoft@@UEAA@XZ
?setListener@Guidance@nmacore@Microsoft@@QEAAXPEAVIGuidanceListener@23@@Z
?setTtsEngine@Guidance@nmacore@Microsoft@@QEAAXPEAVITtsEngine@23@@Z
?setAudioPlayer@Guidance@nmacore@Microsoft@@QEAAXPEAVIAudioPlayer@23@@Z
??0TtsEngine@nmacore@Microsoft@@QEAA@W4TtsEngineType@TtsEngineFactory@ngeo@2@@Z
?getInstance@Runtime@nmacore@Microsoft@@SAAEAV123@XZ
?getGuidance@Runtime@nmacore@Microsoft@@QEAAPEAVGuidance@23@XZ
??1GeoPolyline@ngeo@Microsoft@@UEAA@XZ
??1iterator@RouteElements@ngeo@Microsoft@@QEAA@XZ
??1RouteElement@ngeo@Microsoft@@QEAA@XZ
??1RoadElement@ngeo@Microsoft@@QEAA@XZ
?getDurationWithTraffic@Route@nmacore@Microsoft@@UEBAIXZ
?getDurationWithTraffic@Route@nmacore@Microsoft@@UEBAII@Z
?isScenic@Route@nmacore@Microsoft@@UEBA_NXZ
?getTrafficCongestion@Route@nmacore@Microsoft@@UEBA?AW4TrafficCongestionType@IRoute@msnma@@XZ
?getTrafficCongestion@Route@nmacore@Microsoft@@UEBA?AW4TrafficCongestionType@IRoute@msnma@@I@Z
?getCalculationType@Route@nmacore@Microsoft@@UEBA?AW4TCalculationType@IRoute@msnma@@XZ
?isValid@Route@nmacore@Microsoft@@UEBA_NXZ
?isCondensed@Route@nmacore@Microsoft@@UEBA_NXZ
?isDeserialized@Route@nmacore@Microsoft@@UEBA_NXZ
?serialize@Route@nmacore@Microsoft@@UEAAIAEAVIOutStream@msnma@@@Z
?getRouteGeometryAt@Route@nmacore@Microsoft@@UEAAAEBVIGeoCoordinates@msngeo@@I@Z
?getRouteGeometryAt@Route@nmacore@Microsoft@@UEAAAEBVIGeoCoordinates@msngeo@@II@Z
?getRouteGeometryCount@Route@nmacore@Microsoft@@UEAAIXZ
?getRouteGeometryCount@Route@nmacore@Microsoft@@UEAAII@Z
?getManeuverAt@Route@nmacore@Microsoft@@UEAAAEAVIManeuver@msnma@@I@Z
?getManeuverCount@Route@nmacore@Microsoft@@UEAAIXZ
?getDurationWithoutTraffic@Route@nmacore@Microsoft@@UEBAIXZ
?getDurationWithoutTraffic@Route@nmacore@Microsoft@@UEBAII@Z
?getDuration@Route@nmacore@Microsoft@@UEBAII@Z
?getLength@Route@nmacore@Microsoft@@UEBAII@Z
?getInstanceType@Route@nmacore@Microsoft@@UEBA?AW4InstanceType@msnma@@XZ
?copy@Route@nmacore@Microsoft@@UEBA?AV?$unique_ptr@VIRoute@msnma@@U?$default_delete@VIRoute@msnma@@@std@@@std@@XZ
?get_road_element@RouteElement@ngeo@Microsoft@@QEBA?AVRoadElement@23@XZ
??Diterator@RouteElements@ngeo@Microsoft@@QEBA?AVRouteElement@23@XZ
??9iterator@RouteElements@ngeo@Microsoft@@QEAA_NAEBV0123@@Z
??Eiterator@RouteElements@ngeo@Microsoft@@QEAAAEAV0123@XZ
?end@RouteElements@ngeo@Microsoft@@QEBA?AViterator@123@XZ
?begin@RouteElements@ngeo@Microsoft@@QEBA?AViterator@123@XZ
?getRouteElements@Route@nmacore@Microsoft@@QEAAAEBVRouteElements@ngeo@3@XZ
?get_route_geometry@Route@ngeo@Microsoft@@QEBA?AW4ErrorCode@errorcodes@msngeo@@AEAVGeoPolyline@23@@Z
??0GeoPolyline@ngeo@Microsoft@@QEAA@XZ
?getBoundingBox@Route@nmacore@Microsoft@@UEAAAEBVGeoRect@ngeo@3@XZ
?getManeuvers@Route@nmacore@Microsoft@@QEAAAEBV?$vector@VManeuver@nmacore@Microsoft@@V?$allocator@VManeuver@nmacore@Microsoft@@@std@@@std@@XZ
?getLength@Route@nmacore@Microsoft@@UEBAIXZ
?getDuration@Route@nmacore@Microsoft@@UEBAIXZ
??1Route@nmacore@Microsoft@@UEAA@XZ
??0Route@nmacore@Microsoft@@QEAA@AEBV0ngeo@2@W4TCalculationType@IRoute@msnma@@@Z
??1Route@ngeo@Microsoft@@QEAA@XZ
??4Route@ngeo@Microsoft@@QEAAAEAV012@AEBV012@@Z
?is_valid@Route@ngeo@Microsoft@@QEBA_NXZ
?route@Route@nmacore@Microsoft@@QEBAAEBV1ngeo@3@XZ
??0Route@ngeo@Microsoft@@QEAA@XZ
?getEngineId@TtsEngine@nmacore@Microsoft@@EEBA?AW4TEngineID@BaseEngine@23@XZ
?currentLocation@Guidance@nmacore@Microsoft@@QEBAAEBVMapMatchedLocation@ngeo@3@XZ
?is_valid@Location@ngeo@Microsoft@@QEBA_NXZ
?getRoadName@Guidance@nmacore@Microsoft@@QEBA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ
?get_directions_int@LaneInfo@ngeo@Microsoft@@QEBAHXZ
?on_route@LaneInfo@ngeo@Microsoft@@QEBA_NXZ
??4LaneInfo@ngeo@Microsoft@@QEAAAEAV012@AEBV012@@Z
?get_exit_text@Signpost@ngeo@Microsoft@@QEBAAEBV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ
?get_background_color@Signpost@ngeo@Microsoft@@QEBAAEBVColor@23@XZ
?get_foreground_color@Signpost@ngeo@Microsoft@@QEBAAEBVColor@23@XZ
?get_course_degrees@Location@ngeo@Microsoft@@QEBANXZ
?get_speed_m_s@Location@ngeo@Microsoft@@QEBANXZ
?is_on_street@MapMatchedLocation@ngeo@Microsoft@@QEBA_NXZ
?get_coordinates@Location@ngeo@Microsoft@@QEBAAEBVGeoCoordinates@23@XZ
?get_road_element@MapMatchedLocation@ngeo@Microsoft@@QEBAAEBVRoadElement@23@XZ
?getTimeToArrival@Guidance@nmacore@Microsoft@@QEBAHXZ
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
NmaDirect_OverrideUserLocation
NmaDirect_StartGuidanceWithSimulatedRoute
Name
.text
Size
128KB
Virtual Size
127KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
64KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=55, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=1362, id=1, productName=Unmarked objects,
count=8, id=257, version=33145,
count=30, id=261, version=33145,
count=1, id=256, version=33145,
count=25, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
NotificationController.dll
- IMPHASH 819f4cf1138a7286866a3536d32c3ac4
- SHA256 40528ab4618ec3a3cc75a785cdd9d5aeb98935db6f0716c3b55af09a1f82dfb3
- MD5 b50974850be5db69dcaa04a05a7afc66
- SHA1 2063f4755be24cefc3c61017428dcbac071f3479
- SHA512 e3e637a890da712065c554c59686f2d3881e8e348a73b11bfce45e2854f7838534a882b0021cc171f70bbaafdeff3c8058f97906676d0f2d94de43e1496cc127
- SSDEEP 24576:peBANpvODDSyvbK3LMq98y7V/F+SDXPLXSmF6Tmw5:peBATvOPXvbK75zSk6ac
- TLSH T11B557F2E56AC01D5E5BAD1BDC247891BF6B378160331AACB0158467D1F2FFE4963EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
645856
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
NotificationController.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__gmtime64
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__itow_s
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__wcsicmp
_o__wcsnicmp
memmove
_o__wtof
_o__wtoi
_o__wtol
_o_abort
_o_free
_o_iswspace
_o_malloc
_o_terminate
_o_towlower
_o_wcscat_s
_o_wcscpy_s
_o_wcstod
_o_wcstoul
_o_wcstoull
__C_specific_handler
__current_exception
__current_exception_context
__CxxFrameHandler3
_CxxThrowException
_o__execute_onexit_table
_o__errno
_o__difftime64
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__get_errno
_o__callnewh
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
memchr
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
wcscmp
memset
wcscspn
rmclient
HamCloseActivity
HamStartActivityAsync
HamCreateActivityForProcess
HamPopulateActivityProperties
HamDisconnectFromServer
HamConnectToServer
combase
GetErrorInfo
ord140
SetErrorInfo
ord154
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
LoadStringW
FindResourceExW
LoadResource
GetModuleFileNameA
DisableThreadLibraryCalls
LockResource
LoadLibraryExW
GetProcAddress
GetModuleHandleExA
FreeLibrary
GetModuleHandleExW
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceBeginInitialize
InitOnceComplete
InitOnceExecuteOnce
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
ReleaseSemaphore
EnterCriticalSection
CreateSemaphoreExW
LeaveCriticalSection
InitializeCriticalSectionEx
WaitForSingleObject
TryAcquireSRWLockShared
OpenSemaphoreW
WaitForMultipleObjectsEx
CreateEventExW
ResetEvent
ReleaseSRWLockShared
InitializeCriticalSection
SetEvent
ReleaseMutex
ReleaseSRWLockExclusive
CreateMutexExW
TryAcquireSRWLockExclusive
DeleteCriticalSection
AcquireSRWLockShared
WaitForSingleObjectEx
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
RaiseException
SetUnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-eventing-provider-l1-1-0
EventActivityIdControl
EventRegister
EventWriteTransfer
EventUnregister
EventSetInformation
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetProcessId
ProcessIdToSessionId
OpenProcessToken
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
CompareStringOrdinal
WideCharToMultiByte
api-ms-win-core-winrt-string-l1-1-0
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsCompareStringOrdinal
WindowsDeleteString
WindowsSubstringWithSpecifiedLength
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsDuplicateString
WindowsCreateString
api-ms-win-core-com-l1-1-0
CoCreateGuid
CoTaskMemRealloc
CLSIDFromString
CoReleaseMarshalData
CoWaitForMultipleHandles
CreateStreamOnHGlobal
CoMarshalInterface
CoRevokeClassObject
CoGetApartmentType
CoRegisterClassObject
CoResumeClassObjects
StringFromGUID2
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoGetCallContext
CoTaskMemFree
CoCreateInstance
PropVariantClear
api-ms-win-core-winrt-l1-1-0
RoRegisterActivationFactories
RoActivateInstance
RoGetActivationFactory
RoUninitialize
RoInitialize
RoRevokeActivationFactories
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
RoOriginateErrorW
GetRestrictedErrorInfo
RoOriginateError
SetRestrictedErrorInfo
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
GetSystemTime
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InterlockedPushEntrySList
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegGetValueW
RegCloseKey
RegQueryValueExW
RegQueryInfoKeyW
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
oleaut32
SysAllocStringLen
SysReAllocStringLen
SysAllocString
SysStringLen
SysFreeString
api-ms-win-security-base-l1-1-0
GetTokenInformation
EqualSid
IsWellKnownSid
api-ms-win-core-winrt-error-l1-1-1
IsErrorPropagationEnabled
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate
RoOriginateLanguageException
api-ms-win-core-file-l1-1-0
CompareFileTime
FindFirstFileW
DeleteFileW
GetFileAttributesW
CreateDirectoryW
FindClose
FindNextFileW
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
api-ms-win-core-path-l1-1-0
PathCchAppend
PathCchRemoveFileSpec
PathCchRemoveExtension
PathCchFindExtension
PathCchAppendEx
api-ms-win-core-file-l2-1-2
CopyFileW
api-ms-win-power-setting-l1-1-0
PowerSettingRegisterNotification
PowerSettingUnregisterNotification
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
api-ms-win-core-string-l2-1-1
SHLoadIndirectString
api-ms-win-core-url-l1-1-0
PathCreateFromUrlW
umpdc
Pdcv2ActivationClientUnregister
Pdcv2ActivationClientDeactivate
api-ms-win-shcore-thread-l1-1-0
SHGetThreadRef
api-ms-win-rtcore-ntuser-window-l1-1-0
TranslateMessage
PostQuitMessage
GetForegroundWindow
DispatchMessageW
PeekMessageW
api-ms-win-rtcore-ntuser-synch-l1-1-0
MsgWaitForMultipleObjectsEx
api-ms-win-appmodel-runtime-l1-1-1
ParseApplicationUserModelId
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFindFileNameW
ntdll
RtlIsMultiUsersInSessionSku
RtlSleepConditionVariableSRW
RtlWakeAllConditionVariable
RtlAcquireSRWLockExclusive
RtlReleaseSRWLockExclusive
wcschr
wcsncmp
wcsrchr
wcsstr
RtlSubscribeWnfStateChangeNotification
RtlPublishWnfStateData
NtQueryWnfStateData
RtlUnsubscribeWnfStateChangeNotification
RtlGetDeviceFamilyInfoEnum
RtlDeriveCapabilitySidsFromName
RtlTestAndPublishWnfStateData
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolAllowThreadReuse
SHTaskPoolGetUniqueContext
SHTaskPoolQueueTask
api-ms-win-shcore-registry-l1-1-0
SHRegGetValueW
api-ms-win-rtcore-ntuser-powermanagement-l1-1-0
UnregisterPowerSettingNotification
api-ms-win-rtcore-ntuser-private-l1-1-0
GetWindowBand
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
shcore
ord190
msvcp_win
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??Bid@locale@std@@QEAA_KXZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?_Xbad_alloc@std@@YAXXZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?good@ios_base@std@@QEBA_NXZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGXZ
?id@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Getcat@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?put@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@GPEBUtm@@PEBG3@Z
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG0@Z
?uncaught_exception@std@@YA_NXZ
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEAI@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEA_K@Z
?_Xbad_function_call@std@@YAXXZ
??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ
?in@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Incref@facet@locale@std@@UEAAXXZ
??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
_Xtime_get_ticks
?_Xinvalid_argument@std@@YAXPEBD@Z
??Bios_base@std@@QEBA_NXZ
?width@ios_base@std@@QEAA_J_J@Z
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?flags@ios_base@std@@QEBAHXZ
?width@ios_base@std@@QEBA_JXZ
??1?$basic_istream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
?seekp@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@_JH@Z
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
976KB
Virtual Size
972KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
248KB
Virtual Size
247KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
52KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
160B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=109, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=17, id=260, version=33145,
count=5, id=259, version=33145,
count=1417, id=1, productName=Unmarked objects,
count=12, id=257, version=33145,
count=31, id=261, version=33145,
count=1, id=256, version=33145,
count=104, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
NotificationControllerPS.dll
- IMPHASH ca549befda59075effca9c405740a586
- SHA256 7ac76a088eca357773f9202c1fd729168f3d4149a536f0eb815164eb12fb5f44
- MD5 6bfb5a6eddeaa14571b8ea4e88c7497f
- SHA1 889ee44b31cb5d90d55c9495f5a998ed491d5fbd
- SHA512 8b0ccf2029440e414f10845fcfdd8c01a39a2df7f609d0c2c9062a22c9f057ef5a34ad1af6092e59bddaca0716e83e7d4f4dadb263a42b710491d7657c34f3bd
- SSDEEP 6144:DusUstPYaNSKmAJTLUkCEd2Gonwryq6lLZ3kqIyMefF/j71K:isUSQaNSFITpFKwrF8LkZ0f1
- TLSH T1A1944C6DEAE800B5D1BAD17CC5A34A0AF2B23C5953725ACF0650425E1F77FE8993E720
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
29024
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
NotificationControllerPS.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o_free
_o_malloc
_o_wcscpy_s
_o_wcstoull
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__crt_atexit
_o__configure_narrow_argv
_o___stdio_common_vswprintf
_o__execute_onexit_table
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o__errno
_o___std_exception_copy
_o__cexit
_o__callnewh
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
wcscmp
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetProcAddress
GetModuleHandleW
GetModuleHandleExW
api-ms-win-core-synch-l1-1-0
ReleaseMutex
WaitForSingleObject
ReleaseSemaphore
WaitForSingleObjectEx
CreateSemaphoreExW
InitializeCriticalSection
TryAcquireSRWLockExclusive
TryAcquireSRWLockShared
CreateEventExW
ResetEvent
CreateMutexExW
OpenSemaphoreW
SetEvent
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
RaiseException
UnhandledExceptionFilter
GetLastError
SetLastError
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcess
GetProcessId
ProcessIdToSessionId
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
SetRestrictedErrorInfo
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventUnregister
EventSetInformation
EventRegister
EventActivityIdControl
api-ms-win-core-registry-l1-1-0
RegGetValueW
api-ms-win-core-util-l1-1-0
DecodePointer
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceBeginInitialize
InitOnceComplete
InitOnceExecuteOnce
api-ms-win-core-com-l1-1-0
CoTaskMemFree
PropVariantClear
CoCreateInstance
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoGetCallContext
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
ntdll
RtlUnsubscribeWnfStateChangeNotification
RtlIsMultiUsersInSessionSku
RtlPublishWnfStateData
RtlSubscribeWnfStateChangeNotification
wcschr
RtlGetDeviceFamilyInfoEnum
RtlTestAndPublishWnfStateData
NtQueryWnfStateData
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFindFileNameW
combase
ord154
msvcp_win
_Query_perf_frequency
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
_Query_perf_counter
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
268KB
Virtual Size
267KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
92KB
Virtual Size
90KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=81, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=11, id=260, version=33145,
count=5, id=259, version=33145,
count=1264, id=1, productName=Unmarked objects,
count=6, id=257, version=33145,
count=30, id=261, version=33145,
count=1, id=256, version=33145,
count=38, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
NotificationIntelligencePlatform.dll
- IMPHASH 2b0d293e78bd3811c183269e2a9284d9
- SHA256 14a9d9faafb2f3ecd3110590b2cd1995b3e5036d100a3cb1b2dfa7e0ac1b0742
- MD5 4c0ba28fd299ab6d7f8668de7a3b1208
- SHA1 f592cfd0735fa1148fe6af0941b182abfefe8390
- SHA512 67bdb2fd7e4cafd42984cf6b60594f024159dd297b80155c4ba68d4e3d2b90bd7acd94b6db010b2c5e2376ab54ce3d40623af8e31158739ff48fd5729f54d126
- SSDEEP 6144:cGdRk7Gvy+ma/dL82fTD0LhxAaFcSF7kfLVyB:cGk7Gvy+ma/TA1xAGHF7SS
- TLSH T1DB24295E66A801B6E1B7D13DDAD38A0BF2B27455432252CF02D103BE0E67FEC653A761
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
11136
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
NotificationIntelligencePlatform.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_abort
_o_free
_o_iswspace
_o_malloc
_o_realloc
_o_terminate
_o_tolower
__C_specific_handler
__current_exception
__current_exception_context
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
memcmp
memcpy
_CxxThrowException
__CxxFrameHandler3
strchr
__std_terminate
__CxxFrameHandler4
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
LoadLibraryExW
FreeLibrary
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleW
api-ms-win-core-interlocked-l1-1-0
InterlockedPushEntrySList
InitializeSListHead
InterlockedFlushSList
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventSetInformation
EventRegister
EventWriteTransfer
EventActivityIdControl
api-ms-win-core-file-l1-1-0
CompareFileTime
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-core-com-l1-1-0
PropVariantClear
CoTaskMemFree
CoCreateFreeThreadedMarshaler
CoCreateInstance
CoTaskMemAlloc
api-ms-win-core-synch-l1-1-0
CreateSemaphoreExW
DeleteCriticalSection
EnterCriticalSection
ReleaseSemaphore
LeaveCriticalSection
InitializeCriticalSection
ReleaseSRWLockShared
InitializeCriticalSectionEx
WaitForSingleObject
AcquireSRWLockShared
ReleaseMutex
OpenSemaphoreW
ReleaseSRWLockExclusive
WaitForSingleObjectEx
CreateMutexExW
AcquireSRWLockExclusive
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-threadpool-l1-2-0
TrySubmitThreadpoolCallback
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
dmiso8601utils
ISO8601StringToSystemTime
ntdll
NtQueryWnfStateData
msvcp_win
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
?_Xlength_error@std@@YAXPEBD@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?_Incref@facet@locale@std@@UEAAXXZ
?_Xbad_alloc@std@@YAXXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Wcscoll
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
??Bid@locale@std@@QEAA_KXZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??1facet@locale@std@@MEAA@XZ
?is@?$ctype@_W@std@@QEBA_NF_W@Z
?tolower@?$ctype@_W@std@@QEBA_W_W@Z
?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
_Wcsxfrm
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$collate@_W@std@@2V0locale@2@A
oleaut32
SetErrorInfo
SysFreeString
SysStringLen
GetErrorInfo
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
DllCanUnloadNow
DllGetActivationFactory
Name
.text
Size
140KB
Virtual Size
137KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=59, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=1197, id=1, productName=Unmarked objects,
count=6, id=257, version=33145,
count=29, id=261, version=33145,
count=1, id=256, version=33145,
count=7, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
NtlmShared.dll
- IMPHASH 2ffc7202884e15e9cb2c1d7bdb00a4e9
- SHA256 d4d6a38127f6989db063547c7a16fee98647cb8dce623237c5a32b64dfc33dbd
- MD5 08920df65e993fb8d138ad5188006ef2
- SHA1 4c7e6fb92645e7a1e6d0c3594848beaefbafd7e7
- SHA512 77fed85a9d40a3501178f21e86b598b1231cf7ff9d5875d5cc5f26471081c0822862346ccbe1961a3626bb3212acfe3d3f3b382d10d428045afd44beaeb4d206
- SSDEEP 1536:SL6BNEUMMePhm16Uc860hdrlpInaIAWPxKmKzqfKIDl+KAHN28MaaP0zSA:SLENEeeWJbrm3AWP1x2N23aac+A
- TLSH T148B35C6E72B83096E566913CC5628619EBB0B039671167FF03E0C1BC9F23BD46E39B54
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
dd:d1:75:dc:d9:35:c9:0a:74:72:16:86:d5:1f:5b:44:1d:5f:b6:c9:da:05:c3:85:fe:ec:0e:93:50:72:45:6c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:55:46:a8:83:17:24:6f:63:e9:00:00:00:00:05:55
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 13, 2025 - Oct 18, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6B05-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:11:45:18:39:9b:43:cf:fc:6c:00:01:00:00:02:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
5024
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
NtlmShared.pdb
api-ms-win-core-crt-l1-1-0
memcpy_s
_vsnwprintf_s
memmove_s
memcpy
memcmp
__C_specific_handler
memset
api-ms-win-core-crt-l2-1-0
_initterm
_onexit
__dllonexit3
_purecall
_initterm_e
ntdll
RtlUpperChar
RtlCaptureContext
RtlEqualUnicodeString
EtwEventRegister
RtlLookupFunctionEntry
RtlVirtualUnwind
EtwTraceMessage
EtwUnregisterTraceGuids
EtwEventSetInformation
EtwGetTraceEnableFlags
RtlInitUnicodeString
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
RtlNtStatusToDosError
EtwRegisterTraceGuidsW
RtlDowncaseUnicodeString
RtlFreeUnicodeString
RtlUpcaseUnicodeString
RtlConvertSidToUnicodeString
NtQuerySystemTime
EtwEventUnregister
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
DisableThreadLibraryCalls
GetProcAddress
GetModuleFileNameA
GetModuleHandleW
GetModuleFileNameW
api-ms-win-core-synch-l1-1-0
CreateSemaphoreExW
ReleaseSRWLockShared
WaitForSingleObjectEx
ReleaseSRWLockExclusive
LeaveCriticalSection
EnterCriticalSection
CreateMutexExW
AcquireSRWLockShared
DeleteCriticalSection
InitializeCriticalSectionEx
ReleaseMutex
AcquireSRWLockExclusive
InitializeCriticalSection
WaitForSingleObject
ReleaseSemaphore
OpenSemaphoreW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
MsvpAvlAdd
MsvpAvlGet
MsvpAvlGetFlags
MsvpAvlGetTimestamp
MsvpAvlInit
MsvpAvlLen
MsvpAvlSetFlags
MsvpAvlSetTimestamp
MsvpAvlToString
MsvpCachePasswordsToCredential
MsvpCalculateNtlm2Challenge
MsvpCalculateNtlm2SessionKeys
MsvpCalculateNtlm3Owf
MsvpCompareCredentials
MsvpComputeSaltedHashedPassword
MsvpCredentialToCachePasswords
MsvpDecryptDpapiMasterKey
MsvpDeriveSecureCredKey
MsvpGMSACred
MsvpLm20GetNtlm3ChallengeResponse
MsvpLm3Response
MsvpLm3ValidateResponse
MsvpMakeSecretPasswordNT5
MsvpNtlm3Response
MsvpNtlm3ValidateResponse
MsvpPasswordValidate
MsvpPutClearOwfsInPrimaryCredential
MsvpUpdateSharedConfiguration
MsvpValidateSupplementalCreds
MsvpValidateSupplementalCredsBuffer
NtLmAlterRtlEqualUnicodeString
NtlmSharedAllocate
NtlmSharedAllocatePrivateHeap
NtlmSharedCleanup
NtlmSharedFree
NtlmSharedFreePrivateHeap
NtlmSharedInit
Name
.text
Size
56KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
184B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=1, id=261, version=33145,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=13, id=260, version=33145,
count=35, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=105, id=1, productName=Unmarked objects,
count=1, id=256, version=33145,
count=13, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
NvAgent.dll
- IMPHASH c0de06230e3b997c19f1c5816ba44303
- SHA256 15d36b98b066ad6842e59dd8feeb1747331732eb8b57e84dbcaa77d2d30c911e
- MD5 41d2b58e01419c6bebfc4208fd1f6fef
- SHA1 bee7bf610da3f02d4ef1d536cc7138211f6f8a8a
- SHA512 b11af1f930cdc59f4a5500704dd29957dacd556d2e89c3e6bc7f167e49c11e1578b4c25ec4c3a3ea8cb3d2f441ab5d9ebc7a4ce5e94f9dd8a12b5a86917917d7
- SSDEEP 1536:ql2FEoBBANJBn/DhXO0lrjkrh1I0qJf5+Poz9S:qlzobAnxLs0TJJB+w0
- TLSH T15D638E9DA6A410D5E475513CC5938A1DE4B0B1A0A31217FF03A0D1BD1FA3BE4BA3DF99
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e5:96:57:b8:8c:65:e4:9a:02:15:3a:65:30:ae:fc:b9:33:31:62:76:2d:40:24:cd:1a:16:97:d7:38:b7:56:35
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 21, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:19:da:dd:aa:8b:dc:44:b2:92:00:00:00:00:05:19
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 19, 2025 - Jun 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:321A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1a:a9:a0:1d:06:a0:0f:43:aa:00:01:00:00:02:1a
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
5456
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
NvAgent.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__register_onexit_function
_o__seh_filter_dll
memcpy
_o_free
__C_specific_handler
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
_CxxThrowException
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleFileNameA
GetModuleHandleExW
DisableThreadLibraryCalls
GetProcAddress
api-ms-win-core-synch-l1-1-0
OpenSemaphoreW
WaitForSingleObjectEx
CreateMutexExW
CreateSemaphoreExW
CreateEventA
ReleaseMutex
SetEvent
WaitForSingleObject
ReleaseSRWLockExclusive
ReleaseSemaphore
AcquireSRWLockExclusive
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-threadpool-legacy-l1-1-0
UnregisterWaitEx
api-ms-win-service-core-l1-1-0
RegisterServiceCtrlHandlerExW
SetServiceStatus
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
api-ms-win-core-util-l1-1-0
DecodePointer
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
vmsif
VmsIfInitializeEventServer
VmsIfShutdownEventServer
DllCanUnloadNow
ServiceMain
SvchostPushServiceGlobals
Name
.text
Size
24KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
200B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=45, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1121, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=21, id=261, version=33145,
count=1, id=256, version=33145,
count=4, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
OEMDefaultAssociations.dll
- SHA256 c10402250505adbf5976f197201053d43a22c511ed953a46c5602ef682b55137
- MD5 546ec5bc7b023226d7d5fe9b02189a02
- SHA1 58786a373d59fac9b2d4eb16494301634e4a9b52
- SHA512 6c7251027dca264c1abb1541ecfb461002f76e9494931d0e422957a61a19323ff7a828b48167da2b15b43379f0b53e7f7168c3b6ee789e0ad114156cadde1df5
- SSDEEP 192:RRWtMcIYWqX6bg4HuXyvLIvrlBrFEgow+1:7WnXWqX6kXyvcvrDFEgo
- TLSH T18803BDD18BD108D3E36799B62A03D89C13FBC07ECA986F54B112623EF515B3D47A7829
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
4KB
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
32KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=33138,
count=1, id=258, version=33138,
OmaDmAgent.dll
- IMPHASH 170f40bdf7df14594a949555bb9395e3
- SHA256 e7ce7513271dd46d7c3a7a09cebc051008e1e875be27eeaa7814ac7538a36ebd
- MD5 9d22a726d9382cd192717cb68d84d027
- SHA1 64309953b2d0b1bf362a7ec0aa88da38f68696da
- SHA512 446d78ebab1ee7e115fabea6e9807a676c4e812e17510ad16888dc29fb7f623c0cf198b5ab859fa02b147cb6af39a4b6865fa839ca096059d592f239cbc8ba16
- SSDEEP 3072:TTdLNhoB/5PTT0+Vci2n0BsW8oGUivwgIy8JWcBAJmkDqDcuT:TTdLNhoRpg+ii2n0B0oGJ8hNDx
- TLSH T113144B2EA2AD11B5D1B6D27CC6C30666FA733419172256EF02F0C1392F17BE8A939F15
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
6112
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
OmaDmAgent.pdb
msvcp110_win
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?id@?$codecvt@DDH@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_BADOFF@std@@3_JB
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Swap_all@_Container_base0@std@@QEAAXAEAU12@@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?_Add_vtordisp2@?$basic_ios@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Add_vtordisp1@?$basic_istream@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Getcat@?$codecvt@DDH@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDH@std@@QEBAHAEAHPEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?out@?$codecvt@DDH@std@@QEBAHAEAHPEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDH@std@@QEBAHAEAHPEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBGHH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Winerror_map@std@@YAPEBDH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?good@ios_base@std@@QEBA_NXZ
?_Xbad_alloc@std@@YAXXZ
msvcrt
wcsncmp
??0bad_cast@@QEAA@PEBD@Z
??1bad_cast@@UEAA@XZ
??0bad_cast@@QEAA@AEBV0@@Z
fclose
fwrite
fgetpos
_fseeki64
fsetpos
setvbuf
fflush
ungetc
fputc
fgetc
_wcsnicmp
wcstol
wcstoul
towlower
realloc
_wtoi
_snwprintf_s
toupper
wcscpy_s
memcpy
memmove
memset
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
__C_specific_handler
_initterm
free
_amsg_exit
_XcptFilter
_callnewh
malloc
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
_purecall
??3@YAXPEAX@Z
_wcsicmp
memcpy_s
_vsnwprintf
??_V@YAXPEAX@Z
__CxxFrameHandler4
_CxxThrowException
__CxxFrameHandler3
wcscmp
advapi32
RegQueryValueExW
CheckTokenMembership
EventWriteTransfer
RegGetValueW
RevertToSelf
RegEnumValueW
RegDeleteValueW
RegQueryInfoKeyW
RegOpenCurrentUser
ImpersonateLoggedOnUser
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
GetTokenInformation
GetLengthSid
CopySid
OpenThreadToken
OpenProcessToken
ConvertSidToStringSidW
RegEnumKeyExW
RegDeleteKeyExW
CreateProcessAsUserW
EventRegister
EventUnregister
EventSetInformation
TraceMessage
kernel32
OutputDebugStringW
WaitForSingleObjectEx
ReleaseSemaphore
CloseHandle
HeapAlloc
GetProcAddress
CreateMutexExW
LocalFree
WTSGetActiveConsoleSessionId
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
WideCharToMultiByte
DebugBreak
IsDebuggerPresent
GetLastError
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
SetLastError
HeapFree
CreateSemaphoreExW
GetModuleFileNameA
DisableThreadLibraryCalls
FormatMessageW
GetSystemDirectoryW
ReleaseMutex
GetCurrentThreadId
LocalAlloc
WaitForSingleObject
Sleep
GetModuleHandleExW
GetCurrentThread
CreateThread
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
DeleteFileW
RaiseException
CreateFileW
WriteFile
ExpandEnvironmentStringsW
SetEvent
OpenSemaphoreW
CreateEventW
ole32
CoInitializeEx
CLSIDFromString
CoUninitialize
CoCreateGuid
StringFromGUID2
CoTaskMemFree
CoCreateInstance
CoSetProxyBlanket
wtsapi32
WTSQueryUserToken
dmcmnutils
DmGetActiveUserSid
DmRevertToSelf
DmImpersonate
DmGetUserTokenFromSid
DmGetCurrentUserSid
OmaDmRegistryGetDWORD
omadmapi
ord34
ord44
dmenrollengine
GetFirstEnrollmentGuidOfTypes
GetEnrollmentSID
GetEnrollmentType
mdmregistration
UnregisterDeviceWithManagement
IsDeviceRegisteredWithManagement
mi
MI_Application_InitializeV1
oleaut32
SysAllocString
SysFreeString
rpcrt4
UuidToStringW
RpcStringFreeW
UuidFromStringW
shell32
SHGetSpecialFolderPathW
SHCreateDirectoryExW
SHGetFolderPathW
shlwapi
UrlUnescapeW
SHCreateStreamOnFileEx
sppc
SLGetSLIDList
SLClose
SLOpen
SLGetLicensingStatusInformation
SLGetProductSkuInformation
urlmon
IsValidURL
wsclient
WSLicenseOpen
WSLicenseClose
WSLicenseInstallLicense
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoInitialize
RoUninitialize
RoActivateInstance
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsDeleteString
WindowsCreateStringReference
WindowsGetStringRawBuffer
OmaDmRunPostSessionWork
ResourceManagerUninstallWmiApp
Name
.text
Size
128KB
Virtual Size
127KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
36KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
356B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33145,
count=5, id=259, version=33145,
count=266, id=1, productName=Unmarked objects,
count=45, id=257, version=33145,
count=11, id=261, version=33145,
count=1, id=256, version=33145,
count=22, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
OnDemandBrokerClient.dll
- IMPHASH 5b1b51d9e2624f906434f1f081391067
- SHA256 eb11a7fcf9cf6f32d8b840f66bb9e832c525d75b6200c52d08b6cdd0f34e843e
- MD5 4b974a73fdfb6432a26f751f35164fad
- SHA1 d5155b4e8395f5b68833d8f14a2441753445e392
- SHA512 1b1bf7b9db165b6eb4b3129c80f0e2876908956fd64533b08c7665d57aa8ae888a9bf222cfe01ae59c62b74f771709a88e10d787009404e08f3703655ab502d6
- SSDEEP 768:fOMTHvsBbouEKpbUDQwvJxlZSlz8olPMWVQkBc5YmN:mMTHvst9rpbkLvJxilxBVQkBc5YmN
- TLSH T1FE73075EB7A820D4E47AA17CC1530E2AE672FC2453111AEF43A0837D5F677D19A38F91
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
19056
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
OnDemandBrokerClient.pdb
msvcrt
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_callnewh
free
malloc
memcpy_s
wcscpy_s
_purecall
__CxxFrameHandler3
memset
rpcrt4
I_RpcMapWin32Status
RpcBindingFree
RpcBindingCreateW
NdrClientCall3
RpcBindingBind
I_RpcExceptionFilter
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleHandleExA
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-com-l1-1-0
CoCreateInstance
IIDFromString
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
oleaut32
SysFreeString
api-ms-win-core-synch-l1-1-0
InitializeCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EnterCriticalSection
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsCreateString
WindowsGetStringRawBuffer
api-ms-win-security-base-l1-1-0
GetTokenInformation
RevertToSelf
ImpersonateLoggedOnUser
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
ntdll
RtlSubscribeWnfStateChangeNotification
RtlCopySid
RtlLengthSid
RtlUnsubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
api-ms-win-appmodel-runtime-l1-1-0
GetPackagesByPackageFamily
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
CreateOnDemandBrokerClient
Name
.text
Size
28KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
604B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=36, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=14, id=260, version=33145,
count=4, id=259, version=33145,
count=67, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=6, id=261, version=33145,
count=1, id=256, version=33145,
count=10, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
OnDemandConnRouteHelper.dll
- IMPHASH 0e85dac486037eced088e7a5ae0f3a8e
- SHA256 fa6f0a14231217b3600ef176be5f0d35f99a5dcd8d359bc0f0d863bb2b2c1fef
- MD5 dfdc0df6408aafd76082d96a53897435
- SHA1 e53a39db0bec1e0444623082bc072726b3cc795b
- SHA512 487bb16a281c0fd590bc41a2463b945c65f19d8a9b069b5edb7483c2a59a666cb38a1ce7b2ecd1e4d7111710207bfbed9e9d3410f8fdd724d7f284ff5838d278
- SSDEEP 1536:4syyPHGRD/1AIhl1c+2/Y+vSNd6i9UnyeipTbpM/ZIfjfwiwYM3Frt7gcc:9PmZtTfRvddeGbpMm7fwiwYM3Vtcp
- TLSH T180A32B6EABA810E5E479E17EC5930A19E7B1F425531307EF0760826D1F23BE41F39BA1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
21008
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
OnDemandConnRouteHelper.pdb
msvcp_win
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o_malloc
__C_specific_handler
_CxxThrowException
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__cexit
_o__callnewh
__std_terminate
__CxxFrameHandler4
memcpy
api-ms-win-crt-string-l1-1-0
memset
ntdll
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
FreeLibrary
GetModuleHandleExW
GetModuleHandleW
GetModuleHandleExA
GetModuleFileNameA
GetProcAddress
api-ms-win-core-synch-l1-1-0
SetEvent
CreateEventW
ReleaseSemaphore
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionEx
CreateSemaphoreExW
EnterCriticalSection
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
WaitForSingleObject
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventSetInformation
EventRegister
EventUnregister
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoTaskMemFree
api-ms-win-core-threadpool-l1-2-0
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SetThreadpoolThreadMaximum
SubmitThreadpoolWork
CreateThreadpool
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks
CloseThreadpool
SetThreadpoolThreadMinimum
rpcrt4
Ndr64AsyncClientCall
NdrClientCall3
RpcExceptionFilter
RpcSsDestroyClientContext
RpcBindingSetOption
RpcAsyncCancelCall
RpcAsyncInitializeHandle
RpcBindingFromStringBindingW
RpcBindingFree
RpcAsyncCompleteCall
RpcStringBindingComposeW
RpcStringFreeW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
FreeInterfaceContextTable
GetInterfaceContextTableForHostName
OnDemandAddRouteRequest
OnDemandGetRoutingHint
OnDemandRegisterNotification
OnDemandRemoveMatchingRoute
OnDemandRemoveRouteRequest
OnDemandUnRegisterNotification
Name
.text
Size
44KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
520B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=54, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=21, id=261, version=33145,
count=1170, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=1, id=256, version=33145,
count=1, id=253, version=33145,
count=17, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
networkexplorer.dll
- IMPHASH d9893ecf499e29f3595b8a67c6fce31f
- SHA256 bc3fbf9b40771941742be85df32cc7699c4549af9831c602230cbd8273140313
- MD5 1a882b9cf7cd9dfcbd7f58e8438ce45c
- SHA1 8f02b021b274bae372118c7823b313169eb94ea4
- SHA512 1d49d09f174e9b5e246a77b42ef9bacfc5095c84ff194ded9ec9887c4f885391dac779d6844479fac916ac3274a4c385f62a61cee1f77bb144d851620f195928
- SSDEEP 1536:c1kLxNLXWSnbqUIQbfsoIRhpPbCXGhabkuDhRStye+PZyGA+jl1YFGOjXA:3LTzN2FIkkhstye+4GA+p1YFrjw
- TLSH T1CAB32A6D66E820D9E675A27CC5420A1AE371B420231257FF0BE0C2BE4F67BD46D3DB61
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
29984
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
NetworkExplorer.pdb
msvcrt
__CxxFrameHandler4
memcpy
_onexit
__dllonexit
_CxxThrowException
_lock
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_initterm
malloc
free
_amsg_exit
_XcptFilter
__C_specific_handler
_purecall
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
memcpy_s
_vsnwprintf
_unlock
memset
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-path-l1-1-0
PathIsUNCEx
api-ms-win-core-com-l1-1-0
PropVariantClear
CoUninitialize
CoInitializeEx
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-synch-l1-1-0
WaitForSingleObject
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseMutex
ReleaseSRWLockExclusive
CreateMutexExW
ReleaseSemaphore
CreateSemaphoreExW
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
LoadStringW
GetProcAddress
GetModuleHandleExW
GetModuleFileNameW
GetModuleHandleW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
OutputDebugStringA
DebugBreak
IsDebuggerPresent
api-ms-win-core-string-l1-1-0
CompareStringW
WideCharToMultiByte
oleaut32
VariantInit
VariantClear
SysAllocString
SafeArrayCreateVector
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventSetInformation
EventUnregister
EventActivityIdControl
EventRegister
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegCloseKey
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
kernel32
ActivateActCtx
FindActCtxSectionStringW
DeleteTimerQueueEx
QueryActCtxW
CreateActCtxW
CreateTimerQueueTimer
CreateTimerQueue
lstrcmpiW
DeactivateActCtx
ole32
CoAllowSetForegroundWindow
shlwapi
ord268
ord197
ord176
ord437
PathStripToRootW
SHStrDupW
ord219
ord388
ord199
ord267
shell32
ShellExecuteW
ord727
ord155
ord763
ord18
SHBindToFolderIDListParent
SHGetNameFromIDList
SHCreateDataObject
AssocCreateForClasses
SHCreateDefaultContextMenu
ord256
ord25
SHCreateDefaultExtractIcon
ShellExecuteExW
ord102
ord19
propsys
PSFormatForDisplay
VariantToPropVariant
ord408
PropVariantToVariant
PSGetPropertyFromPropertyStorage
PropVariantToStringAlloc
PSCreateMemoryPropertyStore
gdi32
DeleteObject
SelectObject
CreateCompatibleDC
CreateDIBSection
DeleteDC
user32
DestroyIcon
GetSystemMetrics
SetMenuItemInfoW
LoadMenuW
GetDC
RemoveMenu
DestroyMenu
GetSubMenu
ReleaseDC
SetMenuInfo
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
60KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
468B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=38, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=261, version=33145,
count=1, productName=Unmarked objects (old),
count=21, id=260, version=33145,
count=5, id=259, version=33145,
count=145, id=1, productName=Unmarked objects,
count=17, id=257, version=33145,
count=1, id=256, version=33145,
count=9, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
networkhelper.dll
- IMPHASH edb6f0988eb903221180aabd27e199cc
- SHA256 33b0f24722327f16a9aa3efa1fb86f32f4c5529c08f1e2dc56545553fcc9e2a5
- MD5 000911fcd771cadbb64cc1c203b5ac8c
- SHA1 5e848e8a2601d22a52c2a401242a005f87f53e7f
- SHA512 69d8b76b55690987728f6d87399ff5e216bb64c53881cdfc91df01affd1a44144da6cb5b73a53191059db8d0e9eda5df52d9e44c30f127e055baea652ce37310
- SSDEEP 3072:Wg/tUYuE1KCe+d1iXjnHa12n+5TzS8Eguc1c/dtpA:NRuE1RiXjnHa1c+iHW1c/
- TLSH T1CAE32B5A37A910B9E57EC23CC493851EE272B8645B21ABDF062182BC5F33BD07D39B51
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
8096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
NetworkHelper.pdb
msvcrt
_amsg_exit
__C_specific_handler
_strnicmp
_purecall
_initterm
swprintf_s
wcsncpy_s
_vsnwprintf
memcpy_s
__CxxFrameHandler3
__dllonexit
_onexit
_lock
memmove
_callnewh
malloc
memcmp
_wsplitpath_s
realloc
_XcptFilter
memcpy
free
_unlock
memset
ntdll
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlReportException
NtQuerySystemInformation
api-ms-win-core-com-l1-1-0
CoUninitialize
StringFromGUID2
CoCreateInstance
CoInitializeEx
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventWriteTransfer
EventRegister
EventSetInformation
api-ms-win-core-synch-l1-1-0
CreateSemaphoreExW
CreateMutexExW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
DeleteCriticalSection
AcquireSRWLockShared
InitializeCriticalSection
OpenSemaphoreW
ResetEvent
ReleaseSemaphore
WaitForSingleObject
ReleaseMutex
SetEvent
CreateEventW
EnterCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
ReleaseSRWLockShared
WaitForSingleObjectEx
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
RaiseException
SetLastError
UnhandledExceptionFilter
GetLastError
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-synch-l1-2-0
InitOnceComplete
SleepConditionVariableSRW
WakeAllConditionVariable
InitOnceBeginInitialize
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
OpenProcessToken
GetCurrentThreadId
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
GetTickCount64
GetSystemTime
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegNotifyChangeKeyValue
RegCreateKeyExW
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleHandleExA
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetModuleFileNameA
FreeLibrary
api-ms-win-core-file-l1-1-0
CreateFileW
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-kernel32-legacy-l1-1-0
RegisterWaitForSingleObject
umpdc
Pdcv2ActivationClientUnregister
Pdcv2ActivationClientRenewActivation
Pdcv2ActivationClientDeactivate
Pdcv2ActivationClientActivate
Pdcv2ActivationClientRegister
syncutil
ord9
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-threadpool-legacy-l1-1-0
UnregisterWaitEx
CHttpTransport_CreateInstance
CheckPdcRenewal
CreateControlChannelTriggerConnectionManager
GetOrCreateNullPowerDependencyCoordinatorManager
GetSerializedAppMetadata
InitializePowerDependencyCoordinatorManager
IsNetworkConnectionCostRestricted
ProgressStatus
ReleasePowerDependencyCoordinatorManager
ReportSyncProgress
SyncPdcReference_WatchdogReport
SyncPdcReference_WatchdogsEnabled
SyncWerReportComponentName
SyncWerReportGenerator
Name
.text
Size
84KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
184B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
624B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=64, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=17, id=260, version=33145,
count=172, id=1, productName=Unmarked objects,
count=9, id=257, version=33145,
count=1, id=256, version=33145,
count=18, id=264, version=33145,
count=6, id=261, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
networkitemfactory.dll
- IMPHASH c6d2427433f6e806451f4352758bf559
- SHA256 e85d19601561439d1f2ff6cb364a2a60e243e08057215ccab850b224f7779a09
- MD5 3d50f3d38b94dae9c6c12944db4a0f82
- SHA1 763dca3a8d283f84d2e7813e5f412656d101ba1d
- SHA512 108f6f68e7977f718680a6cf5ccb27aded16eba70371eea61819917911d38fad885d2f0771851fb146a68a6f829d62d0a800644b0080ae0264e188253ffd3670
- SSDEEP 1536:O6hb0bULoHqj38oripYhRjf+euumfRzh/laY:z6bZHqj3jyo+G2Rzh/F
- TLSH T1049306AE27F420A8F122517DCA974A8AD375F434235257EF03A0827E4F277E09E36B51
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5504
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
NetworkItemFactory.pdb
msvcrt
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
?what@exception@@UEBAPEBDXZ
wcstok_s
_vsnwprintf
_purecall
_CxxThrowException
__CxxFrameHandler3
memcpy
__CxxFrameHandler4
memmove
_XcptFilter
_amsg_exit
free
malloc
_initterm
__C_specific_handler
_lock
_unlock
__dllonexit
_onexit
?terminate@@YAXXZ
??0exception@@QEAA@AEBQEBD@Z
??1type_info@@UEAA@XZ
memset
ntdll
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
kernel32
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
QueryPerformanceCounter
Sleep
DisableThreadLibraryCalls
HeapFree
GetProcessHeap
HeapAlloc
GetLastError
GetTickCount
WaitForSingleObject
CreateTimerQueueTimer
CreateTimerQueue
LeaveCriticalSection
DeleteTimerQueueEx
GetProcAddress
GetModuleHandleW
GetSystemInfo
CompareStringW
GlobalAlloc
GlobalFree
GetCurrentThreadId
InitializeCriticalSection
CreateEventW
CloseHandle
SetEvent
DeleteCriticalSection
EnterCriticalSection
advapi32
GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
TraceMessage
ole32
CoUninitialize
CoInitializeEx
CoCreateInstance
CoTaskMemAlloc
CoMarshalInterface
CoGetInterfaceAndReleaseStream
PropVariantCopy
CoUnmarshalInterface
PropVariantClear
CoTaskMemFree
CoReleaseMarshalData
CoMarshalInterThreadInterfaceInStream
CoCreateFreeThreadedMarshaler
CoSetProxyBlanket
CLSIDFromString
CreateStreamOnHGlobal
user32
LoadStringW
shell32
SHChangeNotify
ord25
ord155
ord18
propsys
PropVariantToGUID
PropVariantToUInt32
PropVariantToStringAlloc
InitPropVariantFromStringVector
PSCreateMemoryPropertyStore
shlwapi
ord219
SHStrDupW
ord154
ord16
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
44KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
676B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=21, id=260, version=33136,
count=4, id=259, version=33136,
count=100, id=1, productName=Unmarked objects,
count=19, id=257, version=33136,
count=7, id=261, version=33136,
count=1, id=256, version=33136,
count=13, id=264, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
newdev.dll
- IMPHASH 32dd6ee2776aae5b4e959bf351e1352f
- SHA256 0cc3266a91cc07bea226acf8c10351302e8b3c54175dd7a221538d35f7594d58
- MD5 719b01dc3a1692752f5509549c10c02f
- SHA1 fe6ffb889c4ac8c4b6dfa4424ad0faa7a1cef0a8
- SHA512 76984e7f3d9165765f7105b3f35f6b0c8df1c8fa722f805277a8c38c4807a11eeced21578d049e3026fd7dceb41d831b60dea83c449f527f555a5d2f5e61afe4
- SSDEEP 6144:kHlTH0kbopKFZJn4X+POxJ06dIMetYCUMaRrliAIZ18oZDOvhYo2WLgDv:kHjxPOxVIYCUM8rliRZD1cgDv
