wlanmsm.zip
- SHA256 26783f1e8adddeba9ca489e9686a7b1b5f2cd5b134efbaa96fb935a81863174e
Overview
overview
7Static
static
3WINSRPC.dll
windows10-2004-x64
1WinHvEmulation.dll
windows10-2004-x64
1WinHvPlatform.dll
windows10-2004-x64
1WinMsoIrmP...or.dll
windows10-2004-x64
1WinOpcIrmP...or.dll
windows10-2004-x64
1WinREAgent.dll
windows10-2004-x64
1WinRtTracing.dll
windows10-2004-x64
1WinSATAPI.dll
windows10-2004-x64
7WinSCard.dll
windows10-2004-x64
1WinSync.dll
windows10-2004-x64
1WinSyncMetastore.dll
windows10-2004-x64
1WinSyncProviders.dll
windows10-2004-x64
7WinTypes.dll
windows10-2004-x64
1WinUICohabitation.dll
windows10-2004-x64
1Windows.UI.Logon.dll
windows10-2004-x64
1Windows.UI...er.dll
windows10-2004-x64
1Windows.UI...rd.dll
windows10-2004-x64
1Windows.UI.Search.dll
windows10-2004-x64
1Windows.UI...ds.dll
windows10-2004-x64
1Windows.UI.Shell.dll
windows10-2004-x64
1Windows.UI...ge.dll
windows10-2004-x64
1Windows.UI...ls.dll
windows10-2004-x64
1Windows.UI...ls.dll
windows10-2004-x64
1Windows.UI...ps.dll
windows10-2004-x64
1Windows.UI...ne.dll
windows10-2004-x64
1Windows.UI...h1.dll
windows10-2004-x64
1Windows.UI...h1.dll
windows10-2004-x64
1Windows.UI...on.dll
windows10-2004-x64
1Windows.UI...s1.dll
windows10-2004-x64
1Windows.UI...s2.dll
windows10-2004-x64
1Windows.UI...s3.dll
windows10-2004-x64
1Windows.UI...s4.dll
windows10-2004-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
WINSRPC.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
WinHvEmulation.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
WinHvPlatform.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
WinMsoIrmProtector.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
WinOpcIrmProtector.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
WinREAgent.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
WinRtTracing.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
WinSATAPI.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
WinSCard.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
WinSync.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
WinSyncMetastore.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
WinSyncProviders.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
WinTypes.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
WinUICohabitation.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
Windows.UI.Logon.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
Windows.UI.NetworkUXController.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
Windows.UI.PicturePassword.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
Windows.UI.Search.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
Windows.UI.Shell.Internal.AdaptiveCards.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
Windows.UI.Shell.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
Windows.UI.Storage.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
Windows.UI.Xaml.Controls.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
Windows.UI.Xaml.InkControls.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
Windows.UI.Xaml.Maps.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
Windows.UI.Xaml.Phone.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
Windows.UI.Xaml.Resources.19h1.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
Windows.UI.Xaml.Resources.21h1.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
Windows.UI.Xaml.Resources.Common.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
Windows.UI.Xaml.Resources.rs1.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
Windows.UI.Xaml.Resources.rs2.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
Windows.UI.Xaml.Resources.rs3.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
Windows.UI.Xaml.Resources.rs4.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target wlanmsm.zip
- Size 28.2MB
- Sample260812-gn2d9azeld
- SHA256 26783f1e8adddeba9ca489e9686a7b1b5f2cd5b134efbaa96fb935a81863174e
- MD5 110ee766ab8d7ddb8ddd8ab5a3fb127e
- SHA1 0e24af41626695b4570669565a6d1da706cd9626
- SHA512 79f463fa2e9e6666d8d927e52a893cdc4c5e008ced91adc64dde9d7062c908ebd7d4d6c3423ff82ea9a3ea4bcf4183c0381ace913c912446be3fde142afd5948
- SSDEEP 786432:DVZGQjDbJ9txhVaeg2WTTleEQ7Qm0pAOVNKLD:DV/btDvSMEQ8RpQ3
- TLSH T1045733B290C42887644F83706EFF7B5164BF21DEE9C6249ACE4693B37556701E62E30D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 82 IoCs
Checks for missing Authenticode signature.
resource unpack001/WINSRPC.DLL unpack001/WinHvEmulation.dll unpack001/WinHvPlatform.dll unpack001/WinMsoIrmProtector.dll unpack001/WinOpcIrmProtector.dll unpack001/WinRtTracing.dll unpack001/WinSATAPI.dll unpack001/WinSCard.dll unpack001/WinSync.dll unpack001/WinSyncMetastore.dll unpack001/WinSyncProviders.dll unpack001/WinUICohabitation.dll unpack001/Windows.UI.Logon.dll unpack001/Windows.UI.NetworkUXController.dll unpack001/Windows.UI.PicturePassword.dll unpack001/Windows.UI.Search.dll unpack001/Windows.UI.Shell.Internal.AdaptiveCards.dll unpack001/Windows.UI.Shell.dll unpack001/Windows.UI.Storage.dll unpack001/Windows.UI.Xaml.Controls.dll unpack001/Windows.UI.Xaml.InkControls.dll unpack001/Windows.UI.Xaml.Maps.dll unpack001/Windows.UI.Xaml.Phone.dll unpack001/Windows.UI.Xaml.Resources.19h1.dll unpack001/Windows.UI.Xaml.Resources.21h1.dll unpack001/Windows.UI.Xaml.Resources.Common.dll unpack001/Windows.UI.Xaml.Resources.rs1.dll unpack001/Windows.UI.Xaml.Resources.rs2.dll unpack001/Windows.UI.Xaml.Resources.rs3.dll unpack001/Windows.UI.Xaml.Resources.rs4.dll unpack001/Windows.UI.Xaml.Resources.rs5.dll unpack001/Windows.UI.Xaml.Resources.th.dll unpack001/Windows.UI.Xaml.Resources.win81.dll unpack001/Windows.UI.Xaml.Resources.win8rtm.dll unpack001/Windows.UI.Xaml.dll unpack001/Windows.UI.XamlHost.dll unpack001/Windows.WARP.JITService.dll unpack001/Windows.Web.Diagnostics.dll unpack001/Windows.Web.Http.dll unpack001/Windows.Web.dll unpack001/WindowsBackupAndRestoreCSP.dll unpack001/WindowsCodecsExt.dll unpack001/WindowsDefaultHeatProcessor.dll unpack001/WindowsInternal.ComposableShell.Display.dll unpack001/WindowsInternal.Shell.CompUiActivation.dll unpack001/WindowsProtectedPrintConfiguration.dll unpack001/Winlangdb.dll unpack001/WiredNetworkCSP.dll unpack001/WirelessNetworkPreferenceCSP.dll unpack001/WlanMediaManager.dll unpack001/windowslivelogin.dll unpack001/windowsperformancerecordercontrol.dll unpack001/windowsudk.shellcommon.dll unpack001/windowsudkservices.shellcommon.dll unpack001/winethc.dll unpack001/winhttpcom.dll unpack001/wini3c.dll unpack001/winipcfile.dll unpack001/winipcsecproc.dll unpack001/winipsec.dll unpack001/winlogonext.dll unpack001/winml.dll unpack001/winmsipc.dll unpack001/winnlsres.dll unpack001/winrscmd.dll unpack001/winrsmgr.dll unpack001/winrssrv.dll unpack001/winshfhc.dll unpack001/winsku.dll unpack001/winsrv.dll unpack001/winsrvext.dll unpack001/winusb.dll unpack001/wisp.dll unpack001/witnesswmiv2provider.dll unpack001/wkspbrokerAx.dll unpack001/wksprtPS.dll unpack001/wkssvc.dll unpack001/wlancfg.dll unpack001/wlandlg.dll unpack001/wlangpui.dll unpack001/wlanhlp.dll unpack001/wlanmsm.dll
File Explorer
-
wlanmsm.zip.zip 28.2MB
-
WINSRPC.DLL.dll 52KB
-
WinHvEmulation.dll.dll 160KB
-
WinHvPlatform.dll.dll 384KB
-
WinMsoIrmProtector.dll.dll 112KB
-
WinOpcIrmProtector.dll.dll 104KB
-
WinREAgent.dll.dll 817KB
-
WinRtTracing.dll.dll 208KB
-
WinSATAPI.dll.dll 408KB
-
WinSCard.dll.dll 316KB
-
WinSync.dll.dll 736KB
-
WinSyncMetastore.dll.dll 244KB
-
WinSyncProviders.dll.dll 156KB
-
WinTypes.dll.dll 1.4MB
-
WinUICohabitation.dll.dll 132KB
-
Windows.UI.Logon.dll.dll 4.1MB
-
Windows.UI.NetworkUXController.dll.dll 92KB
-
Windows.UI.PicturePassword.dll.dll 436KB
-
Windows.UI.Search.dll.dll 748KB
-
Windows.UI.Shell.Internal.AdaptiveCards.dll.dll 1.3MB
-
Windows.UI.Shell.dll.dll 72KB
-
Windows.UI.Storage.dll.dll 304KB
-
Windows.UI.Xaml.Controls.dll.dll 3.1MB
-
Windows.UI.Xaml.InkControls.dll.dll 816KB
-
Windows.UI.Xaml.Maps.dll.dll 1.2MB
-
Windows.UI.Xaml.Phone.dll.dll 1.2MB
-
Windows.UI.Xaml.Resources.19h1.dll.dll 696KB
-
Windows.UI.Xaml.Resources.21h1.dll.dll 696KB
-
Windows.UI.Xaml.Resources.Common.dll.dll 52KB
-
Windows.UI.Xaml.Resources.rs1.dll.dll 452KB
-
Windows.UI.Xaml.Resources.rs2.dll.dll 504KB
-
Windows.UI.Xaml.Resources.rs3.dll.dll 612KB
-
Windows.UI.Xaml.Resources.rs4.dll.dll 636KB
-
Windows.UI.Xaml.Resources.rs5.dll.dll 692KB
-
Windows.UI.Xaml.Resources.th.dll.dll 300KB
-
Windows.UI.Xaml.Resources.win81.dll.dll 244KB
-
Windows.UI.Xaml.Resources.win8rtm.dll.dll 148KB
-
Windows.UI.Xaml.dll.dll 17.0MB
-
Windows.UI.XamlHost.dll.dll 316KB
-
Windows.WARP.JITService.dll.dll 88KB
-
Windows.Web.Diagnostics.dll.dll 212KB
-
Windows.Web.Http.dll.dll 1.3MB
-
Windows.Web.dll.dll 660KB
-
WindowsBackupAndRestoreCSP.dll.dll 88KB
-
WindowsCodecs.dll.dll 2.2MB
-
WindowsCodecsExt.dll.dll 308KB
-
WindowsDefaultHeatProcessor.dll.dll 152KB
-
WindowsInternal.ComposableShell.Display.dll.dll 804KB
-
WindowsInternal.Shell.CompUiActivation.dll.dll 100KB
-
WindowsManagementServiceWinRt.ProxyStub.dll.dll 166KB
-
WindowsProtectedPrintConfiguration.dll.dll 100KB
-
Winlangdb.dll.dll 208KB
-
WiredNetworkCSP.dll.dll 104KB
-
WirelessNetworkPreferenceCSP.dll.dll 212KB
-
WlanMediaManager.dll.dll 812KB
-
windowslivelogin.dll.dll 300KB
-
windowsperformancerecordercontrol.dll.dll 1.2MB
-
windowsudk.shellcommon.dll.dll 6.6MB
-
windowsudkservices.shellcommon.dll.dll 128KB
-
winethc.dll.dll 124KB
-
winhttp.dll.dll 1.2MB
-
winhttpcom.dll.dll 132KB
-
wini3c.dll.dll 192KB
-
wininet.dll.dll 2.6MB
-
wininetlui.dll.dll 138KB
-
wininitext.dll.dll 97KB
-
winipcfile.dll.dll 500KB
-
winipcsecproc.dll.dll 900KB
-
winipsec.dll.dll 120KB
-
winlogonext.dll.dll 140KB
-
winmde.dll.dll 2.1MB
-
winml.dll.dll 64KB
-
winmm.dll.dll 219KB
-
winmmbase.dll.dll 227KB
-
winmsipc.dll.dll 2.1MB
-
winnlsres.dll.dll 28KB
-
winnsi.dll.dll 66KB
-
winrnr.dll.dll 86KB
-
winrscmd.dll.dll 140KB
-
winrsmgr.dll.dll 12KB
-
winrssrv.dll.dll 36KB
-
winshfhc.dll.dll 44KB
-
winsku.dll.dll 396KB
-
winsqlite3.dll.dll 1.1MB
-
winsrv.dll.dll 88KB
-
winsrvext.dll.dll 136KB
-
winsta.dll.dll 392KB
-
wintrust.dll.dll 534KB
-
winusb.dll.dll 52KB
-
wisp.dll.dll 308KB
-
witnesswmiv2provider.dll.dll 60KB
-
wkscli.dll.dll 118KB
-
wkspbrokerAx.dll.dll 152KB
-
wksprtPS.dll.dll 56KB
-
wkssvc.dll.dll 384KB
-
wlanapi.dll.dll 578KB
-
wlancfg.dll.dll 376KB
-
wlandlg.dll.dll 220KB
-
wlangpui.dll.dll 436KB
-
wlanhlp.dll.dll 24KB
-
wlanmsm.dll.dll 520KB
WINSRPC.DLL
- IMPHASH 3f614f0b53fb9b7727cd3f457a6b254d
- SHA256 fd5073cbe1588ceeb399c0bce3a3a31e07c97e69e24bc541d031ad1b58189d21
- MD5 8ca0d13af0def2903ac2435d1acfac7a
- SHA1 0fd80db69b0dbe7732b9958365b936933c40be33
- SHA512 743816fb651d823524a5ec19581861e572373aa6b629dc31dec9e02d111bb43d709efbc33ca87ef20f8a9238e848d31bea58c142869b5f58e3f54e28e37a877c
- SSDEEP 384:yrrLpIaR/xCR2B4fOdad4JHTsDAMmdQG1kUWDLWo:gGaR42BIcadOHT/rdHkRr
- TLSH T16933D60DE31464EEF4BA867CC52B0E267626F465030257DF05A0822DBE337D86B76E93
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4752
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
winsrpc.pdb
msvcrt
_amsg_exit
malloc
strcat_s
strcpy_s
_initterm
free
_XcptFilter
__C_specific_handler
memset
advapi32
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
kernel32
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetCurrentProcess
TerminateProcess
GetTickCount
GetProcAddress
LocalAlloc
MultiByteToWideChar
LocalFree
lstrcmpW
FindFirstFileA
ExpandEnvironmentStringsW
FindNextFileA
FindClose
GetLastError
DeleteFileA
LoadLibraryW
Sleep
RemoveDirectoryA
GetModuleHandleW
FreeLibrary
WideCharToMultiByte
CreateDirectoryA
rpcrt4
RpcStringBindingComposeW
RpcBindingSetAuthInfoW
RpcBindingFromStringBindingW
NdrClientCall3
I_RpcExceptionFilter
RpcBindingFree
RpcStringFreeW
WinsABind
WinsAllocMem
WinsBackup
WinsCheckAccess
WinsDelDbRecs
WinsDeleteWins
WinsDoScavenging
WinsDoScavengingNew
WinsDoStaticInit
WinsFreeMem
WinsGetBrowserNames
WinsGetDbRecs
WinsGetDbRecsByName
WinsGetNameAndAdd
WinsPullRange
WinsRecordAction
WinsResetCounters
WinsRestore
WinsRestoreEx
WinsSetFlags
WinsSetPriorityClass
WinsStatus
WinsStatusNew
WinsStatusWHdl
WinsSyncUp
WinsTerm
WinsTombstoneDbRecs
WinsTrigger
WinsUBind
WinsUnbind
WinsWorkerThdUpd
Name
.text
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
732B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
472B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=4, id=259, version=33136,
count=15, id=260, version=33136,
count=53, id=1, productName=Unmarked objects,
count=9, id=257, version=33136,
count=1, id=256, version=33136,
count=5, id=264, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
WinHvEmulation.dll
- IMPHASH e67e99ecd118ce001b54b8631781d6ac
- SHA256 5ab75822abe149416534555c28c6bd449b9e29821a1a6b7119bac482124132e5
- MD5 b2f080d32919590f3e402d3213ff7a0e
- SHA1 443c893e1d7780c0a527982449993a8f1f862c9e
- SHA512 2245a6531132f194f2d8e67681e10ebaf3d90bfb725a8f48fcc76876ace02e0c6f92f6ed94f1e733099b6e056571ebcfd48476afad7b7dc22cea8f1136e4ac4d
- SSDEEP 3072:E7U9CWbjwsgZlkW8GqZ90dTE0rMWwE31I:XCWbjwsElXqs/MWwE
- TLSH T147F3091972BA00B7D4BB923D8A834A1AF6F2BC54575157DB029062BD1F33BF8693C315
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7360
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WinHvEmulation.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o_malloc
_o_terminate
__C_specific_handler
__CxxFrameHandler3
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_CxxThrowException
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetModuleHandleExW
GetProcAddress
GetModuleHandleW
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
CreateMutexExW
ReleaseSemaphore
ReleaseSRWLockShared
DeleteCriticalSection
EnterCriticalSection
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockShared
LeaveCriticalSection
CreateSemaphoreExW
InitializeCriticalSectionEx
WaitForSingleObject
ReleaseMutex
ReleaseSRWLockExclusive
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventRegister
EventWriteTransfer
EventUnregister
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
WHvEmulatorCreateEmulator
WHvEmulatorDestroyEmulator
WHvEmulatorTryIoEmulation
WHvEmulatorTryMmioEmulation
Name
.text
Size
108KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
344B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=41, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1129, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=22, id=261, version=33145,
count=1, id=256, version=33145,
count=9, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WinHvPlatform.dll
- IMPHASH 95f5196eb7f845c0cd9c4215fd8b19d9
- SHA256 2648baafc6c6c24cd5401efd59a5ea21fdbd5255f0fd4f7f96c2a4a116b121cc
- MD5 8b54f94c60d053eab6c78dd5b9aa78d4
- SHA1 09c176feefa6a213decb35d7ebc1d44eb2a46487
- SHA512 89a7fa78cedec234c9f5553e3ca40cfa21e83fc0159ece31d20725566f1747a663cbb0f77e7023320be19fa50bd8d7bad2e427e98be397439579e4fc6a00911c
- SSDEEP 6144:RWA85l2F/ivIZKm/tIIhh/GUTKlkgXMzhnEgUhTHKhbg:d8kivIViIh5/KBWhnQhM
- TLSH T153844C2EF66C10F8E07AD078CD678916E6B23869037166CF21E0816D6B37FE8653DB51
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
8288
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WinHvPlatform.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsnicmp
_o_abort
_o_ceilf
_o_free
_o_malloc
_o_terminate
_o_wcstod
_o_wcstoull
__current_exception
__current_exception_context
_CxxThrowException
_o__cexit
_o__callnewh
_o__configure_narrow_argv
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__C_specific_handler
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
ntdll
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
NtPowerInformation
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA
api-ms-win-core-synch-l1-1-0
CreateMutexExW
ReleaseSRWLockExclusive
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
OpenSemaphoreW
WaitForSingleObjectEx
LeaveCriticalSection
CreateEventW
ReleaseSRWLockShared
ReleaseMutex
AcquireSRWLockShared
WaitForSingleObject
DeleteCriticalSection
ReleaseSemaphore
ResetEvent
CreateEventExW
CreateSemaphoreExW
TryAcquireSRWLockExclusive
SetEvent
AcquireSRWLockExclusive
InitializeCriticalSectionEx
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThread
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-memory-l1-1-0
VirtualProtect
api-ms-win-core-synch-l1-2-0
InitOnceComplete
WaitOnAddress
WakeByAddressAll
InitOnceBeginInitialize
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventUnregister
EventRegister
EventWriteTransfer
api-ms-win-core-io-l1-1-0
DeviceIoControl
GetOverlappedResult
CancelIoEx
api-ms-win-core-systemtopology-l1-1-0
GetNumaHighestNodeNumber
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-file-l1-1-0
CreateFileW
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
GetThreadIdealProcessorEx
api-ms-win-core-kernel32-legacy-l1-1-1
GetNumaProcessorNodeEx
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
devobj
DevObjEnumDeviceInfo
DevObjEnumDeviceInterfaces
DevObjDestroyDeviceInfoList
DevObjGetClassDevs
DevObjCreateDeviceInfoList
DevObjGetDeviceProperty
DevObjGetDeviceInterfaceDetail
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
WHvAcceptPartitionMigration
WHvAdviseGpaRange
WHvAllocateVpciResource
WHvCancelPartitionMigration
WHvCancelRunVirtualProcessor
WHvCompletePartitionMigration
WHvCreateNotificationPort
WHvCreatePartition
WHvCreateTrigger
WHvCreateVirtualProcessor
WHvCreateVirtualProcessor2
WHvCreateVpciDevice
WHvDeleteNotificationPort
WHvDeletePartition
WHvDeleteTrigger
WHvDeleteVirtualProcessor
WHvDeleteVpciDevice
WHvGetCapability
WHvGetInterruptTargetVpSet
WHvGetPartitionCounters
WHvGetPartitionProperty
WHvGetVirtualProcessorCounters
WHvGetVirtualProcessorCpuidOutput
WHvGetVirtualProcessorInterruptControllerState
WHvGetVirtualProcessorInterruptControllerState2
WHvGetVirtualProcessorRegisters
WHvGetVirtualProcessorState
WHvGetVirtualProcessorXsaveState
WHvGetVpciDeviceInterruptTarget
WHvGetVpciDeviceNotification
WHvGetVpciDeviceProperty
WHvMapGpaRange
WHvMapGpaRange2
WHvMapVpciDeviceInterrupt
WHvMapVpciDeviceMmioRanges
WHvPostVirtualProcessorSynicMessage
WHvQueryGpaRangeDirtyBitmap
WHvReadGpaRange
WHvReadVpciDeviceRegister
WHvRegisterPartitionDoorbellEvent
WHvRequestInterrupt
WHvRequestVpciDeviceInterrupt
WHvResetPartition
WHvResumePartitionTime
WHvRetargetVpciDeviceInterrupt
WHvRunVirtualProcessor
WHvSetNotificationPortProperty
WHvSetPartitionProperty
WHvSetVirtualProcessorInterruptControllerState
WHvSetVirtualProcessorInterruptControllerState2
WHvSetVirtualProcessorRegisters
WHvSetVirtualProcessorState
WHvSetVirtualProcessorXsaveState
WHvSetVpciDevicePowerState
WHvSetupPartition
WHvSignalVirtualProcessorSynicEvent
WHvStartPartitionMigration
WHvSuspendPartitionTime
WHvTranslateGva
WHvUnmapGpaRange
WHvUnmapVpciDeviceInterrupt
WHvUnmapVpciDeviceMmioRanges
WHvUnregisterPartitionDoorbellEvent
WHvUpdateTriggerParameters
WHvWriteGpaRange
WHvWriteVpciDeviceRegister
Name
.text
Size
276KB
Virtual Size
272KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.mrdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=33145,
count=59, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1198, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=27, id=261, version=33145,
count=8, id=259, version=33145,
count=1, id=256, version=33145,
count=37, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WinMsoIrmProtector.dll
- IMPHASH 559e63ac34a9eafd4224cf4218de8178
- SHA256 e113140539edf514ac15c18042d47693e9183937966a097de6b73305a753c0df
- MD5 3d93ba7c661f459eccad128f189bfa50
- SHA1 ef20b760c51b675f0225e509464e9d9f25394e1d
- SHA512 49f14fa2e760551d8c49729fdd0ea9b78198f4840d4204d50ca9467070540d8e71a4ccc56274ce0c7d48010657c9bf38c993393e549c67dc94397ceb4e6b3cd6
- SSDEEP 1536:OAkzdmqHQ+CfIIBT9U+QlvYktdm+fOzBUOHnhD6EhVH/HRAuG:OAyQ+CgIk+Qly+fOfHhDthh/H
- TLSH T1D5B33A4A77E8A0D5E16A923C89574E59E772F4212B2153EF2360936E0F73BC06F35B81
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7616
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WinMsoIrmProtector.pdb
msvcrt
?terminate@@YAXXZ
_callnewh
_initterm
_errno
realloc
_amsg_exit
_lock
??1type_info@@UEAA@XZ
_unlock
??0exception@@QEAA@AEBQEBD@Z
_XcptFilter
__dllonexit
memmove
wcscat_s
memcpy
__CxxFrameHandler3
_CxxThrowException
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??3@YAXPEAX@Z
wcscpy_s
memcpy_s
free
malloc
wcsncpy_s
__C_specific_handler
wcsncmp
_purecall
??_V@YAXPEAX@Z
__CxxFrameHandler4
_onexit
memset
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
CompareStringW
api-ms-win-core-registry-l1-1-0
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegCloseKey
RegQueryInfoKeyW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoCreateGuid
CoTaskMemRealloc
CoTaskMemFree
StringFromGUID2
CoTaskMemAlloc
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
LoadLibraryExW
LoadResource
GetProcAddress
SizeofResource
GetModuleHandleW
FindResourceExW
GetModuleFileNameW
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
RaiseException
api-ms-win-core-localization-l1-2-0
GetThreadLocale
SetThreadLocale
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
api-ms-win-core-sysinfo-l1-1-0
GetSystemDirectoryW
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-com-l2-1-1
StgOpenStorage
StgIsStorageILockBytes
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
44KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
64B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
976B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=46, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33138,
count=18, id=260, version=33138,
count=115, id=1, productName=Unmarked objects,
count=3, id=257, version=33138,
count=10, id=261, version=33138,
count=1, id=256, version=33138,
count=13, id=264, version=33138,
count=1, id=255, version=33138,
count=1, id=258, version=33138,
WinOpcIrmProtector.dll
- IMPHASH 3e7b6b58def060673d82fcd31b844311
- SHA256 907df0d3cb32faec8620e656156b8c6b17a72dd7cef39300303b7b55d27b76cf
- MD5 e104ce526e7d49c5cba35de5d1c2a1d5
- SHA1 64c6ebac01f8db8687cc9ec7358322ad03de7c2d
- SHA512 82b5c02ee9ba80c5736365b00da2b8f26033d9e54ca3e16b5c89bfdc695105e23fb7d36ff6cebe119280519a86b899acc0e0484ad666443faedb9704de570b12
- SSDEEP 1536:s1BqwHVpCz+iEi5hjPolgH4EY+6O+a1fghS6Cd9yaAuG:sTqwHHCOi5hjP0v+6OvdghSbq
- TLSH T18AA33A4A76D890D9E176923849578E45EB72F8213B1147EF2390937E0F73BC06E39B82
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7616
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WinOpcIrmProtector.pdb
msvcrt
?terminate@@YAXXZ
_callnewh
_initterm
_errno
realloc
_amsg_exit
_lock
_unlock
??0exception@@QEAA@AEBQEBD@Z
_XcptFilter
__dllonexit
memmove
??1type_info@@UEAA@XZ
wcscat_s
memcpy
__CxxFrameHandler3
_CxxThrowException
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
?what@exception@@UEBAPEBDXZ
??3@YAXPEAX@Z
??1exception@@UEAA@XZ
wcscpy_s
memcpy_s
free
malloc
wcsncpy_s
__C_specific_handler
wcsncmp
_purecall
??_V@YAXPEAX@Z
__CxxFrameHandler4
_onexit
memset
api-ms-win-core-string-l1-1-0
CompareStringW
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-registry-l1-1-0
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegCloseKey
RegQueryInfoKeyW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoCreateGuid
CoTaskMemRealloc
CoTaskMemFree
StringFromGUID2
CoTaskMemAlloc
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
LoadLibraryExW
LoadResource
GetProcAddress
SizeofResource
GetModuleHandleW
GetModuleFileNameW
FindResourceExW
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
RaiseException
api-ms-win-core-localization-l1-2-0
GetThreadLocale
SetThreadLocale
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-com-l2-1-1
StgIsStorageILockBytes
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
40KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
64B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=46, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=18, id=260, version=33145,
count=114, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=10, id=261, version=33145,
count=1, id=256, version=33145,
count=13, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WinREAgent.dll
- IMPHASH 389b7d09df35858f70b88288dd454ba3
- SHA256 fc815cbf95bb930ce09348ed339653d802a13d10a71f2b6909bc1059d739c4a1
- MD5 deb2070f2346b6d25e91f327419cc318
- SHA1 39cb2d8bbd22793baf3046980ccbbccc279a5048
- SHA512 524822fd68d8e23d95d6732952f89f3cf9fc36f1eb1850fa3bfae9ff849e692d023e2daa783093abbdc63a3360dee92200d3e3ddc6c854c2b7170c14cc1411ac
- SSDEEP 12288:57EQMej5MbrUEjc4ODNYoH68yuBoHUVKHSYBqphyntXngPNWpIO0r4F7JKddN:vM+5McEQ4ODKoH68yH+KHVwphqWNNOEN
- TLSH T17905F85927FC02A4F5F797389D734606F9B27C659770E9CF069140AE8E23BE09439B12
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
20:d5:e2:28:98:dc:7d:06:e9:ed:c8:03:af:ee:6f:0d:11:48:9a:be:f5:1b:f1:09:c1:83:75:f2:96:1f:09:2f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A000-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:2b:bb:00:50:ff:4d:3b:9a:a1:00:01:00:00:02:2b
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
13664
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WinREAgent.pdb
msvcrt
strchr
sprintf_s
_wcstoui64
wcstoul
wcsrchr
wcsncmp
_set_errno
strtol
??3@YAXPEAX@Z
_wtof
strncpy_s
qsort_s
__RTDynamicCast
memset
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
memmove
memcpy
__CxxFrameHandler3
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_callnewh
malloc
wcscpy_s
__C_specific_handler
calloc
vswprintf_s
_vscwprintf
free
wcscspn
wcsspn
??_V@YAXPEAX@Z
_purecall
_wcsicmp
memmove_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
memcpy_s
??1exception@@UEAA@XZ
_vsnwprintf
__CxxFrameHandler4
_stricmp
memcmp
wcschr
_wtoi64
_wtoi
_wtol
_errno
_wcsnicmp
wcscmp
advapi32
RevertToSelf
ImpersonateLoggedOnUser
RegQueryInfoKeyW
CredFree
CredReadW
RegDeleteKeyExW
RegLoadKeyW
RegUnLoadKeyW
RegEnumValueW
RegDeleteValueW
RegGetValueW
RegEnumKeyExW
RegDeleteTreeW
RegDeleteKeyW
RegSetKeySecurity
RegGetKeySecurity
SetFileSecurityW
GetAce
GetFileSecurityW
ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
EventWriteTransfer
EventRegister
EventUnregister
RegOpenKeyExW
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextW
CryptReleaseContext
EventSetInformation
OpenThreadToken
OpenProcessToken
AdjustTokenPrivileges
SetSecurityDescriptorGroup
MakeSelfRelativeSD
AddAccessAllowedAce
SetSecurityDescriptorControl
GetLengthSid
InitializeAcl
InitializeSecurityDescriptor
FreeSid
AllocateAndInitializeSid
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
LookupPrivilegeValueW
GetTokenInformation
CopySid
kernel32
HeapReAlloc
HeapDestroy
InitializeCriticalSection
RaiseException
FreeLibrary
GetEnvironmentVariableW
Sleep
QueryPerformanceCounter
GetSystemTimeAsFileTime
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
MultiByteToWideChar
GetVersionExW
CreateThreadpoolTimer
OpenSemaphoreW
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSectionEx
EnterCriticalSection
WaitForSingleObjectEx
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
GetSystemWindowsDirectoryW
GetTickCount
HeapSize
ReleaseMutex
ReleaseSemaphore
CloseHandle
SetLastError
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
OutputDebugStringW
IsDebuggerPresent
WideCharToMultiByte
GetLastError
DebugBreak
GetModuleFileNameA
FindResourceExW
LoadResource
LockResource
SizeofResource
LeaveCriticalSection
CreateSemaphoreExW
CreateMutexExW
GetCurrentProcessId
GetDiskFreeSpaceExW
LoadLibraryExW
HeapFree
GetProcAddress
GetModuleHandleW
HeapAlloc
GetProcessHeap
GetCurrentThreadId
FormatMessageW
GetModuleHandleExW
GetCurrentThread
DeleteFileW
GetFileInformationByHandleEx
FindFirstFileNameW
SetFileInformationByHandle
FindNextFileNameW
GetFullPathNameW
GetLongPathNameW
GetFinalPathNameByHandleW
GetModuleFileNameW
GetSystemInfo
OpenProcess
VirtualProtect
LoadLibraryExA
VirtualQuery
CompareStringW
SetEvent
CreateEventW
SetEnvironmentVariableW
GetFileAttributesW
SetFileAttributesW
GetWindowsDirectoryW
MoveFileTransactedW
CreateFileW
GetFileSizeEx
ReadFile
TlsAlloc
TlsGetValue
TlsSetValue
DeviceIoControl
GetVolumePathNameW
FindClose
FindFirstFileW
GetVolumeNameForVolumeMountPointW
GetFileInformationByHandle
GetVolumePathNamesForVolumeNameW
GetCurrentDirectoryW
FindNextFileW
CreateDirectoryW
MoveFileExW
CopyFile2
LocalFree
GetPrivateProfileSectionNamesW
GetPrivateProfileSectionW
WritePrivateProfileStringW
FlushFileBuffers
QueryDosDeviceW
VerSetConditionMask
VerifyVersionInfoW
GetSystemDirectoryW
GlobalFree
ExitProcess
WTSGetActiveConsoleSessionId
CreateMutexW
GetProductInfo
user32
UnregisterClassA
reagent
WinReInstallOnTargetOS
WinReGetConfig
WinReHashWimFile
WinReSetupBackupWinRE
oleaut32
SysFreeString
SysAllocString
dismapi
_DismCleanImage
DismGetPackages
DismGetPackageInfo
DismMountImage
DismUnmountImage
DismInitialize
DismOpenSession
DismShutdown
DismCloseSession
DismDelete
DismGetImageInfo
_DismAddPackageEx
servicingcommon
SfpUnload
SfpCreateOfflineRepairObject
CbsGetSsBinaryPathFromTargetImage
CbsOfflineFinalize
CbsCreateOfflineSession
StringsAreEqualCaseInsensitive
wtsapi32
WTSEnumerateSessionsW
WTSFreeMemory
WTSQueryUserToken
ole32
CoCreateGuid
CoCreateInstance
StringFromGUID2
CoGetMalloc
CoTaskMemFree
rpcrt4
UuidCreate
api-ms-win-core-version-l1-1-1
GetFileVersionInfoW
GetFileVersionInfoSizeW
api-ms-win-core-version-l1-1-0
GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeExW
crypt32
CertVerifyCertificateChainPolicy
winhttp
WinHttpOpen
WinHttpConnect
WinHttpCloseHandle
WinHttpQueryDataAvailable
WinHttpSetOption
WinHttpSetCredentials
WinHttpGetDefaultProxyConfiguration
WinHttpGetIEProxyConfigForCurrentUser
WinHttpOpenRequest
WinHttpQueryAuthSchemes
WinHttpReadData
WinHttpGetProxyForUrl
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
ktmw32
CreateTransaction
CommitTransaction
ntdll
NtSetInformationFile
RtlNtStatusToDosError
RtlSetThreadErrorMode
NtQueryInformationProcess
RtlAllocateHeap
RtlFreeHeap
RtlGetVersion
NtQueryInformationFile
wintrust
WTHelperGetProvSignerFromChain
WinVerifyTrust
WTHelperProvDataFromStateData
wdscore
WdsTerminate
WdsInitialize
CurrentIP
ConstructPartialMsgVW
WdsSetupLogMessageW
wimgapi
WIMGetAttributes
WIMUnregisterMessageCallback
WIMUnregisterLogFile
WIMCreateFile
WIMUnmountImage
WIMRegisterLogFile
WIMCloseHandle
WIMLoadImage
WIMRegisterMessageCallback
WIMSetTemporaryPath
WIMUnmountImageHandle
WIMApplyImage
WIMExportImage
bcrypt
BCryptCloseAlgorithmProvider
BackupWinRE
CreateWinREServicingManager
GetWinREAgentVersion
GetWinREVersion
LoadWinREServicingManager
RestoreWinRE
SaveWinREServicingManager
Name
.text
Size
492KB
Virtual Size
489KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
260KB
Virtual Size
257KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=21, id=260, version=33145,
count=464, id=1, productName=Unmarked objects,
count=35, id=257, version=33145,
count=14, id=261, version=33145,
count=1, id=256, version=33145,
count=126, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WinRtTracing.dll
- IMPHASH a1ac3383f75e3b64cf5190bbc711703b
- SHA256 d943603fe713c7c6572a18d954c811bbf48e034ddcc9d51ae30bb525233f763a
- MD5 0ff8d9ef2900312d168614b8ca0a7ff8
- SHA1 4618078f5000cb5025ee6d4ed333eda85f35a767
- SHA512 c33f81b04efcb60af02f269f0d40e170a181287eb4fe25ca1f2bd9bed61aaec0aa3846c3b1a100f12d5cc6382658dab8c2a1714e3c18ffe270a1144ee706c5b9
- SSDEEP 3072:HxGIQNqhRwyBX8CwQzunjmsmyONF/z9ZMwlQHj+0U5ZWac1Bml/ag:HAI6QyyBX8Azujmsmb90jRU5Tc1IZa
- TLSH T1C624F8276A6900A3E8799178C95B4B0AE372BC14079153CB0254537DDE3FBE8AF3B761
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
67376
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WinRtTracing.pdb
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-string-l1-1-0
memset
wcsnlen
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__configure_narrow_argv
_o__crt_atexit
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__cexit
memmove
_o_ceilf
_o_free
_o_malloc
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
__CxxFrameHandler3
_CxxThrowException
_o__callnewh
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
wcschr
__std_terminate
__CxxFrameHandler4
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
GetRestrictedErrorInfo
RoTransformError
SetRestrictedErrorInfo
RoOriginateErrorW
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-synch-l1-1-0
InitializeSRWLock
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
SleepConditionVariableSRW
WakeAllConditionVariable
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
RaiseException
GetLastError
UnhandledExceptionFilter
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsDuplicateString
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
HSTRING_UserFree
HSTRING_UserSize64
WindowsCreateString
WindowsCreateStringReference
HSTRING_UserFree64
HSTRING_UserMarshal
HSTRING_UserSize
HSTRING_UserUnmarshal
WindowsDeleteString
HSTRING_UserUnmarshal64
HSTRING_UserMarshal64
WindowsGetStringLen
api-ms-win-core-file-l1-1-0
DeleteFileW
CreateDirectoryW
api-ms-win-core-winrt-l1-1-0
RoInitialize
RoUninitialize
RoGetActivationFactory
api-ms-win-core-file-l2-1-0
MoveFileExW
api-ms-win-core-winrt-error-l1-1-1
IsErrorPropagationEnabled
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate
api-ms-win-core-com-l1-1-0
CoCreateFreeThreadedMarshaler
CoCreateInstance
CoTaskMemAlloc
CoCreateGuid
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventUnregister
EventWriteEx
EventSetInformation
api-ms-win-core-localization-l1-2-0
LCMapStringEx
oleaut32
SysFreeString
SysAllocString
api-ms-win-eventing-controller-l1-1-0
ControlTraceW
EnableTraceEx2
StartTraceW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
rpcrt4
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrOleAllocate
NdrOleFree
ntdll
EtwNotificationUnregister
EtwNotificationRegister
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
100KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
72KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=58, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=11, id=260, version=33145,
count=5, id=259, version=33145,
count=1157, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=28, id=261, version=33145,
count=1, id=256, version=33145,
count=14, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WinSATAPI.dll
- IMPHASH d8e5f02a66c7ddb820db2a32abaff7d7