- TLSH T1C674381D67ED14F5E877D23889478211E6B27434239252DF26A0CA3CAF17EE8A63DF11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
82736
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
newdev.pdb
msvcrt
memcpy
memmove
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
_callnewh
memcmp
memcpy_s
swscanf
wcsrchr
wcscpy_s
wcsnlen
wcsstr
_wcslwr
malloc
free
_wcsicmp
_resetstkoflw
_vsnprintf
iswctype
towupper
_purecall
__C_specific_handler
memmove_s
toupper
_vsnwprintf
wcschr
memset
ntdll
NtOpenThreadToken
NtQueryInformationToken
NtOpenProcessToken
NtDeleteValueKey
NtSetValueKey
NtQueryValueKey
NtQueryKey
NtCreateKey
NtOpenKey
RtlFreeUnicodeString
RtlFormatCurrentUserKeyPath
RtlGUIDFromString
NtClose
NtSetInformationFile
NtQueryInformationFile
RtlGetVersion
RtlNtStatusToDosErrorNoTeb
NtQuerySystemInformation
RtlMultiByteToUnicodeN
RtlMultiByteToUnicodeSize
RtlUnicodeToMultiByteN
RtlUnicodeToMultiByteSize
RtlInitUnicodeString
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WinSqmSetDWORD
RtlSetThreadErrorMode
WinSqmAddToStream
NtQueryInformationProcess
RtlInitUnicodeStringEx
RtlUpcaseUnicodeString
RtlNtStatusToDosError
RtlValidSid
DbgPrint
api-ms-win-core-errorhandling-l1-1-0
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
GetLastError
api-ms-win-core-sidebyside-l1-1-0
CreateActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
QueryActCtxW
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegEnumValueW
api-ms-win-core-file-l1-1-0
CreateDirectoryW
DeleteFileW
GetFileAttributesW
FindClose
FindNextFileW
FindFirstFileW
GetFullPathNameW
CompareFileTime
CreateFileW
SetFileAttributesW
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
LoadStringW
GetModuleHandleExW
LoadLibraryExA
GetModuleHandleExA
GetModuleFileNameW
GetProcAddress
DisableThreadLibraryCalls
FreeLibrary
api-ms-win-security-base-l1-1-0
CreateWellKnownSid
AllocateAndInitializeSid
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
FreeSid
GetTokenInformation
IsValidSid
GetLengthSid
AddAccessAllowedAceEx
DuplicateTokenEx
InitializeAcl
InitializeSecurityDescriptor
CheckTokenMembership
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringA
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventRegister
EventSetInformation
EventUnregister
api-ms-win-eventing-classicprovider-l1-1-0
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
TraceMessage
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
ReleaseSemaphore
LeaveCriticalSection
InitializeCriticalSectionEx
OpenSemaphoreW
AcquireSRWLockExclusive
CreateMutexExW
DeleteCriticalSection
CreateSemaphoreExW
ReleaseMutex
CreateEventW
ReleaseSRWLockExclusive
SleepEx
SetEvent
WaitForSingleObjectEx
ResetEvent
AcquireSRWLockShared
ReleaseSRWLockShared
CreateMutexW
WaitForSingleObject
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalReAlloc
LocalFree
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
MultiByteToWideChar
api-ms-win-core-processthreads-l1-1-0
GetCurrentThread
ProcessIdToSessionId
OpenProcessToken
CreateThread
SetThreadPriority
TerminateProcess
GetCurrentThreadId
SetPriorityClass
GetExitCodeThread
GetPriorityClass
GetCurrentProcess
GetCurrentProcessId
GetExitCodeProcess
GetThreadPriority
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFileExistsW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
GetWindowsDirectoryW
GetSystemTimeAsFileTime
GetTickCount
GetSystemWindowsDirectoryW
api-ms-win-core-processenvironment-l1-1-0
GetCommandLineW
ExpandEnvironmentStringsW
api-ms-win-core-com-l1-1-0
CoUninitialize
CoInitializeSecurity
CoCreateInstance
CoInitializeEx
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-wow64-l1-1-1
IsWow64Process2
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-wow64-l1-1-0
IsWow64Process
api-ms-win-shcore-obsolete-l1-1-0
CommandLineToArgvW
api-ms-win-devices-config-l1-1-1
CM_Get_DevNode_Status
CM_Query_And_Remove_SubTreeW
CM_Locate_DevNodeW
CM_Get_Class_PropertyW
CM_Set_DevNode_Registry_PropertyW
CM_Get_DevNode_Registry_PropertyW
CM_Set_DevNode_PropertyW
CM_MapCrToWin32Err
CM_Get_DevNode_PropertyW
api-ms-win-core-sysinfo-l1-2-0
GetNativeSystemInfo
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoUninitialize
RoInitialize
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
wofutil
WofIsExternalFile
WofSetFileDataLocation
kernel32
WaitForMultipleObjectsEx
GetTickCount64
LoadLibraryExW
DeviceIoControl
CompareStringW
FlushFileBuffers
GetFileInformationByHandle
LCMapStringW
MoveFileExW
GetFileSize
GetModuleFileNameA
GetCommandLineA
GetLocalTime
CreateFileMappingW
CreateHardLinkW
SetFilePointer
WideCharToMultiByte
OutputDebugStringW
WriteFile
MapViewOfFile
FileTimeToLocalFileTime
UnmapViewOfFile
SetEndOfFile
SetErrorMode
GetThreadLocale
HeapReAlloc
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-memory-l1-1-0
VirtualQuery
VirtualProtect
devrtl
DevRtlWriteTextLog
DevRtlGetThreadLogToken
DeviceInternetSettingUiW
DiInstallDevice
DiInstallDriverA
DiInstallDriverW
DiRollbackDriver
DiShowUpdateDevice
DiShowUpdateDriver
DiUninstallDevice
DiUninstallDriverA
DiUninstallDriverW
GetInternetPolicies
InstallLegacyDeviceDriver
InstallNewDevice
InstallSelectedDriver
InstallWindowsUpdateDriver
InstallWindowsUpdateDriverEx
InstallWindowsUpdateDrivers
QueryWindowsUpdateDriverStatus
SetDriverPackageRestorePoint
SetInternetPolicies
UpdateDriverForPlugAndPlayDevicesA
UpdateDriverForPlugAndPlayDevicesW
pDiDoDeviceInstallAsAdmin
pDiDoNullDriverInstall
pDiRunFinishInstallOperations
Name
.text
Size
240KB
Virtual Size
239KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
64KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
668B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=74, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=16, id=260, version=33145,
count=5, id=259, version=33145,
count=481, id=1, productName=Unmarked objects,
count=11, id=257, version=33145,
count=2, id=261, version=33145,
count=1, id=256, version=33145,
count=50, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
ngccredprov.dll
- IMPHASH d1dc7f50a218924ae4385d36cef40fb1
- SHA256 7186e515c091fe8b93493734de027580337a420b88628e54350abba2ac06c799
- MD5 d71741918b9cc85ef65d2f6aa7bbcaf3
- SHA1 c3c43e3fdec2cec3c132ae7b7fdd704d4ad9ec41
- SHA512 46675db05154070f6815fe49fa240d09322bce1cf5d5f88e3018874a4550c85ca87094283983e49ba9cf5155ea04ad3e21fafc15db46af9ead8f2dc7344cf197
- SSDEEP 12288:ifrIvV7taHGALbasVo/HP/jg1GAEYQN9p60:csVpYGMbSvjAGAxS9p60
- TLSH T1D4E4492972E84194E1BBC27CCAA345EAEA723C1057319ECF015065695E3FFE4973AB31
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
174256
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ngccredprov.pdb
msvcp_win
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ
??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z
?do_length@?$codecvt@GDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBD1_K@Z
?do_unshift@?$codecvt@GDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
?_Incref@facet@locale@std@@UEAAXXZ
?do_always_noconv@?$codecvt@GDU_Mbstatet@@@std@@MEBA_NXZ
?do_max_length@?$codecvt@GDU_Mbstatet@@@std@@MEBAHXZ
?do_encoding@?$codecvt@GDU_Mbstatet@@@std@@MEBAHXZ
?do_in@?$codecvt@GDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
?do_out@?$codecvt@GDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__wcserror
_o__wcsicmp
_o__wcsnicmp
memmove
_o_abort
_o_free
_o_iswascii
_o_iswcntrl
_o_iswdigit
_o_iswlower
_o_iswprint
_o_iswpunct
_o_iswspace
_o_iswupper
_o_malloc
_o_memcpy_s
_o_terminate
_o_wcsncpy_s
__C_specific_handler
__CxxFrameHandler3
__current_exception
__current_exception_context
_CxxThrowException
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o__execute_onexit_table
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o__errno
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
wcsstr
wcschr
api-ms-win-crt-string-l1-1-0
wcsnlen
strcmp
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetProcAddress
SizeofResource
DisableThreadLibraryCalls
LoadStringW
GetModuleHandleExW
LoadResource
FindResourceExW
GetModuleFileNameA
FreeLibrary
LockResource
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObject
LeaveCriticalSection
InitializeSRWLock
ReleaseMutex
ReleaseSemaphore
CreateEventW
TryAcquireSRWLockExclusive
EnterCriticalSection
WaitForSingleObjectEx
DeleteCriticalSection
OpenSemaphoreW
CreateMutexExW
CreateSemaphoreExW
ReleaseSRWLockShared
InitializeCriticalSectionEx
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
RaiseException
SetLastError
GetLastError
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
CompareStringEx
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventWriteTransfer
EventUnregister
EventActivityIdControl
EventRegister
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceExecuteOnce
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-security-base-l1-1-0
GetLengthSid
EqualSid
CopySid
GetTokenInformation
IsValidSid
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount64
GetTickCount
GetComputerNameExW
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-security-sddl-l1-1-0
ConvertStringSidToSidW
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegCloseKey
RegDeleteTreeW
RegSetValueExW
RegCreateKeyExW
RegGetValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegDeleteValueW
RegUnLoadKeyW
RegOpenCurrentUser
RegLoadKeyW
RegFlushKey
api-ms-win-core-com-l1-1-0
CoUninitialize
CoInitializeEx
CoTaskMemFree
CoTaskMemAlloc
CoGetMalloc
api-ms-win-core-file-l1-1-0
CompareFileTime
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
rpcrt4
UuidIsNil
RpcExceptionFilter
NdrClientCall3
UuidFromStringW
UuidCreate
RpcBindingCreateW
RpcBindingBind
RpcStringFreeW
RpcBindingFree
UuidToStringW
api-ms-win-security-credentials-l1-1-0
CredUnmarshalCredentialW
CredFree
CredIsMarshaledCredentialW
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-libraryloader-l2-1-0
QueryOptionalDelayLoadedAPI
api-ms-win-security-lsalookup-l1-1-0
LookupAccountNameLocalW
LookupAccountSidLocalW
api-ms-win-security-lsapolicy-l1-1-0
LsaFreeMemory
LsaQueryInformationPolicy
LsaClose
LsaLookupSids2
LsaOpenPolicy
api-ms-win-security-lsalookup-l1-1-2
LsaLookupUserAccountType
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
ntdll
RtlNtStatusToDosError
RtlInitString
RtlIsMultiUsersInSessionSku
RtlFreeAnsiString
RtlInitUnicodeString
RtlUnicodeStringToAnsiString
RtlUnsubscribeWnfStateChangeNotification
NtQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlPublishWnfStateData
RtlNtStatusToDosErrorNoTeb
RtlIsMultiSessionSku
RtlGetPersistedStateLocation
NtQueryKey
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
420KB
Virtual Size
417KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
148KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
24KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
912B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
68KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=114, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=18, id=260, version=33145,
count=5, id=259, version=33145,
count=1550, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=32, id=261, version=33145,
count=1, id=256, version=33145,
count=204, id=264, version=33145,
count=2, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
ngckeyenum.dll
- IMPHASH 066f4610f2bd9e8d8055e6123d0e1216
- SHA256 2f302d679cec0e3032579cb8bf440af705b6ecb09ce4daee1d219c3ef9b277ab
- MD5 0f46fbfac135aed59164fd68d6da8941
- SHA1 690925c4df432e26a08c7157d35bd501a2444826
- SHA512 d8583a65b12bd9fe48388f7d552056fc4a19a85da43ca07dd85530748dfe2865f2c337f493b42ba334b848fec301e7139c3b143fb97c18ee49892a1b6ef23789
- SSDEEP 3072:ZOrJN5XXxENKFxq55gBtEnDMOtpV/Pd6zpka1ndQlTEu678Y5PnVq++Fgigm:MJN5XXekk/gcnQGbFU3Vq++FJ
- TLSH T167441A2A23F809B8F9B7967989B38505E67278251731D6CF0290C07D1E37ED4E939F62
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
6160
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ngckeyenum.pdb
msvcp_win
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o___stdio_common_vswprintf
memmove
_o__wcserror
_o__wcsnicmp
_o_free
_o_malloc
_o_memcpy_s
_o_wcsncpy_s
__C_specific_handler
_CxxThrowException
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
__CxxFrameHandler3
wcsstr
api-ms-win-crt-string-l1-1-0
memset
wcsnlen
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetModuleFileNameA
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
CreateSemaphoreExW
ReleaseSemaphore
InitializeCriticalSectionEx
WaitForSingleObject
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
InitializeSRWLock
CreateEventW
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetLastError
RaiseException
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
OpenProcessToken
GetCurrentThread
OpenThreadToken
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
CompareStringEx
CompareStringOrdinal
WideCharToMultiByte
api-ms-win-security-base-l1-1-0
GetLengthSid
GetTokenInformation
CopySid
IsValidSid
DuplicateTokenEx
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventRegister
EventWriteTransfer
EventSetInformation
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoGetMalloc
CoTaskMemAlloc
CoCreateInstance
StringFromGUID2
CoInitializeEx
CoUninitialize
api-ms-win-core-heap-obsolete-l1-1-0
LocalSize
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegLoadKeyW
RegQueryInfoKeyW
RegOpenCurrentUser
RegCloseKey
RegEnumKeyExW
RegUnLoadKeyW
ntdll
RtlGetPersistedStateLocation
RtlNtStatusToDosError
RtlInitString
NtQueryKey
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-file-l1-1-0
CompareFileTime
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
NgcCredProvEnumLogonKeys
NgcCredProvFreeBuffer
NgcCredProvInvalidateLogonKeysCache
NgcSerializeConvenienceCredential
NgcSerializeConveniencePasswordChangeCredential
NgcSerializeKeyCredential
NgcSerializeKeyPasswordChangeCredential
NgcSerializeKeySspiCredential
NgcSerializeMsaPasswordCredential
NgcSerializePasswordCredential
NgcSerializeSmartCardCredential
Name
.text
Size
160KB
Virtual Size
157KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
64KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
448B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
624B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=76, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33145,
count=5, id=259, version=33145,
count=1299, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=25, id=261, version=33145,
count=1, id=256, version=33145,
count=39, id=264, version=33145,
count=2, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
ngcksp.dll
- IMPHASH 56a262485d3d9247790774115ff8e216
- SHA256 f33c028a899cf91966c260adedad749163bc71c7e3fcd56d14a85b2bf5304507
- MD5 329b10edba6f85c39cc2bc640e955654
- SHA1 bda5366bfda47a9c488f9f2a4db65e24fe53dcaa
- SHA512 d0bfaa550981df71774c90faa3501352c893df01236135ac94e3886468a7a7eaa482965ed792063b4245fbafbee5a900be8b651cf2947910d5854a099bef25f7
- SSDEEP 3072:R2KHda1s1TtvhXGfFkOHCpKWQehJj4iGQrFh:5a1wTtvZGfUps2N4iG2
- TLSH T1C804197EA2A901FAE5BAD27DD9D74927F7713454035242CF0650423D0E2BFE8AA3DB60
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
8464
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ngcksp.pdb
msvcp_win
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsicmp
_o_free
_o_malloc
_CxxThrowException
_o__callnewh
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___stdio_common_vswprintf
__C_specific_handler
__CxxFrameHandler4
memmove
__std_terminate
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
wcscmp
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleW
GetModuleFileNameA
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
DeleteCriticalSection
AcquireSRWLockShared
CreateEventW
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseMutex
WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection
ReleaseSemaphore
EnterCriticalSection
CreateSemaphoreExW
CreateMutexExW
InitializeSRWLock
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapSize
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
rpcrt4
RpcAsyncCancelCall
RpcAsyncInitializeHandle
RpcBindingBind
RpcBindingCreateW
RpcBindingFree
UuidFromStringW
RpcExceptionFilter
Ndr64AsyncClientCall
NdrClientCall3
RpcAsyncCompleteCall
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventRegister
EventSetInformation
EventUnregister
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
ncrypt
NCryptEncrypt
NCryptFreeObject
NCryptImportKey
NCryptOpenStorageProvider
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
ConvertStringSidToSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-security-base-l1-1-0
GetLengthSid
CopySid
IsValidSid
api-ms-win-ntuser-ie-message-l1-1-0
MsgWaitForMultipleObjects
DispatchMessageW
TranslateMessage
PeekMessageW
GetKeyStorageInterface
Name
.text
Size
104KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
48KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
808B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=52, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=22, id=261, version=33145,
count=1175, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=1, id=256, version=33145,
count=10, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
ngclocal.dll
- IMPHASH 27663684d7732648c68444e638815275
- SHA256 07f988d7b2ca9ab319efa2538dbf49b8c4016be90c170771ab2e97187471ae41
- MD5 8f9ed4446433efad72f87fcac5fafb7b
- SHA1 a8a5367c70a2390a3f48e56f35d7a63ed34a18cf
- SHA512 67861e0f5c5dc7638b8d968e4f4146cc54cdc5f552d079c6d49d9e3cf628acd2ec179491c8b4a51e04c9a1452b98289d02e60282b80d55456f6e270260328a9e
- SSDEEP 1536:NNpHRwMyH4SIfhXgLuJONwi7u26WXkxgzz1skcaZ82qFKJioNDW3OjeHa1Dh7jn:bp00ApNJy2tUx+mjIJiADVjA8h7j
- TLSH T14DD34C7D3AAD10A5E07AD17CC5924A09E7B270A503126BEF069080BD1F5BFD87D39F91
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
9664
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ngclocal.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o_malloc
__C_specific_handler
_o___stdio_common_vswprintf
_CxxThrowException
_o__cexit
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__callnewh
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
api-ms-win-core-synch-l1-1-0
CreateMutexExW
AcquireSRWLockExclusive
InitializeSRWLock
ReleaseSRWLockExclusive
WaitForSingleObjectEx
DeleteCriticalSection
CreateSemaphoreExW
InitializeCriticalSectionEx
ReleaseMutex
AcquireSRWLockShared
WaitForSingleObject
OpenSemaphoreW
ReleaseSemaphore
LeaveCriticalSection
ReleaseSRWLockShared
EnterCriticalSection
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
RaiseException
GetLastError
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-eventing-provider-l1-1-0
EventActivityIdControl
EventSetInformation
EventUnregister
EventWriteTransfer
EventRegister
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
Sleep
api-ms-win-core-heap-obsolete-l1-1-0
LocalSize
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
rpcrt4
RpcExceptionFilter
RpcBindingFree
RpcBindingBind
RpcBindingCreateW
NdrClientCall3
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
api-ms-win-security-base-l1-1-0
GetLengthSid
IsValidSid
CopySid
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
NgcLocalAddCredential
NgcLocalAddCredentialSilent
NgcLocalChangeCredential
NgcLocalFindCredential
NgcLocalRemoveCredential
Name
.text
Size
76KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=53, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=21, id=261, version=33145,
count=1165, id=1, productName=Unmarked objects,
count=2, id=257, version=33145,
count=1, id=256, version=33145,
count=10, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
ngcpopkeysrv.dll
- IMPHASH 9fc9c4b6e7d04ba7af3695b4813c7d8d
- SHA256 8c255fe5e592fb5880d56b1812c48cdcb411d6f060bb1b6340984900dd1ebd8f
- MD5 947cd3fdf886f116cff4ecd49b1eff7c
- SHA1 efdf377800bd11aa54e2237505b18f60245d7545
- SHA512 fea2e48160fc195c87200da7808bf17d42e8a9042ed2fe1afb33995c656ce519129bafb26cc0eda96a37a418b7a2c72763c99b86d993d31097d5c27498fef0e0
- SSDEEP 6144:jGSwfbbFlpPaMk4Vkcyk4jJycAEHj/icZYZ5ZA9:jGhfbbJTkMR3ED/103
- TLSH T1B044183D22D90AB5E4B7917CDDD38606F5B278660732CADF0251016D0E2BFEC993AB52
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
18592
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ngcpopkeysrv.pdb
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__itow
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o_malloc
_o_terminate
__std_terminate
__C_specific_handler
__current_exception
__current_exception_context
_CxxThrowException
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o__crt_atexit
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
wcscmp
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockShared
CreateEventW
OpenSemaphoreW
ResetEvent
InitializeSRWLock
InitializeCriticalSectionAndSpinCount
ReleaseSRWLockExclusive
CreateMutexExW
AcquireSRWLockShared
DeleteCriticalSection
ReleaseMutex
SetEvent
WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection
OpenEventW
ReleaseSemaphore
EnterCriticalSection
AcquireSRWLockExclusive
WaitForSingleObjectEx
CreateSemaphoreExW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
RaiseException
SetLastError
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventActivityIdControl
EventWriteTransfer
EventSetInformation
EventRegister
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringOrdinal
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
LocalReAlloc
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
ntdll
RtlMakeSelfRelativeSD
RtlPublishWnfStateData
NtQuerySystemInformation
RtlIsMultiSessionSku
api-ms-win-core-registry-l1-1-0
RegEnumValueW
RegCloseKey
RegEnumKeyExW
RegCreateKeyExW
RegOpenKeyExW
RegGetValueW
RegDeleteValueW
RegDeleteKeyExW
RegQueryInfoKeyW
RegSetValueExW
api-ms-win-security-base-l1-1-0
GetSecurityDescriptorLength
api-ms-win-core-com-l1-1-0
CoInitializeEx
CoCreateInstance
CoUninitialize
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-sysinfo-l1-2-0
GetSystemFirmwareTable
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
NgcGetPregenKey
NgcPregenKey
NgcTriggerTask
s_NgcCreateTokenBindingAik
s_NgcDecryptWithSymmetricGcmPopKey
s_NgcDecryptWithSymmetricPopKey
s_NgcDeleteSymmetricPopKeyTransportKey
s_NgcDeleteTokenBindingAik
s_NgcEncryptWithSymmetricGcmPopKey
s_NgcEncryptWithSymmetricPopKey
s_NgcGetKeyAttestationForContainerService
s_NgcGetPregenKeyState
s_NgcGetPregenUserKey
s_NgcGetSymmetricPopKeyTransportKey
s_NgcGetSymmetricPopKeyTransportKeyName
s_NgcGetTokenBindingAikName
s_NgcImportSymmetricPopKey
s_NgcRenewKeyAttestation
s_NgcSignWithSymmetricPopKey
s_NgcVerifyWithSymmetricPopKey
Name
.text
Size
172KB
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
416B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
596B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=76, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=11, id=260, version=33145,
count=5, id=259, version=33145,
count=1361, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=28, id=261, version=33145,
count=1, id=256, version=33145,
count=82, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
ngcrecovery.dll
- IMPHASH e0e41b809cda95fdc341951f8515520d
- SHA256 93372f7dc7878c3eb6f018a5bbbb06d5bad2e6c111443032832439a5c3490f67
- MD5 9534da178a1c1d5c3af73b5bf94d70f8
- SHA1 ce4f17c8010f6d66215a91c30431c457d76a61c6
- SHA512 3505a0b8c284d89848377371b8e53afc80ce16a062d9b5ccc27a9afca69d7c94a2c1e455d74fe5ce3d1d718e2e3cf3beb58598a3f2ca114a070ed7232be135e5
- SSDEEP 3072:eX40fs06ha+uteBWsGBbKzkFAp8pOP7ssOp+u7Io72UY2Cmv3DlDN2W6z:c400hha+IeBW3DFS85sOlIUCm/RDN7
- TLSH T18E442A3D63D90DB5E4B6C17DCAD34607E2B278115732C6EF069141AE0E2BFE8A939B11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
19936
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
NgcRecovery.pdb
msvcp_win
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?in@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
?_Incref@facet@locale@std@@UEAAXXZ
?do_always_noconv@?$codecvt@GDU_Mbstatet@@@std@@MEBA_NXZ
?do_max_length@?$codecvt@GDU_Mbstatet@@@std@@MEBAHXZ
?do_encoding@?$codecvt@GDU_Mbstatet@@@std@@MEBAHXZ
?do_in@?$codecvt@GDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
_Query_perf_counter
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
_Query_perf_frequency
?do_out@?$codecvt@GDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
?do_unshift@?$codecvt@GDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Xbad_function_call@std@@YAXXZ
?do_length@?$codecvt@GDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBD1_K@Z
??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xlength_error@std@@YAXPEBD@Z
??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ
?_Xout_of_range@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__malloc_base
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__wcsicmp
memmove
_o_free
_o_malloc
_o_strncpy_s
_o_strtol
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
__CxxFrameHandler3
_CxxThrowException
_o__free_base
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
strrchr
strchr
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
strcmp
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExA
GetModuleHandleExW
GetModuleHandleW
GetModuleFileNameA
GetProcAddress
winhttp
WinHttpOpen
WinHttpSendRequest
WinHttpQueryDataAvailable
WinHttpAddRequestHeaders
WinHttpConnect
WinHttpOpenRequest
WinHttpReadData
WinHttpCloseHandle
WinHttpReceiveResponse
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
DeleteCriticalSection
LeaveCriticalSection
CreateSemaphoreExW
AcquireSRWLockShared
InitializeCriticalSectionEx
CreateEventExW
ReleaseSemaphore
CreateEventW
InitializeSRWLock
ReleaseSRWLockExclusive
ResetEvent
SetEvent
WaitForSingleObject
CreateMutexExW
AcquireSRWLockExclusive
InitializeCriticalSectionAndSpinCount
ReleaseSRWLockShared
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseMutex
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
RaiseException
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
rpcrt4
RpcBindingFree
NdrClientCall3
RpcBindingBind
RpcExceptionFilter
RpcBindingCreateW
RpcStringFreeW
UuidToStringW
UuidFromStringW
UuidCreate
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateStringReference
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoGetActivationFactory
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventActivityIdControl
EventWriteTransfer
EventSetInformation
EventUnregister
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
Sleep
crypt32
CertCloseStore
CryptExportPublicKeyInfoEx
CryptStringToBinaryW
CryptStringToBinaryA
CryptBinaryToStringA
CryptBinaryToStringW
CertCreateCertificateContext
CertGetEnhancedKeyUsage
CertGetCertificateChain
CertFreeCertificateContext
CertAddCertificateContextToStore
CertVerifyCertificateChainPolicy
CertOpenStore
CertFindCertificateInStore
CertFreeCertificateChain
bcrypt
BCryptDestroyKey
BCryptEncrypt
BCryptGenRandom
BCryptGenerateSymmetricKey
api-ms-win-core-com-l1-1-0
CoWaitForMultipleHandles
CoInitializeEx
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoUninitialize
CoTaskMemAlloc
ntdll
NtQuerySystemInformation
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW
ConvertSidToStringSidW
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegOpenKeyExW
RegCloseKey
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
RegEnumKeyExW
RegDeleteTreeW
ncrypt
NCryptOpenStorageProvider
NCryptFreeObject
NCryptEncrypt
NCryptImportKey
NCryptOpenKey
NCryptGetProperty
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-security-base-l1-1-0
IsValidSid
EqualSid
GetTokenInformation
GetLengthSid
CopySid
api-ms-win-security-lsalookup-l1-1-0
LookupAccountSidLocalW
api-ms-win-security-lsapolicy-l1-1-0
LsaFreeMemory
LsaOpenPolicy
LsaLookupSids2
LsaClose
api-ms-win-core-file-l1-1-0
CompareFileTime
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-security-lsalookup-l1-1-2
LsaLookupUserAccountType
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
umpdc
Pdcv2ActivationClientRenewActivation
Pdcv2ActivationClientActivate
Pdcv2ActivationClientDeactivate
Pdcv2ActivationClientUnregister
Pdcv2ActivationClientRegister
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
NgcGetPinRecoveryParams
NgcIsPinRecoveryEnabled
NgcProtectPinRecoverySecret
NgcRecoverPin
NgcRecoverPinSilent
NgcRecoverPinSilentWithToken
NgcVerifyPinRecoverySecret
Name
.text
Size
160KB
Virtual Size
158KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
820B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=110, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33145,
count=5, id=259, version=33145,
count=1427, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=35, id=261, version=33145,
count=1, id=256, version=33145,
count=78, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
ngcsvc.dll
- IMPHASH a4fc6cc422bca59eceb651d1a5d8232d
- SHA256 b34fe113f8f075eff30b191374e145d17c10b9b24bef0b8ba364dc9fa09c3480
- MD5 c6595477c33ed09159a325b233c8f8d1
- SHA1 acdae04bfc32f0416057f2b9b7b62f64f0c4f047
- SHA512 664b5b248e53ad2529e13d9da680eb3346e5348f7183184d6864e9aa6d4e5bcab40b4ce12685259391e83d6aa2e7ea33d317acef1908034d1f33bfcb66e4a479
- SSDEEP 12288:2gCRbV2N6hEa9NPEOaXSrNZESzYEZ8fcozjA9NsqMDX9hE1QN9abtKj+E:kPk+DuJcjEbEi3A9yx9h6Q8tKj
- TLSH T15C455C2E62EC01E9F4FAD1B8CAA74557EA717821573189CF0050857D0E7BFE49E3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
345520
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ngcsvc.pdb
msvcp_win
_Mtx_destroy_in_situ
_Mtx_init_in_situ
?_Xbad_function_call@std@@YAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ
??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z
?do_length@?$codecvt@GDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBD1_K@Z
?do_unshift@?$codecvt@GDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?do_out@?$codecvt@GDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
?do_in@?$codecvt@GDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
?do_encoding@?$codecvt@GDU_Mbstatet@@@std@@MEBAHXZ
?do_max_length@?$codecvt@GDU_Mbstatet@@@std@@MEBAHXZ
?do_always_noconv@?$codecvt@GDU_Mbstatet@@@std@@MEBA_NXZ
?_Incref@facet@locale@std@@UEAAXXZ
?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?setf@ios_base@std@@QEAAHHH@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?width@ios_base@std@@QEAA_J_J@Z
?_Xlength_error@std@@YAXPEBD@Z
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?_Throw_Cpp_error@std@@YAXH@Z
?flags@ios_base@std@@QEBAHXZ
?width@ios_base@std@@QEBA_JXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?good@ios_base@std@@QEBA_NXZ
?uncaught_exception@std@@YA_NXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG0@Z
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
_Mtx_lock
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
_Mtx_unlock
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
??Bid@locale@std@@QEAA_KXZ
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGXZ
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__get_errno
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__wcsicmp
_o__wcsicmp_l
_o__wcsnicmp
memmove
_o_free
_o_iswascii
_o_iswcntrl
_o_iswdigit
_o_iswlower
_o_iswpunct
_o_iswspace
_o_iswupper
_o_ldexp
_o_malloc
_o_memcpy_s
_o_terminate
_o_wcsncpy_s
_o_wcstoull
__C_specific_handler
__CxxFrameHandler3
__current_exception
__current_exception_context
_CxxThrowException
_o__free_locale
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__execute_onexit_table
_o__errno
_o__difftime64
_o__crt_atexit
_o__create_locale
_o__configure_narrow_argv
_o__cexit
_o__callnewh
memcpy
memcmp
wcsstr
__std_terminate
__CxxFrameHandler4
_o__wcserror
api-ms-win-crt-string-l1-1-0
wcscmp
memset
strncmp
wcsnlen
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
GetModuleFileNameA
LoadLibraryExA
GetProcAddress
LoadStringW
GetModuleHandleW
GetModuleHandleExA
DisableThreadLibraryCalls
GetModuleHandleExW
api-ms-win-core-synch-l1-1-0
OpenEventW
CreateEventExW
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
ReleaseSRWLockExclusive
ResetEvent
InitializeSRWLock
ReleaseSRWLockShared
WaitForSingleObject
CreateEventW
InitializeCriticalSectionEx
LeaveCriticalSection
TryAcquireSRWLockExclusive
CreateMutexExW
ReleaseSemaphore
SetEvent
EnterCriticalSection
ReleaseMutex
OpenSemaphoreW
AcquireSRWLockShared
CreateSemaphoreExW
AcquireSRWLockExclusive
DeleteCriticalSection
api-ms-win-core-heap-l1-1-0
HeapSize
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetLastError
UnhandledExceptionFilter
RaiseException
GetLastError
SetUnhandledExceptionFilter
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolCleanupGroup
TrySubmitThreadpoolCallback
WaitForThreadpoolTimerCallbacks
CreateThreadpoolCleanupGroup
CloseThreadpoolTimer
SetThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetPriorityClass
CreateProcessAsUserW
SetPriorityClass
TerminateProcess
SetThreadToken
OpenProcessToken
GetCurrentThreadId
GetCurrentThread
GetCurrentProcess
OpenThreadToken
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
CompareStringEx
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventWriteTransfer
EventUnregister
EventRegister
EventActivityIdControl
api-ms-win-core-file-l1-1-0
CompareFileTime
GetLongPathNameW
CreateFileW
FindNextFileW
ReadFile
FindFirstFileW
WriteFile
FindClose
api-ms-win-security-base-l1-1-0
GetTokenInformation
ImpersonateLoggedOnUser
DuplicateToken
FreeSid
GetLengthSid
AdjustTokenPrivileges
EqualSid
AccessCheck
DuplicateTokenEx
CopySid
IsValidSid
RevertToSelf
AllocateAndInitializeSid
MapGenericMask
IsWellKnownSid
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTime
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetVersionExW
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegLoadKeyW
RegGetValueW
RegQueryInfoKeyW
RegOpenCurrentUser
RegFlushKey
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteTreeW
RegSetValueExW
RegDeleteKeyExW
RegDeleteValueW
RegUnLoadKeyW
RegEnumKeyExW
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
SystemTimeToFileTime
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-core-com-l1-1-0
CoTaskMemFree
StringFromGUID2
CoTaskMemRealloc
CoGetMalloc
CoTaskMemAlloc
CLSIDFromString
CoCreateInstance
CoInitializeEx
CoUninitialize
CoCreateGuid
StringFromCLSID
api-ms-win-core-processthreads-l1-1-1
OpenProcess
IsProcessorFeaturePresent
api-ms-win-core-memory-l1-1-0
ReadProcessMemory
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-core-processthreads-l1-1-3
GetProcessInformation
api-ms-win-security-base-l1-2-0
CheckTokenMembershipEx
CheckTokenCapability
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-sysinfo-l1-2-0
GetSystemFirmwareTable
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-registry-l1-1-1
RegDeleteKeyValueW
RegSetKeyValueW
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoUninitialize
RoInitialize
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsCreateStringReference
WindowsCreateString
WindowsGetStringRawBuffer
api-ms-win-core-kernel32-legacy-l1-1-0
WTSGetActiveConsoleSessionId
UnregisterWait
api-ms-win-core-heap-obsolete-l1-1-0
LocalSize
api-ms-win-shcore-obsolete-l1-1-0
CommandLineToArgvW
ntdll
RtlGetPersistedStateLocation
NtQueryKey
NtQueryInformationToken
RtlGetDeviceFamilyInfoEnum
RtlHashUnicodeString
RtlQueryPackageIdentity
RtlDeriveCapabilitySidsFromName
RtlNtStatusToDosError
RtlUnicodeStringToAnsiString
RtlUnsubscribeWnfStateChangeNotification
RtlFreeAnsiString
NtQuerySystemInformation
RtlPublishWnfStateData
RtlInitAnsiString
NtQueryInformationProcess
RtlSubscribeWnfStateChangeNotification
RtlInitUnicodeString
NtQueryWnfStateData
RtlIsMultiSessionSku
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-core-io-l1-1-1
CancelIo
api-ms-win-core-io-l1-1-0
DeviceIoControl
GetOverlappedResult
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
NgcServiceMain
SvchostPushServiceGlobals
Name
.text
Size
856KB
Virtual Size
854KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
324KB
Virtual Size
321KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
40KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=96, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=23, id=260, version=33145,
count=5, id=259, version=33145,
count=1646, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=33, id=261, version=33145,
count=1, id=256, version=33145,
count=157, id=264, version=33145,
count=2, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
ngctasks.dll
- IMPHASH 3a09ecefde126de768f259ea19a65401
- SHA256 6bf4ea963daa8265c63455bc0f7b64ef23c282979d0b248890edc7cd6178c2fc
- MD5 5d612d0026720b466e47f45664be8782
- SHA1 2ece3a81b3acb5a98d43881fea6d86a20aa1075f
- SHA512 315aa86ef269e1e8c3335379168d9f60bad12203893bfa76c7b666c2340b24a205b6add4dcdad63930573e9f6075a023cda9924a9d216cb219a906d2d33fdcfb
- SSDEEP 3072:hYqYtlq0arWerkriUmW6pSzclgLw+p83E/26V1St:8tlbWBrAinW6pSz4CO3E/26V
- TLSH T1D834183D36DD01B5F476917CC9D2461BE5B2346213328AEF0691427D0E2BFE8A939F62
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
23728
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ngctasks.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsdup
memmove
_o_free
_o_malloc
_o_terminate
__CxxFrameHandler3
__current_exception
__current_exception_context
_CxxThrowException
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
wcsrchr
wcschr
__C_specific_handler
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventRegister
EventUnregister
EventActivityIdControl
EventWriteTransfer
api-ms-win-core-libraryloader-l1-2-0
FreeLibraryAndExitThread
GetModuleFileNameA
GetModuleHandleExW
FreeLibrary
LoadStringW
GetModuleHandleW
GetProcAddress
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
EnterCriticalSection
WaitForSingleObjectEx
DeleteCriticalSection
ReleaseSRWLockExclusive
ResetEvent
CreateSemaphoreExW
LeaveCriticalSection
InitializeCriticalSectionEx
CreateEventW
ReleaseMutex
OpenSemaphoreW
WaitForSingleObject
AcquireSRWLockShared
SetEvent
CreateMutexExW
ReleaseSRWLockShared
ReleaseSemaphore
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
GetLastError
SetLastError
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
WindowsCreateString
WindowsGetStringRawBuffer
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoUninitialize
CoInitializeEx
CoTaskMemFree
CoTaskMemAlloc
api-ms-win-core-shutdown-l1-1-0
InitiateSystemShutdownExW
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegDeleteKeyExW
RegDeleteTreeW
RegEnumKeyExW
RegQueryValueExW
RegOpenKeyExW
RegDeleteValueW
RegEnumValueW
RegGetValueW
RegCreateKeyExW
RegCloseKey
RegQueryInfoKeyW
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
OpenProcessToken
GetCurrentProcessId
ResumeThread
CreateThread
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringOrdinal
ntdll
RtlPublishWnfStateData
NtQuerySystemInformation
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
oleaut32
SysAllocString
SysFreeString
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-file-l1-1-0
CompareFileTime
api-ms-win-core-datetime-l1-1-1
GetDateFormatEx
GetTimeFormatEx
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
SystemTimeToFileTime
crypt32
CryptExportPublicKeyInfoEx
CertCreateCertificateContext
CertFreeCertificateContext
CryptDecodeObjectEx
ncrypt
NCryptOpenStorageProvider
NCryptSetProperty
NCryptFreeObject
NCryptImportKey
NCryptGetProperty
NCryptOpenKey
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
ngcpopkeysrv
NgcPregenKey
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-security-base-l1-1-0
AdjustTokenPrivileges
api-ms-win-core-sysinfo-l1-2-0
GetSystemFirmwareTable
devobj
DevObjEnumDeviceInterfaces
DevObjDestroyDeviceInfoList
DevObjCreateDeviceInfoList
DevObjGetClassDevs
DevObjOpenDevRegKey
DevObjEnumDeviceInfo
api-ms-win-security-lsalookup-l2-1-0
LookupPrivilegeValueW
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
bcrypt
BCryptHash
profapi
ord104
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetRetryTimeStamp
NgcTriggerTaskForOobe
SetAikTimeTrigger
Name
.text
Size
136KB
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
56KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
588B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=111, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=15, id=260, version=33145,
count=5, id=259, version=33145,
count=1373, id=1, productName=Unmarked objects,
count=4, id=257, version=33145,
count=27, id=261, version=33145,
count=1, id=256, version=33145,
count=69, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
ngcutils.dll
- IMPHASH c55116d29a13c8dd6eb720994136c017
- SHA256 b113641733a3c68ce951cb93540b3cad730776a8b00fff0f56bf0e6305d7ea51
- MD5 e3b156bee15dd2f06abe4c2f75bd666f
- SHA1 382529cee41cfcd94cafd260a720066e59497267
- SHA512 ff421964445630e8f7e8784e88c8ff1f64dbe7ea8a019a6e5b6b4318ded57297d16c6f5a1f4455fd326f58f37fe5158da5eb42bc49b8de6f150800f28b409989
- SSDEEP 12288:KFbGi5dH5KkAuzZv3iC9r2Mec5BVpbrl:KFbGi5dlz13iTlc5BrJ
- TLSH T1B4C45E2EB1AC03E5D0BAD17D8E578507FAB13429133165DF4290C2752F2BEE4AA7EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
20992
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ngcutils.pdb
msvcp_win
_Mtx_destroy_in_situ
_Mtx_init_in_situ
?_Xbad_function_call@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
_Cnd_wait
_Cnd_broadcast
_Cnd_destroy_in_situ
_Cnd_init_in_situ
_Mtx_unlock
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_lock
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__wcsicmp
memmove
_o_abort
_o_free
_o_iswspace
_o_malloc
_o_strncpy_s
_o_strtol
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
__CxxFrameHandler3
_CxxThrowException
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
__std_terminate
__CxxFrameHandler4
memchr
memcmp
memcpy
strchr
strrchr
__std_type_info_compare
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetModuleHandleW
LoadStringW
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleExW
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
CreateSemaphoreExW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
CreateEventW
ReleaseSRWLockShared
SetEvent
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSemaphore
ReleaseSRWLockExclusive
LeaveCriticalSection
InitializeCriticalSectionEx
ReleaseMutex
WaitForSingleObject
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
RaiseException
GetLastError
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
SetThreadpoolTimer
TrySubmitThreadpoolCallback
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
CompareStringOrdinal
api-ms-win-core-com-l1-1-0
CoGetClassObject
CLSIDFromString
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
CoTaskMemFree
api-ms-win-security-base-l1-1-0
GetTokenInformation
EqualSid
GetLengthSid
CopySid
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-security-sddl-l1-1-0
ConvertStringSidToSidW
ConvertSidToStringSidW
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventRegister
EventUnregister
EventWriteTransfer
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InterlockedFlushSList
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
rpcrt4
RpcStringFreeW
UuidToStringW
RpcRevertToSelfEx
RpcImpersonateClient
UuidCreate
ntdll
RtlUnicodeStringToAnsiString
RtlInitUnicodeString
RtlFreeAnsiString
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegGetValueW
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegDeleteTreeW
RegCloseKey
RegEnumKeyExW
sspicli
LsaLookupAuthenticationPackage
LsaConnectUntrusted
SspiLocalFree
LsaDeregisterLogonProcess
api-ms-win-security-lsalookup-l1-1-2
LsaLookupUserAccountType
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
api-ms-win-security-lsalookup-l1-1-0
LookupAccountSidLocalW
LookupAccountNameLocalW
api-ms-win-security-lsapolicy-l1-1-0
LsaOpenPolicy
LsaLookupSids2
LsaFreeMemory
LsaClose
api-ms-win-core-file-l1-1-0
CompareFileTime
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
GetRestrictedErrorInfo
SetRestrictedErrorInfo
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsDuplicateString
WindowsCreateString
WindowsCreateStringReference
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-synch-l1-2-0
WakeByAddressSingle
WaitOnAddress
api-ms-win-security-credentials-l1-1-0
CredFree
CredUnmarshalCredentialW
CredIsMarshaledCredentialW
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
oleaut32
GetErrorInfo
SysFreeString
SetErrorInfo
SysStringLen
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
DllCanUnloadNow
DllGetClassObject
NgcAreCacheTypeApiFlagsValid
NgcAreNCryptCacheTypeApiFlagsValid
NgcAreStringsEqual
NgcBuildDefaultDecryptionKeyNameString
NgcBuildKeyNameString
NgcCallerIsAppContainer
NgcCoMemAllocCopy
NgcCoMemResourceStringAllocCopy
NgcDeviceLockIsEnforcementPending
NgcGetAttestationStatement
NgcGetAuthPackageId
NgcGetCallerAppContainerSid
NgcGetCallerSid
NgcGetCryptoRegistryLocation
NgcGetNCryptBinaryBlob
NgcGetSmartCardReaderAndContainerName
NgcGetUserNameAndDomain
NgcGetUserSid
NgcIsCertTrustEnabled
NgcIsCloudTrustEnabled
NgcIsConsumerUser
NgcIsInsecureTpm
NgcIsPolicyEnabled
NgcIsPostLogonCachingDisabled
NgcPackGestureCollectionInputSerializationBuffer
NgcSetBioProtectorUpdateNeeded
NgcSetNCryptBoolProperty
NgcSetNCryptDwordProperty
NgcSetNCryptUiPolicy
NgcSetNCryptWindowHandle
NgcUnpackGestureCollectionInputSerializationBuffer
NgcUnpackNegotiateInputSerializationBuffer
Name
.text
Size
416KB
Virtual Size
413KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
76KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
216B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=120, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=14, id=260, version=33145,
count=5, id=259, version=33145,
count=1517, id=1, productName=Unmarked objects,
count=7, id=257, version=33145,
count=32, id=261, version=33145,
count=1, id=256, version=33145,
count=77, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
ninput.dll
- IMPHASH 4c4a3eeea493801ab043ed7e3902ae5b
- SHA256 fe15951b2eb20bbe2cad14d8149fdd19fec3435a94af345db4f7896654c60b9e
- MD5 6aff6016b2d2ce4e8d4df7a5001e0f7c
- SHA1 546dfda4c7addad5719e889a86b97cd711ae9e7d
- SHA512 5c98fd663427d76bd4e8e590e31b9902b0435e12d8f903e2aa26d8d15b2f9e495dbadfb123271af37d8415f34a93daec473c3cdddc45044a928495d5cd4026be
- SSDEEP 12288:jnttdGqKpACZwl5ov8dPp68DMHV9RWZx+GV4:jgqKp1xoPqV964GV
- TLSH T1B0B47D4AB6B815E9D17B903C8557D61FE6713816132186CF03A086BD6F37EE8263B722
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
281888
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ninput.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__stricmp
memmove
_o__wcsicmp
_o__wcsnicmp
_o_atan2
_o_atan2f
_o_ceil
_o_cosf
_o_floor
_o_floorf