- SHA256 5e31b06ab8cf2a01b131370560086233b07c63162b3608d863c4e4a023d344e0
- MD5 52bb6e69ec7534459605caede3269b71
- SHA1 e260f642f81f952de9d121a013317b9772844e9b
- SHA512 5a257b5c3ae28d6b93dbe0fd6152f7e9777d3c1f0d02375183c13bce4fa982e11efb8cfd491da7219c10580e69d24bec93caab55899f25c366a7a55e7e903c67
- SSDEEP 6144:S2MRg07v96wYgMVq12241Rov7nR9cT8vn5nYBbc4g29p7:S2fO16FLVq1b2Rov88Cth
- TLSH T1EC94E61EA7A847B6D066913C8577F205E2B278105B21D2CB229C427D2E37BD46E3DBF1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
74320
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WinSATAPI.pdb
msvcrt
floor
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
realloc
_errno
_initterm
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
??0exception@@QEAA@XZ
_callnewh
calloc
memmove_s
_time64
iswdigit
_wcsicmp
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
??3@YAXPEAX@Z
?what@exception@@UEBAPEBDXZ
_vsnwprintf
_itoa_s
_vsnprintf_s
_snprintf_s
_vsnwprintf_s
wcsncpy_s
malloc
free
_purecall
wcscat_s
wcscpy_s
memcpy_s
??_V@YAXPEAX@Z
??1bad_cast@@UEAA@XZ
??0bad_cast@@QEAA@PEBD@Z
??0bad_cast@@QEAA@AEBV0@@Z
strcspn
localeconv
sprintf_s
_wtof
modf
_wcsnicmp
wcsncmp
setlocale
__uncaught_exception
__pctype_func
___lc_handle_func
___lc_codepage_func
___mb_cur_max_func
_ismbblead
abort
memset
_wcsdup
__crtLCMapStringW
_wsetlocale
memchr
memcmp
__C_specific_handler
__CxxFrameHandler3
??1exception@@UEAA@XZ
floorf
oleaut32
SysFreeString
LoadTypeLi
SystemTimeToVariantTime
SysStringLen
SetErrorInfo
SysAllocString
LoadRegTypeLi
SysStringByteLen
SysAllocStringByteLen
VariantChangeType
VarUI4FromStr
CreateErrorInfo
GetErrorInfo
VariantInit
RegisterTypeLi
VariantClear
api-ms-win-core-libraryloader-l1-2-0
FreeLibraryAndExitThread
LoadResource
SizeofResource
LoadLibraryExA
LoadLibraryExW
FindResourceExW
FreeLibrary
GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
DeleteCriticalSection
EnterCriticalSection
WaitForMultipleObjectsEx
SetCriticalSectionSpinCount
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
CreateEventW
SetEvent
api-ms-win-core-com-l1-1-0
CoUninitialize
CoTaskMemAlloc
StringFromGUID2
CoGetClassObject
CoInitializeEx
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
api-ms-win-core-registry-l1-1-0
RegQueryInfoKeyW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegQueryValueExW
RegFlushKey
RegOpenKeyExW
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-string-l1-1-0
GetStringTypeW
GetStringTypeExW
MultiByteToWideChar
CompareStringW
WideCharToMultiByte
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
api-ms-win-eventing-provider-l1-1-0
EventEnabled
EventUnregister
EventWriteTransfer
EventRegister
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GlobalMemoryStatusEx
GetTickCount
api-ms-win-core-processthreads-l1-1-0
CreateThread
CreateProcessW
TerminateThread
GetCurrentThreadId
GetCurrentProcessId
ResumeThread
GetExitCodeProcess
GetCurrentProcess
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
FormatMessageA
api-ms-win-core-wow64-l1-1-0
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
rpcrt4
UuidToStringW
RpcStringFreeW
UuidCreate
UuidCreateNil
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-memory-l1-1-0
CreateFileMappingW
MapViewOfFile
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-file-l1-1-0
GetDiskFreeSpaceExW
api-ms-win-core-synch-l1-2-0
Sleep
WakeAllConditionVariable
SleepConditionVariableSRW
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
ntdll
ShipAssert
dxgi
CreateDXGIFactory
gdiplus
GdipCreateFontFamilyFromName
GdipCreateBitmapFromResource
GdipCloneImage
GdipDeleteBrush
GdipAlloc
GdipDisposeImage
GdipSetStringFormatLineAlign
GdipCreateFont
GdipCreateSolidFill
GdipCreateHBITMAPFromBitmap
GdiplusStartup
GdipGetImageHeight
GdipSetTextRenderingHint
GdipCloneBrush
GdipGetImageGraphicsContext
GdipFillRectangleI
GdipDeleteGraphics
GdipDeleteStringFormat
GdipDeleteFont
GdipGetImageWidth
GdipSetStringFormatAlign
GdipDeleteFontFamily
GdipCreateStringFormat
GdipDrawString
GdiplusShutdown
GdipFree
user32
PostMessageW
SystemParametersInfoW
EnumDisplaySettingsW
GetSysColor
GetSystemMetrics
UnregisterClassA
CharLowerBuffW
EnumDisplayDevicesW
IsWindow
shlwapi
StrFormatByteSizeW
shell32
ShellExecuteExW
SHGetFolderPathW
kernel32
CloseThreadpoolTimer
LCIDToLocaleName
UnmapViewOfFile
GetVersionExW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
SearchPathW
FindResourceW
LockResource
GetSystemFirmwareTable
lstrcmpW
IsDebuggerPresent
DebugBreak
WTSGetActiveConsoleSessionId
AcquireSRWLockShared
CreateMutexExW
GetCurrentDirectoryW
CreateThreadpoolTimer
ReleaseSRWLockShared
OutputDebugStringW
SetThreadpoolTimer
ProcessIdToSessionId
ReleaseMutex
CreateFileW
GetLocaleInfoW
OpenSemaphoreW
FindClose
WaitForThreadpoolTimerCallbacks
lstrcmpiW
GetStringTypeExA
GetModuleFileNameA
FindFirstFileW
CreateSemaphoreExW
InitializeCriticalSectionEx
FindNextFileW
ReleaseSemaphore
GetUserDefaultLocaleName
GetLocaleInfoEx
WaitForSingleObjectEx
api-ms-win-security-base-l1-1-0
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
200KB
Virtual Size
198KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
88KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
88KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=60, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=6, id=259, version=33145,
count=376, id=1, productName=Unmarked objects,
count=31, id=257, version=33145,
count=26, id=261, version=33145,
count=67, id=260, version=33145,
count=1, id=256, version=33145,
count=40, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WinSCard.dll
- IMPHASH 83e385b709cddd188a7907de4b4e334d
- SHA256 17c6112948db66c9a6137e217b1b04e7c10d1e7ce5cae2caaa2e324bcd13c5d5
- MD5 142b9dbfa5cd2f3d3ce4dab29362eaf9
- SHA1 fe6737299a7e2392b364bef75cb3a04340704875
- SHA512 e8522167f21bacd657819580222864ccafb1063c3eab9ec2b6ee3182189a225908e5cd1419424f3c3aa7a2615c91d536f073ba503d8d40a5b4faaf092a06d0d1
- SSDEEP 6144:79C8dZUj9u19KcJrQQ+Cj5H1kyQApJCGkkvR9dceGGiFj0oIGG:Q8dZUm9FJrQQZ5H1+ApM/kSIf
- TLSH T19A643C1EE2A91895E4B7C2BDC5478616FBB27865831183CB0AA0C53D6F17FE87A34F41
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
105264
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WinSCard.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__ultow
_o__wcsicmp
_o__wcsnicmp
_o__wtoi
_o_free
_o_malloc
__std_terminate
_o__crt_atexit
_o___stdio_common_vswprintf
_o__configure_narrow_argv
_o___stdio_common_vsprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__cexit
_o__callnewh
__C_specific_handler
__CxxFrameHandler4
_CxxThrowException
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
strcmp
wcspbrk
api-ms-win-core-synch-l1-2-0
InitializeConditionVariable
Sleep
WakeAllConditionVariable
SleepConditionVariableCS
api-ms-win-security-base-l1-1-0
DuplicateTokenEx
RevertToSelf
InitializeSid
GetTokenInformation
SetSecurityDescriptorDacl
AddAccessAllowedAce
GetLengthSid
InitializeSecurityDescriptor
AddAce
IsValidSid
InitializeAcl
GetSidLengthRequired
GetSidSubAuthority
GetAce
GetAclInformation
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExW
SizeofResource
LoadLibraryExW
FreeLibrary
LockResource
LoadResource
GetProcAddress
api-ms-win-core-registry-l1-1-0
RegDeleteValueW
RegDeleteKeyExW
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegEnumValueW
RegQueryValueExW
RegEnumKeyExW
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionEx
WaitForSingleObject
InitializeCriticalSection
LeaveCriticalSection
DeleteCriticalSection
AcquireSRWLockShared
InitializeCriticalSectionAndSpinCount
ReleaseSemaphore
ResetEvent
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
SetEvent
ReleaseSRWLockExclusive
EnterCriticalSection
CreateEventW
CreateSemaphoreExW
ReleaseMutex
OpenEventW
CreateMutexExW
api-ms-win-core-heap-l1-1-0
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
SetLastError
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetProcessId
GetCurrentProcess
OpenProcessToken
OpenThreadToken
GetCurrentThread
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
SetThreadToken
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventRegister
EventUnregister
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableLevel
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableFlags
UnregisterTraceGuids
TraceMessage
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
SetThreadpoolWait
SetThreadpoolTimer
CreateThreadpoolCleanupGroup
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolWaitCallbacks
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolCleanupGroup
CloseThreadpoolWait
WaitForThreadpoolTimerCallbacks
api-ms-win-core-localization-l1-2-0
GetACP
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-file-l1-1-0
CreateFileW
ReadFile
GetFileSizeEx
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-libraryloader-l1-2-1
FindResourceW
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpW
lstrlenA
lstrcmpiW
lstrlenW
ntdll
RtlInitUnicodeString
NtCancelIoFileEx
RtlDeleteCriticalSection
NtDeviceIoControlFile
EtwTraceMessage
NtCreateFile
RtlDllShutdownInProgress
RtlInitializeCriticalSection
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
ClassInstall32
SCardAccessNewReaderEvent
SCardAccessStartedEvent
SCardAddReaderToGroupA
SCardAddReaderToGroupW
SCardAudit
SCardBeginTransaction
SCardCancel
SCardConnectA
SCardConnectW
SCardControl
SCardDisconnect
SCardEndTransaction
SCardEstablishContext
SCardForgetCardTypeA
SCardForgetCardTypeW
SCardForgetReaderA
SCardForgetReaderGroupA
SCardForgetReaderGroupW
SCardForgetReaderW
SCardFreeMemory
SCardGetAttrib
SCardGetCardTypeProviderNameA
SCardGetCardTypeProviderNameW
SCardGetDeviceTypeIdA
SCardGetDeviceTypeIdW
SCardGetProviderIdA
SCardGetProviderIdW
SCardGetReaderDeviceInstanceIdA
SCardGetReaderDeviceInstanceIdW
SCardGetReaderIconA
SCardGetReaderIconW
SCardGetStatusChangeA
SCardGetStatusChangeW
SCardGetTransmitCount
SCardIntroduceCardTypeA
SCardIntroduceCardTypeW
SCardIntroduceReaderA
SCardIntroduceReaderGroupA
SCardIntroduceReaderGroupW
SCardIntroduceReaderW
SCardIsValidContext
SCardListCardsA
SCardListCardsW
SCardListInterfacesA
SCardListInterfacesW
SCardListReaderGroupsA
SCardListReaderGroupsW
SCardListReadersA
SCardListReadersW
SCardListReadersWithDeviceInstanceIdA
SCardListReadersWithDeviceInstanceIdW
SCardLocateCardsA
SCardLocateCardsByATRA
SCardLocateCardsByATRW
SCardLocateCardsW
SCardPciRaw
SCardPciT0
SCardPciT1
SCardReadCacheA
SCardReadCacheW
SCardReconnect
SCardReleaseAllEvents
SCardReleaseContext
SCardReleaseNewReaderEvent
SCardReleaseStartedEvent
SCardRemoveReaderFromGroupA
SCardRemoveReaderFromGroupW
SCardSetAttrib
SCardSetCardTypeProviderNameA
SCardSetCardTypeProviderNameW
SCardState
SCardStatusA
SCardStatusW
SCardTransmit
SCardWriteCacheA
SCardWriteCacheW
g_rgSCardRawPci
g_rgSCardT0Pci
g_rgSCardT1Pci
Name
.text
Size
208KB
Virtual Size
206KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
72KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
224B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=69, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1259, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=21, id=261, version=33145,
count=1, id=256, version=33145,
count=23, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WinSync.dll
- IMPHASH 89d930dd8c802f54d098cb1633216008
- SHA256 3382aa3729c58c561806bf430a6b702c6fbe49dc6a9c70d94959adf3397cebdd
- MD5 1141187bb5149a3b6bf53336b096bdf6
- SHA1 bf6cf23a81ac89f207113c334025202525c0b593
- SHA512 62c41df4308e991d3e2e800848b99c40a449d6bf113ce89145a333a55d078cbe4c94cd95fab5a112941a9edd0134b18c8736411c625c4058ac8f253ea205c740
- SSDEEP 12288:MrAofIoulX41Mv6alYHN7gfIQ96DG6P40S5o73AXgQj:qhQNlXzv6d7gP9666g0S5FB
- TLSH T139F44A75E5E406D6D6E5E2398113062BEB70744DEB3181DB02B48179BB9FEE4CA7E308
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
159232
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WinSync.pdb
msvcrt
memcpy
_purecall
free
_amsg_exit
_initterm
_XcptFilter
malloc
__C_specific_handler
memcmp
memset
api-ms-win-core-com-l1-1-0
CoTaskMemFree
IIDFromString
CoCreateInstance
StringFromCLSID
StringFromIID
CoCreateFreeThreadedMarshaler
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
SetLastError
UnhandledExceptionFilter
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableLevel
GetTraceEnableFlags
UnregisterTraceGuids
GetTraceLoggerHandle
TraceMessage
RegisterTraceGuidsW
api-ms-win-core-synch-l1-1-0
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
EnterCriticalSection
LeaveCriticalSection
CreateEventW
ResetEvent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
HeapDestroy
api-ms-win-core-localization-l1-2-0
FormatMessageW
oleaut32
CreateErrorInfo
SetErrorInfo
GetErrorInfo
api-ms-win-core-registry-l2-1-0
RegDeleteKeyW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpW
api-ms-win-core-file-l1-1-0
FindFirstFileW
GetFullPathNameW
FindClose
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
GetModuleFileNameW
api-ms-win-core-localization-l1-2-2
LCIDToLocaleName
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-localization-obsolete-l1-2-0
GetUserDefaultUILanguage
Name
.text
Size
608KB
Virtual Size
604KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
84KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
24KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=44, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=18, id=260, version=33136,
count=4, id=259, version=33136,
count=81, id=1, productName=Unmarked objects,
count=3, id=257, version=33136,
count=1, id=256, version=33136,
count=85, id=264, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
WinSyncMetastore.dll
- IMPHASH 9bc8391cd9f4663cd8782e4167fe874d
- SHA256 e5dccac51ad6900f49ad6ffe0fe61460ad64b1d12a5b8447c5c516a4373ba17d
- MD5 0ddb96cbe5a38da3df2946fd09fcc0f8
- SHA1 245b3d077c6338b9fb183df4ba4702de363318c4
- SHA512 db94a9a5524e6e7284aa326f3c0ac17dbacf0b2f21ba33efc2cec69226ae99c8bdcf6e6cc95fd96d88d348ff01561aa2242f90aa76b8f2f8d4e72d141c74db56
- SSDEEP 3072:zDdgW8fEtdeIxpwWF3ckgpOSgej20aXorQmsYInqY14gqQ:F+f0dTpd3ckgFgmIqY1
- TLSH T1C0342B65E1D429E4E9F25774866241B6EF72700D673041FF26FC08652B2BAF1EA78B0C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4816
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WinSyncMetastore.pdb
msvcrt
_initterm
_onexit
__dllonexit
_unlock
_XcptFilter
_lock
free
malloc
memcpy
_wcsnicmp
qsort_s
_vsnwprintf
_amsg_exit
__C_specific_handler
memcmp
memset
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTime
GetSystemTimeAsFileTime
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-errorhandling-l1-1-0
SetLastError
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
ReleaseMutex
LeaveCriticalSection
CreateMutexW
DeleteCriticalSection
oleaut32
VariantClear
SysAllocString
GetErrorInfo
CreateErrorInfo
SetErrorInfo
VariantInit
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-com-l1-1-0
StringFromGUID2
CoCreateInstance
CoTaskMemFree
api-ms-win-core-libraryloader-l1-1-0
GetModuleFileNameW
FreeLibrary
LoadStringW
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-file-l1-1-0
FindClose
FindFirstFileW
GetFullPathNameW
FileTimeToLocalFileTime
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
FileTimeToSystemTime
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapDestroy
HeapAlloc
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-localization-l1-2-2
LCIDToLocaleName
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
lstrcmpW
api-ms-win-core-localization-obsolete-l1-2-0
GetUserDefaultUILanguage
api-ms-win-security-cryptoapi-l1-1-0
CryptHashData
CryptCreateHash
CryptReleaseContext
CryptGetHashParam
CryptDestroyHash
CryptAcquireContextW
winsync
ord1
Name
.text
Size
176KB
Virtual Size
172KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
552B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=44, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=17, id=260, version=33136,
count=5, id=259, version=33136,
count=86, id=1, productName=Unmarked objects,
count=5, id=257, version=33136,
count=1, id=256, version=33136,
count=29, id=264, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
WinSyncProviders.dll
- IMPHASH 2b2ade92b7f09e3f6c2b7654f8f28c7a
- SHA256 bb27d176e88dba3825da21862f7990df1ee028de37834e0e751a9c45bdc86fec
- MD5 256178df83c3480d809119b542cb72f0
- SHA1 3247c8e2d4337a1e50b6f3df5641c447d7450d11
- SHA512 284dc1fe06e5e317fcfb37e0086f92956b742efd0cc651b47005f4b21f1d1ae0e4d2456ac0e4f02fa051f64f0cdda5a2140363add1c0638d280120c59cb739a0
- SSDEEP 3072:leAQNT0ihOPTigBZQ32rX0bZu6LhGW4/:lIYDigBiSXWZu6Lhv4
- TLSH T116F349B666F805F1C7A5633D9993054AFB70300523A252CF075842AE9F7FAE4AE3D712
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4832
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WinSyncProviders.pdb
msvcrt
_amsg_exit
__C_specific_handler
free
_XcptFilter
_callnewh
_vsnwprintf
_initterm
malloc
memcpy
_purecall
memcpy_s
memcmp
memset
winsync
ord1
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage
RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceEnableFlags
api-ms-win-core-com-l1-1-0
StringFromGUID2
CoCreateGuid
api-ms-win-core-libraryloader-l1-1-0
LoadStringW
FreeLibrary
GetModuleFileNameW
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegCreateKeyExW
RegCloseKey
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTime
GetSystemTimeAsFileTime
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError
oleaut32
CreateErrorInfo
GetErrorInfo
SetErrorInfo
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-string-l1-1-0
CompareStringW
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
api-ms-win-core-file-l1-1-0
FindClose
GetFullPathNameW
FindFirstFileW
api-ms-win-core-localization-l1-2-2
LCIDToLocaleName
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-registry-l2-1-0
RegDeleteKeyW
api-ms-win-core-string-obsolete-l1-1-0
lstrlenW
api-ms-win-core-localization-obsolete-l1-2-0
GetUserDefaultUILanguage
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
100KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
736B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=42, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=17, id=260, version=33136,
count=4, id=259, version=33136,
count=63, id=1, productName=Unmarked objects,
count=5, id=257, version=33136,
count=2, id=261, version=33136,
count=1, id=256, version=33136,
count=26, id=264, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
WinTypes.dll
- IMPHASH 34ac6b4e6e36038e929e4bb287e740f9
- SHA256 3ad9f2c233dbe2e491de364025a726f95c21aaecde42820680b52a3cef3b4473
- MD5 4ac4ea13122c932b0ff90c8f6092b4dd
- SHA1 5e6e0d324cf673a565c2593c006760d881163fbf
- SHA512 a132810d1263f370004494e0a9e12c2eb4509dc6203f45769bd32a799403c60e08224cc288603b9d3df6e2dd9b336b60cfdf27268bd6c32f0a17031b3b246329
- SSDEEP 12288:HxPfPj52EqljXwJv8PB3Zz0+dbH8WUDiID6QndM0A/w93ZELRp:RPfPjU/XR108nryDTVZYP
- TLSH T13865E84BAA690156D27CB236C2AB0B0CE3B16C155755D3CB26A4723ECF3BBC45B3A750
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
50:9d:47:e5:90:3f:b7:11:5b:79:3c:07:42:91:ce:37:fd:d8:b1:c8:97:27:aa:b6:30:56:9d:4e:56:75:46:f2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:401A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:19:5e:b2:d8:54:75:f4:b1:8d:00:01:00:00:02:19
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
326416
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WinTypes.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsnicmp
_o_abort
_o_free
_o_isdigit
_o_iswspace
_o_malloc
_o_realloc
_o_terminate
_o_towupper
_o_wcscat_s
_o_wcscpy_s
_o_wcsncat_s
_o_wcstoul
__C_specific_handler
__current_exception
__current_exception_context
__CxxFrameHandler3
_CxxThrowException
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o__cexit
_o__callnewh
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
wcsrchr
wcschr
_o__aligned_malloc
_o__aligned_free
__std_terminate
_o__configure_narrow_argv
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
wcsncmp
wcscmp
combase
ord90
GetErrorInfo
SetErrorInfo
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetModuleFileNameW
DisableThreadLibraryCalls
GetModuleHandleExA
GetModuleHandleW
GetModuleHandleExW
FreeLibrary
GetProcAddress
api-ms-win-core-synch-l1-1-0
OpenSemaphoreW
WaitForSingleObject
InitializeCriticalSection
ReleaseSemaphore
CreateMutexExW
WaitForSingleObjectEx
ReleaseMutex
InitializeSRWLock
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ReleaseSRWLockShared
AcquireSRWLockShared
AcquireSRWLockExclusive
CreateSemaphoreExW
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
OpenProcessToken
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
CompareStringEx
WideCharToMultiByte
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventSetInformation
EventUnregister
EventRegister
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
InitOnceComplete
InitOnceInitialize
InitOnceBeginInitialize
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetWindowsDirectoryW
GetSystemDirectoryW
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedFlushSList
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
api-ms-win-core-registry-l1-1-0
RegGetValueW
api-ms-win-core-file-l1-1-0
FindNextFileW
FindFirstFileW
FindClose
GetFileAttributesW
api-ms-win-core-wow64-l1-1-0
Wow64DisableWow64FsRedirection
IsWow64Process
Wow64RevertWow64FsRedirection
api-ms-win-core-path-l1-1-0
PathCchRemoveFileSpec
api-ms-win-core-psapi-l1-1-0
K32GetModuleFileNameExW
api-ms-win-security-base-l1-1-0
GetTokenInformation
ntdll
RtlDeleteElementGenericTableAvl
RtlInitializeGenericTableAvl
RtlLookupElementGenericTableAvl
RtlInsertElementGenericTableAvl
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
RoCreateNonAgilePropertySet
RoCreatePropertySetSerializer
RoGetBufferMarshaler
RoGetMetaDataFile
RoIsApiContractMajorVersionPresent
RoIsApiContractPresent
RoParseTypeName
RoResolveNamespace
Name
.text
Size
648KB
Virtual Size
645KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
660KB
Virtual Size
656KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
72KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=33145,
count=61, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1227, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=14, id=260, version=33145,
count=5, id=259, version=33145,
count=30, id=261, version=33145,
count=1, id=256, version=33145,
count=55, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WinUICohabitation.dll
- IMPHASH ad7d459c8982b551f4a76206c6fd92e4
- SHA256 f5acaf696abffdce3a0492291b3d3dd4fadbbc084745f7e8edab6d6ccc700d71
- MD5 d5385fb21538491327242b21008410c0
- SHA1 cb5367c9229d9bb8c72629bd7955bf8dee813ad8
- SHA512 70c506b1fc7c0ca0fbd49909608db68348289c3985bfde183c6db66f3bc0f2091c823b6db737b0b1950400ddb12ade30ad9c339f8c2896c5c59ade0c69b41639
- SSDEEP 3072:vkEmmG4rlZiTshaYkWiVKJshvIWO4nBEDX5Wo/D4U3k:syiT4aYqHcWo/D4U0
- TLSH T1C7D32A6E31B811E5E5A6C03DC8924A19E7B2B465531253DF03A0C1BE5F93BF86D3EB60
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
8768
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WinUICohabitation.pdb
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_abort
_o_free
_o_iswspace
_o_malloc
__C_specific_handler
_CxxThrowException
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
FindStringOrdinal
GetModuleHandleExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameA
FreeLibrary
LoadLibraryExW
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-com-l1-1-0
PropVariantClear
CoTaskMemAlloc
CoTaskMemFree
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockExclusive
DeleteCriticalSection
InitializeCriticalSectionEx
CreateMutexExW
InitializeCriticalSection
LeaveCriticalSection
WaitForSingleObject
ReleaseMutex
AcquireSRWLockExclusive
ReleaseSemaphore
WaitForSingleObjectEx
EnterCriticalSection
OpenSemaphoreW
AcquireSRWLockShared
CreateSemaphoreExW
ReleaseSRWLockShared
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventWriteTransfer
EventSetInformation
EventUnregister
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-winrt-error-l1-1-0
RoFailFastWithErrorContext
GetRestrictedErrorInfo
SetRestrictedErrorInfo
oleaut32
SysFreeString
SetErrorInfo
SysStringLen
GetErrorInfo
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InterlockedPushEntrySList
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-appmodel-runtime-internal-l1-1-7
AddDependencyToProcessPackageGraph
api-ms-win-appmodel-runtime-l1-1-0
GetCurrentPackageInfo
combase
ord230
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
WinAppSDKCohabitation_EnsureWASDKFrameworkPackageRegistered
WinAppSDKCohabitation_EnsureWASDKvNextFrameworkPackageRegistered
WinAppSDKCohabitation_RegisterWASDKThread
WinAppSDKCohabitation_RegisterWASDKvNextThread
WinAppSDKCohabitation_UnregisterWASDKThread
WinUICohabitation_DesktopWindowXamlSourceNative_AttachToWindow
WinUICohabitation_DesktopWindowXamlSourceNative_get_WindowHandle
WinUICohabitation_GetWinUI2XamlControlsResources
Name
.text
Size
84KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
360B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=56, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=23, id=261, version=33145,
count=1159, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=1, id=256, version=33145,
count=4, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=258, version=33145,
Windows.UI.Logon.dll
- IMPHASH a0d5b5c2d052afab69d1b61c93b0cf02
- SHA256 51b3aa2b50944111f039c0de035f9c8951a3fd7a65eda7380ad30ece5c2565bf
- MD5 d35ad1c7d460d5b29f36cb838b976a02
- SHA1 b105fe550e1f7e4cd283bca166a92b07da2d2702
- SHA512 e34344da71317128ac77aa977aef07719db7b622069b0d26a573a3c20ca5590f57f050c50a82334fffb1ec609b65d9a71680bcdaffc0acd7446bb0baf062e08b
- SSDEEP 49152:09OSBVJoyynhr+7AgOsqO0COWdVicLmqrkgy1DyTEL1C1ryzyQrx3UQ12obpi:Nktm8dyguvrX/p
- TLSH T1D116F769091C42D1D779A6B9881BAD0BE9B1744C077006CB08500BD95FBFBFAADBF271
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
855264
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Windows.UI.Logon.pdb
wincorlib
??0ChangedStateException@Platform@@QE$AAA@XZ
?GetIBoxArrayVtable@Details@Platform@@YAPEAXPEAX@Z
?GetObjectContext@Details@Platform@@YAPEAUIUnknown@@XZ
?ResolveWeakReference@Details@Platform@@YAPE$AAVObject@2@AEBU_GUID@@PEAPEAU__abi_IUnknown@@@Z
??0DisconnectedException@Platform@@QE$AAA@XZ
??0Delegate@Platform@@QE$AAA@XZ
?Allocate@Heap@Details@Platform@@SAPEAX_K@Z
?ReCreateException@Exception@Platform@@SAPE$AAV12@H@Z
?GetProxyImpl@Details@Platform@@YAJPEAUIUnknown@@AEBU_GUID@@0PEAPEAU3@@Z
?ReleaseInContextImpl@Details@Platform@@YAJPEAUIUnknown@@0@Z
?GetTypeCode@Type@Platform@@SA?AW4TypeCode@2@PE$AAV12@@Z
?CreateValue@Details@Platform@@YAPE$AAVObject@2@W4TypeCode@2@PEBX@Z
?GetIBoxVtable@Details@Platform@@YAPEAXPEAX@Z
?EventSourceGetTargetArray@Details@Platform@@YAPEAXPEAXPEAUEventLock@12@@Z
?EventSourceGetTargetArraySize@Details@Platform@@YAIPEAX@Z
??0NullReferenceException@Platform@@QE$AAA@XZ
?Equals@Object@Platform@@QE$AAA_NPE$AAV12@@Z
??0InvalidArgumentException@Platform@@QE$AAA@PE$AAVString@1@@Z
?get@FullName@Type@Platform@@QE$AAAPE$AAVString@3@XZ
?CreateException@Exception@Platform@@SAPE$AAV12@HPE$AAVString@2@@Z
??0OutOfBoundsException@Platform@@QE$AAA@XZ
?EventSourceInitialize@Details@Platform@@YAXPEAPEAX@Z
??0FailureException@Platform@@QE$AAA@XZ
??0OutOfMemoryException@Platform@@QE$AAA@XZ
?ReleaseTarget@ControlBlock@Details@Platform@@AEAAXXZ
?AlignedFree@Heap@Details@Platform@@SAXPEAX@Z
?Free@Heap@Details@Platform@@SAXPEAX@Z
??0Object@Platform@@QE$AAA@XZ
?CreateException@Exception@Platform@@SAPE$AAV12@H@Z
?EventSourceRemove@Details@Platform@@YAXPEAPEAXPEAUEventLock@12@VEventRegistrationToken@Foundation@Windows@@@Z
?UninitializeData@Details@Platform@@YAXH@Z
?InitializeData@Details@Platform@@YAJH@Z
?__abi_cast_Object_to_String@__abi_details@@YAPE$AAVString@Platform@@_NPE$AAVObject@3@@Z
?__abi_make_type_id@@YAPE$AAVType@Platform@@AEBU__abi_type_descriptor@@@Z
??BType@Platform@@SA?AVTypeName@Interop@Xaml@UI@Windows@@PE$AAV01@@Z
?get@Message@Exception@Platform@@QE$AAAPE$AAVString@3@XZ
??0FailureException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0NotImplementedException@Platform@@QE$AAA@XZ
?EventSourceUninitialize@Details@Platform@@YAXPEAPEAX@Z
?__abi_cast_String_to_Object@__abi_details@@YAPE$AAVObject@Platform@@PE$AAVString@3@@Z
??0InvalidArgumentException@Platform@@QE$AAA@XZ
?AllocateException@Heap@Details@Platform@@SAPEAX_K0@Z
?__abi_WinRTraiseWrongThreadException@@YAXXZ
?__abi_WinRTraiseObjectDisposedException@@YAXXZ
?Allocate@Heap@Details@Platform@@SAPEAX_K0@Z
?__abi_WinRTraiseInvalidCastException@@YAXXZ
?__abi_WinRTraiseNotImplementedException@@YAXXZ
?EventSourceGetTargetArrayEvent@Details@Platform@@YAPEAXPEAXIPEBXPEA_J@Z
?__abi_WinRTraiseDisconnectedException@@YAXXZ
?__abi_WinRTraiseFailureException@@YAXXZ
?__abi_WinRTraiseOperationCanceledException@@YAXXZ
?GetWeakReference@Details@Platform@@YAPEAU__abi_IUnknown@@QE$ADVObject@2@@Z
?__abi_FailFast@@YAXXZ
?ReCreateFromException@Details@Platform@@YAJPE$AAVException@2@@Z
?GetIidsFn@@YAJHPEAKPEBU__s_GUID@@PEAPEAVGuid@Platform@@@Z
?GetActivationFactoryByPCWSTR@@YAJPEAXAEAVGuid@Platform@@PEAPEAX@Z
?get@Right@Rect@Foundation@Windows@@QEAAMXZ
?get@Bottom@Rect@Foundation@Windows@@QEAAMXZ
?__abi_ObjectToString@__abi_details@@YAPE$AAVString@Platform@@PE$AAVObject@3@_N@Z
?__abi_WinRTraiseAccessDeniedException@@YAXXZ
?__abi_WinRTraiseInvalidArgumentException@@YAXXZ
?EventSourceAdd@Details@Platform@@YA?AVEventRegistrationToken@Foundation@Windows@@PEAPEAXPEAUEventLock@12@PE$AAVDelegate@2@@Z
?__abi_WinRTraiseClassNotRegisteredException@@YAXXZ
?__abi_WinRTraiseCOMException@@YAXJ@Z
?__abi_WinRTraiseNullReferenceException@@YAXXZ
?__abi_WinRTraiseChangedStateException@@YAXXZ
?__abi_WinRTraiseOutOfBoundsException@@YAXXZ
?__abi_WinRTraiseOutOfMemoryException@@YAXXZ
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__get_errno
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__wcsicmp
memmove
_o_abort
_o_atan2
_o_ceil
_o_ceilf
_o_free
_o_iswdigit
_o_iswspace
_o_malloc
_o_memcpy_s
_o_realloc
_o_sqrt
_o_terminate
_o_wcscat_s
_o_wcscpy_s
_o_wcstol
__CxxFrameHandler3
__C_specific_handler
__current_exception
__current_exception_context
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_CxxThrowException
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__execute_onexit_table
_o__errno
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
wcslen
memset
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
InitOnceExecuteOnce
api-ms-win-core-winrt-string-l1-1-0
WindowsConcatString
WindowsCreateStringReference
WindowsDeleteString
WindowsDuplicateString
WindowsCreateString
WindowsGetStringRawBuffer
WindowsCompareStringOrdinal
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsGetStringLen
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-winrt-error-l1-1-0
SetRestrictedErrorInfo
RoFailFastWithErrorContext
RoOriginateError
RoOriginateErrorW
RoTransformError
GetRestrictedErrorInfo
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
InitializeSRWLock
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionEx
CreateEventExW
SetEvent
WaitForSingleObjectEx
CreateSemaphoreExW
WaitForSingleObject
CreateMutexExW
AcquireSRWLockShared
ReleaseSemaphore
OpenSemaphoreW
ReleaseSRWLockShared
InitializeCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseMutex
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExA
GetProcAddress
GetModuleFileNameA
GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleHandleW
FreeLibrary
LoadLibraryExW
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate
IsErrorPropagationEnabled
RoOriginateLanguageException
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThread
OpenThreadToken
GetCurrentThreadId
GetCurrentProcessId
OpenProcessToken
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount64
GetTickCount
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedPushEntrySList
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-errorhandling-l1-1-0
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
RaiseException
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
api-ms-win-eventing-provider-l1-1-0
EventActivityIdControl
EventUnregister
EventWriteTransfer
EventSetInformation
EventRegister
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetUserDefaultLocaleName
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-com-l1-1-0
CoTaskMemRealloc
CoTaskMemAlloc
PropVariantClear
CoTaskMemFree
CoGetContextToken
StringFromGUID2
CoGetCallContext
CoCreateInstance
CoMarshalInterface
CoWaitForMultipleHandles
CoCreateFreeThreadedMarshaler
CoReleaseMarshalData
CreateStreamOnHGlobal
CoRevertToSelf
CoGetMalloc
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoGetActivationFactory
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-security-base-l1-1-0
RevertToSelf
EqualSid
IsValidSid
GetTokenInformation
ImpersonateLoggedOnUser
api-ms-win-core-string-l1-1-0
GetStringTypeExW
CompareStringOrdinal
WideCharToMultiByte
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegQueryValueExW
RegOpenCurrentUser
RegEnumValueW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
ntdll
EtwTraceMessage
_vsnwprintf
wcsrchr
strchr
wcsstr
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
RtlWakeAllConditionVariable
RtlSleepConditionVariableSRW
RtlNtStatusToDosErrorNoTeb
RtlGetDeviceFamilyInfoEnum
RtlUnsubscribeWnfStateChangeNotification
NtQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlPublishWnfStateData
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
d2d1
ord1
api-ms-win-core-registryuserspecific-l1-1-0
SHRegGetUSValueW
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
kernel32
CreateEventW
msvcp_win
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ
?_Assign@_ContextCallback@details@Concurrency@@AEAAXPEAX@Z
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?__ExceptionPtrRethrow@@YAXPEBX@Z
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_IsNonBlockingThread@_Task_impl_base@details@Concurrency@@SA_NXZ
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_Xbad_function_call@std@@YAXXZ
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Wcscoll
_Wcsxfrm
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?id@?$collate@_W@std@@2V0locale@2@A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z
?tolower@?$ctype@_W@std@@QEBA_W_W@Z
?is@?$ctype@_W@std@@QEBA_NF_W@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??Bid@locale@std@@QEAA_KXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
?GetNextAsyncId@platform@details@Concurrency@@YAIXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_broadcast
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_unlock
_Cnd_init_in_situ
_Cnd_destroy_in_situ
_Cnd_wait
api-ms-win-crt-math-l1-1-0
_copysign
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
3.2MB
Virtual Size
3.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
576KB
Virtual Size
573KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
140KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
152KB
Virtual Size
151KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
976B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=84, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=18, id=260, version=33145,
count=1514, id=1, productName=Unmarked objects,
count=9, id=257, version=33145,
count=36, id=261, version=33145,
count=7, id=259, version=33145,
count=1, id=256, version=33145,
count=78, id=265, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
Windows.UI.NetworkUXController.dll
- IMPHASH 8a4815ed96efb4c2e337c6d0130bc60f
- SHA256 94ef95cbafb2f93f051a356299be955ad5a3a080e19f3175cb7a6cc7758a9c60
- MD5 bd6d219d2670d04a25844371585d5084
- SHA1 6baf51646f278f2c6c8f5b291fa89e3f129b9ad4
- SHA512 e52082453e1e9b560d9f81e618dba5ed4aedc4e0d96ce0f0d914dc884b8516b86c1d086a63af18f611a6eb514e0a6e851f1463842386329981d6115dc9dc430b
- SSDEEP 768:ZnprS9VNVq35/wfA/dDlwRBhXmfX06coK94Am9aFdE9Idmt523SqTKRYx/2hQ7VZ:Zi+35/bNaBhXmf2OOKRXkwcRbL8EShe
- TLSH T10693185E26E404E9EA75A13C89A34E1DE370F05557035BEF43A041AE1F23FE49D3ABA1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7168
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Windows.UI.NetworkUXController.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memcpy
_o_free
_o_malloc
__C_specific_handler
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__CxxFrameHandler3
_CxxThrowException
__std_terminate
__CxxFrameHandler4
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleFileNameA
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleExW
api-ms-win-core-synch-l1-1-0
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
OpenSemaphoreW
InitializeSRWLock
ReleaseMutex
ReleaseSRWLockShared
AcquireSRWLockShared
CreateMutexExW
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
CreateEventW
SetEvent
EnterCriticalSection
ReleaseSemaphore
CreateSemaphoreExW
WaitForSingleObject
ResetEvent
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
GetLastError
SetLastError
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventSetInformation
EventRegister
EventUnregister
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
InitOnceExecuteOnce
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
RoOriginateErrorW
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsIsStringEmpty
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsCreateStringReference
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-com-l1-1-0
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoActivateInstance
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
48KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=49, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1142, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=27, id=261, version=33145,
count=1, id=256, version=33145,
count=6, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
Windows.UI.PicturePassword.dll
- IMPHASH b5983954d5cb875deb6295671f1a8640
- SHA256 a195b21e6f7fae84c313b5411142faac3cf982d3c2f1c9235aea3a29912797a5
- MD5 09f50af8ec3675e1412581a0ff2ea103
- SHA1 193c83299a1127e002c2a95b3f37d021f375525d
- SHA512 d7b53685dd2caecfbe5804b2b26acc2b8c7e05dcaf62a0c643867d5d9449b7cd7a21820da2675d955de54aed7181650d7970e48726c3df5c3cc3e3715312f8a8
- SSDEEP 6144:njZcqG2vB7QAo5Upyv//nJ5axe4yu5KtAQgotWDucUAOLr0U6zmh3dT:njSqGEB7QjnJ5a3UqDYWD9OLv6qF
- TLSH T19E94AE5D33A60065D5BA923885674F09F572BC10732642FF02AB727CCE77BD8A93AB11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
9744
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Windows.UI.PicturePassword.pdb
msvcrt
free
memcpy
memcmp
memset
memmove
_wtoi
memmove_s
wcsstr
floorf
_purecall
memcpy_s
_vsnwprintf
pow
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
__CxxFrameHandler3
_CxxThrowException
_callnewh
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
malloc
atan2
sqrt
shcore
ord190
ord188
SHCreateStreamOnFileW
ord162
SHCreateMemStream
IStream_Reset
IStream_Copy
ord109
IStream_Size
SHCreateStreamOnFileEx
shlwapi
StrChrW
ord219
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
FreeLibrary
LoadLibraryExW
GetModuleHandleExA
GetModuleHandleW
GetModuleHandleExW
FindResourceExW
GetModuleFileNameA
LockResource
GetProcAddress
LoadResource
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-synch-l1-1-0
InitializeCriticalSection
CreateMutexExW
CreateEventExW
InitializeCriticalSectionEx
ReleaseSemaphore
DeleteCriticalSection
WaitForMultipleObjectsEx
AcquireSRWLockShared
ReleaseSRWLockShared
LeaveCriticalSection
OpenEventW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CreateEventW
CreateSemaphoreExW
ReleaseMutex
EnterCriticalSection
WaitForSingleObject
WaitForSingleObjectEx
OpenSemaphoreW
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceExecuteOnce
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
HeapReAlloc
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
CreateProcessAsUserW
GetCurrentProcess
TerminateProcess
OpenThreadToken
GetCurrentThreadId
GetCurrentThread
OpenProcessToken
GetCurrentProcessId
SetThreadToken
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetComputerNameExW
GetTickCount
GetVersionExW
GetSystemDirectoryW
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-errorhandling-l1-1-0
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
RaiseException
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventWriteTransfer
EventRegister
EventActivityIdControl
EventSetInformation
oleaut32
SysFreeString
VariantClear
SysAllocString
api-ms-win-core-com-l1-1-0
CoGetMalloc
CoTaskMemFree
CoUninitialize
CoTaskMemAlloc
PropVariantClear
CoCreateInstance
CoGetCallContext
CoImpersonateClient
CoRevertToSelf
CoInitializeEx
CoReleaseMarshalData
CoSetProxyBlanket
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoTaskMemRealloc
api-ms-win-security-sddl-l1-1-0
ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW
RegCreateKeyExW
RegGetValueW
RegCloseKey
RegDeleteKeyExW
RegOpenKeyExW
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-file-l1-1-0
DeleteFileW
FindFirstFileW
CompareFileTime
CreateDirectoryW
FindClose
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-path-l1-1-0
PathCchCombine
PathCchCanonicalizeEx
PathCchAppend
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
crypt32
CryptProtectMemory
CryptUnprotectMemory
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoActivateInstance
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-file-l2-1-2
CopyFileW
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-security-base-l1-1-0
CreateRestrictedToken
ImpersonateLoggedOnUser
SetFileSecurityW
GetFileSecurityW
SetTokenInformation
GetLengthSid
GetTokenInformation
FreeSid
CreateWellKnownSid
AllocateAndInitializeSid
CopySid
cryptsp
CryptDestroyHash
CryptAcquireContextW
CryptHashData
CryptCreateHash
CryptReleaseContext
CryptGetHashParam
api-ms-win-core-misc-l1-1-0
lstrcmpiW
ntdll
RtlDeleteResource
RtlReleaseResource
RtlAcquireResourceExclusive
RtlInitializeResource
RtlNtStatusToDosError
dui70
?SetLayout@Element@DirectUI@@QEAAJPEAVLayout@2@@Z
?GetInteractionMode@TouchScrollViewer@DirectUI@@QEAAHXZ
?Create@FillLayout@DirectUI@@SAJPEAPEAVLayout@2@@Z
?Destroy@Layout@DirectUI@@QEAAXXZ
?Add@Element@DirectUI@@QEAAJPEAV12@@Z
?EnabledProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?GetID@Element@DirectUI@@QEAAGXZ
?GetBool@Value@DirectUI@@QEAA_NXZ
?GetInt@Value@DirectUI@@QEAAHXZ
?UpdateTooltip@Element@DirectUI@@MEAAXPEAV12@@Z
?ActivateTooltip@Element@DirectUI@@MEAAXPEAV12@K@Z
?RemoveTooltip@Element@DirectUI@@MEAAXPEAV12@@Z
?GetLayout@Element@DirectUI@@QEAAPEAVLayout@2@PEAPEAVValue@2@@Z
?SetSelected@Element@DirectUI@@QEAAJ_N@Z
?SetDirection@Element@DirectUI@@QEAAJH@Z
?SetAccName@Element@DirectUI@@QEAAJPEBG@Z
?GetIntZero@Value@DirectUI@@SAPEAV12@XZ
??0Element@DirectUI@@QEAA@XZ
??1Element@DirectUI@@UEAA@XZ
?Initialize@Element@DirectUI@@QEAAJIPEAV12@PEAK@Z
?OnPropertyChanged@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?OnGroupChanged@Element@DirectUI@@UEAAXH_N@Z
?OnInput@Element@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?OnKeyFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?OnDestroy@Element@DirectUI@@UEAAXXZ
?OnEvent@Element@DirectUI@@UEAAXPEAUEvent@2@@Z
?MessageCallback@Element@DirectUI@@UEAAIPEAUtagGMSG@@@Z
?Register@Element@DirectUI@@SAJXZ
?GetAccessibleImpl@Element@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
?Initialize@FlowLayout@DirectUI@@QEAAX_NIII@Z
?RemoveListener@Element@DirectUI@@QEAAXPEAUIElementListener@2@@Z
?Release@Value@DirectUI@@QEAAXXZ
??0CritSecLock@DirectUI@@QEAA@PEAU_RTL_CRITICAL_SECTION@@@Z
??1CritSecLock@DirectUI@@QEAA@XZ
?IsRTLReading@Element@DirectUI@@UEAA_NXZ
?IsContentProtected@Element@DirectUI@@UEAA_NXZ
?QueryInterface@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?GetParent@Element@DirectUI@@QEAAPEAV12@XZ
?GetVisible@Element@DirectUI@@QEAA_NXZ
?GetChildren@Element@DirectUI@@QEAAPEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@PEAPEAVValue@2@@Z
?GetLayoutPos@Element@DirectUI@@QEAAHXZ
?GetExtent@Element@DirectUI@@QEAAPEBUtagSIZE@@PEAPEAVValue@2@@Z
?GetKeyFocused@Element@DirectUI@@UEAA_NXZ
?GetEnabled@Element@DirectUI@@QEAA_NXZ
?SetVisible@Element@DirectUI@@QEAAJ_N@Z
?SetWidth@Element@DirectUI@@QEAAJH@Z
?SetHeight@Element@DirectUI@@QEAAJH@Z
?SetX@Element@DirectUI@@QEAAJH@Z
?SetY@Element@DirectUI@@QEAAJH@Z
?SetLayoutPos@Element@DirectUI@@QEAAJH@Z
?SetContentString@Element@DirectUI@@QEAAJPEBG@Z
?SetAlpha@Element@DirectUI@@QEAAJH@Z
?SetEnabled@Element@DirectUI@@QEAAJ_N@Z
?SetMinSize@Element@DirectUI@@QEAAJHH@Z
?CanSetFocus@HWNDElement@DirectUI@@UEAA_NXZ
?GetHWND@HWNDElement@DirectUI@@UEAAPEAUHWND__@@XZ
?GetHWND@NativeHWNDHost@DirectUI@@QEAAPEAUHWND__@@XZ
?ShowWindow@NativeHWNDHost@DirectUI@@QEAAXH@Z
?Initialize@NativeHWNDHost@DirectUI@@QEAAJPEBGPEAUHWND__@@PEAUHICON__@@HHHHHHI@Z
?SetXOffset@Viewer@DirectUI@@QEAAJH@Z
?SetYOffset@Viewer@DirectUI@@QEAAJH@Z
?GetXOffset@BaseScrollViewer@DirectUI@@QEAAHXZ
?GetYOffset@BaseScrollViewer@DirectUI@@QEAAHXZ
?SetXOffset@BaseScrollViewer@DirectUI@@QEAAJH@Z
?SetYOffset@BaseScrollViewer@DirectUI@@QEAAJH@Z
?UpdateTooltip@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z
?ActivateTooltip@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@K@Z
?RemoveTooltip@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z
?GetClassInfoW@TouchHWNDElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ
?SetInteractionMode@TouchScrollViewer@DirectUI@@QEAAJH@Z
?TriggeredAnimationComplete@PVLAnimation@DirectUI@@SA?AVUID@@XZ
?Initialize@TouchHWNDElement@DirectUI@@QEAAJPEAUHWND__@@_NIPEAVElement@2@PEAK@Z
?MessageCallback@TouchHWNDElement@DirectUI@@UEAAIPEAUtagGMSG@@@Z
?OnInput@TouchHWNDElement@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?OnEvent@TouchHWNDElement@DirectUI@@UEAAXPEAUEvent@2@@Z
?OnKeyFocusMoved@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@0@Z
?OnPropertyChanged@TouchHWNDElement@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?WndProc@TouchHWNDElement@DirectUI@@UEAA_JPEAUHWND__@@I_K_J@Z
?IsMSAAEnabled@TouchHWNDElement@DirectUI@@UEAA_NXZ
?OnDestroy@TouchHWNDElement@DirectUI@@UEAAXXZ
?GetClassInfoPtr@TouchHWNDElement@DirectUI@@SAPEAUIClassInfo@2@XZ
?Register@TouchHWNDElement@DirectUI@@SAJXZ
??0TouchHWNDElement@DirectUI@@QEAA@XZ
??1TouchHWNDElement@DirectUI@@UEAA@XZ
?_OnUIStateChanged@TouchHWNDElement@DirectUI@@MEAAXGG@Z
?GetClassInfoPtr@Viewer@DirectUI@@SAPEAUIClassInfo@2@XZ
?Create@DUIXmlParser@DirectUI@@SAJPEAPEAV12@P6APEAVValue@2@PEBGPEAX@Z2P6AX11H2@Z2@Z
?Destroy@DUIXmlParser@DirectUI@@QEAAXXZ
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@0@Z
?CreateElement@DUIXmlParser@DirectUI@@QEAAJPEBGPEAVElement@2@1PEAKPEAPEAV32@@Z
?CreateInt@Value@DirectUI@@SAPEAV12@HW4DynamicScaleValue@@@Z
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUHBITMAP__@@EI_N11@Z
?ManipulationCompleted@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ
?SetSuppressSetContact@TouchScrollViewer@DirectUI@@QEAAJ_N@Z
??0ClassInfoBase@DirectUI@@QEAA@XZ
??1ClassInfoBase@DirectUI@@UEAA@XZ
?Initialize@ClassInfoBase@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG_NPEBQEBUPropertyInfo@2@I@Z
?Register@ClassInfoBase@DirectUI@@QEAAJXZ
?ClassExist@ClassInfoBase@DirectUI@@SA_NPEAPEAUIClassInfo@2@PEBQEBUPropertyInfo@2@IPEAU32@PEAUHINSTANCE__@@PEBG_N@Z
?AddRef@ClassInfoBase@DirectUI@@UEAAXXZ
?Release@ClassInfoBase@DirectUI@@UEAAHXZ
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?GetByClassIndex@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?GetPICount@ClassInfoBase@DirectUI@@UEBAIXZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UEBAIXZ
?GetName@ClassInfoBase@DirectUI@@UEBAPEBGXZ
?IsValidProperty@ClassInfoBase@DirectUI@@UEBA_NPEBUPropertyInfo@2@@Z
?IsSubclassOf@ClassInfoBase@DirectUI@@UEBA_NPEAUIClassInfo@2@@Z
?GetModule@ClassInfoBase@DirectUI@@UEBAPEAUHINSTANCE__@@XZ
?IsGlobal@ClassInfoBase@DirectUI@@UEBA_NXZ
?AddChild@ClassInfoBase@DirectUI@@UEAAXXZ
?RemoveChild@ClassInfoBase@DirectUI@@UEAAXXZ
?GetChildren@ClassInfoBase@DirectUI@@UEBAHXZ
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UEBAXXZ
?GetClassInfoPtr@Movie@DirectUI@@SAPEAUIClassInfo@2@XZ
?LoadFromResource@Movie@DirectUI@@QEAAJPEAUHINSTANCE__@@H@Z
?Play@Movie@DirectUI@@QEAAXXZ
?Destroy@Element@DirectUI@@QEAAJ_N@Z
?SetValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@@Z
?SetValue@Element@DirectUI@@QEAAJPEBUPropertyInfo@2@HPEAVValue@2@@Z
?RemoveLocalValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZ@Z
?StartDefer@Element@DirectUI@@QEAAXPEAK@Z
?EndDefer@Element@DirectUI@@QEAAXK@Z
?UpdateLayout@Element@DirectUI@@QEAAXXZ
?GetContentStringAsDisplayed@Element@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanged@Element@DirectUI@@UEAAXPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnMouseFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?Paint@Element@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z
?GetContentSize@Element@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?Add@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?Insert@Element@DirectUI@@UEAAJPEAPEAV12@II@Z
?Remove@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z
?IsDescendent@Element@DirectUI@@QEAA_NPEAV12@@Z
?GetAdjacent@Element@DirectUI@@UEAAPEAV12@PEAV12@HPEBUNavReference@2@K@Z
?EnsureVisible@Element@DirectUI@@UEAA_NHHHH@Z
?SetKeyFocus@Element@DirectUI@@UEAAXXZ
?AddListener@Element@DirectUI@@QEAAJPEAUIElementListener@2@@Z
?AddBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
?RemoveBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UEAAXPEAUtagRECT@@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MEAAXHH@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?OnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
?OnUnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
?GetRoot@Element@DirectUI@@QEAAPEAV12@XZ
?GetFactoryLock@Element@DirectUI@@SAPEAU_RTL_CRITICAL_SECTION@@XZ
?ExtentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?ContentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?GetClassInfoPtr@Element@DirectUI@@SAPEAUIClassInfo@2@XZ
?DefaultAction@Element@DirectUI@@UEAAJXZ
?GetUIAElementProvider@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?GetElementProviderImpl@Element@DirectUI@@UEAAJPEAVInvokeHelper@2@PEAPEAVElementProvider@2@@Z
?HandleUiaDestroyListener@Element@DirectUI@@UEAAXXZ
?HandleUiaPropertyListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?HandleUiaEventListener@Element@DirectUI@@UEAAXPEAUEvent@2@@Z
?GetUiaFocusDelegate@Element@DirectUI@@UEAAPEAV12@XZ
StrToID
?Click@TouchButton@DirectUI@@SA?AVUID@@XZ
?Host@NativeHWNDHost@DirectUI@@QEAAXPEAVElement@2@@Z
??0NativeHWNDHost@DirectUI@@QEAA@XZ
??1NativeHWNDHost@DirectUI@@UEAA@XZ
?CreateHostWindow@NativeHWNDHost@DirectUI@@UEAAPEAUHWND__@@KPEBG0KHHHHPEAU3@PEAUHMENU__@@PEAUHINSTANCE__@@PEAX@Z
?OnGroupChanged@HWNDElement@DirectUI@@UEAAXH_N@Z
?OnThemeChanged@HWNDElement@DirectUI@@UEAAXPEAUThemeChangedEvent@2@@Z
?OnImmersiveColorSchemeChanged@HWNDElement@DirectUI@@UEAAXXZ
?OnNoChildWithShortcutFound@HWNDElement@DirectUI@@UEAAXPEAUKeyboardEvent@2@@Z
?OnGetDlgCode@HWNDElement@DirectUI@@UEAAXPEAUtagMSG@@PEA_J@Z
?OnWmThemeChanged@HWNDElement@DirectUI@@UEAAX_K_J@Z
?OnWmSettingChanged@HWNDElement@DirectUI@@UEAAX_K_J@Z
?OnCompositionChanged@HWNDElement@DirectUI@@UEAAXXZ
?CreateStyleParser@HWNDElement@DirectUI@@UEAAJPEAPEAVDUIXmlParser@2@@Z
?GetWindowClassNameAndStyle@HWNDElement@DirectUI@@UEAAXPEAPEBGPEAI@Z
?GetAccessibleImpl@HWNDElement@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
GetScaleFactor
?CreateInstance@CSafeElementProxy@@SAJPEAVElement@DirectUI@@PEAPEAV1@@Z
?Detach@CSafeElementProxy@@QEAAXXZ
DuiCreateObject
RegisterPVLBehaviorFactory
UnInitThread
UnInitProcessPriv
InitThread
InitProcessPriv
?GetTopLevel@Element@DirectUI@@QEAAPEAV12@XZ
?GetRootRelativeBounds@Element@DirectUI@@QEAAJPEAUtagRECT@@@Z
?GetClassInfoPtr@HWNDElement@DirectUI@@SAPEAUIClassInfo@2@XZ
?GetClassInfoPtr@TouchScrollViewer@DirectUI@@SAPEAUIClassInfo@2@XZ
?HandleUiaPropertyChangingListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@@Z
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
sspicli
GetUserNameExW
LogonUserExExW
api-ms-win-service-management-l1-1-0
OpenSCManagerW
OpenServiceW
StartServiceW
CloseServiceHandle
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
124KB
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
52KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
696B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
232KB
Virtual Size
230KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=96, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=21, id=260, version=33145,
count=5, id=259, version=33145,
count=581, id=1, productName=Unmarked objects,
count=11, id=257, version=33145,
count=5, id=261, version=33145,
count=1, id=256, version=33145,
count=45, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
Windows.UI.Search.dll
- IMPHASH 89bbe571c5472e0aaba2f4fb5e2092da
- SHA256 2bff9d7a710f19b6cd54cecfdcb9bd8ae8febd2626ef001c3c9cd2c0d2b7cd56
- MD5 78cc0591dd9a59b75b2e9347c7c4cec7
- SHA1 b8bf78beb0b0ba889cc843b0d4d53185a67e2aa4
- SHA512 92c660f3269e9245e3918b86e47395b6120d40f3018c06f7e2b228bae9b2da3cffa7af20c1edb7c4474636b539a5d1fda8644eaacf74ea43774669e2486991f4
- SSDEEP 12288:snzVQJyjHpEEdT+8KgVwFYwpLVkoytpa5lsSMSvLuP6FhQPJZKkr:szWoSEd68iFXUpa5TvupR
- TLSH T107F4097B6FAC0692D275B17EC5534B0EE3B278550361D3CF0269026E5E2BFE8593A321
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
10768
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Windows.UI.Search.pdb
wincorlib
?GetWeakReference@Details@Platform@@YAPEAU__abi_IUnknown@@QE$ADVObject@2@@Z
??0NotImplementedException@Platform@@QE$AAA@XZ
?__abi_cast_String_to_Object@__abi_details@@YAPE$AAVObject@Platform@@PE$AAVString@3@@Z
?EventSourceRemove@Details@Platform@@YAXPEAPEAXPEAUEventLock@12@VEventRegistrationToken@Foundation@Windows@@@Z
?EventSourceAdd@Details@Platform@@YA?AVEventRegistrationToken@Foundation@Windows@@PEAPEAXPEAUEventLock@12@PE$AAVDelegate@2@@Z
?EventSourceUninitialize@Details@Platform@@YAXPEAPEAX@Z
?EventSourceInitialize@Details@Platform@@YAXPEAPEAX@Z
??0Object@Platform@@QE$AAA@XZ
?ResolveWeakReference@Details@Platform@@YAPE$AAVObject@2@AEBU_GUID@@PEAPEAU__abi_IUnknown@@@Z
?ReCreateFromException@Details@Platform@@YAJPE$AAVException@2@@Z
?__abi_FailFast@@YAXXZ
?GetActivationFactoryByPCWSTR@@YAJPEAXAEAVGuid@Platform@@PEAPEAX@Z
?GetIidsFn@@YAJHPEAKPEBU__s_GUID@@PEAPEAVGuid@Platform@@@Z
?UninitializeData@Details@Platform@@YAXH@Z
?InitializeData@Details@Platform@@YAJH@Z
?GetIBoxArrayVtable@Details@Platform@@YAPEAXPEAX@Z
?CreateValue@Details@Platform@@YAPE$AAVObject@2@W4TypeCode@2@PEBX@Z
?GetIBoxVtable@Details@Platform@@YAPEAXPEAX@Z
??0ChangedStateException@Platform@@QE$AAA@XZ
?GetTypeCode@Type@Platform@@SA?AW4TypeCode@2@PE$AAV12@@Z
?__abi_make_type_id@@YAPE$AAVType@Platform@@AEBU__abi_type_descriptor@@@Z
?__abi_ObjectToString@__abi_details@@YAPE$AAVString@Platform@@PE$AAVObject@3@_N@Z
?get@FullName@Type@Platform@@QE$AAAPE$AAVString@3@XZ
?EventSourceGetTargetArray@Details@Platform@@YAPEAXPEAXPEAUEventLock@12@@Z
?EventSourceGetTargetArraySize@Details@Platform@@YAIPEAX@Z
?EventSourceGetTargetArrayEvent@Details@Platform@@YAPEAXPEAXIPEBXPEA_J@Z
?CreateException@Exception@Platform@@SAPE$AAV12@H@Z
??BType@Platform@@SA?AVTypeName@Interop@Xaml@UI@Windows@@PE$AAV01@@Z
??0OutOfMemoryException@Platform@@QE$AAA@XZ
??0FailureException@Platform@@QE$AAA@XZ
??0OutOfBoundsException@Platform@@QE$AAA@XZ
?__abi_cast_Object_to_String@__abi_details@@YAPE$AAVString@Platform@@_NPE$AAVObject@3@@Z
??0DisconnectedException@Platform@@QE$AAA@XZ
??0NullReferenceException@Platform@@QE$AAA@XZ
?AllocateException@Heap@Details@Platform@@SAPEAX_K0@Z
?__abi_WinRTraiseWrongThreadException@@YAXXZ
?__abi_WinRTraiseObjectDisposedException@@YAXXZ
?__abi_WinRTraiseInvalidCastException@@YAXXZ
?__abi_WinRTraiseNotImplementedException@@YAXXZ
??0Delegate@Platform@@QE$AAA@XZ
?Allocate@Heap@Details@Platform@@SAPEAX_K0@Z
?Free@Heap@Details@Platform@@SAXPEAX@Z
?AlignedFree@Heap@Details@Platform@@SAXPEAX@Z
?GetType@Object@Platform@@QE$AAAPE$AAVType@2@XZ
?ReleaseTarget@ControlBlock@Details@Platform@@AEAAXXZ
?CreateException@Exception@Platform@@SAPE$AAV12@HPE$AAVString@2@@Z
?get@Message@Exception@Platform@@QE$AAAPE$AAVString@3@XZ
?__abi_WinRTraiseDisconnectedException@@YAXXZ
?__abi_WinRTraiseFailureException@@YAXXZ
?__abi_WinRTraiseOperationCanceledException@@YAXXZ
?__abi_WinRTraiseAccessDeniedException@@YAXXZ
?__abi_WinRTraiseInvalidArgumentException@@YAXXZ
?__abi_WinRTraiseClassNotRegisteredException@@YAXXZ
?__abi_WinRTraiseCOMException@@YAXJ@Z
?__abi_WinRTraiseNullReferenceException@@YAXXZ
?__abi_WinRTraiseChangedStateException@@YAXXZ
?__abi_WinRTraiseOutOfBoundsException@@YAXXZ
?__abi_WinRTraiseOutOfMemoryException@@YAXXZ
msvcrt
memcmp
realloc
_set_errno
??_V@YAXPEAX@Z
memmove
_XcptFilter
_amsg_exit
free
_initterm
__C_specific_handler
?terminate@@YAXXZ
_lock
__dllonexit
_onexit
??1type_info@@UEAA@XZ
memcpy
wcscspn
?what@exception@@UEBAPEBDXZ
wcscmp
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_callnewh
malloc
_CxxThrowException
wcslen
memset
__CxxFrameHandler3
memmove_s
wcsstr
wcsrchr
_get_errno
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
_purecall
??3@YAXPEAX@Z
memcpy_s
_vsnwprintf
_wcsicmp
__CxxFrameHandler4
_unlock
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleHandleExW
GetModuleFileNameA
LoadLibraryExW
GetModuleHandleExA
FreeLibrary
GetModuleHandleW
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-1-0
CreateEventExW
ReleaseMutex
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
CreateSemaphoreExW
CreateMutexW
EnterCriticalSection
InitializeSRWLock
ResetEvent
ReleaseSRWLockExclusive
CreateMutexExW
DeleteCriticalSection
WaitForSingleObject
ReleaseSemaphore
InitializeCriticalSectionEx
SetEvent
ReleaseSRWLockShared
WaitForMultipleObjectsEx
LeaveCriticalSection
CreateEventW
InitializeCriticalSection
AcquireSRWLockShared
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceExecuteOnce
Sleep
InitOnceComplete
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
RaiseException
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
api-ms-win-core-winrt-string-l1-1-0
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsCreateStringReference
WindowsDeleteString
WindowsSubstringWithSpecifiedLength
WindowsConcatString
WindowsGetStringRawBuffer
WindowsCompareStringOrdinal
WindowsGetStringLen
WindowsCreateString
WindowsDuplicateString
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventUnregister
EventSetInformation
EventWriteTransfer
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-eventing-classicprovider-l1-1-0
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
UnregisterTraceGuids
TraceMessage
GetTraceLoggerHandle
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
IsThreadpoolTimerSet
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
TlsAlloc
OpenProcessToken
TerminateProcess
TlsFree
GetProcessId
GetCurrentProcess
TlsGetValue
GetCurrentProcessId
TlsSetValue
GetCurrentThreadId
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
RoTransformError
SetRestrictedErrorInfo
RoOriginateError
api-ms-win-core-localization-l1-2-0
LCMapStringW
FindNLSString
GetSystemDefaultLCID
GetUserGeoID
GetSystemPreferredUILanguages
FormatMessageW
GetUserDefaultLangID
LocaleNameToLCID
GetLocaleInfoW
GetSystemDefaultLangID
ResolveLocaleName
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
WideCharToMultiByte
CompareStringW
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-winrt-error-l1-1-1
RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
api-ms-win-core-com-l1-1-0
CoGetCallContext
PropVariantCopy
CoGetStdMarshalEx
CoGetMalloc
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoReleaseMarshalData
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
StringFromCLSID
CoCreateGuid
CoGetApartmentType
CoWaitForMultipleHandles
CoDisableCallCancellation
CoEnableCallCancellation
CoCancelCall
PropVariantClear
CoCreateInstance
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
LocalReAlloc
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoActivateInstance
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegGetValueW
RegCloseKey
RegQueryValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
api-ms-win-core-shlwapi-obsolete-l1-1-0
QISearch
StrCmpICW
StrStrIW
StrCmpNICW
api-ms-win-core-localization-obsolete-l1-2-0
GetUserDefaultUILanguage
api-ms-win-core-threadpool-legacy-l1-1-0
DeleteTimerQueueTimer
CreateTimerQueueTimer
api-ms-win-core-kernel32-legacy-l1-1-0
UnregisterWait
RegisterWaitForSingleObject
api-ms-win-core-com-private-l1-1-0
CoRevokeInitializeSpy
CoRegisterInitializeSpy
shcore
ord246
ord245
ord230
ord232
SHGetThreadRef
IUnknown_QueryService
ord244
IUnknown_SetSite
IUnknown_Set
ord141
SHCreateThreadWithHandle
SHTaskPoolGetUniqueContext
GetScaleFactorForMonitor
IStream_Write
ord188
ord233
SHTaskPoolQueueTask
urlmon
IsValidURL
ntdll
WinSqmIsOptedIn
WinSqmAddToStream
RtlNtStatusToDosError
RtlPublishWnfStateData
RtlCompareUnicodeString
RtlNtStatusToDosErrorNoTeb
RtlAllocateHeap
RtlInitUnicodeString
NtQueryInformationToken
RtlFreeHeap
iswalnum
RtlQueryResourcePolicy
RtlFlushHeaps
wcschr
user32
CreateWindowInBand
ord2561
IsWindowInDestroy
CreateWindowInBandEx
SetWindowCompositionAttribute
ToUnicodeEx
SetKeyboardState
GetKeyboardState
GetWindowThreadProcessId
GetAncestor
GetWindowLongPtrW
SetWindowLongPtrW
IsWindowUnicode
DefWindowProcA
GetPointerInfo
GetQueueStatus
MoveWindow
PostThreadMessageW
AttachThreadInput
ord2521
PostQuitMessage
TranslateMessage
LoadCursorW
SetCursor
SetRectEmpty
GetWindow
PostMessageW
DispatchMessageW
PeekMessageW
GetKeyboardLayout
ActivateKeyboardLayout
SystemParametersInfoW
RegisterWindowMessageW
RemovePropW
GetParent
SetForegroundWindow
ShowWindow
RegisterClassExW
DefWindowProcW
GetForegroundWindow
DestroyWindow
GetAsyncKeyState
GetDC
ReleaseDC
GetKeyState
MsgWaitForMultipleObjectsEx
IsWindowVisible
SetPropW
shell32
SHCreateItemInKnownFolder
ord102
SHGetPropertyStoreForWindow
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
api-ms-win-core-file-l1-1-0
CompareFileTime
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-localization-l1-2-2
LCIDToLocaleName
api-ms-win-core-shlwapi-legacy-l1-1-0
PathMatchSpecExW
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
488KB
Virtual Size
485KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
160KB
Virtual Size
159KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
36KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
544B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=100, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=72, id=260, version=33145,
count=28, id=261, version=33145,
count=15, id=257, version=33145,
count=573, id=1, productName=Unmarked objects,
count=1, id=256, version=33145,
count=87, id=265, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
Windows.UI.Shell.Internal.AdaptiveCards.dll
- IMPHASH fdc9b63bd584957d1c4a45dd884ee279
- SHA256 0f668bbbd73580e0e8d9baf3bf4703fdd10ad26fa39e18f2bf396fe6a1632d31
- MD5 b8b62dc450d750e7116657440be1d62e
- SHA1 cdda85aca8f32f2a733472156d78b1c210501c12
- SHA512 819e18fece2505db3cb40ad968c2d5cc12782de7a813061b57a797bccf80fe5f4055b28d5a720e89a045aa952a8866e937eb0530ce96801bad84d44d984b0362
- SSDEEP 24576:omSdu9m1bfFDvbBphpA8EF7ArLIlcgMdQ:omSdu9m1VcmMlcg
- TLSH T104551867699801E5EBB9E17C892B8A0AE7713802437197CF0355614DAF7FBD48F3A720
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
8528
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Windows.UI.Shell.Internal.AdaptiveCards.pdb
msvcp_win
_Strcoll
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?tolower@?$ctype@D@std@@QEBADD@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?good@ios_base@std@@QEBA_NXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Xbad_function_call@std@@YAXXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Xruntime_error@std@@YAXPEBD@Z
?_Makeloc@_Locimp@locale@std@@CAPEAV123@AEBV_Locinfo@3@HPEAV123@PEBV23@@Z
?_Getname@_Locinfo@std@@QEBAPEBDXZ
??0_Locinfo@std@@QEAA@HPEBD@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@_N@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?flags@ios_base@std@@QEBAHXZ
?uncaught_exception@std@@YA_NXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?id@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?_Getcat@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?put@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@GPEBUtm@@PEBG3@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
_Strxfrm
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
?imbue@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??Bid@locale@std@@QEAA_KXZ
?id@?$ctype@D@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Incref@facet@locale@std@@UEAAXXZ
?in@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
??0facet@locale@std@@IEAA@_K@Z
??0_Lockit@std@@QEAA@H@Z
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Lockit@std@@QEAA@XZ
??1_Locinfo@std@@QEAA@XZ
??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??1facet@locale@std@@MEAA@XZ
??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?id@?$collate@D@std@@2V0locale@2@A
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z
?_Xbad_alloc@std@@YAXXZ
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z
?eof@ios_base@std@@QEBA_NXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@AEAD@Z
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?unget@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
??7ios_base@std@@QEBA_NXZ
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__localtime64_s
_o__mktime64
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__dclass
_o__strnicmp
memcpy
_o__wtof
_o_ceilf
_o_floorf
_o_free
_o_isalnum
_o_isalpha
_o_iscntrl
_o_isdigit
_o_ispunct
_o_isspace
_o_isxdigit
_o_malloc
_o_modf
_o_realloc
_o_strftime
_o_strtol
_o_strtoul
_o_terminate
_o_toupper
__C_specific_handler
__CxxFrameHandler3
__current_exception
__current_exception_context
memmove
_CxxThrowException
memchr
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
memcmp
strchr
api-ms-win-crt-string-l1-1-0
memset
rpcrt4
NdrOleAllocate
NdrOleFree
NdrDllCanUnloadNow
NdrDllGetClassObject
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
HSTRING_UserFree64
WindowsCreateStringReference
WindowsCompareStringOrdinal
WindowsDuplicateString
HSTRING_UserSize64
WindowsIsStringEmpty
HSTRING_UserFree
WindowsStringHasEmbeddedNull
WindowsCreateString
WindowsGetStringRawBuffer
HSTRING_UserMarshal64
HSTRING_UserUnmarshal
HSTRING_UserMarshal
HSTRING_UserUnmarshal64
HSTRING_UserSize
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoTaskMemFree
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
GetRestrictedErrorInfo
RoOriginateError
SetRestrictedErrorInfo
RoOriginateErrorW
api-ms-win-core-synch-l1-1-0
AcquireSRWLockShared
CreateSemaphoreExW
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ReleaseSRWLockExclusive
ResetEvent
AcquireSRWLockExclusive
ReleaseSRWLockShared
InitializeCriticalSectionEx
InitializeSRWLock
WaitForSingleObjectEx
CreateEventW
ReleaseSemaphore
ReleaseMutex
CreateMutexExW
OpenSemaphoreW
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleHandleW
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleExW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
RaiseException
SetLastError
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoActivateInstance
api-ms-win-crt-math-l1-1-0
_isnan
_finite
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventRegister
EventUnregister
EventWriteTransfer
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
860KB
Virtual Size
859KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
348KB
Virtual Size
344KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=56, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=11, id=260, version=33145,
count=5, id=259, version=33145,
count=1343, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=38, id=261, version=33145,
count=1, id=256, version=33145,
count=135, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
Windows.UI.Shell.dll
- IMPHASH f8960f67aa15aeaee5624691ab47eaca
- SHA256 c2ccbc455a17ab0af7621e1687fb24469d1802e53754691b7f1cd1a0136e05eb
- MD5 256256fed70fd5d6d004c07e394c264d
- SHA1 1e5712fd5f9b816e145cde2ffbb23922ade47eec
- SHA512 187ab8e8ed615f30b8c0d9d22dc2218d34a297808ef0b02cf9150d1d1113ddf941670e91129fc298ad0136618ab69b682381f6a49b9029453393750b55365005
- SSDEEP 1536:dJZlZ4DhtnimLtQGLN3zvL6CPKVkPQAO:dJO7iwBzvnPK6i
- TLSH T11B734B8E6AEA24D9F136D13DC5930A19E1B1F4215B5283EF43B042AF1F33BE85439B55
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
15632