_o_fmod
_o_fmodf
_o_free
_o_log
_o_malloc
_o_pow
_o_powf
_o_rand
_o_realloc
_o_sinf
_o_sqrt
_o_sqrtf
_o_strtok_s
_o_strtoul
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_CxxThrowException
wcschr
wcsrchr
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
wcscmp
wcsncmp
memset
api-ms-win-core-sidebyside-l1-1-0
QueryActCtxSettingsW
api-ms-win-core-atoms-l1-1-0
GlobalDeleteAtom
GlobalAddAtomW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
OpenProcessToken
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount64
GetTickCount
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameW
GetModuleHandleExW
GetProcAddress
GetModuleFileNameA
GetModuleHandleW
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
InitOnceBeginInitialize
Sleep
InitOnceComplete
api-ms-win-core-synch-l1-1-0
WaitForSingleObject
ReleaseSemaphore
EnterCriticalSection
LeaveCriticalSection
ReleaseSRWLockExclusive
CreateSemaphoreExW
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseMutex
InitializeCriticalSectionEx
ReleaseSRWLockShared
CreateMutexExW
AcquireSRWLockShared
InitializeCriticalSection
AcquireSRWLockExclusive
DeleteCriticalSection
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-registry-l1-1-0
RegEnumKeyExW
RegCloseKey
RegGetValueW
RegOpenKeyExW
RegQueryValueExW
RegEnumValueW
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-core-wow64-l1-1-0
IsWow64Process
oleaut32
VariantClear
VariantInit
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
ntdll
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
EtwEventSetInformation
EtwEventWriteTransfer
EtwEventUnregister
RtlCompareUnicodeString
RtlNtStatusToDosErrorNoTeb
RtlAllocateHeap
RtlInitUnicodeString
NtQueryInformationToken
RtlFreeHeap
ZwUpdateWnfStateData
EtwEventRegister
EtwEventActivityIdControl
EtwGetTraceLoggerHandle
api-ms-win-core-largeinteger-l1-1-0
MulDiv
api-ms-win-rtcore-ntuser-window-l1-1-0
SendMessageW
PostMessageW
SendMessageTimeoutW
SendMessageCallbackW
RegisterClassExW
UnregisterClassW
GetClassNameW
GetMessageTime
api-ms-win-rtcore-ntuser-wmpointer-l1-1-0
GetPointerDeviceProperties
GetPointerCursorId
GetPointerPenInfoHistory
GetPointerDeviceRects
GetPointerTouchInfoHistory
GetPointerType
GetPointerInfo
GetPointerTouchInfo
GetPointerPenInfo
GetPointerDevice
GetPointerInfoHistory
api-ms-win-rtcore-ntuser-wmpointer-l1-1-2
GetWindowFeedbackSetting
api-ms-win-rtcore-ntuser-winevent-l1-1-0
SetWinEventHook
UnhookWinEvent
api-ms-win-rtcore-ntuser-private-l1-1-7
IsOneCoreTransformMode
api-ms-win-rtcore-ntuser-private-l1-1-9
ord2551
InputSpaceRegionFromPoint
ord2651
GetPointerDeviceInputSpace
api-ms-win-rtcore-ntuser-private-l1-1-4
ord2595
api-ms-win-crt-math-l1-1-0
_finite
_isnan
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
AddPointerInteractionContext
BufferPointerPacketsInteractionContext
CreateInteractionContext
DefaultInputHandler
DestroyInteractionContext
GetCrossSlideParameterInteractionContext
GetHoldParameterInteractionContext
GetInertiaParameterInteractionContext
GetInteractionConfigurationInteractionContext
GetMouseWheelParameterInteractionContext
GetPropertyInteractionContext
GetStateInteractionContext
GetTapParameterInteractionContext
GetTranslationParameterInteractionContext
ProcessBufferedPacketsInteractionContext
ProcessInertiaInteractionContext
ProcessPointerFramesInteractionContext
RegisterOutputCallbackInteractionContext
RegisterOutputCallbackInteractionContext2
RemovePointerInteractionContext
ResetInteractionContext
SetCrossSlideParametersInteractionContext
SetHoldParameterInteractionContext
SetInertiaParameterInteractionContext
SetInteractionConfigurationInteractionContext
SetMouseWheelParameterInteractionContext
SetPivotInteractionContext
SetPropertyInteractionContext
SetTapParameterInteractionContext
SetTranslationParameterInteractionContext
StopInteractionContext
Name
.text
Size
380KB
Virtual Size
377KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
72KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
776B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=83, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1288, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33145,
count=5, id=259, version=33145,
count=24, id=261, version=33145,
count=1, id=256, version=33145,
count=106, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
nlaapi.dll
- IMPHASH b024b05ac6806c73416f41c5df415ac0
- SHA256 6d3047f76f61f7be9ea7ecb1afa4f39343045d0989bf1aa2058076f303db951c
- MD5 06ec9320771525d8327b059863621529
- SHA1 24dd1119caa3e198bfc86752936d5c53b3267c5b
- SHA512 9f35cff08e7fb25eb9674012508d189693298c14c729d18aec651d6b38d9cb970f56b0d2218828276f494a9b35f1863741f1b2ca78590e1a3f0f1a1f3abbd893
- SSDEEP 768:b86GTveqkucWuhWLUXOrPkTcwtr5P+CrD:b86Gp92hWwObkAwB5P+CX
- TLSH T1BB333A58A7A904EDF176817ED5A31F1AE9B1BC21536247DB432041AD1F33FD43A38BA2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
6352
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
nlaapi.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___stdio_common_vswprintf
_o__cexit
_o__configure_narrow_argv
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__seh_filter_dll
memcpy
_o_free
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__C_specific_handler
__std_terminate
__CxxFrameHandler4
_CxxThrowException
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExA
GetModuleHandleExW
DisableThreadLibraryCalls
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
rpcrt4
RpcMgmtInqServerPrincNameW
RpcBindingSetOption
RpcBindingFromStringBindingW
NdrClientCall3
RpcStringBindingComposeW
I_RpcExceptionFilter
RpcBindingFree
RpcStringFreeW
RpcBindingSetAuthInfoW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
NlaGetCaptivePortalHosts
NlaIndicateReprobe
Name
.text
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
236B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1108, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=20, id=261, version=33145,
count=1, id=256, version=33145,
count=1, id=253, version=33145,
count=9, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
nlansp_c.dll
- IMPHASH 8bef64bfc001dd09bcf1670ffd7cc500
- SHA256 5d1bb56d1904010a87f3e930ffd593c8e573bde354ae75e34a789dfc95332d3c
- MD5 8a0b85027f2552a734a43d5290456b65
- SHA1 8232f1730d6b53bb6b776bbc901d31d3d73f2d82
- SHA512 729abe0036297a6edc8f9419853560e2a7aa4061d2ff77a2898c39cdf12c1bf7b54ba1cdc62341131c771b96f22fa074a4de1468f716b857371904f6b8d2c20a
- SSDEEP 3072:zyAS78y5DzheEmrWwOHL1SUsB6Od4nh6c0wH8:eAS/5D6WwOr1SRE9nh67
- TLSH T1BDD3292EB2AE10B5E079D17CC9834A16D7B27065532217EF02A0C1B91F57FE86D3DB51
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
8160
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
nlansp_c.pdb
msvcp_win
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o_malloc
_o_terminate
__current_exception
__current_exception_context
__CxxFrameHandler3
_CxxThrowException
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__cexit
_o__callnewh
__std_type_info_compare
__C_specific_handler
__std_terminate
__CxxFrameHandler4
__C_specific_handler_noexcept
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
ntdll
NtSetIoCompletion
RtlDllShutdownInProgress
RtlUnsubscribeWnfStateChangeNotification
NtQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
NtQueueApcThread
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetModuleHandleW
FreeLibrary
GetProcAddress
GetModuleHandleExW
GetModuleHandleExA
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
SetLastError
SetUnhandledExceptionFilter
api-ms-win-core-synch-l1-1-0
CreateSemaphoreExW
CreateMutexExW
ReleaseSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObjectEx
ReleaseMutex
ReleaseSemaphore
DeleteCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
OpenSemaphoreW
CreateEventExW
InitializeCriticalSectionEx
SetEvent
ResetEvent
TryAcquireSRWLockExclusive
WaitForSingleObject
InitializeSRWLock
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventUnregister
EventSetInformation
EventRegister
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegCreateKeyExW
RegOpenCurrentUser
RegNotifyChangeKeyValue
RegCloseKey
RegGetValueW
RegEnumValueW
RegDeleteValueW
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
SubmitThreadpoolWork
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks
CloseThreadpool
TrySubmitThreadpoolCallback
CreateThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SetThreadpoolThreadMaximum
SetThreadpoolThreadMinimum
CreateThreadpool
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
rpcrt4
RpcBindingFromStringBindingW
RpcStringBindingComposeW
NdrClientCall3
RpcExceptionFilter
RpcBindingFree
RpcStringFreeW
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllMain
NSPStartup
Name
.text
Size
80KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
352B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=48, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=1192, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=26, id=261, version=33145,
count=1, id=256, version=33145,
count=1, id=253, version=33145,
count=9, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
nlhtml.dll
- IMPHASH 49e44b6dcc4524b36fa3f2a9d40d1de5
- SHA256 ec793cc5afa75222bc33d1d6f4b30e2c707d17c5790d30ae54a2f3be669f4a75
- MD5 57e2b6629541c66d72237f9484081152
- SHA1 92d28028522d3d7a6233bc40bd978b751cb01c9b
- SHA512 edebac64755a2158b98e6bc953d3d299d8f1022a11a6d13b29a3c5a22a1b5518407b3c09a38b457d8c8215fb5dedfe78bd4233badee511fc3974a707c856e371
- SSDEEP 6144:G1oFB/YUU96ewVCM8dqfbrRCCTZ/7XRY2oDTN2lGTM+P2vaSEG:G1qrUoCM8IYGGAtcG
- TLSH T18854185AB7E80CA1FDB7903DC5938505D77778610760DBDF0290826AAE2FBD4E934B22
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
0b:28:92:f2:4e:f7:36:9c:a1:3d:d1:9c:72:34:af:ab:ae:53:f1:86:fa:4b:71:01:b7:c6:d6:a7:0b:cd:4f:4d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:651A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:15:18:03:d3:81:07:26:7c:53:00:01:00:00:02:15
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
85216
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
nlhtml.pdb
msvcp_win
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-string-l1-1-0
memset
wcsncmp
wcscmp
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o__wcslwr_s
_o__wcsnicmp
_o__wcsupr
_o__wtoi
_o__wtol
_o_abort
_o_bsearch
_o_free
_o_iswalpha
_o_iswdigit
_o_iswspace
_o_malloc
_o_realloc
_o_terminate
_o_towupper
_o_wcstoul
__C_specific_handler
__current_exception
__current_exception_context
__CxxFrameHandler3
_CxxThrowException
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o__crt_atexit
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__configure_narrow_argv
_o__cexit
_o__callnewh
wcsrchr
wcschr
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
LoadLibraryExW
DisableThreadLibraryCalls
GetModuleFileNameA
GetProcAddress
GetModuleHandleW
LoadResource
FreeLibrary
FindResourceExW
LoadStringW
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
InitializeCriticalSectionEx
EnterCriticalSection
ReleaseMutex
ReleaseSRWLockExclusive
CreateEventW
AcquireSRWLockExclusive
WaitForSingleObjectEx
ReleaseSemaphore
ResetEvent
SetEvent
WaitForSingleObject
OpenSemaphoreW
ReleaseSRWLockShared
CreateSemaphoreExW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
GetLocaleInfoW
IsDBCSLeadByteEx
FormatMessageW
GetCPInfo
IsValidCodePage
FormatMessageA
GetLocaleInfoEx
GetSystemDefaultLCID
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
CompareStringW
MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte
api-ms-win-core-sysinfo-l1-1-0
GetSystemTime
GetVersionExW
GetVersionExA
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventRegister
EventWriteTransfer
EventUnregister
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
oleaut32
SysStringLen
SysAllocString
SetErrorInfo
SysFreeString
SysAllocStringLen
VarR8FromStr
api-ms-win-core-localization-l1-2-2
LCIDToLocaleName
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegEnumKeyExW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
api-ms-win-core-memory-l1-1-0
CreateFileMappingW
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
api-ms-win-core-file-l1-1-0
SetEndOfFile
CreateFileW
GetFileSize
SetFilePointer
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-processenvironment-l1-1-0
SearchPathW
api-ms-win-core-localization-obsolete-l1-2-0
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
144KB
Virtual Size
142KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
76KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=68, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=14, id=260, version=33145,
count=5, id=259, version=33145,
count=1197, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=31, id=261, version=33145,
count=1, id=256, version=33145,
count=38, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
nlmgp.dll
- IMPHASH d00b0f513bc39e2dc7460486ebb69fa4
- SHA256 a8ac58bc17f3f4c0094dda9bbd88557c75ceb9880e347f00532b52b474302f8f
- MD5 d4342964d7816d755f38421145c20928
- SHA1 48e0e068e9650ea4cb18c15aab33adf3f7640685
- SHA512 34c9ae0f5e916a5317197b8867d9e8c007776d69f29913afa31bcabdae93a266c4a4536328094914ac746c955af9f272f2f610b70a90d54d7b80f3fe249e8df3
- SSDEEP 6144:rJzYDK5lYNItr8b2vHGEIVwCFdPX/mZZZi5/mHC:r5/gb2v2uC
- TLSH T160143A5D72A8207AC4659238C5820725D772BC341B1253DF31E8B27E9F73AE5AE34F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5824
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
nlmgp.pdb
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-string-l1-1-0
wcsspn
wcspbrk
memset
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
memcpy
_o__wcsicmp
_o__wcsnicmp
_o_free
_o_malloc
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_CxxThrowException
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__execute_onexit_table
_o__errno
wcschr
__C_specific_handler
wcsrchr
_o__crt_atexit
__std_terminate
__CxxFrameHandler4
_o__configure_narrow_argv
__C_specific_handler_noexcept
memcmp
advapi32
TraceMessage
RegCloseKey
RegQueryValueExW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
UnregisterTraceGuids
RegisterTraceGuidsW
kernel32
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
DecodePointer
EncodePointer
LoadLibraryExA
VirtualAlloc
GetCurrentProcess
VirtualFree
ReleaseActCtx
ExpandEnvironmentStringsW
LocalFree
CompareStringOrdinal
DisableThreadLibraryCalls
DeleteCriticalSection
InitializeCriticalSection
FindResourceExW
LoadResource
SizeofResource
MultiByteToWideChar
lstrcmpiW
OutputDebugStringA
QueryActCtxW
GetModuleFileNameW
CreateActCtxW
FindActCtxSectionStringW
LoadLibraryW
ActivateActCtx
LoadLibraryExW
DeactivateActCtx
SetLastError
FreeLibrary
GlobalFree
GlobalAlloc
GetLastError
RaiseException
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleExW
HeapFree
GetProcAddress
GetModuleHandleW
HeapAlloc
GetProcessHeap
GetCurrentThreadId
FormatMessageW
EnumResourceNamesW
user32
UnregisterClassA
EndDialog
DrawFocusRect
DrawIconEx
GetSysColor
SetWindowPos
GetClientRect
GetSystemMetrics
LoadImageW
CopyIcon
InvalidateRect
MessageBoxW
CallWindowProcW
MessageBeep
GetKeyState
SetFocus
PostMessageW
GetDlgItemTextW
GetWindowTextLengthW
SetDlgItemTextW
DialogBoxParamW
CreateIconIndirect
GetActiveWindow
GetIconInfo
GetDC
ReleaseDC
CharNextW
RegisterClipboardFormatW
GetWindowLongPtrW
SetWindowLongPtrW
IsDlgButtonChecked
SendMessageW
EnableWindow
GetDlgItem
ShowWindow
CheckRadioButton
GetParent
DestroyIcon
LoadBitmapW
LoadIconW
LoadStringW
gdi32
ExtTextOutW
SetBkColor
CreateBitmapIndirect
SetDIBits
CreateCompatibleBitmap
GetBitmapBits
GetDIBits
GetObjectW
DeleteObject
ole32
StringFromGUID2
CoTaskMemFree
CoCreateInstance
CoSetProxyBlanket
IIDFromString
CoCreateGuid
CoTaskMemRealloc
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
StringFromCLSID
CoTaskMemAlloc
oleaut32
SysFreeString
SysAllocString
VariantClear
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
VariantInit
VarUI4FromStr
shlwapi
SHAutoComplete
SHStrDupW
PathFindExtensionW
SHDeleteEmptyKeyW
shell32
ExtractIconExW
gdiplus
GdipCreateFromHDC
GdipDisposeImage
GdipSetSmoothingMode
GdipDrawImageRectI
GdipCloneImage
GdipGetImageThumbnail
GdipCreateBitmapFromFileICM
GdipCreateHICONFromBitmap
GdiplusStartup
GdipAlloc
GdipFree
GdipDeleteGraphics
GdiplusShutdown
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
96KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
52KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
656B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=15, id=260, version=33145,
count=5, id=259, version=33145,
count=24, id=261, version=33145,
count=1272, id=1, productName=Unmarked objects,
count=21, id=257, version=33145,
count=1, id=256, version=33145,
count=24, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
nlmproxy.dll
- IMPHASH 0c06645148dc364192d5ed56fa3e5676
- SHA256 5b79cd9157d930f8b110241545ca0ef50a6e6d60cbe7e1c54584b95352c205be
- MD5 0e41b62f99a4d2b5733fb4b0821fcc8e
- SHA1 253e966232ef3e869101e10307f98c3043e460c5
- SHA512 40a5f24a42b27d3e5ce73902b5ce738d0eafe57a03df4caa71d1734cec81aaf2bc284195ddb28ee7bf36763bade81d3617cc3a43854c188780f8078f4d965fc5
- SSDEEP 384:CXUbnT7w7T/xCpCcMCF8oSrF3FG81N1Vi2WksW21c:CEb47T/xCpCXCF8fDGqN1Viss
- TLSH T18D33A488BE4918E6D4798235845F0E34A22DED815BD683CB16E4326D1F7ABC09B71FC5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5056
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
nlmproxy.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
__C_specific_handler
_o___std_type_info_destroy_list
api-ms-win-crt-string-l1-1-0
memset
oleaut32
BSTR_UserUnmarshal
BSTR_UserSize64
BSTR_UserMarshal
BSTR_UserSize
BSTR_UserUnmarshal64
BSTR_UserFree
BSTR_UserFree64
BSTR_UserMarshal64
rpcrt4
NdrDllGetClassObject
NdrDllRegisterProxy
NdrDllUnregisterProxy
IUnknown_QueryInterface_Proxy
NdrOleFree
NdrStubCall3
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
NdrDllCanUnloadNow
NdrStubForwardingFunction
NdrOleAllocate
api-ms-win-core-com-midlproxystub-l1-1-0
NdrProxyForwardingFunction3
ObjectStublessClient19
ObjectStublessClient14
ObjectStublessClient12
ObjectStublessClient16
ObjectStublessClient11
ObjectStublessClient13
ObjectStublessClient7
ObjectStublessClient10
ObjectStublessClient17
NdrProxyForwardingFunction6
ObjectStublessClient9
ObjectStublessClient15
ObjectStublessClient8
NdrProxyForwardingFunction5
ObjectStublessClient18
NdrProxyForwardingFunction4
ObjectStublessClient20
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo
Name
.text
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=31, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1123, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=4, id=259, version=33145,
count=11, id=261, version=33145,
count=1, id=256, version=33145,
count=2, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
nlmsprep.dll
- IMPHASH 5f9d7e641cb1b7221ea615e31fabb885
- SHA256 2a40cd3b7d75740a0dc1f074e00deb097a70163a9421a87c98cc27b57f6338af
- MD5 473bd4304b28b6975c3672efdc06a7c8
- SHA1 afd1d2c3ca06e81f86ad37b33e3845e242087725
- SHA512 9f4eda923e4e8233a686127eb82a794af7f1a2e4faca52df0bc74e068fa4b20797cbfafb8a24ec78808e2fa0acc175e6c51c8e91fd7c46d141b0a49d1d581ae1
- SSDEEP 384:NSummax6BDoKODo1eVktlQVkiGssJQHuHJylqL0a+gW47WDqW:tVJEEPH2qF+gW4U
- TLSH T1C823D82A67E62869F5B6467C84F2135F9135F830173296FF06A0403D4D37BE4A635F8A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5088
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
nlmsprep.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___stdio_common_vswprintf
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
__C_specific_handler
_o___std_type_info_destroy_list
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
GetModuleHandleW
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegSetValueExW
RegCloseKey
RegDeleteTreeW
RegEnumKeyExW
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
api-ms-win-core-file-l1-1-0
DeleteFileW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-sysinfo-l1-1-0
GetSystemWindowsDirectoryW
GetSystemTimeAsFileTime
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
NetworkListManager_Generalize
Name
.text
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
636B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=39, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1111, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=17, id=261, version=33145,
count=1, id=256, version=33145,
count=3, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
nlsbres.dll
- SHA256 2fedabc8b3e9b851961e2f805f8fa8f86a26933394feb5de8ceafab689f102f9
- MD5 c98c1cf08bac578ebb830e74a9d33b17
- SHA1 d2cd2a6a34e93467e4cd513f62c7636278515cde
- SHA512 c60512b9424c3a75ccaf6a466255f898667b55efa4f5eaeca89e7311c0ce3b727be426718743182a30c9f07a98e77ff1ea089d4823eccb988bf290cbe33f6069
- SSDEEP 1536:bON4hEL5weIGxmORZ8/2uso2aU1Z3Yjb2Ag81Obn3EDfsPs9zl:bORTIjm8uuso2aU/3YjbO81Obn3ELs+h
- TLSH T17EA3E911ABF8AA49FAF39B71AEB190515E37FE963D34850E1240460D4A71B48DC7CB3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
be:e2:65:18:96:53:01:6f:52:f4:08:c7:86:9f:80:f9:bf:b4:f9:2f:b4:8c:ec:cf:a0:9f:06:a1:f9:7b:34:ec
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 19, 2025
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:a7:04:3e:e4:22:c8:34:fa:fc:00:00:00:00:04:a7
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2024 - Sep 11, 2025
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:3605-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:f7:58:20:75:04:ca:fb:c2:f4:00:01:00:00:01:f7
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
4KB
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
84KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=33140,
count=1, id=258, version=33140,
nmwcdclsx64.dll
- IMPHASH bcfcdb876f4eca57994e1844f79faf36
- SHA256 acbb67b1ea17e8062aae97dfa67bd5fef9d0de2fa7e9ee7ff47be569fe0ac243
- MD5 11e3b7ce5cc1c5421be1a075b6eb816f
- SHA1 9b324a60b02ac98d13350eea775b8d381f085131
- SHA512 c5904812fd11c1c6fb349d19340e7016a5cae15a29667a2ce1410e9623e8a8ba6637db68ac14613d945d1c81e9f608ad845e1a1443b15b1bf67a4c9d8a71fe5a
- SSDEEP 1536:50hHmNba95u19nVuwrIUluYHdkexcn+nWah2:5qH+bI5uXnV6UluYHGexcnoB
- TLSH T1E063386537A050B9C02A827DC8E28B59F672BC0143B702CF4774967AAF637D5A63E731
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
16724
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
c:\projects\drivers\samsung\ccdriver_combinedmode\Builds\bin\fre_samsung_internal\fre\amd64\nmwcdclsx64.pdb
setupapi
SetupDiGetDeviceRegistryPropertyA
CM_Get_Parent
SetupDiOpenDeviceInfoA
CM_Get_Device_ID_Size
SetupDiCreateDeviceInfoList
SetupDiSetDeviceRegistryPropertyA
CM_Get_Device_IDA
kernel32
CreateFileW
VirtualQuery
GetSystemInfo
DisableThreadLibraryCalls
GetVersionExA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
OutputDebugStringA
FlsSetValue
GetCommandLineA
GetVersionExW
GetLastError
HeapFree
GetSystemTimeAsFileTime
RaiseException
RtlPcToFileHeader
HeapAlloc
GetProcAddress
GetModuleHandleW
ExitProcess
EncodePointer
DecodePointer
FlsFree
SetLastError
FlsGetValue
GetCurrentThreadId
FlsAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
RtlUnwindEx
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CloseHandle
HeapReAlloc
HeapSize
WriteFile
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
Sleep
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
FlushFileBuffers
LoadLibraryExW
GetStringTypeW
MultiByteToWideChar
LCMapStringW
WriteConsoleW
VirtualProtect
VirtualAlloc
SetThreadStackGuarantee
comctl32
ord17
WMCClassInstaller
WMCModemCoInstaller
Name
.text
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
1014B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=101, id=1, productName=Unmarked objects,
count=10, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=109, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=35, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=138, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
noise.dll
- IMPHASH da6270003eb469243d697dd8fdde63d2
- SHA256 78f288844e437822710da33eeeef3ee3fa447872b5579b54fef29134a9fb11e8
- MD5 46aead35cb966991edba983d2ca9e395
- SHA1 7dfbce9bd1471921edf665bb0853a2e91db96633
- SHA512 f755dcb81abccd7d576491190b802de59637d330d5014e8edc9dfc58589f325eb34c75606fd1a2d43fdabbf0235965aaf8e393f5dad643bc42954dcddfc63ef8
- SSDEEP 1536:eFaTLxXj89AGVw8hXD57IY84bB0Hcg2ubgJuM/v/luOX3YVwy71J76xJYPaSaT:dxwKGTbq8vuEtWwy7X72J0VaT
- TLSH T116D32A2F76A900B9E1B7913CC8825657D3B2702613215BEF03D081BA2F57BF46D7AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7056
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
noise.pdb
msvcp_win
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o_malloc
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
_CxxThrowException
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
wcscmp
memset
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleHandleExW
GetModuleHandleW
GetModuleFileNameA
api-ms-win-core-synch-l1-1-0
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseMutex
LeaveCriticalSection
WaitForSingleObject
EnterCriticalSection
ReleaseSemaphore
CreateMutexExW
DeleteCriticalSection
CreateSemaphoreExW
InitializeCriticalSectionEx
ReleaseSRWLockShared
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
NoiseCloseHandle
NoiseHandshakeGetHash
NoiseHandshakeInitialize
NoiseHandshakeProcessMessage
NoiseOpenHandle
NoiseTransportMesssageDecrypt
NoiseTransportMesssageEncrypt
Name
.text
Size
84KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
136B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
264B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=40, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=20, id=261, version=33145,
count=1144, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=1, id=256, version=33145,
count=10, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
normaliz.dll
- SHA256 8a6ee80a338e6b090757a4a5bd217072c9d7e2aa3cf80f99428f9032d48f8057
- MD5 7cb6387055ed3d714e76ab3cb14af25d
- SHA1 466cc83037941e5b12860f52762d2081857df5ab
- SHA512 09aa8909b46a92dfaaa2753a67dc5350d87ada4a487816ccaaefd046e84c9d1f61f70da19aeea918832e45a3c9490ac23d2d03190803524a0a814bd5605d34d7
- SSDEEP 48:iqLvsUcFnSlLHwMGOXvq94VIZW67Cuct/WO5WwHg:BLvmnSlLVvXCYEWUGeOWw
- TLSH T12FE2D04AB3B84C69F4BE07758C6B19572379BA305B6183FB8940024D2CA4BD4AD71F36
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
normaliz.pdb
IdnToAscii
IdnToNameprepUnicode
IdnToUnicode
IsNormalizedString
NormalizeString
Name
.text
Size
4KB
Virtual Size
118B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
64B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.00cfg
Size
4KB
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
44B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=259, version=33136,
count=4, id=260, version=33136,
count=1, id=256, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
notificationplatformcomponent.dll
- IMPHASH afa4000a0efbc78ed580b30627208af7
- SHA256 87273a42024d7062bfd87afaa4596f9dfb5fb6b02269d0b6a716d5b5646eed2c
- MD5 8861d617ef45252f5119b3a4c8fd1bbe
- SHA1 d78107b6237d879f5efcf82b27675026666a27ea
- SHA512 b24b04333d9af0f043e323fba6a82bf5f2ca1a66430e0f14ac33db53581552fa6f989b92d9413398f69b31184962403ab47a2f62457dd2736ec35da76e31793f
- SSDEEP 1536:7Pxj0G7GuF3lhn2qMjL8lq7rOizZwtiFTtTnG:754lY8qMj1Y4bG
- TLSH T14663285E27B912E5E571917CC2870E1DE271F8356B0366FF03A0826E5F23BD454397A2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
12288
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
NotificationPlatformComponent.pdb
msvcrt
__C_specific_handler
_unlock
malloc
_amsg_exit
_XcptFilter
free
_onexit
_lock
__dllonexit
_callnewh
_purecall
_vsnwprintf
__CxxFrameHandler3
_initterm
memcpy_s
memmove
memset
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleExW
GetProcAddress
GetModuleHandleW
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockExclusive
InitializeCriticalSection
DeleteCriticalSection
CreateEventExW
ReleaseSRWLockShared
AcquireSRWLockShared
AcquireSRWLockExclusive
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
ReleaseSemaphore
SetEvent
CreateSemaphoreExW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetLastError
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
Sleep
api-ms-win-core-com-l1-1-0
CoGetMalloc
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoRevokeClassObject
CoDisconnectContext
CoDecrementMTAUsage
CoRegisterClassObject
CoIncrementMTAUsage
CoInitializeEx
CoUninitialize
CoCreateFreeThreadedMarshaler
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
ntdll
RtlPublishWnfStateData
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolWork
CloseThreadpoolWork
SubmitThreadpoolWork
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
32KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
548B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=36, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=14, id=260, version=33145,
count=5, id=259, version=33145,
count=85, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=4, id=261, version=33145,
count=1, id=256, version=33145,
count=5, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
npmproxy.dll
- IMPHASH 790a289f98de52d6e6413067e6eeda8d
- SHA256 366860f15178411d5e06f441783e175c61c7d12f7be4fb454b0cc551c36c9d5e
- MD5 186eb7d732cd86f73a3b1125e995ba9a
- SHA1 cf8517b0ce129078fd9fb67563dcc194bb872620
- SHA512 aed11767b18d9cf08d3d4d125cf529bfb33fe6f75d24e553bfc945f41d0ba030e5041f760030042d3606f2a488b93dda32e40a8e2cf804607e82d7fdb8a4bb6e
- SSDEEP 3072:6/h9BKeG1xZj5d5y7cKu3ePDPj08woXyZ8PmO+qofx2bjmDKhO5PMAU:6Z9BKehxhO5PMA
- TLSH T13EA3D68BE60464BBD039817984874E24E376F96057934BCB22A4423E4F3B7D4AF39F95
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
14320
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
npmproxy.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__register_onexit_function
_o__seh_filter_dll
_o__callnewh
memcpy
_o_free
_o_malloc
__CxxFrameHandler4
__std_terminate
__C_specific_handler
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_CxxThrowException
__C_specific_handler_noexcept
api-ms-win-crt-string-l1-1-0
memset
rpcrt4
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrDllRegisterProxy
NdrOleAllocate
NdrDllUnregisterProxy
RpcExceptionFilter
RpcBindingFree
RpcStringFreeW
RpcBindingSetAuthInfoExW
RpcBindingFromStringBindingW
RpcStringBindingComposeW
NdrOleFree
NdrClientCall3
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleFileNameA
GetModuleHandleExW
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleExA
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetLastError
GetLastError
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
WaitForSingleObjectEx
ReleaseSemaphore
WaitForSingleObject
OpenSemaphoreW
CreateMutexExW
CreateSemaphoreExW
ReleaseSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseMutex
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
api-ms-win-security-base-l1-1-0
CreateWellKnownSid
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo
LANIdFreeCollection
LANIdRetrieveCollection
NlmDiagSendWlanConnectionAttemptDiagnostics
NlmDiagSendWlanDisconnectionDiagnostics
Name
.text
Size
32KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=47, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1147, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=22, id=261, version=33145,
count=1, id=256, version=33145,
count=1, id=253, version=33145,
count=12, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
nrpsrv.dll
- IMPHASH 92e98ccd6aa108e386042837a53c42f8
- SHA256 0a2f62681152386559d57279e4b8ecaa6ef0a70648f4c90f725e91ed7b0e09a4
- MD5 771da7e720482343999b431c1ac9c486
- SHA1 1aee5719095ea5e1a8ae4c3ea2d8c74645ace9be
- SHA512 1cc671f10dbb2a87e3161f4d03a4cce25225f7a5b0b183b6c6278c41103103afdec3abde5b6aecf68821859e0ece0ab36dbc263685a68b51ddd798dca4b23c11
- SSDEEP 384:62Xgxeh9hZ1WHKWBKIVQ9QDBRJsgscmeR9zmvNEy:QchjZKcIVeQ1PJ7N9zwf
- TLSH T1DB034BD297684081E5AA6BB002A1CE473E3D77D6072095EB46D5F0450C5B3CAFF34BAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
52:4f:59:b2:e8:75:04:b9:45:3e:84:01:36:01:ed:19:df:35:2b:68:76:0d:2a:f2:3c:22:75:73:28:66:29:88
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 21, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:18:41:84:19:ad:cb:ad:29:4f:00:00:00:00:05:18
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 19, 2025 - Jun 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:2A1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:10:ab:cd:e4:16:18:ef:39:b0:00:01:00:00:02:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
4112
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
nrpsrv.pdb
ntdll
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
NrpStartRpcServer
NrpStopRpcServer
Name
.text
Size
4KB
Virtual Size
822B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=33145,
count=13, id=1, productName=Unmarked objects,
count=6, id=260, version=33145,
count=3, id=259, version=33145,
count=1, id=256, version=33145,
count=2, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
nrtapi.dll
- IMPHASH 57b3dcc0f96a2fa5cb4f5fa0854987d6
- SHA256 d677cce14539f568d0f5ed57b6bda92eb94355465e6e934629b6edbee0e7aa92
- MD5 91deeff148f751afb7ef0ca98adbb013
- SHA1 754040973a72d64f5c53945cd867a692c5873c94
- SHA512 276d132c9097dfaad5c52d4ecae9636b58872eada2499c0a9b86ba0da63dc34b89eeb29a616904603ac9eabb0e917cab3b698878f1735fb601d3368777154450
- SSDEEP 192:mvA+fG5In5YsjiCSZajUSXNgZ8106EpkfSHWw5W:mvA+RYseZajXXNB0ifSHWw5W
- TLSH T198D2F70A93525598F1BA87B446730F5D72ABBA21076113FF4AF090290E76FEA7938F41
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4112
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
nrtapi.pdb
ntdll
RtlCanonicalizeDomainName
RtlCaptureContext
wcsnlen
RtlLookupFunctionEntry
RtlFreeHeap
NtClose
wcscpy_s
RtlInitUnicodeString
RtlFreeUnicodeString
RtlAllocateHeap
RtlVirtualUnwind
NtCreateFile
memset
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
168B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=33145,
count=25, id=1, productName=Unmarked objects,
count=6, id=260, version=33145,
count=3, id=259, version=33145,
count=1, id=256, version=33145,
count=2, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
nshdnsclient.dll
- IMPHASH 99e0856bad07e15e5f76d9bdcb26a6eb
- SHA256 6a179579eb5835f0662189a8b49032a092f1aadeddab0194d94c6c2497a790dd
- MD5 0e76cfab6a7b66d308b5d85f106f980e
- SHA1 546a8073a991e00612be353391c1705999b12732
- SHA512 063878e5740920e4e43095477119398dcbf5cec88cec3ba95e7e3cf0e0e2610687f4038fd98a954e0c897b3f06d95387ff9cccd71753e9f270db1795e4b2ebe1
- SSDEEP 3072:Yu5HkkTT7e7LGn7cN9Km5+MXlNNI0r8gS+16:YuFkkT3e7LGn7cHv5+klNNI0c
- TLSH T185E3292B32E9609AE466C378C0574917E772B4752B1097EF07D0C8B94F07BE69E38B85
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
58:32:5b:ab:79:0f:51:d7:48:fd:44:cc:1b:bf:37:04:4f:68:12:ee:a7:f6:e0:1f:97:48:7c:e4:35:a6:69:22
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6B05-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:11:45:18:39:9b:43:cf:fc:6c:00:01:00:00:02:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
5056
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
NshDnsClient.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
memcmp
_o_free
_o_localeconv
_o_malloc
_o_realloc
_o_strtod
_o_tolower
_o_wcscpy_s
_o_wcstoul
__C_specific_handler
_o___stdio_common_vswprintf
wcsrchr
memcpy
_o___stdio_common_vsscanf
_o___stdio_common_vsprintf
_o___stdio_common_vsnwprintf_s
_o___std_type_info_destroy_list
_o__configure_narrow_argv
_o__execute_onexit_table
_o__errno
_o__cexit
wcschr
api-ms-win-crt-string-l1-1-0
memset
strncmp
dnsapi
DnsGetWellKnownServerProperty
DnsFreeWellKnownServers
DnsGetZtConfig
DnsGetWellKnownServers
DnsDeleteWellKnownServerProperty
DnsDeleteSettings
DnsFree
DnsSetWellKnownServerProperty
DnsFreePolicyConfig
DnsFreeZtConfig
DnsGetPolicyTableInfo
DnsFreeWellKnownServerPropertyEx
DnsGetZtSettings
DnsFreeZtSettings
DnsSetZtSettings
DnsValidateName_W
DnsGetZtTrustedServers
DnsFreeZtTrustedServers
DnsGetZtRules
DnsFreeZtRules
DnsFreeZtClientCertConfig
DnsGetZtClientCertConfig
DnsFreeZtTrustedCa
DnsValidateServer_W
DnsGetZtTrustedCa
ntdll
RtlLookupFunctionEntry
RtlCaptureContext
RtlIpv6AddressToStringExW
RtlIpv6StringToAddressW
RtlNtStatusToDosError
RtlIpv4AddressToStringExW
RtlIpv4StringToAddressW
RtlVirtualUnwind
iphlpapi
ConvertInterfaceLuidToGuid
ConvertInterfaceNameToLuidW
ConvertRemoteInterfaceAliasToLuid
ConvertRemoteInterfaceIndexToLuid
GetAdaptersAddresses
SetInterfaceDnsSettings
SetDnsSettings
GetDnsSettings
FreeDnsSettings
ConvertGuidToStringW
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
DisableThreadLibraryCalls
GetModuleHandleW
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
api-ms-win-eventing-provider-l1-1-0
EventWriteEx
EventUnregister
EventRegister
EventSetInformation
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
api-ms-win-service-management-l1-1-0
OpenSCManagerW
OpenServiceW
CloseServiceHandle
api-ms-win-service-winsvc-l1-1-0
ControlService
api-ms-win-core-processenvironment-l1-1-0
GetCommandLineW
ws2_32
GetNameInfoW
api-ms-win-core-file-l1-1-0
ReadFile
GetFileSize
CreateFileW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetVersionExW
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringW
MultiByteToWideChar
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-localization-l1-2-0
FormatMessageW
netsh.exe
PreprocessCommand
MatchToken
RegisterHelper
RegisterContext
MakeString
FreeString
PrintMessageFromModule
MatchEnumTag
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
InitHelperDll
NshDnsAddDnsServer
NshDnsDeleteDnsServer
NshDnsSetDnsServer
NshDnsShowDnsServers
NshDnsShowInterfaceDnsServers
Name
.text
Size
80KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
_wpp_sf
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
796B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=257, version=33145,
count=79, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1276, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=11, id=260, version=33145,
count=4, id=259, version=33145,
count=14, id=261, version=33145,
count=1, id=256, version=33145,
count=47, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
nshhttp.dll
- IMPHASH edb0ab84ed73eeac70d86b8bdad0b2f8
- SHA256 1ee291ed617ebf322d7090fdbb2cbe3c4939898a1f67fec2c98929f427cb2393
- MD5 c0ca5469594a33af0dc8600273a3434d
- SHA1 ca68a7bf03722e36fa2f1c132d5c72463ca2eaa6
- SHA512 14c00aaf38393a4a89230f636f4e2cbcb59c55f5a86d22a31ee707540094bebf51822d9187d03469ddd05d54a2a2f2c19215d76c769e61ad773cd34476b9edbc
- SSDEEP 1536:EwzlUHW1FTo5fgHR8SFqXFOUjGPNlqdFdJ85UpCg8YZGvWQ0YVHI+jDwAeRCZj0U:EwzzTTo9gio06SOpS1bRTDs28wDs3f
- TLSH T19BC34C2E32E9306AC87642B8C566851AE772F8B11B01ABFF16D1D4388F137D55E39F40
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
8b:5a:29:a9:07:b9:16:c2:ec:84:00:0e:09:f7:85:3a:0b:a3:92:fc:54:b6:43:d4:0d:00:4c:3c:57:48:e0:c3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 18, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:2A1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:10:ab:cd:e4:16:18:ef:39:b0:00:01:00:00:02:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
5056
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
nshhttp.pdb
api-ms-win-crt-string-l1-1-0
memset
wcsncmp
strncmp
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
_o_bsearch
_o_free
_o_iswdigit
_o_iswlower
_o_iswxdigit
_o_localeconv
_o_malloc
_o_qsort
_o_realloc
_o_strtod
_o_tolower
_o_wcstoul
__C_specific_handler
_o___stdio_common_vsscanf
_o___stdio_common_vsprintf
_o__cexit
_o___std_type_info_destroy_list
memcpy
wcsstr
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
api-ms-win-eventing-provider-l1-1-0
EventWriteEx
EventRegister
EventSetInformation
EventUnregister
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleHandleW
DisableThreadLibraryCalls
ws2_32
WSAStringToAddressW
WSACleanup
htons
ntohs
WSAStartup
WSAAddressToStringW
api-ms-win-core-file-l1-1-0
WriteFile
ReadFile
CreateFileW
GetFileSize
api-ms-win-core-processenvironment-l1-1-0
GetCommandLineW
GetEnvironmentVariableW
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
OpenProcessToken
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
ConvertSecurityDescriptorToStringSecurityDescriptorW
api-ms-win-security-base-l1-1-0
GetKernelObjectSecurity
AdjustTokenPrivileges
GetAce
GetSecurityDescriptorDacl
api-ms-win-service-core-l1-1-1
EnumServicesStatusExW
api-ms-win-core-processthreads-l1-1-1
OpenProcess
IsProcessorFeaturePresent
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-service-management-l1-1-0
OpenSCManagerW
CloseServiceHandle
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-security-lsalookup-l2-1-0
LookupPrivilegeValueW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-security-lsalookup-l1-1-0
LookupAccountSidLocalW
LookupAccountNameLocalW
api-ms-win-service-private-l1-1-0
I_QueryTagInformation
ntdll
RtlGUIDFromString
RtlTimeToTimeFields
RtlFreeUnicodeString
RtlStringFromGUID
RtlNtStatusToDosError
httpapi
HttpInitialize
HttpControlService
HttpSetServiceConfiguration
HttpCreateRequestQueue
HttpTerminate
HttpCloseRequestQueue
HttpDeleteServiceConfiguration
HttpQueryServiceConfiguration
HttpUpdateServiceConfiguration
netsh.exe
PrintMessageFromModule
FreeString
MakeString
PreprocessCommand
RegisterContext
RegisterHelper
MatchEnumTag
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-localization-l1-2-0
FormatMessageW
InitHelperDll
Name
.text
Size
72KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
_wpp_sf
Size
4KB
Virtual Size
187B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
300B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=257, version=33145,
count=67, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1179, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=4, id=259, version=33145,
count=14, id=261, version=33145,
count=1, id=256, version=33145,
count=11, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
nshipsec.dll
- IMPHASH e71cdbd32557a6e2ced197bec009b0a4
- SHA256 c36462df3f20bde14fc82bd27d7d56d1b9e19a26e238c53e120b59b5c355bab7
- MD5 eda166c9ce643132f5623cb283959f52
- SHA1 264f7a8268d972b14d18a0751b3a5adf1f31089a
- SHA512 b37ffdf949b0f4a96592aa3a7e22ece8cebd566c162004881d33bc118c8f584324e7bbd1f7b69b25d16dbb390df66640c6be8144b6046bbf3ae5e5f3deb236b3
- SSDEEP 6144:UCBYLzvEh7IGcSoIFbLmaScEqtJdVBot9BykAlukkiLiP6s8kKtrPE:5WzMVIGcAvBbbtJdVqxAIkkiuP6zkKtI
- TLSH T12B745D1E63F510E5D9778278894BA363E272B4351721AAFF01E0C474BB12FF56A38B49
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4928
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
nshipsec.pdb
msvcrt
_unlock
__dllonexit
_onexit
_lock
__C_specific_handler
pow
memset
memmove
memcpy
memcmp
_initterm
_vsnprintf
_amsg_exit
_XcptFilter
strcmp
wcstok
wprintf
_callnewh
wcstoul
_wremove
wcsncmp
_vsnwprintf
isdigit
wcsrchr
swscanf
iswdigit
swscanf_s
_wcsnicmp
malloc
calloc
wcsspn
_wcsicmp
wcschr
wcsstr
free
time
wcscmp
ntdll
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlIpv6StringToAddressW
RtlNtStatusToDosError
RtlIpv4StringToAddressW
RtlIpv6AddressToStringExW
RtlIpv4AddressToStringExW
RtlCompareMemory
EtwTraceMessage
api-ms-win-core-datetime-l1-1-0
GetTimeFormatW
GetDateFormatW
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-file-l1-1-0
FileTimeToLocalFileTime
api-ms-win-core-libraryloader-l1-2-0
LoadStringW
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegCreateKeyExW
RegCloseKey
RegRestoreKeyW
RegOpenKeyExW
RegSetValueExW
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
OpenThreadToken
GetCurrentProcess
TerminateProcess
OpenProcessToken
GetCurrentThreadId
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-service-management-l1-1-0
CloseServiceHandle
OpenSCManagerW
OpenServiceW
api-ms-win-service-winsvc-l1-1-0
QueryServiceStatus
netsh.exe
RegisterContext
PrintMessageFromModule
MatchEnumTag
PreprocessCommand
MatchToken
MatchTagsInCmdLine
RegisterHelper
ws2_32
getaddrinfo
ntohl
inet_ntoa
freeaddrinfo
inet_addr
gethostbyaddr
htonl
rpcrt4
UuidCompare
UuidCreate
UuidFromStringW
UuidIsNil
UuidCreateNil
ole32
CoTaskMemFree
CoInitialize
CoCreateInstance
StringFromGUID2
CoTaskMemAlloc
crypt32
CertEnumCertificatesInStore
CertOpenStore
CertFindChainInStore
CertNameToStrW
CertFreeCertificateContext
CertGetCertificateContextProperty
CertCloseStore
CertGetEnhancedKeyUsage
CertStrToNameW
userenv
GetAppliedGPOListW
FreeGPOListW
activeds
ord14
ord3
ord17
ord15
ord18
oleaut32
SysAllocString
SysFreeString
VariantClear
polstore
IPSecDeleteFilterData
IPSecDeletePolicyData
IPSecCreatePolicyData
IPSecIsDomainPolicyAssigned
IPSecExportPolicies
IPSecImportPolicies
RegCreateNFAData
IPSecCreateFilterData
RegCreatePolicyData
IPSecClosePolicyStore
IPSecCopyNFAData
IPSecSetNegPolData
IPSecSetPolicyData
IPSecSetNFAData
IPSecSetISAKMPData
IPSecDeleteNFAData
IPSecGetFilterData
IPSecFreeNegPolData
IPSecEnumNegPolData
IPSecSetFilterData
IPSecFreeFilterData
IPSecOpenPolicyStore
IPSecFreeMulPolicyData
IPSecGetNegPolData
IPSecGetISAKMPData
IPSecEnumNFAData
IPSecCopyPolicyData
IPSecEnumPolicyData
IPSecFreeMulFilterData
IPSecCopyFilterData
IPSecEnumFilterData
IPSecFreeMulNegPolData
IPSecCopyNegPolData
IPSecDeleteNegPolData
IPSecDeleteISAKMPData
IPSecCreateNFAData
IPSecCreateNegPolData
IPSecFreePolicyData
IPSecAssignPolicy
IPSecUnassignPolicy
IPSecGetAssignedPolicyData
IPSecCreateISAKMPData
IPSecFreeFilterSpec
winipsec
ord78
ord79
ord35
ord37
ord86
ord46
ord51
ord92
ord45
ord65
ord61
ord55
ord62
ord33
ord32
ord30
ord22
ord36
ord28
ord31
ord91
ord72
ord63
ord74
ord49
ord64
ord85
ord70
ord47
ord84
ord57
ord24
ord39
ord29
ord34
ord66
ord73
ord93
ord90
ord48
ord87
dnsapi
DnsValidateName_W
wldap32
ord122
ord224
firewallapi
FwEmptyWFAddresses
kernel32
FormatMessageW
LocalFree
LocalAlloc
GetComputerNameW
FileTimeToSystemTime
Sleep
GetCurrentThread
CloseHandle
ResolveDelayLoadedAPI
RegEnumKeyExW
RegDeleteKeyExW
HeapFree
HeapAlloc
GetProcessHeap
DelayLoadFailureHook
api-ms-win-security-base-l1-1-0
AdjustTokenPrivileges
InitHelperDll
Name
.text
Size
272KB
Virtual Size
268KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
408B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=28, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=16, id=260, version=33138,
count=5, id=259, version=33138,
count=272, id=1, productName=Unmarked objects,
count=33, id=257, version=33138,
count=2, id=261, version=33138,
count=1, id=256, version=33138,
count=42, id=264, version=33138,
count=1, id=255, version=33138,
count=1, id=258, version=33138,
nshwfp.dll