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Windows.UI.Shell.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memcpy
_o___std_type_info_destroy_list
_o_free
_o_malloc
__C_specific_handler
_o___stdio_common_vswprintf
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
__CxxFrameHandler3
_CxxThrowException
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
ReleaseSRWLockShared
AcquireSRWLockShared
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
SetLastError
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA
GetProcAddress
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-com-l1-1-0
CoCreateInstance
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
ntdll
NtQueryWnfStateData
RtlUnsubscribeWnfStateChangeNotification
RtlSubscribeWnfStateChangeNotification
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolQueueTask
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
32KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
388B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=49, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1125, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=25, id=261, version=33145,
count=1, id=256, version=33145,
count=4, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
Windows.UI.Storage.dll
- IMPHASH 1e8d36a6f4aa4eed591c4ac2b1c0f760
- SHA256 847cdda0ec4e195d6b787088a575279fc5eeef15b740a482c2c03e82aca7cf76
- MD5 731abb1fb56d65138e703d253e5654f6
- SHA1 1664a2240532687c236efa1bee5ca8547f87a738
- SHA512 e200fa3cddac3f22b9f4e34757db02029685237f841eae70f3d2e3cb1a4b1349fdec9d8fa4206afdd46cf5412e1b03b7ca7c7c9c072a52bce8121e987d2ebe5f
- SSDEEP 6144:SnYdsb28ZikLkltjSrzb2hmIXtCcxYttH:XsbfZikwnjSrzb2hBM
- TLSH T1D5644A2F76ED05A7F2B6D13DC9934B09E271B8115722D2CF02A1026D6E27FE4AC39761
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
10704
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Windows.UI.Storage.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__cexit
memmove
_o__wcslwr
_o_abort
_o_free
_o_iswspace
_o_malloc
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
_o__callnewh
_o___stdio_common_vswprintf
_o__crt_atexit
_o__configure_narrow_argv
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__execute_onexit_table
_o__wcsicmp
wcschr
__CxxFrameHandler3
_CxxThrowException
_o__errno
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
wcscspn
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetProcAddress
GetModuleHandleExW
GetModuleFileNameW
DisableThreadLibraryCalls
GetModuleHandleExA
LoadLibraryExW
GetModuleFileNameA
FreeLibrary
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockExclusive
InitializeSRWLock
ReleaseSRWLockShared
ReleaseMutex
OpenSemaphoreW
WaitForSingleObject
AcquireSRWLockShared
ReleaseSemaphore
InitializeCriticalSectionEx
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
AcquireSRWLockExclusive
CreateMutexExW
WaitForSingleObjectEx
CreateEventExW
SetEvent
CreateSemaphoreExW
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
RaiseException
GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
OpenThreadToken
GetCurrentProcess
OpenProcessToken
TerminateProcess
GetCurrentThread
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
WideCharToMultiByte
api-ms-win-core-winrt-error-l1-1-0
GetRestrictedErrorInfo
RoOriginateErrorW
RoOriginateError
SetRestrictedErrorInfo
RoTransformError
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceExecuteOnce
InitOnceBeginInitialize
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsReplaceString
WindowsDuplicateString
WindowsCreateString
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsSubstringWithSpecifiedLength
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetWindowsDirectoryW
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-interlocked-l1-1-0
InterlockedPushEntrySList
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
OpenProcess
IsProcessorFeaturePresent
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoWaitForMultipleHandles
CoRevertToSelf
CoReleaseMarshalData
CoGetMalloc
CoCreateFreeThreadedMarshaler
CreateStreamOnHGlobal
CoMarshalInterface
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventUnregister
EventRegister
EventActivityIdControl
EventSetInformation
ntdll
RtlPublishWnfStateData
RtlGetDeviceFamilyInfoEnum
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoActivateInstance
api-ms-win-core-winrt-error-l1-1-1
RoReportFailedDelegate
IsErrorPropagationEnabled
RoGetMatchingRestrictedErrorInfo
RoOriginateLanguageException
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
api-ms-win-security-base-l1-1-0
AddAce
GetLengthSid
GetAclInformation
EqualSid
GetAce
DuplicateTokenEx
InitializeAcl
DeleteAce
GetTokenInformation
api-ms-win-security-capability-l1-1-0
CapabilityCheck
api-ms-win-shell-shellcom-l1-1-0
SHCoCreateInstance
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolQueueTask
SHTaskPoolAllowThreadReuse
combase
ord168
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-security-provider-l1-1-0
GetSecurityInfo
SetSecurityInfo
api-ms-win-core-psapi-l1-1-0
K32GetModuleFileNameExW
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegSetValueExW
RegGetValueW
RegCreateKeyExW
RegCloseKey
RegQueryInfoKeyW
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-shlwapi-obsolete-l1-1-0
QISearch
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
FileTimeToSystemTime
api-ms-win-shcore-registry-l1-1-0
SHSetValueW
oleaut32
SysStringLen
SetErrorInfo
GetErrorInfo
SysFreeString
api-ms-win-core-string-l2-1-0
CharLowerBuffW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-shell-changenotify-l1-1-0
SHChangeNotify
api-ms-win-shell-namespace-l1-1-0
SHParseDisplayName
ILFree
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
164KB
Virtual Size
163KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
104KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=103, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33145,
count=5, id=259, version=33145,
count=1251, id=1, productName=Unmarked objects,
count=4, id=257, version=33145,
count=29, id=261, version=33145,
count=1, id=256, version=33145,
count=18, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
Windows.UI.Xaml.Controls.dll
- IMPHASH dc91da57405dfaf572437863b0ac06d7
- SHA256 b7bec60d0cbb92454a8ee218100b8f2c1f8b4fb25814dc99c841bb85082bc549
- MD5 17bf497cc1b8ef69681eb9de5571c3c8
- SHA1 528b3011fc209164ef325380c94c026c6be09d0b
- SHA512 2a3903c24af02e50b1b745f30270855b1dcc6fa3fa76b12abb25421f43ea79511f4b26eecdf900092922170af3bbf29e3df6d417ad8f0c0eaefad83b55ec8bb7
- SSDEEP 49152:BizXq7xgws1KIkOtSNOVHPRWvikJP7vCd81HPfJBLq2IHpfQVRzYnK4AkD2IvgVr:wVHPRWvikJP73Bq2IHxQVRIX0
- TLSH T173E5F65956A907E5E1FAE93CDAA7890FE5B13C25837387CF0175014A4F27FE8813E622
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
281264
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Windows.UI.Xaml.Controls.pdb
api-ms-win-core-processthreads-l1-1-0
TlsSetValue
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
TlsGetValue
GetCurrentThreadId
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventRegister
EventUnregister
EventSetInformation
api-ms-win-core-libraryloader-l1-2-0
LoadResource
LockResource
SizeofResource
GetModuleHandleExW
GetProcAddress
FreeLibrary
GetModuleHandleW
DisableThreadLibraryCalls
LoadLibraryExW
GetModuleFileNameA
FindResourceExW
api-ms-win-core-localization-l1-2-0
GetLocaleInfoEx
FormatMessageW
SetProcessPreferredUILanguages
GetLocaleInfoW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-synch-l1-1-0
ReleaseSemaphore
LeaveCriticalSection
ResetEvent
InitializeCriticalSectionEx
WaitForSingleObject
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
CreateEventW
AcquireSRWLockShared
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
EnterCriticalSection
CreateSemaphoreExW
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
RaiseException
SetLastError
UnhandledExceptionFilter
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapSize
HeapFree
HeapAlloc
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoCreateGuid
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
RoTransformError
RoOriginateError
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsCreateString
WindowsGetStringRawBuffer
WindowsIsStringEmpty
WindowsCreateStringReference
WindowsStringHasEmbeddedNull
api-ms-win-core-libraryloader-l1-2-1
FindResourceW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-winrt-errorprivate-l1-1-0
RoFailFastWithErrorContextInternal2
api-ms-win-crt-private-l1-1-0
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__dclass
_o__errno
_o__execute_onexit_table
_o__fdclass
_o__free_base
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__malloc_base
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsicmp
_o__wcsnicmp
_o__wtoi
_o_abort
_o_atan2
_o_ceil
_o_ceilf
_o_cos
_o_floor
_o_iswspace
_o_pow
_o_round
_o_roundf
_o_sin
_o_sqrt
_o_terminate
_o_towupper
_o_wcstoul
__CxxFrameHandler4
__std_terminate
__CxxFrameHandler3
__current_exception_context
__current_exception
__C_specific_handler
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___stdio_common_vswprintf
_CxxThrowException
memcmp
memcpy
memmove
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
_wassert
api-ms-win-crt-string-l1-1-0
wcsncmp
memset
msvcp_win
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z
?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W0@Z
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_lock
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_unlock
?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z
??Bios_base@std@@QEBA_NXZ
?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
api-ms-win-core-processenvironment-l1-1-0
SearchPathW
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
api-ms-win-core-localization-obsolete-l1-2-0
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
api-ms-win-core-file-l1-1-0
CreateFileW
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetVersionExW
api-ms-win-core-memory-l1-1-0
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
api-ms-win-core-localization-l1-2-2
LCIDToLocaleName
api-ms-win-core-featurestaging-l1-1-0
RecordFeatureUsage
UnsubscribeFeatureStateChangeNotification
SubscribeFeatureStateChangeNotification
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-errorhandling-l1-1-3
TerminateProcessOnMemoryExhaustion
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-interlocked-l1-1-0
InterlockedPushEntrySList
InterlockedFlushSList
InitializeSListHead
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
combase
GetErrorInfo
SetErrorInfo
oleaut32
SysFreeString
SysStringLen
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-com-l1-1-1
RoGetAgileReference
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllMain
GetDependencyLocatorStorage
SendTelemetryOnSuspend
XamlTestHookFreeControlsResourceLibrary
Name
.text
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
587KB
Virtual Size
586KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
15KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
165KB
Virtual Size
164KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
63KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
42KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=28, id=261, version=33145,
count=91, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=257, version=33145,
count=1267, id=1, productName=Unmarked objects,
count=1, id=253, version=33145,
count=264, id=265, version=33145,
count=1, id=256, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
Windows.UI.Xaml.InkControls.dll
- IMPHASH a029989ece4f4875a88e944379f46cda
- SHA256 db021cf7588929ae5a2356e1dfd3a7e0d6d2570ebf261be64a85e8b90202c330
- MD5 9a4ea19e6c63514fb3ef872c4f662a20
- SHA1 7e9708bdb45b0b1e90734a03177df561a7f04331
- SHA512 3ca7226d60f260abdcec61743f494adce1a4f7b2a949185a4d687ee09e90aa6b864508223f02745de9685be277fd453a121f16a033b64f2e4d75f0a377c4118e
- SSDEEP 6144:VKaQZ9O7yW6Lnd9ypXkPITGXHSQtKcnzPexSNRDmUapav5Z1vm+O3+7oLlKSQtUK:VKaXmUynP2SNtmU/v5wKSQp+FT4H/
- TLSH T10E052B2E1AED01D2E9B0F13CD6574A1AF271B4516731D2CF0295029E8EAFBE4D53B721
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
10064
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Windows.UI.Xaml.InkControls.pdb
msvcp_win
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_unlock
?_Xlength_error@std@@YAXPEBD@Z
_Mtx_init_in_situ
_Mtx_lock
?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA
?_Xbad_function_call@std@@YAXXZ
_Mtx_destroy_in_situ
api-ms-win-crt-runtime-l1-1-0
_invoke_watson
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_atan2f
_o_ceilf
_o_cosf
_o_fmodf
_o_sinf
_o_sqrtf
__C_specific_handler
_o__cexit
_o__execute_onexit_table
_o__errno
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o__crt_atexit
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o__configure_narrow_argv
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
wcsstr
__std_terminate
__CxxFrameHandler4
_CxxThrowException
memcpy
api-ms-win-crt-string-l1-1-0
wcscmp
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
DisableThreadLibraryCalls
GetModuleHandleExA
FreeLibrary
GetModuleHandleExW
LockResource
GetModuleHandleW
LoadLibraryExW
LoadResource
FindResourceExW
GetProcAddress
api-ms-win-core-featurestaging-l1-1-0
RecordFeatureUsage
SubscribeFeatureStateChangeNotification
UnsubscribeFeatureStateChangeNotification
api-ms-win-core-synch-l1-1-0
AcquireSRWLockShared
ReleaseSRWLockShared
ReleaseSemaphore
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseMutex
CreateSemaphoreExW
WaitForSingleObject
CreateMutexExW
CreateEventW
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapSize
HeapAlloc
HeapFree
api-ms-win-core-errorhandling-l1-1-0
GetLastError
RaiseException
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentProcess
TlsFree
TlsGetValue
TerminateProcess
TlsSetValue
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
FormatMessageW
SetProcessPreferredUILanguages
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventWriteTransfer
EventRegister
EventUnregister
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
SetRestrictedErrorInfo
RoOriginateErrorW
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-core-winrt-errorprivate-l1-1-0
RoFailFastWithErrorContextInternal2
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsIsStringEmpty
WindowsDuplicateString
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsGetStringLen
WindowsCreateStringReference
WindowsDeleteString
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoActivateInstance
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureStackBackTrace
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-com-l1-1-0
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
CoTaskMemFree
api-ms-win-eventing-classicprovider-l1-1-0
TraceEvent
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount64
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegOpenKeyExW
RegGetValueW
RegCloseKey
api-ms-win-core-errorhandling-l1-1-3
TerminateProcessOnMemoryExhaustion
api-ms-win-core-quirks-l1-1-0
QuirkIsEnabled
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
RoClearError
bcp47langs
LanguageListAsMuiForm
GetApplicationLanguages
combase
ord90
ord157
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
GetDependencyLocatorStorage
XamlTestHookFreeInkControlsResourceLibrary
Name
.text
Size
540KB
Virtual Size
539KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
196KB
Virtual Size
194KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
36KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=78, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=1217, id=1, productName=Unmarked objects,
count=7, id=257, version=33145,
count=22, id=261, version=33145,
count=1, id=256, version=33145,
count=60, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
Windows.UI.Xaml.Maps.dll
- IMPHASH 067d9734631f331dd8a40c29b7224e2b
- SHA256 5f7bd9d1d2338147bd21b77ea5c3ffa1491de6a9b087534356355829fa829228
- MD5 9aa766c88b367b2dc90e508d67e476d6
- SHA1 08a6233dcbc0746a74a651d3172cb6299cb5e29d
- SHA512 6a61d3b16489a2ec9cdd18dfa429390b1150784d5775c65d9c2762c7b200451debbbb70de17be015b22adfda5ab80c467e0a08c719914ca43c5c252c6ce4599f
- SSDEEP 12288:9h08uIhx8CT2U6glJ6BLRuxSEILrzlYYB+buJ4ru+HWvtIjW6MWFj55a:9fh+0rIPzltB+6F+HWlIbMq2
- TLSH T15A55E71A1BF98342EAB5A23CC6A74559D77378066B71D2CF011C025E8F77BD1D83AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
65088
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Windows.UI.Xaml.Maps.pdb
msvcp_win
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
_Mtx_destroy_in_situ
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_unlock
?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA
?_Xlength_error@std@@YAXPEBD@Z
_Mtx_init_in_situ
_Mtx_lock
api-ms-win-crt-runtime-l1-1-0
_initterm
_invoke_watson
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__itow_s
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsnicmp
_o_atan
_o_atan2
_o_ceilf
_o_cos
_o_floor
_o_fmod
_o_free
_o_malloc
_o_realloc
_o_sin
_o_sqrt
_o_tan
__C_specific_handler
_o__cexit
_o__execute_onexit_table
_o__errno
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o__crt_atexit
wcsstr
_o__configure_narrow_argv
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
LockResource
FindResourceExW
FreeLibrary
LoadResource
GetModuleHandleExW
DisableThreadLibraryCalls
LoadLibraryExW
GetModuleFileNameA
GetProcAddress
GetModuleHandleW
api-ms-win-core-featurestaging-l1-1-0
RecordFeatureUsage
UnsubscribeFeatureStateChangeNotification
SubscribeFeatureStateChangeNotification
api-ms-win-core-synch-l1-1-0
OpenSemaphoreW
ReleaseMutex
ReleaseSRWLockShared
ReleaseSRWLockExclusive
CreateMutexExW
AcquireSRWLockShared
WaitForSingleObject
WaitForSingleObjectEx
ReleaseSemaphore
InitializeCriticalSectionEx
CreateEventExW
CreateSemaphoreExW
AcquireSRWLockExclusive
EnterCriticalSection
CreateEventW
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
InitializeSRWLock
api-ms-win-core-heap-l1-1-0
HeapSize
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
RaiseException
GetLastError
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
OpenProcessToken
TlsFree
GetCurrentThreadId
TlsGetValue
TlsSetValue
api-ms-win-core-localization-l1-2-0
SetProcessPreferredUILanguages
GetLocaleInfoEx
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventUnregister
EventSetInformation
EventActivityIdControl
EventWriteTransfer
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-winrt-error-l1-1-0
GetRestrictedErrorInfo
RoTransformError
RoOriginateError
SetRestrictedErrorInfo
RoOriginateErrorW
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
api-ms-win-core-winrt-errorprivate-l1-1-0
RoFailFastWithErrorContextInternal2
api-ms-win-core-winrt-string-l1-1-0
WindowsDuplicateString
WindowsCreateString
WindowsDeleteString
WindowsCreateStringReference
WindowsIsStringEmpty
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsCompareStringOrdinal
WindowsConcatString
api-ms-win-core-winrt-error-l1-1-1
IsErrorPropagationEnabled
RoClearError
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate
api-ms-win-core-com-l1-1-0
CoCreateGuid
CoReleaseMarshalData
CoMarshalInterface
CoGetApartmentType
CoCreateInstance
CoTaskMemRealloc
CoWaitForMultipleHandles
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CreateStreamOnHGlobal
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlCaptureStackBackTrace
RtlLookupFunctionEntry
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoGetActivationFactory
api-ms-win-eventing-classicprovider-l1-1-0
TraceEvent
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemTime
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegQueryValueExW
RegGetValueW
RegOpenKeyExW
api-ms-win-core-errorhandling-l1-1-3
TerminateProcessOnMemoryExhaustion
api-ms-win-core-quirks-l1-1-0
QuirkIsEnabled
api-ms-win-core-psm-app-l1-1-0
PsmUnregisterAppStateChangeNotification
PsmRegisterAppStateChangeNotification
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-winrt-robuffer-l1-1-0
RoGetBufferMarshaler
bcp47langs
LanguageListAsMuiForm
GetApplicationLanguages
combase
ord157
ord90
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
GetDependencyLocatorStorage
XamlTestHookFreeMapsResourceLibrary
Name
.text
Size
852KB
Virtual Size
849KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
296KB
Virtual Size
294KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
52KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
24KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
28KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=88, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=11, id=260, version=33145,
count=5, id=259, version=33145,
count=1236, id=1, productName=Unmarked objects,
count=7, id=257, version=33145,
count=20, id=261, version=33145,
count=1, id=256, version=33145,
count=90, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
Windows.UI.Xaml.Phone.dll
- IMPHASH a9f7562bece8ac4fefcf88e319d89d61
- SHA256 b3379f090dd031c2435de7f0d25d14f952f105ec4a6b6467a7b031e0b378d878
- MD5 852f342cd8f7c7597ff73f3ab7c73252
- SHA1 c13bb1f2d6779a7e1c901aa0413bf3b1f3e22a81
- SHA512 cc8a3e89d1c45bbda8e52630a9534eb2c993cb5cacb12dc0aedb77a30635b490bff350848a578ca17f2ac8c9468fa14cbc1bf5606bd37627e5d2fdf95fba02c3
- SSDEEP 12288:qPnwC0UbBZd76Z4wp8x6xX0vG5F5yGsraXQIFsFANn2rqmwROqsM:IwtUbBz76Znp8z+5FIrdE2WmSM
- TLSH T18945A31B1AE805D0E7B5727C82174E1EFB717402376292CB1254456E8FBBFE29C7AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
9376
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Windows.UI.Xaml.Phone.pdb
msvcp_win
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA
_Mtx_init_in_situ
?_Xbad_function_call@std@@YAXXZ
_Mtx_unlock
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@H@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@N@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@M@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@_J@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@F@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@I@Z
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_lock
_Mtx_destroy_in_situ
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
_invoke_watson
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_ceilf
_o_floor
__C_specific_handler
_o__execute_onexit_table
_o__errno
_o___stdio_common_vswprintf
_o__cexit
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__crt_atexit
_o__configure_narrow_argv
_CxxThrowException
memcmp
memcpy
__std_terminate
__CxxFrameHandler4
wcsstr
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
LoadResource
FindResourceExW
GetProcAddress
DisableThreadLibraryCalls
FreeLibrary
GetModuleHandleExW
LoadLibraryExW
GetModuleHandleW
LockResource
api-ms-win-core-featurestaging-l1-1-0
UnsubscribeFeatureStateChangeNotification
GetFeatureEnabledState
RecordFeatureUsage
SubscribeFeatureStateChangeNotification
api-ms-win-core-synch-l1-1-0
WaitForSingleObject
InitializeSRWLock
InitializeCriticalSectionEx
AcquireSRWLockShared
ReleaseMutex
ReleaseSemaphore
CreateSemaphoreExW
CreateMutexExW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WaitForSingleObjectEx
ReleaseSRWLockShared
OpenSemaphoreW
CreateEventW
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
HeapSize
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
SetLastError
RaiseException
UnhandledExceptionFilter
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
TlsFree
TerminateProcess
TlsGetValue
TlsSetValue
api-ms-win-core-localization-l1-2-0
FormatMessageW
SetProcessPreferredUILanguages
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventRegister
EventUnregister
EventWriteTransfer
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
RoOriginateError
SetRestrictedErrorInfo
RoTransformError
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
api-ms-win-core-winrt-errorprivate-l1-1-0
RoFailFastWithErrorContextInternal2
api-ms-win-core-winrt-string-l1-1-0
WindowsConcatString
WindowsCreateStringReference
WindowsDeleteString
WindowsCreateString
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsDuplicateString
WindowsCompareStringOrdinal
api-ms-win-core-winrt-error-l1-1-1
IsErrorPropagationEnabled
RoClearError
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoCreateFreeThreadedMarshaler
StringFromGUID2
CoTaskMemAlloc
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoActivateInstance
api-ms-win-eventing-classicprovider-l1-1-0
TraceEvent
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
ntdll
RtlCaptureStackBackTrace
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegGetValueW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-errorhandling-l1-1-3
TerminateProcessOnMemoryExhaustion
api-ms-win-core-quirks-l1-1-0
QuirkIsEnabled
api-ms-win-rtcore-ntuser-private-l1-1-7
IsOneCoreTransformMode
bcp47langs
LanguageListAsMuiForm
GetApplicationLanguages
combase
ord157
ord90
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
CreateApplicationBarProxy
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
GetDependencyLocatorStorage
SendTelemetryOnSuspend
XamlControlsCalculateFlyoutPlacement
XamlControlsGetDatePickerSelection
XamlControlsGetListPickerSelection
XamlControlsGetPlatformMetadataProvider
XamlControlsGetPlatformResourcesModuleHandle
XamlControlsGetTimePickerSelection
XamlControlsTestHookCreateLoopingSelector
XamlTestHookFreePhoneResourceLibrary
Name
.text
Size
980KB
Virtual Size
976KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
168KB
Virtual Size
165KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=88, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=1287, id=1, productName=Unmarked objects,
count=9, id=257, version=33145,
count=21, id=261, version=33145,
count=1, id=256, version=33145,
count=86, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
Windows.UI.Xaml.Resources.19h1.dll
- SHA256 4fcdfb207c0f62885a6ad20380af5e6beef4e093829e0e41575f58437b75463c
- MD5 945070325ab1de21d491775080847256
- SHA1 3a17c38aae92a1f972670798148e3a9e6627da01
- SHA512 55280ae4f4864265f7c66cffa51d2cb20ae5a54824e968a71ca349bb58bc9b888c84d7018e21eade600cc31d1b62fa61a127e954000acc88d87ca3cfe3bd4d26
- SSDEEP 6144:OY3WUYr4CDQfY1wGUouTuqGrA6mxro+q/hrI0mRMSi70aeGPhO6AdtUtt/tM1xvq:x3Wzpr5mRMS8/tSxvcDKBP
- TLSH T11DE4FD01A7FB1248F3F36FB06EFA492418B7BE526A31C17F4014164E1A71F85AAA5773
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
4KB
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
688KB
Virtual Size
687KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=33138,
count=1, id=258, version=33138,
Windows.UI.Xaml.Resources.21h1.dll
- SHA256 13636286b41b495d43481f60cd040919ed1da31408ce6ccffdb74ee09fba19ac
- MD5 3e464f05fde9e638318a3dc8f976cda6
- SHA1 f847abff16d66d1e6a9d33c6fba3a983ff9d0597
- SHA512 686d53125428591348f7b7b9856086d3ccd353a49f811183a264a7daef1d71777be30aac6c02274dfd45f9034fdd20d735876f34c919e2f62568138558774e22
- SSDEEP 6144:iY3WUYr4CDQfY1wGUouTuqGrA6mxro+q/hrI0mRMSzI0aeGPhO6AdtURemzTbPPz:t3Wzpr5mRMSDcvP1JyPDZG
- TLSH T159E4FF01A7FB1248F3F36FB06EFA492418B7BE526A31D17F4004164E1A71F86AA95773
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
4KB
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
688KB
Virtual Size
687KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=33138,
count=1, id=258, version=33138,
Windows.UI.Xaml.Resources.Common.dll
- SHA256 769a03d263032c205c3c0b1712cc2c843f3b9db1c47ef12af7ccb6f05f89197f
- MD5 18517040ea272c53e24a4557db708892
- SHA1 c715b8542da59b160dc4220345ac49d143ae58ea
- SHA512 de460646b39c714f26a0f9b417f954f01cf2ab69bad6b69e3c58842b522ef01cf6a4ad8c5c12c8e0f47e94ad527783000d02b553f28cac6b95e45ccde5b147e4
- SSDEEP 768:w5enEEdKuC0eJ1MH5+1FMoy0CkrSaDWKFxGd1pUBsQOTk1P:qenEEcuVQiHaeHrG9BsQOTk9
- TLSH T1C833FD5067F95208F6F73F74AEB95A640E7ABCAAAD79C21D1210904E5972F40CDB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
4KB
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
44KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=33138,
count=1, id=258, version=33138,
Windows.UI.Xaml.Resources.rs1.dll
- SHA256 d6c353d75c944e3d168adbff5d40a5fdc753de48d625779a19f41f5d515f6c82
- MD5 09098dc13070dd4b690dc53681044860
- SHA1 f9cce4f915adf3abf4a7f800da25b5dfcda19dd7
- SHA512 a2d545bbd94afbfb9f9e8b78e75037deddd00bb7674a31e01372ffb044425abcab3502b0bf578e79d44c5ad70bc61f04a9d62ba974bf92134000cfe2cb25279a
- SSDEEP 6144:av36FBQBEGm90aeGPhzGDFd9ichdcX+QAKc0:C36EzBca1Qb
- TLSH T1BBA4EC05E7FA1148F3F76BB06EFE492418B3BE536A31D07F40041A4E1A72F859AA5763
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
4KB
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
444KB
Virtual Size
443KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=33138,
count=1, id=258, version=33138,
Windows.UI.Xaml.Resources.rs2.dll
- SHA256 aefa8021a895e50c1e8b92a5686189c6eef6d8ff494bcefcd72b767c6433cba3
- MD5 09f52e7c96ad3f355e9cedb6c18688d9
- SHA1 6c51a68edfe6e4d2817a74d40c0122ee7dcd9ba2
- SHA512 355ad51b8b5ed9a32d01587f11ad6f030190a035334f06bf933524115f90c29cfe7c2da2a8708dad79c758dbde88c45525396ed63e2fe8b16116b9a572d439b9
- SSDEEP 6144:av36YjdvKZdDQB2awnipULG9YaFA0N0aeGPh1JIq4FiVChjc3L:S36LQB2awnipULG9YUAYoEI
- TLSH T105B4EE05B7FB1248F3F76AB06EFE492418B3BE536A31D07F40041A5E0A71F869A95763
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
4KB
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
496KB
Virtual Size
494KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=33138,
count=1, id=258, version=33138,
Windows.UI.Xaml.Resources.rs3.dll
- SHA256 eb61d0f407bcabd10f423d5481d6f45bbbcd9e0169254d372f4b1fc84eb029df
- MD5 ad4f46496696c88569c399106d46074f
- SHA1 52ee1a3d65cb9191ce7c7437819ecbb97ff13f3d
- SHA512 48a48b7a45cfa670ba873cb99e3ba693cbd720e6e23d1a9eaa640be552916d5b89e0416aa25fd1e6cf375a2d0daba572c7a323bbed94352d8a768b1b4ac13ba6
- SSDEEP 6144:3L36ljd44CDboY1wGUouT6qGrA6mxroFeMqsePalw0aeGPh56AdtUeoq4y0QShuK:b36NNiUIJtw
- TLSH T1C4D4FF05E7FB1648F3F36AB06EFE492418B3BE526931C17F40041A5E0A71F869AA5773
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
4KB
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
604KB
Virtual Size
600KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=33138,
count=1, id=258, version=33138,
Windows.UI.Xaml.Resources.rs4.dll
- SHA256 70e0383fcb0670c456cae3a5e115e302ec12a685d1856e4a9409c7293b4b747e
- MD5 21e1d4b8002d9086cae7068c48f387d4
- SHA1 72402547085f182a5c1143d62820a6aff6c96d09
- SHA512 51eae93d2534ae1cafcebbaa8a22c1825a2dccaac5d51592cff1dedce38835a9c872b66b2df95c09da550673ca2e53b6d5d3c9738243b9f85d0535909787ef5f
- SSDEEP 12288:o36GFa/YpRljYVURj0RTcYwEPawEPxwEPwwEPswEPWwEPrP/wEPqYPdj/R/JJ:r/R/
- TLSH T1A8D40F01E7FB1248F3F36EB06EFE496518B7BE526A31C1BF4004165E0A31F859AA5763
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
4KB
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
628KB
Virtual Size
627KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=33138,
count=1, id=258, version=33138,
Windows.UI.Xaml.Resources.rs5.dll
- SHA256 db6580196e5ad2597dd59fe5e3fcbf2068203477ec65a819140809f1da138638
- MD5 9ef6d6d1a117e55f97b66113e7980f7f
- SHA1 6cd6d22fd790b6114792daf38e5c620082bf57e5
- SHA512 99730abd9c939a869f7e84cf7cc4f44bac5abe3dff17ee16e9ad7014dd9933c6d1b4f226ab826934d19f76dda5130932ef3cc2646db330f7ec534198e331d721
- SSDEEP 6144:Il3XQ46a4CDz9Y1wGUouTuqGrA6mxroiArb5P9m/0nK0aeGPhH6AdtU9lYbivPUr:e3X3eqpbxV6DHJs93
- TLSH T1A0E4ED01A7FB1248F3F36FB06FFA492458B7BE536A31C07E4014164E1A71F85AAA5763
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
4KB
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
684KB
Virtual Size
681KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=33138,
count=1, id=258, version=33138,
Windows.UI.Xaml.Resources.th.dll
- SHA256 385d1ab78fd3c1dcde05c294707da88c90705e3a4f2ff22ab860481cd4d30a0c
- MD5 a12f256a7cc607d37b718fd6a7a7d3ea
- SHA1 239dfd114eec63a8a947467757480243e70a55cc
- SHA512 0dde81995f63527e6c5ea3193111e53a91b3b73bf31a3f7e1f5e0a10d594fe61c5025f185e8e7be49bb3cb125f2b749fb5d19dc86b8b0bcce5645efe11cf0db2
- SSDEEP 6144:yn3D5IZy4XB4X545Xj45Xv4P45X745XU/nWWItZkNieVgbdl4uYnYLWq1m1ieceD:y3DW1s
- TLSH T186642306E7FB014DF7F326705DBB892128A3BE535831D17F41182B5D1A32F898BA9762
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
4KB
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
292KB
Virtual Size
291KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=33138,
count=1, id=258, version=33138,
Windows.UI.Xaml.Resources.win81.dll
- SHA256 d64e04121190060f86f7400ce57c33e644a401b637e856b07ab1d4872f1b9abf
- MD5 76607bd2c8b80a27d8fda1b49a2f8f49
- SHA1 d2477bfa4ef43f0ee0c27d40f685f7bf4024989c
- SHA512 6e6a73424926c9fe6e27f90cf4ea0c759e0e40b0231f279662448ffd0ea0150bd540ce6f7ab31554884b80e607348788972e456d86b1028382e5c9fcfcb8d8f0
- SSDEEP 3072:mhjOIWre48xXdrSpigkaANPnKoYfST79Bsiq1zzdNr733YybHmRzBqcB5D+DyHTv:z3YzrKJQ0QDNA0W0TkiBoVzs0aeGPht
- TLSH T1F6342409E7FB1149F7F3B6709DFA89256CB3BE83A830C47F400526191B32F469A96752
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
4KB
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
236KB
Virtual Size
234KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=33138,
count=1, id=258, version=33138,
Windows.UI.Xaml.Resources.win8rtm.dll
- SHA256 db73f191b37cef9600a506f546175150ba1491988ae77b9f945653cd327542ec
- MD5 f53077ff96b16080b01956504a6d49ab
- SHA1 96f2b4e4e066483a1ccf7d04bfe68b66a5f8c3aa
- SHA512 892ca222e57febb5ef617970be351f4a9a0a3c28358fe52e45ca9beae744ef05828839e88b7985ed5ad18685d49ae95749151c8f21bdfd28afdae3fbfe270068
- SSDEEP 3072:yejOIWre48xXdrSjfST79Bsiq1zzdNr7G3YESXje7cOpxfQqQFHm0s0p2+G92cNH:H3Y4PQqQFHm0s0p2NsJI
- TLSH T1FFE3CE0AD7FB5209F3F7767069FA8D242CB37E53AC30D47F400426191A72F859AA6B52
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
4KB
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
140KB
Virtual Size
137KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=33138,
count=1, id=258, version=33138,
Windows.UI.Xaml.dll
- IMPHASH 2ea0941ecbd50cbe5a3575ace618f08d
- SHA256 b0a1d10f9766565658bf210ee521861dfa16fb22b331925fc1f039ef626ad2cb
- MD5 660e4c4effc139771735caa4c02112f1
- SHA1 046031b2037c425c28fc885dd852c19b95a6a381
- SHA512 c4fcb128a2c52c26c143a0074f87cbf0f6f52ff318923ed34f7335c85218b937964850c7b38d376d1c51e75ad74260f33e127eac2c3ec725c971595793310009
- SSDEEP 196608:1nwhGjveEbamxmyoPGTfwuiaPbLkpt3E2HVbZ:9imA1Pgqtp
- TLSH T1DD076A9A26E941C1D2B6F23CCA57824EEAB23824B33193DF01A046599F77BD1D93D731
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7438128
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
windows.ui.xaml.pdb
msvcp_win
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@N@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@H@Z
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
_Mtx_lock
?is@?$ctype@G@std@@QEBA_NFG@Z
?tolower@?$ctype@G@std@@QEBAGG@Z
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$collate@G@std@@2V0locale@2@A
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG0@Z
_Wcsxfrm
_Wcscoll
??Bid@locale@std@@QEAA_KXZ
?widen@?$ctype@G@std@@QEBAGD@Z
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
_Mtx_init_in_situ
?setf@ios_base@std@@QEAAHHH@Z
?put@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@G@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@M@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@J@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?id@?$ctype@G@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@_N@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?_Throw_Cpp_error@std@@YAXH@Z
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGXZ
?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGD@Z
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
_Mtx_destroy_in_situ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
_Mtx_unlock
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?_Xbad_function_call@std@@YAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA
api-ms-win-crt-runtime-l1-1-0
_invoke_watson
_initterm_e
_initterm
api-ms-win-crt-string-l1-1-0
wcsncmp
wcscmp
memset
wcscspn
api-ms-win-crt-math-l1-1-0
fmaxf
fminf
_finite
_isnan
api-ms-win-crt-private-l1-1-0
_o__free_base
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__itow_s
_o__malloc_base
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o__wcsnicmp
_o__wcstoi64
_o__wsplitpath_s
_o__wtoi
_o_abort
_o_atan2f
_o_ceil
_o_ceilf
_o_cos
_o_cosf
_o_exp
_o_floor
_o_floorf
_o_fmod
_o_fmodf
_o_free
_o_isalpha
_o_isspace
_o_iswalnum
_o_iswblank
_o_iswcntrl
_o_iswdigit
_o_iswgraph
_o_iswprint
_o_iswpunct
_o_iswspace
_o_log
_o_logf
_o_lroundf
_o_malloc
_o_memcpy_s
_o_pow
_o_powf
_o_realloc
_o_round
_o_roundf
_o_sin
_o_sinf
_o_sqrt
_o_sqrtf
_o_tanf
_o_terminate
_o_tolower
_o_towlower
_o_towupper
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstod
_o_wcstol
_o_wcstoll
_o_wcstoul
_o_wcstoull
wcsstr
__std_type_info_compare
wcschr
strchr
__C_specific_handler
wcsrchr
__current_exception
__current_exception_context
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__beginthreadex
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
__std_terminate
__CxxFrameHandler4
__CxxFrameHandler3
_CxxThrowException
memcmp
memcpy
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameW
LoadResource
LoadLibraryExW
GetProcAddress
FindStringOrdinal
GetModuleHandleW
LockResource
GetModuleHandleExW
FreeLibrary
FindResourceExW
GetModuleHandleExA
GetModuleFileNameA
SizeofResource
api-ms-win-core-synch-l1-1-0
CreateSemaphoreExW
OpenMutexW
ReleaseSemaphore
CreateEventExW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
ReleaseMutex
CreateEventW
ReleaseSRWLockExclusive
CreateMutexW
TryAcquireSRWLockExclusive
InitializeCriticalSectionEx
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
ResetEvent
ReleaseSRWLockShared
InitializeCriticalSection
WaitForMultipleObjectsEx
InitializeSRWLock
SetEvent
CreateMutexExW
OpenEventW
AcquireSRWLockShared
api-ms-win-core-heap-l1-1-0
HeapReAlloc
HeapFree
HeapCreate
HeapSize
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
RaiseException
SetLastError
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableFlags
UnregisterTraceGuids
TraceMessage
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceLoggerHandle
TraceEvent
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolWorkCallbacks
CloseThreadpoolWork
CloseThreadpoolWait
SubmitThreadpoolWork
CloseThreadpoolCleanupGroup
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWork
SetThreadpoolTimer
SetThreadpoolWait
CloseThreadpoolCleanupGroupMembers
CreateThreadpoolWait
WaitForThreadpoolTimerCallbacks
CreateThreadpoolCleanupGroup
CloseThreadpoolTimer
CreateThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
GetPriorityClass
GetCurrentThreadId
SetPriorityClass
GetThreadPriority
TerminateProcess
TlsSetValue
SetThreadPriority
OpenProcessToken
TlsGetValue
TlsFree
GetExitCodeProcess
GetCurrentThread
GetCurrentProcess
GetProcessId
TlsAlloc
CreateThread
GetCurrentProcessId
OpenThreadToken
SwitchToThread
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetVersionExW
GetWindowsDirectoryW
GetSystemTimeAsFileTime
GetSystemInfo
GetTickCount64
api-ms-win-core-localization-l1-2-0
GetThreadUILanguage
FormatMessageW
GetLocaleInfoW
LocaleNameToLCID
GetLocaleInfoEx
ResolveLocaleName
GetUserDefaultLCID
SetProcessPreferredUILanguages
FindNLSStringEx
LCMapStringEx
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringEx
CompareStringOrdinal
MultiByteToWideChar
api-ms-win-core-wow64-l1-1-1
IsWow64Process2
api-ms-win-core-wow64-l1-1-0
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
api-ms-win-eventing-provider-l1-1-0
EventActivityIdControl
EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlCaptureStackBackTrace
RtlVirtualUnwind
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
RegEnumKeyExW
RegDeleteValueW
RegGetValueW
RegQueryInfoKeyW
RegCloseKey
RegOpenKeyExW
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
InitOnceExecuteOnce
Sleep
InitOnceInitialize
api-ms-win-core-quirks-l1-1-0
QuirkIsEnabled
api-ms-win-core-shlwapi-legacy-l1-1-0
PathRemoveFileSpecW
PathAddBackslashW
PathCombineW
PathFindExtensionW
api-ms-win-core-kernel32-legacy-l1-1-1
PowerCreateRequest
PowerClearRequest
PowerSetRequest
api-ms-win-core-largeinteger-l1-1-0
MulDiv
api-ms-win-oobe-notification-l1-1-0
OOBEComplete
ntdll
RtlNtStatusToDosError
ZwQueryWnfStateData
RtlInitUnicodeString
RtlUnsubscribeWnfStateChangeNotification
NtQuerySecurityObject
RtlIsMultiSessionSku
RtlGetDeviceFamilyInfoEnum
RtlFreeSid
RtlFreeHeap
RtlAllocateHeap
RtlAllocateAndInitializeSid
NtPowerInformation
RtlQueryPackageClaims
NtQueryWnfStateData
RtlCopyUnicodeString
NtQuerySecurityAttributesToken
RtlCompareMemory
NtSetSecurityObject
RtlSetDaclSecurityDescriptor
RtlAddAccessAllowedAce
RtlAddAce
RtlPublishWnfStateData
RtlGetAce
RtlCreateAcl
RtlQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlLengthSid
RtlQueryInformationAcl
RtlGetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlSubscribeWnfStateChangeNotification
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
GlobalAlloc
api-ms-win-security-base-l1-1-0
AccessCheck
RevertToSelf
GetSidSubAuthorityCount
GetSidSubAuthority
EqualSid
GetTokenInformation
GetAce
DuplicateTokenEx
DuplicateToken
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
GetThreadTimes
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-processtopology-obsolete-l1-1-0
GetProcessAffinityMask
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
K32GetProcessMemoryInfo
K32GetModuleFileNameExW
api-ms-win-core-file-l1-1-0
GetTempFileNameW
SetFilePointerEx
GetFileSize
GetFileAttributesW
ReadFile
WriteFile
CreateFileW
SetEndOfFile
GetFileSizeEx
GetFileTime
api-ms-win-core-memory-l1-1-0
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
GetEnvironmentVariableW
SearchPathW
api-ms-win-core-url-l1-1-0
UrlCanonicalizeW
PathCreateFromUrlW
UrlCreateFromPathW
api-ms-win-core-file-l1-2-3
GetTempPath2W
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
GetDynamicTimeZoneInformation
api-ms-win-core-localization-obsolete-l1-2-0
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
FindResourceW
api-ms-win-core-sysinfo-l1-2-0
GetProductInfo
api-ms-win-core-errorhandling-l1-1-3
TerminateProcessOnMemoryExhaustion
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
combase
ord157
ord90
ord147
ord134
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-heap-obsolete-l1-1-0
GlobalUnlock
GlobalLock
api-ms-win-core-localization-l1-2-2
LCIDToLocaleName
api-ms-win-core-datetime-l1-1-0
GetTimeFormatW
api-ms-win-core-path-l1-1-0
PathCchAddExtension
PathCchAddBackslash
PathCchAppend
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-shlwapi-obsolete-l1-1-0
StrCSpnW
QISearch
CalculateAvailableMonitorRect
CreateString
CreateXamlUIPresenter
DeleteString
DisableDeferredInvoke
DllCanUnloadNow
DllGetActivationFactory
DllMain
GetDependencyObjectAddress
GetErrorContextIndex
GetGlobalModuleParams
GetStringLen
GetStringRawBuffer
InitializeXamlDiagnosticsEx
OverrideXamlMetadataProvider
OverrideXamlResourcePropertyBag
Name
.text
Size
12.4MB
Virtual Size
12.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3.3MB
Virtual Size
3.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
76KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
576KB
Virtual Size
574KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
160KB
Virtual Size
158KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
516KB
Virtual Size
515KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=120, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=42, id=260, version=33145,
count=1854, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=30, id=261, version=33145,
count=8, id=259, version=33145,
count=1, id=256, version=33145,
count=2868, id=264, version=33145,
count=2, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
Windows.UI.XamlHost.dll
- IMPHASH 1bafa82554c3a9896510920e9f43645d
- SHA256 93d5be74df72089f311e534535ea7ce9f8d1c3d056f354b2cb83153a344e8abe
- MD5 b198d2ae7c44998c6b71449916c14881
- SHA1 bd20b17a180f4613be03ecf59accc7cf98f140df
- SHA512 868191fbc8fa4545f63d80e92b1da1b0fa316edd54058f4c57dcca46c84beb79982672425e4b96c07b5d60f0a43996e137728bfb5af92550921ec3bc51112e9a
- SSDEEP 6144:gmm5DAy+oNbARDSf2AIBsBrgGjbRk77nfnwqoqzd/wvS+:g/5DQgbAR02NBs9k3fdoQd
- TLSH T149644E5F62E918E5F636E13C85538A0DF2B174221322A6CF0790817E9F2BFD8997D760
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
130208
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Windows.UI.XamlHost.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__execute_onexit_table
memmove
_o_abort
_o_free
_o_iswspace
_o_malloc
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_CxxThrowException
__CxxFrameHandler3
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleFileNameA
GetModuleHandleExW
DisableThreadLibraryCalls
FreeLibrary
GetModuleHandleExA
LoadLibraryExW
GetModuleHandleW
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionEx
CreateMutexExW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseSRWLockShared
OpenEventW
AcquireSRWLockShared
ReleaseMutex
DeleteCriticalSection
WaitForSingleObject
EnterCriticalSection
ReleaseSemaphore
LeaveCriticalSection
ResetEvent
CreateSemaphoreExW
CreateEventExW
InitializeCriticalSection
SetEvent
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
api-ms-win-core-processthreads-l1-1-0
GetCurrentThread
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
GetSystemPreferredUILanguages
FormatMessageW
SetThreadUILanguage
ResolveLocaleName
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringOrdinal
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventActivityIdControl
EventSetInformation
EventWriteTransfer
EventRegister
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-winrt-error-l1-1-0
SetRestrictedErrorInfo
RoOriginateError
RoTransformError
RoOriginateErrorW
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsCreateString
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsCreateStringReference
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedPushEntrySList
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-com-l1-1-0
CoWaitForMultipleHandles
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
PropVariantClear
CoGetApartmentType
CoGetMalloc
CoCreateFreeThreadedMarshaler
StringFromCLSID
api-ms-win-core-registry-l1-1-0
RegGetValueW
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
RoOriginateLanguageException
IsErrorPropagationEnabled
RoReportFailedDelegate
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-processthreads-l1-1-3
SetThreadDescription
api-ms-win-appmodel-runtime-internal-l1-1-7
AddDependencyToProcessPackageGraph
api-ms-win-rtcore-ntuser-private-l1-1-0
CreateWindowInBandEx
api-ms-win-rtcore-ntuser-shell-l1-1-0
GetShellWindow
RegisterShellHookWindow
api-ms-win-rtcore-ntuser-window-l1-1-0
DefWindowProcW
DestroyWindow
SetWindowTextW
GetForegroundWindow
PostMessageW
ShowWindow
CreateWindowExW
GetWindowThreadProcessId
RegisterWindowMessageW
SetWindowPos
GetDesktopWindow
SendMessageW
GetPropW
RemovePropW
SetPropW
GetAncestor
EnableWindow
SetActiveWindow
IsWindowVisible
GetWindowRect
GetClientRect
GetQueueStatus
SetForegroundWindow
combase
ord100
ntdll
RtlSubscribeWnfStateChangeNotification
RtlQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion
shcore
ord244
ord233
GetScaleFactorForMonitor
SHTaskPoolQueueTask
ord261
CreateRandomAccessStreamOverStream
GetProcessDpiAwareness
GetDpiForMonitor
SHTaskPoolGetUniqueContext
ord232
ord230
user32
GetLastActivePopup
FlashWindow
keybd_event
AreDpiAwarenessContextsEqual
GetThreadDpiAwarenessContext
SetThreadDpiAwarenessContext
SetLayeredWindowAttributes
GetThreadDesktop
GetUserObjectInformationW
OpenInputDesktop
PtInRect
CloseDesktop
SetThreadDesktop
SetWinEventHook
UnhookWinEvent
ord2565
ord2561
GetKeyState
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
oleaut32
SetErrorInfo
GetErrorInfo
SysFreeString
SysStringLen
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
216KB
Virtual Size
213KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
60KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
448B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=73, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=1292, id=1, productName=Unmarked objects,
count=10, id=257, version=33145,
count=28, id=261, version=33145,
count=1, id=256, version=33145,
count=24, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
Windows.WARP.JITService.dll
- IMPHASH 39f159247718c6f9e8e547571df22315
- SHA256 f90427434ca953c2ea9b60b03270a74dea57ddd81d4dea8dac13351f757d8728
- MD5 e1cde61e2abe71af764183bbd1c8cd73
- SHA1 dbc76ba940b62af9404518fd54a1a6395fdb8bd9
- SHA512 f05bca9cc686f5a09e3b26c5489131345e0632231914b589dea2aa65701b337dd5565c1eb7c9b79609d82b831bd4c62e698ef739e14292b191967ebba4876442
- SSDEEP 1536:1Dj9P1jUgERmDlN8VNgjh8faAPdvLNlQL5XLQm:b1CSz8VNgjh85PdPc5d
- TLSH T1B3934A5D72B820A4E5369539C8934215E372B43163126BFF62E0C2BE5F63FD86939F81
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
41968
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Windows.WARP.JITService.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
__C_specific_handler
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
_CxxThrowException
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
LoadLibraryExA
FreeLibrary
GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleW
api-ms-win-core-synch-l1-1-0
CreateEventW
DeleteCriticalSection
AcquireSRWLockShared
SetEvent
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CreateSemaphoreExW
ReleaseMutex
CreateMutexExW
WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection
ReleaseSemaphore
EnterCriticalSection
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
GetLastError
SetLastError
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-eventlog-legacy-l1-1-0
DeregisterEventSource
RegisterEventSourceW
ReportEventW
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-service-winsvc-l1-1-0
RegisterServiceCtrlHandlerW
api-ms-win-service-core-l1-1-0
SetServiceStatus
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemInfo
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-memory-l1-1-0
VirtualQuery
VirtualProtect
DllMain
ServiceMain
Name
.text
Size
44KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
228B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=53, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1145, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=17, id=261, version=33145,
count=1, id=256, version=33145,
count=4, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
Windows.Web.Diagnostics.dll
- IMPHASH b0d56050e6edf41a7d601ac2584f4c53
- SHA256 26626319146c20871a695c4477ae981d7cce9a3c5be60b6a8240aacf255cdb7f
- MD5 be651bac0bbd0c4f9838d60c2132f9dc
- SHA1 cdee5a4814cacb5bf7a21a40387a24e669e47fc3
- SHA512 6c7de90d05cc741a17893464c52c57e06fa8080238252c9f70f4414ae184a85fecfc6462a778e7e2bc3f55d00fc8b68a05d21cb10f9321b112771cc7a0ec7c13
- SSDEEP 6144:TGM8xK+gunZYVv3e2eGeCiMu6GAJTVQgPNEyshc:TGM8x1gunZYVgjAJXPu
- TLSH T11D242B1E36ED0075E576A17CC9838B0AE2B2B815576253CF0254437EDF2FBE89A39721
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5376
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Windows.Web.Diagnostics.pdb
msvcrt
_initterm
__C_specific_handler
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_amsg_exit
malloc
free
??_V@YAXPEAX@Z
??0exception@@QEAA@AEBQEBD@Z
?what@exception@@UEBAPEBDXZ
??0bad_cast@@QEAA@PEBD@Z
??0bad_cast@@QEAA@AEBV0@@Z
??1bad_cast@@UEAA@XZ
_wcsicmp
_wtoi
localeconv
wcstoul
sprintf_s
_lock
vswprintf_s
wcsstr
_wcsnicmp
_callnewh
setlocale
_CxxThrowException
memcpy
memmove
__pctype_func
___lc_handle_func
___lc_codepage_func
calloc
___mb_cur_max_func
_errno
_ismbblead
??0exception@@QEAA@AEBQEBDH@Z
__uncaught_exception
abort
memset
_wcsdup
__crtLCMapStringW
_wsetlocale
_XcptFilter
_purecall
??0exception@@QEAA@AEBV0@@Z
_vsnwprintf
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
memcpy_s
??3@YAXPEAX@Z
__CxxFrameHandler4
_unlock
__dllonexit
_onexit
__CxxFrameHandler3
strcspn
wcscmp
api-ms-win-core-kernel32-legacy-l1-1-0
WaitForMultipleObjects
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameA
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
RaiseException
SetLastError
SetUnhandledExceptionFilter
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
GetStringTypeW
MultiByteToWideChar
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-synch-l1-1-0
CreateSemaphoreExW
CreateMutexExW
ReleaseSRWLockExclusive
ReleaseSRWLockShared
InitializeCriticalSectionEx
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
OpenSemaphoreW
AcquireSRWLockShared
AcquireSRWLockExclusive
WaitForSingleObjectEx
ReleaseMutex
SetEvent
WaitForSingleObject
InitializeSRWLock
CreateEventExW
ReleaseSemaphore
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsCreateString
WindowsGetStringRawBuffer
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
RoOriginateError
SetRestrictedErrorInfo
RoTransformError
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount64
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate
IsErrorPropagationEnabled
rpcrt4
UuidToStringW
NdrOleAllocate
NdrOleFree
NdrDllCanUnloadNow
NdrDllGetClassObject
RpcStringFreeW
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-eventing-controller-l1-1-0
StopTraceW
EnableTraceEx2
StartTraceW
QueryAllTracesW
api-ms-win-eventing-consumer-l1-1-0
OpenTraceW
ProcessTrace
CloseTrace
api-ms-win-eventing-tdh-l1-1-0
TdhGetProperty
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
120KB
Virtual Size
119KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
60KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=54, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=176, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=22, id=261, version=33145,
count=63, id=260, version=33145,
count=1, id=256, version=33145,
count=11, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
Windows.Web.Http.dll
- IMPHASH c866e432f30dd69a3cce0c6466c295ca
- SHA256 9fad5a5bbb820f10376a3c0c81903a2b25e49bdf9c423d013e3fabe7bfeb511b
- MD5 a6719bd7c9dae4bc96d00e8aef0f46f3
- SHA1 245e9390ecd776f87c3c586cbf8ece9bb2f4631a
- SHA512 9a9d9a8e5070d92e8bcdf8a0ab49c57024e9805d60c15cf0eccd1ec9559a44e80a1f70927c3f77aac55b769351f9bdafd055189c70434dcb13bfe5be4c212fcc
- SSDEEP 24576:kn+V+CEfPAKd4hK0OAbml3M4DsebjvRVLcySnfU5Hl+fSvuzM+XhKeZ8cLiNS9b1:kn+V+CEfPAKd4hK0OAbml3MJebjvRVLG
- TLSH T1F9550A1A6AF8029AD67DA279C027465DD3717C212721B3CB2159723EDF3BBD44E3A720
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
523136
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Windows.Web.Http.pdb
msvcrt
memcpy
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
memcmp
_vsnwprintf
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_callnewh
realloc
_itow_s
wcschr
iswalnum
_ultow_s
swprintf_s
free
malloc
swscanf_s
_wcsicmp
_purecall
memmove_s
_lock
memcpy_s
iswdigit
memset
ntdll
NtSetInformationThread
NtOpenThreadToken
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlUpcaseUnicodeChar
RtlAllocateHeap
RtlInitUnicodeString
RtlCopyUnicodeString
RtlFreeHeap
NtQuerySecurityAttributesToken
RtlCompareMemory
RtlQueryPackageClaims
RtlNtStatusToDosError
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
LoadStringW
DisableThreadLibraryCalls
GetModuleHandleExW
GetModuleHandleW
GetModuleFileNameA
FreeLibrary
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-winrt-string-l1-1-0
WindowsStringHasEmbeddedNull
HSTRING_UserUnmarshal64
HSTRING_UserUnmarshal
HSTRING_UserMarshal64
WindowsGetStringLen
HSTRING_UserFree
WindowsCreateString
HSTRING_UserFree64
WindowsCompareStringOrdinal
HSTRING_UserMarshal
WindowsSubstring
HSTRING_UserSize
WindowsCreateStringReference
WindowsConcatString
WindowsIsStringEmpty
WindowsDuplicateString
WindowsSubstringWithSpecifiedLength
WindowsReplaceString
WindowsGetStringRawBuffer
HSTRING_UserSize64
WindowsDeleteString
api-ms-win-core-com-l1-1-0
CoIncrementMTAUsage
CoTaskMemAlloc
GetHGlobalFromStream
CoWaitForMultipleObjects
CoReleaseMarshalData
CoMarshalInterface
CoCreateFreeThreadedMarshaler
CoDecrementMTAUsage
CoCreateGuid
CoTaskMemFree
CreateStreamOnHGlobal
CoCreateInstance
api-ms-win-core-localization-l1-2-0
IdnToAscii
FormatMessageW
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
SetThreadToken
OpenThreadToken
OpenProcessToken
GetCurrentProcessId
GetCurrentProcess
GetCurrentThread
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-synch-l1-1-0
CreateMutexExW
CreateEventW
CreateSemaphoreExW
SetEvent
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
TryAcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx
EnterCriticalSection
InitializeSRWLock
InitializeCriticalSectionEx
DeleteCriticalSection
InitializeCriticalSection
WaitForSingleObject
LeaveCriticalSection
OpenSemaphoreW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolWait
FreeLibraryWhenCallbackReturns
CallbackMayRunLong
TrySubmitThreadpoolCallback
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolWait
CreateThreadpoolWait
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
RoOriginateError
GetRestrictedErrorInfo
SetRestrictedErrorInfo
RoTransformError
api-ms-win-core-winrt-error-l1-1-1
RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
api-ms-win-security-base-l1-1-0
DuplicateTokenEx
GetTokenInformation
RevertToSelf
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
InitOnceInitialize
WakeAllConditionVariable
Sleep
SleepConditionVariableCS
InitializeConditionVariable
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemDirectoryW
GetSystemTimeAsFileTime
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoGetActivationFactory
RoInitialize
RoUninitialize
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
CompareStringOrdinal
WideCharToMultiByte
CompareStringW
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventRegister
EventUnregister
EventSetInformation
rpcrt4
NdrDllUnregisterProxy
NdrOleAllocate
NdrDllRegisterProxy
NdrDllCanUnloadNow
NdrOleFree
RpcStringFreeW
NdrDllGetClassObject
UuidToStringW
api-ms-win-core-winrt-robuffer-l1-1-0
RoGetBufferMarshaler
api-ms-win-shcore-stream-winrt-l1-1-0
CreateRandomAccessStreamOverStream
api-ms-win-core-heap-obsolete-l1-1-0
GlobalUnlock
GlobalHandle
GlobalLock
api-ms-win-core-heap-l2-1-0
LocalFree
GlobalFree
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
oleaut32
SysAllocStringLen
SysFreeString
SysAllocString
api-ms-win-core-normalization-l1-1-0
NormalizeString
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
FileTimeToSystemTime
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
Name
.text
Size
788KB
Virtual Size
787KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
448KB
Virtual Size
445KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
44KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
376B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
44KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=70, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=20, id=260, version=33145,
count=5, id=259, version=33145,
count=247, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=5, id=261, version=33145,
count=1, id=256, version=33145,
count=140, id=265, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
Windows.Web.dll
- IMPHASH 5680de7ea308ff2bae7ee6dcadcfc98c
- SHA256 1751ecc199633210c2ba1613794548d84bb345dbe49ff587d8a9e89e39b6917c
- MD5 aed0e560c1b746bcfa616f79a0443820
- SHA1 20b8fa2dd7bc38450a86c633618104916302cf54
- SHA512 0383fc23c3c8e5d81ad421a9700f9404e0df9df934f2dc690fed53d13abe53d84d4eb3edd6a33199444094d15d0ee9a08df8746925ca81ff5288c048646094a8
- SSDEEP 12288:Jp5dqheye1YtpwSYPYAg38BlIdWViSa87jeAa2LDMKwr:JHYeRYkV+Ak87jeARMKw
- TLSH T1F1E4E75B2AE8055AD639923CC453065DE7B27C505B61A7CF0260627ECE3FBD48F3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
93008
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Windows.Web.pdb
api-ms-win-crt-math-l1-1-0
_finite
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__itoa_s
_o__itow_s
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsicmp
_o__wtof
_o_free
_o_malloc
_o_memcpy_s
__C_specific_handler
__CxxFrameHandler3
_o__execute_onexit_table
_o__errno
_o__ecvt_s
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
memcmp
memcpy
memmove
api-ms-win-crt-string-l1-1-0
memset
wcscmp
ntdll
RtlNtStatusToDosError
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlAllocateHeap
RtlInitUnicodeString
RtlCopyUnicodeString
RtlFreeHeap
NtQuerySecurityAttributesToken
RtlCompareMemory
NtSetInformationThread
NtOpenThreadToken
RtlCaptureContext
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
CompareStringOrdinal
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
api-ms-win-core-processthreads-l1-1-0
OpenThreadToken
GetCurrentThreadId
GetCurrentProcessId
GetCurrentThread
OpenProcessToken
GetCurrentProcess
TerminateProcess
api-ms-win-security-base-l1-1-0
RevertToSelf
GetTokenInformation
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
SetLastError
GetLastError
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
CallbackMayRunLong
TrySubmitThreadpoolCallback
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks
SubmitThreadpoolWork
CreateThreadpoolWork
SetThreadpoolTimer
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolWait
FreeLibraryWhenCallbackReturns
SetThreadpoolWait
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventWriteTransfer
EventRegister
api-ms-win-core-localization-l1-2-0
IsDBCSLeadByteEx
IsDBCSLeadByte
FormatMessageW
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
FreeLibrary
LoadLibraryExW
GetModuleHandleW
FindResourceExW
GetProcAddress
LoadStringW
DisableThreadLibraryCalls
SizeofResource
GetModuleFileNameA
LockResource
LoadResource
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-synch-l1-1-0
ResetEvent
LeaveCriticalSection
CreateSemaphoreExW
CreateMutexExW
InitializeCriticalSectionAndSpinCount
OpenSemaphoreW
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSectionEx
EnterCriticalSection
WaitForSingleObjectEx
AcquireSRWLockExclusive
SetEvent
CreateEventW
ReleaseMutex
ReleaseSemaphore
InitializeSRWLock
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
InitializeCriticalSection
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTime
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetLocalTime
api-ms-win-core-timezone-l1-1-0
GetTimeZoneInformation
FileTimeToSystemTime
SystemTimeToFileTime
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-url-l1-1-0
UrlEscapeW
api-ms-win-core-registry-l1-1-0
RegGetValueW
api-ms-win-core-file-l1-2-0
GetTempPathW
api-ms-win-core-path-l1-1-0
PathCchAppend
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
LocalReAlloc
api-ms-win-core-quirks-l1-1-0
QuirkIsEnabled
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-kernel32-legacy-l1-1-0
GetStringTypeExA
api-ms-win-core-shlwapi-obsolete-l1-1-0
StrToIntA
StrStrNIW
StrCmpICA
StrCmpW
StrCmpIW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiA
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
Name
.text
Size
388KB
Virtual Size
385KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
184KB
Virtual Size
182KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
32KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
976B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
20KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=73, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1318, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=14, id=260, version=33145,
count=5, id=259, version=33145,
count=25, id=261, version=33145,
count=1, id=256, version=33145,
count=98, id=265, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WindowsBackupAndRestoreCSP.dll
- IMPHASH 41798baa807a10001917203f4a9824ff
- SHA256 2bd4a6c7fb982662165d408d3ee77acbd1250dceb803c2ab7b5226156a73fa64
- MD5 8ef1cde63aba2dc5f9eae302044d7700
- SHA1 8be2b01083c168d400207785993000ab92ab0be1
- SHA512 6c04cd1805ebcda87fae21c4fb4d694567ff9571aacd0320fc26492869a729184720e223485724cf3571bbb9240cf851ddff37097bdf936dce609781cfc9e8f6
- SSDEEP 1536:LFSVFYtJRh7wyRAObKjCYqxv1TM6Wi1REvBYkrSVVNBo9n:L4s3pbcCYqpm6fQzrSBBo9n
- TLSH T1FF933A5D72A824A6E47AC03CC9934A18E3B1F065631257EF03E081BE5F63BE46D39F56
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5664
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WindowsBackupAndRestoreCSP.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o_free
_o_malloc
_o_memcpy_s
__C_specific_handler
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__CxxFrameHandler4
__std_terminate
__CxxFrameHandler3
_CxxThrowException
_o___stdio_common_vswprintf
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-errorhandling-l1-1-0
SetLastError
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExA
GetModuleHandleW
GetProcAddress
GetModuleHandleExW
GetModuleFileNameA
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
DeleteCriticalSection
CreateMutexExW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegGetValueW
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegCloseKey
oleaut32
VariantClear
VariantInit
SysAllocString
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
api-ms-win-core-registry-l1-1-1
RegDeleteKeyValueW
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
48KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
464B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=45, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1135, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=25, id=261, version=33145,
count=1, id=256, version=33145,
count=10, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WindowsCodecs.dll
- IMPHASH 4e69fa3eee33b14eacfc048aa126d5fa
- SHA256 85aeb3df0505e00f8795ba7c3ae83044d05583297f78965d23fbbbf97c0e1324
- MD5 a83d1e2f2adee154d4d9bac4ddb3963f
- SHA1 1316dab3d0edf3fb9f656eac3464822fe67110ba
- SHA512 4eee745e8f50fe881b28425dd28db10cbd546712383fb42fce1b2f87695bcb5502d701704aa73a825ba84ad6af9e090c6d39c38ffc9a4182ab912f02d0ac8c43
- SSDEEP 24576:fscvbZ+HWpHHrlGTbJcZFek5Y4tIK6qunb+aIyn2Lp/zgoqL3VrY8zwqt:fPTjnknuLe0YiqnbvI1Lm3VEqt
- TLSH T1C3B55B46B6E84486C7A58238CD5B851AEBB03C1D17F156FB3290A7E96F37BE07939310
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
5a:cc:a1:2e:ff:27:59:00:ae:d1:ce:df:7b:2f:6d:30:b7:be:b1:79:f9:e7:27:3e:33:40:8f:06:72:cc:da:3b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:651A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:15:18:03:d3:81:07:26:7c:53:00:01:00:00:02:15
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
799600
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WindowsCodecs.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__stricmp
__intrinsic_setjmp
_o__wcsicmp
_o__wcsnicmp
_o_atan2
_o_calloc
_o_ceilf
_o_exit
_o_exp
_o_floorf
_o_fread
_o_free
_o_getenv_s
_o_ldexp
_o_log
_o_malloc
_o_powf
_o_qsort
_o_rand
_o_realloc
_o_sqrt
_o_strcpy_s
__C_specific_handler
_o__execute_onexit_table
_o__errno
__std_type_info_compare
wcsstr
strstr
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o__aligned_realloc
_o__aligned_malloc
_o__aligned_free
_o___stdio_common_vswprintf
_o___stdio_common_vsscanf
_o___stdio_common_vsnprintf_s
_o___stdio_common_vfprintf
_o___std_type_info_destroy_list
_o___acrt_iob_func
memcmp
memmove
memcpy
api-ms-win-crt-string-l1-1-0
wcscmp
memset
strncmp
strcmp
api-ms-win-core-marshal-l1-1-0
HICON_UserFree
HBITMAP_UserMarshal
HICON_UserUnmarshal
HPALETTE_UserMarshal
HICON_UserSize
HPALETTE_UserFree
HBITMAP_UserFree
CLIPFORMAT_UserUnmarshal
CLIPFORMAT_UserSize
CLIPFORMAT_UserMarshal
HPALETTE_UserUnmarshal
HPALETTE_UserSize
HICON_UserMarshal
HBITMAP_UserUnmarshal
CLIPFORMAT_UserFree
HBITMAP_UserSize
api-ms-win-core-com-midlproxystub-l1-1-0
ObjectStublessClient3
ObjectStublessClient4
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
InitializeCriticalSectionEx
CreateSemaphoreExW
WaitForSingleObject
SleepEx
ReleaseSRWLockExclusive
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
CreateEventW
ReleaseSemaphore
OpenSemaphoreW
AcquireSRWLockShared
LeaveCriticalSection
ReleaseMutex
EnterCriticalSection
CreateMutexExW
WaitForSingleObjectEx
ReleaseSRWLockShared
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventSetInformation
EventRegister
EventWriteTransfer
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExA
GetModuleHandleW
DisableThreadLibraryCalls
LoadLibraryExW
FreeLibrary
GetProcAddress
GetModuleFileNameA
GetModuleHandleExW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
OpenProcessToken
GetCurrentThreadId
SetThreadToken
TerminateProcess
OpenThreadToken
GetCurrentProcessId
GetCurrentProcess
GetCurrentThread
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
GetTickCount64
GetTickCount
GetSystemTimeAsFileTime