- IMPHASH 9d51793addb17247e2c3862e9ca044d1
- SHA256 d5247e33c7ed534d44286f027b4c18a83f6fc9cf97c086748319c69f537d7f7d
- MD5 73a8f498a56eb48397965c3942b1c0ae
- SHA1 1b7dc70d178057019500afa2b0a67ae2104f0cb5
- SHA512 0c7df5784b43b413860a6262e78db58ced0921606d2f99c771d9b452b9740f86c5f46d1cbe904018c7b7d91b353c90ab470f02c3ea93953b68a27acdf6ba3c4f
- SSDEEP 6144:EyS55VSoBpK/YhT5ajwXtcCxjjOKUoubYchwm9+3RMl6kqFDm7XDH:EyEpKkT5YSSCxjjusmMK6ez
- TLSH T1E205D7047A416B69E046C079E6730683AAF45E043314E2FF92E8B9366D77FC66970FE1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5088
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
nshwfp.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__get_errno
_o__i64toa_s
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__lseek
_o__ltoa_s
_o__read
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__ultoa_s
_o__ultow_s
_o__wcsicmp
_o__wcsnicmp
memcpy
_o__write
_o_bsearch
_o_free
_o_isprint
_o_malloc
_o_qsort
_o_remove
_o_strcpy_s
_o_wcstol
_o_wcstoul
__C_specific_handler
_o__execute_onexit_table
_o__errno
_o__crt_atexit
strstr
_o__configure_narrow_argv
_o__close
_o__cexit
_o___acrt_iob_func
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vfwprintf
_o___std_type_info_destroy_list
memcmp
_o__ui64toa_s
api-ms-win-crt-string-l1-1-0
strpbrk
wcsncmp
memset
netsh.exe
MatchEnumTag
PrintMessageFromModule
RegisterContext
PrintMessage
RegisterHelper
PreprocessCommand
ntdll
RtlIpv6AddressToStringW
EtwEventWriteTransfer
RtlApplicationVerifierStop
RtlNtStatusToDosError
EtwTraceMessage
RtlIpv6StringToAddressW
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlEthernetAddressToStringA
RtlIpv6AddressToStringA
RtlIpv4AddressToStringA
RtlIpv4StringToAddressW
api-ms-win-core-libraryloader-l1-2-0
LoadStringW
GetModuleHandleExA
GetProcAddress
GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleHandleW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetExitCodeProcess
GetCurrentProcess
ExitProcess
GetCurrentProcessId
CreateProcessW
TerminateProcess
GetCurrentThreadId
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
HeapCreate
HeapSize
HeapReAlloc
GetProcessHeap
HeapDestroy
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
DeleteCriticalSection
CreateEventW
OpenEventW
SetEvent
rpcrt4
MesDecodeBufferHandleCreate
I_RpcExceptionFilter
NdrMesTypeDecode3
MesHandleFree
MesEncodeDynBufferHandleCreate
UuidFromStringW
UuidCreate
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
firewallapi
FWEnumDynamicKeywordAddressesByType0
FWFreeDynamicKeywordAddressData0
api-ms-win-crt-stdio-l1-1-0
_open
_tempnam
fwpuclnt
IkeextSaDestroyEnumHandle0
IPsecSaContextCreateEnumHandle0
IkeextSaCreateEnumHandle0
IPsecSaContextEnum1
IPsecSaContextDestroyEnumHandle0
FwpmSubLayerDestroyEnumHandle0
FwpmSubLayerEnum0
FwpsAleEndpointCreateEnumHandle0
FwpsAleEndpointEnum0
FwpsAleEndpointDestroyEnumHandle0
FwpmCalloutSubscriptionsGet0
FwpmFilterSubscriptionsGet0
FwpmNetEventSubscriptionsGet0
FwpmProviderSubscriptionsGet0
FwpmSubLayerCreateEnumHandle0
FwpmSessionDestroyEnumHandle0
FwpmSessionEnum0
FwpmSessionCreateEnumHandle0
FwpmProviderDestroyEnumHandle0
FwpmProviderEnum0
FwpmProviderCreateEnumHandle0
FwpmLayerDestroyEnumHandle0
FwpmLayerEnum0
FwpmLayerCreateEnumHandle0
FwpmProviderUnsubscribeChanges0
FwpmCalloutDestroyEnumHandle0
FwpmCalloutEnum0
FwpmCalloutCreateEnumHandle0
FwpmProviderContextDestroyEnumHandle0
FwpmProviderContextEnum3
FwpmProviderContextCreateEnumHandle0
FwpmProviderContextSubscriptionsGet0
FwpmFilterEnum0
FwpmSubLayerSubscriptionsGet0
FwpmFilterCreateEnumHandle0
FwpmProviderGetByKey0
IkeextGetStatistics1
IPsecGetStatistics1
FwpmNetEventCreateEnumHandleEx
FwpmNetEventEnum5
IPsecDospStateDestroyEnumHandle0
FwpmProviderContextGetByKey3
FwpmNetEventDestroyEnumHandle0
IPsecDospStateEnum0
FwpmProviderSubscribeChanges0
FwpmProviderContextSubscribeChanges0
IPsecDospStateCreateEnumHandle0
IPsecDospGetStatistics0
FwpmTransactionAbort0
FwpmTransactionCommit0
FwpmTransactionBegin0
FwpmEngineGetSecurityInfo0
FwpmProviderContextAdd3
FwpmProviderGetSecurityInfoByKey0
FwpmNetEventsLost0
IPsecSaDbGetSecurityInfo0
FwpmEngineClose0
FwpmLayerGetSecurityInfoByKey0
FwpmFilterAdd0
FwpmProviderContextSetSecurityInfoByKey0
FwpmNetEventsSetSecurityInfo0
FwpmSubLayerGetByKey0
FwpmFilterGetSecurityInfoByKey0
FwpmSubLayerGetSecurityInfoByKey0
FwpmEngineGetOption0
FwpmLayerSetSecurityInfoByKey0
FwpmCalloutSetSecurityInfoByKey0
FwpmEngineSetOption0
FwpmGetAppIdFromFileName0
FwpmSubLayerSubscribeChanges0
FwpmSubLayerSetSecurityInfoByKey0
FwpmCalloutSubscribeChanges0
FwpmSystemPortsGet0
FwpmFilterSubscribeChanges0
FwpmFreeMemory0
IPsecSaDbSetSecurityInfo0
FwpmNetEventSubscribe4
FwpmFilterDeleteByKey0
IkeextSaDbGetSecurityInfo0
FwpmProviderSetSecurityInfoByKey0
FwpmNetEventUnsubscribe0
FwpmProviderContextGetSecurityInfoByKey0
FwpmFilterUnsubscribeChanges0
FwpmCalloutUnsubscribeChanges0
FwpmSubLayerUnsubscribeChanges0
FwpmProviderContextUnsubscribeChanges0
FwpmFilterSetSecurityInfoByKey0
FwpmEngineOpen0
IkeextSaEnum2
FwpmEngineSetSecurityInfo0
IkeextSaDbSetSecurityInfo0
FwpmCalloutGetSecurityInfoByKey0
FwpmProviderContextDeleteByKey0
FwpmCalloutGetByKey0
FwpmFilterGetByKey0
FwpmFilterDestroyEnumHandle0
FwpmNetEventsGetSecurityInfo0
nsi
NsiGetAllParameters
NsiSetAllParameters
api-ms-win-service-management-l2-1-0
QueryServiceStatusEx
api-ms-win-core-console-l1-1-0
GetConsoleOutputCP
api-ms-win-core-processenvironment-l1-1-0
GetStdHandle
api-ms-win-core-file-l1-1-0
GetFileAttributesA
FileTimeToLocalFileTime
WriteFile
DeleteFileW
DeleteFileA
GetFileInformationByHandle
CreateFileW
CreateFileA
api-ms-win-service-management-l1-1-0
CloseServiceHandle
OpenSCManagerW
OpenServiceW
api-ms-win-security-base-l1-1-0
GetLengthSid
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-console-l1-2-0
AttachConsole
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertStringSidToSidW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFindExtensionW
iphlpapi
GetAdaptersAddresses
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
crypt32
CertNameToStrW
CertCreateCertificateContext
CertFreeCertificateContext
CertGetNameStringW
api-ms-win-security-lsapolicy-l1-1-0
LsaQueryInformationPolicy
LsaFreeMemory
LsaClose
LsaOpenPolicy
api-ms-win-security-lsalookup-l2-1-0
LookupAccountNameW
api-ms-win-eventing-controller-l1-1-0
StartTraceW
ControlTraceW
api-ms-win-eventing-legacy-l1-1-0
EnableTrace
cabinet
ord13
ord14
ord11
ord10
api-ms-win-core-kernel32-legacy-l1-1-0
FileTimeToDosDateTime
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumValueW
IdpConfigAddPolicy
IdpConfigAllocateAndGetPolicy
IdpConfigFreePolicy
IdpConfigInitDefaultPolicy
IdpConfigRemovePolicy
InitHelperDll
WfpCaptureExportedW
WfpCaptureStop
Name
.text
Size
172KB
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
468KB
Virtual Size
467KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
164KB
Virtual Size
167KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
24KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=257, version=33145,
count=107, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1418, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33145,
count=5, id=259, version=33145,
count=24, id=261, version=33145,
count=1, id=256, version=33145,
count=84, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
nsi.dll
- IMPHASH 7f27355794f636782c2b4c73c336bd5f
- SHA256 8093f7ce25d08cd7c6307b8e3ca4382451f27d3f2f9a8ecef19479a01a2e17d0
- MD5 51cd9df0a96348051d2fad4ef1acb87a
- SHA1 f36a5dbd4c744e0826af0437a333fb85b70e07f2
- SHA512 9b25b5af75a20d3dd26efc17d14a44566f6d1527fc74874fd6edacb16d91ff89c6010c6d22a7aca1cfc1a3661e57ab0d1001589adcca64354701b45e9fa0e766
- SSDEEP 384:AfdSHn5S0Wn8zIlSjy0HwLZW7VWdR1KdvDBRJCbyNdlKR9znurrf:AQgoIleaycR4dv1Pv3s9zUf
- TLSH T156334BAA875420C4E8FBC57452A1E656BC3572A6271029FF46E0DABC0D33BC1F638E25
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d0:42:b4:3d:26:af:cc:e6:8b:e7:2a:43:88:c1:25:96:b8:bb:c8:23:af:0a:f6:df:ed:e3:84:15:73:1d:7e:56
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 11, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:55:46:a8:83:17:24:6f:63:e9:00:00:00:00:05:55
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 13, 2025 - Oct 18, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A935-03E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:27:d5:c0:83:c3:b1:2e:57:2d:00:01:00:00:02:27
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
10224
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
nsi.pdb
ntdll
RtlVirtualUnwind
NtDeviceIoControlFile
RtlCaptureContext
NtTerminateProcess
RtlLookupFunctionEntry
RtlUnhandledExceptionFilter
NtWaitForSingleObject
RtlNtStatusToDosError
memset
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-file-l1-1-0
CreateFileW
api-ms-win-core-errorhandling-l1-1-0
GetLastError
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-synch-l1-1-0
CreateEventA
NsiAllocateAndGetPersistentDataWithMaskTable
NsiAllocateAndGetTable
NsiCancelChangeNotification
NsiDeregisterChangeNotification
NsiDeregisterChangeNotificationEx
NsiEnumerateObjectsAllParameters
NsiEnumerateObjectsAllParametersEx
NsiEnumerateObjectsAllPersistentParametersWithMask
NsiFreePersistentDataWithMaskTable
NsiFreeTable
NsiGetAllParameters
NsiGetAllParametersEx
NsiGetAllPersistentParametersWithMask
NsiGetObjectSecurity
NsiGetParameter
NsiGetParameterEx
NsiRegisterChangeNotification
NsiRegisterChangeNotificationEx
NsiRequestChangeNotification
NsiRequestChangeNotificationEx
NsiSetAllParameters
NsiSetAllParametersEx
NsiSetAllPersistentParametersWithMask
NsiSetObjectSecurity
NsiSetParameter
NsiSetParameterEx
Name
.text
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=33145,
count=20, id=1, productName=Unmarked objects,
count=5, id=260, version=33145,
count=3, id=259, version=33145,
count=1, id=256, version=33145,
count=4, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
nsisvc.dll
- IMPHASH 0ba8e439c7e8eeab23574a1e8db5fc42
- SHA256 5705ee29a10e5172393b6884001409ec6089df420065cd9df5d8f71bf881b1c6
- MD5 848d53789271da515592640ca6250a67
- SHA1 a14bcfe699fbeea87d988b24ec36d5b60aad157b
- SHA512 05825bfde218f6ddb84185aa2e64f808cd8502ba1b21f54560a9a322ee66071ec8849a58f01e445d60447d3b79a29656e477a4f31d3d88a25d2d8fbb0ceab295
- SSDEEP 384:9zuLALb19PZfDL76vuWaMBKFOsgFPw4Bq75MgMz5BGRcoqptoyMRflBJr30WMTW6:9KLGPZfDf6vTdw4BM5m7oyMFlLr6
- TLSH T11D532A5CB2E620E5D87A823D81635F65D772F42A43112BEF42E0C13D5F26BD16B39E88
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
13552
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
nsisvc.pdb
api-ms-win-core-crt-l2-1-0
_initterm
_initterm_e
ntdll
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwTraceMessage
RtlPublishWnfStateData
rpcrt4
RpcSsContextLockExclusive
RpcServerUseProtseqW
RpcServerRegisterIf3
RpcAsyncCompleteCall
RpcServerSubscribeForNotification
RpcBindingVectorFree
RpcImpersonateClient
RpcRevertToSelf
NdrServerCall2
Ndr64AsyncServerCallAll
RpcServerInqBindings
RpcServerInqCallAttributesW
RpcEpRegisterW
RpcEpUnregister
RpcServerUnregisterIfEx
RpcServerUnsubscribeForNotification
NdrAsyncServerCall
NdrServerCallAll
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
InitializeCriticalSection
SetEvent
CreateEventW
EnterCriticalSection
DeleteCriticalSection
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-core-interlocked-l1-1-0
InterlockedPushEntrySList
InitializeSListHead
InterlockedPopEntrySList
api-ms-win-core-windowserrorreporting-l1-1-0
WerSetFlags
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
SetPriorityClass
GetCurrentProcess
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-service-core-l1-1-0
RegisterServiceCtrlHandlerExW
SetServiceStatus
api-ms-win-core-threadpool-legacy-l1-1-0
UnregisterWaitEx
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-threadpool-private-l1-1-0
RegisterWaitForSingleObjectEx
api-ms-win-core-crt-l1-1-0
memcpy
__C_specific_handler
memset
memcmp
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
ServiceMain
SvchostPushServiceGlobals
Name
.text
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
924B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
64B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
440B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=1, productName=Unmarked objects (old),
count=4, id=259, version=33145,
count=13, id=260, version=33145,
count=43, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=82, id=1, productName=Unmarked objects,
count=1, id=256, version=33145,
count=6, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
ntasn1.dll
- IMPHASH f7100ef886430cb1abaf38be7bb05def
- SHA256 04a37b3d847944b0086c330195d3ffa84c6178125684740254d4a964551977e5
- MD5 72ad745571ae2fa2e561b675193c1386
- SHA1 ba431d7f9834641745531cbc420a2574533e7b1c
- SHA512 a7073268a16e89dc503434dc1fe745a4f21fbf549c78ed69d7e1fcf0fb2f1333462426e570cced18558f47a33048f2b4214d38d37f6518dc05586305c989815b
- SSDEEP 3072:dFIl2XvoURCo8B/uWotjbPlzOMTLp6u8Zhhoq7ieJrDK2ks33P:dFIl0vFYSxZTl6ugLRKEv
- TLSH T1D8442916BBE888A3DCB6837C85E74A246BF9F9941BA1C3CF0790552C2E477D05E3A351
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
19:a5:97:75:dd:53:55:3f:83:3f:1a:01:93:a6:51:be:b7:4b:75:d5:d0:e2:03:c8:f7:06:0b:d6:e9:50:37:c6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 28, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:E002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:ee:05:d3:02:30:b2:9a:9d:a7:00:01:00:00:01:ee
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
52576
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ntasn1.pdb
ntdll
EtwRegisterTraceGuidsW
EtwEventWriteTransfer
RtlCaptureContext
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwTraceMessage
RtlLookupFunctionEntry
RtlCompareString
RtlInitString
RtlTimeFieldsToTime
RtlMultiByteToUnicodeN
RtlMultiByteToUnicodeSize
RtlUnicodeToMultiByteN
RtlTimeToTimeFields
RtlUnicodeToMultiByteSize
WinSqmIsOptedIn
WinSqmIncrementDWORD
RtlImageNtHeader
EtwEventRegister
EtwEventUnregister
RtlVirtualUnwind
EtwGetTraceEnableFlags
memset
EtwUnregisterTraceGuids
memchr
memcpy
memmove
wcscmp
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
GetModuleFileNameW
api-ms-win-core-errorhandling-l1-1-0
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-rtlsupport-l1-1-0
RtlCompareMemory
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
Name
.text
Size
92KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
132KB
Virtual Size
129KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=33138,
count=54, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=8, id=260, version=33138,
count=4, id=259, version=33138,
count=1, id=256, version=33138,
count=31, id=264, version=33138,
count=1, id=255, version=33138,
count=1, id=258, version=33138,
ntdll.dll
- SHA256 b9775b65c47564c2571fb9175e07ec14ce2a771613230afb2c284a0501a369a7
- MD5 080dd73e4aaa8382aa2bf0aefb18e3b2
- SHA1 5588392fe4bb49ebf103e7d7ee2c56b0bfa0a853
- SHA512 d040659b0aba95fe60d41bc2ea288171c49ccda7ac68509eaec88ec8e3a2c2e2a2959c4f5aed284bc4cff90e1fe75adb90283bb4933f9e100edefb9c79107f82
- SSDEEP 49152:nNSXCVHe/KfUYtANyWfo0BWZgXmseTed+XHZB+ukf:N8Lo0yWmgneX5kukf
- TLSH T14AC5E552A3F80648F1F7BA3499B516259F767C86AB38C6DF1294415E1EB2FD08E34323
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
f9:e2:7d:ce:4e:2b:e1:05:df:85:83:a8:ad:5f:df:02:d0:a8:28:a5:95:80:7c:9d:54:af:c1:44:93:e4:de:40
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:55:46:a8:83:17:24:6f:63:e9:00:00:00:00:05:55
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 13, 2025 - Oct 18, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:7F00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1e:a3:ac:a4:6e:39:6f:7c:49:00:01:00:00:02:1e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ntdll.pdb
A_SHAFinal
A_SHAInit
A_SHAUpdate
AlpcAdjustCompletionListConcurrencyCount
AlpcFreeCompletionListMessage
AlpcGetCompletionListLastMessageInformation
AlpcGetCompletionListMessageAttributes
AlpcGetHeaderSize
AlpcGetMessageAttribute
AlpcGetMessageFromCompletionList
AlpcGetOutstandingCompletionListMessageCount
AlpcInitializeMessageAttribute
AlpcMaxAllowedMessageLength
AlpcRegisterCompletionList
AlpcRegisterCompletionListWorkerThread
AlpcRundownCompletionList
AlpcUnregisterCompletionList
AlpcUnregisterCompletionListWorkerThread
ApiSetGetImplementationHost
ApiSetQueryApiSetPresence
ApiSetQueryApiSetPresenceEx
ApiSetQuerySchema
CsrAllocateCaptureBuffer
CsrAllocateMessagePointer
CsrCaptureMessageBuffer
CsrCaptureMessageMultiUnicodeStringsInPlace
CsrCaptureMessageString
CsrCaptureTimeout
CsrClientCallServer
CsrClientConnectToServer
CsrFreeCaptureBuffer
CsrGetProcessId
CsrIdentifyAlertableThread
CsrSetPriorityClass
CsrVerifyRegion
DbgBreakPoint
DbgPrint
DbgPrintEx
DbgPrintReturnControlC
DbgPrompt
DbgQueryDebugFilterState
DbgSetDebugFilterState
DbgUiConnectToDbg
DbgUiContinue
DbgUiConvertStateChangeStructure
DbgUiConvertStateChangeStructureEx
DbgUiDebugActiveProcess
DbgUiGetThreadDebugObject
DbgUiIssueRemoteBreakin
DbgUiRemoteBreakin
DbgUiSetThreadDebugObject
DbgUiStopDebugging
DbgUiWaitStateChange
DbgUserBreakPoint
EtwCheckCoverage
EtwCreateTraceInstanceId
EtwDeliverDataBlock
EtwEnumerateProcessRegGuids
EtwEventActivityIdControl
EtwEventEnabled
EtwEventProviderEnabled
EtwEventRegister
EtwEventSetInformation
EtwEventUnregister
EtwEventWrite
EtwEventWriteEndScenario
EtwEventWriteEx
EtwEventWriteFull
EtwEventWriteNoRegistration
EtwEventWriteStartScenario
EtwEventWriteString
EtwEventWriteTransfer
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwLogTraceEvent
EtwNotificationRegister
EtwNotificationUnregister
EtwProcessPrivateLoggerRequest
EtwRegisterSecurityProvider
EtwRegisterTraceGuidsA
EtwRegisterTraceGuidsW
EtwReplyNotification
EtwSendNotification
EtwSetMark
EtwTraceEventInstance
EtwTraceMessage
EtwTraceMessageVa
EtwUnregisterTraceGuids
EtwWriteUMSecurityEvent
EtwpCreateEtwThread
EtwpGetCpuSpeed
EvtIntReportAuthzEventAndSourceAsync
EvtIntReportEventAndSourceAsync
ExpInterlockedPopEntrySListEnd
ExpInterlockedPopEntrySListFault
ExpInterlockedPopEntrySListResume
KiRaiseUserExceptionDispatcher
KiUserApcDispatcher
KiUserCallbackDispatcher
KiUserExceptionDispatcher
KiUserInvertedFunctionTable
LdrAccessResource
LdrAddDllDirectory
LdrAddLoadAsDataTable
LdrAddRefDll
LdrAppxHandleIntegrityFailure
LdrCallEnclave
LdrControlFlowGuardEnforced
LdrCreateEnclave
LdrDeleteEnclave
LdrDisableThreadCalloutsForDll
LdrEnumResources
LdrEnumerateLoadedModules
LdrFastFailInLoaderCallout
LdrFindEntryForAddress
LdrFindResourceDirectory_U
LdrFindResourceEx_U
LdrFindResource_U
LdrFlushAlternateResourceModules
LdrGetDllDirectory
LdrGetDllFullName
LdrGetDllHandle
LdrGetDllHandleByMapping
LdrGetDllHandleByName
LdrGetDllHandleEx
LdrGetDllPath
LdrGetFailureData
LdrGetFileNameFromLoadAsDataTable
LdrGetKnownDllSectionHandle
LdrGetProcedureAddress
LdrGetProcedureAddressEx
LdrGetProcedureAddressForCaller
LdrHotPatchNotify
LdrInitShimEngineDynamic
LdrInitializeEnclave
LdrInitializeThunk
LdrIsModuleSxsRedirected
LdrLoadAlternateResourceModule
LdrLoadAlternateResourceModuleEx
LdrLoadDll
LdrLoadEnclaveModule
LdrLockLoaderLock
LdrOpenImageFileOptionsKey
LdrProcessInitializationComplete
LdrProcessRelocationBlock
LdrProcessRelocationBlockEx
LdrQueryImageFileExecutionOptions
LdrQueryImageFileExecutionOptionsEx
LdrQueryImageFileKeyOption
LdrQueryModuleServiceTags
LdrQueryOptionalDelayLoadedAPI
LdrQueryProcessModuleInformation
LdrRegisterDllNotification
LdrRemoveDllDirectory
LdrRemoveLoadAsDataTable
LdrResFindResource
LdrResFindResourceDirectory
LdrResGetRCConfig
LdrResRelease
LdrResSearchResource
LdrResolveDelayLoadedAPI
LdrResolveDelayLoadsFromDll
LdrRscIsTypeExist
LdrSetAppCompatDllRedirectionCallback
LdrSetDefaultDllDirectories
LdrSetDllDirectory
LdrSetDllManifestProber
LdrSetImplicitPathOptions
LdrSetMUICacheType
LdrShutdownProcess
LdrShutdownThread
LdrStandardizeSystemPath
LdrSystemDllInitBlock
LdrUnloadAlternateResourceModule
LdrUnloadAlternateResourceModuleEx
LdrUnloadDll
LdrUnlockLoaderLock
LdrUnregisterDllNotification
LdrUpdatePackageSearchPath
LdrVerifyImageMatchesChecksum
LdrVerifyImageMatchesChecksumEx
LdrpResGetMappingSize
LdrpResGetResourceDirectory
MD4Final
MD4Init
MD4Update
MD5Final
MD5Init
MD5Update
MicrosoftTelemetryAssertTriggeredUM
NlsAnsiCodePage
NlsMbCodePageTag
NlsMbOemCodePageTag
NtAcceptConnectPort
NtAccessCheck
NtAccessCheckAndAuditAlarm
NtAccessCheckByType
NtAccessCheckByTypeAndAuditAlarm
NtAccessCheckByTypeResultList
NtAccessCheckByTypeResultListAndAuditAlarm
NtAccessCheckByTypeResultListAndAuditAlarmByHandle
NtAcquireCrossVmMutant
NtAcquireProcessActivityReference
NtAddAtom
NtAddAtomEx
NtAddBootEntry
NtAddDriverEntry
NtAdjustGroupsToken
NtAdjustPrivilegesToken
NtAdjustTokenClaimsAndDeviceGroups
NtAlertMultipleThreadByThreadId
NtAlertResumeThread
NtAlertThread
NtAlertThreadByThreadId
NtAlertThreadByThreadIdEx
NtAllocateLocallyUniqueId
NtAllocateReserveObject
NtAllocateUserPhysicalPages
NtAllocateUserPhysicalPagesEx
NtAllocateUuids
NtAllocateVirtualMemory
NtAllocateVirtualMemoryEx
NtAlpcAcceptConnectPort
NtAlpcCancelMessage
NtAlpcConnectPort
NtAlpcConnectPortEx
NtAlpcCreatePort
NtAlpcCreatePortSection
NtAlpcCreateResourceReserve
NtAlpcCreateSectionView
NtAlpcCreateSecurityContext
NtAlpcDeletePortSection
NtAlpcDeleteResourceReserve
NtAlpcDeleteSectionView
NtAlpcDeleteSecurityContext
NtAlpcDisconnectPort
NtAlpcImpersonateClientContainerOfPort
NtAlpcImpersonateClientOfPort
NtAlpcOpenSenderProcess
NtAlpcOpenSenderThread
NtAlpcQueryInformation
NtAlpcQueryInformationMessage
NtAlpcRevokeSecurityContext
NtAlpcSendWaitReceivePort
NtAlpcSetInformation
NtApphelpCacheControl
NtAreMappedFilesTheSame
NtAssignProcessToJobObject
NtAssociateWaitCompletionPacket
NtCallEnclave
NtCallbackReturn
NtCancelIoFile
NtCancelIoFileEx
NtCancelSynchronousIoFile
NtCancelTimer
NtCancelTimer2
NtCancelWaitCompletionPacket
NtChangeProcessState
NtChangeThreadState
NtClearEvent
NtClose
NtCloseObjectAuditAlarm
NtCommitComplete
NtCommitEnlistment
NtCommitRegistryTransaction
NtCommitTransaction
NtCompactKeys
NtCompareObjects
NtCompareSigningLevels
NtCompareTokens
NtCompleteConnectPort
NtCompressKey
NtConnectPort
NtContinue
NtContinueEx
NtConvertBetweenAuxiliaryCounterAndPerformanceCounter
NtCopyFileChunk
NtCreateCpuPartition
NtCreateCrossVmEvent
NtCreateCrossVmMutant
NtCreateDebugObject
NtCreateDirectoryObject
NtCreateDirectoryObjectEx
NtCreateEnclave
NtCreateEnlistment
NtCreateEvent
NtCreateEventPair
NtCreateFile
NtCreateIRTimer
NtCreateIoCompletion
NtCreateIoRing
NtCreateJobObject
NtCreateJobSet
NtCreateKey
NtCreateKeyTransacted
NtCreateKeyedEvent
NtCreateLowBoxToken
NtCreateMailslotFile
NtCreateMutant
NtCreateNamedPipeFile
NtCreatePagingFile
NtCreatePartition
NtCreatePort
NtCreatePrivateNamespace
NtCreateProcess
NtCreateProcessEx
NtCreateProcessStateChange
NtCreateProfile
NtCreateProfileEx
NtCreateRegistryTransaction
NtCreateResourceManager
NtCreateSection
NtCreateSectionEx
NtCreateSemaphore
NtCreateSymbolicLinkObject
NtCreateThread
NtCreateThreadEx
NtCreateThreadStateChange
NtCreateTimer
NtCreateTimer2
NtCreateToken
NtCreateTokenEx
NtCreateTransaction
NtCreateTransactionManager
NtCreateUserProcess
NtCreateWaitCompletionPacket
NtCreateWaitablePort
NtCreateWnfStateName
NtCreateWorkerFactory
NtDebugActiveProcess
NtDebugContinue
NtDelayExecution
NtDeleteAtom
NtDeleteBootEntry
NtDeleteDriverEntry
NtDeleteFile
NtDeleteKey
NtDeleteObjectAuditAlarm
NtDeletePrivateNamespace
NtDeleteValueKey
NtDeleteWnfStateData
NtDeleteWnfStateName
NtDeviceIoControlFile
NtDirectGraphicsCall
NtDisableLastKnownGood
NtDisplayString
NtDrawText
NtDuplicateObject
NtDuplicateToken
NtEnableLastKnownGood
NtEnumerateBootEntries
NtEnumerateDriverEntries
NtEnumerateKey
NtEnumerateSystemEnvironmentValuesEx
NtEnumerateTransactionObject
NtEnumerateValueKey
NtExtendSection
NtFilterBootOption
NtFilterToken
NtFilterTokenEx
NtFindAtom
NtFlushBuffersFile
NtFlushBuffersFileEx
NtFlushInstallUILanguage
NtFlushInstructionCache
NtFlushKey
NtFlushProcessWriteBuffers
NtFlushVirtualMemory
NtFlushWriteBuffer
NtFreeUserPhysicalPages
NtFreeVirtualMemory
NtFreezeRegistry
NtFreezeTransactions
NtFsControlFile
NtGetCachedSigningLevel
NtGetCompleteWnfStateSubscription
NtGetContextThread
NtGetCurrentProcessorNumber
NtGetCurrentProcessorNumberEx
NtGetDevicePowerState
NtGetMUIRegistryInfo
NtGetNextProcess
NtGetNextThread
NtGetNlsSectionPtr
NtGetNotificationResourceManager
NtGetTickCount
NtGetWriteWatch
NtImpersonateAnonymousToken
NtImpersonateClientOfPort
NtImpersonateThread
NtInitializeEnclave
NtInitializeNlsFiles
NtInitializeRegistry
NtInitiatePowerAction
NtIsProcessInJob
NtIsSystemResumeAutomatic
NtIsUILanguageComitted
NtListenPort
NtLoadDriver
NtLoadEnclaveData
NtLoadKey
NtLoadKey2
NtLoadKey3
NtLoadKeyEx
NtLockFile
NtLockProductActivationKeys
NtLockRegistryKey
NtLockVirtualMemory
NtMakePermanentObject
NtMakeTemporaryObject
NtManageHotPatch
NtManagePartition
NtMapCMFModule
NtMapUserPhysicalPages
NtMapUserPhysicalPagesScatter
NtMapViewOfSection
NtMapViewOfSectionEx
NtModifyBootEntry
NtModifyDriverEntry
NtNotifyChangeDirectoryFile
NtNotifyChangeDirectoryFileEx
NtNotifyChangeKey
NtNotifyChangeMultipleKeys
NtNotifyChangeSession
NtOpenCpuPartition
NtOpenDirectoryObject
NtOpenEnlistment
NtOpenEvent
NtOpenEventPair
NtOpenFile
NtOpenIoCompletion
NtOpenJobObject
NtOpenKey
NtOpenKeyEx
NtOpenKeyTransacted
NtOpenKeyTransactedEx
NtOpenKeyedEvent
NtOpenMutant
NtOpenObjectAuditAlarm
NtOpenPartition
NtOpenPrivateNamespace
NtOpenProcess
NtOpenProcessToken
NtOpenProcessTokenEx
NtOpenRegistryTransaction
NtOpenResourceManager
NtOpenSection
NtOpenSemaphore
NtOpenSession
NtOpenSymbolicLinkObject
NtOpenThread
NtOpenThreadToken
NtOpenThreadTokenEx
NtOpenTimer
NtOpenTransaction
NtOpenTransactionManager
NtPlugPlayControl
NtPowerInformation
NtPrePrepareComplete
NtPrePrepareEnlistment
NtPrepareComplete
NtPrepareEnlistment
NtPrivilegeCheck
NtPrivilegeObjectAuditAlarm
NtPrivilegedServiceAuditAlarm
NtPropagationComplete
NtPropagationFailed
NtProtectVirtualMemory
NtPssCaptureVaSpaceBulk
NtPulseEvent
NtQueryAttributesFile
NtQueryAuxiliaryCounterFrequency
NtQueryBootEntryOrder
NtQueryBootOptions
NtQueryDebugFilterState
NtQueryDefaultLocale
NtQueryDefaultUILanguage
NtQueryDirectoryFile
NtQueryDirectoryFileEx
NtQueryDirectoryObject
NtQueryDriverEntryOrder
NtQueryEaFile
NtQueryEvent
NtQueryFullAttributesFile
NtQueryInformationAtom
NtQueryInformationByName
NtQueryInformationCpuPartition
NtQueryInformationEnlistment
NtQueryInformationFile
NtQueryInformationJobObject
NtQueryInformationPort
NtQueryInformationProcess
NtQueryInformationResourceManager
NtQueryInformationThread
NtQueryInformationToken
NtQueryInformationTransaction
NtQueryInformationTransactionManager
NtQueryInformationWorkerFactory
NtQueryInstallUILanguage
NtQueryIntervalProfile
NtQueryIoCompletion
NtQueryIoRingCapabilities
NtQueryKey
NtQueryLicenseValue
NtQueryMultipleValueKey
NtQueryMutant
NtQueryObject
NtQueryOpenSubKeys
NtQueryOpenSubKeysEx
NtQueryPerformanceCounter
NtQueryPortInformationProcess
NtQueryQuotaInformationFile
NtQuerySection
NtQuerySecurityAttributesToken
NtQuerySecurityObject
NtQuerySecurityPolicy
NtQuerySemaphore
NtQuerySymbolicLinkObject
NtQuerySystemEnvironmentValue
NtQuerySystemEnvironmentValueEx
NtQuerySystemInformation
NtQuerySystemInformationEx
NtQuerySystemTime
NtQueryTimer
NtQueryTimerResolution
NtQueryValueKey
NtQueryVirtualMemory
NtQueryVolumeInformationFile
NtQueryWnfStateData
NtQueryWnfStateNameInformation
NtQueueApcThread
NtQueueApcThreadEx
NtQueueApcThreadEx2
NtRaiseException
NtRaiseHardError
NtReadFile
NtReadFileScatter
NtReadOnlyEnlistment
NtReadRequestData
NtReadVirtualMemory
NtReadVirtualMemoryEx
NtRecoverEnlistment
NtRecoverResourceManager
NtRecoverTransactionManager
NtRegisterProtocolAddressInformation
NtRegisterThreadTerminatePort
NtReleaseKeyedEvent
NtReleaseMutant
NtReleaseSemaphore
NtReleaseWorkerFactoryWorker
NtRemoveIoCompletion
NtRemoveIoCompletionEx
NtRemoveProcessDebug
NtRenameKey
NtRenameTransactionManager
NtReplaceKey
NtReplacePartitionUnit
NtReplyPort
NtReplyWaitReceivePort
NtReplyWaitReceivePortEx
NtReplyWaitReplyPort
NtRequestPort
NtRequestWaitReplyPort
NtResetEvent
NtResetWriteWatch
NtRestoreKey
NtResumeProcess
NtResumeThread
NtRevertContainerImpersonation
NtRollbackComplete
NtRollbackEnlistment
NtRollbackRegistryTransaction
NtRollbackTransaction
NtRollforwardTransactionManager
NtSaveKey
NtSaveKeyEx
NtSaveMergedKeys
NtSecureConnectPort
NtSerializeBoot
NtSetBootEntryOrder
NtSetBootOptions
NtSetCachedSigningLevel
NtSetCachedSigningLevel2
NtSetContextThread
NtSetDebugFilterState
NtSetDefaultHardErrorPort
NtSetDefaultLocale
NtSetDefaultUILanguage
NtSetDriverEntryOrder
NtSetEaFile
NtSetEvent
NtSetEventBoostPriority
NtSetEventEx
NtSetHighEventPair
NtSetHighWaitLowEventPair
NtSetIRTimer
NtSetInformationCpuPartition
NtSetInformationDebugObject
NtSetInformationEnlistment
NtSetInformationFile
NtSetInformationIoRing
NtSetInformationJobObject
NtSetInformationKey
NtSetInformationObject
NtSetInformationProcess
NtSetInformationResourceManager
NtSetInformationSymbolicLink
NtSetInformationThread
NtSetInformationToken
NtSetInformationTransaction
NtSetInformationTransactionManager
NtSetInformationVirtualMemory
NtSetInformationWorkerFactory
NtSetIntervalProfile
NtSetIoCompletion
NtSetIoCompletionEx
NtSetLdtEntries
NtSetLowEventPair
NtSetLowWaitHighEventPair
NtSetQuotaInformationFile
NtSetSecurityObject
NtSetSystemEnvironmentValue
NtSetSystemEnvironmentValueEx
NtSetSystemInformation
NtSetSystemPowerState
NtSetSystemTime
NtSetThreadExecutionState
NtSetTimer
NtSetTimer2
NtSetTimerEx
NtSetTimerResolution
NtSetUuidSeed
NtSetValueKey
NtSetVolumeInformationFile
NtSetWnfProcessNotificationEvent
NtShutdownSystem
NtShutdownWorkerFactory
NtSignalAndWaitForSingleObject
NtSinglePhaseReject
NtStartProfile
NtStopProfile
NtSubmitIoRing
NtSubscribeWnfStateChange
NtSuspendProcess
NtSuspendThread
NtSystemDebugControl
NtTerminateEnclave
NtTerminateJobObject
NtTerminateProcess
NtTerminateThread
NtTestAlert
NtThawRegistry
NtThawTransactions
NtTraceControl
NtTraceEvent
NtTranslateFilePath
NtUmsThreadYield
NtUnloadDriver
NtUnloadKey
NtUnloadKey2
NtUnloadKeyEx
NtUnlockFile
NtUnlockVirtualMemory
NtUnmapViewOfSection
NtUnmapViewOfSectionEx
NtUnsubscribeWnfStateChange
NtUpdateWnfStateData
NtVdmControl
NtWaitForAlertByThreadId
NtWaitForDebugEvent
NtWaitForKeyedEvent
NtWaitForMultipleObjects
NtWaitForMultipleObjects32
NtWaitForSingleObject
NtWaitForWorkViaWorkerFactory
NtWaitHighEventPair
NtWaitLowEventPair
NtWorkerFactoryWorkerReady
NtWriteFile
NtWriteFileGather
NtWriteRequestData
NtWriteVirtualMemory
NtYieldExecution
NtdllDefWindowProc_A
NtdllDefWindowProc_W
NtdllDialogWndProc_A
NtdllDialogWndProc_W
PfxFindPrefix
PfxInitialize
PfxInsertPrefix
PfxRemovePrefix
PssNtCaptureSnapshot
PssNtDuplicateSnapshot
PssNtFreeRemoteSnapshot
PssNtFreeSnapshot
PssNtFreeWalkMarker
PssNtQuerySnapshot
PssNtValidateDescriptor
PssNtWalkSnapshot
RtlAbortRXact
RtlAbsoluteToSelfRelativeSD
RtlAcquirePebLock
RtlAcquirePrivilege
RtlAcquireReleaseSRWLockExclusive
RtlAcquireResourceExclusive
RtlAcquireResourceShared
RtlAcquireSRWLockExclusive
RtlAcquireSRWLockShared
RtlActivateActivationContext
RtlActivateActivationContextEx
RtlActivateActivationContextUnsafeFast
RtlAddAccessAllowedAce
RtlAddAccessAllowedAceEx
RtlAddAccessAllowedObjectAce
RtlAddAccessDeniedAce
RtlAddAccessDeniedAceEx
RtlAddAccessDeniedObjectAce
RtlAddAccessFilterAce
RtlAddAce
RtlAddActionToRXact
RtlAddAtomToAtomTable
RtlAddAttributeActionToRXact
RtlAddAuditAccessAce
RtlAddAuditAccessAceEx
RtlAddAuditAccessObjectAce
RtlAddCompoundAce
RtlAddFunctionTable
RtlAddGrowableFunctionTable
RtlAddIntegrityLabelToBoundaryDescriptor
RtlAddMandatoryAce
RtlAddProcessTrustLabelAce
RtlAddRefActivationContext
RtlAddRefMemoryStream
RtlAddResourceAttributeAce
RtlAddSIDToBoundaryDescriptor
RtlAddScopedPolicyIDAce
RtlAddVectoredContinueHandler
RtlAddVectoredExceptionHandler
RtlAddressInSectionTable
RtlAdjustPrivilege
RtlAllocateActivationContextStack
RtlAllocateAndInitializeSid
RtlAllocateAndInitializeSidEx
RtlAllocateHandle
RtlAllocateHeap
RtlAllocateMemoryBlockLookaside
RtlAllocateMemoryZone
RtlAllocateWnfSerializationGroup
RtlAnsiCharToUnicodeChar
RtlAnsiStringToUnicodeSize
RtlAnsiStringToUnicodeString
RtlAppendAsciizToString
RtlAppendPathElement
RtlAppendStringToString
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
RtlApplicationVerifierStop
RtlApplyRXact
RtlApplyRXactNoFlush
RtlAppxIsFileOwnedByTrustedInstaller
RtlAreAllAccessesGranted
RtlAreAnyAccessesGranted
RtlAreBitsClear
RtlAreBitsClearEx
RtlAreBitsSet
RtlAreLongPathsEnabled
RtlAssert
RtlAvlInsertNodeEx
RtlAvlRemoveNode
RtlBarrier
RtlBarrierForDelete
RtlCallEnclave
RtlCallEnclaveReturn
RtlCancelTimer
RtlCanonicalizeDomainName
RtlCapabilityCheck
RtlCapabilityCheckForSingleSessionSku
RtlCaptureContext
RtlCaptureContext2
RtlCaptureStackBackTrace
RtlCharToInteger
RtlCheckBootStatusIntegrity
RtlCheckForOrphanedCriticalSections
RtlCheckPortableOperatingSystem
RtlCheckRegistryKey
RtlCheckSandboxedToken
RtlCheckSystemBootStatusIntegrity
RtlCheckTokenCapability
RtlCheckTokenMembership
RtlCheckTokenMembershipEx
RtlCleanUpTEBLangLists
RtlClearAllBits
RtlClearAllBitsEx
RtlClearBit
RtlClearBitEx
RtlClearBits
RtlClearBitsEx
RtlClearThreadWorkOnBehalfTicket
RtlCloneMemoryStream
RtlCloneUserProcess
RtlCmDecodeMemIoResource
RtlCmEncodeMemIoResource
RtlCommitDebugInfo
RtlCommitMemoryStream
RtlCompactHeap
RtlCompareAltitudes
RtlCompareExchangePointerMapping
RtlCompareExchangePropertyStore
RtlCompareMemory
RtlCompareMemoryUlong
RtlCompareString
RtlCompareUnicodeString
RtlCompareUnicodeStrings
RtlCompleteProcessCloning
RtlCompressBuffer
RtlComputeCrc32
RtlComputeImportTableHash
RtlComputePrivatizedDllName_U
RtlConnectToSm
RtlConsoleMultiByteToUnicodeN
RtlConstructCrossVmEventPath
RtlConstructCrossVmMutexPath
RtlContractHashTable
RtlConvertDeviceFamilyInfoToString
RtlConvertExclusiveToShared
RtlConvertHostPerfCounterToPerfCounter
RtlConvertLCIDToString
RtlConvertSRWLockExclusiveToShared
RtlConvertSharedToExclusive
RtlConvertSidToUnicodeString
RtlConvertToAutoInheritSecurityObject
RtlCopyBitMap
RtlCopyContext
RtlCopyExtendedContext
RtlCopyLuid
RtlCopyLuidAndAttributesArray
RtlCopyMappedMemory
RtlCopyMemory
RtlCopyMemoryNonTemporal
RtlCopyMemoryStreamTo
RtlCopyOutOfProcessMemoryStreamTo
RtlCopySecurityDescriptor
RtlCopySid
RtlCopySidAndAttributesArray
RtlCopyString
RtlCopyUnicodeString
RtlCrc32
RtlCrc64
RtlCreateAcl
RtlCreateActivationContext
RtlCreateAndSetSD
RtlCreateAtomTable
RtlCreateBootStatusDataFile
RtlCreateBoundaryDescriptor
RtlCreateEnvironment
RtlCreateEnvironmentEx
RtlCreateHashTable
RtlCreateHashTableEx
RtlCreateHeap
RtlCreateMemoryBlockLookaside
RtlCreateMemoryZone
RtlCreateProcessParameters
RtlCreateProcessParametersEx
RtlCreateProcessParametersWithTemplate
RtlCreateProcessReflection
RtlCreateQueryDebugBuffer
RtlCreateRegistryKey
RtlCreateSecurityDescriptor
RtlCreateServiceSid
RtlCreateSystemVolumeInformationFolder
RtlCreateTagHeap
RtlCreateTimer
RtlCreateTimerQueue
RtlCreateUmsCompletionList
RtlCreateUmsThreadContext
RtlCreateUnicodeString
RtlCreateUnicodeStringFromAsciiz
RtlCreateUserFiberShadowStack
RtlCreateUserProcess
RtlCreateUserProcessEx
RtlCreateUserSecurityObject
RtlCreateUserStack
RtlCreateUserThread
RtlCreateVirtualAccountSid
RtlCultureNameToLCID
RtlCustomCPToUnicodeN
RtlCutoverTimeToSystemTime
RtlDeCommitDebugInfo
RtlDeNormalizeProcessParams
RtlDeactivateActivationContext
RtlDeactivateActivationContextUnsafeFast
RtlDebugPrintTimes
RtlDecodePointer
RtlDecodeRemotePointer
RtlDecodeSystemPointer
RtlDecompressBuffer
RtlDecompressBufferEx
RtlDecompressFragment
RtlDefaultNpAcl
RtlDelayExecution
RtlDelete
RtlDeleteAce
RtlDeleteAtomFromAtomTable
RtlDeleteBarrier
RtlDeleteBoundaryDescriptor
RtlDeleteCriticalSection
RtlDeleteElementGenericTable
RtlDeleteElementGenericTableAvl
RtlDeleteElementGenericTableAvlEx
RtlDeleteFunctionTable
RtlDeleteGrowableFunctionTable
RtlDeleteHashTable
RtlDeleteNoSplay
RtlDeleteRegistryValue
RtlDeleteResource
RtlDeleteSecurityObject
RtlDeleteTimer
RtlDeleteTimerQueue
RtlDeleteTimerQueueEx
RtlDeleteUmsCompletionList
RtlDeleteUmsThreadContext
RtlDequeueUmsCompletionListItems
RtlDeregisterSecureMemoryCacheCallback
RtlDeregisterWait
RtlDeregisterWaitEx
RtlDeriveCapabilitySidsFromName
RtlDestroyAtomTable
RtlDestroyEnvironment
RtlDestroyHandleTable
RtlDestroyHeap
RtlDestroyMemoryBlockLookaside
RtlDestroyMemoryZone
RtlDestroyProcessParameters
RtlDestroyQueryDebugBuffer
RtlDetectHeapLeaks
RtlDetermineDosPathNameType_U
RtlDisableThreadProfiling
RtlDisownModuleHeapAllocation
RtlDllShutdownInProgress
RtlDnsHostNameToComputerName
RtlDoesFileExists_U
RtlDoesNameContainWildCards
RtlDosApplyFileIsolationRedirection_Ustr
RtlDosLongPathNameToNtPathName_U_WithStatus
RtlDosLongPathNameToRelativeNtPathName_U_WithStatus
RtlDosPathNameToNtPathName_U
RtlDosPathNameToNtPathName_U_WithStatus
RtlDosPathNameToRelativeNtPathName_U
RtlDosPathNameToRelativeNtPathName_U_WithStatus
RtlDosSearchPath_U
RtlDosSearchPath_Ustr
RtlDowncaseUnicodeChar
RtlDowncaseUnicodeString
RtlDrainNonVolatileFlush
RtlDumpResource
RtlDuplicateUnicodeString
RtlEmptyAtomTable
RtlEnableEarlyCriticalSectionEventCreation
RtlEnableThreadProfiling
RtlEnclaveCallDispatch
RtlEnclaveCallDispatchReturn
RtlEncodePointer
RtlEncodeRemotePointer
RtlEncodeSystemPointer
RtlEndEnumerationHashTable
RtlEndStrongEnumerationHashTable
RtlEndWeakEnumerationHashTable
RtlEnterCriticalSection
RtlEnterUmsSchedulingMode
RtlEnumProcessHeaps
RtlEnumerateEntryHashTable
RtlEnumerateGenericTable
RtlEnumerateGenericTableAvl
RtlEnumerateGenericTableLikeADirectory
RtlEnumerateGenericTableWithoutSplaying
RtlEnumerateGenericTableWithoutSplayingAvl
RtlEqualComputerName
RtlEqualDomainName
RtlEqualLuid
RtlEqualPrefixSid
RtlEqualSid
RtlEqualString
RtlEqualUnicodeString
RtlEqualWnfChangeStamps
RtlEraseUnicodeString
RtlEthernetAddressToStringA
RtlEthernetAddressToStringW
RtlEthernetStringToAddressA
RtlEthernetStringToAddressW
RtlExecuteUmsThread
RtlExitUserProcess
RtlExitUserThread
RtlExpandEnvironmentStrings
RtlExpandEnvironmentStrings_U
RtlExpandHashTable
RtlExtendCorrelationVector
RtlExtendMemoryBlockLookaside
RtlExtendMemoryZone
RtlExtractBitMap
RtlFillMemory
RtlFillMemoryNonTemporal
RtlFillNonVolatileMemory
RtlFinalReleaseOutOfProcessMemoryStream
RtlFindAceByType
RtlFindActivationContextSectionGuid
RtlFindActivationContextSectionString
RtlFindCharInUnicodeString
RtlFindClearBits
RtlFindClearBitsAndSet
RtlFindClearBitsAndSetEx
RtlFindClearBitsEx
RtlFindClearRuns
RtlFindClosestEncodableLength
RtlFindExportedRoutineByName
RtlFindLastBackwardRunClear
RtlFindLeastSignificantBit
RtlFindLongestRunClear
RtlFindMessage
RtlFindMostSignificantBit
RtlFindNextForwardRunClear
RtlFindSetBits
RtlFindSetBitsAndClear
RtlFindSetBitsAndClearEx
RtlFindSetBitsEx
RtlFindUnicodeSubstring
RtlFirstEntrySList
RtlFirstFreeAce
RtlFlsAlloc
RtlFlsAllocEx
RtlFlsFree
RtlFlsGetValue
RtlFlsGetValue2
RtlFlsSetValue
RtlFlushHeaps
RtlFlushNonVolatileMemory
RtlFlushNonVolatileMemoryRanges
RtlFlushSecureMemoryCache
RtlFormatCurrentUserKeyPath
RtlFormatMessage
RtlFormatMessageEx
RtlFreeActivationContextStack
RtlFreeAnsiString
RtlFreeHandle
RtlFreeHeap
RtlFreeMemoryBlockLookaside
RtlFreeNonVolatileToken
RtlFreeOemString
RtlFreeSid
RtlFreeThreadActivationContextStack
RtlFreeUTF8String
RtlFreeUnicodeString
RtlFreeUserFiberShadowStack
RtlFreeUserStack
RtlGUIDFromString
RtlGenerate8dot3Name
RtlGetAce
RtlGetAcesBufferSize
RtlGetActiveActivationContext
RtlGetActiveConsoleId
RtlGetAppContainerNamedObjectPath
RtlGetAppContainerParent
RtlGetAppContainerSidType
RtlGetCallersAddress
RtlGetCompressionWorkSpaceSize
RtlGetConsoleSessionForegroundProcessId
RtlGetControlSecurityDescriptor
RtlGetCriticalSectionRecursionCount
RtlGetCurrentDirectory_U
RtlGetCurrentPeb
RtlGetCurrentProcessorNumber
RtlGetCurrentProcessorNumberEx
RtlGetCurrentServiceSessionId
RtlGetCurrentThreadPrimaryGroup
RtlGetCurrentTransaction
RtlGetCurrentUmsThread
RtlGetDaclSecurityDescriptor
RtlGetDeviceFamilyInfoEnum
RtlGetElementGenericTable
RtlGetElementGenericTableAvl
RtlGetEnabledExtendedFeatures
RtlGetExePath
RtlGetExtendedContextLength
RtlGetExtendedContextLength2
RtlGetExtendedFeaturesMask
RtlGetFeatureToggleConfiguration
RtlGetFeatureTogglesChangeToken
RtlGetFileMUIPath
RtlGetFrame
RtlGetFullPathName_U
RtlGetFullPathName_UEx
RtlGetFullPathName_UstrEx
RtlGetFunctionTableListHead
RtlGetGroupSecurityDescriptor
RtlGetImageFileMachines
RtlGetIntegerAtom
RtlGetInterruptTimePrecise
RtlGetLastNtStatus
RtlGetLastWin32Error
RtlGetLengthWithoutLastFullDosOrNtPathElement
RtlGetLengthWithoutTrailingPathSeperators
RtlGetLocaleFileMappingAddress
RtlGetLongestNtPathLength
RtlGetMultiTimePrecise
RtlGetNativeSystemInformation
RtlGetNextEntryHashTable
RtlGetNextUmsListItem
RtlGetNonVolatileToken
RtlGetNtGlobalFlags
RtlGetNtProductType
RtlGetNtSystemRoot
RtlGetNtVersionNumbers
RtlGetOwnerSecurityDescriptor
RtlGetParentLocaleName
RtlGetPersistedStateLocation
RtlGetProcessHeaps
RtlGetProcessPreferredUILanguages
RtlGetProductInfo
RtlGetReturnAddressHijackTarget
RtlGetSaclSecurityDescriptor
RtlGetSearchPath
RtlGetSecurityDescriptorRMControl
RtlGetSessionProperties
RtlGetSetBootStatusData
RtlGetSuiteMask
RtlGetSystemBootStatus
RtlGetSystemBootStatusEx
RtlGetSystemGlobalData
RtlGetSystemPreferredUILanguages
RtlGetSystemTimeAndBias
RtlGetSystemTimePrecise
RtlGetThreadErrorMode
RtlGetThreadLangIdByIndex
RtlGetThreadPreferredUILanguages
RtlGetThreadWorkOnBehalfTicket
RtlGetTokenNamedObjectPath
RtlGetUILanguageInfo
RtlGetUmsCompletionListEvent
RtlGetUnloadEventTrace
RtlGetUnloadEventTraceEx
RtlGetUserInfoHeap
RtlGetUserPreferredUILanguages
RtlGetVersion
RtlGrowFunctionTable
RtlGuardCheckLongJumpTarget
RtlHashUnicodeString
RtlHeapTrkInitialize
RtlIdentifierAuthoritySid
RtlIdnToAscii
RtlIdnToNameprepUnicode
RtlIdnToUnicode
RtlImageDirectoryEntryToData
RtlImageNtHeader
RtlImageNtHeaderEx
RtlImageRvaToSection
RtlImageRvaToVa
RtlImpersonateSelf
RtlImpersonateSelfEx
RtlIncrementCorrelationVector
RtlInitAnsiString
RtlInitAnsiStringEx
RtlInitBarrier
RtlInitCodePageTable
RtlInitEnumerationHashTable
RtlInitMemoryStream
RtlInitNlsTables
RtlInitOutOfProcessMemoryStream
RtlInitString
RtlInitStringEx
RtlInitStrongEnumerationHashTable
RtlInitUTF8String
RtlInitUTF8StringEx
RtlInitUnicodeString
RtlInitUnicodeStringEx
RtlInitWeakEnumerationHashTable
RtlInitializeAtomPackage
RtlInitializeBitMap
RtlInitializeBitMapEx
RtlInitializeConditionVariable
RtlInitializeContext
RtlInitializeCorrelationVector
RtlInitializeCriticalSection
RtlInitializeCriticalSectionAndSpinCount
RtlInitializeCriticalSectionEx
RtlInitializeExtendedContext
RtlInitializeExtendedContext2
RtlInitializeGenericTable
RtlInitializeGenericTableAvl
RtlInitializeHandleTable
RtlInitializeNtUserPfn
RtlInitializeRXact
RtlInitializeResource
RtlInitializeSListHead
RtlInitializeSRWLock
RtlInitializeSid
RtlInitializeSidEx
RtlInsertElementGenericTable
RtlInsertElementGenericTableAvl
RtlInsertElementGenericTableFull
RtlInsertElementGenericTableFullAvl
RtlInsertEntryHashTable
RtlInstallFunctionTableCallback
RtlInt64ToUnicodeString
RtlIntegerToChar
RtlIntegerToUnicodeString
RtlInterlockedClearBitRun
RtlInterlockedClearBitRunEx
RtlInterlockedFlushSList
RtlInterlockedPopEntrySList
RtlInterlockedPushEntrySList
RtlInterlockedPushListSList
RtlInterlockedPushListSListEx
RtlInterlockedSetBitRun
RtlIoDecodeMemIoResource
RtlIoEncodeMemIoResource
RtlIpv4AddressToStringA
RtlIpv4AddressToStringExA
RtlIpv4AddressToStringExW
RtlIpv4AddressToStringW
RtlIpv4StringToAddressA
RtlIpv4StringToAddressExA
RtlIpv4StringToAddressExW
RtlIpv4StringToAddressW
RtlIpv6AddressToStringA
RtlIpv6AddressToStringExA
RtlIpv6AddressToStringExW
RtlIpv6AddressToStringW
RtlIpv6StringToAddressA
RtlIpv6StringToAddressExA
RtlIpv6StringToAddressExW
RtlIpv6StringToAddressW
RtlIsActivationContextActive
RtlIsApiSetImplemented
RtlIsCapabilitySid
RtlIsCloudFilesPlaceholder
RtlIsCriticalSectionLocked
RtlIsCriticalSectionLockedByThread
RtlIsCurrentProcess
RtlIsCurrentThread
RtlIsCurrentThreadAttachExempt
RtlIsDosDeviceName_U
RtlIsEcCode
RtlIsElevatedRid
RtlIsEnclaveFeaturePresent
RtlIsFeatureEnabledForEnterprise
RtlIsGenericTableEmpty
RtlIsGenericTableEmptyAvl
RtlIsMultiSessionSku
RtlIsMultiUsersInSessionSku
RtlIsNameInExpression
RtlIsNameInUnUpcasedExpression
RtlIsNameLegalDOS8Dot3
RtlIsNonEmptyDirectoryReparsePointAllowed
RtlIsNormalizedString
RtlIsPackageSid
RtlIsParentOfChildAppContainer
RtlIsPartialPlaceholder
RtlIsPartialPlaceholderFileHandle
RtlIsPartialPlaceholderFileInfo
RtlIsProcessorFeaturePresent
RtlIsStateSeparationEnabled
RtlIsTextUnicode
RtlIsThreadWithinLoaderCallout
RtlIsUntrustedObject
RtlIsValidHandle
RtlIsValidIndexHandle
RtlIsValidLocaleName
RtlIsValidProcessTrustLabelSid
RtlIsZeroMemory
RtlKnownExceptionFilter
RtlLCIDToCultureName
RtlLargeIntegerToChar
RtlLcidToLocaleName
RtlLeaveCriticalSection
RtlLengthCurrentClearRunBackwardEx
RtlLengthCurrentClearRunForwardEx
RtlLengthRequiredSid
RtlLengthSecurityDescriptor
RtlLengthSid
RtlLengthSidAsUnicodeString
RtlLoadString
RtlLocalTimeToSystemTime
RtlLocaleNameToLcid
RtlLocateExtendedFeature
RtlLocateExtendedFeature2
RtlLocateLegacyContext
RtlLockBootStatusData
RtlLockCurrentThread
RtlLockHeap
RtlLockMemoryBlockLookaside
RtlLockMemoryStreamRegion
RtlLockMemoryZone
RtlLockModuleSection
RtlLogStackBackTrace
RtlLogUnexpectedCodepath
RtlLookupAtomInAtomTable
RtlLookupElementGenericTable
RtlLookupElementGenericTableAvl
RtlLookupElementGenericTableFull
RtlLookupElementGenericTableFullAvl
RtlLookupEntryHashTable
RtlLookupFirstMatchingElementGenericTableAvl
RtlLookupFunctionEntry
RtlLookupFunctionTable
RtlMakeSelfRelativeSD
RtlMapGenericMask
RtlMapSecurityErrorToNtStatus
RtlMoveMemory
RtlMultiAppendUnicodeStringBuffer
RtlMultiByteToUnicodeN
RtlMultiByteToUnicodeSize
RtlMultipleAllocateHeap
RtlMultipleFreeHeap
RtlNewInstanceSecurityObject
RtlNewSecurityGrantedAccess
RtlNewSecurityObject
RtlNewSecurityObjectEx
RtlNewSecurityObjectWithMultipleInheritance
RtlNormalizeProcessParams
RtlNormalizeSecurityDescriptor
RtlNormalizeString
RtlNotifyFeatureToggleUsage
RtlNotifyFeatureUsage
RtlNtPathNameToDosPathName
RtlNtStatusToDosError
RtlNtStatusToDosErrorNoTeb
RtlNtdllName
RtlNumberGenericTableElements
RtlNumberGenericTableElementsAvl
RtlNumberOfClearBits
RtlNumberOfClearBitsEx
RtlNumberOfClearBitsInRange
RtlNumberOfSetBits
RtlNumberOfSetBitsEx
RtlNumberOfSetBitsInRange
RtlNumberOfSetBitsUlongPtr
RtlOemStringToUnicodeSize