GetVersionExW
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureStackBackTrace
RtlCaptureContext
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-crt-math-l1-1-0
_isnan
_finite
api-ms-win-core-com-l1-1-0
CoGetApartmentType
PropVariantCopy
CreateStreamOnHGlobal
IIDFromString
CoCreateInstance
GetHGlobalFromStream
CoLockObjectExternal
PropVariantClear
CoTaskMemAlloc
StringFromGUID2
CoTaskMemFree
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetLocaleInfoEx
api-ms-win-core-file-l1-1-0
CreateFileW
GetFileSize
GetFileInformationByHandle
GetFileType
SetEndOfFile
SetFilePointer
SetFilePointerEx
ReadFile
WriteFile
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
lstrcmpW
api-ms-win-core-memory-l1-1-0
VirtualAlloc
MapViewOfFileEx
UnmapViewOfFile
VirtualFree
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegOpenKeyExW
RegEnumKeyExW
RegQueryValueExW
RegEnumValueW
api-ms-win-core-path-l1-1-0
PathCchCombine
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
ntdll
RtlInitializeBitMap
RtlSetBits
RtlDllShutdownInProgress
DbgPrintEx
api-ms-win-core-heap-obsolete-l1-1-0
GlobalUnlock
GlobalLock
GlobalSize
api-ms-win-core-heap-l2-1-0
GlobalAlloc
GlobalFree
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
api-ms-win-core-normalization-l1-1-0
GetStringScripts
api-ms-win-core-stringansi-l1-1-0
IsCharAlphaNumericA
api-ms-win-core-largeinteger-l1-1-0
MulDiv
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-core-kernel32-legacy-l1-1-0
CreateFileMappingA
DllCanUnloadNow
DllFreeCodecResources
DllGetClassObject
IEnumString_Next_WIC_Proxy
IEnumString_Reset_WIC_Proxy
IPropertyBag2_Write_Proxy
IWICBitmapClipper_Initialize_Proxy
IWICBitmapCodecInfo_DoesSupportAnimation_Proxy
IWICBitmapCodecInfo_DoesSupportLossless_Proxy
IWICBitmapCodecInfo_DoesSupportMultiframe_Proxy
IWICBitmapCodecInfo_GetContainerFormat_Proxy
IWICBitmapCodecInfo_GetDeviceManufacturer_Proxy
IWICBitmapCodecInfo_GetDeviceModels_Proxy
IWICBitmapCodecInfo_GetFileExtensions_Proxy
IWICBitmapCodecInfo_GetMimeTypes_Proxy
IWICBitmapDecoder_CopyPalette_Proxy
IWICBitmapDecoder_GetColorContexts_Proxy
IWICBitmapDecoder_GetDecoderInfo_Proxy
IWICBitmapDecoder_GetFrameCount_Proxy
IWICBitmapDecoder_GetFrame_Proxy
IWICBitmapDecoder_GetMetadataQueryReader_Proxy
IWICBitmapDecoder_GetPreview_Proxy
IWICBitmapDecoder_GetThumbnail_Proxy
IWICBitmapEncoder_Commit_Proxy
IWICBitmapEncoder_CreateNewFrame_Proxy
IWICBitmapEncoder_GetEncoderInfo_Proxy
IWICBitmapEncoder_GetMetadataQueryWriter_Proxy
IWICBitmapEncoder_Initialize_Proxy
IWICBitmapEncoder_SetPalette_Proxy
IWICBitmapEncoder_SetThumbnail_Proxy
IWICBitmapFlipRotator_Initialize_Proxy
IWICBitmapFrameDecode_GetColorContexts_Proxy
IWICBitmapFrameDecode_GetMetadataQueryReader_Proxy
IWICBitmapFrameDecode_GetThumbnail_Proxy
IWICBitmapFrameEncode_Commit_Proxy
IWICBitmapFrameEncode_GetMetadataQueryWriter_Proxy
IWICBitmapFrameEncode_Initialize_Proxy
IWICBitmapFrameEncode_SetColorContexts_Proxy
IWICBitmapFrameEncode_SetResolution_Proxy
IWICBitmapFrameEncode_SetSize_Proxy
IWICBitmapFrameEncode_SetThumbnail_Proxy
IWICBitmapFrameEncode_WriteSource_Proxy
IWICBitmapLock_GetDataPointer_STA_Proxy
IWICBitmapLock_GetStride_Proxy
IWICBitmapScaler_Initialize_Proxy
IWICBitmapSource_CopyPalette_Proxy
IWICBitmapSource_CopyPixels_Proxy
IWICBitmapSource_GetPixelFormat_Proxy
IWICBitmapSource_GetResolution_Proxy
IWICBitmapSource_GetSize_Proxy
IWICBitmap_Lock_Proxy
IWICBitmap_SetPalette_Proxy
IWICBitmap_SetResolution_Proxy
IWICColorContext_InitializeFromMemory_Proxy
IWICComponentFactory_CreateMetadataWriterFromReader_Proxy
IWICComponentFactory_CreateQueryWriterFromBlockWriter_Proxy
IWICComponentInfo_GetAuthor_Proxy
IWICComponentInfo_GetCLSID_Proxy
IWICComponentInfo_GetFriendlyName_Proxy
IWICComponentInfo_GetSpecVersion_Proxy
IWICComponentInfo_GetVersion_Proxy
IWICFastMetadataEncoder_Commit_Proxy
IWICFastMetadataEncoder_GetMetadataQueryWriter_Proxy
IWICFormatConverter_Initialize_Proxy
IWICImagingFactory_CreateBitmapClipper_Proxy
IWICImagingFactory_CreateBitmapFlipRotator_Proxy
IWICImagingFactory_CreateBitmapFromHBITMAP_Proxy
IWICImagingFactory_CreateBitmapFromHICON_Proxy
IWICImagingFactory_CreateBitmapFromMemory_Proxy
IWICImagingFactory_CreateBitmapFromSource_Proxy
IWICImagingFactory_CreateBitmapScaler_Proxy
IWICImagingFactory_CreateBitmap_Proxy
IWICImagingFactory_CreateComponentInfo_Proxy
IWICImagingFactory_CreateDecoderFromFileHandle_Proxy
IWICImagingFactory_CreateDecoderFromFilename_Proxy
IWICImagingFactory_CreateDecoderFromStream_Proxy
IWICImagingFactory_CreateEncoder_Proxy
IWICImagingFactory_CreateFastMetadataEncoderFromDecoder_Proxy
IWICImagingFactory_CreateFastMetadataEncoderFromFrameDecode_Proxy
IWICImagingFactory_CreateFormatConverter_Proxy
IWICImagingFactory_CreatePalette_Proxy
IWICImagingFactory_CreateQueryWriterFromReader_Proxy
IWICImagingFactory_CreateQueryWriter_Proxy
IWICImagingFactory_CreateStream_Proxy
IWICMetadataBlockReader_GetCount_Proxy
IWICMetadataBlockReader_GetReaderByIndex_Proxy
IWICMetadataQueryReader_GetContainerFormat_Proxy
IWICMetadataQueryReader_GetEnumerator_Proxy
IWICMetadataQueryReader_GetLocation_Proxy
IWICMetadataQueryReader_GetMetadataByName_Proxy
IWICMetadataQueryWriter_RemoveMetadataByName_Proxy
IWICMetadataQueryWriter_SetMetadataByName_Proxy
IWICPalette_GetColorCount_Proxy
IWICPalette_GetColors_Proxy
IWICPalette_GetType_Proxy
IWICPalette_HasAlpha_Proxy
IWICPalette_InitializeCustom_Proxy
IWICPalette_InitializeFromBitmap_Proxy
IWICPalette_InitializeFromPalette_Proxy
IWICPalette_InitializePredefined_Proxy
IWICPixelFormatInfo_GetBitsPerPixel_Proxy
IWICPixelFormatInfo_GetChannelCount_Proxy
IWICPixelFormatInfo_GetChannelMask_Proxy
IWICStream_InitializeFromIStream_Proxy
IWICStream_InitializeFromMemory_Proxy
WICConvertBitmapSource
WICCreateBitmapFromSection
WICCreateBitmapFromSectionEx
WICCreateColorContext_Proxy
WICCreateImagingFactory_Proxy
WICGetMetadataContentSize
WICMapGuidToShortName
WICMapSchemaToName
WICMapShortNameToGuid
WICMatchMetadataContent
WICSerializeMetadataContent
WICSetEncoderFormat_Proxy
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
444KB
Virtual Size
443KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
64KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
624B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
24KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=87, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1311, id=1, productName=Unmarked objects,
count=28, productName=Unmarked objects (old),
count=115, id=260, version=33145,
count=5, id=259, version=33145,
count=1, id=256, version=33145,
count=296, id=264, version=33145,
count=2, id=253, version=33145,
count=26, id=261, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WindowsCodecsExt.dll
- IMPHASH 03005bfa18d6a6191ca23e840ea6b0d2
- SHA256 8a7ef1e82c4c8020f3cc1475aa4d1a159a7a980c0b73465bb19e1b39845d71ab
- MD5 9380e3ca31ba7c5ee95b9e4a073816bf
- SHA1 490de6c32f40800baeb93d0edf28483611e3fa41
- SHA512 0d1064cf99c0bf6ce1b147921a29363dc2085b2dc459205c5b466a62794a3cb234e3ddafcc3c0b2786109e7546814f3917c6937ebf06a0bcd67bca63423cceb1
- SSDEEP 6144:RSZkvcCRDz9kyl+gs8cIYFSa9YiPNpWJl:8eld6ylDs9IaSaKiA
- TLSH T1A6645D1FB3E818D6D2B5923CCA878609F7B17411335186DF13A882796F6BBE45E39324
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
83840
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WindowsCodecsExt.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o_free
_o_frexp
_o_ldexp
_o_malloc
_o_realloc
__C_specific_handler
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
wcsncmp
memset
ntdll
DbgPrintEx
RtlLookupFunctionEntry
RtlCaptureContext
RtlSetBits
RtlCaptureStackBackTrace
RtlVirtualUnwind
RtlInitializeBitMap
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleHandleW
GetProcAddress
GetModuleFileNameA
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemInfo
GetVersionExW
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
GetLastError
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-com-l1-1-0
CoTaskMemFree
GetHGlobalFromStream
CoTaskMemAlloc
CoGetApartmentType
CoCreateInstance
PropVariantClear
CoLockObjectExternal
CreateStreamOnHGlobal
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx
EnterCriticalSection
InitializeCriticalSectionEx
WaitForSingleObject
OpenSemaphoreW
CreateMutexExW
CreateSemaphoreExW
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
ReleaseSRWLockExclusive
DeleteCriticalSection
SleepEx
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
oleaut32
SysAllocStringLen
VariantChangeType
SysStringLen
VariantClear
VariantInit
SysFreeString
SysAllocString
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
CompareStringW
api-ms-win-core-heap-l2-1-0
GlobalAlloc
GlobalFree
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpW
lstrcmpiW
api-ms-win-core-heap-obsolete-l1-1-0
GlobalLock
GlobalSize
GlobalUnlock
windowscodecs
WICMapSchemaToName
WICMatchMetadataContent
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
IWICColorTransform_Initialize_Proxy
WICCreateColorTransform_Proxy
Name
.text
Size
224KB
Virtual Size
221KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=33145,
count=55, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1191, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=21, id=260, version=33145,
count=5, id=259, version=33145,
count=1, id=256, version=33145,
count=74, id=264, version=33145,
count=1, id=253, version=33145,
count=19, id=261, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WindowsDefaultHeatProcessor.dll
- IMPHASH 0985a8a4d087c526916749fc2f36cee5
- SHA256 1b746a9ba47f40f0930787d8573799f952eeaed6822b64e564650dd8065041e9
- MD5 d66f8e01f6c2fd951bb606393f97f25e
- SHA1 c0014f12a73279847567a8c8f9db21f57adddc65
- SHA512 db0d891faddaab47ecd8013456423e5284dd0622d2db699ed149589c5a7a47af7ed58bad675ee0eafedb9a4c393024169a8a284f4175c974fc8f3cdbb5e4483d
- SSDEEP 3072:566+L2W0pZXdY52FJReeVpglRCn75LjAt/wN4PGLRqwc5ZBoEHH:5+lWZ+52FJzVprn75LQkRqFoEH
- TLSH T127E36D6A72BA00E9D57BC17C8697560BFBB27415132197CB02D081BE1F67BE8783E721
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
10320
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WindowsDefaultHeatProcessor.pdb
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_atan2f
_o_ceilf
_o_free
_o_malloc
_o_sqrtf
__C_specific_handler
_CxxThrowException
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetModuleFileNameA
GetProcAddress
GetModuleHandleW
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
AcquireSRWLockExclusive
WaitForSingleObjectEx
ReleaseSRWLockExclusive
OpenSemaphoreW
CreateSemaphoreExW
ReleaseSRWLockShared
ReleaseMutex
AcquireSRWLockShared
WaitForSingleObject
CreateMutexExW
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
ReleaseSemaphore
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-errorhandling-l1-1-0
SetLastError
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventRegister
EventWriteTransfer
EventUnregister
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
CreateHeatProcessor
Name
.text
Size
100KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
460B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=40, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=24, id=261, version=33145,
count=1130, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=1, id=256, version=33145,
count=23, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WindowsInternal.ComposableShell.Display.dll
- IMPHASH 2eff1d8fc5b49816176916a3902f42b5
- SHA256 00a87cd5e1c9184b305b9547b92ee81f8f3e5a25caf7958b190c048a0a0f679d
- MD5 447c885219380c95771513e7f4d7c72a
- SHA1 f981492b36ef7028c83eb42a600c79b3e70a9acd
- SHA512 c5db8fa65b13965390ff4551d2e0308ac7b62a430e0605c46fc9ec6f572ef7f20e27359ddb098ca84cf7fcdcbb42491171ab5890c92680421d151b19051c9c99
- SSDEEP 12288:Spl8mWOD3JD6DmOqyAAL0DoQ4Ok7B6pYhklcgkQC:ShFOqyAAL0Do7Z7B2Y9mC
- TLSH T1220506691A9C06D1DAB9B17D9C6B8709F6B138460761A6CF0650020E9F7FBF8D93F231
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
16288
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WindowsInternal.ComposableShell.Display.pdb
api-ms-win-core-processthreads-l1-1-0
GetCurrentThread
GetCurrentProcessId
OpenThreadToken
CreateThread
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
api-ms-win-core-winrt-error-l1-1-0
RoFailFastWithErrorContext
RoOriginateError
GetRestrictedErrorInfo
SetRestrictedErrorInfo
RoTransformError
oleaut32
SetErrorInfo
SysFreeString
SysStringLen
GetErrorInfo
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
FreeLibrary
GetModuleFileNameA
GetProcAddress
GetModuleHandleW
LoadLibraryExW
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventWriteTransfer
EventUnregister
EventActivityIdControl
EventSetInformation
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
InitOnceBeginInitialize
InitOnceComplete
Sleep
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
RaiseException
ntdll
RtlPublishWnfStateData
RtlQueryRegistryValuesEx
api-ms-win-security-capability-l1-1-0
CapabilityCheck
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
WaitForSingleObjectEx
WaitForSingleObject
EnterCriticalSection
ReleaseSRWLockExclusive
SetEvent
ResetEvent
DeleteCriticalSection
AcquireSRWLockShared
CreateSemaphoreExW
WaitForMultipleObjectsEx
CreateEventExW
InitializeCriticalSectionEx
CreateMutexExW
ReleaseSemaphore
OpenSemaphoreW
CreateEventW
InitializeSRWLock
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
TryAcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseMutex
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringLen
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsCreateString
WindowsDeleteString
WindowsConcatString
WindowsDuplicateString
WindowsCompareStringOrdinal
api-ms-win-core-com-l1-1-0
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
CoTaskMemFree
CoGetCallContext
api-ms-win-ntuser-sysparams-l1-1-0
DisplayConfigGetDeviceInfo
DisplayConfigSetDeviceInfo
EnumDisplayMonitors
GetMonitorInfoW
EnumDisplayDevicesW
api-ms-win-core-registry-l1-1-0
RegEnumKeyExW
RegGetValueW
RegOpenKeyExW
RegCloseKey
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoGetActivationFactory
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-shcore-scaling-l1-1-1
GetScaleFactorForMonitor
api-ms-win-core-sysinfo-l1-1-0
GetTickCount64
GetSystemTimeAsFileTime
api-ms-win-core-apiquery-l2-1-0
IsApiSetImplemented
api-ms-win-rtcore-ntuser-private-l1-1-8
ord2637
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
wincorlib
?EventSourceGetTargetArray@Details@Platform@@YAPEAXPEAXPEAUEventLock@12@@Z
?EventSourceGetTargetArraySize@Details@Platform@@YAIPEAX@Z
?ResolveWeakReference@Details@Platform@@YAPE$AAVObject@2@AEBU_GUID@@PEAPEAU__abi_IUnknown@@@Z
?EventSourceGetTargetArrayEvent@Details@Platform@@YAPEAXPEAXIPEBXPEA_J@Z
??0InvalidArgumentException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0DisconnectedException@Platform@@QE$AAA@XZ
?CreateException@Exception@Platform@@SAPE$AAV12@H@Z
?GetWeakReference@Details@Platform@@YAPEAU__abi_IUnknown@@QE$ADVObject@2@@Z
??0NotImplementedException@Platform@@QE$AAA@XZ
?Allocate@Heap@Details@Platform@@SAPEAX_K0@Z
?get@Message@Exception@Platform@@QE$AAAPE$AAVString@3@XZ
?EventSourceInitialize@Details@Platform@@YAXPEAPEAX@Z
??0FailureException@Platform@@QE$AAA@XZ
??0OutOfMemoryException@Platform@@QE$AAA@XZ
??0ChangedStateException@Platform@@QE$AAA@XZ
??0OutOfBoundsException@Platform@@QE$AAA@XZ
?AllocateException@Heap@Details@Platform@@SAPEAX_K0@Z
?EventSourceUninitialize@Details@Platform@@YAXPEAPEAX@Z
?EventSourceRemove@Details@Platform@@YAXPEAPEAXPEAUEventLock@12@VEventRegistrationToken@Foundation@Windows@@@Z
?EventSourceAdd@Details@Platform@@YA?AVEventRegistrationToken@Foundation@Windows@@PEAPEAXPEAUEventLock@12@PE$AAVDelegate@2@@Z
??0Object@Platform@@QE$AAA@XZ
?ReleaseTarget@ControlBlock@Details@Platform@@AEAAXXZ
?AlignedFree@Heap@Details@Platform@@SAXPEAX@Z
?__abi_WinRTraiseNotImplementedException@@YAXXZ
?__abi_WinRTraiseInvalidCastException@@YAXXZ
?__abi_WinRTraiseNullReferenceException@@YAXXZ
?__abi_WinRTraiseOperationCanceledException@@YAXXZ
?__abi_WinRTraiseFailureException@@YAXXZ
?__abi_WinRTraiseAccessDeniedException@@YAXXZ
?__abi_WinRTraiseOutOfMemoryException@@YAXXZ
?__abi_WinRTraiseInvalidArgumentException@@YAXXZ
?__abi_WinRTraiseOutOfBoundsException@@YAXXZ
?__abi_WinRTraiseChangedStateException@@YAXXZ
?__abi_WinRTraiseClassNotRegisteredException@@YAXXZ
?__abi_WinRTraiseWrongThreadException@@YAXXZ
?__abi_WinRTraiseDisconnectedException@@YAXXZ
?__abi_WinRTraiseCOMException@@YAXJ@Z
?__abi_WinRTraiseObjectDisposedException@@YAXXZ
?ToString@uint32@default@@QEAAPE$AAVString@Platform@@XZ
?ToString@int64@default@@QEAAPE$AAVString@Platform@@XZ
?GetTypeCode@Type@Platform@@SA?AW4TypeCode@2@PE$AAV12@@Z
?__abi_make_type_id@@YAPE$AAVType@Platform@@AEBU__abi_type_descriptor@@@Z
?CreateValue@Details@Platform@@YAPE$AAVObject@2@W4TypeCode@2@PEBX@Z
?GetIBoxArrayVtable@Details@Platform@@YAPEAXPEAX@Z
?GetIBoxVtable@Details@Platform@@YAPEAXPEAX@Z
?__abi_ObjectToString@__abi_details@@YAPE$AAVString@Platform@@PE$AAVObject@3@_N@Z
?GetActivationFactory@Details@Platform@@YAJPEAVModuleBase@1WRL@Microsoft@@PEAUHSTRING__@@PEAPEAUIActivationFactory@@@Z
?TerminateModule@Details@Platform@@YA_NPEAVModuleBase@1WRL@Microsoft@@@Z
?get@Empty@Rect@Foundation@Windows@@SA?AV234@XZ
?Free@Heap@Details@Platform@@SAXPEAX@Z
?__abi_cast_Object_to_String@__abi_details@@YAPE$AAVString@Platform@@_NPE$AAVObject@3@@Z
?__abi_cast_String_to_Object@__abi_details@@YAPE$AAVObject@Platform@@PE$AAVString@3@@Z
??0NullReferenceException@Platform@@QE$AAA@XZ
?CreateException@Exception@Platform@@SAPE$AAV12@HPE$AAVString@2@@Z
?Union@Rect@Foundation@Windows@@QEAAXV123@@Z
?__abi_FailFast@@YAXXZ
?ReCreateFromException@Details@Platform@@YAJPE$AAVException@2@@Z
?InitializeData@Details@Platform@@YAJH@Z
??0Delegate@Platform@@QE$AAA@XZ
?UninitializeData@Details@Platform@@YAXH@Z
?GetIidsFn@@YAJHPEAKPEBU__s_GUID@@PEAPEAVGuid@Platform@@@Z
?GetActivationFactoryByPCWSTR@@YAJPEAXAEAVGuid@Platform@@PEAPEAX@Z
api-ms-win-crt-private-l1-1-0
__C_specific_handler
memcmp
memcpy
__CxxFrameHandler3
_CxxThrowException
wcsstr
__std_terminate
__CxxFrameHandler4
_o___std_exception_copy
_o___std_exception_destroy
_o___std_type_info_destroy_list
_o___stdio_common_vswprintf
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsicmp
_o__wcsnicmp
_o_abort
_o_ceilf
_o_free
_o_iswspace
_o_malloc
_o_pow
_o_sqrt
memmove
api-ms-win-crt-string-l1-1-0
wcslen
memset
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
msvcp_win
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ
?_Xlength_error@std@@YAXPEBD@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
_Cnd_broadcast
_Mtx_unlock
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_lock
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?GetNextAsyncId@platform@details@Concurrency@@YAIXZ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?_Xbad_function_call@std@@YAXXZ
_Cnd_wait
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?_IsNonBlockingThread@_Task_impl_base@details@Concurrency@@SA_NXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
_Mtx_destroy_in_situ
_Cnd_destroy_in_situ
?_Assign@_ContextCallback@details@Concurrency@@AEAAXPEAX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
_Mtx_init_in_situ
_Cnd_init_in_situ
ext-ms-win-rtcore-minuser-display-l1-1-0
ord2621
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
api-ms-win-core-util-l1-1-0
DecodePointer
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedPushEntrySList
api-ms-win-core-com-l1-1-1
RoGetAgileReference
DllCanUnloadNow
DllGetActivationFactory
Name
.text
Size
553KB
Virtual Size
553KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
153KB
Virtual Size
153KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
48KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=7, id=259, version=33145,
count=4, id=257, version=33145,
count=10, id=260, version=33145,
count=32, id=261, version=33145,
count=77, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1312, id=1, productName=Unmarked objects,
count=1, id=253, version=33145,
count=11, id=265, version=33145,
count=1, id=256, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WindowsInternal.Shell.CompUiActivation.dll
- IMPHASH a46394dbbe625b6af60f2944ec00f2c1
- SHA256 b8d3da30bda1852307c6fec1967edbcb02a2c5c82ce8a0055aa9c2e8656c8d1b
- MD5 023367aa998d0ff9a2d39a196eba1d0f
- SHA1 c6281c529fcc52a19d8477a1126016fe63eeb393
- SHA512 102bf35f7c842c6a73c4bf2a76c87c37525fa766e7ab401f7be771f2a476909304a3eb69a7dcad238bdc4f9925f005f4b4208e96095184888e88f52048c023f2
- SSDEEP 1536:8F9I2a05ujhIb9urntObA7Z1r7gw+yqnG36nJFfyAOlu:C0/uItmiB0QqGIaB8
- TLSH T149A3396A76AC10B6E171C17D89C3490AD372B466533297DF0390C26E1F27FE49D3AB92
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5408
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WindowsInternal.Shell.CompUiActivation.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_abort
_o_free
_o_iswspace
_o_malloc
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
GetModuleHandleW
GetProcAddress
GetModuleFileNameA
GetModuleHandleExW
LoadLibraryExW
api-ms-win-core-synch-l1-1-0
ReleaseSemaphore
CreateMutexExW
CreateSemaphoreExW
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
WaitForSingleObject
ReleaseSRWLockExclusive
ReleaseMutex
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
GetLastError
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InterlockedFlushSList
InitializeSListHead
InterlockedPushEntrySList
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
msvcp_win
?__ExceptionPtrCurrentException@@YAXPEAX@Z
_Thrd_yield
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?_Xlength_error@std@@YAXPEBD@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
oleaut32
GetErrorInfo
SysStringLen
SysFreeString
SetErrorInfo
api-ms-win-core-com-l1-1-0
CoGetObjectContext
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
CoGetApartmentType
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-winrt-error-l1-1-0
RoFailFastWithErrorContext
RoTransformError
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-threadpool-l1-2-0
TrySubmitThreadpoolCallback
DllCanUnloadNow
DllGetActivationFactory
Name
.text
Size
56KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
476B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=49, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=1139, id=1, productName=Unmarked objects,
count=2, id=257, version=33145,
count=24, id=261, version=33145,
count=1, id=256, version=33145,
count=5, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WindowsManagementServiceWinRt.ProxyStub.dll
- IMPHASH 8b06d0005ebbc15f5e467f4faa3f3c7d
- SHA256 403145df0ec74ea59b444e29696e39563efbc109332ef1aba08cbf6c5c93dffe
- MD5 8f5431f8962f3b92232c89ca46698c92
- SHA1 1ca989ddc76a01c771122e080f3214eab785d74b
- SHA512 90884afba4fab964c13c4fa66e88c38b826eafaa9cee0dded0ca6f77126f693ceb2c01aac88633602d90d8d7364caf5a3eb48cfa15edf0f81090c4d03b007302
- SSDEEP 3072:cOuJV6Hakr9UMLBUSzqe8DigTRtGl7Sgy:9kXJfSzqe8DigNtG
- TLSH T1BEF33B47B2E90A2BE07996714ABB4E106779FD059B92C3CF0020722D5D7BBC19F317A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
3f:5a:0b:30:72:77:cc:b3:8d:7f:e3:4f:3c:be:42:f0:6d:ab:78:72:3b:59:b1:e5:d0:03:fb:92:80:63:85:9c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:401A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:19:5e:b2:d8:54:75:f4:b1:8d:00:01:00:00:02:19
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
5056
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WindowsManagementServiceWinRt.ProxyStub.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
__C_specific_handler
_o___std_type_info_destroy_list
api-ms-win-crt-string-l1-1-0
memset
rpcrt4
NdrOleFree
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrOleAllocate
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-winrt-string-l1-1-0
HSTRING_UserMarshal64
HSTRING_UserUnmarshal
HSTRING_UserFree64
HSTRING_UserMarshal
HSTRING_UserUnmarshal64
HSTRING_UserSize64
HSTRING_UserFree
HSTRING_UserSize
DllCanUnloadNow
DllGetClassObject
GetProxyDllInfo
Name
.text
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
116KB
Virtual Size
114KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=29, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1100, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=4, id=259, version=33145,
count=11, id=261, version=33145,
count=1, id=256, version=33145,
count=8, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WindowsProtectedPrintConfiguration.dll
- IMPHASH 3fcdeb8ec3e43b6f219be2b8756ed701
- SHA256 51413100c61908c7beadbb9f078a2389e53d5bebac0b4babbad82b59a89db02b
- MD5 6c9950fdeb07d20d5eed7796440f9083
- SHA1 de04b491dc5b92b54110e9a709e08ce5a05b0295
- SHA512 2af9d3ff4a00edc7cdd3fad6304c1772332869b86927ca627c067b707fda0dd6f2d7aa24038f2dd294c8155bd4b4ea3793e6d65cbbed82ff7ad28c2ef5dbbf58
- SSDEEP 1536:Vu9YE/pLBi54tBpVhFpvxDJfxK8nGx5HgT5Y0N7RaZCIig:42Eri50tVxDJpBE5SY0N9a0g
- TLSH T145A32C6E62B820E6E076817CC6524A19E7727461672253FF03A081BD5F53FE06D3DFA2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
8416
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WindowsProtectedPrintConfiguration.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o_malloc
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
ntdll
NtQueryWnfStateData
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnsubscribeWnfStateChangeNotification
RtlPublishWnfStateData
RtlSubscribeWnfStateChangeNotification
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExW
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-synch-l1-1-0
AcquireSRWLockShared
CreateMutexExW
DeleteCriticalSection
SetEvent
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
CreateEventExW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CreateSemaphoreExW
ReleaseMutex
WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection
ReleaseSemaphore
EnterCriticalSection
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventWriteTransfer
EventActivityIdControl
EventSetInformation
EventUnregister
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-registry-l1-1-0
RegGetValueW
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
DisableWindowsProtectedPrint
EnableWindowsProtectedPrint
ProcessWindowsProtectedPrintCsp
ProcessWindowsProtectedPrintPolicy
Name
.text
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
276B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=41, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1138, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=24, id=261, version=33145,
count=1, id=256, version=33145,
count=4, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
Winlangdb.dll
- IMPHASH 3c04fa9942c11a7e47b119785d09f96f
- SHA256 b61ac078494d1eca753f62414037c4bcb7690119339dec58a68a436c8c1cd5d0
- MD5 d825a5bc89d13ab3f715ffac8e50660f
- SHA1 4692093d215820e0aa2cd97a1be481d36db61826
- SHA512 54264fcc7b774a7098eb3e35b6be47e75d23372434edaee5e9cb7411d4ac36ef78808200aaf8b8f81e5633e0163f9178dd70c2bcd9b0b0be8fb58bd5d56256fa
- SSDEEP 3072:Uzz67eD7xL40ccCdWB5BzwEjB+gBECEe577YFdsVkZ2jAa7:t7o760cc6U5hEgBECEO8Fd8C2jAa
- TLSH T17524199B6B6D1176D0B6807D85CB4A4AF7B2F41223129BDF425003790E27BEC6D3BB25
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7872
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Winlangdb.pdb
msvcp_win
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Xbad_function_call@std@@YAXXZ
?id@?$collate@G@std@@2V0locale@2@A
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?tolower@?$ctype@G@std@@QEBAGG@Z
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
??Bid@locale@std@@QEAA_KXZ
?id@?$ctype@G@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
??0_Locinfo@std@@QEAA@PEBD@Z
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??1_Lockit@std@@QEAA@XZ
??1_Locinfo@std@@QEAA@XZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?is@?$ctype@G@std@@QEBA_NFG@Z
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Incref@facet@locale@std@@UEAAXXZ
_Wcscoll
_Wcsxfrm
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__register_onexit_function
_o__seh_filter_dll
_o___stdio_common_vswprintf
memmove
_o_ceilf
_o_free
_o_malloc
_o_realloc
__C_specific_handler
_CxxThrowException
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
wcschr
_o___stdio_common_vswscanf
strchr
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
LoadStringW
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA
GetProcAddress
api-ms-win-core-synch-l1-1-0
CreateEventW
ReleaseMutex
WaitForSingleObjectEx
WaitForSingleObject
ResetEvent
ReleaseSemaphore
OpenSemaphoreW
EnterCriticalSection
CreateSemaphoreExW
CreateMutexExW
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
DeleteCriticalSection
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
SetLastError
SetUnhandledExceptionFilter
RaiseException
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
OpenProcessToken
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
LocaleNameToLCID
FindNLSStringEx
GetUserPreferredUILanguages
GetLocaleInfoEx
FormatMessageW
IsValidLocaleName
ResolveLocaleName
GetUserDefaultLocaleName
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringOrdinal
CompareStringEx
api-ms-win-core-winrt-string-l1-1-0
WindowsStringHasEmbeddedNull
WindowsDuplicateString
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateStringReference
WindowsGetStringLen
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventSetInformation
EventRegister
EventUnregister
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoTaskMemFree
api-ms-win-core-localization-l1-2-1
EnumSystemLocalesEx
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegCloseKey
RegGetValueW
RegCreateKeyExW
api-ms-win-core-localization-private-l1-1-0
LoadStringByReference
api-ms-win-security-base-l1-1-0
GetLengthSid
CopySid
IsWellKnownSid
GetTokenInformation
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
kernelbase
OpenGlobalizationUserSettingsKey
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
ntdll
NtClose
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
Bcp47GetEnglishName
Bcp47GetLocalizedName
Bcp47GetLocalizedScript
Bcp47GetNativeName
EnsureLanguageProfileExists
GetLanguageNames
GetLocaleFromLanguageAndRegion
GetRegionalFormatList
IsoScriptGetLocalizedName
LanguagesDatabaseGetChildLanguages
LanguagesDatabaseGetLeafLanguages
LanguagesDatabaseHasChildren
LanguagesDatabaseHasLocalizedContent
SetUserLanguages
SetUserLanguagesCore
SetUserLanguagesNoSpeller
Name
.text
Size
104KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
72KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
224B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=60, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33145,
count=5, id=259, version=33145,
count=1217, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=26, id=261, version=33145,
count=1, id=256, version=33145,
count=11, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WiredNetworkCSP.dll
- IMPHASH fecfa95987f3a642730527eb8a16b3f3
- SHA256 58930bd3cc9af31884b1898db9aae16916a5ca0675c2604e399a0c68983d7859
- MD5 d7ab2cb0797819c237eee394cce0ebd9
- SHA1 35f6db901efcb17f56097981ffcc2bb82fd662c3
- SHA512 da336be6a7919de4b686d69d884cd30582c4db4da0d79aefdc2325a53f518cf85ecb8424b70f1cee9af27bb318a477d64c26e8b624d89b8b368a1f0181a6cbbd
- SSDEEP 1536:y+di0ysxHOkEJjhrKt/KKm6TGUCW0GH1ePHo5MoT997fJE+K05iGY6:oAROjIK7QGhlGH1X997VLAGX
- TLSH T131A30A6D73B830A6D52A817DC5924659E3B1B4251B2217EF03A0C1BDAF23FE41E38F95
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5664
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WiredNetworkCSP.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o___std_exception_copy
memmove
_o__wcsicmp
_o_free
_o_malloc
_o_memcpy_s
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o___stdio_common_vswprintf
wcsstr
__std_terminate
__CxxFrameHandler4
memcmp
_o___std_type_info_destroy_list
_o___std_exception_destroy
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExA
GetModuleHandleW
GetProcAddress
GetModuleFileNameA
GetModuleHandleExW
DisableThreadLibraryCalls
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
SetLastError
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-synch-l1-1-0
SetEvent
AcquireSRWLockExclusive
LeaveCriticalSection
CreateSemaphoreExW
CreateMutexExW
OpenSemaphoreW
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSectionEx
EnterCriticalSection
WaitForSingleObjectEx
ReleaseMutex
ReleaseSemaphore
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
CreateEventA
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
UnregisterTraceGuids
api-ms-win-eventing-obsolete-l1-1-0
RegisterTraceGuidsA
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
api-ms-win-service-winsvc-l1-1-0
QueryServiceConfigA
ChangeServiceConfigA
ControlService
QueryServiceStatus
OpenSCManagerA
api-ms-win-service-management-l1-1-0
CloseServiceHandle
OpenServiceW
StartServiceW
api-ms-win-service-private-l1-1-0
UnsubscribeServiceChangeNotifications
SubscribeServiceChangeNotifications
oleaut32
VariantInit
SysFreeString
SysAllocString
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoCreateInstance
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
dot3api
Dot3SetProfileEapXmlUserData
Dot3DeleteProfile
Dot3QueryAutoConfigParameter
Dot3SetAutoConfigParameter
Dot3SetProfile
Dot3CloseHandle
Dot3FreeMemory
Dot3GetProfile
Dot3OpenHandle
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
440B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=53, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1160, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=24, id=261, version=33145,
count=1, id=256, version=33145,
count=16, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WirelessNetworkPreferenceCSP.dll
- IMPHASH 762b7b1acdc3487d5a6203195d6be30f
- SHA256 cacd407ff244e4d202082f21a804e5232b010c651a12415bc0930aad6260bf68
- MD5 2f8cceb80e5de0b33b1d5b8e9d76206f
- SHA1 8fed35e810e6c4dd96cd27d637fc88aaaed7569a
- SHA512 6cf133950b73a13c88a9c42c550f828de7ab3ffb19f3df72f6d1f4a986314c05230ebd89d5b58c44937a9eccf48be84bde66ab720e30e90c961f049504f0472a
- SSDEEP 3072:ClrnX1OG7CUb203vOeUnjfaQgtxkF9w9/PIXcxTsoy2D5EN2ZRGk6Xl:AXxZbfvOetv892HIUa2RGkM
- TLSH T134244B5A769900B5D57BE178CF87460AF3B2B425432152CF06E0927B5F37BE8B839B60