RtlOemStringToUnicodeString
RtlOemToUnicodeN
RtlOpenCrossProcessEmulatorWorkConnection
RtlOpenCurrentUser
RtlOsDeploymentState
RtlOverwriteFeatureConfigurationBuffer
RtlOwnerAcesPresent
RtlPcToFileHeader
RtlPinAtomInAtomTable
RtlPopFrame
RtlPrefixString
RtlPrefixUnicodeString
RtlPrepareForProcessCloning
RtlProcessFlsData
RtlProtectHeap
RtlPublishWnfStateData
RtlPushFrame
RtlQueryActivationContextApplicationSettings
RtlQueryAllFeatureConfigurations
RtlQueryAllInternalFeatureConfigurations
RtlQueryAllInternalRuntimeFeatureConfigurations
RtlQueryAtomInAtomTable
RtlQueryCriticalSectionOwner
RtlQueryDepthSList
RtlQueryDynamicTimeZoneInformation
RtlQueryElevationFlags
RtlQueryEnvironmentVariable
RtlQueryEnvironmentVariable_U
RtlQueryFeatureConfiguration
RtlQueryFeatureConfigurationChangeStamp
RtlQueryFeatureUsageNotificationSubscriptions
RtlQueryHeapInformation
RtlQueryImageMitigationPolicy
RtlQueryInformationAcl
RtlQueryInformationActivationContext
RtlQueryInformationActiveActivationContext
RtlQueryInterfaceMemoryStream
RtlQueryInternalFeatureConfiguration
RtlQueryModuleInformation
RtlQueryPackageClaims
RtlQueryPackageIdentity
RtlQueryPackageIdentityEx
RtlQueryPerformanceCounter
RtlQueryPerformanceFrequency
RtlQueryPointerMapping
RtlQueryProcessBackTraceInformation
RtlQueryProcessDebugInformation
RtlQueryProcessHeapInformation
RtlQueryProcessLockInformation
RtlQueryProcessPlaceholderCompatibilityMode
RtlQueryPropertyStore
RtlQueryProtectedPolicy
RtlQueryRegistryValueWithFallback
RtlQueryRegistryValues
RtlQueryRegistryValuesEx
RtlQueryResourcePolicy
RtlQuerySecurityObject
RtlQueryTagHeap
RtlQueryThreadPlaceholderCompatibilityMode
RtlQueryThreadProfiling
RtlQueryTimeZoneInformation
RtlQueryTokenHostIdAsUlong64
RtlQueryUmsThreadInformation
RtlQueryUnbiasedInterruptTime
RtlQueryValidationRunlevel
RtlQueryWnfMetaNotification
RtlQueryWnfStateData
RtlQueryWnfStateDataWithExplicitScope
RtlQueueApcWow64Thread
RtlQueueWorkItem
RtlRaiseCustomSystemEventTrigger
RtlRaiseException
RtlRaiseExceptionForReturnAddressHijack
RtlRaiseNoncontinuableException
RtlRaiseStatus
RtlRandom
RtlRandomEx
RtlRbInsertNodeEx
RtlRbRemoveNode
RtlRcuAllocate
RtlRcuFree
RtlRcuReadLock
RtlRcuReadUnlock
RtlRcuSynchronize
RtlReAllocateHeap
RtlReadMemoryStream
RtlReadOutOfProcessMemoryStream
RtlReadThreadProfilingData
RtlRealPredecessor
RtlRealSuccessor
RtlRegisterFeatureConfigurationChangeNotification
RtlRegisterForWnfMetaNotification
RtlRegisterSecureMemoryCacheCallback
RtlRegisterThreadWithCsrss
RtlRegisterWait
RtlReleaseActivationContext
RtlReleaseMemoryStream
RtlReleasePath
RtlReleasePebLock
RtlReleasePrivilege
RtlReleaseRelativeName
RtlReleaseResource
RtlReleaseSRWLockExclusive
RtlReleaseSRWLockShared
RtlRemoteCall
RtlRemoveEntryHashTable
RtlRemovePointerMapping
RtlRemovePrivileges
RtlRemovePropertyStore
RtlRemoveVectoredContinueHandler
RtlRemoveVectoredExceptionHandler
RtlReplaceSidInSd
RtlReplaceSystemDirectoryInPath
RtlReportException
RtlReportExceptionEx
RtlReportSilentProcessExit
RtlReportSqmEscalation
RtlResetMemoryBlockLookaside
RtlResetMemoryZone
RtlResetNtUserPfn
RtlResetRtlTranslations
RtlRestoreBootStatusDefaults
RtlRestoreContext
RtlRestoreLastWin32Error
RtlRestoreSystemBootStatusDefaults
RtlRestoreThreadPreferredUILanguages
RtlRetrieveNtUserPfn
RtlRevertMemoryStream
RtlRunDecodeUnicodeString
RtlRunEncodeUnicodeString
RtlRunOnceBeginInitialize
RtlRunOnceComplete
RtlRunOnceExecuteOnce
RtlRunOnceInitialize
RtlSecondsSince1970ToTime
RtlSecondsSince1980ToTime
RtlSeekMemoryStream
RtlSelfRelativeToAbsoluteSD
RtlSelfRelativeToAbsoluteSD2
RtlSendMsgToSm
RtlSetAllBits
RtlSetAllBitsEx
RtlSetAttributesSecurityDescriptor
RtlSetBit
RtlSetBitEx
RtlSetBits
RtlSetBitsEx
RtlSetControlSecurityDescriptor
RtlSetCriticalSectionSpinCount
RtlSetCurrentDirectory_U
RtlSetCurrentEnvironment
RtlSetCurrentTransaction
RtlSetDaclSecurityDescriptor
RtlSetDynamicTimeZoneInformation
RtlSetEnvironmentStrings
RtlSetEnvironmentVar
RtlSetEnvironmentVariable
RtlSetExtendedFeaturesMask
RtlSetFeatureConfigurations
RtlSetGroupSecurityDescriptor
RtlSetHeapInformation
RtlSetImageMitigationPolicy
RtlSetInformationAcl
RtlSetIoCompletionCallback
RtlSetLastWin32Error
RtlSetLastWin32ErrorAndNtStatusFromNtStatus
RtlSetMemoryStreamSize
RtlSetOwnerSecurityDescriptor
RtlSetPortableOperatingSystem
RtlSetProcessDebugInformation
RtlSetProcessIsCritical
RtlSetProcessPlaceholderCompatibilityMode
RtlSetProcessPreferredUILanguages
RtlSetProtectedPolicy
RtlSetProxiedProcessId
RtlSetSaclSecurityDescriptor
RtlSetSearchPathMode
RtlSetSecurityDescriptorRMControl
RtlSetSecurityObject
RtlSetSecurityObjectEx
RtlSetSystemBootStatus
RtlSetSystemBootStatusEx
RtlSetThreadErrorMode
RtlSetThreadIsCritical
RtlSetThreadPlaceholderCompatibilityMode
RtlSetThreadPoolStartFunc
RtlSetThreadPreferredUILanguages
RtlSetThreadPreferredUILanguages2
RtlSetThreadSubProcessTag
RtlSetThreadWorkOnBehalfTicket
RtlSetTimeZoneInformation
RtlSetTimer
RtlSetUmsThreadInformation
RtlSetUnhandledExceptionFilter
RtlSetUserFlagsHeap
RtlSetUserValueHeap
RtlSidDominates
RtlSidDominatesForTrust
RtlSidEqualLevel
RtlSidHashInitialize
RtlSidHashLookup
RtlSidIsHigherLevel
RtlSizeHeap
RtlSleepConditionVariableCS
RtlSleepConditionVariableSRW
RtlSplay
RtlStartRXact
RtlStatMemoryStream
RtlStringFromGUID
RtlStringFromGUIDEx
RtlStronglyEnumerateEntryHashTable
RtlSubAuthorityCountSid
RtlSubAuthoritySid
RtlSubscribeForFeatureUsageNotification
RtlSubscribeWnfStateChangeNotification
RtlSubtreePredecessor
RtlSubtreeSuccessor
RtlSwitchedVVI
RtlSystemTimeToLocalTime
RtlTestAndPublishWnfStateData
RtlTestBit
RtlTestBitEx
RtlTestProtectedAccess
RtlTimeFieldsToTime
RtlTimeToElapsedTimeFields
RtlTimeToSecondsSince1970
RtlTimeToSecondsSince1980
RtlTimeToTimeFields
RtlTlsAlloc
RtlTlsFree
RtlTlsSetValue
RtlTraceDatabaseAdd
RtlTraceDatabaseCreate
RtlTraceDatabaseDestroy
RtlTraceDatabaseEnumerate
RtlTraceDatabaseFind
RtlTraceDatabaseLock
RtlTraceDatabaseUnlock
RtlTraceDatabaseValidate
RtlTryAcquirePebLock
RtlTryAcquireSRWLockExclusive
RtlTryAcquireSRWLockShared
RtlTryConvertSRWLockSharedToExclusiveOrRelease
RtlTryEnterCriticalSection
RtlUTF8StringToUnicodeString
RtlUTF8ToUnicodeN
RtlUdiv128
RtlUmsThreadYield
RtlUnhandledExceptionFilter
RtlUnhandledExceptionFilter2
RtlUnicodeStringToAnsiSize
RtlUnicodeStringToAnsiString
RtlUnicodeStringToCountedOemString
RtlUnicodeStringToInteger
RtlUnicodeStringToOemSize
RtlUnicodeStringToOemString
RtlUnicodeStringToUTF8String
RtlUnicodeToCustomCPN
RtlUnicodeToMultiByteN
RtlUnicodeToMultiByteSize
RtlUnicodeToOemN
RtlUnicodeToUTF8N
RtlUniform
RtlUnlockBootStatusData
RtlUnlockCurrentThread
RtlUnlockHeap
RtlUnlockMemoryBlockLookaside
RtlUnlockMemoryStreamRegion
RtlUnlockMemoryZone
RtlUnlockModuleSection
RtlUnregisterFeatureConfigurationChangeNotification
RtlUnsubscribeFromFeatureUsageNotifications
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlUnsubscribeWnfNotificationWithCompletionCallback
RtlUnsubscribeWnfStateChangeNotification
RtlUnwind
RtlUnwindEx
RtlUpcaseUnicodeChar
RtlUpcaseUnicodeString
RtlUpcaseUnicodeStringToAnsiString
RtlUpcaseUnicodeStringToCountedOemString
RtlUpcaseUnicodeStringToOemString
RtlUpcaseUnicodeToCustomCPN
RtlUpcaseUnicodeToMultiByteN
RtlUpcaseUnicodeToOemN
RtlUpdateClonedCriticalSection
RtlUpdateClonedSRWLock
RtlUpdateTimer
RtlUpperChar
RtlUpperString
RtlUserFiberStart
RtlUserThreadStart
RtlValidAcl
RtlValidProcessProtection
RtlValidRelativeSecurityDescriptor
RtlValidSecurityDescriptor
RtlValidSid
RtlValidateCorrelationVector
RtlValidateHeap
RtlValidateProcessHeaps
RtlValidateUnicodeString
RtlValidateUserCallTarget
RtlVerifyVersionInfo
RtlVirtualUnwind
RtlVirtualUnwind2
RtlWaitForWnfMetaNotification
RtlWaitOnAddress
RtlWakeAddressAll
RtlWakeAddressAllNoFence
RtlWakeAddressSingle
RtlWakeAddressSingleNoFence
RtlWakeAllConditionVariable
RtlWakeConditionVariable
RtlWalkFrameChain
RtlWalkHeap
RtlWeaklyEnumerateEntryHashTable
RtlWerpReportException
RtlWnfDllUnloadCallback
RtlWow64CallFunction64
RtlWow64ChangeProcessState
RtlWow64ChangeThreadState
RtlWow64EnableFsRedirection
RtlWow64EnableFsRedirectionEx
RtlWow64GetCpuAreaEnabledFeatures
RtlWow64GetCpuAreaInfo
RtlWow64GetCurrentCpuArea
RtlWow64GetCurrentMachine
RtlWow64GetEquivalentMachineCHPE
RtlWow64GetProcessMachines
RtlWow64GetSharedInfoProcess
RtlWow64GetThreadContext
RtlWow64GetThreadSelectorEntry
RtlWow64IsWowGuestMachineSupported
RtlWow64LogMessageInEventLogger
RtlWow64PopAllCrossProcessWorkFromWorkList
RtlWow64PopCrossProcessWorkFromFreeList
RtlWow64PushCrossProcessWorkOntoFreeList
RtlWow64PushCrossProcessWorkOntoWorkList
RtlWow64RequestCrossProcessHeavyFlush
RtlWow64SetThreadContext
RtlWow64SuspendProcess
RtlWow64SuspendThread
RtlWriteMemoryStream
RtlWriteNonVolatileMemory
RtlWriteRegistryValue
RtlXRestore
RtlXSave
RtlZeroHeap
RtlZeroMemory
RtlZombifyActivationContext
RtlpApplyLengthFunction
RtlpCheckDynamicTimeZoneInformation
RtlpCleanupRegistryKeys
RtlpConvertAbsoluteToRelativeSecurityAttribute
RtlpConvertCultureNamesToLCIDs
RtlpConvertLCIDsToCultureNames
RtlpConvertRelativeToAbsoluteSecurityAttribute
RtlpCreateProcessRegistryInfo
RtlpEnsureBufferSize
RtlpFreezeTimeBias
RtlpGetDeviceFamilyInfoEnum
RtlpGetLCIDFromLangInfoNode
RtlpGetNameFromLangInfoNode
RtlpGetSystemDefaultUILanguage
RtlpGetUserOrMachineUILanguage4NLS
RtlpInitializeLangRegistryInfo
RtlpIsQualifiedLanguage
RtlpLoadMachineUIByPolicy
RtlpLoadUserUIByPolicy
RtlpMergeSecurityAttributeInformation
RtlpMuiFreeLangRegistryInfo
RtlpMuiRegCreateRegistryInfo
RtlpMuiRegFreeRegistryInfo
RtlpMuiRegLoadRegistryInfo
RtlpNotOwnerCriticalSection
RtlpNtCreateKey
RtlpNtEnumerateSubKey
RtlpNtMakeTemporaryKey
RtlpNtOpenKey
RtlpNtQueryValueKey
RtlpNtSetValueKey
RtlpQueryDefaultUILanguage
RtlpQueryProcessDebugInformationFromWow64
RtlpQueryProcessDebugInformationRemote
RtlpRefreshCachedUILanguage
RtlpScpCfgNtdllExports
RtlpSetInstallLanguage
RtlpSetPreferredUILanguages
RtlpSetUserPreferredUILanguages
RtlpTimeFieldsToTime
RtlpTimeToTimeFields
RtlpUnWaitCriticalSection
RtlpVerifyAndCommitUILanguageSettings
RtlpWaitForCriticalSection
RtlpWow64CtxFromAmd64
RtlpWow64GetContextOnAmd64
RtlpWow64SetContextOnAmd64
RtlxAnsiStringToUnicodeSize
RtlxOemStringToUnicodeSize
RtlxUnicodeStringToAnsiSize
RtlxUnicodeStringToOemSize
SbExecuteProcedure
SbSelectProcedure
ShipAssert
ShipAssertGetBufferInfo
ShipAssertMsgA
ShipAssertMsgW
TpAllocAlpcCompletion
TpAllocAlpcCompletionEx
TpAllocCleanupGroup
TpAllocIoCompletion
TpAllocJobNotification
TpAllocPool
TpAllocTimer
TpAllocWait
TpAllocWork
TpAlpcRegisterCompletionList
TpAlpcUnregisterCompletionList
TpCallbackDetectedUnrecoverableError
TpCallbackIndependent
TpCallbackLeaveCriticalSectionOnCompletion
TpCallbackMayRunLong
TpCallbackReleaseMutexOnCompletion
TpCallbackReleaseSemaphoreOnCompletion
TpCallbackSendAlpcMessageOnCompletion
TpCallbackSendPendingAlpcMessage
TpCallbackSetEventOnCompletion
TpCallbackUnloadDllOnCompletion
TpCancelAsyncIoOperation
TpCaptureCaller
TpCheckTerminateWorker
TpDbgDumpHeapUsage
TpDbgSetLogRoutine
TpDisablePoolCallbackChecks
TpDisassociateCallback
TpIsTimerSet
TpPostWork
TpQueryPoolStackInformation
TpReleaseAlpcCompletion
TpReleaseCleanupGroup
TpReleaseCleanupGroupMembers
TpReleaseIoCompletion
TpReleaseJobNotification
TpReleasePool
TpReleaseTimer
TpReleaseWait
TpReleaseWork
TpSetDefaultPoolMaxThreads
TpSetDefaultPoolStackInformation
TpSetPoolMaxThreads
TpSetPoolMaxThreadsSoftLimit
TpSetPoolMinThreads
TpSetPoolStackInformation
TpSetPoolThreadBasePriority
TpSetPoolThreadCpuSets
TpSetPoolWorkerThreadIdleTimeout
TpSetTimer
TpSetTimerEx
TpSetWait
TpSetWaitEx
TpSimpleTryPost
TpStartAsyncIoOperation
TpTimerOutstandingCallbackCount
TpTrimPools
TpWaitForAlpcCompletion
TpWaitForIoCompletion
TpWaitForJobNotification
TpWaitForTimer
TpWaitForWait
TpWaitForWork
TpWorkOnBehalfClearTicket
TpWorkOnBehalfSetTicket
VerSetConditionMask
WerReportExceptionWorker
WerReportSQMEvent
WinSqmAddToAverageDWORD
WinSqmAddToStream
WinSqmAddToStreamEx
WinSqmCheckEscalationAddToStreamEx
WinSqmCheckEscalationSetDWORD
WinSqmCheckEscalationSetDWORD64
WinSqmCheckEscalationSetString
WinSqmCommonDatapointDelete
WinSqmCommonDatapointSetDWORD
WinSqmCommonDatapointSetDWORD64
WinSqmCommonDatapointSetStreamEx
WinSqmCommonDatapointSetString
WinSqmEndSession
WinSqmEventEnabled
WinSqmEventWrite
WinSqmGetEscalationRuleStatus
WinSqmGetInstrumentationProperty
WinSqmIncrementDWORD
WinSqmIsOptedIn
WinSqmIsOptedInEx
WinSqmIsSessionDisabled
WinSqmSetDWORD
WinSqmSetDWORD64
WinSqmSetEscalationInfo
WinSqmSetIfMaxDWORD
WinSqmSetIfMinDWORD
WinSqmSetString
WinSqmStartSession
WinSqmStartSessionForPartner
WinSqmStartSqmOptinListener
ZwAcceptConnectPort
ZwAccessCheck
ZwAccessCheckAndAuditAlarm
ZwAccessCheckByType
ZwAccessCheckByTypeAndAuditAlarm
ZwAccessCheckByTypeResultList
ZwAccessCheckByTypeResultListAndAuditAlarm
ZwAccessCheckByTypeResultListAndAuditAlarmByHandle
ZwAcquireCrossVmMutant
ZwAcquireProcessActivityReference
ZwAddAtom
ZwAddAtomEx
ZwAddBootEntry
ZwAddDriverEntry
ZwAdjustGroupsToken
ZwAdjustPrivilegesToken
ZwAdjustTokenClaimsAndDeviceGroups
ZwAlertMultipleThreadByThreadId
ZwAlertResumeThread
ZwAlertThread
ZwAlertThreadByThreadId
ZwAlertThreadByThreadIdEx
ZwAllocateLocallyUniqueId
ZwAllocateReserveObject
ZwAllocateUserPhysicalPages
ZwAllocateUserPhysicalPagesEx
ZwAllocateUuids
ZwAllocateVirtualMemory
ZwAllocateVirtualMemoryEx
ZwAlpcAcceptConnectPort
ZwAlpcCancelMessage
ZwAlpcConnectPort
ZwAlpcConnectPortEx
ZwAlpcCreatePort
ZwAlpcCreatePortSection
ZwAlpcCreateResourceReserve
ZwAlpcCreateSectionView
ZwAlpcCreateSecurityContext
ZwAlpcDeletePortSection
ZwAlpcDeleteResourceReserve
ZwAlpcDeleteSectionView
ZwAlpcDeleteSecurityContext
ZwAlpcDisconnectPort
ZwAlpcImpersonateClientContainerOfPort
ZwAlpcImpersonateClientOfPort
ZwAlpcOpenSenderProcess
ZwAlpcOpenSenderThread
ZwAlpcQueryInformation
ZwAlpcQueryInformationMessage
ZwAlpcRevokeSecurityContext
ZwAlpcSendWaitReceivePort
ZwAlpcSetInformation
ZwApphelpCacheControl
ZwAreMappedFilesTheSame
ZwAssignProcessToJobObject
ZwAssociateWaitCompletionPacket
ZwCallEnclave
ZwCallbackReturn
ZwCancelIoFile
ZwCancelIoFileEx
ZwCancelSynchronousIoFile
ZwCancelTimer
ZwCancelTimer2
ZwCancelWaitCompletionPacket
ZwChangeProcessState
ZwChangeThreadState
ZwClearEvent
ZwClose
ZwCloseObjectAuditAlarm
ZwCommitComplete
ZwCommitEnlistment
ZwCommitRegistryTransaction
ZwCommitTransaction
ZwCompactKeys
ZwCompareObjects
ZwCompareSigningLevels
ZwCompareTokens
ZwCompleteConnectPort
ZwCompressKey
ZwConnectPort
ZwContinue
ZwContinueEx
ZwConvertBetweenAuxiliaryCounterAndPerformanceCounter
ZwCopyFileChunk
ZwCreateCpuPartition
ZwCreateCrossVmEvent
ZwCreateCrossVmMutant
ZwCreateDebugObject
ZwCreateDirectoryObject
ZwCreateDirectoryObjectEx
ZwCreateEnclave
ZwCreateEnlistment
ZwCreateEvent
ZwCreateEventPair
ZwCreateFile
ZwCreateIRTimer
ZwCreateIoCompletion
ZwCreateIoRing
ZwCreateJobObject
ZwCreateJobSet
ZwCreateKey
ZwCreateKeyTransacted
ZwCreateKeyedEvent
ZwCreateLowBoxToken
ZwCreateMailslotFile
ZwCreateMutant
ZwCreateNamedPipeFile
ZwCreatePagingFile
ZwCreatePartition
ZwCreatePort
ZwCreatePrivateNamespace
ZwCreateProcess
ZwCreateProcessEx
ZwCreateProcessStateChange
ZwCreateProfile
ZwCreateProfileEx
ZwCreateRegistryTransaction
ZwCreateResourceManager
ZwCreateSection
ZwCreateSectionEx
ZwCreateSemaphore
ZwCreateSymbolicLinkObject
ZwCreateThread
ZwCreateThreadEx
ZwCreateThreadStateChange
ZwCreateTimer
ZwCreateTimer2
ZwCreateToken
ZwCreateTokenEx
ZwCreateTransaction
ZwCreateTransactionManager
ZwCreateUserProcess
ZwCreateWaitCompletionPacket
ZwCreateWaitablePort
ZwCreateWnfStateName
ZwCreateWorkerFactory
ZwDebugActiveProcess
ZwDebugContinue
ZwDelayExecution
ZwDeleteAtom
ZwDeleteBootEntry
ZwDeleteDriverEntry
ZwDeleteFile
ZwDeleteKey
ZwDeleteObjectAuditAlarm
ZwDeletePrivateNamespace
ZwDeleteValueKey
ZwDeleteWnfStateData
ZwDeleteWnfStateName
ZwDeviceIoControlFile
ZwDirectGraphicsCall
ZwDisableLastKnownGood
ZwDisplayString
ZwDrawText
ZwDuplicateObject
ZwDuplicateToken
ZwEnableLastKnownGood
ZwEnumerateBootEntries
ZwEnumerateDriverEntries
ZwEnumerateKey
ZwEnumerateSystemEnvironmentValuesEx
ZwEnumerateTransactionObject
ZwEnumerateValueKey
ZwExtendSection
ZwFilterBootOption
ZwFilterToken
ZwFilterTokenEx
ZwFindAtom
ZwFlushBuffersFile
ZwFlushBuffersFileEx
ZwFlushInstallUILanguage
ZwFlushInstructionCache
ZwFlushKey
ZwFlushProcessWriteBuffers
ZwFlushVirtualMemory
ZwFlushWriteBuffer
ZwFreeUserPhysicalPages
ZwFreeVirtualMemory
ZwFreezeRegistry
ZwFreezeTransactions
ZwFsControlFile
ZwGetCachedSigningLevel
ZwGetCompleteWnfStateSubscription
ZwGetContextThread
ZwGetCurrentProcessorNumber
ZwGetCurrentProcessorNumberEx
ZwGetDevicePowerState
ZwGetMUIRegistryInfo
ZwGetNextProcess
ZwGetNextThread
ZwGetNlsSectionPtr
ZwGetNotificationResourceManager
ZwGetWriteWatch
ZwImpersonateAnonymousToken
ZwImpersonateClientOfPort
ZwImpersonateThread
ZwInitializeEnclave
ZwInitializeNlsFiles
ZwInitializeRegistry
ZwInitiatePowerAction
ZwIsProcessInJob
ZwIsSystemResumeAutomatic
ZwIsUILanguageComitted
ZwListenPort
ZwLoadDriver
ZwLoadEnclaveData
ZwLoadKey
ZwLoadKey2
ZwLoadKey3
ZwLoadKeyEx
ZwLockFile
ZwLockProductActivationKeys
ZwLockRegistryKey
ZwLockVirtualMemory
ZwMakePermanentObject
ZwMakeTemporaryObject
ZwManageHotPatch
ZwManagePartition
ZwMapCMFModule
ZwMapUserPhysicalPages
ZwMapUserPhysicalPagesScatter
ZwMapViewOfSection
ZwMapViewOfSectionEx
ZwModifyBootEntry
ZwModifyDriverEntry
ZwNotifyChangeDirectoryFile
ZwNotifyChangeDirectoryFileEx
ZwNotifyChangeKey
ZwNotifyChangeMultipleKeys
ZwNotifyChangeSession
ZwOpenCpuPartition
ZwOpenDirectoryObject
ZwOpenEnlistment
ZwOpenEvent
ZwOpenEventPair
ZwOpenFile
ZwOpenIoCompletion
ZwOpenJobObject
ZwOpenKey
ZwOpenKeyEx
ZwOpenKeyTransacted
ZwOpenKeyTransactedEx
ZwOpenKeyedEvent
ZwOpenMutant
ZwOpenObjectAuditAlarm
ZwOpenPartition
ZwOpenPrivateNamespace
ZwOpenProcess
ZwOpenProcessToken
ZwOpenProcessTokenEx
ZwOpenRegistryTransaction
ZwOpenResourceManager
ZwOpenSection
ZwOpenSemaphore
ZwOpenSession
ZwOpenSymbolicLinkObject
ZwOpenThread
ZwOpenThreadToken
ZwOpenThreadTokenEx
ZwOpenTimer
ZwOpenTransaction
ZwOpenTransactionManager
ZwPlugPlayControl
ZwPowerInformation
ZwPrePrepareComplete
ZwPrePrepareEnlistment
ZwPrepareComplete
ZwPrepareEnlistment
ZwPrivilegeCheck
ZwPrivilegeObjectAuditAlarm
ZwPrivilegedServiceAuditAlarm
ZwPropagationComplete
ZwPropagationFailed
ZwProtectVirtualMemory
ZwPssCaptureVaSpaceBulk
ZwPulseEvent
ZwQueryAttributesFile
ZwQueryAuxiliaryCounterFrequency
ZwQueryBootEntryOrder
ZwQueryBootOptions
ZwQueryDebugFilterState
ZwQueryDefaultLocale
ZwQueryDefaultUILanguage
ZwQueryDirectoryFile
ZwQueryDirectoryFileEx
ZwQueryDirectoryObject
ZwQueryDriverEntryOrder
ZwQueryEaFile
ZwQueryEvent
ZwQueryFullAttributesFile
ZwQueryInformationAtom
ZwQueryInformationByName
ZwQueryInformationCpuPartition
ZwQueryInformationEnlistment
ZwQueryInformationFile
ZwQueryInformationJobObject
ZwQueryInformationPort
ZwQueryInformationProcess
ZwQueryInformationResourceManager
ZwQueryInformationThread
ZwQueryInformationToken
ZwQueryInformationTransaction
ZwQueryInformationTransactionManager
ZwQueryInformationWorkerFactory
ZwQueryInstallUILanguage
ZwQueryIntervalProfile
ZwQueryIoCompletion
ZwQueryIoRingCapabilities
ZwQueryKey
ZwQueryLicenseValue
ZwQueryMultipleValueKey
ZwQueryMutant
ZwQueryObject
ZwQueryOpenSubKeys
ZwQueryOpenSubKeysEx
ZwQueryPerformanceCounter
ZwQueryPortInformationProcess
ZwQueryQuotaInformationFile
ZwQuerySection
ZwQuerySecurityAttributesToken
ZwQuerySecurityObject
ZwQuerySecurityPolicy
ZwQuerySemaphore
ZwQuerySymbolicLinkObject
ZwQuerySystemEnvironmentValue
ZwQuerySystemEnvironmentValueEx
ZwQuerySystemInformation
ZwQuerySystemInformationEx
ZwQuerySystemTime
ZwQueryTimer
ZwQueryTimerResolution
ZwQueryValueKey
ZwQueryVirtualMemory
ZwQueryVolumeInformationFile
ZwQueryWnfStateData
ZwQueryWnfStateNameInformation
ZwQueueApcThread
ZwQueueApcThreadEx
ZwQueueApcThreadEx2
ZwRaiseException
ZwRaiseHardError
ZwReadFile
ZwReadFileScatter
ZwReadOnlyEnlistment
ZwReadRequestData
ZwReadVirtualMemory
ZwReadVirtualMemoryEx
ZwRecoverEnlistment
ZwRecoverResourceManager
ZwRecoverTransactionManager
ZwRegisterProtocolAddressInformation
ZwRegisterThreadTerminatePort
ZwReleaseKeyedEvent
ZwReleaseMutant
ZwReleaseSemaphore
ZwReleaseWorkerFactoryWorker
ZwRemoveIoCompletion
ZwRemoveIoCompletionEx
ZwRemoveProcessDebug
ZwRenameKey
ZwRenameTransactionManager
ZwReplaceKey
ZwReplacePartitionUnit
ZwReplyPort
ZwReplyWaitReceivePort
ZwReplyWaitReceivePortEx
ZwReplyWaitReplyPort
ZwRequestPort
ZwRequestWaitReplyPort
ZwResetEvent
ZwResetWriteWatch
ZwRestoreKey
ZwResumeProcess
ZwResumeThread
ZwRevertContainerImpersonation
ZwRollbackComplete
ZwRollbackEnlistment
ZwRollbackRegistryTransaction
ZwRollbackTransaction
ZwRollforwardTransactionManager
ZwSaveKey
ZwSaveKeyEx
ZwSaveMergedKeys
ZwSecureConnectPort
ZwSerializeBoot
ZwSetBootEntryOrder
ZwSetBootOptions
ZwSetCachedSigningLevel
ZwSetCachedSigningLevel2
ZwSetContextThread
ZwSetDebugFilterState
ZwSetDefaultHardErrorPort
ZwSetDefaultLocale
ZwSetDefaultUILanguage
ZwSetDriverEntryOrder
ZwSetEaFile
ZwSetEvent
ZwSetEventBoostPriority
ZwSetEventEx
ZwSetHighEventPair
ZwSetHighWaitLowEventPair
ZwSetIRTimer
ZwSetInformationCpuPartition
ZwSetInformationDebugObject
ZwSetInformationEnlistment
ZwSetInformationFile
ZwSetInformationIoRing
ZwSetInformationJobObject
ZwSetInformationKey
ZwSetInformationObject
ZwSetInformationProcess
ZwSetInformationResourceManager
ZwSetInformationSymbolicLink
ZwSetInformationThread
ZwSetInformationToken
ZwSetInformationTransaction
ZwSetInformationTransactionManager
ZwSetInformationVirtualMemory
ZwSetInformationWorkerFactory
ZwSetIntervalProfile
ZwSetIoCompletion
ZwSetIoCompletionEx
ZwSetLdtEntries
ZwSetLowEventPair
ZwSetLowWaitHighEventPair
ZwSetQuotaInformationFile
ZwSetSecurityObject
ZwSetSystemEnvironmentValue
ZwSetSystemEnvironmentValueEx
ZwSetSystemInformation
ZwSetSystemPowerState
ZwSetSystemTime
ZwSetThreadExecutionState
ZwSetTimer
ZwSetTimer2
ZwSetTimerEx
ZwSetTimerResolution
ZwSetUuidSeed
ZwSetValueKey
ZwSetVolumeInformationFile
ZwSetWnfProcessNotificationEvent
ZwShutdownSystem
ZwShutdownWorkerFactory
ZwSignalAndWaitForSingleObject
ZwSinglePhaseReject
ZwStartProfile
ZwStopProfile
ZwSubmitIoRing
ZwSubscribeWnfStateChange
ZwSuspendProcess
ZwSuspendThread
ZwSystemDebugControl
ZwTerminateEnclave
ZwTerminateJobObject
ZwTerminateProcess
ZwTerminateThread
ZwTestAlert
ZwThawRegistry
ZwThawTransactions
ZwTraceControl
ZwTraceEvent
ZwTranslateFilePath
ZwUmsThreadYield
ZwUnloadDriver
ZwUnloadKey
ZwUnloadKey2
ZwUnloadKeyEx
ZwUnlockFile
ZwUnlockVirtualMemory
ZwUnmapViewOfSection
ZwUnmapViewOfSectionEx
ZwUnsubscribeWnfStateChange
ZwUpdateWnfStateData
ZwVdmControl
ZwWaitForAlertByThreadId
ZwWaitForDebugEvent
ZwWaitForKeyedEvent
ZwWaitForMultipleObjects
ZwWaitForMultipleObjects32
ZwWaitForSingleObject
ZwWaitForWorkViaWorkerFactory
ZwWaitHighEventPair
ZwWaitLowEventPair
ZwWorkerFactoryWorkerReady
ZwWriteFile
ZwWriteFileGather
ZwWriteRequestData
ZwWriteVirtualMemory
ZwYieldExecution
__C_specific_handler
__chkstk
__isascii
__iscsym
__iscsymf
__misaligned_access
__toascii
_atoi64
_errno
_fltused
_i64toa
_i64toa_s
_i64tow
_i64tow_s
_itoa
_itoa_s
_itow
_itow_s
_lfind
_local_unwind
_ltoa
_ltoa_s
_ltow
_ltow_s
_makepath_s
_memccpy
_memicmp
_setjmp
_setjmpex
_snprintf
_snprintf_s
_snscanf_s
_snwprintf
_snwprintf_s
_snwscanf_s
_splitpath
_splitpath_s
_strcmpi
_stricmp
_strlwr
_strlwr_s
_strnicmp
_strnset_s
_strset_s
_strupr
_strupr_s
_swprintf
_ui64toa
_ui64toa_s
_ui64tow
_ui64tow_s
_ultoa
_ultoa_s
_ultow
_ultow_s
_vscprintf
_vscwprintf
_vsnprintf
_vsnprintf_s
_vsnwprintf
_vsnwprintf_s
_vswprintf
_wcsicmp
_wcslwr
_wcslwr_s
_wcsnicmp
_wcsnset_s
_wcsset_s
_wcstoi64
_wcstoui64
_wcsupr
_wcsupr_s
_wmakepath_s
_wsplitpath_s
_wtoi
_wtoi64
_wtol
abs
atan
atan2
atoi
atol
bsearch
bsearch_s
ceil
cos
fabs
floor
isalnum
isalpha
iscntrl
isdigit
isgraph
islower
isprint
ispunct
isspace
isupper
iswalnum
iswalpha
iswascii
iswctype
iswdigit
iswgraph
iswlower
iswprint
iswspace
iswxdigit
isxdigit
labs
log
longjmp
mbstowcs
memchr
memcmp
memcpy
memcpy_s
memmove
memmove_s
memset
pow
qsort
qsort_s
sin
sprintf
sprintf_s
sqrt
sscanf
sscanf_s
strcat
strcat_s
strchr
strcmp
strcpy
strcpy_s
strcspn
strlen
strncat
strncat_s
strncmp
strncpy
strncpy_s
strnlen
strpbrk
strrchr
strspn
strstr
strtok_s
strtol
strtoul
swprintf
swprintf_s
swscanf_s
tan
tolower
toupper
towlower
towupper
vDbgPrintEx
vDbgPrintExWithPrefix
vsprintf
vsprintf_s
vswprintf_s
wcscat
wcscat_s
wcschr
wcscmp
wcscpy
wcscpy_s
wcscspn
wcslen
wcsncat
wcsncat_s
wcsncmp
wcsncpy
wcsncpy_s
wcsnlen
wcspbrk
wcsrchr
wcsspn
wcsstr
wcstok_s
wcstol
wcstombs
wcstoul
Name
.text
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
SCPCFG
Size
4KB
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
SCPCFGFP
Size
4KB
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
SCPCFGNP
Size
4KB
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
SCPCFGES
Size
4KB
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
RT
Size
4KB
Virtual Size
444B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
PAGE
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
356KB
Virtual Size
354KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
68KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.00cfg
Size
4KB
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.mrdata
Size
16KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
492KB
Virtual Size
489KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, productName=Unmarked objects (old),
count=126, id=260, version=33145,
count=1, id=256, version=33145,
count=49, id=259, version=33145,
count=345, id=264, version=33145,
count=30, id=261, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
ntdsapi.dll
- IMPHASH 964a9ab9a13527fc9bfa5a7d1d1103b8
- SHA256 2c37c40b951c8ddb510722ffb394f6c27906fcc534a13a06c7b475830b0f9674
- MD5 de3697051f79b72c7bccd107193d98fa
- SHA1 23d4208e1c28e914bad62dc472fd222f69d639af
- SHA512 cccafb76998dc0972edaf6a55ddb694b274e66a0476dff53f3d64ec6cb5b0788e0e9ef3bd06547134d012f825c0d7b114dbe2d9c4808665e0af3858e88687a05
- SSDEEP 3072:MXhrq9Hi9oev9/5amWhUOaFH8NwZaWc52o3tUjOkt0SZE//c:Ye9C9zF/YtbaFH8NwZaWc52odyOktfZc
- TLSH T16C04F71EF6A610AED866913A8A574356A732B224230143CF22D0C63DEE5B7DE7F75F40
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
25072
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ntdsapi.pdb
msvcrt
_beginthreadex
__C_specific_handler
_amsg_exit
malloc
strncmp
wcsstr
_vsnwprintf
_wcsnicmp
_wcsicmp
wcschr
wcstol
wcsncmp
_endthreadex
_initterm
memchr
memcpy
_vsnprintf
free
_XcptFilter
_itow
iswxdigit
iswdigit
towlower
wcstoul
memset
api-ms-win-core-heap-l2-1-0
LocalReAlloc
LocalFree
LocalAlloc
rpcrt4
RpcBindingInqAuthInfoA
RpcBindingSetAuthInfoExW
RpcSsGetContextBinding
Ndr64AsyncClientCall
RpcBindingFree
RpcEpResolveBinding
RpcStringFreeW
RpcBindingSetOption
RpcSsDestroyClientContext
NDRCContextBinding
RpcStringBindingParseW
RpcMgmtEpEltInqNextW
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcBindingToStringBindingW
RpcIfInqId
RpcMgmtEpEltInqDone
RpcMgmtEpEltInqBegin
I_RpcGetExtendedError
I_RpcExceptionFilter
NdrClientCall3
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
GetACP
GetUserDefaultLCID
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
CompareStringW
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapDestroy
HeapFree
HeapCreate
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-synch-l1-1-0
WaitForSingleObject
CreateEventA
WaitForMultipleObjectsEx
SetEvent
ResetEvent
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter
GetLastError
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
DisableThreadLibraryCalls
ws2_32
ntohs
WSALookupServiceNextW
GetAddrInfoW
WSALookupServiceEnd
WSAStartup
WSALookupServiceBeginW
GetNameInfoW
FreeAddrInfoW
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
GetComputerNameExW
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceExecuteOnce
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-security-activedirectoryclient-l1-1-0
DsCrackNamesW
DsFreeNameResultW
DsBindWithSpnExW
DsGetDomainControllerInfoW
DsFreeDomainControllerInfoW
DsFreePasswordCredentials
DsMakePasswordCredentialsW
DsUnBindW
api-ms-win-security-activedirectoryclient-l1-1-1
DsFreeNgcKey
DsReadNgcKeyW
DsWriteNgcKeyW
api-ms-win-core-kernel32-legacy-l1-1-0
GetComputerNameW
ntdll
RtlNtStatusToDosError
RtlIpv4AddressToStringExW
RtlIpv6StringToAddressExW
RtlIpv4StringToAddressExW
RtlIpv6AddressToStringExW
DbgPrint
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DsAddCloneDCW
DsAddSidHistoryA
DsAddSidHistoryW
DsBindA
DsBindByInstanceA
DsBindByInstanceW
DsBindToISTGA
DsBindToISTGW
DsBindW
DsBindWithCredA
DsBindWithCredW
DsBindWithSpnA
DsBindWithSpnExA
DsBindWithSpnExW
DsBindWithSpnExWWorker
DsBindWithSpnW
DsBindingSetTimeout
DsClientMakeSpnForTargetServerA
DsClientMakeSpnForTargetServerW
DsCrackNamesA
DsCrackNamesW
DsCrackNamesWWorker
DsCrackSpn2A
DsCrackSpn2W
DsCrackSpn3W
DsCrackSpn4W
DsCrackSpnA
DsCrackSpnW
DsCrackUnquotedMangledRdnA
DsCrackUnquotedMangledRdnW
DsFinishDemotionW
DsFreeCloneDcResult
DsFreeDomainControllerInfoA
DsFreeDomainControllerInfoW
DsFreeDomainControllerInfoWWorker
DsFreeNameResultA
DsFreeNameResultW
DsFreeNameResultWWorker
DsFreeNgcKey
DsFreeNgcKeyWorker
DsFreePasswordCredentials
DsFreePasswordCredentialsWorker
DsFreeSchemaGuidMapA
DsFreeSchemaGuidMapW
DsFreeSpnArrayA
DsFreeSpnArrayW
DsGetBindAddrW
DsGetBindAnnotW
DsGetBindInstGuid
DsGetDomainControllerInfoA
DsGetDomainControllerInfoW
DsGetDomainControllerInfoWWorker
DsGetRdnW
DsGetSpnA
DsGetSpnW
DsInheritSecurityIdentityA
DsInheritSecurityIdentityW
DsInitDemotionW
DsIsMangledDnA
DsIsMangledDnW
DsIsMangledRdnValueA
DsIsMangledRdnValueW
DsListDomainsInSiteA
DsListDomainsInSiteW
DsListInfoForServerA
DsListInfoForServerW
DsListRolesA
DsListRolesW
DsListServersForDomainInSiteA
DsListServersForDomainInSiteW
DsListServersInSiteA
DsListServersInSiteW
DsListSitesA
DsListSitesW
DsLogEntry
DsMakePasswordCredentialsA
DsMakePasswordCredentialsW
DsMakePasswordCredentialsWWorker
DsMakeSpnA
DsMakeSpnW
DsMapSchemaGuidsA
DsMapSchemaGuidsW
DsQuerySitesByCostA
DsQuerySitesByCostW
DsQuerySitesFree
DsQuoteRdnValueA
DsQuoteRdnValueW
DsReadNgcKeyA
DsReadNgcKeyW
DsReadNgcKeyWWorker
DsRemoveDsDomainA
DsRemoveDsDomainW
DsRemoveDsServerA
DsRemoveDsServerW
DsReplicaAddA
DsReplicaAddW
DsReplicaConsistencyCheck
DsReplicaDelA
DsReplicaDelW
DsReplicaDemotionW
DsReplicaFreeInfo
DsReplicaGetInfo2W
DsReplicaGetInfoW
DsReplicaModifyA
DsReplicaModifyW
DsReplicaSyncA
DsReplicaSyncAllA
DsReplicaSyncAllW
DsReplicaSyncW
DsReplicaUpdateRefsA
DsReplicaUpdateRefsW
DsReplicaVerifyObjectsA
DsReplicaVerifyObjectsW
DsServerRegisterSpnA
DsServerRegisterSpnW
DsUnBindA
DsUnBindW
DsUnBindWWorker
DsUnquoteRdnValueA
DsUnquoteRdnValueW
DsWriteAccountSpnA
DsWriteAccountSpnW
DsWriteNgcKeyA
DsWriteNgcKeyW
DsWriteNgcKeyWWorker
DsaopBind
DsaopBindWithCred
DsaopBindWithSpn
DsaopExecuteScript
DsaopPrepareScript
DsaopUnBind
Name
.text
Size
80KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
64KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=42, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=14, id=260, version=33136,
count=5, id=259, version=33136,
count=177, id=1, productName=Unmarked objects,
count=5, id=257, version=33136,
count=1, id=256, version=33136,
count=31, id=264, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
ntfsres.dll
- SHA256 542f85dd0298116eb723fe16bea7410f14eb687073084dcb96c107372141bb79
- MD5 3dc63976111dc49d18b778ed4b083ab3
- SHA1 bbb92b841bfff9edf084c5e7fd7e8bf14e1f5efc
- SHA512 bf6f1f7a9ff7badd77e76d68a5944211e69e90b6aeb939706b1d194ccaa8e0c213da2ef50ffb278379eebe829c40a4fee83824ed3c27572e3a10c93175c0943a
- SSDEEP 6144:EsP+P0BhQs2AX+VmdR9Ory0yqEZge1/8GMEEUkJjl1RlPBjnONsNod4/Eqtp1n/Y:2cBhQs2n8j9X1yA5
- TLSH T14FF4C0025AED2419F1F7DB327B7640F55A2A7AB97A30C82FB055A20E5422F01CF56F36
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
4KB
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
732KB
Virtual Size
730KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=33145,
count=1, id=258, version=33145,
ntlanman.dll
- IMPHASH f1c9c4b282794b4482f755c6b16a47f7
- SHA256 383a39c39632f3041e38b6aeafd8a919c6e813521eb838f7bb47cf8549686e3a
- MD5 212569a278ea4276b71ada1edecff2b5
- SHA1 e1c0be2454f5c48ecd2ad2e37c038d9540751b1e
- SHA512 b61633e11622812f3afeb989a5ee418b7a381c4316f133860a75f38af0dd95c9c2ef3ccef7e72554b3c48e96479418c5a4f35f815a46cfb1c52c5650f48204a6
- SSDEEP 3072:KQ7cu8sNjsOA6rRJzwy41mco92yyyEDlQBFEqYV:KQ58M4O/c11mcooyytQkqY
- TLSH T1EDE3391E33AA10A5E67A917CC5420206E3B3B434231197DF46E0C6BDAF17AD97E39F91
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
48880
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ntlanman.pdb
msvcrt
_lock
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
__dllonexit
free
_callnewh
_onexit
malloc
wcsrchr
memmove
wcscpy_s
_ultow
towupper
_wcsnicmp
memcpy
??1type_info@@UEAA@XZ
_wcsicmp
strcpy_s
memmove_s
memcpy_s
_vsnwprintf
_itow_s
wcschr
_purecall
wcscat_s
_wcsupr
_unlock
__RTDynamicCast
memcmp
memset
ntdll
RtlLookupFunctionEntry
RtlCaptureContext
RtlCopyLuid
NtQueryInformationToken
NtOpenProcessToken
DbgPrint
NtCreateFile
NtQueryInformationFile
RtlDeleteResource
RtlVirtualUnwind
RtlGetLastNtStatus
RtlInitializeResource
RtlAcquireResourceExclusive
NtClose
RtlAppendUnicodeToString
RtlAppendUnicodeStringToString
RtlInitUnicodeStringEx
RtlEqualUnicodeString
RtlCompareUnicodeString
NtOpenFile
RtlInitUnicodeString
NtFsControlFile
RtlNtStatusToDosError
RtlLeaveCriticalSection
RtlInitializeCriticalSection
RtlEnterCriticalSection
RtlDeleteCriticalSection
RtlReleaseResource
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
LoadStringW
DisableThreadLibraryCalls
LoadLibraryExW
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
FreeLibrary
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalReAlloc
LocalFree
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-sysinfo-l1-1-0
GetComputerNameExW
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-synch-l1-1-0
AcquireSRWLockShared
CreateSemaphoreExW
EnterCriticalSection
ReleaseSemaphore
LeaveCriticalSection
CreateMutexExW
ReleaseSRWLockShared
WaitForSingleObject
OpenSemaphoreW
ReleaseMutex
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
DeleteCriticalSection
AcquireSRWLockExclusive
WaitForSingleObjectEx
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
api-ms-win-core-processenvironment-l1-1-0
GetStdHandle
api-ms-win-core-console-l1-1-0
SetConsoleMode
GetConsoleMode
ReadConsoleW
WriteConsoleW
api-ms-win-core-file-l1-1-0
GetFileType
GetDriveTypeW
WriteFile
CreateFileW
GetLogicalDrives
api-ms-win-security-base-l1-1-0
EqualSid
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
DllMain
I_SystemFocusDialog
NPAddConnection
NPAddConnection3
NPAddConnection4
NPCancelConnection
NPCancelConnection2
NPCloseEnum
NPEnumResource
NPFormatNetworkName
NPGetCaps
NPGetConnection
NPGetConnection3
NPGetConnectionPerformance
NPGetPersistentUseOptionsForConnection
NPGetPersistentUseOptionsForConnection2
NPGetReconnectFlags
NPGetResourceInformation
NPGetResourceParent
NPGetUniversalName
NPGetUser
NPOpenEnum
QueryAppInstanceVersion
RegisterAppInstance
RegisterAppInstanceVersion
ResetAllAppInstanceVersions
SetAppInstanceCsvFlags
Name
.text
Size
88KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
456B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
360B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=46, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=15, id=260, version=33145,
count=5, id=259, version=33145,
count=191, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=3, id=261, version=33145,
count=27, id=264, version=33145,
count=1, id=256, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
ntlanui2.dll
- IMPHASH 81b4ef34cf94cb5928cee875ca0cf84b
- SHA256 055aec5c847d912a0c6731e46fbca2855ceb157db173883c112c9fd53f6b47e5
- MD5 1931a75911d3602fd990a76f9e024d7d
- SHA1 d25682666bd44d9c3b2aac3fa1a520123b88cc88
- SHA512 b797687b01eb60642c9f404244c716316683aee6f739eb2b422a991183d75c859c4b32f4434da6793f297e44da171b4a27cbdb5737326f6d2f21a9cf36272223
- SSDEEP 384:wQeGE9lBrhIj73J6WJLp3drqMZePMIvsmg+esWneW:T0lDXWP3dOM4PMIEiA
- TLSH T14313071EB33611D8E06D02384853196AB9F47C2127124AFF47B0AA7F5D72BC0BD3D6A6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4832
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ntlanui2.pdb
msvcrt
wcschr
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
free
_vsnwprintf
memcpy
memset
api-ms-win-core-libraryloader-l1-2-0
LoadStringW
DisableThreadLibraryCalls
GetProcAddress
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
srvcli
NetServerGetInfo
netutils
NetApiBufferFree
NetApiBufferAllocate
wkscli
NetWkstaGetInfo
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
advapi32
LsaQueryInformationPolicy
LsaClose
LsaFreeMemory
LsaOpenPolicy
comctl32
ord17
CreatePropertySheetPageW
DestroyPropertySheetPage
ntdll
RtlInitUnicodeStringEx
ole32
ReleaseStgMedium
user32
RegisterClipboardFormatW
SetWindowLongPtrW
LoadCursorW
GetWindowLongPtrW
SetDlgItemTextW
SetCursor
MessageBoxW
DestroyCursor
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
516B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
172B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=24, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=14, id=260, version=33136,
count=4, id=259, version=33136,
count=54, id=1, productName=Unmarked objects,
count=13, id=257, version=33136,
count=2, id=261, version=33136,
count=1, id=256, version=33136,
count=8, id=264, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
ntmarta.dll
- IMPHASH 30e18160801f336caa9140ce875ad581
- SHA256 f2bfd7121052ddfa5affae30efa070ac98052d76e6a5723f31ff75171c561974
- MD5 8573f8f4a23857239f6c290a6c14761d
- SHA1 c90037e7084335bfd3522c83b2a258081b5b16ff
- SHA512 af5626d82c4123ce36e5e4681aceaa4b6c67f1e372b53fbf9a778ca1790d97894c501e6c706a4f3701d53a06b12b22e1a7b6872e399a5cd6b4e8d6e51fe6f013
- SSDEEP 6144:flQir3zd2ydMmXeMH11rv8onfZbbDDegPyde:KiTzYyGMVTfxbDjPSe
- TLSH T1FA243A5E22BE20A5D56AE27885468315F673B4353300A6EF46E0C6BC4B1BFE97739F40
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
8b:c1:65:f2:0c:dc:da:63:f9:4a:83:06:ba:35:52:53:50:a5:f8:01:ca:d9:97:35:07:64:e0:46:ac:d3:6b:be
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 24, 2025
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:19:da:dd:aa:8b:dc:44:b2:92:00:00:00:00:05:19
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 19, 2025 - Jun 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:3605-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:13:b0:43:35:66:cf:af:95:e8:00:01:00:00:02:13
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
64464
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ntmarta.pdb
api-ms-win-crt-string-l1-1-0
wcsncmp
wcscmp
memset
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__register_onexit_function
_o__seh_filter_dll
memcpy
_o__wcsicmp
_o__wcsnicmp
_o__wtol
_o_free
_o_malloc
_o_qsort
_o_tolower
_o_towlower
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstol
_o_wcstoul
wcsrchr
wcsstr
_o__callnewh
wcschr
_o___stdio_common_vswprintf_s
__C_specific_handler
_o___std_type_info_destroy_list
memcmp
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
LoadStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
api-ms-win-security-base-l1-1-0
GetSecurityDescriptorGroup
CopySid
GetLengthSid
SetSecurityDescriptorControl
AddAuditAccessAceEx
AddAuditAccessObjectAce
AddAccessDeniedAceEx
AddAccessDeniedObjectAce
GetTokenInformation
AddAccessAllowedObjectAce
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
InitializeSecurityDescriptor
MapGenericMask
ConvertToAutoInheritPrivateObjectSecurity
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
GetPrivateObjectSecurity
SetKernelObjectSecurity
CreatePrivateObjectSecurityEx
GetKernelObjectSecurity
MakeSelfRelativeSD
DestroyPrivateObjectSecurity
EqualDomainSid
GetSecurityDescriptorOwner
RevertToSelf
InitializeAcl
AddAccessAllowedAceEx
GetSecurityDescriptorLength
CreatePrivateObjectSecurityWithMultipleInheritance
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
SetThreadToken
GetCurrentThread
OpenThreadToken
ResumeThread
OpenProcessToken
GetExitCodeThread
ExitThread
GetCurrentProcessId
TerminateProcess
TerminateThread
GetCurrentThreadId
CreateThread
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
api-ms-win-core-synch-l1-1-0
WaitForSingleObject
OpenEventW
OpenSemaphoreW
OpenWaitableTimerW
SetEvent
CreateEventW
OpenMutexW
api-ms-win-core-memory-l1-1-0
OpenFileMappingW
api-ms-win-core-file-l1-1-0
FindFirstFileW
FindClose
GetFileInformationByHandle
GetDriveTypeW
CreateFileW
GetFileAttributesW
GetFullPathNameW
FindNextFileW
GetFileSize
api-ms-win-core-io-l1-1-0
DeviceIoControl
GetOverlappedResult
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegQueryInfoKeyW
RegCreateKeyExW
RegSetKeySecurity
RegGetKeySecurity
RegCloseKey
RegEnumKeyExW
RegSetValueExW
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
GetComputerNameExW
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-security-activedirectoryclient-l1-1-0
DsFreeNameResultW
DsCrackNamesW
DsBindWithSpnExW
DsUnBindW
api-ms-win-core-job-l2-1-0
OpenJobObjectW
api-ms-win-core-url-l1-1-0
UrlUnescapeW
ntdll
NtQueryVolumeInformationFile
NtQueryDirectoryFile
NtQueryObject
NtClose
RtlLengthSid
RtlCopySid
RtlConvertSidToUnicodeString
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlLengthSecurityDescriptor
RtlEqualSid
NtOpenDirectoryObject
NtQueryDirectoryObject
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject
NtQuerySecurityObject
RtlDosPathNameToNtPathName_U
NtCreateFile
RtlGetFullPathName_U
NtSetSecurityObject
RtlValidAcl
RtlAcquireResourceShared
RtlConvertSharedToExclusive
RtlReleaseResource
NtOpenEvent
NtOpenMutant
NtOpenProcess
NtOpenSection
NtOpenSemaphore
NtOpenThread
NtOpenTimer
NtOpenJobObject
RtlAcquireResourceExclusive
RtlSubAuthoritySid
RtlSubAuthorityCountSid
RtlInitUnicodeString
RtlFreeHeap
RtlReleaseRelativeName
RtlDosPathNameToRelativeNtPathName_U
NtOpenFile
RtlNtStatusToDosError
NtQueryInformationFile
RtlInitializeResource
RtlDeleteResource
RtlValidSid
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
AccConvertAccessMaskToActrlAccess
AccConvertAccessToSD
AccConvertAccessToSecurityDescriptor
AccConvertAclToAccess
AccConvertSDToAccess
AccFreeIndexArray
AccGetAccessForTrustee
AccGetExplicitEntries
AccGetInheritanceSource
AccLookupAccountName
AccLookupAccountSid
AccLookupAccountTrustee
AccProvCancelOperation
AccProvGetAccessInfoPerObjectType
AccProvGetAllRights
AccProvGetCapabilities
AccProvGetOperationResults
AccProvGetTrusteesAccess
AccProvGrantAccessRights
AccProvHandleGetAccessInfoPerObjectType
AccProvHandleGetAllRights
AccProvHandleGetTrusteesAccess
AccProvHandleGrantAccessRights
AccProvHandleIsAccessAudited
AccProvHandleIsObjectAccessible
AccProvHandleRevokeAccessRights
AccProvHandleRevokeAuditRights
AccProvHandleSetAccessRights
AccProvIsAccessAudited
AccProvIsObjectAccessible
AccProvRevokeAccessRights
AccProvRevokeAuditRights
AccProvSetAccessRights
AccRewriteGetExplicitEntriesFromAcl
AccRewriteGetHandleRights
AccRewriteGetNamedRights
AccRewriteSetEntriesInAcl
AccRewriteSetHandleRights
AccRewriteSetNamedRights
AccSetEntriesInAList
AccTreeResetNamedSecurityInfo
EventGuidToName
EventNameFree
GetExplicitEntriesFromAclW
GetMartaExtensionInterface
GetNamedSecurityInfoW
GetSecurityInfo
SetEntriesInAclW
SetNamedSecurityInfoW
SetSecurityInfo
Name
.text
Size
140KB
Virtual Size
139KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
ERRATA
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
704B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
624B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=57, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1302, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33145,
count=4, id=259, version=33145,
count=18, id=261, version=33145,
count=1, id=256, version=33145,
count=36, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
ntprint.dll
- IMPHASH 5d8340e24f3ad087fa05c0b95f1840b1
- SHA256 e4b0a946b4bdd901e24a2bec40204f59b9dfdaafd64a7d5a809b42c7717c969d
- MD5 206305917bb2c55cec7df991b73692cc
- SHA1 326dfa8b79272718f7b46bafa85f894b3e92cc5f
- SHA512 252d150005b563e67d646ec0d70423069e3c160932c006dff2662003c82988143141f65bdd16d88eaa8958278a1e877e3b5bd379af8c6c84cf6236ab5d8dca02
- SSDEEP 6144:jc1OPobRPAU9c3Q1/nMVcZlts7rXoygyNaTvyjqwEeTQ9SbwE3FXVB:jc1OgJx9c3Q1/nMMltmXoyg4dV
- TLSH T185A4C609A7F90059F4F79B78997682059A72BC692B31D2DF12A4C17D0A72FD0ED34B32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
8944
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ntprint.pdb
api-ms-win-crt-string-l1-1-0
wcscmp
memset
wcsncmp
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsdup
_o__wcsicmp
_o__wcsnicmp
memmove
_o__wtoi
_o_free
_o_iswalpha
_o_iswdigit
_o_iswspace
_o_malloc
_o_wcstok_s
__CxxFrameHandler3
_o__execute_onexit_table
_o__errno
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
__std_terminate
__CxxFrameHandler4
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__C_specific_handler
wcsstr
wcsrchr
wcschr
_CxxThrowException
memcmp
memcpy
ntdll
VerSetConditionMask
RtlGetVersion
RtlInitUnicodeString
NtQuerySystemInformation
RtlLCIDToCultureName
EtwEventRegister
EtwEventUnregister
EtwEventEnabled
EtwEventWrite
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
user32
GetLastActivePopup
SetCursor
LoadCursorW
TranslateMessage
PeekMessageW
DispatchMessageW
MsgWaitForMultipleObjects
SendMessageW
GetWindow
GetParent
GetGUIThreadInfo
LoadStringW
CharPrevW
MessageBoxW
PostQuitMessage
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
DisableThreadLibraryCalls
GetModuleFileNameA
FreeLibrary
GetModuleHandleExW
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-synch-l1-1-0
ReleaseSemaphore
WaitForSingleObject
ReleaseMutex
EnterCriticalSection
CreateMutexExW
AcquireSRWLockShared
InitializeCriticalSectionEx
AcquireSRWLockExclusive
WaitForSingleObjectEx
ResetEvent
OpenSemaphoreW
SetEvent
CreateEventW
InitializeCriticalSectionAndSpinCount
ReleaseSRWLockShared
DeleteCriticalSection
LeaveCriticalSection
CreateMutexW
CreateSemaphoreExW
ReleaseSRWLockExclusive
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-errorhandling-l1-1-0
SetErrorMode
SetUnhandledExceptionFilter
GetLastError
SetLastError
UnhandledExceptionFilter
RaiseException
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventSetInformation
EventWriteTransfer
EventRegister
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetExitCodeProcess
GetCurrentThreadId
GetCurrentThread
ExitProcess
OpenProcessToken
CreateProcessW
OpenThreadToken
api-ms-win-core-localization-l1-2-0
GetThreadPreferredUILanguages
SetThreadPreferredUILanguages
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-file-l1-1-0
FindNextFileW
GetDriveTypeW
CreateFileW
DeleteFileW
GetFileTime
FindClose
SetFileAttributesW
GetFileAttributesW
FindFirstFileExW
RemoveDirectoryW
FindFirstFileW
GetFullPathNameW
CreateDirectoryW
GetLogicalDrives
SetFilePointer
WriteFile
CompareFileTime
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegGetValueW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
api-ms-win-core-file-l1-2-0
GetTempPathW
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-sysinfo-l1-1-0
GetSystemWindowsDirectoryW
GetSystemTimeAsFileTime
GetSystemDirectoryW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringOrdinal
CompareStringW
api-ms-win-security-base-l1-1-0
GetSidSubAuthorityCount
GetSidSubAuthority
CreateWellKnownSid
AllocateAndInitializeSid
FreeSid
CheckTokenMembership
GetTokenInformation
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
crypt32
CertCloseStore
CertFindCertificateInStore
CertOpenStore
CertGetCertificateContextProperty
CertGetEnhancedKeyUsage
CertVerifyCertificateChainPolicy
CertFreeCertificateContext
api-ms-win-core-version-l1-1-1
GetFileVersionInfoW
GetFileVersionInfoSizeW
api-ms-win-core-version-l1-1-0
VerQueryValueW
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSecurityDescriptorToStringSecurityDescriptorW
api-ms-win-core-memory-l1-1-0
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
OpenFileMappingW
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
kernel32
ActivateActCtx
lstrcmpiW
lstrcmpW
DeactivateActCtx
QueryActCtxW
VerifyVersionInfoW
CheckElevationEnabled
WritePrivateProfileStringW
GetPrivateProfileIntW
GetPrivateProfileSectionW
GetPrivateProfileStringW
GetComputerNameW
FindActCtxSectionStringW
CreateActCtxW
advapi32
RegOpenKeyW
RegDeleteKeyW
DecryptFileW
GetSecurityInfo
setupapi
SetupDiDestroyDeviceInfoList
SetupVerifyInfFileW
SetupScanFileQueueW
SetupInitDefaultQueueCallbackEx
pSetupGetField
pSetupSetGlobalFlags
pSetupGetGlobalFlags
DriverStoreFindDriverPackageW
DriverStoreAddDriverPackageW
SetupOpenFileQueue
SetupEnumInfSectionsW
SetupQueueCopyW
SetupFindNextMatchLineW
SetupQueryInfVersionInformationW
SetupDiCreateDeviceInfoList
SetupDiBuildDriverInfoList
SetupDiGetDriverInfoDetailW
SetupDiSetSelectedDriverW
SetupGetInfPublishedNameW
SetupDiGetWizardPage
SetupDiSelectDevice
SetupRemoveFromSourceListW
SetupGetMultiSzFieldW
SetupOpenInfFileW
SetupPromptForDiskW
SetupGetInfDriverStoreLocationW
SetupGetInfInformationW
SetupDiGetActualSectionToInstallExW
SetupGetSourceInfoW
SetupDiDestroyDriverInfoList
SetupQueryInfFileInformationW
SetupQueryInfOriginalFileInformationW
SetupGetSourceFileLocationW
SetupGetStringFieldW
SetupFindNextLine
SetupInstallFilesFromInfSectionW
SetupGetLineTextW
SetupDiSetDevicePropertyW
SetupDiGetDriverInstallParamsW
SetupDiGetDeviceInstanceIdW
SetupDiGetDevicePropertyW
SetupDiGetSelectedDriverW
SetupDiSetDriverInstallParamsW
SetupDiSetClassInstallParamsW
SetupDiGetClassInstallParamsW
SetupDiOpenDevRegKey
SetupGetFieldCount
SetupIterateCabinetW
SetupSetDirectoryIdW
SetupFindFirstLineW
SetupDiSetDeviceInstallParamsW
SetupTermDefaultQueueCallback
SetupGetIntField
SetupCommitFileQueueW
SetupDiEnumDriverInfoW
SetupGetLineCountW
SetupDiGetDeviceInstallParamsW
SetupCloseFileQueue
SetupQueueCopyIndirectW
SetupInitDefaultQueueCallback
SetupCloseInfFile
SetupGetLineByIndexW
SetupOpenAppendInfFileW
SetupDefaultQueueCallbackW
SetupSetNonInteractiveMode
SetupSetFileQueueAlternatePlatformW
SetupInstallFromInfSectionW
winspool.drv
EnumPrintProcessorsW
GetPrinterDataW
AddPrinterDriverExW
EnumMonitorsW
SetPrinterDataW
AddMonitorW
GetPrintProcessorDirectoryW
GetPrinterDriverDirectoryW
SetPrinterW
GetPrinterW
EnumPrinterDriversW
DeletePrinter
SetPrinterDataExW
CorePrinterDriverInstalledW
GetPrinterDataExW
EnumPrintersW
OpenPrinterW
AddPrintProcessorW
GetCorePrinterDriversW
InstallPrinterDriverFromPackageW
ClosePrinter
OpenPrinter2W
UploadPrinterDriverPackageW
mscms
InstallColorProfileW
WcsAssociateColorProfileWithDevice
WcsDisassociateColorProfileFromDevice
WcsEnumColorProfiles
WcsEnumColorProfilesSize
GetColorDirectoryW
wintrust
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
CryptCATAdminCalcHashFromFileHandle
WTHelperGetProvCertFromChain
CryptCATAdminCalcHashFromFileHandle2
WinVerifyTrust
CryptCATAdminReleaseContext
CryptCATAdminAcquireContext2
shell32
ShellExecuteExW
combase
ord148
api-ms-win-core-file-l2-1-0
MoveFileExW
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
api-ms-win-core-winrt-l1-1-0
RoInitialize
RoUninitialize
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
ClassInstall32
PSetupAssociateICMProfiles
PSetupBuildDriverList
PSetupBuildDriversFromPath
PSetupCheckForDriversInDriverStore
PSetupCopyDriverPackageFiles
PSetupCreateDrvSetupPage
PSetupCreateMonitorInfo
PSetupCreatePrinterDeviceInfoList
PSetupDestroyDriverInfo3
PSetupDestroyMonitorInfo
PSetupDestroyPrinterDeviceInfoList
PSetupDestroySelectedDriverInfo
PSetupDisassociateICMProfiles
PSetupDownloadAndInstallLegacyDriverW
PSetupDriverInfoFromDeviceID
PSetupDriverInfoFromName
PSetupDriverStoreAddDriverPackage
PSetupDriverStoreFindDriverPackageW
PSetupElevateAndCallDriverStoreAddDriverPackage
PSetupElevatedDriverStoreAddDriverPackageW
PSetupElevatedInstallDownloadedLegacyDriverW
PSetupElevatedInstallDriverPackageFromConnectionW
PSetupElevatedInstallPrinterDriverFromTheWebW
PSetupElevatedLegacyPrintDriverInstallW
PSetupEnumMonitor
PSetupFindCompatibleDriverFromName
PSetupFreeDrvField
PSetupFreeMem
PSetupGetActualInstallSection
PSetupGetCatalogNameFromInfW
PSetupGetDriverInfo3
PSetupGetInfDriverStoreLocation
PSetupGetLocalDataField
PSetupGetPathToSearch
PSetupGetSelectedDriverInfo
PSetupInstallDriverPackageFromConnection
PSetupInstallICMProfiles
PSetupInstallInboxDriverSilently
PSetupInstallMonitor
PSetupInstallPrinterDriver
PSetupIsCompatibleDriver
PSetupIsDriverInstalled
PSetupIsTheDriverFoundInInfInstalled
PSetupParseInfAndCommitFileQueue
PSetupPreSelectDriver
PSetupProcessPrinterAdded
PSetupSelectDeviceButtons
PSetupSelectDriver
PSetupSetCoreInboxDriverPath
PSetupSetDriverPlatform
PSetupSetNonInteractiveMode
PSetupSetSelectDevTitleAndInstructions
PSetupShowBlockedDriverUI
PSetupThisPlatform
PSetupWebPnpGenerateDownLevelInfForInboxDriver
ServerInstallW
Name
.text
Size
240KB
Virtual Size
238KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
108KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
88KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=257, version=33145,
count=81, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1392, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=27, id=261, version=33145,
count=1, id=256, version=33145,
count=37, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
ntshrui.dll
- IMPHASH 51f885f299e7fee043a6c396012f939d
- SHA256 ab95627cf618e5e849c0f0cffcf6bd27c45063f884b560b0bf659167d43ecce2
- MD5 f63b03ae95eb3857b2959d2bae81c7c6
- SHA1 d1d7a8bfee97198cf252e7845d7ef13cce9b3e78
- SHA512 78b8f2c013a838755c1426eeaec3da5166f096404508e5bc67f792c572a6a58a36259862bdf81b5e4f5f541a87b0ca8d3fa12cebf02f2fdd82a97f72008bb3e4
- SSDEEP 12288:FNQG2kXGnVlJL5otttcdBTHJfcdO2ZhMxmsJYQDrhjAuyNUV1/K8f2:kkXGVl4ntcdBTHJfUdZLQDrhfyG/K8f
- TLSH T103E45B6E27FC00E5D67AD13DC543465AE7B274211322A7CF125082BD9F2BFE86A39B50
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
151344
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ntshrui.pdb
msvcp_win
_Query_perf_frequency
_Query_perf_counter
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-string-l1-1-0
wcsncmp
memset
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__get_errno
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__wcsicmp
memmove
_o__wcsnicmp
_o_abort
_o_ceilf
_o_iswspace
_o_terminate
_o_towlower
__CxxFrameHandler3
__C_specific_handler
__current_exception
__current_exception_context
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
_CxxThrowException
memcmp
memcpy
api-ms-win-core-libraryloader-l1-2-0
LoadResource
FindResourceExW
GetModuleFileNameA
FindStringOrdinal
GetProcAddress
LoadLibraryExW
GetModuleHandleExW
FreeLibrary
GetModuleHandleW
LoadStringW
DisableThreadLibraryCalls
GetModuleFileNameW
LockResource
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionAndSpinCount
ReleaseMutex
ReleaseSemaphore
OpenSemaphoreW
WaitForSingleObjectEx
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateMutexW
WaitForSingleObject
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CreateEventW
InitializeCriticalSection
CreateSemaphoreExW
CreateMutexExW
SetEvent
ResetEvent
InitializeCriticalSectionEx
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
RaiseException
GetLastError
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
OpenProcessToken
GetCurrentProcessId
GetCurrentThread
OpenThreadToken
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FindNLSStringEx
FormatMessageW
GetUserDefaultLCID
GetLocaleInfoW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
CompareStringW
MultiByteToWideChar
CompareStringOrdinal
WideCharToMultiByte
api-ms-win-security-base-l1-1-0
InitializeSecurityDescriptor
GetSecurityDescriptorOwner
GetAce
IsValidSecurityDescriptor
AccessCheck
DuplicateToken
IsWellKnownSid
AddAccessDeniedAceEx
AddAccessAllowedAceEx
GetTokenInformation
GetAclInformation
EqualSid
IsValidSid
SetFileSecurityW
GetSecurityDescriptorControl
SetSecurityDescriptorControl
EqualPrefixSid
GetSecurityDescriptorLength
MakeSelfRelativeSD
GetSidSubAuthorityCount
GetSidSubAuthority
SetSecurityDescriptorOwner
GetLengthSid
InitializeAcl
GetSecurityDescriptorDacl
GetFileSecurityW
AddAce
DeleteAce
SetSecurityDescriptorDacl
MapGenericMask
CopySid
CreateWellKnownSid
api-ms-win-core-heap-l2-1-0
LocalAlloc
GlobalFree
GlobalAlloc
LocalFree
api-ms-win-core-path-l1-1-0
PathCchCombine
PathCchAddBackslash
PathAllocCombine
PathIsUNCEx
PathCchAppend
PathCchRemoveFileSpec
PathCchCanonicalize
api-ms-win-core-com-l1-1-0
CoReleaseMarshalData
CoMarshalInterThreadInterfaceInStream
CoGetCallContext
CoCreateFreeThreadedMarshaler
CoInitializeEx
CoGetInterfaceAndReleaseStream
CoCreateInstance
CoTaskMemRealloc
PropVariantClear
CoTaskMemAlloc
CoTaskMemFree
CoSetProxyBlanket
CoGetMalloc
CoUninitialize
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
api-ms-win-core-file-l1-1-0
GetVolumeInformationW
GetFileAttributesW
FindClose
GetDriveTypeW
FindFirstFileW
GetVolumePathNameW
FindNextFileW
api-ms-win-core-sysinfo-l1-1-0
GetWindowsDirectoryW
GetComputerNameExW
GetTickCount64
GetTickCount
GetSystemDirectoryW
GetSystemTimeAsFileTime
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
Sleep
InitOnceExecuteOnce
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteStringBuffer
WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsDeleteString
WindowsPreallocateStringBuffer
WindowsPromoteStringBuffer
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoActivateInstance
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegGetValueW
RegQueryInfoKeyW
RegCloseKey
RegSetValueExW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
rpcrt4
UuidCreate
api-ms-win-core-winrt-error-l1-1-0
SetRestrictedErrorInfo
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
RoOriginateLanguageException
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedPushEntrySList
api-ms-win-security-base-private-l1-1-0
MakeAbsoluteSD2
api-ms-win-security-activedirectoryclient-l1-1-0
DsUnBindW
DsFreeNameResultW
DsCrackNamesW
api-ms-win-core-sidebyside-l1-1-0
ReleaseActCtx
CreateActCtxW
DeactivateActCtx
ActivateActCtx
ntdll
RtlCreateUnicodeString
WinSqmAddToStream
RtlNtStatusToDosError
RtlDosPathNameToNtPathName_U
NtOpenFile
EtwEventActivityIdControl
RtlMapGenericMask
EtwEventSetInformation
EtwEventWriteTransfer
RtlFreeUnicodeString
EtwEventRegister
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwEventUnregister
EtwGetTraceLoggerHandle
EtwTraceMessage
kernel32
GlobalSize
GetUserDefaultUILanguage
MulDiv
GlobalUnlock
GetComputerNameW
GlobalLock
lstrlenW
lstrcmpiW
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
CanShareFolder
DllCanUnloadNow
DllGetClassObject
GetLocalPathFromNetResource
GetLocalPathFromNetResourceA
GetLocalPathFromNetResourceW
GetNetResourceFromLocalPath
GetNetResourceFromLocalPathA
GetNetResourceFromLocalPathW
IsFolderPrivateForUser
IsPathShared
IsPathSharedA
IsPathSharedW
RefreshShareCacheAsync
SetFolderPermissionsForSharing
ShowShareFolderUI
Name
.text
Size
504KB
Virtual Size
500KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
112KB
Virtual Size
110KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=84, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=18, id=260, version=33145,
count=5, id=259, version=33145,
count=1621, id=1, productName=Unmarked objects,
count=7, id=257, version=33145,
count=32, id=261, version=33145,
count=1, id=256, version=33145,
count=70, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
ntvdm64.dll
- IMPHASH dd0e8e26fa9213a5cfffff1806f14ebe
- SHA256 3aa4aa4d5039ff1cd1afce3295c4be693ee404ceb41286c96e662a1cd4f554db
- MD5 00d461c15e25b53546654681e44cdcd0
- SHA1 209216f8a14c17ad068c31b8d812a3ed28380475
- SHA512 ddc6b88cbd52ad62e6d143c1c08ced76471eb349356c60efa19da7ca3b4565f9c02a49d608f6587ac8a12ccf094e672ca67917a710508950ab6b6e4b02d1f0e0
- SSDEEP 384:rcg3ZHC7iAoDB6QbRhrWOOegTiobqxrAgVYwZG7ybXv61Wz5uWr:Q2ZD5Rhr9/qwGODvj5
- TLSH T1F2031A4F37F520A9EAB6C67445A76725A633F821731247FF04A0C15D1E29BD0BA34F16
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4112
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ntvdm64.pdb
ntdll
RtlFreeHeap
RtlLookupFunctionEntry
RtlVirtualUnwind
__C_specific_handler
RtlCaptureContext
wcsncmp
wcschr
NtClose
RtlGetThreadErrorMode
RtlInitUnicodeString
NtQueryInformationProcess
RtlAllocateHeap
_vsnwprintf
NtCreateFile
wcscmp
api-ms-win-core-version-l1-1-0
GetFileVersionInfoSizeExW
GetFileVersionInfoExW
VerQueryValueW
api-ms-win-core-processenvironment-l1-1-0
SearchPathW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegSetValueExW
RegCloseKey
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-file-l1-1-0
GetFullPathNameW
api-ms-win-core-wow64-l1-1-1
GetSystemWow64DirectoryW
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
LoadStringW
GetModuleHandleW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
GetSystemWindowsDirectoryW
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-registry-l2-1-0
RegCreateKeyW
RegEnumKeyW
RegOpenKeyW
kernelbase
CreateProcessInternalW
version
VerQueryValueA
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllInstall
NtVdm64CreateProcessInternalW
NtVdm64RaiseInvalid16BitError
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
324B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=32, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=257, version=33140,
count=57, id=1, productName=Unmarked objects,
count=8, id=260, version=33140,
count=3, id=259, version=33140,
count=1, id=256, version=33140,
count=3, id=264, version=33140,
count=1, id=255, version=33140,
count=1, id=258, version=33140,
objsel.dll
- IMPHASH fa1b76ab52d3bdfbb2a0deacd3546864
- SHA256 db0967247fd9ec90ce3424e7f37fa03cce24bcffa93913af34b87c6da9eabfec
- MD5 8028c2576fe78b33f4b59dd12d98373c
- SHA1 8fafd0b07654c2a7f5b25de7ea894b7dd57b7140
- SHA512 7ce7020a436e264d229f8084cb5b1c60b6765bbceca25f4ca22801e44bb38c3c7590142e832e869de45abeb071dba3ed928b6bf0f34222e21b43e3d33a35c379
- SSDEEP 12288:Cv0LTEJ3rCwe4CD8L5dufSGllqyB2q5j:bKetD8LfSzlqyB26
- TLSH T143D46B1EEAA801A5C0B5D03CCE6385DED6B23C694F2147DB21E4B67E9E33ED46635B40
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
6112
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
objsel.pdb
msvcrt
iswspace
_wcsupr
_errno
wcstol
_initterm
towupper
?what@exception@@UEBAPEBDXZ
_CxxThrowException
_wcsicmp
_wcslwr
??0exception@@QEAA@AEBQEBD@Z
_callnewh
wprintf
_amsg_exit
__CxxFrameHandler4
_XcptFilter
memmove
memcpy
_lock
wcsspn
wcsncpy_s
wcstoul
_unlock
__C_specific_handler
__dllonexit
_onexit
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
memcmp
__RTDynamicCast
towlower
_wcsnicmp
_itow_s
wcscpy_s
wcsrchr
wcsstr
_beginthreadex
swprintf_s
wcschr
malloc
??_V@YAXPEAX@Z
free
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
_purecall
??3@YAXPEAX@Z
memcpy_s
_vsnwprintf
??0exception@@QEAA@AEBQEBDH@Z
memset
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
DisableThreadLibraryCalls
LoadStringW
GetModuleHandleExW
GetModuleFileNameW
GetModuleHandleW
GetModuleFileNameA
LoadLibraryExW
GetProcAddress
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
InitializeCriticalSectionEx
EnterCriticalSection
DeleteCriticalSection
CreateSemaphoreExW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeCriticalSection
ReleaseSemaphore
SetEvent
WaitForSingleObject
ReleaseMutex
CreateEventW
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-processthreads-l1-1-0
CreateThread
GetCurrentProcessId
GetThreadId
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetLocaleInfoW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
CompareStringW
WideCharToMultiByte
api-ms-win-core-synch-l1-2-1
CreateSemaphoreW
api-ms-win-core-heap-l2-1-0
GlobalAlloc
LocalFree
LocalAlloc
GlobalFree
api-ms-win-security-base-l1-1-0
ImpersonateLoggedOnUser
RevertToSelf
GetLengthSid
GetSidSubAuthorityCount
IsValidSid
GetSidLengthRequired
AllocateAndInitializeSid
FreeSid
EqualSid
CopySid
GetSidSubAuthority
api-ms-win-security-lsalookup-l2-1-0
LsaEnumerateTrustedDomains
LookupAccountSidW
LookupAccountNameW
api-ms-win-service-management-l1-1-0
CloseServiceHandle
OpenSCManagerW
api-ms-win-service-core-l1-1-1
EnumServicesStatusExW
oleaut32
VariantCopy
SafeArrayDestroy
SafeArrayGetUBound
VariantInit
SystemTimeToVariantTime
VariantClear
SysAllocString
SysFreeString
SafeArrayAccessData
SafeArrayCreate
SafeArrayGetLBound
SafeArrayUnaccessData
SafeArrayGetElement
api-ms-win-core-com-l1-1-0
CoTaskMemFree
PropVariantClear
CoUninitialize
CoCreateInstance
CoTaskMemAlloc
StringFromGUID2
api-ms-win-core-synch-l1-2-0
WakeAllConditionVariable
SleepConditionVariableSRW
Sleep
api-ms-win-security-credentials-l1-1-0
CredIsMarshaledCredentialW
logoncli
DsGetDcNameW
DsEnumerateDomainTrustsW
netutils
NetApiBufferFree
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
GetComputerNameExW
GetSystemWindowsDirectoryW
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
iphlpapi
ParseNetworkString
ws2_32
WSAAddressToStringW
wkscli
NetUseDel
NetUseAdd
NetWkstaGetInfo
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
dsrole
DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation
sspicli
LsaDeregisterLogonProcess
LsaCallAuthenticationPackage
LsaConnectUntrusted
LsaFreeReturnBuffer
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
ConvertStringSidToSidW
ConvertSecurityDescriptorToStringSecurityDescriptorW
api-ms-win-core-string-l2-1-0
IsCharAlphaW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-security-lsapolicy-l1-1-0
LsaFreeMemory
LsaClose
LsaLookupSids
LsaOpenPolicy
LsaLookupNames2
LsaQueryInformationPolicy
api-ms-win-security-activedirectoryclient-l1-1-0
DsCrackNamesW
DsUnBindW
DsFreePasswordCredentials
DsMakePasswordCredentialsW
DsFreeNameResultW
api-ms-win-security-lsalookup-l1-1-1
ReleaseIdentityProviderEnumContext
EnumerateIdentityProviders
ntdll
RtlLengthSid
RtlCopySid
RtlNtStatusToDosError
NtClose
NtSetInformationThread
NtImpersonateAnonymousToken
NtOpenThreadToken
RtlFreeUnicodeString
RtlCreateUnicodeString
kernel32
GlobalLock
GlobalUnlock
MulDiv
GetComputerNameW
GetUserDefaultUILanguage
lstrcmpiW
lstrcmpW
GetSystemDefaultUILanguage
user32
LoadMenuW
GetActiveWindow
GetSubMenu
GetKeyState
RedrawWindow
GetWindowDC
GetDC
IsWindow
GetMenuItemCount
DestroyWindow
RegisterClipboardFormatW
GetDlgItemTextW
IsDlgButtonChecked
CallWindowProcW
SendDlgItemMessageW
GetMenuItemInfoW
EnableMenuItem
SetCursor
LoadCursorW
LoadIconW
DestroyIcon
GetMessageW
GetWindowThreadProcessId
DispatchMessageW
MsgWaitForMultipleObjects
PostThreadMessageW
SetWindowLongW
GetWindowLongW
GetSystemMetrics
DefWindowProcW
EndPaint
DrawTextExW
GetWindowTextW
PeekMessageW
TranslateMessage
MessageBoxW
GetWindow
EnableWindow
GetWindowTextLengthW
GetSysColor
BeginPaint
FillRect
InvalidateRect
ShowWindow
SystemParametersInfoW
GetDesktopWindow
IsWindowVisible
DestroyMenu
TrackPopupMenu
GetFocus
AppendMenuW
CreatePopupMenu
IsWindowEnabled
MsgWaitForMultipleObjectsEx
SetFocus
SetWindowTextW
GetParent
RegisterClassW
GetClientRect
SetWindowLongPtrW
GetWindowLongPtrW
SetWindowPos
MapWindowPoints
GetWindowRect
MapDialogRect
EndDialog
GetDlgItem
SendMessageW
SetDlgItemTextW
PostMessageW
CreateDialogParamW
CreateWindowExW
DialogBoxParamW
GetForegroundWindow
ReleaseDC
gdi32
LineTo
MoveToEx
TextOutW
SetTextAlign
GetTextMetricsW
GetTextExtentPoint32W
GetDeviceCaps
DeleteObject
CreatePen
SetBkColor
SetTextColor
SelectObject
advapi32
LogonUserW
RegDeleteKeyW
RegConnectRegistryW
ole32
ReleaseStgMedium
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
CoInitialize
activeds
ord4
ord9
ord13
ord5
ord6
ord7
shell32
ShellExecuteW
ord258
ord259
ntdsapi
DsBindW
DsBindWithCredW
credui
CredPackAuthenticationBufferW
CredUIParseUserNameW
CredUnPackAuthenticationBufferW
CredUIPromptForWindowsCredentialsW
uxtheme
EnableThemeDialogTexture
secur32
TranslateNameW
dpapi
CryptProtectMemory
CryptUnprotectMemory
wldap32
ord16
ord13
ord18
ord14
ord54
ord301
ord41
ord27
ord26
ord203
ord309
ord310
ord304
ord79
ord145
ord88
ord224
ord140
ord142
ord133
ord12
ord73
ord216
ord147
dsparse
DsGetRdnW
api-ms-win-core-sidebyside-l1-1-0
DeactivateActCtx
ActivateActCtx
CreateActCtxW
ReleaseActCtx
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
288KB
Virtual Size
285KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
84KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
228KB
Virtual Size
226KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=102, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=508, id=1, productName=Unmarked objects,
count=31, id=257, version=33145,
count=13, id=261, version=33145,
count=21, id=260, version=33145,
count=1, id=256, version=33145,
count=64, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
occache.dll
- IMPHASH e8f17a79a0b50f29046e5d48ded25572
- SHA256 6c42bef17ac90343c78ef0dbb346b173d3bb748eab064cb4d80bb34be4aab463
- MD5 872155d5146b178807df127529259cb4
- SHA1 5010ebfb5185580a9ebc20f4dd20cec440ae2c5c
- SHA512 9b984f510164e89bfa5b485f1263af1ac4be52ee25b2451a7578785864362b0e13a0095c09b5f5beae4e33584ba642627ad2a168816518ec7db2498e554ea683
- SSDEEP 3072:Ytr0A4O14O5fPi2fLgeAgs9bHrQ042c8AjhUNzxAhUovuS3U:A4u5fPdf4gs97rQ042c8IhRvu
- TLSH T13324162A72A920F5D465813C85474A59F7B2FC3893135BDF06A0B2FE5E23BE5AC35603
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
11696
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
occache.pdb
msvcrt
_onexit
strncmp
_ultoa_s
_unlock
__dllonexit
memcpy
memset
_wcsicmp
memmove_s
memcpy_s
_vsnwprintf
_itoa_s
_strnicmp
isalpha
_XcptFilter
_amsg_exit
free
malloc
_initterm
__C_specific_handler
_lock
_vsnprintf
memcmp
user32
PostMessageA
CharUpperA
MessageBoxA
GetClientRect
SetDlgItemTextA
DestroyIcon
EndDialog
LoadIconA
SendDlgItemMessageA
LoadStringA
RegisterClipboardFormatA
LoadMenuA
GetSubMenu
RemoveMenu
DestroyMenu
CreatePopupMenu
CharPrevA
GetDlgItem
SendMessageA
CheckMenuItem
SetMenuDefaultItem
DialogBoxParamA
GetWindowLongPtrA
SetWindowLongPtrA
SetWindowTextA
CharNextA
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
kernel32
ResolveDelayLoadedAPI
DelayLoadFailureHook
FindNextFileA
RaiseException
RaiseFailFastException
VirtualQuery
VirtualFree
VirtualProtect
VirtualAlloc
FlushInstructionCache
SetThreadContext
GetThreadContext
ResumeThread
SuspendThread
GetSystemTimeAsFileTime
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
GetCurrentThread
LoadLibraryA
GetDiskFreeSpaceA
GetWindowsDirectoryA
GetFileAttributesA
SetErrorMode
SystemTimeToFileTime
GetLocalTime
InitializeCriticalSection
DisableThreadLibraryCalls
DeleteCriticalSection
HeapAlloc
GetProcessHeap
HeapFree
lstrcmpiA
lstrcmpA
CompareFileTime
FindFirstFileA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetDateFormatA
GetTimeFormatA
FindClose
LocalFree
LocalAlloc
GlobalAlloc
LoadLibraryExA
MultiByteToWideChar
GetProcAddress
FreeLibrary
IsDBCSLeadByte
GetCPInfo
FormatMessageW
GetCurrentThreadId
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA
DebugBreak
GetLastError
IsDebuggerPresent
OutputDebugStringW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
SetLastError
CloseHandle
ReleaseSemaphore
ReleaseMutex
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
WaitForSingleObjectEx
EnterCriticalSection
InitializeCriticalSectionEx
WaitForSingleObject
OpenSemaphoreW
CreateThreadpoolTimer
GetCurrentProcessId
CreateMutexExW
CreateSemaphoreExW
LeaveCriticalSection
GetTickCount
FormatMessageA
VerLanguageNameA
GetPrivateProfileStringA
SetFileTime
GetShortPathNameA
GetEnvironmentVariableA
CreateFileA
DeleteFileA
GetSystemDirectoryA
CompareStringA
RemoveDirectoryA
GetVersionExA
GetFileTime
advapi32
RegOpenKeyExW
RegCloseKey
RegQueryValueExA
RegEnumValueA
RegEnumKeyA
RegSetValueExA
RegQueryValueA
RegDeleteValueA
RegEnumKeyExA
RegDeleteKeyA
RegOpenCurrentUser
RegOverridePredefKey
RegOpenKeyExA
RegSetValueA
RegCreateKeyExA
shlwapi
PathGetDriveNumberA
StrRetToBufW
StrCmpNIA
StrStrIA
ord157
PathGetDriveNumberW
StrChrA
PathFindFileNameA
PathFileExistsA
SHRegGetValueA
PathCompactPathA
ord217
StrToIntA
ord219
comctl32
PropertySheetA
shell32
SHBindToParent
ord155
ord174
ord74
ExtractIconA
ShellExecuteA
ord18
SHGetFolderPathW
SHGetPathFromIDListW
SHChangeNotify
SHGetFolderPathA
ord25
ord67
iertutil
ord207
DllCanUnloadNow
DllGetClassObject
FindControlClose
FindFirstControl
FindFirstControlArch
FindNextControl
FindNextControlArch
GetControlDependentFile
GetControlInfo
IsModuleRemovable
ReleaseControlHandle
RemoveControlByHandle
RemoveControlByHandle2
RemoveControlByName
RemoveControlByName2
RemoveExpiredControls
SweepControlsByLastAccessDate
Name
.text
Size
100KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
168B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.detourc
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
4KB
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
56KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=18, id=260, version=33145,
count=5, id=259, version=33145,
count=5, id=261, version=33145,
count=235, id=1, productName=Unmarked objects,
count=21, id=257, version=33145,
count=1, id=256, version=33145,
count=30, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
ocsetapi.dll
- IMPHASH 2d106fc15a61be1992ba447dea5da334
- SHA256 640f82f8f040209aeb58bed9211d4ddbce667fee5d1228873e489fe5ffa6d5cf
- MD5 e87b97c354e93fb1805427abfbd7031e
- SHA1 ebd1f339fbb1932389f78a03cda2e66eeac6e5e2
- SHA512 f60850cfdbe176d908d551fae8bd5e220e8e526fa37bc326c24bfb0cd858237e2cce96ace5170e00d7cf6777cae581c392fc165c5686a2f218b712f1eda6865e
- SSDEEP 6144:AEao99RjdS0NY2HYeQzvE/DXxLa6QaanNbGHxM8ctxpe:AEao9bjk0NYCYeQzvE/75a6QaanNbGHi
- TLSH T1F8346E197A55ABB9FC0690F9B7B0017254F5AC09631CB6FB81CC8CA1162BCC6ED74BB1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
9152
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ocsetapi.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__free_base
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__malloc_base
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o__wcsnicmp
_o_free
_o_iswspace
_o_malloc
__C_specific_handler
__CxxFrameHandler3
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___std_type_info_destroy_list
wcschr
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
strcmp
memset
kernel32
InitOnceComplete
InitOnceBeginInitialize
TerminateProcess
DebugBreak
GetModuleHandleW
GetProcAddress
FormatMessageW
GetModuleHandleExW
QueryPerformanceCounter
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
GetCurrentProcess
RtlVirtualUnwind
GetTickCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetProcessHeap
GetCurrentProcessId
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
IsProcessorFeaturePresent
CreateThreadpoolTimer
ReleaseSRWLockShared
SetThreadpoolTimer
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
CloseThreadpoolTimer
ReleaseSRWLockExclusive
ReleaseMutex
WaitForSingleObject
WaitForThreadpoolTimerCallbacks
InitializeCriticalSectionEx
LeaveCriticalSection
HeapAlloc
ExpandEnvironmentStringsW
ReleaseSemaphore
EnterCriticalSection
SetLastError
HeapFree
CreateSemaphoreExW
GetSystemTimeAsFileTime
FreeLibrary
GetModuleFileNameA
GetLastError
IsDebuggerPresent
GetCurrentThreadId
OutputDebugStringW
DisableThreadLibraryCalls
CreateEventW
InitializeCriticalSectionAndSpinCount
HeapDestroy
HeapCreate
DeleteFileW
SetFileAttributesW
GetSystemWindowsDirectoryW
CloseHandle
ReadFile
GetFileSize
CreateFileW
advapi32
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegDeleteValueW
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
TraceMessage
GetTraceLoggerHandle
EventUnregister
EventRegister
EventWriteTransfer
RegSetValueExW
dpx
DpxNewJob
ntdll
NtClose
CopyMspFilesToSystemMsiCache
RemoveMspFilesFromSystemMsiCache
Name
.text
Size
100KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
112KB
Virtual Size
110KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
240B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=33145,
count=19, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1310, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=25, id=261, version=33145,
count=1, id=256, version=33145,
count=31, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
odbc32.dll
- IMPHASH f1950afcbb72e14c089fee52192c79dd
- SHA256 76256afcc395843f007ab0d7e673c305af7230dec20abad99d9786524868fb22
- MD5 cedf7b44440df4041cc9182625a5c3c5
- SHA1 533fcd4939ec550d68192af0cf5d2600942b6969
- SHA512 856f38bfd60876d0e08cf616397d876e7ea5fc719c2b95b69dd75d81f378c9835fad7af9112df9de08865f163c969445b0619c4c4fd3b5d9c9d5b9a8cf1372da
- SSDEEP 12288:SFTf3X4yYwC/gKRDmZlh9RiHhpUd/+x2WJX7keEU40:KvowC/giDmDdJGbET
- TLSH T1BDF41719A7E81069E0A6923636770605D7B2B8302B75E5EF01A0D13E7FE3FE02A35775
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
168144
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ODBC32.pdb
msvcrt
_wmakepath_s
_vsnprintf
calloc
_wstat
wcstombs
_aligned_free
_vsnwprintf
free
_wcsicmp
__C_specific_handler
_wcsnicmp
wcstoul
_aligned_malloc
_ltow_s
_ultow_s
wcsncpy_s
wcsstr
_purecall
towupper
memcpy_s
memmove_s
_XcptFilter
_amsg_exit
_initterm
_lock
_unlock
__dllonexit
_onexit
memcpy
_wsplitpath_s
memcmp
_errno
_wtol
malloc
_snwprintf_s
wcsrchr
_waccess
memset
api-ms-win-core-synch-l1-2-0
WakeConditionVariable
InitializeConditionVariable
SleepConditionVariableCS
Sleep
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
SetEvent
CreateEventW
WaitForSingleObject
InitializeCriticalSection
DeleteCriticalSection
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
InitializeCriticalSectionEx
ReleaseSemaphore
CreateSemaphoreExW
SetCriticalSectionSpinCount
TryEnterCriticalSection
EnterCriticalSection
InitializeSRWLock
LeaveCriticalSection
ReleaseMutex
CreateMutexA
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
crypt32
CryptUnprotectMemory
CryptProtectMemory
ntdll
RtlCaptureContext
WinSqmSetDWORD
RtlLookupFunctionEntry
RtlVirtualUnwind
kernel32
WriteFile
WritePrivateProfileStringW
GetPrivateProfileStringW
FindClose
FindNextFileW
FindFirstFileW
CreateDirectoryW
ExpandEnvironmentStringsA
LoadLibraryExA
GetSystemTimeAsFileTime
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
GetTickCount
GetProcessHeap
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
GetModuleHandleExW
GetModuleFileNameA
InterlockedPushEntrySList
RaiseException
HeapReAlloc
DebugBreak
HeapAlloc
HeapFree
DeleteFileW
CreateFileW
CreateFileMappingW
UnmapViewOfFile
DelayLoadFailureHook
ResolveDelayLoadedAPI
OpenFileMappingW
GetCurrentThreadId
SubmitThreadpoolWork
CreateThreadpoolWork
LoadLibraryExW
GetProcAddress
FreeLibrary
InterlockedPopEntrySList
SetThreadErrorMode
GetCurrentThread
GetLastError
GetCurrentProcess
CloseHandle
WideCharToMultiByte
GetModuleHandleW
FormatMessageW
SwitchToThread
CloseThreadpoolWork
InitializeSListHead
MultiByteToWideChar
DisableThreadLibraryCalls
GetSystemInfo
GetTempPath2W
FreeLibraryAndExitThread
CreateThread
SetLastError
VirtualQuery
GetModuleFileNameW
GetCurrentProcessId
GetSystemDirectoryW
GetFullPathNameW
SearchPathW
GetDriveTypeW
OutputDebugStringW
OpenMutexA
MapViewOfFile
advapi32
AddAccessAllowedAce
OpenProcessToken
RegEnumValueW
RegQueryValueExA
EqualSid
CopySid
IsValidSid
RegGetValueA
RegOpenKeyExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetTokenInformation
InitializeAcl
GetLengthSid
FreeSid
AllocateAndInitializeSid
UnregisterTraceGuids
RegisterTraceGuidsW
RegQueryValueExW
RegNotifyChangeKeyValue
RegCloseKey
RegOpenKeyExW
RegGetValueW
OpenThreadToken
user32
GetSystemMetrics
MoveWindow
EnableWindow
LoadCursorA
LoadCursorW
SetCursor
GetClientRect
ChildWindowFromPoint
ScreenToClient
GetMessagePos
SetFocus
MessageBoxW
GetWindowTextW
GetWindowLongPtrA
GetParent
SendMessageW
SendMessageA
LoadBitmapA
SetWindowLongPtrA
GetWindowLongPtrW
GetDlgItem
GetDesktopWindow
LoadStringW
IsWindow
GetWindowRect
CloseODBCPerfData
CollectODBCPerfData
CursorLibLockDbc
CursorLibLockDesc
CursorLibLockStmt
CursorLibTransact
DllBidEntryPoint
GetODBCSharedData
LockHandle
ODBCGetTryWaitValue
ODBCInternalConnectW
ODBCQualifyFileDSNW
ODBCSetTryWaitValue
OpenODBCPerfData
PostComponentError
PostODBCComponentError
PostODBCError
SQLAllocConnect
SQLAllocEnv
SQLAllocHandle
SQLAllocHandleStd
SQLAllocStmt
SQLBindCol
SQLBindParam
SQLBindParameter
SQLBrowseConnect
SQLBrowseConnectA
SQLBrowseConnectW
SQLBulkOperations
SQLCancel
SQLCancelHandle
SQLCloseCursor
SQLColAttribute
SQLColAttributeA
SQLColAttributeW
SQLColAttributes
SQLColAttributesA
SQLColAttributesW
SQLColumnPrivileges
SQLColumnPrivilegesA
SQLColumnPrivilegesW
SQLColumns
SQLColumnsA
SQLColumnsW
SQLCompleteAsync
SQLConnect
SQLConnectA
SQLConnectW
SQLCopyDesc
SQLDataSources
SQLDataSourcesA
SQLDataSourcesW
SQLDescribeCol
SQLDescribeColA
SQLDescribeColW
SQLDescribeParam
SQLDisconnect
SQLDriverConnect
SQLDriverConnectA
SQLDriverConnectW
SQLDrivers
SQLDriversA
SQLDriversW
SQLEndTran
SQLError
SQLErrorA
SQLErrorW
SQLExecDirect
SQLExecDirectA
SQLExecDirectW
SQLExecute
SQLExtendedFetch
SQLFetch
SQLFetchScroll
SQLForeignKeys
SQLForeignKeysA
SQLForeignKeysW
SQLFreeConnect
SQLFreeEnv
SQLFreeHandle
SQLFreeStmt
SQLGetConnectAttr
SQLGetConnectAttrA
SQLGetConnectAttrW
SQLGetConnectOption
SQLGetConnectOptionA
SQLGetConnectOptionW
SQLGetCursorName
SQLGetCursorNameA
SQLGetCursorNameW
SQLGetData
SQLGetDescField
SQLGetDescFieldA
SQLGetDescFieldW
SQLGetDescRec
SQLGetDescRecA
SQLGetDescRecW
SQLGetDiagField
SQLGetDiagFieldA
SQLGetDiagFieldW
SQLGetDiagRec
SQLGetDiagRecA
SQLGetDiagRecW
SQLGetEnvAttr
SQLGetFunctions
SQLGetInfo
SQLGetInfoA
SQLGetInfoW
SQLGetStmtAttr
SQLGetStmtAttrA
SQLGetStmtAttrW
SQLGetStmtOption
SQLGetTypeInfo
SQLGetTypeInfoA
SQLGetTypeInfoW
SQLMoreResults
SQLNativeSql
SQLNativeSqlA
SQLNativeSqlW
SQLNumParams
SQLNumResultCols
SQLParamData
SQLParamOptions
SQLPrepare
SQLPrepareA
SQLPrepareW
SQLPrimaryKeys
SQLPrimaryKeysA
SQLPrimaryKeysW
SQLProcedureColumns
SQLProcedureColumnsA
SQLProcedureColumnsW
SQLProcedures
SQLProceduresA
SQLProceduresW
SQLPutData
SQLRowCount
SQLSetConnectAttr
SQLSetConnectAttrA
SQLSetConnectAttrW
SQLSetConnectOption
SQLSetConnectOptionA
SQLSetConnectOptionW
SQLSetCursorName
SQLSetCursorNameA
SQLSetCursorNameW
SQLSetDescField
SQLSetDescFieldA
SQLSetDescFieldW
SQLSetDescRec
SQLSetEnvAttr
SQLSetParam
SQLSetPos
SQLSetScrollOptions
SQLSetStmtAttr
SQLSetStmtAttrA
SQLSetStmtAttrW
SQLSetStmtOption
SQLSpecialColumns
SQLSpecialColumnsA
SQLSpecialColumnsW
SQLStatistics
SQLStatisticsA
SQLStatisticsW
SQLTablePrivileges
SQLTablePrivilegesA
SQLTablePrivilegesW
SQLTables
SQLTablesA
SQLTablesW
SQLTransact
SearchStatusCode
VFreeErrors
VRetrieveDriverErrorsRowCol
ValidateErrorQueue
Name
.text
Size
472KB
Virtual Size
470KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
244KB
Virtual Size
243KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.sdbid
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=17, id=260, version=33145,
count=5, id=259, version=33145,
count=212, id=1, productName=Unmarked objects,
count=13, id=257, version=33145,
count=1, id=256, version=33145,
count=46, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
odbcbcp.dll
- IMPHASH bc4583e612e59a94f52e1b299836ad06
- SHA256 9c2a69f6b2c1f50695f4671ca520901fe325f8481850b78b152e1095633f73c0
- MD5 00989da2d24f67606963b7eac41e3c91
- SHA1 20f7c264325d72b56652b57a683b11dba5bfd569
- SHA512 1c940631bbb6cc4b91a2bd252daec99254ef81c34204784ae6b7c1ca6173ccdccc91c8ba3e06c96bf029fc7f29028edc31e616a9cf92c268bfb7d9826d4e0edd
- SSDEEP 1536:lHEX0JtB4ZIlNYgN4HRcyGoqeoqj5q75qBviDChQCqgb1:lkEJtBeW3doqeoqj5q75qBviDChQCp
- TLSH T14673D78A73E81064F06B92759BB70A55DAB9F8702B6553FF1190C22F6E62FC10E74B31
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4752
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
odbcbcp.pdb
msvcrt
_initterm
malloc
_amsg_exit
_XcptFilter
wcsncpy_s
_ultow_s
_wcsicmp
free
__C_specific_handler
kernel32
WideCharToMultiByte
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SearchPathW
SetLastError
EnterCriticalSection
GetFullPathNameW
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSection
GetSystemDirectoryW
MultiByteToWideChar
GetLastError
OutputDebugStringW
DisableThreadLibraryCalls
GetProcAddress
DeleteCriticalSection
GetCurrentProcessId
FreeLibrary
SetUnhandledExceptionFilter
VirtualQuery
GetDriveTypeW
LoadLibraryExW
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
advapi32
RegGetValueW
RegCloseKey
RegisterTraceGuidsW
UnregisterTraceGuids
RegOpenKeyExW
RegQueryValueExW
odbc32
ord176
ord139
ord145
ord111
LibMain
SQLCloseEnumServers
SQLGetNextEnumeration
SQLInitEnumServers
SQLLinkedCatalogsA
SQLLinkedCatalogsW
SQLLinkedServers
bcp_batch
bcp_bind
bcp_colfmt
bcp_collen
bcp_colptr
bcp_columns
bcp_control
bcp_done
bcp_exec
bcp_getcolfmt
bcp_initA
bcp_initW
bcp_moretext
bcp_readfmtA
bcp_readfmtW
bcp_sendrow
bcp_setcolfmt
bcp_writefmtA
bcp_writefmtW
dbprtypeA
dbprtypeW
Name
.text
Size
24KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.sdbid
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
576B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33138,
count=4, id=259, version=33138,
count=56, id=1, productName=Unmarked objects,
count=9, id=257, version=33138,
count=1, id=256, version=33138,
count=2, id=264, version=33138,
count=1, id=255, version=33138,
count=1, id=258, version=33138,
odbcconf.dll
- IMPHASH 2beb6e2c39ea80b6ed35b73a26d6287a
- SHA256 0f3574a2f9793c9cf46ea25ac4ec04ec896309a857bb30c53522af27225c4195
- MD5 2b5bcb6ee7ce5708bad5c791bd186981
- SHA1 3bc947d2421760a830fc09e5d6fbb82cccfab609
- SHA512 9450c864ba35f6da63f9223c04f8163b98b6eb33d577b60c79cb41c12dcbfcd5f98b0edafc71005b0de5882828cf6572c0b63143d34492349c1845a84a7d9c12
- SSDEEP 384:QN2G/e6p5vLbtnfNQZIKc62c+ltvixRbesoPo0gaeD8fXqwgLEt1fxvcMq74EqaM:QJ/bLbteZnc69+ltvirXfMfxu45NQY
- TLSH T1D233E55373B861F8E062427CCD630642AA76BD64077215EF16A0F3AE5F77BC0A535B41
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4832
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
odbcconf.pdb
msvcrt
_XcptFilter
_callnewh
_vsnwprintf
_stricmp
malloc
_amsg_exit
__C_specific_handler
_errno
_initterm
fprintf
_fsopen
_vsnprintf
fclose
fflush
vfprintf
fopen
free
memset
kernel32
Sleep
LoadLibraryA
GetModuleFileNameW
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SetLastError
LoadLibraryExW
SetThreadErrorMode
MultiByteToWideChar
GetLastError
GetProcAddress
CreateDirectoryA
FormatMessageA
user32
MessageBoxW
advapi32
RegSetValueExA
RegCloseKey
RegQueryValueExA
RegCreateKeyExA
RegOpenKeyExA
ole32
CoLoadLibrary
CoFreeLibrary
oleaut32
SysAllocString
SysFreeString
LoadRegTypeLi
RegisterTypeLi
LoadTypeLi
ntdll
_vsnwprintf_s
AppRegEnum
CloseAppRegEnum
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
ExecuteAction
OpenAppRegEnum
QueryApplication
RefreshAppRegEnum
RegisterApplication
RunDLL32_RegisterApplication
RunDLL32_UnregisterApplication
SetActionEnum
SetActionLogFile
SetActionLogMode
SetActionLogModeSz
SetActionName
SetSilent
UnregisterApplication
Name
.text
Size
16KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
212B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=16, id=260, version=33145,
count=4, id=259, version=33145,
count=64, id=1, productName=Unmarked objects,
count=15, id=257, version=33145,
count=2, id=261, version=33145,
count=1, id=256, version=33145,
count=10, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
odbccp32.dll
- IMPHASH 1ef59050c2716dd3279effc229e02050
- SHA256 5a8d68da221192cbdf98abad40ba03dc04ec479b194cac26828dc188829e3226
- MD5 fa8026b771d55460a805b8dcc43afc80
- SHA1 a0124d687d543123cb024712dea86f35cbf63c6a
- SHA512 ed85369390c314319dc21d429d8156e798953806d018db7055e8f5e41842e0143c1f5ce0e4d1591947a8d8a8a6b4ddae43f86114d920a438a54987149dc400ff
- SSDEEP 1536:2SkMYNetuMaNeDejlNk6w4Ga7iOTkkuGICPSfLmu4lfRUStsSm014f5Fw+rA1bo:2NMSMaknva+ykkwffL9wpNm/I+rKo
- TLSH T148E3F71E32AD21A9E077A1BC96960216E77374341321A7EF16D0C5798F17BD8BE39F02
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
8128
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ODBCCP32.pdb
msvcrt
_initterm
_amsg_exit
_XcptFilter
_wstat
iswctype
wcstol
_ltow_s
wcschr
_wfullpath
_waccess
_wmakepath_s
_wcsnicmp
_wcsicmp
_wsplitpath_s
calloc
_close
_errno
_wopen
malloc
free
memcpy
__C_specific_handler
_vsnwprintf
fclose
_wfopen
fwprintf
_snwprintf_s
wcsrchr
memcmp
memset
user32
GetSystemMetrics
SetWindowLongPtrA
GetWindowLongPtrA
CharUpperBuffW
LoadIconA
IsDlgButtonChecked
IsWindow
CheckDlgButton
SendMessageA
LoadBitmapA
SetWindowTextW
ReleaseDC
GetDC
LoadCursorA
SetCursor
GetActiveWindow
GetWindowTextW
EndDialog
PostMessageA
SetFocus
EnableWindow
MoveWindow
OffsetRect
GetWindowRect
PostMessageW
ShowWindow
DialogBoxParamW
GetWindowLongPtrW
SendMessageW
GetDlgItem
GetParent
SetWindowLongPtrW
GetDesktopWindow
MessageBoxW
LoadStringW
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
kernel32
LoadLibraryExW
FindNextFileW
CreateDirectoryW
CreateFileW
WriteFile
GetTempFileNameW
ExpandEnvironmentStringsA
LoadLibraryExA
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
WideCharToMultiByte
CloseHandle
OutputDebugStringW
SetFileInformationByHandle
FindClose
GetThreadLocale
GetDateFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileW
GetTempPath2W
MultiByteToWideChar
GetSystemDirectoryW
GetModuleHandleW
GetModuleFileNameW
GetPrivateProfileStringW
FormatMessageW
InitializeCriticalSection
DeleteCriticalSection
DisableThreadLibraryCalls
WritePrivateProfileStringW
GetProfileStringW
VerLanguageNameW
SetThreadErrorMode
DeleteFileW
GetLastError
FreeLibrary
GetProcAddress
LeaveCriticalSection
EnterCriticalSection
DelayLoadFailureHook
ResolveDelayLoadedAPI
advapi32
RegQueryValueExA
RegCloseKey
RegEnumKeyExW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegGetValueW
RegOpenKeyExW
RegOpenKeyExA
RegDeleteKeyW
RegQueryInfoKeyW
RegEnumValueW
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
ODBCCPlApplet
SQLConfigDataSource
SQLConfigDataSourceW
SQLConfigDriver
SQLConfigDriverW
SQLCreateDataSource
SQLCreateDataSourceEx
SQLCreateDataSourceExW
SQLCreateDataSourceW
SQLGetAvailableDrivers
SQLGetAvailableDriversW
SQLGetConfigMode
SQLGetInstalledDrivers
SQLGetInstalledDriversW
SQLGetPrivateProfileString
SQLGetPrivateProfileStringW
SQLGetTranslator
SQLGetTranslatorW
SQLInstallDriver
SQLInstallDriverEx
SQLInstallDriverExW
SQLInstallDriverManager
SQLInstallDriverManagerW
SQLInstallDriverW
SQLInstallODBC
SQLInstallODBCW
SQLInstallTranslator
SQLInstallTranslatorEx
SQLInstallTranslatorExW
SQLInstallTranslatorW
SQLInstallerError
SQLInstallerErrorW
SQLLoadDataSourcesListBox
SQLLoadDriverListBox
SQLManageDataSources
SQLPostInstallerError
SQLPostInstallerErrorW
SQLReadFileDSN
SQLReadFileDSNW
SQLRemoveDSNFromIni
SQLRemoveDSNFromIniW
SQLRemoveDefaultDataSource
SQLRemoveDriver
SQLRemoveDriverManager
SQLRemoveDriverW
SQLRemoveTranslator
SQLRemoveTranslatorW
SQLSetConfigMode
SQLValidDSN
SQLValidDSNW
SQLWriteDSNToIni
SQLWriteDSNToIniW
SQLWriteFileDSN
SQLWriteFileDSNW
SQLWritePrivateProfileString
SQLWritePrivateProfileStringW
SelectTransDlg
Name
.text
Size
92KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=14, id=260, version=33145,
count=5, id=259, version=33145,
count=150, id=1, productName=Unmarked objects,
count=13, id=257, version=33145,
count=1, id=256, version=33145,
count=19, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
odbccr32.dll
- IMPHASH 3de68f143a4fc630d889663fb28135ef
- SHA256 07a689851cf275d03039fac0de253dce9e0a9638aae1df3d7f0ce5905776828d
- MD5 980ca2520994342bbd2a10af7d87af02
- SHA1 2916b2f1dadb1fc23a7a3be1bfb7107159c504c2
- SHA512 ee29a6154c7a6b3c148d4941febc59ede5bb50c36982221902f4e71561aa01d5406e5f76b2418d3e84230760520b0542290983478f57541ef72546d703803b77
- SSDEEP 1536:8ka7LcIQhM6Z5KLhIljuVVKaVz1FKFIvJ+FQhDWOF:8ka/m55FjXaVzsFAqOF
- TLSH T1A4A3179AB67860A5E5A6C07885430F28EBB6B07513221BEF22E0C37D4F13FD06D75B61
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5584
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ODBCCR32.pdb
mfc42
ord4092
ord3543
ord3055
ord3175
ord3061
ord3375
ord3240
ord4824
ord3371
ord3252
ord3058
ord6060
ord5718
ord5737
ord5074
ord4378
ord5731
ord5729
ord3477
ord2426
ord5624
ord1392
ord4201
ord6078
ord2527
ord4093
ord4845
ord6819
ord4385
ord1842
ord2422
ord1873
ord1082
ord1596
ord1484
ord1597
ord812
ord288
ord1498
ord1562
ord355
ord1588
ord1421
ord287
ord1594
ord1551
ord1564
ord1469
ord4087
ord3173
ord4381
ord4992
ord4779
ord3926
ord6097
ord1063
ord659
ord370
ord1573
ord5993
ord5912
ord1572
ord1585
ord286
ord1883
ord367
ord3840
ord3230
ord2571
msvcrt
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
free
_vsnprintf
_stricmp
_strnicmp
__CxxFrameHandler4
memcpy
__C_specific_handler
_CxxThrowException
memset
user32
IsCharAlphaA
MessageBoxW
odbc32
CursorLibLockStmt
ord8
ord6
ord11
ord68
CursorLibLockDbc
ord62
ord19
ord12
ord48
ord49
ord16
ord24
ord3
ord51
ord13
ord43
ord18
ord63
ord72
ord26
ord64
ord20
ord4
ord31
CursorLibLockDesc
CursorLibTransact
ord45
ord61
ord46
ord39
ord50
ord76
ord34
ValidateErrorQueue