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7728
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WirelessNetworkPreferenceCSP.pdb
msvcp_win
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__configure_narrow_argv
_o__create_locale
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__free_locale
_o__i64toa_s
_o__i64tow_s
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memcmp
_o__cexit
_o__ui64toa_s
_o__ui64tow_s
_o__wcsicmp
_o__wcstod_l
_o_abort
_o_ceilf
_o_free
_o_iswspace
_o_malloc
_o_memcpy_s
_o_terminate
__C_specific_handler
__CxxFrameHandler3
__current_exception
__current_exception_context
_CxxThrowException
memmove
_o__callnewh
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnwprintf_s
memcpy
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___pctype_func
__std_terminate
__CxxFrameHandler4
api-ms-win-crt-string-l1-1-0
strnlen
wcsnlen
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetModuleHandleW
GetModuleHandleExA
DisableThreadLibraryCalls
GetModuleFileNameA
GetProcAddress
api-ms-win-core-synch-l1-1-0
OpenSemaphoreW
ResetEvent
AcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSRWLockExclusive
InitializeCriticalSectionAndSpinCount
CreateEventW
ReleaseMutex
SetEvent
WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection
CreateMutexExW
ReleaseSemaphore
EnterCriticalSection
AcquireSRWLockShared
DeleteCriticalSection
CreateSemaphoreExW
WaitForSingleObjectEx
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
SetLastError
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
GetLocaleInfoEx
FormatMessageA
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventSetInformation
EventWriteTransfer
EventRegister
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoTaskMemAlloc
oleaut32
SysAllocString
VariantClear
SysFreeString
VariantInit
api-ms-win-core-registry-l1-1-0
RegGetValueW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
mobilenetworking
PersistentRegPathGetDWORD
GetPersistentRegPath
PersistentRegPathSetDWORD
ntdll
RtlPublishWnfStateData
RtlQueryWnfStateData
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
140KB
Virtual Size
137KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=56, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=1195, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=33, id=261, version=33145,
count=7, id=259, version=33145,
count=1, id=256, version=33145,
count=17, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WlanMediaManager.dll
- IMPHASH 33354e4ddbef0201b3cb75b41c9132b5
- SHA256 fd4f5bf809b7b4535b608a5477446771e086fe459bd48b178c4ec79fd8961b75
- MD5 edad96034118daf0fa44e6fb230c4d9e
- SHA1 2dbcaec4a3c3d710471b3455c77205127272687d
- SHA512 afce1adc271adc02fe5bb810136eae2fd8037943b4b25dfa4c93e2d46d92656d789698ccc8335b05a1831247352291d865a1a148d025b93404d388189f1e168f
- SSDEEP 24576:wy0WxEfELropinHHI6ebeqCko1WJP1KnctXx:LzLUpSkiqCko1WJdKk
- TLSH T10A056C2EABEC0195D5BAD27C85834B1EF6B1B429473196CF0170027E9F17BE44E3AB25
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
16032
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WlanMediaManager.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsicmp
_o__wgetenv
_o__wtoi
_o__wtol
_o_abort
_o_ceilf
_o_free
_o_isblank
_o_iswdigit
_o_iswspace
_o_iswxdigit
_o_malloc
_o_mbstowcs_s
_o_mbtowc
_o_memcpy_s
_o_realloc
_o_terminate
_o_towlower
_o_towupper
_o_wcscpy_s
_o_wcstok_s
_o_wcstol
_o_wcstombs_s
_o_wmemcpy_s
__C_specific_handler
__current_exception
__current_exception_context
__CxxFrameHandler3
_CxxThrowException
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
strchr
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
memmove
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
strncmp
wcscmp
strcmp
memset
ntdll
RtlGetDeviceFamilyInfoEnum
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlIsMultiSessionSku
RtlUnsubscribeWnfStateChangeNotification
RtlIpv6StringToAddressExW
EtwTraceMessage
RtlIpv4StringToAddressExW
RtlIpv6AddressToStringExW
RtlIpv4AddressToStringExW
RtlUnsubscribeWnfNotificationWaitForCompletion
NtOpenFile
RtlSubscribeWnfStateChangeNotification
NtQueryWnfStateData
NtQueryInformationToken
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
GetProcAddress
GetModuleFileNameA
GetModuleHandleW
LoadLibraryExW
GetModuleHandleExA
GetModuleHandleExW
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
ReleaseMutex
WaitForSingleObjectEx
WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection
OpenSemaphoreW
ReleaseSemaphore
EnterCriticalSection
ReleaseSRWLockShared
CreateMutexExW
CreateSemaphoreExW
AcquireSRWLockShared
DeleteCriticalSection
InitializeSRWLock
ResetEvent
CreateEventExW
ReleaseSRWLockExclusive
InitializeCriticalSection
SetEvent
CreateEventW
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
RaiseException
SetLastError
SetUnhandledExceptionFilter
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-processthreads-l1-1-0
OpenProcessToken
CreateThread
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
SetThreadToken
GetCurrentThreadId
ProcessIdToSessionId
GetCurrentThread
OpenThreadToken
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
InitOnceExecuteOnce
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetLocalTime
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
msvcp_win
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?is@?$ctype@G@std@@QEBA_NFG@Z
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??0_Locinfo@std@@QEAA@PEBD@Z
?_Xbad_function_call@std@@YAXXZ
?tolower@?$ctype@G@std@@QEBAGG@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$collate@G@std@@2V0locale@2@A
?id@?$ctype@G@std@@2V0locale@2@A
?_Xbad_alloc@std@@YAXXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
_Wcsxfrm
_Wcscoll
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Xlength_error@std@@YAXPEBD@Z
??Bid@locale@std@@QEAA_KXZ
??1_Locinfo@std@@QEAA@XZ
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-core-registry-l1-1-0
RegOpenCurrentUser
RegGetValueW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegEnumValueW
api-ms-win-service-management-l1-1-0
OpenSCManagerW
OpenServiceW
CloseServiceHandle
api-ms-win-service-winsvc-l1-1-0
QueryServiceStatus
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventSetInformation
EventRegister
EventActivityIdControl
EventWriteTransfer
api-ms-win-core-sysinfo-l1-2-0
GetOsSafeBootMode
rpcrt4
RpcBindingCreateW
RpcBindingBind
RpcExceptionFilter
UuidToStringW
UuidHash
RpcStringFreeW
NdrClientCall3
RpcBindingFree
api-ms-win-security-base-l1-1-0
CheckTokenMembership
GetTokenInformation
DuplicateTokenEx
DuplicateToken
CreateWellKnownSid
api-ms-win-core-heap-l2-1-0
LocalFree
GlobalAlloc
LocalAlloc
GlobalFree
iphlpapi
InternalCreateIpForwardEntry2
ConvertInterfaceLuidToNameW
GetUnicastIpAddressTable
GetAdaptersAddresses
GetIpForwardTable2
InternalDeleteUnicastIpAddressEntry
GetInterfaceDnsSettings
InitializeUnicastIpAddressEntry
FreeMibTable
ConvertInterfaceLuidToAlias
ConvertInterfaceGuidToLuid
InitializeIpForwardEntry
SetInterfaceDnsSettings
InternalDeleteIpForwardEntry2
GetIfStackTable
InternalCreateUnicastIpAddressEntry
GetIfTable2Ex
FreeInterfaceDnsSettings
ConvertInterfaceLuidToIndex
api-ms-win-core-string-l2-1-1
SHLoadIndirectString
api-ms-win-core-file-l1-1-0
WriteFile
CompareFileTime
CreateFileW
FileTimeToLocalFileTime
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
SystemTimeToFileTime
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-service-private-l1-1-0
SubscribeServiceChangeNotifications
UnsubscribeServiceChangeNotifications
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolQueueTask
SHTaskPoolGetUniqueContext
api-ms-win-security-accesshlpr-l1-1-0
FreeTransientObjectSecurityDescriptor
api-ms-win-core-heap-obsolete-l1-1-0
GlobalLock
GlobalUnlock
api-ms-win-core-shlwapi-obsolete-l1-1-0
QISearch
api-ms-win-core-threadpool-legacy-l1-1-0
DeleteTimerQueueTimer
CreateTimerQueueTimer
api-ms-win-appmodel-runtime-l1-1-0
GetCurrentPackageId
api-ms-win-core-registry-l2-1-0
RegEnumKeyW
api-ms-win-core-datetime-l1-1-1
GetDateFormatEx
GetTimeFormatEx
api-ms-win-core-io-l1-1-0
DeviceIoControl
dhcpcsvc6
Dhcpv6EnableDhcp
Dhcpv6IsEnabled
dhcpcsvc
DhcpEnableDhcp
DhcpIsEnabled
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
592KB
Virtual Size
589KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
152KB
Virtual Size
151KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
36KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=101, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=17, id=260, version=33145,
count=5, id=259, version=33145,
count=1451, id=1, productName=Unmarked objects,
count=4, id=257, version=33145,
count=33, id=261, version=33145,
count=1, id=256, version=33145,
count=78, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
windowslivelogin.dll
- IMPHASH fdb90fb30954ea2db613ec1120f0254b
- SHA256 a4555a8ee0bbfdee7a1fb021029f0b4d2589417b1a334b130ef2a54bcdbd5e2f
- MD5 6dd4b3df78db5e93be5e86bb7b57b243
- SHA1 3192d6eb8cbd99719594c2fe71b29755f4984540
- SHA512 da6258cd0b2de3aaade66ae648945b646ce797290e602034705dac7ef9841db2b16e47232951ab06354369e24d42331bfc82a7a0c9ff3e9a54c4047406a99769
- SSDEEP 6144:QuAcsHZrCbseb8saUTwoBLOK21r8noTY58ryANhhJ/36zM8YjhhAjry:+ZZ+bhxa4wo5H21r8noTY58OANbJAny
- TLSH T1B364391DA69908A6E87BE13DC5934629E7B2B8104331D2CF0650827E5F37BD4FA39F45
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
10608
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WindowsLiveLogin.pdb
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-string-l1-1-0
wcscspn
memset
wcscmp
wcsspn
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__localtime64_s
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__wcsicmp
_o__wcslwr_s
_o_calloc
_o_free
_o_iswspace
_o_malloc
_o_memcpy_s
_o_terminate
_o_toupper
_o_wcsftime
_o_wcsncpy_s
_o_wcstol
_o_wmemcpy_s
__current_exception
__current_exception_context
__CxxFrameHandler3
_o___stdio_common_vswprintf_s
_CxxThrowException
_o___stdio_common_vswprintf
_o__execute_onexit_table
_o__errno
_o___std_type_info_destroy_list
_o__crt_atexit
_o__configure_narrow_argv
_o___std_exception_destroy
_o___std_exception_copy
_o__cexit
_o__callnewh
wcsstr
strrchr
wcsrchr
__std_terminate
__C_specific_handler
__CxxFrameHandler4
__C_specific_handler_noexcept
memcmp
memcpy
memmove
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameW
LoadResource
GetModuleHandleExW
SizeofResource
GetProcAddress
FindResourceExW
LockResource
GetModuleHandleW
FreeLibrary
LoadLibraryExW
GetModuleFileNameA
api-ms-win-core-synch-l1-1-0
WaitForSingleObjectEx
ReleaseSRWLockShared
OpenSemaphoreW
AcquireSRWLockShared
CreateEventW
ReleaseMutex
CreateEventExW
ReleaseSRWLockExclusive
WaitForMultipleObjectsEx
WaitForSingleObject
InitializeCriticalSection
LeaveCriticalSection
ResetEvent
SetEvent
AcquireSRWLockExclusive
ReleaseSemaphore
EnterCriticalSection
CreateMutexExW
CreateSemaphoreExW
DeleteCriticalSection
InitializeCriticalSectionEx
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapDestroy
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoGetCallerTID
CoUninitialize
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegGetValueW
RegDeleteValueW
RegSetKeySecurity
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegCloseKey
RegOpenCurrentUser
RegDeleteKeyExW
RegDeleteTreeW
RegEnumValueW
RegQueryInfoKeyW
RegOpenKeyExW
api-ms-win-core-processthreads-l1-1-0
OpenThreadToken
GetCurrentThreadId
OpenProcessToken
GetCurrentProcessId
GetProcessIdOfThread
GetCurrentProcess
TerminateProcess
OpenThread
GetCurrentThread
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetVersionExW
GetSystemDirectoryW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-localization-l1-2-0
GetUserDefaultLocaleName
FormatMessageW
GetThreadPreferredUILanguages
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventUnregister
EventSetInformation
EventWriteTransfer
EventActivityIdControl
api-ms-win-core-version-l1-1-0
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CloseThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
rpcrt4
I_RpcBindingInqLocalClientPID
UuidCreate
MesDecodeBufferHandleCreate
NdrMesTypeAlignSize3
NdrMesTypeEncode3
MesHandleFree
RpcAsyncInitializeHandle
RpcBindingFree
RpcStringFreeW
RpcBindingSetAuthInfoExW
RpcStringBindingComposeW
RpcBindingFromStringBindingW
MesBufferHandleReset
RpcAsyncCancelCall
Ndr64AsyncClientCall
RpcSsDestroyClientContext
MesEncodeFixedBufferHandleCreate
RpcAsyncCompleteCall
crypt32
CryptStringToBinaryW
CryptUnprotectMemory
CryptProtectData
CryptUnprotectData
CryptProtectMemory
api-ms-win-security-base-l1-1-0
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
ImpersonateLoggedOnUser
RevertToSelf
IsValidSid
CreateWellKnownSid
GetTokenInformation
api-ms-win-security-lsalookup-l2-1-0
LookupAccountNameW
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
userenv
GetProfileType
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-service-management-l1-1-0
CloseServiceHandle
OpenSCManagerW
OpenServiceW
api-ms-win-service-management-l2-1-0
QueryServiceConfigW
api-ms-win-service-winsvc-l1-1-0
QueryServiceStatus
api-ms-win-core-url-l1-1-0
UrlGetPartW
api-ms-win-core-kernel32-legacy-l1-1-0
GetComputerNameW
api-ms-win-security-provider-l1-1-0
SetNamedSecurityInfoW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-localization-obsolete-l1-2-0
GetUserDefaultUILanguage
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
164KB
Virtual Size
163KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
92KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
240B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=97, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=16, id=260, version=33145,
count=5, id=259, version=33145,
count=1329, id=1, productName=Unmarked objects,
count=4, id=257, version=33145,
count=30, id=261, version=33145,
count=1, id=256, version=33145,
count=49, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
windowsperformancerecordercontrol.dll
- IMPHASH 9a33ff769ca5e01ae52c818d7fe45410
- SHA256 e78413e5e1310be735d33cf3547afb8142dcf3a6e4958af2486a45743ec519b6
- MD5 4432ee75053b5220098726771ddab7bc
- SHA1 767e90b04a56ae37e6dbb1519c31daf022fc88f6
- SHA512 578195bccd077caf6b39347412d81121c766e19d08aed49f5a79f30613def39dc47628a4f1b23c086f0c8ef90a665a3823f77fbfbf3b86b744a505a31742c30a
- SSDEEP 24576:SEsACJihBWPSShlz9ZzccF991Dl3wmhnKxE:SEsACJibwSSLcYP39hnKxE
- TLSH T19B553A1497EC8420C6B7A9359AA68E15EE7070E3073146CBB09D623EAF33ED64D37761
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7504
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WindowsPerformanceRecorderControl.pdb
api-ms-win-crt-string-l1-1-0
wcsnlen
wcspbrk
wcsspn
wcscspn
wcscmp
memset
wcsncmp
strncmp
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__gmtime64
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__memicmp
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
_o__stricmp
_o__ultow_s
memmove
_o__wcsicmp
_o__wcslwr_s
_o__wcsnicmp
_o__wcstoui64
_o__wfullpath
_o__wtof
_o__wtoi
_o_calloc
_o_ceil
_o_ceilf
_o_free
_o_iswdigit
_o_iswspace
_o_malloc
_o_realloc
_o_terminate
_o_towlower
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstod
_o_wcstol
_o_wcstoul
_o_wmemcpy_s
__current_exception
__current_exception_context
_CxxThrowException
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
wcsstr
wcsrchr
wcschr
__C_specific_handler
__CxxFrameHandler3
__C_specific_handler_noexcept
memchr
memcmp
memcpy
strrchr
api-ms-win-core-libraryloader-l1-1-0
LoadLibraryExW
FreeLibrary
LoadResource
LockResource
GetModuleFileNameW
GetModuleHandleExW
DisableThreadLibraryCalls
FindResourceExW
SizeofResource
GetProcAddress
GetModuleFileNameA
GetModuleHandleW
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
CreateEventW
ReleaseMutex
AcquireSRWLockShared
SetEvent
InitializeCriticalSectionEx
InitializeCriticalSection
LeaveCriticalSection
AcquireSRWLockExclusive
WaitForSingleObjectEx
ReleaseSemaphore
EnterCriticalSection
ReleaseSRWLockExclusive
ReleaseSRWLockShared
CreateSemaphoreExW
OpenSemaphoreW
CreateMutexExW
WaitForSingleObject
api-ms-win-core-heap-l1-1-0
HeapDestroy
HeapAlloc
HeapReAlloc
HeapSize
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
RaiseException
GetLastError
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
GetCurrentThread
GetExitCodeProcess
CreateProcessW
api-ms-win-core-localization-l1-2-0
LCMapStringEx
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventRegister
EventUnregister
EventWriteTransfer
api-ms-win-core-file-l1-1-0
GetFinalPathNameByHandleW
WriteFile
GetFileTime
SetFilePointer
GetFileSize
ReadFile
FindClose
FindVolumeClose
FindNextVolumeW
FindFirstVolumeW
FindNextFileW
QueryDosDeviceW
CreateDirectoryW
CreateFileW
GetFileAttributesW
FindFirstFileExW
SetFilePointerEx
FindFirstFileW
GetTempFileNameW
RemoveDirectoryW
DeleteFileW
GetFullPathNameW
api-ms-win-core-processtopology-obsolete-l1-1-0
GetActiveProcessorCount
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegQueryValueExW
RegDeleteValueW
RegEnumValueW
RegSetValueExW
RegCreateKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
api-ms-win-eventing-controller-l1-1-0
StartTraceW
ControlTraceW
EnumerateTraceGuidsEx
TraceSetInformation
TraceQueryInformation
QueryAllTracesW
api-ms-win-core-file-l1-2-0
GetTempPathW
GetVolumePathNamesForVolumeNameW
api-ms-win-core-sysinfo-l1-2-0
GetNativeSystemInfo
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
SetEnvironmentVariableW
api-ms-win-eventing-classicprovider-l1-1-0
UnregisterTraceGuids
TraceEvent
RegisterTraceGuidsW
api-ms-win-core-shlwapi-legacy-l1-1-0
PathRemoveBackslashW
PathAddBackslashW
PathAddExtensionW
PathAppendW
api-ms-win-core-processthreads-l1-1-1
OpenProcess
IsProcessorFeaturePresent
api-ms-win-core-wow64-l1-1-0
IsWow64Process
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
api-ms-win-core-sysinfo-l1-1-0
GetSystemDirectoryW
GetSystemWindowsDirectoryW
GetVersionExW
GetWindowsDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GlobalMemoryStatusEx
GetTickCount
api-ms-win-core-kernel32-legacy-l1-1-0
CopyFileW
FindResourceW
api-ms-win-core-heap-obsolete-l1-1-0
LocalFree
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
ntdll
RtlAdjustPrivilege
NtQuerySystemInformation
RtlAcquireSRWLockExclusive
RtlReleaseSRWLockExclusive
NtSetSystemInformation
NtSetIntervalProfile
RtlNtStatusToDosError
RtlQueryHeapInformation
RtlSetHeapInformation
RtlImageDirectoryEntryToData
RtlImageRvaToVa
RtlInitUnicodeString
RtlGUIDFromString
RtlGetVersion
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
api-ms-win-core-memory-l1-1-0
CreateFileMappingW
UnmapViewOfFile
MapViewOfFileEx
api-ms-win-core-version-l1-1-0
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
WPRCControlLogging
WPRCCreateInstance
WPRCCreateInstanceUnderInstanceName
WPRCDisableBuiltinProfiles
WPRCFormatError
WPRCQueryBuiltInProfiles
WPRCReleaseInstanceByName
WPRCRemoveLogging
Name
.text
Size
624KB
Virtual Size
622KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
196KB
Virtual Size
194KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
28KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
396KB
Virtual Size
395KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=85, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1294, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=28, id=261, version=33145,
count=1, id=256, version=33145,
count=57, id=264, version=33145,
count=2, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
windowsudk.shellcommon.dll
- IMPHASH b28d5d6a2378204e0ce86a45a5b16642
- SHA256 6779d4dee17aae3040f27e7ffa9240008a85f62683080e48a2d6a3da2e7ef8f8
- MD5 c2bbf488252f8c983c8c866b154105ea
- SHA1 02da5a97833f7f73d3fbaf192c2906b4dd1b9a4b
- SHA512 0a73f813326d333f7d54db6eca6b4f637a3e15317dc8e98a3407a016e2a4058ad6754a35773dc0fae822bca9605c5755cf5a316d0f07b44a5e59809ad43041b8
- SSDEEP 98304:1iI/OyyUa0cTnSVPq6wos4YU29KC8RhAOprerrz4+p9M/qh8O:NlAmi3t8O
- TLSH T15866591A2BBC0196E0BAD13DCAA74A0FD6B27826537197CF0111465E0F2BBF9853B771
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
1004752
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
windowsudk.shellcommon.pdb
msvcp_win
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?_Syserror_map@std@@YAPEBDH@Z
?width@ios_base@std@@QEAA_J_J@Z
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?flags@ios_base@std@@QEBAHXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?good@ios_base@std@@QEBA_NXZ
?uncaught_exception@std@@YA_NXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ
?width@ios_base@std@@QEBA_JXZ
?_Winerror_map@std@@YAHH@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?pbase@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z
_Cnd_init_in_situ
_Cnd_destroy_in_situ
_Cnd_timedwait
_Mtx_current_owns
_Cnd_broadcast
_Xtime_get_ticks
?setf@ios_base@std@@QEAAHHH@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
?_Incref@facet@locale@std@@UEAAXXZ
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
??Bid@locale@std@@QEAA_KXZ
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?fail@ios_base@std@@QEBA_NXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
??0task_continuation_context@Concurrency@@AEAA@XZ
?_Assign@_ContextCallback@details@Concurrency@@AEAAXPEAX@Z
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ
_Cnd_wait
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
_Cnd_signal
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?id@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A
?_Getcat@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?get@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@PEB_W4@Z
?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
_Thrd_detach
_Cnd_register_at_thread_exit
?__ExceptionPtrToBool@@YA_NPEBX@Z
_Cnd_unregister_at_thread_exit
?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W0@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z
?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?_Xbad_function_call@std@@YAXXZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
??Bios_base@std@@QEBA_NXZ
_Cnd_do_broadcast_at_thread_exit
_Thrd_id
_Thrd_join
_Mtx_unlock
_Mtx_lock
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Query_perf_frequency
_Query_perf_counter
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
_Thrd_yield
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?_Xbad_alloc@std@@YAXXZ
?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__localtime64_s
_o__lock_file
_o__mktime64
_o__msize
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__ui64tow_s
_o__unlock_file
_o__wcsicmp
_o__wcsnicmp
_o__wcstoui64
_o__wtoi
_o_abort
_o_acos
_o_asin
_o_asinh
_o_atan
_o_atan2
_o_atanh
_o_ceil
_o_ceilf
_o_cos
_o_cosh
_o_exp
_o_fclose
_o_fflush
_o_fgetc
_o_floor
_o_fmod
_o_fputc
_o_fread
_o_free
_o_fsetpos
_o_fwrite
_o_iswspace
_o_log
_o_log10
_o_log2
_o_malloc
_o_memcpy_s
_o_pow
_o_realloc
_o_setvbuf
_o_sin
_o_sinh
_o_sqrt
_o_tan
_o_tanh
_o_terminate
_o_towlower
_o_towupper
_o_ungetc
_o_wcscpy_s
_o_wcstok_s
_o_wcstol
_o_wcstombs
_o_wcstoul
__C_specific_handler
__current_exception
__current_exception_context
_CxxThrowException
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__execute_onexit_table
_o__errno
_o__endthreadex
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o__beginthreadex
_o__get_stream_buffer_pointers
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o__get_errno
_o___stdio_common_vsprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__CxxFrameHandler3
memmove
memcpy
memcmp
memchr
strrchr
strchr
wcsrchr
__std_type_info_compare
wcsstr
wcschr
_o____lc_codepage_func
__std_terminate
__CxxFrameHandler4
_o_acosh
_o__fseeki64
_o_fgetpos
api-ms-win-crt-string-l1-1-0
wcscmp
memset
strncmp
strcspn
strspn
strcmp
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExA
GetProcAddress
AddDllDirectory
GetModuleFileNameA
FindStringOrdinal
GetModuleHandleExA
LoadLibraryExW
GetModuleHandleExW
LoadStringW
FreeLibrary
GetModuleHandleW
RemoveDllDirectory
api-ms-win-core-synch-l1-1-0
TryEnterCriticalSection
ReleaseMutex
WaitForSingleObject
ReleaseSemaphore
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
LeaveCriticalSection
CreateMutexExW
ReleaseSRWLockExclusive
ResetEvent
AcquireSRWLockExclusive
CreateEventW
ReleaseSRWLockShared
OpenSemaphoreW
AcquireSRWLockShared
DeleteCriticalSection
WaitForMultipleObjectsEx
CreateEventExW
CreateSemaphoreExW
InitializeCriticalSectionEx
SetEvent
CreateMutexW
InitializeCriticalSection
WaitForSingleObjectEx
api-ms-win-core-heap-l1-1-0
HeapReAlloc
HeapDestroy
HeapSize
HeapCompact
HeapFree
HeapAlloc
GetProcessHeap
HeapCreate
HeapValidate
api-ms-win-core-errorhandling-l1-1-0
GetLastError
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
api-ms-win-core-processthreads-l1-1-0
OpenThread
TerminateProcess
GetCurrentProcess
GetProcessIdOfThread
ProcessIdToSessionId
GetExitCodeProcess
SetThreadToken
GetCurrentThreadId
OpenProcessToken
OpenThreadToken
CreateProcessW
GetProcessTimes
GetCurrentProcessId
ResumeThread
GetProcessId
GetCurrentThread
api-ms-win-core-localization-l1-2-0
LCMapStringW
FormatMessageW
GetLocaleInfoEx
GetThreadPreferredUILanguages
ResolveLocaleName
FormatMessageA
FindNLSString
LocaleNameToLCID
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringA
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
CompareStringW
WideCharToMultiByte
CompareStringOrdinal
api-ms-win-eventing-provider-l1-1-0
EventActivityIdControl
EventSetInformation
EventUnregister
EventRegister
EventWriteTransfer
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
WaitOnAddress
InitOnceExecuteOnce
WakeByAddressAll
Sleep
SleepConditionVariableSRW
WakeAllConditionVariable
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
GetSystemTime
GetVersionExW
GetSystemTimeAsFileTime
GetTickCount
GetComputerNameExW
GlobalMemoryStatusEx
GetSystemDirectoryW
GetSystemWindowsDirectoryW
api-ms-win-core-interlocked-l1-1-0
InterlockedFlushSList
InterlockedPushEntrySList
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlCaptureStackBackTrace
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
OpenProcess
IsProcessorFeaturePresent
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolTimer
TrySubmitThreadpoolCallback
SetThreadpoolWait
SetThreadpoolWaitEx
SetThreadpoolTimerEx
WaitForThreadpoolTimerCallbacks
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
CreateThreadpoolTimer
api-ms-win-security-base-l1-1-0
CreateWellKnownSid
CheckTokenMembership
CopySid
GetSidSubAuthorityCount
AllocateLocallyUniqueId
RevertToSelf
GetTokenInformation
InitializeAcl
IsValidSid
GetAce
IsWellKnownSid
ImpersonateLoggedOnUser
DuplicateToken
DuplicateTokenEx
GetLengthSid
GetSidSubAuthority
SetKernelObjectSecurity
EqualSid
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegQueryInfoKeyW
RegSetValueExW
RegGetKeySecurity
RegCreateKeyExW
RegNotifyChangeKeyValue
RegDeleteTreeW
RegDisablePredefinedCacheEx
RegDeleteValueW
RegEnumValueW
RegOpenCurrentUser
RegDeleteKeyExW
RegEnumKeyExW
RegOpenKeyExW
RegCloseKey
RegGetValueW
api-ms-win-core-file-l1-1-0
GetFullPathNameW
FlushFileBuffers
SetFileInformationByHandle
UnlockFileEx
SetEndOfFile
FindClose
GetDiskFreeSpaceW
FindNextFileW
DeleteFileW
FindFirstFileW
GetDiskFreeSpaceA
SetFileAttributesW
GetFullPathNameA
GetFileAttributesA
WriteFile
SetFilePointer
FindFirstFileExW
CompareFileTime
GetDiskFreeSpaceExW
GetFileSize
LockFileEx
UnlockFile
GetFileAttributesExW
ReadFile
GetFileAttributesW
CreateFileA
LockFile
DeleteFileA
CreateDirectoryW
GetVolumePathNameW
CreateFileW
api-ms-win-core-sysinfo-l1-2-0
GetSystemTimePreciseAsFileTime
GetNativeSystemInfo
VerSetConditionMask
GetProductInfo
api-ms-win-core-string-obsolete-l1-1-0
lstrlenW
api-ms-win-core-string-l2-1-1
SHLoadIndirectString
api-ms-win-core-shlwapi-legacy-l1-1-0
PathUnExpandEnvStringsW
PathFileExistsW
PathParseIconLocationW
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-localization-l1-2-2
LCIDToLocaleName
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
ntdll
RtlAddAccessAllowedAce
RtlSetDaclSecurityDescriptor
NtSetSecurityObject
RtlCreateAcl
RtlGetDeviceFamilyInfoEnum
RtlLengthSid
RtlQueryInformationAcl
RtlGetDaclSecurityDescriptor
RtlDeriveCapabilitySidsFromName
NtQueryWnfStateData
RtlUnsubscribeWnfStateChangeNotification
RtlSubscribeWnfStateChangeNotification
RtlCreateSecurityDescriptor
RtlQueryWnfStateData
NtQuerySecurityObject
RtlPublishWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlIsMultiSessionSku
NtQueryInformationProcess
RtlAddAce
RtlInitUnicodeString
NtQueryInformationToken
RtlGetCurrentServiceSessionId
RtlGetAce
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
RegDeleteKeyValueW
api-ms-win-core-localization-obsolete-l1-2-0
GetUserDefaultUILanguage
api-ms-win-storage-exports-internal-l1-1-0
SetThreadFlags
GetThreadFlags
api-ms-win-core-kernel32-legacy-l1-1-1
VerifyVersionInfoW
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
api-ms-win-core-sysinfo-l1-2-1
GetPhysicallyInstalledSystemMemory
api-ms-win-core-file-l1-2-0
GetTempPathW
GetVolumeNameForVolumeMountPointW
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-apiquery-l2-1-0
IsApiSetImplemented
api-ms-win-core-winrt-robuffer-l1-1-0
RoGetBufferMarshaler
api-ms-win-ro-typeresolution-l1-1-1
RoCreatePropertySetSerializer
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryA
LoadLibraryW
api-ms-win-core-job-l2-1-0
AssignProcessToJobObject
CreateJobObjectW
api-ms-win-core-processthreads-l1-1-3
SetThreadDescription
api-ms-win-rtcore-ntuser-private-l1-1-0
GetWindowBand
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
K32GetModuleBaseNameW
api-ms-win-core-path-l1-1-0
PathAllocCombine
PathCchSkipRoot
api-ms-win-core-kernel32-legacy-l1-1-0
RegisterWaitForSingleObject
UnregisterWait
api-ms-win-core-file-l2-1-2
CopyFileW
api-ms-win-eventing-classicprovider-l1-1-0
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage
GetTraceEnableFlags
UnregisterTraceGuids
api-ms-win-core-file-l2-1-0
MoveFileExW
GetFileInformationByHandleEx
combase
ord148
ord147
ord154
ord140
ord167
ord168
api-ms-win-crt-math-l1-1-0
trunc
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-memory-l1-1-0
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
api-ms-win-core-file-l1-2-2
AreFileApisANSI
GetTempPathA
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-util-l1-1-0
EncodePointer
AreExternalFeatureDependenciesEnabled
DllCanUnloadNow
DllGetActivationFactory
GetCtacPropertyAlloc
GetExternalFeatureState
GetExternalFeatureStateWithReporting
Name
.text
Size
4.9MB
Virtual Size
4.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
36KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
368KB
Virtual Size
365KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
80KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=142, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=22, id=260, version=33145,
count=1912, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=37, id=261, version=33145,
count=7, id=259, version=33145,
count=1, id=256, version=33145,
count=536, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
windowsudkservices.shellcommon.dll
- IMPHASH 0db22fdef05a698c71112a127b9acd97
- SHA256 73fd54d7ff4ebfaf3249c879baaf0ddae02ec791db544f84ef1865bed633e738
- MD5 43c09e11808cae4c770ed498542822c9
- SHA1 86beb52d6e0946688620bfd0e895d7e941d2c58d
- SHA512 d1c8c4a98a4fbc2b6dade27169b4494d53a0e28de29b01b7be8aed6d1053d4d6a52af870438229973fc053a4db00c33794d9806b7d4895ca890852211f8597c3
- SSDEEP 1536:tyS6ixTpsM4Th/Ky5xKpEjZFUJmmBZUOMTc19VfqN4q29K/P1zcBLZMSu5ANUP/b:tj6opsn3jZ6JrZpVfPqzH1zeZVGP/i+
- TLSH T19DD33A5A76A901F6E179913CC5C38A0FD372B4A5536243CF07A042AE1F67FE89D397A0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
35600
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
windowsudkservices.shellcommon.pdb
msvcp_win
_Mtx_lock
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_unlock
_Mtx_init_in_situ
?_Xlength_error@std@@YAXPEBD@Z
_Mtx_destroy_in_situ
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_abort
_o_free
_o_iswspace
_o_malloc
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
_CxxThrowException
_o___stdio_common_vswprintf
__CxxFrameHandler3
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
memcpy
api-ms-win-crt-string-l1-1-0
memset
combase
SetErrorInfo
GetErrorInfo
ord68
ord147
ord69
ord66
ord67
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetModuleHandleExW
FreeLibrary
LoadLibraryExW
GetProcAddress
GetModuleHandleW
api-ms-win-core-synch-l1-1-0
WaitForSingleObject
ReleaseSemaphore
SetEvent
ReleaseMutex
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
WaitForSingleObjectEx
CreateEventExW
CreateSemaphoreExW
OpenSemaphoreW
CreateMutexExW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventRegister
EventUnregister
EventSetInformation
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedFlushSList
InterlockedPushEntrySList
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-kernel32-legacy-l1-1-0
UnregisterWait
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-util-l1-1-0
EncodePointer
ServiceMain
SvchostPushServiceGlobals
Name
.text
Size
68KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
264B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
696B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=58, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=11, id=260, version=33145,
count=5, id=259, version=33145,
count=1200, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=25, id=261, version=33145,
count=1, id=256, version=33145,
count=11, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
winethc.dll
- IMPHASH 234b07e4b118e8c54ba6bccbd92289d2
- SHA256 3bf524a47a1d1e694276d7112e42dcea59648ca6a7d10283393854bb433d6598
- MD5 06f9f98d81b724389eee8c3a512501be
- SHA1 dfed13577e1376367bfac6e6188522828fd53123
- SHA512 0e0323bdf910be877dea98704e2a493cd799e589bc2ff4c4bdf8730c0c1d778962369a5f5b983c4b49a73c7f9f8fb3ea05197d3660e0ce20565a0e7a66470442
- SSDEEP 3072:hndh/Q8ZtS12n/dQcjuXWwMatsX/6UjCFfiy:pQ6tE2n/doXWwMatsPXj9
- TLSH T1DFC3E71E72F921AAE1B69238C9664605D7B2BC20272157EF02E0E17E5F33BD5AD34F11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5552
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
winetHC.pdb
msvcrt
wcsncmp
_vscwprintf
memmove_s
vswprintf_s
iswdigit
_wtoi
wcscpy_s
wcscat_s
_callnewh
_XcptFilter
_amsg_exit
wcsnlen
_errno
realloc
_lock
_unlock