PostODBCError
PostODBCComponentError
VRetrieveDriverErrorsRowCol
ord28
ord17
VFreeErrors
LockHandle
ord38
ord73
ord74
ord33
SearchStatusCode
kernel32
VirtualFree
VirtualAlloc
GetTempPath2A
GetTempFileNameA
LoadLibraryExW
FreeLibrary
LocalAlloc
LocalFree
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
ReleaseCLStmtResources
SQLBindCol
SQLBindParameter
SQLBulkOperations
SQLCancel
SQLCloseCursor
SQLEndTran
SQLExecDirect
SQLExecute
SQLExtendedFetch
SQLFetch
SQLFetchScroll
SQLFreeHandle
SQLFreeStmt
SQLGetData
SQLGetDescField
SQLGetDescRec
SQLGetInfo
SQLGetStmtAttr
SQLGetStmtOption
SQLMoreResults
SQLNativeSql
SQLNumParams
SQLParamData
SQLParamOptions
SQLPrepare
SQLPutData
SQLRowCount
SQLSetConnectAttr
SQLSetConnectOption
SQLSetDescField
SQLSetDescRec
SQLSetPos
SQLSetScrollOptions
SQLSetStmtAttr
SQLSetStmtOption
SQLTransact
Name
.text
Size
60KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33136,
count=4, id=259, version=33136,
count=11, id=257, version=33136,
count=166, id=1, productName=Unmarked objects,
count=7, id=261, version=33136,
count=1, id=256, version=33136,
count=12, id=264, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
odbccu32.dll
- IMPHASH b274aaea4a42fd6c2773c020d52097b3
- SHA256 1d0ef4e60c6c10967cf30a049994db7653453d4e7bc27f8d779b0249646219af
- MD5 bd793327bbd441f3f46ad2491c5ce130
- SHA1 df1eb9510199f7342bfe076e097fbe7c155b0ca3
- SHA512 f08326cc48eb9de982c48aa4d8bdb7515cd29f56a912c278a664454c1590a80726327255604223642914849cb2b42195378f7373ce7b1faa18c624be4472518d
- SSDEEP 1536:/IhUzLc0KJzOY3jJhsdEBWwqszjwNP5uS2:/0UL86+CyVQP5u
- TLSH T159A3065EB77860A5D1A6C0788A434E19EBB6B07113212BEF22F0C27D4F53FD16D75A22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
6512
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ODBCCU32.pdb
mfc42u
ord4082
ord3534
ord3046
ord3166
ord3052
ord3366
ord3231
ord4815
ord3362
ord3243
ord3049
ord6053
ord5711
ord5730
ord5065
ord4368
ord5724
ord5722
ord3468
ord2412
ord5615
ord1388
ord4191
ord6071
ord2515
ord4083
ord4836
ord6813
ord4375
ord1828
ord2408
ord1859
ord1082
ord288
ord812
ord1544
ord287
ord1586
ord1555
ord1583
ord1585
ord355
ord1477
ord1553
ord1416
ord1491
ord1577
ord1463
ord4077
ord3164
ord4371
ord4983
ord4770
ord3916
ord6090
ord1063
ord659
ord370
ord1562
ord5986
ord5905
ord1561
ord1574
ord286
ord1869
ord367
ord3830
ord3221
ord2559
msvcrt
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
__C_specific_handler
_amsg_exit
_XcptFilter
__CxxFrameHandler3
_callnewh
malloc
free
_vsnwprintf
_wcsicmp
_wcsnicmp
__CxxFrameHandler4
memcpy
_initterm
_CxxThrowException
memset
user32
IsCharAlphaW
MessageBoxW
odbc32
SearchStatusCode
CursorLibLockStmt
ord108
ord106
ord111
ord68
CursorLibLockDbc
ord162
ord119
ord12
ord48
ord49
ord16
ord24
ord3
ord51
ord13
ord43
ord18
ord63
ord72
ord26
ord64
ord20
ord4
ord31
CursorLibLockDesc
CursorLibTransact
ord145
ord61
ord46
ord139
ord150
ord176
ord134
ValidateErrorQueue
PostODBCError
PostODBCComponentError
VRetrieveDriverErrorsRowCol
ord28
ord117
VFreeErrors
LockHandle
ord138
ord173
ord74
ord133
kernel32
VirtualFree
VirtualAlloc
GetTempPath2W
GetTempFileNameW
LoadLibraryExW
FreeLibrary
LocalAlloc
LocalFree
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
ReleaseCLStmtResources
SQLBindCol
SQLBindParameter
SQLBulkOperations
SQLCancel
SQLCloseCursor
SQLEndTran
SQLExecDirect
SQLExecute
SQLExtendedFetch
SQLFetch
SQLFetchScroll
SQLFreeHandle
SQLFreeStmt
SQLGetData
SQLGetDescField
SQLGetDescRec
SQLGetInfo
SQLGetStmtAttr
SQLGetStmtOption
SQLMoreResults
SQLNativeSql
SQLNumParams
SQLParamData
SQLParamOptions
SQLPrepare
SQLPutData
SQLRowCount
SQLSetConnectAttr
SQLSetConnectOption
SQLSetDescField
SQLSetDescRec
SQLSetPos
SQLSetScrollOptions
SQLSetStmtAttr
SQLSetStmtOption
SQLTransact
Name
.text
Size
60KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33136,
count=4, id=259, version=33136,
count=11, id=257, version=33136,
count=167, id=1, productName=Unmarked objects,
count=11, id=261, version=33136,
count=1, id=256, version=33136,
count=8, id=264, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
odbcint.dll
- SHA256 6ff8996e2e1f6e56c85da1411c3fcbc1f39107c6419282183cd016de5c7c8279
- MD5 26fc5a3a8ffca8fdee9357f0935a0a40
- SHA1 07c3818b9637740ce481145f15e3092d004c5df9
- SHA512 02c8e9bbc79d2df9882234af5ee7f45c274292774679211723d3258b09aeb1bccda3d1afb3584e5fcc8adf905a936355196faa1fe37e334e20d0d9004989bdac
- SSDEEP 3072:bRUUKI9job7ak2wA9ZY1QVnJEC3mJTUZZZZfy:SUKFv2wA9SqFJB3SQZZZZfy
- TLSH T1D13430F5B1F454A7E6275F351CDD7A98B8EE76A441C0462E30A3F2F4949230220ADBBD
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
4KB
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
220KB
Virtual Size
218KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=33140,
count=1, id=258, version=33140,
odbctrac.dll
- IMPHASH e9f729240caf88971625c56b1532b097
- SHA256 4028438bb488ec6c0483c61d5585ea62d94589a201fcce8f266caf059f551e1d
- MD5 6d465e676cc1f2188f35eb05020a42c8
- SHA1 de9b33bcb34cd052fc8e983f28ce3e1d54191d3a
- SHA512 dc92886442c10494d52e0300fc69ac7b7b424e7f797a19a34099fbcdfac0e411ddac39d3c9d7d4371b1992f4898527710b24467f4247ebf58eb29fc95fd90636
- SSDEEP 3072:kbjM6U+xlxkA8DRBU30Wvadao4AVTZOWVV8dJODWMl5OPKe+t:kbjM6U+xkA8DRBU38dZzKB+t
- TLSH T165044F6EB3B12813CD53CA364673450AA375BC153365A3EB52E00E27EE1FBC4A93D295
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5024
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ODBCTRAC.pdb
msvcrt
memset
_initterm
_amsg_exit
_XcptFilter
_snwprintf_s
_splitpath_s
strerror
free
_stricmp
_errno
fwrite
_fullpath
_fsopen
_heapmin
_vsnprintf
fclose
fflush
_wfsopen
isprint
__C_specific_handler
malloc
odbc32
ord36
ntdll
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
_vsnwprintf_s
kernel32
GetSystemTimeAsFileTime
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
LoadLibraryExW
FreeLibrary
DeleteCriticalSection
GetProcAddress
GetSystemInfo
DisableThreadLibraryCalls
InitializeCriticalSection
GetModuleFileNameW
WideCharToMultiByte
GetCurrentProcessId
MultiByteToWideChar
GetCommandLineA
GetCurrentThreadId
LeaveCriticalSection
IsDBCSLeadByteEx
EnterCriticalSection
GetTickCount
LoadLibraryA
user32
MessageBoxW
TraceCloseLogFile
TraceOpenLogFile
TraceReturn
TraceSQLAllocConnect
TraceSQLAllocEnv
TraceSQLAllocHandle
TraceSQLAllocHandleStd
TraceSQLAllocHandleStdW
TraceSQLAllocStmt
TraceSQLBindCol
TraceSQLBindParam
TraceSQLBindParameter
TraceSQLBrowseConnect
TraceSQLBrowseConnectW
TraceSQLBulkOperations
TraceSQLCancel
TraceSQLCancelHandle
TraceSQLCloseCursor
TraceSQLColAttribute
TraceSQLColAttributeW
TraceSQLColAttributes
TraceSQLColAttributesW
TraceSQLColumnPrivileges
TraceSQLColumnPrivilegesW
TraceSQLColumns
TraceSQLColumnsW
TraceSQLCompleteAsync
TraceSQLCompleteAsyncW
TraceSQLConnect
TraceSQLConnectW
TraceSQLCopyDesc
TraceSQLDataSources
TraceSQLDataSourcesW
TraceSQLDescribeCol
TraceSQLDescribeColW
TraceSQLDescribeParam
TraceSQLDisconnect
TraceSQLDriverConnect
TraceSQLDriverConnectW
TraceSQLDrivers
TraceSQLDriversW
TraceSQLEndTran
TraceSQLError
TraceSQLErrorW
TraceSQLExecDirect
TraceSQLExecDirectW
TraceSQLExecute
TraceSQLExtendedFetch
TraceSQLFetch
TraceSQLFetchScroll
TraceSQLForeignKeys
TraceSQLForeignKeysW
TraceSQLFreeConnect
TraceSQLFreeEnv
TraceSQLFreeHandle
TraceSQLFreeStmt
TraceSQLGetConnectAttr
TraceSQLGetConnectAttrW
TraceSQLGetConnectOption
TraceSQLGetConnectOptionW
TraceSQLGetCursorName
TraceSQLGetCursorNameW
TraceSQLGetData
TraceSQLGetDescField
TraceSQLGetDescFieldW
TraceSQLGetDescRec
TraceSQLGetDescRecW
TraceSQLGetDiagField
TraceSQLGetDiagFieldW
TraceSQLGetDiagRec
TraceSQLGetDiagRecW
TraceSQLGetEnvAttr
TraceSQLGetFunctions
TraceSQLGetInfo
TraceSQLGetInfoW
TraceSQLGetStmtAttr
TraceSQLGetStmtAttrW
TraceSQLGetStmtOption
TraceSQLGetTypeInfo
TraceSQLGetTypeInfoW
TraceSQLMoreResults
TraceSQLNativeSql
TraceSQLNativeSqlW
TraceSQLNumParams
TraceSQLNumResultCols
TraceSQLParamData
TraceSQLParamOptions
TraceSQLPrepare
TraceSQLPrepareW
TraceSQLPrimaryKeys
TraceSQLPrimaryKeysW
TraceSQLProcedureColumns
TraceSQLProcedureColumnsW
TraceSQLProcedures
TraceSQLProceduresW
TraceSQLPutData
TraceSQLRowCount
TraceSQLSetConnectAttr
TraceSQLSetConnectAttrW
TraceSQLSetConnectOption
TraceSQLSetConnectOptionW
TraceSQLSetCursorName
TraceSQLSetCursorNameW
TraceSQLSetDescField
TraceSQLSetDescFieldW
TraceSQLSetDescRec
TraceSQLSetEnvAttr
TraceSQLSetParam
TraceSQLSetPos
TraceSQLSetScrollOptions
TraceSQLSetStmtAttr
TraceSQLSetStmtAttrW
TraceSQLSetStmtOption
TraceSQLSpecialColumns
TraceSQLSpecialColumnsW
TraceSQLStatistics
TraceSQLStatisticsW
TraceSQLTablePrivileges
TraceSQLTablePrivilegesW
TraceSQLTables
TraceSQLTablesW
TraceSQLTransact
TraceVSControl
TraceVersion
Name
.text
Size
52KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
96KB
Virtual Size
95KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=14, id=260, version=33136,
count=5, id=259, version=33136,
count=56, id=1, productName=Unmarked objects,
count=11, id=257, version=33136,
count=1, id=256, version=33136,
count=6, id=264, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
oemlicense.dll
- IMPHASH f9c08c57284182e3fdf03e8392b0969f
- SHA256 eceb614f3cc75ce62b317201598e261eacb0a73afaba5ec5e82e4dd1d8367793
- MD5 23ff319452df0a86e0ae6e8119b5ad5e
- SHA1 fcfdae74673c6f4610fb78f28a381228e9ea6f2f
- SHA512 162e8aaee319cd2e8ac6db3d1a150305ac51a1f2b1adba7f66b14d918ae39b4d28560b0434bad46b6d020513ec2944578424dd81347135104e4824434befcff8
- SSDEEP 3072:TNo5irHikdC6NHTM4WaFi86iXQ6xDMvTXLVbkE3OPItlNFXm4:Jo5irHikd3MaY86iXQ6xDWX5bkErn
- TLSH T18BE3071E72AA61B6D5750A3CC6928646D772B4212B2253EF12F4C1BD0F837D8EE34F11
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
bc:69:4d:7d:28:9e:a2:fd:0f:f5:00:bc:97:89:93:d1:e6:a3:16:3f:27:e4:9c:fb:51:6a:31:c5:07:90:28:2f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 23, 2025
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:a8:82:e6:b8:ac:1c:5d:5f:f0:00:00:00:00:04:a8
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2024 - Sep 11, 2025
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8D00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:0d:0d:77:be:7b:36:8f:7f:e3:00:01:00:00:02:0d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
5856
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
OEMLicense.pdb
msvcrt
free
malloc
_initterm
__C_specific_handler
_lock
memmove
memcpy
memcmp
log10
memset
_unlock
__dllonexit
_XcptFilter
_amsg_exit
_onexit
wcschr
wcsstr
wcsrchr
_wcsicmp
_wtoi
swscanf_s
_vsnwprintf
wcscmp
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-libraryloader-l1-1-0
FreeLibrary
DisableThreadLibraryCalls
GetModuleHandleExW
LoadLibraryExA
GetProcAddress
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
SystemTimeToFileTime
GetTimeZoneInformation
api-ms-win-core-errorhandling-l1-1-0
RaiseException
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-localization-l1-2-0
LCMapStringW
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventWriteTransfer
EventRegister
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-file-l1-1-0
DeleteFileW
CreateDirectoryW
FindNextFileW
FindFirstFileW
FindClose
GetFileSize
GetFileAttributesW
WriteFile
ReadFile
CreateFileW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
AcquireSRWLockExclusive
LeaveCriticalSection
EnterCriticalSection
ReleaseSRWLockExclusive
bcrypt
BCryptHashData
BCryptOpenAlgorithmProvider
BCryptCreateHash
BCryptImportKeyPair
BCryptDestroyKey
BCryptGetProperty
BCryptExportKey
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptDestroyHash
oleaut32
SafeArrayDestroy
VariantInit
SafeArrayUnaccessData
SafeArrayCreateVector
SysAllocString
SysFreeString
SafeArrayAccessData
crypt32
CryptQueryObject
CryptImportPublicKeyInfoEx2
CertFreeCertificateContext
api-ms-win-core-synch-l1-2-0
WakeAllConditionVariable
SleepConditionVariableSRW
Sleep
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
GetSystemInfo
api-ms-win-core-heap-obsolete-l1-1-0
LocalAlloc
LocalFree
webservices
WsSkipNode
WsReadChars
WsReadStartAttribute
WsFindAttribute
WsGetReaderNode
WsReadStartElement
WsSetInputToBuffer
WsReadXmlBufferFromBytes
WsCreateReader
WsCreateHeap
WsCreateError
WsSetReaderPosition
WsReadElement
WsGetReaderPosition
WsReadToStartElement
WsMoveReader
WsDateTimeToFileTime
WsFreeReader
WsFreeHeap
WsFreeError
WsReadEndAttribute
cryptxml
CryptXmlVerifySignature
CryptXmlGetReference
CryptXmlGetDocContext
CryptXmlOpenToDecode
CryptXmlGetSignature
CryptXmlGetStatus
CryptXmlClose
api-ms-win-core-memory-l1-1-0
VirtualProtect
VirtualQuery
AddDemoAppLicense
HrAddAppxLicense
HrInstallClipLicense
HrNotifyPhoneLicenseReady
HrRemoveAppxLicense
RemoveDemoAppLicense
Name
.text
Size
80KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=44, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=4, id=259, version=33140,
count=17, id=260, version=33140,
count=140, id=1, productName=Unmarked objects,
count=7, id=257, version=33140,
count=1, id=261, version=33140,
count=1, id=256, version=33140,
count=6, id=264, version=33140,
count=1, id=255, version=33140,
count=1, id=258, version=33140,
offfilt.dll
- IMPHASH d93e4cc35ef60016deffadddbc3139f2
- SHA256 a55f96f9ede1e2cbec5442e5b6ae4a59cc91f8e84e1a22673a5ccf0c9733af48
- MD5 bf8d3ceb9a7d5cf783d492baffd21fe8
- SHA1 a831fe94d2c1a748a93cc5055510b45031d4f7ce
- SHA512 b54ab7f42f321b56a56c065cd0646a836d4fdcf364ec1eae83afd753817afdc32f062773700f66a974edecda7bf9e9d3102eabf1b8ee79476f9787c5d0a2e312
- SSDEEP 6144:Us8TvyF79QzcwehfqLgTkew4mdIkzUozE+AW8r2T5qtf1yzkM+Zv7rWvE1:Us8LiwehfqLVoaxoozE+AW8r2cyu31
- TLSH T1B5848C6AB2E815E0E17BD23CC9A3860BF6B2386143314ACF12D489795F37FE46639751
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
27:74:e7:fa:62:00:da:04:25:d8:43:92:f7:67:89:c5:a3:2e:19:e4:1f:ab:28:9d:bc:55:8d:b6:7e:7d:dc:ed
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:3605-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:13:b0:43:35:66:cf:af:95:e8:00:01:00:00:02:13
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
153296
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
OffFilt.pdb
msvcp_win
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__ecvt_s
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o_atoi
_o_floor
_o_free
_o_isalpha
_o_malloc
_o_wcsncpy_s
__C_specific_handler
_o___stdio_common_vswprintf
_o__configure_narrow_argv
_o__cexit
_o___stdio_common_vsprintf
_o___stdio_common_vsnwprintf_s
_o__crt_atexit
memcpy
__std_terminate
_o___std_type_info_destroy_list
__CxxFrameHandler4
_o___std_exception_destroy
_o___std_exception_copy
_CxxThrowException
memcmp
api-ms-win-crt-string-l1-1-0
memset
strncmp
api-ms-win-core-heap-l2-1-0
GlobalAlloc
GlobalFree
LocalFree
api-ms-win-core-localization-l1-2-0
GetLocaleInfoA
GetLocaleInfoEx
FormatMessageA
FormatMessageW
GetUserDefaultLCID
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
GetModuleHandleExW
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-synch-l1-1-0
ReleaseSemaphore
LeaveCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
CreateSemaphoreExW
CreateMutexExW
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSectionEx
EnterCriticalSection
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
Sleep
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
GetVersionExW
GetSystemTimeAsFileTime
GetTickCount
GetVersionExA
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-heap-obsolete-l1-1-0
GlobalSize
GlobalUnlock
GlobalReAlloc
GlobalLock
api-ms-win-core-memory-l1-1-0
VirtualFree
VirtualAlloc
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryA
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventSetInformation
EventRegister
EventUnregister
api-ms-win-core-file-l1-1-0
GetFileTime
ReadFile
CreateFileW
CreateFileA
FileTimeToLocalFileTime
SetFilePointer
api-ms-win-core-kernel32-legacy-l1-1-0
FileTimeToDosDateTime
api-ms-win-core-datetime-l1-1-0
GetDateFormatA
GetTimeFormatA
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
256KB
Virtual Size
252KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
64KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=62, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=20, id=260, version=33145,
count=5, id=259, version=33145,
count=1184, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=20, id=261, version=33145,
count=1, id=256, version=33145,
count=34, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
officecsp.dll
- IMPHASH 903998f0a53bb3005ee80fe472f8e03e
- SHA256 2d4f6cc8c15dc1d2bca8b1ab14a5201c9e8b481423d802d16b527ac4f06f69a0
- MD5 a53b38a9fc9955d1f740d55123397868
- SHA1 0376380ec17827b8ba31fdfd86ac460845ebada6
- SHA512 38a5e960b2fe94f3538ea9562271e922f46966e959a090aba07737881a48d8e0f840794650b21f65a25f6d2c9583debcdae4ba447d9effe4d8a9b4386c14c6ca
- SSDEEP 3072:nu/bFlrfUElauzLEyh7uEkN08eZicDs762FquJxMGynTK:uRZfUE0nyh7uEkqZi0s7auJxMGynT
- TLSH T1D9E34B2E7A9842B6D565C178CC834F8AD3B2FC101B2243DF1395636E4E37BE89D36A51
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7200
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
officecsp.pdb
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o_free
_o_malloc
_o_memcpy_s
_o_terminate
_o_towlower
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
__current_exception
__current_exception_context
_CxxThrowException
_o__crt_atexit
_o__configure_narrow_argv
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__cexit
_o__callnewh
__C_specific_handler
__std_terminate
__CxxFrameHandler4
__C_specific_handler_noexcept
memcpy
oleaut32
VariantCopy
SysFreeString
SysStringByteLen
SysAllocStringByteLen
VariantInit
LoadTypeLi
SysAllocString
UnRegisterTypeLi
SysStringLen
VariantClear
RegisterTypeLi
api-ms-win-core-synch-l1-1-0
InitializeSRWLock
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer
api-ms-win-core-localization-l1-2-0
SetThreadLocale
FormatMessageA
GetThreadLocale
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
RaiseException
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExA
GetModuleHandleW
GetProcAddress
GetModuleFileNameW
LoadLibraryExW
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegOpenKeyExW
RegCloseKey
RegQueryInfoKeyW
RegDeleteTreeW
RegSetValueExW
RegCreateKeyExW
RegEnumKeyExW
RegEnumValueW
api-ms-win-core-com-l1-1-0
CoGetMalloc
StringFromGUID2
CoCreateInstance
api-ms-win-core-string-l1-1-0
CompareStringW
MultiByteToWideChar
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
CreateProcessW
GetCurrentThreadId
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemDirectoryW
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
combase
GetErrorInfo
msvcp_win
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-registry-l1-1-1
RegDeleteKeyValueW
api-ms-win-core-handle-l1-1-0
CloseHandle
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
64KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
36KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=65, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33145,
count=4, id=259, version=33145,
count=21, id=261, version=33145,
count=1178, id=1, productName=Unmarked objects,
count=4, id=257, version=33145,
count=1, id=256, version=33145,
count=34, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
offlinelsa.dll
- IMPHASH 7069b64307fe9011d139c3e58dc4bb49
- SHA256 90045e20f06054769824e979b5547091bbccaab3c89a9757e880c673699390bb
- MD5 2c2517ee607d6a9a4276731337099ab2
- SHA1 930fd153de04a4105ba71eaec6d1bef32d52bb0a
- SHA512 ca5720f467ce0b218ee9c09a587943e133ed06f4cac27819f7a0d9fdc7e26ecae68e8b5df7aa0b18067a1e8f3d34ad39c4a049f2dc6008adbe1bd2211e1b59b1
- SSDEEP 3072:z7lEsG1pJpbccEukRFDj7qNtoWluh0o59eJyKfGHk9:zZEsGhpb16j78tHluKKeJl
- TLSH T143045B1963F910B5E1BED37CC196064AFAB138263B1113DF02B085BA5F17BE4AA3C759
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
34:48:90:fd:ed:9e:14:e1:4b:98:46:f6:69:70:58:e4:73:58:fc:cb:6c:01:d1:21:68:a5:32:c9:9d:a5:c3:de
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8900-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:22:41:d2:f6:aa:ff:c8:b5:ff:00:01:00:00:02:22
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
5264
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
offlinelsa.pdb
msvcrt
_XcptFilter
memcpy
_onexit
_amsg_exit
__dllonexit
_wcsicmp
free
malloc
_unlock
memcmp
memmove_s
_vsnwprintf
_lock
__C_specific_handler
memcpy_s
_purecall
_initterm
memset
ntdll
RtlUpcaseUnicodeChar
DbgPrintEx
RtlReAllocateHeap
RtlAllocateHeap
RtlFormatCurrentUserKeyPath
RtlRaiseStatus
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlCreateSecurityDescriptor
RtlCreateAcl
RtlNewSecurityObject
RtlAddAccessAllowedAce
RtlGetAce
RtlSetDaclSecurityDescriptor
RtlSetOwnerSecurityDescriptor
NtAdjustPrivilegesToken
RtlEqualSid
NtOpenThreadToken
NtQueryInformationToken
NtSetInformationThread
NtQuerySystemInformation
NtDuplicateToken
NtOpenProcessToken
RtlCompareUnicodeString
RtlInitAnsiString
RtlUnicodeStringToAnsiString
RtlFreeUnicodeString
RtlImageNtHeader
RtlFreeAnsiString
NtQueryValueKey
RtlGetDaclSecurityDescriptor
NtSetValueKey
RtlGetGroupSecurityDescriptor
NtDeleteValueKey
NtSetSecurityObject
RtlGetOwnerSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlpNtEnumerateSubKey
NtDeleteKey
NtQueryKey
RtlFreeSid
RtlAllocateAndInitializeSid
RtlSubAuthoritySid
RtlFreeHeap
NtUnloadKey2
NtFlushKey
RtlDosPathNameToRelativeNtPathName_U_WithStatus
NtLoadKey
RtlInitializeRXact
RtlLengthSecurityDescriptor
RtlEqualUnicodeString
NtCreateKey
RtlCopySid
NtClose
RtlLengthSid
RtlInitUnicodeString
NtOpenKey
RtlValidSid
RtlAnsiStringToUnicodeString
bcrypt
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptDestroyHash
BCryptDestroyKey
BCryptOpenAlgorithmProvider
BCryptGenerateSymmetricKey
BCryptCreateHash
BCryptEncrypt
BCryptHashData
BCryptDecrypt
rpcrt4
RpcStringFreeW
UuidCreate
UuidToStringW
api-ms-win-core-heap-obsolete-l1-1-0
LocalFree
LocalAlloc
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableFlags
GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
TraceMessage
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-security-lsalookup-l2-1-0
LookupPrivilegeNameW
LookupPrivilegeValueW
api-ms-win-core-libraryloader-l1-1-0
DisableThreadLibraryCalls
GetModuleFileNameA
GetProcAddress
GetModuleHandleW
GetModuleHandleExW
api-ms-win-core-synch-l1-1-0
WaitForSingleObjectEx
AcquireSRWLockExclusive
OpenSemaphoreW
WaitForSingleObject
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
ReleaseSemaphore
EnterCriticalSection
CreateSemaphoreExW
AcquireSRWLockShared
DeleteCriticalSection
CreateMutexExW
InitializeSRWLock
ReleaseMutex
ReleaseSRWLockShared
LeaveCriticalSection
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-security-sddl-l1-1-0
ConvertStringSidToSidW
ConvertSidToStringSidW
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-file-l1-1-0
GetFileAttributesW
api-ms-win-core-processthreads-l1-1-0
SetThreadStackGuarantee
GetCurrentProcess
OpenProcessToken
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemInfo
GetSystemTimeAsFileTime
api-ms-win-security-base-l1-1-0
IsValidSid
GetLengthSid
DuplicateTokenEx
GetTokenInformation
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-kernel32-legacy-l1-1-0
WTSGetActiveConsoleSessionId
api-ms-win-security-cryptoapi-l1-1-0
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-memory-l1-1-0
VirtualAlloc
VirtualProtect
VirtualQuery
LsaOfflineAddAccountRights
LsaOfflineAddPrivilegesToAccount
LsaOfflineClose
LsaOfflineCreateAccount
LsaOfflineCreateSecret
LsaOfflineDelete
LsaOfflineEnumerateAccountRights
LsaOfflineEnumerateAccounts
LsaOfflineEnumeratePrivilegesOfAccount
LsaOfflineFreeMemory
LsaOfflineGetSystemAccessAccount
LsaOfflineOpenAccount
LsaOfflineOpenPolicy
LsaOfflineOpenPolicyExternal
LsaOfflineOpenPolicyForInstaller
LsaOfflineOpenSecret
LsaOfflineQueryInformationPolicy
LsaOfflineQuerySecret
LsaOfflineRemoveAccountRights
LsaOfflineRemovePrivilegesFromAccount
LsaOfflineRetrievePrivateData
LsaOfflineSetSecret
LsaOfflineSetSystemAccessAccount
LsaOfflineStorePrivateData
LsaOfflineSyskeyRequest
Name
.text
Size
116KB
Virtual Size
114KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
412B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=44, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33145,
count=5, id=259, version=33145,
count=170, id=1, productName=Unmarked objects,
count=9, id=257, version=33145,
count=1, id=256, version=33145,
count=32, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
offlinesam.dll
- IMPHASH 3a14f8f3805dac9947ce095dd94f0ff3
- SHA256 ec50639a8f1dcb050bed1ce50c64592a4daf25f028b16c40457da5d3fc7ab36f
- MD5 ca49470fb93efff87ec8ba882c89aaeb
- SHA1 eb35856629791d3a5b8ad2e89519400d6344160f
- SHA512 46778c5f63fcbedc260a061060b067e0162c60b024c3d7677da29e1d5e1ad557f643262c3c6b980f92d4195433994aef5ccbb8a9968eca0bacca4948c1e57bcc
- SSDEEP 3072:+D2bKNQXAB4YdXedEASUGkGIpx9LDT6MOewdQYOIENt8VK9rKP+y3bpSpDdUxogF:+D2uNQodudFSUGkP39LSMtwmJt82Yd5
- TLSH T1B9746F0623FD5158F2F7AB345A794665AA32BCA26B34D2DF0290813D4A72FD0DD74B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
bb:c5:98:67:e8:ca:c4:21:6c:48:b3:77:b8:e1:53:4b:50:5c:15:40:3a:8e:15:20:d7:7d:e5:dc:1b:b1:f5:a2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A400-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:28:f0:a5:87:d7:f3:c8:1e:40:00:01:00:00:02:28
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
5280
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
offlinesam.pdb
msvcrt
memcmp
memset
memcpy
memmove
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
memmove_s
memcpy_s
_wcsicmp
_vsnwprintf
_purecall
ntdll
NtOpenKey
RtlInitUnicodeString
NtClose
RtlCopySid
NtCreateKey
RtlImageNtHeader
RtlUpcaseUnicodeChar
DbgPrintEx
RtlReAllocateHeap
RtlAllocateHeap
RtlFormatCurrentUserKeyPath
RtlRaiseStatus
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlFindMessage
RtlAppendUnicodeToString
RtlIntegerToUnicodeString
RtlUpcaseUnicodeStringToOemString
RtlLengthRequiredSid
RtlCopyUnicodeString
RtlIdentifierAuthoritySid
RtlAppendUnicodeStringToString
NtAdjustPrivilegesToken
NtQueryValueKey
NtSetValueKey
RtlGetGroupSecurityDescriptor
NtDeleteValueKey
NtSetSecurityObject
RtlGetOwnerSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlpNtEnumerateSubKey
NtDeleteKey
NtQueryKey
NtOpenThreadToken
NtQueryInformationToken
NtSetInformationThread
NtQuerySystemInformation
NtDuplicateToken
NtOpenProcessToken
RtlCompareUnicodeString
RtlGetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlCreateAcl
RtlAddAuditAccessAce
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedAce
RtlAllocateAndInitializeSid
RtlGetAce
RtlSetDaclSecurityDescriptor
RtlMapGenericMask
RtlInitializeSid
RtlSetOwnerSecurityDescriptor
RtlSetSaclSecurityDescriptor
RtlLengthSid
RtlSubAuthorityCountSid
RtlFreeUnicodeString
RtlConvertSidToUnicodeString
RtlSubAuthoritySid
RtlValidSid
NtQuerySystemTime
RtlEqualSid
RtlFreeHeap
NtUnloadKey2
NtFlushKey
RtlDosPathNameToRelativeNtPathName_U_WithStatus
NtLoadKey
RtlInitializeRXact
rpcrt4
UuidCreate
RpcStringFreeW
UuidToStringW
bcrypt
BCryptDestroyKey
BCryptCloseAlgorithmProvider
BCryptGenerateSymmetricKey
BCryptEncrypt
BCryptSetProperty
BCryptOpenAlgorithmProvider
BCryptHashData
BCryptGetProperty
BCryptCreateHash
BCryptDecrypt
BCryptFinishHash
BCryptDestroyHash
offlinelsa
LsaOfflineOpenPolicyForInstaller
LsaOfflineOpenPolicyExternal
LsaOfflineClose
LsaOfflineSyskeyRequest
LsaOfflineFreeMemory
LsaOfflineQueryInformationPolicy
LsaOfflineOpenPolicy
cryptbase
SystemFunction001
SystemFunction003
SystemFunction036
api-ms-win-core-heap-obsolete-l1-1-0
LocalAlloc
LocalFree
api-ms-win-eventing-classicprovider-l1-1-0
RegisterTraceGuidsW
GetTraceEnableFlags
UnregisterTraceGuids
TraceMessage
GetTraceEnableLevel
GetTraceLoggerHandle
api-ms-win-security-base-l1-1-0
IsValidSid
GetLengthSid
GetTokenInformation
DuplicateTokenEx
api-ms-win-core-file-l1-1-0
GetFileAttributesW
api-ms-win-core-string-l1-1-0
CompareStringEx
api-ms-win-core-synch-l1-1-0
ReleaseMutex
ReleaseSRWLockExclusive
WaitForSingleObject
WaitForSingleObjectEx
InitializeCriticalSectionEx
EnterCriticalSection
CreateMutexExW
AcquireSRWLockShared
DeleteCriticalSection
OpenSemaphoreW
AcquireSRWLockExclusive
ReleaseSRWLockShared
LeaveCriticalSection
InitializeSRWLock
ReleaseSemaphore
CreateSemaphoreExW
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcess
SetThreadStackGuarantee
GetCurrentThreadId
GetCurrentProcessId
OpenProcessToken
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
SetLastError
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-kernel32-legacy-l1-1-0
WTSGetActiveConsoleSessionId
api-ms-win-core-libraryloader-l1-1-0
LoadLibraryExW
GetModuleHandleExW
FreeLibrary
GetModuleHandleW
GetProcAddress
DisableThreadLibraryCalls
GetModuleFileNameA
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemInfo
GetTickCount
api-ms-win-security-sddl-l1-1-0
ConvertStringSidToSidW
api-ms-win-security-lsalookup-l2-1-0
LookupPrivilegeValueW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-memory-l1-1-0
VirtualQuery
VirtualAlloc
VirtualProtect
api-ms-win-security-cryptoapi-l1-1-0
CryptDestroyHash
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptReleaseContext
SamOfflineAddMemberToAlias
SamOfflineCloseHandle
SamOfflineConnect
SamOfflineConnectExternal
SamOfflineConnectForInstaller
SamOfflineCreateAliasInDomain
SamOfflineCreateUserInDomain
SamOfflineDeleteAlias
SamOfflineDeleteUser
SamOfflineEnumerateAliasesInDomain
SamOfflineEnumerateDomainsInSamServer
SamOfflineEnumerateUsersInDomain2
SamOfflineFreeMemory
SamOfflineGetMembersInAlias
SamOfflineLookupDomainInSamServer
SamOfflineLookupNamesInDomain
SamOfflineOpenAlias
SamOfflineOpenDomain
SamOfflineOpenUser
SamOfflineQueryInformationAlias
SamOfflineQueryInformationUser
SamOfflineRemoveMemberFromAlias
SamOfflineRidToSid
SamOfflineSetInformationAlias
SamOfflineSetInformationUser
Name
.text
Size
152KB
Virtual Size
150KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
120KB
Virtual Size
116KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
440B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=50, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33145,
count=5, id=259, version=33145,
count=201, id=1, productName=Unmarked objects,
count=13, id=257, version=33145,
count=1, id=256, version=33145,
count=36, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
offreg.dll
- IMPHASH 7ecf208528d343ca81e86379cfba1349
- SHA256 29f982799ff90b7004abcc607fea12e249da5870f298d6912969235509cb942b
- MD5 e0501faff3dae300107f449a8d1f41ea
- SHA1 c061d2bec783ab90f226348f77019fa4f19f42ba
- SHA512 a7718a482c4a33ffd8723b49073cfad0a14758f828bf8197c9dc6da8707441f0ecf3bd567e023849af89f62b3fe281b5a82e4508085dfa10e15bc991911a561d
- SSDEEP 1536:vFV2DNLyctvVLjfIn4pH/B25D9m0grJAszCSV5EV8ti:vENLxPLjfInO+m0SJAQCS7Euti
- TLSH T1E7B36C1677D821B6E8768378C5574B1AD3B6B42523309BCF03E186BD1F13AEA6E39740
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5056
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
offreg.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__aligned_free
_o__aligned_malloc
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
memmove
_o__wcsicmp
_o__wcsnicmp
_o_free
_o_malloc
_o_qsort
_o_wcscat_s
_o_wcsncpy_s
__C_specific_handler
_o___std_type_info_destroy_list
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
wcsnlen
memset
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TlsSetValue
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
TlsFree
TlsGetValue
TlsAlloc
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetProcAddress
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
DeleteCriticalSection
api-ms-win-security-base-l1-1-0
InitializeSecurityDescriptor
MakeSelfRelativeSD
SetSecurityDescriptorGroup
DestroyPrivateObjectSecurity
IsValidSecurityDescriptor
GetSecurityDescriptorLength
AddAccessAllowedAce
SetPrivateObjectSecurityEx
InitializeAcl
IsValidSid
InitializeSid
CreatePrivateObjectSecurityWithMultipleInheritance
GetSidLengthRequired
GetSidSubAuthority
GetAce
GetSecurityDescriptorControl
GetLengthSid
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
api-ms-win-core-file-l1-1-0
WriteFile
SetEndOfFile
CreateFileW
GetFinalPathNameByHandleW
FlushFileBuffers
GetFileSizeEx
ReadFile
SetFilePointerEx
api-ms-win-core-handle-l1-1-0
CloseHandle
ntdll
RtlAllocateHeap
RtlInitUnicodeString
RtlUpcaseUnicodeChar
RtlRunOnceComplete
RtlRunOnceBeginInitialize
RtlFindNextForwardRunClear
RtlNumberOfSetBits
RtlInitializeSRWLock
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
RtlNtStatusToDosError
RtlFreeHeap
ORCloseHive
ORCloseKey
ORCreateHive
ORCreateHiveEx
ORCreateKey
ORDeleteKey
ORDeleteValue
OREnumKey
OREnumValue
ORFlushHive
ORGetKeySecurity
ORGetValue
ORGetVersion
ORGetVirtualFlags
ORMergeHives
OROpenHive
OROpenHiveByHandle
OROpenKey
ORQueryInfoKey
ORQueryInfoKeyEx
ORQueryInfoKeyValueEx
ORRenameKey
ORSaveHive
ORSaveHiveEx
ORSaveHiveToHandle
ORSetKeySecurity
ORSetValue
ORSetVirtualFlags
Name
.text
Size
60KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
PAGE
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
PAGECMRC
Size
4KB
Virtual Size
130B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
136B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1162, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=6, id=259, version=33145,
count=12, id=261, version=33145,
count=1, id=256, version=33145,
count=50, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
ole32.dll
- IMPHASH 5ab862a2122b3651e8c1eba8a0ac2f3e
- SHA256 185783ea9c2b457ae10b9a31bd9adfc128709a5c8d47bf05cf3fa31188103dcb
- MD5 ccc34ad7f9dd69d5fd4c357c7fdb29b6
- SHA1 e50da0bc7524cd5f64ffba347ceb7379a5c41805
- SHA512 6f43ea828a928eed4da26e752c37a19c0535d32cc5d655cf04c4a4f7a1b1a90cb444c3450d937517d8d778ceaa4d401f754cf4269e2de4bde8ee9c8713292cce
- SSDEEP 24576:7+Ldn7xeLMKRwG05emsbt3WTT5UuOjVSbk8Z+If:7+7KlwlTQRkkzIf
- TLSH T10575291A26EC00D9E67A913D8563C229E671BC2017115ACB11E1FABF7F7BFE00939B51
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a9:08:c0:d9:b9:17:37:72:42:97:a4:d4:33:43:27:74:34:b2:31:3e:e5:b1:b8:4e:4f:4d:ed:0e:64:15:d6:b5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:23:4f:d9:60:24:53:cf:fe:2b:00:01:00:00:02:23
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
285808
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ole32.pdb
msvcp_win
_Query_perf_frequency
_Query_perf_counter
_Mtx_destroy_in_situ
_Mtx_init_in_situ
_Mtx_lock
_Mtx_unlock
?_Throw_Cpp_error@std@@YAXH@Z
api-ms-win-crt-string-l1-1-0
strcspn
wcsncmp
strcmp
wcscmp
memset
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__purecall
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
_o__wcsicmp
_o__wcslwr
_o__wcsnicmp
_o__wtoi
memmove
_o_fmod
_o_free
_o_malloc
_o_strcpy_s
_o_wcscpy_s
_o_wcsncat_s
_o_wcsncpy_s
_o_wcstol
_o_wcstoul
__C_specific_handler
wcschr
wcsrchr
__CxxFrameHandler4
__std_terminate
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_CxxThrowException
_local_unwind
memcmp
memcpy
ntdll
RtlInitializeCriticalSectionAndSpinCount
NtQuerySystemInformation
EtwEventRegister
EtwEventUnregister
EtwEventWriteTransfer
EtwUnregisterTraceGuids
EtwEventSetInformation
EtwGetTraceEnableFlags
EtwTraceMessage
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
RtlAllocateHeap
RtlImageNtHeader
RtlFreeHeap
RtlInitializeCriticalSection
NtQuerySecurityAttributesToken
NtSetInformationFile
NtQueryInformationProcess
EtwRegisterTraceGuidsW
ZwClose
ZwDeleteKey
RtlInitUnicodeString
ZwDeleteValueKey
RtlCompareUnicodeString
RtlDeleteCriticalSection
WinSqmSetDWORD
NtQueryWnfStateData
RtlQueryPackageClaims
RtlIsCriticalSectionLockedByThread
RtlGetNtSystemRoot
RtlCaptureContext
NtQuerySystemInformationEx
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlLoadString
ZwCreateKey
ZwOpenKey
ZwEnumerateKey
ZwQueryValueKey
RtlWriteRegistryValue
RtlNtStatusToDosError
RtlAnsiStringToUnicodeString
kernelbase
lstrcmpiW
AreFileApisANSI
GlobalAlloc
GlobalFree
LocalLock
LocalAlloc
lstrcmpW
LocalUnlock
Sleep
GetPackageFullName
GetApplicationUserModelIdFromToken
lstrlenW
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
LoadStringW
LoadResource
LoadLibraryExW
LoadLibraryExA
LockResource
GetProcAddress
GetModuleFileNameW
GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExW
api-ms-win-core-synch-l1-1-0
CreateMutexExW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
ReleaseSRWLockShared
InitializeSRWLock
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CreateSemaphoreExW
AcquireSRWLockShared
ReleaseMutex
CreateEventExW
WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection
CreateEventW
ReleaseSemaphore
EnterCriticalSection
ResetEvent
InitializeCriticalSection
SetEvent
api-ms-win-core-heap-l1-1-0
HeapDestroy
HeapFree
HeapAlloc
GetProcessHeap
HeapCreate
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
RaiseException
GetLastError
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CloseThreadpoolTimer
CreateThreadpoolWait
WaitForThreadpoolTimerCallbacks
WaitForThreadpoolWorkCallbacks
SubmitThreadpoolWork
CreateThreadpoolWork
CloseThreadpoolWork
SetThreadpoolWait
CloseThreadpoolWait
CreateThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
OpenProcessToken
TlsSetValue
TlsFree
GetCurrentProcess
TlsAlloc
OpenThreadToken
GetCurrentThread
GetCurrentThreadId
CreateProcessW
SetThreadToken
TerminateProcess
GetProcessId
GetCurrentProcessId
CreateThread
api-ms-win-core-wow64-l1-1-1
Wow64SetThreadDefaultGuestMachine
GetSystemWow64DirectoryW
api-ms-win-core-localization-l1-2-0
GetThreadLocale
LCMapStringW
GetUserDefaultLCID
GetSystemDefaultLCID
FormatMessageW
IsDBCSLeadByte
GetLocaleInfoW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-registry-l1-1-0
RegEnumKeyExW
RegFlushKey
RegDeleteKeyExW
RegQueryInfoKeyA
RegDeleteValueW
RegQueryInfoKeyW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegDeleteKeyExA
RegGetValueW
RegOpenKeyExW
RegOpenKeyExA
RegLoadMUIStringW
RegEnumValueW
RegEnumKeyExA
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemInfo
GetTickCount64
GetWindowsDirectoryW
GetSystemTimeAsFileTime
GetVersion
api-ms-win-core-file-l1-1-0
FindFirstFileW
GetFullPathNameA
GetDriveTypeW
CreateFileA
FindClose
SetFilePointer
GetTempFileNameW
GetFileAttributesW
CreateFileW
DeleteFileW
ReadFile
GetFileAttributesExW
GetShortPathNameW
GetFullPathNameW
api-ms-win-core-string-l2-1-0
CharPrevW
CharUpperW
CharNextW
IsCharAlphaNumericW
IsCharAlphaW
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte
CompareStringW
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
api-ms-win-core-libraryloader-l1-2-1
FindResourceW
LoadLibraryA
api-ms-win-core-memory-l1-1-0
OpenFileMappingW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
api-ms-win-core-processenvironment-l1-1-0
SearchPathW
ExpandEnvironmentStringsW
GetCommandLineW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventRegister
EventActivityIdControl
EventWriteTransfer
EventSetInformation
api-ms-win-core-processthreads-l1-1-1
OpenProcess
IsProcessorFeaturePresent
api-ms-win-core-debug-l1-1-1
CheckRemoteDebuggerPresent
api-ms-win-security-base-l1-1-0
RevertToSelf
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
CreateWellKnownSid
DuplicateToken
ImpersonateLoggedOnUser
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-core-file-l1-2-3
GetTempPath2W
api-ms-win-core-processenvironment-l1-2-0
SearchPathA
api-ms-win-core-wow64-l1-1-0
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
IsWow64Process
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-kernel32-legacy-l1-1-0
DosDateTimeToFileTime
MulDiv
FileTimeToDosDateTime
api-ms-win-core-kernel32-private-l1-1-0
_lwrite
CheckElevationEnabled
_lread
_llseek
_lclose
api-ms-win-core-heap-obsolete-l1-1-0
GlobalSize
GlobalReAlloc
GlobalUnlock
GlobalLock
GlobalHandle
api-ms-win-core-stringansi-l1-1-0
CharUpperA
CharPrevA
CharLowerA
CharNextA
api-ms-win-core-atoms-l1-1-0
GlobalGetAtomNameW
GlobalDeleteAtom
GlobalGetAtomNameA
GlobalAddAtomW
GlobalFindAtomA
GlobalFindAtomW
GlobalAddAtomA
api-ms-win-core-threadpool-legacy-l1-1-0
DeleteTimerQueueTimer
CreateTimerQueueTimer
api-ms-win-core-sidebyside-l1-1-0
FindActCtxSectionGuid
api-ms-win-core-synch-l1-2-1
CreateSemaphoreW
gdi32
GetDIBits
CreateDIBSection
SetDIBits
BitBlt
OffsetViewportOrgEx
GetWindowOrgEx
SetBkColor
SetStretchBltMode
StretchBlt
GetObjectType
GetCurrentObject
PatBlt
GetTextFaceW
GetTextMetricsW
EnumFontFamiliesExW
CreateHalftonePalette
CreateCompatibleBitmap
CreateDIBitmap
GetPaletteEntries
StretchDIBits
RealizePalette
CreatePalette
SetEnhMetaFileBits
GetEnhMetaFilePaletteEntries
DeleteDC
CreateCompatibleDC
PlayEnhMetaFileRecord
DeleteMetaFile
DeleteObject
CreateBitmap
GetObjectW
SetBitmapBits
GetBitmapBits
CopyMetaFileW
DeleteEnhMetaFile
CopyEnhMetaFileW
GetBitmapDimensionEx
SetBitmapDimensionEx
GetMetaFileBitsEx
SelectObject
CreateMetaFileA
CloseMetaFile
CreateFontIndirectW
GetTextMetricsA
SetMapMode
SetWindowOrgEx
SetWindowExtEx
Escape
SetTextColor
SetBkMode
GetTextExtentPointA
SetTextAlign
ExtTextOutA
GetDeviceCaps
SaveDC
IntersectClipRect
GetGraphicsMode
CreateEnhMetaFileW
PlayMetaFile
CloseEnhMetaFile
PlayEnhMetaFile
LPtoDP
SetViewportOrgEx
SetViewportExtEx
EnumMetaFile
GetStockObject
SelectPalette
RestoreDC
CreateMetaFileW
PlayMetaFileRecord
GetEnhMetaFileHeader
GetEnhMetaFileBits
SetWinMetaFileBits
GetWinMetaFileBits
SetMetaFileBitsEx
EnumEnhMetaFile
GetTextExtentPointW
user32
SendDlgItemMessageW
SetDlgItemTextW
MessageBoxW
GetActiveWindow
IsWindowEnabled
EnableWindow
DialogBoxParamW
CreateDialogParamW
SetWindowLongPtrW
GetWindowLongPtrW
GetShellWindow
GetWindowThreadProcessId
UnpackDDElParam
PackDDElParam
KillTimer
IsWindow
WaitForInputIdle
CreateWindowExW
PostMessageW
FreeDDElParam
DefWindowProcW
RegisterClassW
UnregisterClassW
GetClassNameW
GetWindow
SetWindowWord
GetWindowWord
RegisterClipboardFormatW
PostQuitMessage
GetClipboardFormatNameW
RegisterClipboardFormatA
GetClipboardFormatNameA
RegisterWindowMessageW
GetPropW
SetCapture
ReleaseCapture
IsClipboardFormatAvailable
GetClipboardData
SetClipboardData
SendMessageW
OpenClipboard
CloseClipboard
EmptyClipboard
RemovePropW
SetPropW
GetClipboardOwner
CountClipboardFormats
EnumClipboardFormats
GetOpenClipboardWindow
SetCursor
LoadCursorW
SetForegroundWindow
GetKeyState
GetWindowLongW
IsIconic
SetThreadDpiAwarenessContext
GetWindowDpiAwarenessContext
GetCursor
GetCursorPos
GetForegroundWindow
RealChildWindowFromPoint
WindowFromPoint
SetRectEmpty
DrawIcon
GetSysColor
CreateCursor
CreateIcon
GetIconInfo
CopyIcon
CopyImage
GetFocus
GetMessageA
GetMessageW
DispatchMessageA
SetActiveWindow
GetWindowTextA
GetDialogBaseUnits
GetTopWindow
IsWindowUnicode
WinHelpW
GetDlgItem
ShowWindow
DestroyWindow
MoveWindow
GetDesktopWindow
GetClientRect
GetWindowRect
SetWindowTextW
MsgWaitForMultipleObjects
DispatchMessageW
TranslateMessage
GetClipboardSequenceNumber
PeekMessageW
ord2716
ord2715
ord2550
GetParent
AllowSetForegroundWindow
SetTimer
WaitMessage
MsgWaitForMultipleObjectsEx
CallMsgFilterW
GetThreadDpiAwarenessContext
ScreenToClient
CopyAcceleratorTableW
GetSubMenu
GetMenuItemID
InSendMessage
ReplyMessage
CallWindowProcW
SetFocus
SetWindowsHookExW
UnhookWindowsHookEx
GetMenuState
CallNextHookEx
ord2521
ReleaseDC
GetDC
DestroyIcon
LoadIconW
GetSystemMetrics
SystemParametersInfoW
combase
ord187
ord207
ord192
ord212
ord190
ord210
ord189
ord209
ord191
ord185
ord196
ord216
ord194
ord214
ord193
ord213
ord195
ord215
ord200
ord220
ord198
ord218
ord197
ord217
ord199
ord219
ord204
ord224
ord202
ord222
ord201
ord221
ord203
ord223
ord101
ord104
ord102
ord103
ord206
ord186
ord208
ord188
ord231
ord205
ord232
ord211
api-ms-win-core-psm-key-l1-1-0
PsmGetKeyFromToken
kernel32
VirtualProtect
VirtualAlloc
SetThreadStackGuarantee
VirtualQuery
RegOpenUserClassesRoot
GetModuleHandleExA
TryAcquireSRWLockExclusive
api-ms-win-core-quirks-l1-1-0
QuirkIsEnabled
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
BindMoniker
CLIPFORMAT_UserFree
CLIPFORMAT_UserFree64
CLIPFORMAT_UserFreeExt
CLIPFORMAT_UserMarshal
CLIPFORMAT_UserMarshal64
CLIPFORMAT_UserMarshalExt
CLIPFORMAT_UserSize
CLIPFORMAT_UserSize64
CLIPFORMAT_UserSizeExt
CLIPFORMAT_UserUnmarshal
CLIPFORMAT_UserUnmarshal64
CLIPFORMAT_UserUnmarshalExt
CLSIDFromOle1Class
CLSIDFromProgID
CLSIDFromProgIDEx
CLSIDFromString
CStdAsyncStubBuffer2_Connect
CStdAsyncStubBuffer2_Disconnect
CStdAsyncStubBuffer2_Release
CStdAsyncStubBuffer_AddRef
CStdAsyncStubBuffer_Connect
CStdAsyncStubBuffer_Disconnect
CStdAsyncStubBuffer_Invoke
CStdAsyncStubBuffer_QueryInterface
CStdAsyncStubBuffer_Release
CStdStubBuffer2_Connect
CStdStubBuffer2_CountRefs
CStdStubBuffer2_Disconnect
CStdStubBuffer2_QueryInterface
CheckInitDde
CleanROTForApartment
ClipboardProcessUninitialize
CoAddRefServerProcess
CoAicGetTokenForCOM
CoAllowSetForegroundWindow
CoAllowUnmarshalerCLSID
CoBuildVersion
CoCancelCall
CoCheckElevationEnabled
CoCopyProxy
CoCreateFreeThreadedMarshaler
CoCreateGuid
CoCreateInstance
CoCreateInstanceEx
CoCreateInstanceFromApp
CoCreateObjectInContext
CoDeactivateObject
CoDecodeProxy
CoDecrementMTAUsage
CoDisableCallCancellation
CoDisconnectContext
CoDisconnectObject
CoDosDateTimeToFileTime
CoEnableCallCancellation
CoFileTimeNow
CoFileTimeToDosDateTime
CoFreeAllLibraries
CoFreeLibrary
CoFreeUnusedLibraries
CoFreeUnusedLibrariesEx
CoGetActivationState
CoGetApartmentID
CoGetApartmentType
CoGetCallContext
CoGetCallState
CoGetCallerTID
CoGetCancelObject
CoGetClassObject
CoGetClassVersion
CoGetComCatalog
CoGetContextToken
CoGetCurrentLogicalThreadId
CoGetCurrentProcess
CoGetDefaultContext
CoGetInstanceFromFile
CoGetInstanceFromIStorage
CoGetInterceptor
CoGetInterceptorForOle32
CoGetInterceptorFromTypeInfo
CoGetInterfaceAndReleaseStream
CoGetMalloc
CoGetMarshalSizeMax
CoGetModuleType
CoGetObject
CoGetObjectContext
CoGetPSClsid
CoGetProcessIdentifier
CoGetStandardMarshal
CoGetStdMarshalEx
CoGetSystemSecurityPermissions
CoGetSystemWow64DirectoryW
CoGetTreatAsClass
CoHandlePriorityEventsFromMessagePump
CoImpersonateClient
CoIncrementMTAUsage
CoInitialize
CoInitializeEx
CoInitializeSecurity
CoInitializeWOW
CoInstall
CoInvalidateRemoteMachineBindings
CoIsHandlerConnected
CoIsOle1Class
CoLoadLibrary
CoLockObjectExternal
CoMarshalHresult
CoMarshalInterThreadInterfaceInStream
CoMarshalInterface
CoPopServiceDomain
CoPushServiceDomain
CoQueryAuthenticationServices
CoQueryClientBlanket
CoQueryProxyBlanket
CoQueryReleaseObject
CoReactivateObject
CoRegisterActivationFilter
CoRegisterChannelHook
CoRegisterClassObject
CoRegisterInitializeSpy
CoRegisterMallocSpy
CoRegisterMessageFilter
CoRegisterPSClsid
CoRegisterSurrogate
CoRegisterSurrogateEx
CoReleaseMarshalData
CoReleaseServerProcess
CoResumeClassObjects
CoRetireServer
CoRevertToSelf
CoRevokeClassObject
CoRevokeInitializeSpy
CoRevokeMallocSpy
CoSetCancelObject
CoSetMessageDispatcher
CoSetProxyBlanket
CoSetState
CoSuspendClassObjects
CoSwitchCallContext
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoTestCancel
CoTreatAsClass
CoTryGetInterceptorForAppModelVirtualization
CoUninitialize
CoUnloadingWOW
CoUnmarshalHresult
CoUnmarshalInterface
CoVrfCheckThreadState
CoVrfGetThreadState
CoVrfReleaseThreadState
CoWaitForMultipleHandles
CoWaitForMultipleObjects
ComPs_NdrDllCanUnloadNow
ComPs_NdrDllGetClassObject
ComPs_NdrDllRegisterProxy
ComPs_NdrDllUnregisterProxy
CreateAntiMoniker
CreateBindCtx
CreateClassMoniker
CreateDataAdviseHolder
CreateDataCache
CreateErrorInfo
CreateFileMoniker
CreateGenericComposite
CreateILockBytesOnHGlobal
CreateItemMoniker
CreateObjrefMoniker
CreateOleAdviseHolder
CreatePointerMoniker
CreateStdProgressIndicator
CreateStreamOnHGlobal
DcomChannelSetHResult
DdeBindToObject
DeletePatternAndExtensionTables
DestroyRunningObjectTable
DllDebugObjectRPCHook
DllGetClassObject
DllGetClassObjectWOW
DllRegisterServer
DoDragDrop
DragDropSetFDT
EnableHookObject
FindExt
FmtIdToPropStgName
FreePropVariantArray
GetActiveObjectExt
GetClassFile
GetConvertStg
GetDocumentBitStg
GetErrorInfo
GetHGlobalFromILockBytes
GetHGlobalFromStream
GetHookInterface
GetObjectFromRotByPath
GetRunningObjectTable
HACCEL_UserFree
HACCEL_UserFree64
HACCEL_UserMarshal
HACCEL_UserMarshal64
HACCEL_UserSize
HACCEL_UserSize64
HACCEL_UserUnmarshal
HACCEL_UserUnmarshal64
HBITMAP_UserFree
HBITMAP_UserFree64
HBITMAP_UserMarshal
HBITMAP_UserMarshal64
HBITMAP_UserSize
HBITMAP_UserSize64
HBITMAP_UserUnmarshal
HBITMAP_UserUnmarshal64
HBRUSH_UserFree
HBRUSH_UserFree64
HBRUSH_UserMarshal
HBRUSH_UserMarshal64
HBRUSH_UserSize
HBRUSH_UserSize64
HBRUSH_UserUnmarshal
HBRUSH_UserUnmarshal64
HDC_UserFree
HDC_UserFree64
HDC_UserMarshal
HDC_UserMarshal64
HDC_UserSize
HDC_UserSize64
HDC_UserUnmarshal
HDC_UserUnmarshal64
HENHMETAFILE_UserFree
HENHMETAFILE_UserFree64
HENHMETAFILE_UserMarshal
HENHMETAFILE_UserMarshal64
HENHMETAFILE_UserSize
HENHMETAFILE_UserSize64
HENHMETAFILE_UserUnmarshal
HENHMETAFILE_UserUnmarshal64
HGLOBAL_UserFree
HGLOBAL_UserFree64
HGLOBAL_UserMarshal
HGLOBAL_UserMarshal64
HGLOBAL_UserSize
HGLOBAL_UserSize64
HGLOBAL_UserUnmarshal
HGLOBAL_UserUnmarshal64
HICON_UserFree
HICON_UserFree64
HICON_UserMarshal
HICON_UserMarshal64
HICON_UserSize
HICON_UserSize64
HICON_UserUnmarshal
HICON_UserUnmarshal64
HMENU_UserFree
HMENU_UserFree64
HMENU_UserMarshal
HMENU_UserMarshal64
HMENU_UserSize
HMENU_UserSize64
HMENU_UserUnmarshal
HMENU_UserUnmarshal64
HMETAFILEPICT_UserFree
HMETAFILEPICT_UserFree64
HMETAFILEPICT_UserMarshal
HMETAFILEPICT_UserMarshal64
HMETAFILEPICT_UserSize
HMETAFILEPICT_UserSize64
HMETAFILEPICT_UserUnmarshal
HMETAFILEPICT_UserUnmarshal64
HMETAFILE_UserFree
HMETAFILE_UserFree64
HMETAFILE_UserMarshal
HMETAFILE_UserMarshal64
HMETAFILE_UserSize
HMETAFILE_UserSize64
HMETAFILE_UserUnmarshal
HMETAFILE_UserUnmarshal64
HMONITOR_UserFree
HMONITOR_UserFree64
HMONITOR_UserMarshal
HMONITOR_UserMarshal64
HMONITOR_UserSize
HMONITOR_UserSize64
HMONITOR_UserUnmarshal
HMONITOR_UserUnmarshal64
HPALETTE_UserFree
HPALETTE_UserFree64
HPALETTE_UserFreeExt
HPALETTE_UserMarshal
HPALETTE_UserMarshal64
HPALETTE_UserMarshalExt
HPALETTE_UserSize
HPALETTE_UserSize64
HPALETTE_UserSizeExt
HPALETTE_UserUnmarshal
HPALETTE_UserUnmarshal64
HPALETTE_UserUnmarshalExt
HRGN_UserFree
HRGN_UserMarshal
HRGN_UserSize
HRGN_UserUnmarshal
HWND_UserFree
HWND_UserFree64
HWND_UserFree64Ext
HWND_UserFreeExt
HWND_UserMarshal
HWND_UserMarshal64
HWND_UserMarshal64Ext
HWND_UserMarshalExt
HWND_UserSize
HWND_UserSize64
HWND_UserSize64Ext
HWND_UserSizeExt
HWND_UserUnmarshal
HWND_UserUnmarshal64
HWND_UserUnmarshal64Ext
HWND_UserUnmarshalExt
HkOleRegisterObject
IIDFromString
IsAccelerator
IsEqualGUID
IsRoInitializeASTAAllowedInDesktop
IsValidIid
IsValidInterface
IsValidPtrIn
IsValidPtrOut
MkParseDisplayName
MonikerCommonPrefixWith
MonikerLoadTypeLib
MonikerRelativePathTo
NdrOleInitializeExtension
NdrProxyForwardingFunction10
NdrProxyForwardingFunction11
NdrProxyForwardingFunction12
NdrProxyForwardingFunction13
NdrProxyForwardingFunction14
NdrProxyForwardingFunction15
NdrProxyForwardingFunction16
NdrProxyForwardingFunction17
NdrProxyForwardingFunction18
NdrProxyForwardingFunction19
NdrProxyForwardingFunction20
NdrProxyForwardingFunction21
NdrProxyForwardingFunction22
NdrProxyForwardingFunction23
NdrProxyForwardingFunction24
NdrProxyForwardingFunction25
NdrProxyForwardingFunction26
NdrProxyForwardingFunction27
NdrProxyForwardingFunction28
NdrProxyForwardingFunction29
NdrProxyForwardingFunction3
NdrProxyForwardingFunction30
NdrProxyForwardingFunction31
NdrProxyForwardingFunction32
NdrProxyForwardingFunction4
NdrProxyForwardingFunction5
NdrProxyForwardingFunction6
NdrProxyForwardingFunction7
NdrProxyForwardingFunction8
NdrProxyForwardingFunction9
ObjectStublessClient10
ObjectStublessClient11
ObjectStublessClient12
ObjectStublessClient13
ObjectStublessClient14
ObjectStublessClient15
ObjectStublessClient16
ObjectStublessClient17
ObjectStublessClient18
ObjectStublessClient19
ObjectStublessClient20
ObjectStublessClient21
ObjectStublessClient22
ObjectStublessClient23
ObjectStublessClient24
ObjectStublessClient25
ObjectStublessClient26
ObjectStublessClient27
ObjectStublessClient28
ObjectStublessClient29
ObjectStublessClient3
ObjectStublessClient30
ObjectStublessClient31
ObjectStublessClient32
ObjectStublessClient4
ObjectStublessClient5
ObjectStublessClient6
ObjectStublessClient7
ObjectStublessClient8
ObjectStublessClient9
Ole32DllGetClassObject
OleBuildVersion
OleConvertIStorageToOLESTREAM
OleConvertIStorageToOLESTREAMEx
OleConvertOLESTREAMToIStorage
OleConvertOLESTREAMToIStorage2
OleConvertOLESTREAMToIStorageEx
OleConvertOLESTREAMToIStorageEx2
OleCreate
OleCreateDefaultHandler
OleCreateEmbeddingHelper
OleCreateEx
OleCreateFontIndirectExt
OleCreateFromData
OleCreateFromDataEx
OleCreateFromFile
OleCreateFromFileEx
OleCreateLink
OleCreateLinkEx
OleCreateLinkFromData
OleCreateLinkFromDataEx
OleCreateLinkToFile
OleCreateLinkToFileEx
OleCreateMenuDescriptor
OleCreatePictureIndirectExt
OleCreatePropertyFrameIndirectExt
OleCreateStaticFromData
OleDestroyMenuDescriptor
OleDoAutoConvert
OleDraw
OleDuplicateData
OleFlushClipboard
OleGetAutoConvert
OleGetClipboard
OleGetClipboardWithEnterpriseInfo
OleGetIconOfClass
OleGetIconOfFile
OleGetPackageClipboardOwner
OleIconToCursorExt
OleInitialize
OleInitializeWOW
OleIsCurrentClipboard
OleIsRunning
OleLoad
OleLoadFromStream
OleLoadPictureExt
OleLoadPictureFileExt
OleLoadPicturePathExt
OleLockRunning
OleMetafilePictFromIconAndLabel
OleNoteObjectVisible
OleQueryCreateFromData
OleQueryLinkFromData
OleRegEnumFormatEtc
OleRegEnumVerbs
OleRegGetMiscStatus
OleRegGetUserType
OleReleaseEnumVerbCache
OleRun
OleSave
OleSavePictureFileExt
OleSaveToStream
OleSetAutoConvert
OleSetClipboard
OleSetContainedObject
OleSetMenuDescriptor
OleTranslateAccelerator
OleTranslateColorExt
OleUninitialize
OpenOrCreateStream
ProgIDFromCLSID
PropStgNameToFmtId
PropSysAllocString
PropSysFreeString
PropVariantChangeType
PropVariantClear
PropVariantCopy
ReadClassStg
ReadClassStm
ReadFmtUserTypeStg
ReadOleStg
ReadStorageProperties
ReadStringStream
RegisterActiveObjectExt
RegisterDragDrop
ReleaseStgMedium
RevokeActiveObjectExt
RevokeDragDrop
RoGetAgileReference
SNB_UserFree
SNB_UserFree64
SNB_UserMarshal
SNB_UserMarshal64
SNB_UserSize
SNB_UserSize64
SNB_UserUnmarshal
SNB_UserUnmarshal64
STGMEDIUM_UserFree
STGMEDIUM_UserFree64
STGMEDIUM_UserFreeExt
STGMEDIUM_UserMarshal
STGMEDIUM_UserMarshal64
STGMEDIUM_UserMarshalExt
STGMEDIUM_UserSize
STGMEDIUM_UserSize64
STGMEDIUM_UserSizeExt
STGMEDIUM_UserUnmarshal
STGMEDIUM_UserUnmarshal64
STGMEDIUM_UserUnmarshalExt
SetConvertStg
SetDocumentBitStg
SetErrorInfo
SetOleautModule
SetWOWThunkGlobalPtr
StdTypesGetClassObject
StdTypesRegisterServer
StgConvertPropertyToVariant
StgConvertVariantToProperty
StgCreateDocfile
StgCreateDocfileOnILockBytes
StgCreatePropSetStg
StgCreatePropStg
StgCreateStorageEx
StgGetIFillLockBytesOnFile
StgGetIFillLockBytesOnILockBytes
StgIsStorageFile
StgIsStorageILockBytes
StgOpenAsyncDocfileOnIFillLockBytes
StgOpenPropStg
StgOpenStorage
StgOpenStorageEx
StgOpenStorageOnHandle
StgOpenStorageOnILockBytes
StgPropertyLengthAsVariant
StgSetTimes
StringFromCLSID
StringFromGUID2
StringFromIID
UpdateDCOMSettings
UpdateProcessTracing
UtConvertDvtd16toDvtd32
UtConvertDvtd32toDvtd16
UtGetDvtd16Info
UtGetDvtd32Info
WdtpInterfacePointer_UserFree
WdtpInterfacePointer_UserFree64
WdtpInterfacePointer_UserMarshal
WdtpInterfacePointer_UserMarshal64
WdtpInterfacePointer_UserSize
WdtpInterfacePointer_UserSize64
WdtpInterfacePointer_UserUnmarshal
WdtpInterfacePointer_UserUnmarshal64
WriteClassStg
WriteClassStm
WriteFmtUserTypeStg
WriteOleStg
WriteStorageProperties
WriteStringStream
Name
.text
Size
864KB
Virtual Size
861KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
200KB
Virtual Size
198KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
480KB
Virtual Size
479KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=94, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=24, id=260, version=33145,
count=1895, id=1, productName=Unmarked objects,
count=15, id=257, version=33145,
count=22, id=261, version=33145,
count=6, id=259, version=33145,
count=1, id=256, version=33145,
count=171, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
oleacc.dll
- IMPHASH dacdff8c76b2982303f1016daba8d85c
- SHA256 bf6cf15b71ffa71aced6451e6746e98b39547e57f1f2dd5f735a0e5135bd5d09
- MD5 b1205ced16b77563e68b316c241df83d
- SHA1 0c5611d38ad2cb8f92cde9184804d9b7f1534bc7
- SHA512 c7bbae0f612a913eabb8728a641ead3d28680fbc236a095a2b93f511db741c69a77e93ebc8a0c5b262c2de5303a210bad4486a377f648ddbc5db004550edcb27
- SSDEEP 6144:CatY5751bqWIW5ijDsltnUfWS7W9ehZ9+IaV944+n48TzmxmX6X4f5qr:CQJjDsWZ9+IaPh+n48Tmtd
- TLSH T1BCA4295EB3A844E6C93AD07C8967420AE7B1B825175197CF0260D27DEF3FBD46A39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
126400
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
oleacc.pdb
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcslwr_s
_o_free
_o_malloc
_o_strncpy_s
_o_terminate
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstok_s
__current_exception
__current_exception_context
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o__execute_onexit_table
_o__errno
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__crt_atexit
_o__configure_narrow_argv
wcsstr
_o__cexit
__std_terminate
__C_specific_handler
__CxxFrameHandler4
_CxxThrowException
__C_specific_handler_noexcept
memcmp
memcpy
_o__beginthreadex
ntdll
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
NtAllocateVirtualMemory
NtFreeVirtualMemory
EtwUnregisterTraceGuids
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
EtwLogTraceEvent
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetVersionExA
GetVersionExW
GetTickCount
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
GetModuleFileNameW
LoadLibraryExW
FindResourceExW
SizeofResource
LoadResource
GetProcAddress
LoadStringW
GetModuleHandleW
GetModuleFileNameA
DisableThreadLibraryCalls
GetModuleHandleExW
rpcrt4
NdrDllCanUnloadNow
NdrStubForwardingFunction
IUnknown_AddRef_Proxy
NdrOleFree
IUnknown_Release_Proxy
NdrOleAllocate
IUnknown_QueryInterface_Proxy
NdrStubCall3
NdrDllGetClassObject
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringW
MultiByteToWideChar
api-ms-win-core-string-l2-1-0
CharNextW
CharLowerBuffW
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
RaiseException
GetLastError
SetLastError
UnhandledExceptionFilter
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
CreateEventW
EnterCriticalSection
AcquireSRWLockExclusive
InitializeCriticalSection
ReleaseSRWLockExclusive
OpenMutexW
CreateMutexW
AcquireSRWLockShared
CreateSemaphoreExW
CreateMutexExW
ReleaseSRWLockShared
DeleteCriticalSection
OpenSemaphoreW
InitializeCriticalSectionEx
WaitForSingleObjectEx
ReleaseSemaphore
ReleaseMutex
SetEvent
WaitForSingleObject
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegCloseKey
RegQueryValueExW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
api-ms-win-core-processthreads-l1-1-1
OpenProcess
IsProcessorFeaturePresent
api-ms-win-core-memory-l1-1-0
ReadProcessMemory
VirtualAllocEx
VirtualFreeEx
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
WriteProcessMemory
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-processthreads-l1-1-0
GetExitCodeThread
GetCurrentProcessId
GetCurrentThreadId
CreateThread
TerminateProcess
OpenProcessToken
GetCurrentProcess
api-ms-win-core-heap-l2-1-0
GlobalAlloc
LocalFree
GlobalFree
LocalAlloc
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetThreadLocale
GetLocaleInfoW
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-security-base-l1-1-0
CheckTokenMembership
AllocateAndInitializeSid
GetTokenInformation
GetSidSubAuthority
FreeSid
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-psapi-l1-1-0
K32GetModuleBaseNameW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-threadpool-legacy-l1-1-0
QueueUserWorkItem
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
lstrcmpW
api-ms-win-core-heap-obsolete-l1-1-0
GlobalUnlock
GlobalLock
api-ms-win-core-atoms-l1-1-0
GlobalAddAtomW
GlobalFindAtomW
GlobalGetAtomNameW
GlobalDeleteAtom
api-ms-win-core-marshal-l1-1-0
HWND_UserFree64
HWND_UserFree
HWND_UserMarshal64
HMENU_UserFree
HMENU_UserMarshal
HWND_UserSize64
HWND_UserUnmarshal64
HMENU_UserSize64
HMENU_UserSize
HMENU_UserMarshal64
HMENU_UserFree64
HWND_UserSize
HWND_UserUnmarshal
HMENU_UserUnmarshal64
HWND_UserMarshal
HMENU_UserUnmarshal
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
AccGetRunningUtilityState
AccNotifyTouchInteraction
AccSetRunningUtilityState
AccessibleChildren
AccessibleObjectFromEvent
AccessibleObjectFromPoint
AccessibleObjectFromWindow
AccessibleObjectFromWindowTimeout
CreateStdAccessibleObject
CreateStdAccessibleProxyA
CreateStdAccessibleProxyW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetOleaccVersionInfo
GetProcessHandleFromHwnd
GetRoleTextA
GetRoleTextW
GetStateTextA
GetStateTextW
IID_IAccessible
IID_IAccessibleHandler
LIBID_Accessibility
LresultFromObject
ObjectFromLresult
PropMgrClient_LookupProp
WindowFromAccessibleObject
Name
.text
Size
304KB
Virtual Size
301KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
92KB
Virtual Size
91KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
24KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=75, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1414, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=17, id=260, version=33145,
count=5, id=259, version=33145,
count=20, id=261, version=33145,
count=1, id=256, version=33145,
count=65, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
oleacchooks.dll
- IMPHASH d380e282c11b15ff2e77a0657628c7a6
- SHA256 cab5c0897a8adcbfdd46024004b02d337d2e2164915c495fdbbd4372cae67269
- MD5 bc154fdb778cb75f36abf49dde23f31c
- SHA1 7d93eaf9465e3f50194d0604e60ba77a3a80486d
- SHA512 4b694a86b88c8ef4a15f4eda4747df97750fa7f01430a3316d0346af04b36b92f6e0026af9bb8299a08baac1e0bca9426c817a8c0f4baf58217bc1e4b488ac72
- SSDEEP 192:OP5WIDM+FMKVy1F8lsgXepZqmpKyEEtQG7/BeSaWqEuW:wcAM+5Vg8lsguppbQK/sNWqEuW
- TLSH T17313088FF7792898F4715A794053160BA236F5240B2392EF4670431E1E76BD1AF38BD2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4752
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
oleacchooks.pdb
msvcrt
__C_specific_handler
_initterm
_vsnwprintf
malloc
free
_amsg_exit
_XcptFilter
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-memory-l1-1-0
UnmapViewOfFile
OpenFileMappingW
MapViewOfFile
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
Name
.text
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
360B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=24, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33145,
count=4, id=259, version=33145,
count=36, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=1, id=256, version=33145,
count=5, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
oleaccrc.dll
- SHA256 55e01403bbd58d3396bb4bc5176228c46aeb4d1704c808ea004ab1375a63479c
- MD5 eb6a180d0e4bb5e36d60f900d834ab3e
- SHA1 4e3ac56b193b604789468bbe52cc51d1122e4368
- SHA512 8a47d15f61bbb8cba6ff6352a9680f961a81ebf7165cf1921f13ffe2166ee774fdc86c05247a404214c9b8365b4f22d745249075be8f9ff6bbb0d8001dc5d834
- SSDEEP 48:KCDW2/MEvfKSSo/mip20IRAr3R+c6hhFQ6ZWyi54p5Ww18c:5BfRSHsd9rh+5hhOyWI3Ww
- TLSH T1F542CB039BF86905F0FF9B715EBB86262636BD68AF11C61F2150236C6875A009DB1B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
4KB
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=33140,
count=1, id=258, version=33140,
oleaut32.dll
- IMPHASH 0ee256404eba3a8ccc042d6da8df9dcc
- SHA256 bb95ec2fcb2f4ab95921171025805226d4ace7a1764500c310790241c259f61e
- MD5 a804d6dd6e06622098015a63e0bce822
- SHA1 fc87623e3db929a49cb7ddb5910dfe4c1095ebf7
- SHA512 12a7f1c2f0878b2a618845a11fa8f21f064571d5d3b62a9a4e46ea42d3e9c12851c4196ac5cbe445802b7057bf403addde148cccafb4ce453b4d53d2b5aee492
- SSDEEP 12288:WaqOuv0LlZtEsoyFMfp+W3mx0lV/IZyswOeLamcoG9/ewOb+I9jA6b:WaXdHEsoyFVWWx0kkP+19/4X97
- TLSH T14F155B27B2B422EAC276503ACAC78267D6B07826175053C712D486BD7E2FFE42B3D754
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
0a:a0:8c:45:68:fa:cc:a6:5b:da:3e:13:2f:78:52:5a:a8:e7:df:76:3e:81:26:3b:05:a7:9b:d6:4a:d5:15:e8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:321A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1a:a9:a0:1d:06:a0:0f:43:aa:00:01:00:00:02:1a
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
319744
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
oleaut32.pdb
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-string-l1-1-0
wcscmp
wcsncmp
memset
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
_clearfp
api-ms-win-crt-private-l1-1-0
_o__gcvt
_o__i64tow_s
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__itoa_s
_o__itow_s
_o__ltow_s
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__stat64i32
_o__ui64tow_s
_o__ultow_s
memmove
_o__wcsicmp
_o__wcsnicmp
_o__wmakepath_s
_o__wsplitpath_s
_o__wtoi
_o__wtol
_o_atoi
_o_atol
_o_ceil
_o_floor
_o_fmod
_o_iswspace
_o_modf
_o_pow
_o_remove
_o_strcat_s
_o_strcpy_s
_o_strncpy_s
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstoul
wcschr
wcsrchr
__C_specific_handler
strchr
strrchr
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsscanf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__execute_onexit_table
_o__errno
__std_terminate
__CxxFrameHandler4
_CxxThrowException
memcmp
memcpy
ntdll
NtQueryInformationProcess
NtGetCachedSigningLevel
NtCompareSigningLevels
LdrGetDllPath
RtlRunOnceBeginInitialize
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
NtQuerySystemInformationEx
NtSetCachedSigningLevel
RtlReleasePath
combase
WdtpInterfacePointer_UserUnmarshal
SetErrorInfo
GetErrorInfo
CreateErrorInfo
ord181
WdtpInterfacePointer_UserSize
WdtpInterfacePointer_UserMarshal
CStdStubBuffer_Invoke
CStdStubBuffer_DebugServerQueryInterface
ord4
CStdStubBuffer_AddRef
CStdStubBuffer_CountRefs
CStdStubBuffer_QueryInterface
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Connect
ord3
ord11
ord43
ord13
ord10
ord180
ord21
ord2
ord26
ord17
ord27
ord19
ord14
ord22
ord35
ord6
ord40
ord12
ord18
ord42
ord33
ord34
ord5
ord7
ord39
ord8
ord25
ord16
ord9
ord38
ord15
ord41
ord28
ord20
ord32
ord36
ord23
ord24
ord167
DcomChannelSetHResult
WdtpInterfacePointer_UserSize64
WdtpInterfacePointer_UserMarshal64
WdtpInterfacePointer_UserUnmarshal64
NdrCStdStubBuffer2_Release
NdrCStdStubBuffer_Release
ord37
api-ms-win-core-localization-l1-2-0
GetLocaleInfoW
LCMapStringW
FormatMessageW
GetLocaleInfoA
IsDBCSLeadByte
GetUserDefaultLCID
GetSystemDefaultLCID
api-ms-win-core-processthreads-l1-1-0
GetCurrentThread
TerminateProcess
OpenThreadToken
GetCurrentProcess
OpenProcessToken
SetThreadToken
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
GetModuleHandleW
LoadLibraryExA
LoadLibraryExW
GetModuleHandleExW
GetProcAddress
GetModuleFileNameA
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
SetErrorMode
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-synch-l1-1-0
CreateMutexExW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
CreateEventW
ResetEvent
SetEvent
ReleaseSRWLockShared
ReleaseSemaphore
InitializeCriticalSection
ReleaseMutex
WaitForSingleObjectEx
EnterCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
OpenSemaphoreW
LeaveCriticalSection
InitializeSRWLock
CreateSemaphoreExW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer
api-ms-win-security-base-l1-1-0
EqualSid
GetTokenInformation
api-ms-win-core-wow64-l1-1-1
Wow64SetThreadDefaultGuestMachine
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW
RegDeleteKeyExW
RegEnumKeyExW
RegOpenKeyExA
RegCreateKeyExW
RegQueryInfoKeyA
RegGetValueW
RegEnumKeyExA
RegSetValueExW
RegCloseKey
RegEnumValueW
RegSetValueExA
RegCreateKeyExA
RegOpenUserClassesRoot
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
CompareStringW
GetStringTypeExW
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
GetTickCount
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetLocalTime
api-ms-win-core-processenvironment-l1-1-0
SearchPathW
GetEnvironmentVariableA
api-ms-win-core-file-l1-1-0
GetFileSize
CreateFileA
GetFullPathNameA
CreateFileW
GetFullPathNameW
GetDriveTypeW
api-ms-win-core-wow64-l1-1-0
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
IsWow64Process
api-ms-win-core-memory-l1-1-0
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
api-ms-win-core-processenvironment-l1-2-0
SearchPathA
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventRegister
EventWriteTransfer
EventSetInformation
rpcrt4
NdrGetUserMarshalInfo
RpcRaiseException
NdrClientCall2
IUnknown_AddRef_Proxy
NdrOleFree
IUnknown_Release_Proxy
NdrDllGetClassObject
NdrStubCall2
NdrStubForwardingFunction
IUnknown_QueryInterface_Proxy
NdrOleAllocate
CreateStubFromTypeInfo
CreateProxyFromTypeInfo
api-ms-win-core-localization-l2-1-0
GetCurrencyFormatW
api-ms-win-core-datetime-l1-1-0
GetTimeFormatW
GetDateFormatW
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
InitOnceInitialize
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-kernel32-private-l1-1-0
_lread
_llseek
_lclose
_lwrite
api-ms-win-core-localization-private-l1-1-0
NlsGetCacheUpdateCount
kernelbase
lstrcmpiA
GetNumberFormatW
CompareStringA
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
BSTR_UserFree
BSTR_UserFree64
BSTR_UserMarshal
BSTR_UserMarshal64
BSTR_UserSize
BSTR_UserSize64
BSTR_UserUnmarshal
BSTR_UserUnmarshal64
BstrFromVector
ClearCustData
CreateDispTypeInfo
CreateErrorInfo
CreateStdDispatch
CreateTypeLib
CreateTypeLib2
DispCallFunc
DispGetIDsOfNames
DispGetParam
DispInvoke
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
DosDateTimeToVariantTime
GetActiveObject
GetAltMonthNames
GetErrorInfo
GetRecordInfoFromGuids
GetRecordInfoFromTypeInfo
GetVarConversionLocaleSetting
HWND_UserFree
HWND_UserFree64
HWND_UserMarshal
HWND_UserMarshal64
HWND_UserSize
HWND_UserSize64
HWND_UserUnmarshal
HWND_UserUnmarshal64
LHashValOfNameSys
LHashValOfNameSysA
LPSAFEARRAY_Marshal
LPSAFEARRAY_Size
LPSAFEARRAY_Unmarshal
LPSAFEARRAY_UserFree
LPSAFEARRAY_UserFree64
LPSAFEARRAY_UserMarshal
LPSAFEARRAY_UserMarshal64
LPSAFEARRAY_UserSize
LPSAFEARRAY_UserSize64
LPSAFEARRAY_UserUnmarshal
LPSAFEARRAY_UserUnmarshal64
LoadRegTypeLib
LoadTypeLib
LoadTypeLibEx
OACleanup
OACreateTypeLib2
OaBuildVersion
OaEnablePerUserTLibRegistration
OleCreateFontIndirect
OleCreatePictureIndirect
OleCreatePropertyFrame
OleCreatePropertyFrameIndirect
OleIconToCursor
OleLoadPicture
OleLoadPictureEx
OleLoadPictureFile
OleLoadPictureFileEx
OleLoadPicturePath
OleSavePictureFile
OleTranslateColor
QueryPathOfRegTypeLib
RegisterActiveObject
RegisterTypeLib
RegisterTypeLibForUser
RevokeActiveObject
SafeArrayAccessData
SafeArrayAddRef
SafeArrayAllocData
SafeArrayAllocDescriptor
SafeArrayAllocDescriptorEx
SafeArrayCopy
SafeArrayCopyData
SafeArrayCreate
SafeArrayCreateEx
SafeArrayCreateVector
SafeArrayCreateVectorEx
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
SafeArrayGetDim
SafeArrayGetElement
SafeArrayGetElemsize
SafeArrayGetIID
SafeArrayGetLBound
SafeArrayGetRecordInfo
SafeArrayGetUBound
SafeArrayGetVartype
SafeArrayLock
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayRedim
SafeArrayReleaseData
SafeArrayReleaseDescriptor
SafeArraySetIID
SafeArraySetRecordInfo
SafeArrayUnaccessData
SafeArrayUnlock
SetErrorInfo
SetOaNoCache
SetVarConversionLocaleSetting
SysAddRefString
SysAllocString
SysAllocStringByteLen
SysAllocStringLen
SysFreeString
SysReAllocString
SysReAllocStringLen
SysReleaseString
SysStringByteLen
SysStringLen
SystemTimeToVariantTime
UnRegisterTypeLib
UnRegisterTypeLibForUser
VARIANT_UserFree
VARIANT_UserFree64
VARIANT_UserMarshal
VARIANT_UserMarshal64
VARIANT_UserSize
VARIANT_UserSize64
VARIANT_UserUnmarshal
VARIANT_UserUnmarshal64
VarAbs
VarAdd
VarAnd
VarBoolFromCy
VarBoolFromDate
VarBoolFromDec
VarBoolFromDisp
VarBoolFromI1
VarBoolFromI2
VarBoolFromI4
VarBoolFromI8
VarBoolFromR4
VarBoolFromR8
VarBoolFromStr
VarBoolFromUI1
VarBoolFromUI2
VarBoolFromUI4
VarBoolFromUI8
VarBstrCat
VarBstrCmp
VarBstrFromBool
VarBstrFromCy
VarBstrFromDate
VarBstrFromDec
VarBstrFromDisp
VarBstrFromI1
VarBstrFromI2
VarBstrFromI4
VarBstrFromI8
VarBstrFromR4
VarBstrFromR8
VarBstrFromUI1
VarBstrFromUI2
VarBstrFromUI4
VarBstrFromUI8
VarCat
VarCmp
VarCyAbs
VarCyAdd
VarCyCmp
VarCyCmpR8
VarCyFix
VarCyFromBool
VarCyFromDate
VarCyFromDec
VarCyFromDisp
VarCyFromI1
VarCyFromI2
VarCyFromI4
VarCyFromI8
VarCyFromR4
VarCyFromR8
VarCyFromStr
VarCyFromUI1
VarCyFromUI2
VarCyFromUI4
VarCyFromUI8
VarCyInt
VarCyMul
VarCyMulI4
VarCyMulI8
VarCyNeg
VarCyRound
VarCySub
VarDateFromBool
VarDateFromCy
VarDateFromDec
VarDateFromDisp
VarDateFromI1
VarDateFromI2
VarDateFromI4
VarDateFromI8
VarDateFromR4
VarDateFromR8
VarDateFromStr
VarDateFromUI1
VarDateFromUI2
VarDateFromUI4
VarDateFromUI8
VarDateFromUdate
VarDateFromUdateEx
VarDecAbs
VarDecAdd
VarDecCmp
VarDecCmpR8
VarDecDiv
VarDecFix
VarDecFromBool
VarDecFromCy
VarDecFromDate
VarDecFromDisp
VarDecFromI1
VarDecFromI2
VarDecFromI4
VarDecFromI8
VarDecFromR4
VarDecFromR8
VarDecFromStr
VarDecFromUI1
VarDecFromUI2
VarDecFromUI4
VarDecFromUI8
VarDecInt
VarDecMul
VarDecNeg
VarDecRound
VarDecSub
VarDiv
VarEqv
VarFix
VarFormat
VarFormatCurrency
VarFormatDateTime
VarFormatFromTokens
VarFormatNumber
VarFormatPercent
VarI1FromBool
VarI1FromCy
VarI1FromDate
VarI1FromDec
VarI1FromDisp
VarI1FromI2
VarI1FromI4
VarI1FromI8
VarI1FromR4
VarI1FromR8
VarI1FromStr
VarI1FromUI1
VarI1FromUI2
VarI1FromUI4
VarI1FromUI8
VarI2FromBool
VarI2FromCy
VarI2FromDate
VarI2FromDec
VarI2FromDisp
VarI2FromI1
VarI2FromI4
VarI2FromI8
VarI2FromR4
VarI2FromR8
VarI2FromStr
VarI2FromUI1
VarI2FromUI2
VarI2FromUI4
VarI2FromUI8
VarI4FromBool
VarI4FromCy
VarI4FromDate
VarI4FromDec
VarI4FromDisp
VarI4FromI1
VarI4FromI2
VarI4FromI8
VarI4FromR4
VarI4FromR8
VarI4FromStr
VarI4FromUI1
VarI4FromUI2
VarI4FromUI4
VarI4FromUI8
VarI8FromBool
VarI8FromCy
VarI8FromDate
VarI8FromDec
VarI8FromDisp
VarI8FromI1
VarI8FromI2
VarI8FromR4
VarI8FromR8
VarI8FromStr
VarI8FromUI1
VarI8FromUI2
VarI8FromUI4
VarI8FromUI8
VarIdiv
VarImp
VarInt
VarMod
VarMonthName
VarMul
VarNeg
VarNot
VarNumFromParseNum
VarOr
VarParseNumFromStr
VarPow
VarR4CmpR8
VarR4FromBool
VarR4FromCy
VarR4FromDate
VarR4FromDec
VarR4FromDisp
VarR4FromI1
VarR4FromI2
VarR4FromI4
VarR4FromI8
VarR4FromR8
VarR4FromStr
VarR4FromUI1
VarR4FromUI2
VarR4FromUI4
VarR4FromUI8
VarR8FromBool
VarR8FromCy
VarR8FromDate
VarR8FromDec
VarR8FromDisp
VarR8FromI1
VarR8FromI2
VarR8FromI4
VarR8FromI8
VarR8FromR4
VarR8FromStr
VarR8FromUI1
VarR8FromUI2
VarR8FromUI4
VarR8FromUI8
VarR8Pow
VarR8Round
VarRound
VarSub
VarTokenizeFormatString
VarUI1FromBool
VarUI1FromCy
VarUI1FromDate
VarUI1FromDec
VarUI1FromDisp
VarUI1FromI1
VarUI1FromI2
VarUI1FromI4
VarUI1FromI8
VarUI1FromR4
VarUI1FromR8
VarUI1FromStr
VarUI1FromUI2
VarUI1FromUI4
VarUI1FromUI8
VarUI2FromBool
VarUI2FromCy
VarUI2FromDate
VarUI2FromDec
VarUI2FromDisp
VarUI2FromI1
VarUI2FromI2
VarUI2FromI4
VarUI2FromI8
VarUI2FromR4
VarUI2FromR8
VarUI2FromStr
VarUI2FromUI1
VarUI2FromUI4
VarUI2FromUI8
VarUI4FromBool
VarUI4FromCy
VarUI4FromDate
VarUI4FromDec
VarUI4FromDisp
VarUI4FromI1
VarUI4FromI2
VarUI4FromI4
VarUI4FromI8
VarUI4FromR4
VarUI4FromR8
VarUI4FromStr
VarUI4FromUI1
VarUI4FromUI2
VarUI4FromUI8
VarUI8FromBool
VarUI8FromCy
VarUI8FromDate
VarUI8FromDec
VarUI8FromDisp
VarUI8FromI1
VarUI8FromI2
VarUI8FromI8
VarUI8FromR4
VarUI8FromR8
VarUI8FromStr
VarUI8FromUI1
VarUI8FromUI2
VarUI8FromUI4
VarUdateFromDate
VarWeekdayName
VarXor
VariantChangeType
VariantChangeTypeEx
VariantClear
VariantCopy
VariantCopyInd
VariantInit
VariantTimeToDosDateTime
VariantTimeToSystemTime
VectorFromBstr
Name
.text
Size
640KB
Virtual Size
637KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
152KB
Virtual Size
148KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
36KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
464B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=70, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=16, id=260, version=33145,
count=21, id=261, version=33145,
count=1361, id=1, productName=Unmarked objects,
count=9, id=257, version=33145,
count=6, id=259, version=33145,
count=1, id=256, version=33145,
count=114, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
oledlg.dll
- IMPHASH 3cf0399e622a97376647f0a476137c08
- SHA256 8b81da060e9c120e4d5982dfddab09cd2e375180b5a38bc9ab4ba14317d21067
- MD5 28a5e53f35d05959a376ccef267a5aee
- SHA1 0fb1dca57a694946744a2b1f3e30bf2f51dbbdeb
- SHA512 db68639a2c59982c8d52311ead63c5310efdd8c0dd7b8e2fa95efc3cb3c435eeafb305544e3f30d076e7fc0df4038df9993c9d2040917b4c667b045942773e84
- SSDEEP 6144:UBwbjZxzn5FmH7/O1F5DLV9Ad1Sxs8uekzch:UBwbjZxb5kOJLVSJ+h
- TLSH T1AF343B2E37AA10A9D86BC23CC5868716E673B4352311A2CB06E0C67D5F57FE97639F01
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
9504
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
oledlg.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__purecall
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
_o__stricmp
_o__wcsicmp
memmove
_o_free
_o_iswalpha
_o_malloc
__C_specific_handler
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__callnewh
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
wcschr
__CxxFrameHandler3
_CxxThrowException
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
wcsncmp
ntdll
NtQuerySystemInformationEx
NtQuerySecurityAttributesToken
EtwEventWriteTransfer
RtlAllocateHeap
RtlImageNtHeader
EtwTraceMessage
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlFreeHeap
kernel32
SetEvent
InitializeCriticalSectionAndSpinCount
RaiseException
VirtualQuery
SetThreadStackGuarantee
GetSystemInfo
VirtualAlloc
VirtualProtect
InitializeCriticalSection
GetProcessHeap
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
HeapAlloc
CreateThreadpoolTimer
ReleaseSRWLockShared
SetThreadpoolTimer
InitOnceBeginInitialize
CreateSemaphoreExW
HeapFree
EnterCriticalSection
ReleaseSemaphore
LeaveCriticalSection
InitializeCriticalSectionEx
WaitForThreadpoolTimerCallbacks
ReleaseMutex
MulDiv
GetFileType
CreateFileW
FindNextFileW
ResetEvent
CloseHandle
CreateEventW
WaitForSingleObject
GetLastError
SetLastError
LoadLibraryExW
FindResourceW
LoadResource
LockResource
IsBadStringPtrW
IsBadReadPtr
IsBadCodePtr
IsBadWritePtr
GlobalSize
GetDateFormatW
GetSystemTime
SystemTimeToFileTime
GetTimeFormatW
FileTimeToLocalFileTime
GetNumberFormatW
FileTimeToSystemTime
LocalFileTimeToFileTime
GetLocaleInfoW
CompareFileTime
GetCurrentDirectoryW
LoadLibraryW
GetFileAttributesW
GetFullPathNameW
FindClose
GetShortPathNameW
SearchPathW
FindFirstFileW
DebugBreak
GetProcAddress
OutputDebugStringW
FormatMessageW
GetModuleHandleExW
CompareStringW
GetModuleFileNameA
GlobalUnlock
FreeLibrary
LocalFree
GlobalLock
GlobalFree
GlobalAlloc
GetVersion
LocalAlloc
WideCharToMultiByte
MultiByteToWideChar
TerminateProcess
GetCurrentProcess
GetModuleHandleW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
DisableThreadLibraryCalls
ReleaseSRWLockExclusive
CloseThreadpoolTimer
GetCurrentThread
InitOnceComplete
AcquireSRWLockExclusive
OpenSemaphoreW
WaitForSingleObjectEx
user32
InvalidateRect
ReleaseDC
DialogBoxParamW
RegisterWindowMessageW
KillTimer
GetDlgItem
GetClientRect
InsertMenuW
CreateIcon
SetWindowWord
GetWindowWord
CharLowerW
SetCursor
ShowCursor
DefWindowProcW
SetWindowLongPtrW
UnregisterClassW
GetWindowLongPtrW
RegisterClassW
LoadBitmapW
LoadCursorW
BeginPaint
EndPaint
GetWindowLongW
DialogBoxIndirectParamW
RegisterClipboardFormatW
SetClipboardViewer
ChangeClipboardChain
GetForegroundWindow
GetWindowTextLengthW
IsWindowEnabled
GetDlgItemInt
SetDlgItemInt
MessageBoxW
GetWindowInfo
CheckDlgButton
SetWindowLongW
GetFocus
GetSystemMetrics
DrawIcon
DestroyIcon
DrawFocusRect
SetFocus
DestroyWindow
SetWindowPos
CheckRadioButton
CharPrevW
MapWindowPoints
GetDialogBaseUnits
IsDlgButtonChecked
GetClipboardFormatNameW
DrawMenuBar
UpdateWindow
EnableWindow
GetWindowThreadProcessId
GetLastActivePopup
GetWindow
IsWindowVisible
GetDesktopWindow
GetParent
SetForegroundWindow
IsIconic
GetWindowTextW
PostMessageW
GetWindowRect
GetMenu
InflateRect
GetDC
GetPropW
FillRect
CreateWindowExW
DeleteMenu
ScreenToClient
SendMessageW
EndDialog
RemovePropW
SetWindowTextW
CreatePopupMenu
LoadStringW
GetActiveWindow
ShowWindow
IsWindow
DispatchMessageW
SetTimer
IsDialogMessageW
PeekMessageW
SetDlgItemTextW
GetDlgItemTextW
SendDlgItemMessageW
GetSysColor
DestroyMenu
CharNextW
SetPropW
TranslateMessage
LoadIconW
gdi32
GetTextExtentPointW
CreateICW
GetBkColor
SetBrushOrgEx
CreateBitmap
SetMapMode
RestoreDC
EnumMetaFile
SetDIBits
PlayMetaFile
SetViewportOrgEx
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
GetLayout
GetDeviceCaps
DeleteDC
GetObjectW
SelectObject
GetStockObject
GetTextMetricsW
SetTextColor
SetBkMode
SetBkColor
ExtTextOutW
GetMetaFileBitsEx
DeleteObject
CreateSolidBrush
UnrealizeObject
SetViewportExtEx
SaveDC
PlayMetaFileRecord
GetBitmapBits
advapi32
RegEnumKeyExW
RegLoadMUIStringW
EventWriteTransfer
RegQueryValueW
RegNotifyChangeKeyValue
EventRegister
EventSetInformation
RegOpenUserClassesRoot
OpenProcessToken
SetThreadToken
RegOpenKeyExW
RegGetValueW
EventUnregister
ConvertSidToStringSidW
OpenThreadToken
GetTokenInformation
RegCloseKey
ole32
OleGetIconOfFile
OleCreate
GetClassFile
OleMetafilePictFromIconAndLabel
OleRegGetUserType
CLSIDFromString
CoGetTreatAsClass
OleGetIconOfClass
StringFromGUID2
OleDuplicateData
OleCreateFromFile
OleQueryLinkFromData
OleGetClipboard
ReleaseStgMedium
CLSIDFromProgID
OleQueryCreateFromData
CoCreateInstance
IIDFromString
CoGetMalloc
CoTaskMemFree
CoTaskMemRealloc
OleCreateLinkToFile
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsCreateStringReference
WindowsDuplicateString
WindowsGetStringRawBuffer
WindowsDeleteString
msvcp_win
_Query_perf_frequency
_Query_perf_counter
api-ms-win-core-wow64-l1-1-1
Wow64SetThreadDefaultGuestMachine
OleUIAddVerbMenuA
OleUIAddVerbMenuW
OleUIBusyA
OleUIBusyW
OleUICanConvertOrActivateAs
OleUIChangeIconA
OleUIChangeIconW
OleUIChangeSourceA
OleUIChangeSourceW
OleUIConvertA
OleUIConvertW
OleUIEditLinksA
OleUIEditLinksW
OleUIInsertObjectA
OleUIInsertObjectW
OleUIObjectPropertiesA
OleUIObjectPropertiesW
OleUIPasteSpecialA
OleUIPasteSpecialW
OleUIPromptUserA
OleUIPromptUserW
OleUIUpdateLinksA
OleUIUpdateLinksW
Name
.text
Size
152KB
Virtual Size
148KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
36KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
636B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33145,
count=5, id=259, version=33145,
count=1382, id=1, productName=Unmarked objects,
count=16, id=257, version=33145,
count=26, id=261, version=33145,
count=1, id=256, version=33145,
count=28, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
oleprn.dll
- IMPHASH b8c2e819392388a4da7e7f8850a4454c
- SHA256 3a7fb12902609535d6820850f51acde8c5e1e8b0da67286745dedcd1df716bf1
- MD5 58d42b15363e356527ff6200973cf8b4
- SHA1 d882d6d00961988d19dd895e0dc451bbbdd80d6e
- SHA512 78ef7d3670bb5ee6661ab2a131f19615a30381831b7ecc94dfd29b918c03aafdf3bca29662faa4507de00179c32ee149e8926c1129d1d181b9acd284e76e4339
- SSDEEP 3072:ppDTkkrQBfbm2oTf3WeqRrFnjjFxWkCcLorFc:DMfbvUCrFnjj+dC3
- TLSH T15514292D769910B5E4699138C5830B49E2B2F834272263CF17E4837D9F77BE8B939B41
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7616
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
oleprn.pdb
api-ms-win-crt-string-l1-1-0
memset
wcscspn
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsnicmp
memmove
_o__wtol
_o_free
_o_iswalnum
_o_iswdigit
_o_iswxdigit
_o_malloc
_o_realloc
_o_towlower
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
wcschr
wcsrchr
__C_specific_handler
_local_unwind
memcmp
memcpy
atl
ord32
ord27
ord26
ord23
ord16
ord21
ord15
ord18
ord22
ord31
ord30
ord25
ntdll
NtOpenThreadToken
RtlNtStatusToDosError
NtSetInformationThread
NtClose
WinSqmIncrementDWORD
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
kernel32
WaitForThreadpoolTimerCallbacks
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
ReleaseSRWLockShared
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
GetProcessHeap
DecodePointer
HeapAlloc
EncodePointer
LoadLibraryExA
VirtualFree
HeapFree
CreateFileW
GetTempPath2W
WriteFile
GetExitCodeProcess
WaitForSingleObject
InitializeCriticalSectionEx
DeleteFileW
GlobalFree
LoadLibraryExW
FreeLibrary
GetSystemDefaultLocaleName
CreateSemaphoreExW
GetWindowsDirectoryW
FormatMessageW
CompareStringOrdinal
lstrcmpW
SetLastError
GetComputerNameW
GetVersionExW
LocalAlloc
DisableThreadLibraryCalls
DeleteCriticalSection
InitializeCriticalSection
LocalFree
GlobalUnlock
GlobalLock
GlobalAlloc
CloseHandle
GetCurrentProcess
GetProcAddress
lstrcmpiW
GetModuleHandleW
GetLastError
GetCurrentThreadId
RaiseException
DebugBreak
LeaveCriticalSection
EnterCriticalSection
GetSystemInfo
VirtualQuery
VirtualAlloc
VirtualProtect
WideCharToMultiByte
MultiByteToWideChar
CreateThreadpoolTimer
GetModuleFileNameA
InitOnceBeginInitialize
GetModuleHandleExW
InitOnceComplete
ReleaseSemaphore
OpenSemaphoreW
ReleaseMutex
CreateMutexExW
CloseThreadpoolTimer
GetFileAttributesW
CreateThread
SetUnhandledExceptionFilter
OutputDebugStringW
SetThreadpoolTimer
advapi32
EventSetInformation
EventUnregister
RegCloseKey
EventWriteTransfer
EventRegister
RegOpenKeyExW
RegQueryValueExW
RegOpenKeyW
TraceMessage
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
user32
GetClassInfoExW
GetParent
SetFocus
ShowWindow
IsWindow
DestroyWindow
IntersectRect
EqualRect
MessageBoxW
GetDesktopWindow
GetLastActivePopup
GetForegroundWindow
PeekMessageW
GetWindowLongPtrW
RegisterClassW
GetClassInfoW
PtInRect
UnionRect
DefWindowProcW
CreateWindowExW
CallWindowProcW
SetWindowLongPtrW
RegisterClassExW
wsprintfW
LoadCursorW
LoadStringW
SendMessageW
GetWindow
EndPaint
GetClientRect
BeginPaint
InvalidateRect
SetWindowPos
SetWindowRgn
OffsetRect
winspool.drv
GetPrinterDataW
GetPrinterDriverW
GetPrinterW
EnumJobsW
ord204
ord203
ConfigurePortW
AddPrinterConnectionW
DeviceCapabilitiesW
EnumPortsW
GetPrinterDataExW
XcvDataW
OpenPrinterW
ClosePrinter
wininet
InternetOpenUrlW
HttpQueryInfoW
InternetErrorDlg
InternetReadFile
InternetCloseHandle
InternetCanonicalizeUrlW
InternetOpenW
gdi32
SetWindowOrgEx
SetWindowExtEx
RestoreDC
CloseMetaFile
SaveDC
GetDeviceCaps
LPtoDP
SetMapMode
CreateMetaFileW
CreateRectRgnIndirect
SetViewportOrgEx
DeleteMetaFile
DeleteDC
shell32
ShellExecuteExW
ole32
CoCreateInstance
StringFromCLSID
CoTaskMemFree
CreateOleAdviseHolder
CreateDataAdviseHolder
OleRegGetMiscStatus
OleRegGetUserType
OleRegEnumVerbs
CoCreateGuid
oleaut32
SafeArrayPutElement
SafeArrayRedim
SafeArrayDestroy
SafeArrayCreate
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
OleCreatePropertyFrame
SetErrorInfo
LoadRegTypeLi
VariantChangeType
VariantInit
VariantClear
SysAllocString
SysAllocStringLen
SysFreeString
SafeArrayGetElement
clusapi
GetNodeClusterState
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
112KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
20KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=24, id=257, version=33145,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1371, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=20, id=260, version=33145,
count=5, id=259, version=33145,
count=22, id=261, version=33145,
count=1, id=256, version=33145,
count=18, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
omadmapi.dll
- IMPHASH f800216a2780a68b15fa6994b6cbf72d
- SHA256 dbdf3ffb573aa76544822c75da4656c79451da7bef1a4da48f961c820e1a2bdf
- MD5 719e1b91c0e5fb3681b6d92b2eaae2d4
- SHA1 9cb60aee0df5295728a55301a9cad92e673dcb50
- SHA512 aa1fc5c83beee1d41d65fd6c0b0976e57ce11dd5d9a0b0e8a1f8201b8780abea0eaea63bcc9427fac9df28738c611e547425ff3b0f880d14b35214d31bb19327
- SSDEEP 6144:9tAH5cxvUNpyMkPMwvrySk/tSaxyAJ6Y8fO:9twaxvaOUwvrTayAAW
- TLSH T1C534061E33FA1495F8B7823889568255E6B374762321A6EF02D0C27D9F27BD87A34F11
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
1c:0f:aa:a9:4e:45:c1:aa:fb:3b:af:32:4b:0b:f0:7b:3e:3c:94:ef:67:d9:18:c2:cc:7f:4a:78:81:e6:85:66
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:4C1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:18:25:d9:92:05:e2:e7:e5:e4:00:01:00:00:02:18
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
7616
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
omadmapi.pdb
msvcp110_win
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Winerror_map@std@@YAPEBDH@Z
?_Syserror_map@std@@YAPEBDH@Z
msvcrt
memmove
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
__C_specific_handler
_initterm
free
_amsg_exit
_XcptFilter
_callnewh
malloc
wcstod
_purecall
_wcsupr_s
_ultow_s
towlower
memmove_s
??_V@YAXPEAX@Z
wcsrchr
wcschr
memcpy
memset
memcmp
_CxxThrowException
strncpy_s
_set_errno
_errno
strtol
strchr
strrchr
sprintf_s
_wcsicmp
wcstoul
iswspace
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
??3@YAXPEAX@Z
memcpy_s
_vsnwprintf
__CxxFrameHandler4
__CxxFrameHandler3
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
DisableThreadLibraryCalls
GetModuleHandleW
GetProcAddress
GetModuleFileNameW
LoadLibraryExA
GetModuleHandleExW
GetModuleFileNameA
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
OutputDebugStringA
IsDebuggerPresent
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventUnregister
EventRegister
EventSetInformation
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
RaiseException
GetLastError
api-ms-win-core-registry-l1-1-0
RegDeleteValueW
RegCreateKeyExW
RegGetValueW
RegDeleteTreeW
RegCloseKey
RegQueryInfoKeyW
RegOpenKeyExW
RegNotifyChangeKeyValue
RegEnumKeyExW
RegSetValueExW
RegQueryValueExW
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockShared
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
DeleteCriticalSection
EnterCriticalSection
WaitForSingleObjectEx
AcquireSRWLockExclusive
AcquireSRWLockShared
LeaveCriticalSection
ResetEvent
CreateEventW
CreateSemaphoreExW
OpenSemaphoreW
SetEvent
CreateMutexExW
WaitForSingleObject
CreateMutexW
ReleaseMutex
ReleaseSemaphore
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-com-l1-1-0
CLSIDFromString
StringFromGUID2
CoCreateGuid
CoCreateInstance
CoUninitialize
CoInitializeEx
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
api-ms-win-security-base-l1-1-0
IsWellKnownSid
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
api-ms-win-core-synch-l1-2-0
Sleep
SleepConditionVariableSRW
WakeAllConditionVariable
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
ntdll
RtlIsStateSeparationEnabled
RtlGetDeviceFamilyInfoEnum
RtlCaptureStackBackTrace
api-ms-win-core-memory-l1-1-0
VirtualQuery
VirtualProtect
AcquireConfigRefreshMutex
AcquireOmaDmClientMutex
Base64StringToHexString
CalcHash
DmCreateSecurityAccount
DmGetHighestTemplateGroup
DmSecGroupSIDToRole
DmSecRoleToGroupSID
DmSecurityAccountInGroup
DmSecurityRoleFromAccountName
FindEndOfHeader
FindHeaderValue
FreeCommandLineOptions
GetStructFromRegistry
HashCert
HexStringToBase64String
IsConfigRefreshSemaphoreSignaled
MdmSendAlert
OmaDmAbortSession
OmaDmAbortSession_Impl
OmaDmCalcTriggerDigest
OmaDmClearAcctInfo
OmaDmClearAcctInfoValues
OmaDmCloseSession
OmaDmCloseSession_Impl
OmaDmCreateInternalAcctID
OmaDmCreateSecurityAccount
OmaDmCreateSessionPolicy
OmaDmDeleteAcctInfo
OmaDmDeleteAcctInfoWaitForCompletion
OmaDmDeleteAcctInfo_Impl
OmaDmDeleteSecurityAccount
OmaDmDeleteSessionPolicy
OmaDmDeleteUserInfo
OmaDmEnumerateAccounts
OmaDmEnumerateInitiationInfo
OmaDmEnumerateSessions
OmaDmFindAppAuthIndex
OmaDmFreeAcctInfo
OmaDmFreeAlertInfo
OmaDmFreeInitiationInfo
OmaDmFreeUserInfo
OmaDmGetAcctIDFromAcctUID
OmaDmGetAcctInfo
OmaDmGetAcctInfoFromKey
OmaDmGetAcctMemberInfo
OmaDmGetAllAcctInfo
OmaDmGetDefaultAcctUID
OmaDmGetFirstMatchingAccountID
OmaDmGetInitiationInfo
OmaDmGetInternalAcctID
OmaDmGetInternalAcctSID
OmaDmGetNextSessionIDToUse
OmaDmGetUserInfo
OmaDmGetValueFromStruct
OmaDmInitiateSession
OmaDmInitiateSessionAsDevice
OmaDmInitiateSessionAsUser
OmaDmInitiateSessionEx
OmaDmInitiateSessionFullSync
OmaDmInitiateSessionWithSessionID
OmaDmInitiateSession_Impl
OmaDmIsInformativeServerSessionActive
OmaDmIsNodePresent
OmaDmIsNodeValuePresent
OmaDmSaveAcctInfoToKey
OmaDmSendAlertNotification
OmaDmSendAlertNotification3
OmaDmSendAlertNotificationEx
OmaDmSetAcctInfo
OmaDmSetAcctInfoAllowed_Impl
OmaDmSetAcctInfoEx
OmaDmSetAcctInfo_Impl
OmaDmSetInitiationInfo
OmaDmSetNodePresence
OmaDmSetNodeValuePresence
OmaDmSetUserInfo
OmaDmSetUserInfoNodeValuePresence
OmaDmSetUserInfoValueInStruct
OmaDmSetValueInStruct
OmaDmUnsetNodePresence
OmaDmValidateSslCertCriteria
OmaDmWaitForAllSessionsCompletion
ProcessCommandLine
ProcessCommandLineOption
ReadBSTRFromStream
ReadStringFromStream
ReadVariantFromStream
ReleaseConfigRefreshMutex
ReleaseOmaDmClientMutex
SaveStructInRegistry
SyncDmGroupMembershipToPolicy
Trim
TruncateTextToLength
URIEncodeSegment
ValidateStringAsFloat
WriteBSTRToStream
WriteStringToStream
WriteVariantToStream
Name
.text
Size
140KB
Virtual Size
136KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
680B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
776B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=44, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=15, id=260, version=33145,
count=229, id=1, productName=Unmarked objects,
count=7, id=257, version=33145,
count=13, id=261, version=33145,
count=1, id=256, version=33145,
count=24, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,