__dllonexit
_onexit
__C_specific_handler
memset
_vsnwprintf
memcpy_s
free
malloc
wcsncpy_s
memcpy
_initterm
_purecall
wcscmp
ntdll
RtlCaptureContext
RtlVirtualUnwind
RtlIpv4StringToAddressExW
RtlIpv6StringToAddressW
RtlIpv4StringToAddressW
RtlIpv6StringToAddressExW
RtlLookupFunctionEntry
kernel32
QueryPerformanceCounter
OutputDebugStringA
GetTickCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleExA
Sleep
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryExW
GetModuleHandleW
lstrcmpiW
RaiseException
LeaveCriticalSection
EnterCriticalSection
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceExW
GetModuleFileNameW
InitializeCriticalSection
DeleteCriticalSection
FormatMessageW
HeapAlloc
GetProcessHeap
HeapFree
GetCurrentThreadId
GetModuleHandleExW
GetModuleFileNameA
DebugBreak
IsDebuggerPresent
OutputDebugStringW
SetLastError
CloseHandle
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx
GlobalAlloc
WaitForSingleObject
OpenSemaphoreW
ExpandEnvironmentStringsW
GetSystemTimeAsFileTime
GlobalFree
GetCurrentProcessId
CreateMutexExW
CreateSemaphoreExW
LockResource
TerminateProcess
GetCurrentProcess
GetCurrentThread
GetExitCodeProcess
CreateThread
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
HeapSize
HeapReAlloc
HeapDestroy
advapi32
EventWrite
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
EventUnregister
EventRegister
SetThreadToken
GetLengthSid
GetTokenInformation
EventWriteTransfer
RegCloseKey
EventActivityIdControl
CreateProcessWithTokenW
DuplicateTokenEx
OpenThreadToken
IsValidSid
user32
UnregisterClassA
LoadStringW
CloseDesktop
SetThreadDesktop
CreateDesktopW
GetThreadDesktop
CharNextW
oleaut32
SysAllocString
VarUI4FromStr
VariantClear
SysStringLen
RegisterTypeLi
LoadTypeLi
UnRegisterTypeLi
VariantInit
SysFreeString
shlwapi
PathIsUNCW
ws2_32
WSACleanup
GetAddrInfoW
FreeAddrInfoW
select
connect
bind
closesocket
ioctlsocket
socket
WSAGetLastError
__WSAFDIsSet
htons
WSAStartup
wininet
InternetGetConnectedStateExW
InternetSetOptionW
InternetCrackUrlW
InternetInitializeAutoProxyDll
winhttp
WinHttpConnect
WinHttpSetStatusCallback
WinHttpCloseHandle
WinHttpGetDefaultProxyConfiguration
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpGetProxyForUrl
WinHttpOpenRequest
WinHttpDetectAutoProxyConfigUrl
WinHttpCrackUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpOpen
WinHttpSetOption
WinHttpSendRequest
dnsapi
DnsGetProxyInformation
DnsFreeProxyName
api-ms-win-core-com-l1-1-0
StringFromGUID2
CoTaskMemRealloc
CoTaskMemFree
CoInitializeEx
CoCreateGuid
CoCreateInstance
CoUninitialize
CoTaskMemAlloc
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
ForceProxyDetectionOnNextRun
SetAutoDetectProxyFlagForUser
Name
.text
Size
76KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=17, id=260, version=33145,
count=188, id=1, productName=Unmarked objects,
count=23, id=257, version=33145,
count=5, id=261, version=33145,
count=1, id=256, version=33145,
count=20, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
winhttp.dll
- IMPHASH bbafb0c0ade74c0d6ce26ba2300c4c9d
- SHA256 a54ffd45556ef74760be7af4b93d5d64e7427b675dc951062e8bea526c9ce008
- MD5 204853abd32384eb6cde071d017bad44
- SHA1 493da7786718266ef6e1ce1f4b3c06ca2e12c565
- SHA512 88ac68c440e8522c87849a83de6c3536d361539630b41ab1e850b6b29e781e94f444d21c05535bd22253f1cbec15362d95f6b326687d09198f9694cd6fa5bc01
- SSDEEP 24576:KRL3uIX8JuSj4ChnD4al+28AjS6UqNhGePKKZqKudpEq5kQUokrVF0:KRL3uIXA6ChEalhDS6UChGyKYNudrZWg
- TLSH T18A455B1AA2AC21E9D17FD178C517422BFBB1B46823209FDB1560C67C6B13FD11A3EB16
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
54:85:b2:86:87:e4:ea:22:2c:f8:bb:32:4e:df:24:f8:7d:7e:68:44:61:be:3f:fe:d8:aa:21:2d:5d:f7:50:e9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:3605-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:13:b0:43:35:66:cf:af:95:e8:00:01:00:00:02:13
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
652896
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
winhttp.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__ltow_s
_o__purecall
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
_o__strtoui64
_o__wcsicmp
_o__wcslwr_s
_o__wcsnicmp
memmove
_o__wtoi
_o_iscntrl
_o_isdigit
_o_isspace
_o_iswdigit
_o_iswspace
_o_memcpy_s
_o_qsort
_o_rand
_o_tolower
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstok
_o_wcstok_s
__C_specific_handler
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___std_type_info_destroy_list
_o__execute_onexit_table
_o__crt_atexit
memcmp
_o__configure_narrow_argv
memcpy
wcschr
wcsstr
wcsrchr
_o__cexit
api-ms-win-crt-string-l1-1-0
wcscmp
memset
memmove_s
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
ResetEvent
WaitForSingleObjectEx
CreateEventW
ReleaseSemaphore
AcquireSRWLockShared
CreateEventA
CreateEventExA
WaitForMultipleObjectsEx
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
SetEvent
InitializeCriticalSection
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ReleaseMutex
InitializeCriticalSectionEx
DeleteCriticalSection
OpenSemaphoreW
CreateSemaphoreExW
InitializeSRWLock
CreateMutexExW
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
LoadLibraryExA
GetModuleHandleW
GetProcAddress
GetModuleHandleExA
GetModuleHandleExW
GetModuleFileNameW
FreeLibrary
GetModuleFileNameA
api-ms-win-security-base-l1-1-0
GetLengthSid
GetTokenInformation
RevertToSelf
IsValidSid
ImpersonateLoggedOnUser
EqualSid
GetAce
AddAccessAllowedAce
SetTokenInformation
InitializeAcl
GetSidSubAuthorityCount
GetSidSubAuthority
CopySid
CreateRestrictedToken
DuplicateTokenEx
AccessCheck
AddMandatoryAce
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventRegister
EventSetInformation
EventWriteEx
EventUnregister
api-ms-win-core-heap-l1-1-0
HeapSize
HeapAlloc
HeapReAlloc
GetProcessHeap
HeapFree
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
GetCommandLineW
api-ms-win-core-processthreads-l1-1-0
TlsGetValue
GetCurrentProcess
TlsSetValue
CreateThread
ResumeThread
InitializeProcThreadAttributeList
DeleteProcThreadAttributeList
CreateProcessAsUserW
OpenThreadToken
GetCurrentThread
TlsFree
OpenProcessToken
UpdateProcThreadAttribute
TerminateProcess
GetCurrentThreadId
TlsAlloc
GetCurrentProcessId
SetThreadToken
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
SetErrorMode
GetLastError
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceInitialize
InitOnceExecuteOnce
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
SetProcessMitigationPolicy
GetProcessMitigationPolicy
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTime
GetTickCount64
GetSystemTimeAsFileTime
GetSystemDirectoryW
api-ms-win-core-interlocked-l1-1-0
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
CompareStringW
api-ms-win-core-heap-l2-1-0
GlobalAlloc
LocalAlloc
GlobalFree
LocalFree
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-registry-l1-1-0
RegSetValueExA
RegSetValueExW
RegDeleteValueW
RegQueryInfoKeyA
RegNotifyChangeKeyValue
RegGetValueW
RegQueryInfoKeyW
RegOpenKeyExA
RegGetValueA
RegEnumKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegQueryValueExA
api-ms-win-security-credentials-l1-1-0
CredFree
CredEnumerateW
CredReadDomainCredentialsW
CredWriteW
CredReadW
CredDeleteW
api-ms-win-core-sysinfo-l1-2-0
GetNativeSystemInfo
api-ms-win-core-wow64-l1-1-1
Wow64SetThreadDefaultGuestMachine
api-ms-win-core-sysinfo-l1-2-6
IsUserCetAvailableInEnvironment
api-ms-win-core-registry-l1-1-1
RegDeleteKeyValueW
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CreateThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolTimer
CallbackMayRunLong
WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
CloseThreadpoolWait
CreateThreadpoolTimer
FreeLibraryWhenCallbackReturns
CloseThreadpoolCleanupGroup
CreateThreadpoolWait
WaitForThreadpoolTimerCallbacks
CreateThreadpoolWork
CloseThreadpoolWork
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
SystemTimeToFileTime
api-ms-win-core-file-l1-1-0
SetFileAttributesW
DeleteFileW
GetFileAttributesW
LocalFileTimeToFileTime
CreateDirectoryW
RemoveDirectoryW
FindClose
SetEndOfFile
SetFilePointer
FindFirstFileW
ReadFile
GetFileSizeEx
WriteFile
CreateFileW
FindNextFileW
CompareFileTime
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-string-l2-1-0
CharLowerW
api-ms-win-core-threadpool-legacy-l1-1-0
UnregisterWaitEx
QueueUserWorkItem
api-ms-win-core-shlwapi-obsolete-l1-1-0
StrCmpNICA
StrStrA
StrChrW
StrCmpNCA
StrStrIA
api-ms-win-core-localization-obsolete-l1-2-0
CompareStringA
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpA
api-ms-win-core-heap-obsolete-l1-1-0
GlobalReAlloc
api-ms-win-core-url-l1-1-0
UrlCombineW
UrlUnescapeA
UrlCanonicalizeW
api-ms-win-core-windowserrorreporting-l1-1-0
WerSetFlags
api-ms-win-core-threadpool-private-l1-1-0
RegisterWaitForSingleObjectEx
api-ms-win-service-private-l1-1-0
WaitServiceState
kernelbase
AppContainerUnregisterSid
SubscribeWdagEnabledStateChange
GetIsWdagEnabled
UnsubscribeEdpEnabledStateChange
SubscribeEdpEnabledStateChange
GetIsEdpEnabled
AppContainerRegisterSid
UnsubscribeWdagEnabledStateChange
ntdll
RtlSubscribeWnfStateChangeNotification
EtwEventUnregister
EtwEventWriteTransfer
RtlConvertSidToUnicodeString
RtlNtStatusToDosError
EtwEventRegister
RtlGetPersistedStateLocation
RtlDllShutdownInProgress
NtSetInformationObject
RtlIpv4AddressToStringExW
RtlIpv6AddressToStringExW
NtOpenFile
RtlUnsubscribeWnfStateChangeNotification
RtlValidSid
RtlReportExceptionEx
RtlQueryPackageClaims
EtwEventActivityIdControl
EtwEventWrite
RtlGetVersion
RtlGetDeviceFamilyInfoEnum
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlIpv4StringToAddressExW
RtlIpv4AddressToStringW
NtGetCachedSigningLevel
NtCompareSigningLevels
NtSetCachedSigningLevel
RtlLengthSid
RtlGUIDFromString
RtlPublishWnfStateData
RtlIpv6StringToAddressExW
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-realtime-l1-1-0
QueryUnbiasedInterruptTime
api-ms-win-core-localization-l1-2-0
IdnToAscii
FormatMessageW
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-memory-l1-1-0
MapViewOfFile
OpenFileMappingW
UnmapViewOfFile
VirtualFree
VirtualAlloc
CreateFileMappingW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-datetime-l1-1-0
GetDateFormatW
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
DllCanUnloadNow
DllGetClassObject
Private1
SvchostPushServiceGlobals
WinHttpAddRequestHeaders
WinHttpAddRequestHeadersEx
WinHttpAutoProxySvcMain
WinHttpCheckPlatform
WinHttpCloseHandle
WinHttpConnect
WinHttpConnectionDeletePolicyEntries
WinHttpConnectionDeleteProxyInfo
WinHttpConnectionFreeNameList
WinHttpConnectionFreeProxyInfo
WinHttpConnectionFreeProxyList
WinHttpConnectionGetNameList
WinHttpConnectionGetProxyInfo
WinHttpConnectionGetProxyList
WinHttpConnectionOnlyConvert
WinHttpConnectionOnlyReceive
WinHttpConnectionOnlySend
WinHttpConnectionSetPolicyEntries
WinHttpConnectionSetProxyInfo
WinHttpConnectionUpdateIfIndexTable
WinHttpCrackUrl
WinHttpCreateProxyList
WinHttpCreateProxyManager
WinHttpCreateProxyResolver
WinHttpCreateProxyResult
WinHttpCreateUiCompatibleProxyString
WinHttpCreateUrl
WinHttpDetectAutoProxyConfigUrl
WinHttpFreeProxyResult
WinHttpFreeProxyResultEx
WinHttpFreeProxySettings
WinHttpFreeProxySettingsEx
WinHttpFreeQueryConnectionGroupResult
WinHttpGetDefaultProxyConfiguration
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpGetProxyForUrlEx
WinHttpGetProxyForUrlEx2
WinHttpGetProxyForUrlHvsi
WinHttpGetProxyResult
WinHttpGetProxyResultEx
WinHttpGetProxySettingsEx
WinHttpGetProxySettingsResultEx
WinHttpGetProxySettingsVersion
WinHttpGetTunnelSocket
WinHttpOpen
WinHttpOpenRequest
WinHttpPacJsWorkerMain
WinHttpProbeConnectivity
WinHttpProtocolCompleteUpgrade
WinHttpProtocolReceive
WinHttpProtocolSend
WinHttpQueryAuthSchemes
WinHttpQueryConnectionGroup
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpQueryHeadersEx
WinHttpQueryOption
WinHttpReadData
WinHttpReadDataEx
WinHttpReadProxySettings
WinHttpReadProxySettingsHvsi
WinHttpReceiveResponse
WinHttpRefreshProxySettings
WinHttpRegisterProxyChangeNotification
WinHttpResetAutoProxy
WinHttpResolverGetProxyForUrl
WinHttpSaveProxyCredentials
WinHttpSendRequest
WinHttpSetCredentials
WinHttpSetDefaultProxyConfiguration
WinHttpSetOption
WinHttpSetProxySettingsPerUser
WinHttpSetSecureLegacyServersAppCompat
WinHttpSetStatusCallback
WinHttpSetTimeouts
WinHttpTimeFromSystemTime
WinHttpTimeToSystemTime
WinHttpUnregisterProxyChangeNotification
WinHttpWebSocketClose
WinHttpWebSocketCompleteUpgrade
WinHttpWebSocketQueryCloseStatus
WinHttpWebSocketReceive
WinHttpWebSocketSend
WinHttpWebSocketShutdown
WinHttpWriteData
WinHttpWriteProxySettings
Name
.text
Size
860KB
Virtual Size
859KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
_wpp_sf
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
160KB
Virtual Size
158KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=33145,
count=103, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1546, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=14, id=260, version=33145,
count=5, id=259, version=33145,
count=17, id=261, version=33145,
count=1, id=256, version=33145,
count=199, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
winhttpcom.dll
- IMPHASH a377823a269f3899cfc344dc8de9a7cd
- SHA256 c95ba2dcb9d904f162ab507d13405530ad33bae8b005cae53d1acc897c76a3f9
- MD5 3ff73e84fe15c0f655e457fc6d07bc8d
- SHA1 c2acff83e849748b93d839eaca5b034fac7fe767
- SHA512 b36eaa7edd44b25bc33ef011a8a2b8cac9f5bec567e6f9772b5c39e8be24e02cc811650f3a4d715b40a9a817ba7b6df024167481a40b10e465cf7c40ed3b020e
- SSDEEP 3072:/iXb7LbKcUzD7NE8+gEsd1TJqYEw28lYXxHNi:aXzX78t14YEwdYX
- TLSH T1F9D3F61F36E604B3D5659238C4A74656D7B6B8202B229BDF06D0923C0E33BE5BD39F25
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5360
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
winhttpcom.pdb
api-ms-win-crt-string-l1-1-0
wcsncmp
memset
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__configure_narrow_argv
_o__crt_atexit
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__ltow
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
memcpy
_o_free
_o_malloc
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o__cexit
_o__callnewh
_o___std_type_info_destroy_list
wcschr
__C_specific_handler
ntdll
RtlNotifyFeatureUsage
RtlQueryFeatureConfiguration
RtlVirtualUnwind
RtlLookupFunctionEntry
EtwEventUnregister
RtlCaptureContext
RtlNtStatusToDosError
EtwEventRegister
api-ms-win-core-synch-l1-1-0
CreateEventA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
ResetEvent
WaitForSingleObjectEx
SetEvent
DeleteCriticalSection
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventWriteEx
api-ms-win-core-heap-l1-1-0
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
CompareStringW
api-ms-win-core-processthreads-l1-1-0
OpenThreadToken
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
SetThreadToken
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExA
GetModuleHandleExW
GetModuleFileNameW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-com-l1-1-0
GetHGlobalFromStream
CoCreateInstance
CreateStreamOnHGlobal
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-security-base-l1-1-0
RevertToSelf
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-shlwapi-obsolete-l1-1-0
StrChrW
StrStrIW
api-ms-win-core-heap-obsolete-l1-1-0
GlobalUnlock
GlobalLock
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolWait
FreeLibraryWhenCallbackReturns
CloseThreadpoolWait
SetThreadpoolWait
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-memory-l1-1-0
VirtualFree
VirtualAlloc
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
52KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
_wpp_sf
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
456B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=63, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1217, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=18, id=260, version=33145,
count=5, id=259, version=33145,
count=19, id=261, version=33145,
count=1, id=256, version=33145,
count=20, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wini3c.dll
- IMPHASH 5621a17bb0de76949998173018305699
- SHA256 bcff52cf836cefbf4db36ea2e5ceced1c8e4c626d68b1eb097425964e3f3107e
- MD5 a0630f1154583ddbedc5c7765d4731a6
- SHA1 502a94fbcc24f02fab693580a89d38aa9e884e7c
- SHA512 01e57be8e175cd9fb6eda089cf3ea6a68e3ed5e9e7d7e1e1e9c25642a1f1b8cdab47f05f2b84b8e71a07f03b22478df2275b160b822d586fb36aec4d7fe42075
- SSDEEP 3072:0GdMeJItgFrgW+5nlblEQZii6K+YiQREzIG9cWnEaKokr0CQO:0YJYgZgWEnEQL6dLzI+FsoWU
- TLSH T16C145C1DB2AD04B9F4BB8179CED2450AE3B274A5072152CF02E0D2BD5B67FE8B439B51
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
8560
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wini3c.pdb
msvcp_win
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o__wcsnicmp
_o_free
_o_malloc
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__callnewh
_o__cexit
__std_terminate
__CxxFrameHandler4
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___stdio_common_vswprintf
_o___std_exception_copy
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
wcsnlen
memset
ntdll
NtQueryInformationFile
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlStringFromGUIDEx
RtlInitUnicodeString
LdrAddRefDll
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleFileNameA
DisableThreadLibraryCalls
GetModuleHandleExW
GetProcAddress
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
ReleaseSemaphore
LeaveCriticalSection
InitializeCriticalSectionEx
WaitForSingleObject
ReleaseMutex
ReleaseSRWLockExclusive
CreateSemaphoreExW
WaitForSingleObjectEx
SetEvent
OpenSemaphoreW
ReleaseSRWLockShared
ResetEvent
CreateEventExW
CreateMutexExW
AcquireSRWLockShared
AcquireSRWLockExclusive
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
CreateEventW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
WaitForThreadpoolIoCallbacks
CreateThreadpoolTimer
CreateThreadpoolIo
WaitForThreadpoolTimerCallbacks
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
CloseThreadpoolWork
CancelThreadpoolIo
StartThreadpoolIo
CreateThreadpoolWork
SetThreadpoolTimer
CloseThreadpoolIo
FreeLibraryWhenCallbackReturns
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-io-l1-1-0
CancelIoEx
GetOverlappedResult
DeviceIoControl
api-ms-win-eventing-classicprovider-l1-1-0
RegisterTraceGuidsW
TraceMessage
UnregisterTraceGuids
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
wpprecorderum
WppAutoLogTrace
WppAutoLogStart
WppAutoLogStop
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventUnregister
EventSetInformation
EventRegister
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-core-processtopology-obsolete-l1-1-0
GetActiveProcessorCount
api-ms-win-core-file-l1-1-0
CreateFileW
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-devices-config-l1-1-1
CM_MapCrToWin32Err
CM_Get_Device_Interface_List_SizeW
CM_Get_DevNode_PropertyW
CM_Get_Device_Interface_PropertyW
CM_Unregister_Notification
CM_Register_Notification
CM_Locate_DevNodeW
CM_Get_Device_Interface_ListW
CM_Open_DevNode_Key
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegGetValueW
Experimental_WinI3CDisableIbis
Experimental_WinI3CDisableIbisWithFileHandle
Experimental_WinI3CEnableIbis
Experimental_WinI3CEnableIbisWithAutoCommandRead
Experimental_WinI3CEnableIbisWithAutoCommandReadWithFileHandle
Experimental_WinI3CEnableIbisWithFileHandle
Experimental_WinI3CGetMaxReadAndIbiLengthFromOperation
Experimental_WinI3CGetMaxWriteLengthFromOperation
Experimental_WinI3CGetReadPayloadFromOperation
Experimental_WinI3CGetStatus
Experimental_WinI3CGetStatusFromOperation
Experimental_WinI3CGetStatusWithFileHandle
Experimental_WinI3CInitializeTarget
Experimental_WinI3CPendIbiReadWithFileHandle
Experimental_WinI3CRead
Experimental_WinI3CReadVendorCcc
Experimental_WinI3CReadVendorCccWithFileHandle
Experimental_WinI3CReadWithFileHandle
Experimental_WinI3CRegisterForTargetAdded
Experimental_WinI3CRelease
Experimental_WinI3CResetTarget
Experimental_WinI3CResetTargetWithFileHandle
Experimental_WinI3CSetMaxReadAndIbiLength
Experimental_WinI3CSetMaxReadAndIbiLengthWithFileHandle
Experimental_WinI3CSetMaxWriteLength
Experimental_WinI3CSetMaxWriteLengthWithFileHandle
Experimental_WinI3CUnregisterForTargetAdded
Experimental_WinI3CWrite
Experimental_WinI3CWriteRead
Experimental_WinI3CWriteReadWithFileHandle
Experimental_WinI3CWriteVendorCcc
Experimental_WinI3CWriteVendorCccWithFileHandle
Experimental_WinI3CWriteWithFileHandle
Name
.text
Size
128KB
Virtual Size
125KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
36KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
464B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=56, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=1197, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=25, id=261, version=33145,
count=1, id=256, version=33145,
count=30, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wininet.dll
- IMPHASH 3e9407b2f40d7473da0e474acaa46c67
- SHA256 322992da5d57f124381e9c810d807873f52915182c3077458d5740846755a02c
- MD5 49ba4029168d58ede9f2381a7ca638f9
- SHA1 1e892d00bfd536e3c5386fd48739d0fb5e01986e
- SHA512 481b78e01ecff28a8d8bc018d812a42bf7ce863b36550347c9a298b02275f79298a7fe974e34478d1c4001f5542f73f288476c540a1acc64d2bd971b8ffd4b42
- SSDEEP 49152:2GPNCUSRTCaJwd7q5SAXfW1t7001leU4BH2QDAedIi3Rkn8+m:2GsTTUEPuUAi3x
- TLSH T19AC56C2AA2E921E8D17AD17CC50B4727EBB1742823209FDB1530CA782F53BE1573E756
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
66:e0:4a:75:9a:e3:fe:fe:6c:a4:82:74:50:0f:41:a0:01:cc:36:72:73:7d:29:20:01:09:de:4d:30:c8:e1:11
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6F1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1c:09:55:15:d7:c3:59:07:d1:00:01:00:00:02:1c
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
1367776
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wininet.pdb
api-ms-win-crt-string-l1-1-0
wcscmp
wcsncmp
__isascii
strncmp
strpbrk
strcmp
memset
strcspn
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__itoa_s
_o__itow
_o__itow_s
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__stricmp
_o__strlwr
_o__strnicmp
_o__wcsicmp
_o__wcslwr_s
_o__wcsnicmp
memmove
_o__wtoi
_o_bsearch
_o_free
_o_isalnum
_o_isalpha
_o_iscntrl
_o_isdigit
_o_ispunct
_o_isspace
_o_iswdigit
_o_isxdigit
_o_malloc
_o_qsort
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstok_s
wcsstr
wcsrchr
wcschr
strchr
_o__execute_onexit_table
_o__errno
__CxxFrameHandler3
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__crt_atexit
_o__initialize_narrow_environment
_o__configure_narrow_argv
_o__cexit
_o__atoi64
__std_terminate
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnwprintf_s
_o___std_type_info_destroy_list
__CxxFrameHandler4
memcpy
__C_specific_handler
memchr
memcmp
api-ms-win-core-synch-l1-1-0
WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
OpenSemaphoreW
InitializeCriticalSectionEx
AcquireSRWLockShared
ReleaseSRWLockShared
InitializeCriticalSection
CreateMutexExW
CreateSemaphoreExW
ReleaseMutex
CreateEventW
InitializeCriticalSectionAndSpinCount
TryAcquireSRWLockExclusive
DeleteCriticalSection
WaitForMultipleObjectsEx
CreateEventA
SetEvent
InitializeSRWLock
ReleaseSemaphore
ResetEvent
CreateEventExA
WaitForSingleObjectEx
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
SetLastError
GetLastError
UnhandledExceptionFilter
api-ms-win-core-synch-l1-2-0
InitializeConditionVariable
InitOnceExecuteOnce
Sleep
SleepConditionVariableCS
WakeAllConditionVariable
api-ms-win-core-heap-l1-1-0
HeapFree
HeapDestroy
GetProcessHeap
HeapAlloc
HeapReAlloc
HeapSize
api-ms-win-core-memory-l1-1-0
VirtualFree
UnmapViewOfFile
VirtualAlloc
CreateFileMappingW
MapViewOfFile
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetTickCount
GetTickCount64
GetSystemTime
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
CompareStringW
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameW
LoadResource
GetModuleHandleExA
LockResource
LoadStringA
FreeLibraryAndExitThread
SizeofResource
GetProcAddress
FreeLibrary
GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExW
LoadStringW
LoadLibraryExW
LoadLibraryExA
api-ms-win-core-file-l1-1-0
SetFilePointerEx
CreateFileA
DeleteFileW
GetFileAttributesExW
GetLongPathNameW
ReadFile
GetDiskFreeSpaceExA
CreateDirectoryW
SetFileAttributesW
SetFileInformationByHandle
GetFileSizeEx
GetFileTime
GetDiskFreeSpaceExW
CompareFileTime
GetFileSize
WriteFile
SetFilePointer
CreateFileW
GetFileAttributesW
FindFirstFileW
FindNextFileW
FindClose
GetVolumePathNameW
SetEndOfFile
GetDriveTypeW
GetShortPathNameW
FindFirstFileExW
GetVolumeInformationW
RemoveDirectoryW
api-ms-win-core-localization-l1-2-0
GetCPInfo
FormatMessageA
IsValidCodePage
FormatMessageW
IdnToAscii
GetCPInfoExW
IsDBCSLeadByte
IsDBCSLeadByteEx
IdnToUnicode
GetLocaleInfoW
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentProcess
OpenProcessToken
OpenThreadToken
GetCurrentThread
CreateThread
GetCurrentThreadId
TlsAlloc
TlsSetValue
TlsGetValue
TlsFree
SwitchToThread
TerminateProcess
ProcessIdToSessionId
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolWait
StartThreadpoolIo
CallbackMayRunLong
SetThreadpoolWait
CreateThreadpoolIo
CancelThreadpoolIo
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
TrySubmitThreadpoolCallback
CloseThreadpoolWork
CreateThreadpoolTimer
CloseThreadpoolIo
WaitForThreadpoolWaitCallbacks
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventUnregister
EventRegister
EventSetInformation
EventWriteEx
api-ms-win-core-heap-l2-1-0
LocalAlloc
GlobalAlloc
GlobalFree
LocalFree
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
FileTimeToSystemTime
api-ms-win-core-datetime-l1-1-0
GetTimeFormatA
GetDateFormatA
api-ms-win-core-wow64-l1-1-0
IsWow64Process
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegQueryValueExA
RegSetValueExA
RegGetValueA
RegCreateKeyExA
RegOpenKeyExA
RegEnumKeyExA
RegSetValueExW
RegDeleteValueW
RegGetValueW
RegDeleteTreeW
RegCloseKey
RegQueryInfoKeyW
RegOpenCurrentUser
RegDeleteTreeA
RegEnumKeyExW
RegNotifyChangeKeyValue
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-2-0
GetNativeSystemInfo
GetSystemTimePreciseAsFileTime
GetProductInfo
api-ms-win-core-file-l2-1-0
CreateHardLinkW
MoveFileExW
api-ms-win-core-io-l1-1-0
GetOverlappedResult
GetQueuedCompletionStatus
DeviceIoControl
PostQueuedCompletionStatus
CreateIoCompletionPort
api-ms-win-core-file-l2-1-2
CopyFileW
api-ms-win-security-appcontainer-l1-1-0
GetAppContainerNamedObjectPath
api-ms-win-core-realtime-l1-1-0
QueryUnbiasedInterruptTime
api-ms-win-core-interlocked-l1-1-0
InterlockedPushEntrySList
InterlockedFlushSList
InitializeSListHead
api-ms-win-core-file-l1-2-0
GetVolumeNameForVolumeMountPointW
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-kernel32-legacy-l1-1-0
SetFileCompletionNotificationModes
FindResourceA
GetComputerNameW
MoveFileW
WTSGetActiveConsoleSessionId
api-ms-win-core-shlwapi-legacy-l1-1-0
PathAddBackslashA
api-ms-win-core-threadpool-legacy-l1-1-0
QueueUserWorkItem
api-ms-win-core-stringansi-l1-1-0
CharLowerA
CharNextA
CharUpperA
api-ms-win-core-shlwapi-obsolete-l1-1-0
StrCmpNICA
StrRChrA
StrStrA
StrStrIA
StrCmpICA
StrCmpNIA
StrCmpNICW
StrStrIW
StrCmpNA
StrToIntA
StrChrA
StrChrW
StrCmpNIW
StrRChrW
StrChrNW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpW
lstrcmpA
lstrcmpiA
api-ms-win-core-localization-obsolete-l1-2-0
CompareStringA
api-ms-win-core-heap-obsolete-l1-1-0
GlobalLock
GlobalUnlock
api-ms-win-core-url-l1-1-0
PathCreateFromUrlW
UrlUnescapeA
UrlCanonicalizeA
UrlCombineA
UrlCanonicalizeW
UrlCombineW
api-ms-win-http-time-l1-1-0
InternetTimeFromSystemTimeW
InternetTimeToSystemTimeA
InternetTimeFromSystemTimeA
InternetTimeToSystemTimeW
ntdll
RtlGetPersistedStateLocation
NtQueryInformationToken
RtlGetDeviceFamilyInfoEnum
RtlGetVersion
EtwEventWriteTransfer
EtwEventWrite
EtwEventActivityIdControl
EtwEventUnregister
EtwEventRegister
RtlIpv6AddressToStringExW
RtlIpv4AddressToStringExW
RtlFreeSid
RtlGetAppContainerParent
RtlGetAppContainerSidType
RtlGetLastNtStatus
RtlNtStatusToDosError
RtlReportExceptionEx
NtSetInformationFile
NtSetInformationObject
RtlQueryPackageClaims
RtlIpv6AddressToStringA
RtlIpv4AddressToStringA
RtlIpv4StringToAddressExA
RtlIpv6AddressToStringW
RtlIpv4AddressToStringW
RtlIpv6StringToAddressExW
RtlIpv4StringToAddressExW
NtClose
NtQueryVolumeInformationFile
NtCreateFile
NtGetCachedSigningLevel
NtCompareSigningLevels
NtSetCachedSigningLevel
RtlIpv6AddressToStringExA
RtlIpv6StringToAddressExA
kernelbase
GetIsEdpEnabled
UnsubscribeEdpEnabledStateChange
GetIsWdagEnabled
SubscribeWdagEnabledStateChange
UnsubscribeWdagEnabledStateChange
GetPackageSecurityContext
GetPackageSecurityProperty
__chkstk
SubscribeEdpEnabledStateChange
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
AppCacheCheckManifest
AppCacheCloseHandle
AppCacheCreateAndCommitFile
AppCacheDeleteGroup
AppCacheDeleteIEGroup
AppCacheDuplicateHandle
AppCacheFinalize
AppCacheFreeDownloadList
AppCacheFreeGroupList
AppCacheFreeIESpace
AppCacheFreeSpace
AppCacheGetDownloadList
AppCacheGetFallbackUrl
AppCacheGetGroupList
AppCacheGetIEGroupList
AppCacheGetInfo
AppCacheGetManifestUrl
AppCacheLookup
CommitUrlCacheEntryA
CommitUrlCacheEntryBinaryBlob
CommitUrlCacheEntryW
CreateMD5SSOHash
CreateUrlCacheContainerA
CreateUrlCacheContainerW
CreateUrlCacheEntryA
CreateUrlCacheEntryExW
CreateUrlCacheEntryW
CreateUrlCacheGroup
DeleteIE3Cache
DeleteUrlCacheContainerA
DeleteUrlCacheContainerW
DeleteUrlCacheEntry
DeleteUrlCacheEntryA
DeleteUrlCacheEntryW
DeleteUrlCacheGroup
DeleteWpadCacheForNetworks
DetectAutoProxyUrl
DispatchAPICall
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
FindCloseUrlCache
FindFirstUrlCacheContainerA
FindFirstUrlCacheContainerW
FindFirstUrlCacheEntryA
FindFirstUrlCacheEntryExA
FindFirstUrlCacheEntryExW
FindFirstUrlCacheEntryW
FindFirstUrlCacheGroup
FindNextUrlCacheContainerA
FindNextUrlCacheContainerW
FindNextUrlCacheEntryA
FindNextUrlCacheEntryExA
FindNextUrlCacheEntryExW
FindNextUrlCacheEntryW
FindNextUrlCacheGroup
ForceNexusLookup
ForceNexusLookupExW
FreeUrlCacheSpaceA
FreeUrlCacheSpaceW
FtpCommandA
FtpCommandW
FtpCreateDirectoryA
FtpCreateDirectoryW
FtpDeleteFileA
FtpDeleteFileW
FtpFindFirstFileA
FtpFindFirstFileW
FtpGetCurrentDirectoryA
FtpGetCurrentDirectoryW
FtpGetFileA
FtpGetFileEx
FtpGetFileSize
FtpGetFileW
FtpOpenFileA
FtpOpenFileW
FtpPutFileA
FtpPutFileEx
FtpPutFileW
FtpRemoveDirectoryA
FtpRemoveDirectoryW
FtpRenameFileA
FtpRenameFileW
FtpSetCurrentDirectoryA
FtpSetCurrentDirectoryW
GetProxyDllInfo
GetUrlCacheConfigInfoA
GetUrlCacheConfigInfoW
GetUrlCacheEntryBinaryBlob
GetUrlCacheEntryInfoA
GetUrlCacheEntryInfoExA
GetUrlCacheEntryInfoExW
GetUrlCacheEntryInfoW
GetUrlCacheGroupAttributeA
GetUrlCacheGroupAttributeW
GetUrlCacheHeaderData
GopherCreateLocatorA
GopherCreateLocatorW
GopherFindFirstFileA
GopherFindFirstFileW
GopherGetAttributeA
GopherGetAttributeW
GopherGetLocatorTypeA
GopherGetLocatorTypeW
GopherOpenFileA
GopherOpenFileW
HttpAddRequestHeadersA
HttpAddRequestHeadersW
HttpCheckDavCompliance
HttpCloseDependencyHandle
HttpDuplicateDependencyHandle
HttpEndRequestA
HttpEndRequestW
HttpGetServerCredentials
HttpGetTunnelSocket
HttpIndicatePageLoadComplete
HttpIsHostHstsEnabled
HttpOpenDependencyHandle
HttpOpenRequestA
HttpOpenRequestW
HttpPushClose
HttpPushEnable
HttpPushWait
HttpQueryInfoA
HttpQueryInfoW
HttpSendRequestA
HttpSendRequestExA
HttpSendRequestExW
HttpSendRequestW
HttpWebSocketClose
HttpWebSocketCompleteUpgrade
HttpWebSocketQueryCloseStatus
HttpWebSocketReceive
HttpWebSocketSend
HttpWebSocketShutdown
IncrementUrlCacheHeaderData
InternetAlgIdToStringA
InternetAlgIdToStringW
InternetAttemptConnect
InternetAutodial
InternetAutodialCallback
InternetAutodialHangup
InternetCanonicalizeUrlA
InternetCanonicalizeUrlW
InternetCheckConnectionA
InternetCheckConnectionW
InternetClearAllPerSiteCookieDecisions
InternetCloseHandle
InternetCombineUrlA
InternetCombineUrlW
InternetConfirmZoneCrossing
InternetConfirmZoneCrossingA
InternetConfirmZoneCrossingW
InternetConnectA
InternetConnectW
InternetConvertUrlFromWireToWideChar
InternetCrackUrlA
InternetCrackUrlW
InternetCreateUrlA
InternetCreateUrlW
InternetDial
InternetDialA
InternetDialW
InternetEnumPerSiteCookieDecisionA
InternetEnumPerSiteCookieDecisionW
InternetErrorDlg
InternetFindNextFileA
InternetFindNextFileW
InternetFortezzaCommand
InternetFreeCookies
InternetFreeProxyInfoList
InternetGetCertByURL
InternetGetCertByURLA
InternetGetConnectedState
InternetGetConnectedStateEx
InternetGetConnectedStateExA
InternetGetConnectedStateExW
InternetGetCookieA
InternetGetCookieEx2
InternetGetCookieExA
InternetGetCookieExW
InternetGetCookieW
InternetGetLastResponseInfoA
InternetGetLastResponseInfoW
InternetGetPerSiteCookieDecisionA
InternetGetPerSiteCookieDecisionW
InternetGetProxyForUrl
InternetGetSecurityInfoByURL
InternetGetSecurityInfoByURLA
InternetGetSecurityInfoByURLW
InternetGoOnline
InternetGoOnlineA
InternetGoOnlineW
InternetHangUp
InternetInitializeAutoProxyDll
InternetLockRequestFile
InternetOpenA
InternetOpenUrlA
InternetOpenUrlW
InternetOpenW
InternetQueryDataAvailable
InternetQueryFortezzaStatus
InternetQueryOptionA
InternetQueryOptionW
InternetReadFile
InternetReadFileExA
InternetReadFileExW
InternetSecurityProtocolToStringA
InternetSecurityProtocolToStringW
InternetSetCookieA
InternetSetCookieEx2
InternetSetCookieExA
InternetSetCookieExW
InternetSetCookieW
InternetSetDialState
InternetSetDialStateA
InternetSetDialStateW
InternetSetFilePointer
InternetSetOptionA
InternetSetOptionExA
InternetSetOptionExW
InternetSetOptionW
InternetSetPerSiteCookieDecisionA
InternetSetPerSiteCookieDecisionW
InternetSetSecureLegacyServersAppCompat
InternetSetStatusCallback
InternetSetStatusCallbackA
InternetSetStatusCallbackW
InternetShowSecurityInfoByURL
InternetShowSecurityInfoByURLA
InternetShowSecurityInfoByURLW
InternetTimeFromSystemTime
InternetTimeFromSystemTimeA
InternetTimeFromSystemTimeW
InternetTimeToSystemTime
InternetTimeToSystemTimeA
InternetTimeToSystemTimeW
InternetUnlockRequestFile
InternetWriteFile
InternetWriteFileExA
InternetWriteFileExW
IsHostInProxyBypassList
IsUrlCacheEntryExpiredA
IsUrlCacheEntryExpiredW
LoadUrlCacheContent
ParseX509EncodedCertificateForListBoxEntry
PrivacyGetZonePreferenceW
PrivacySetZonePreferenceW
ReadUrlCacheEntryStream
ReadUrlCacheEntryStreamEx
RegisterUrlCacheNotification
ResumeSuspendedDownload
RetrieveUrlCacheEntryFileA
RetrieveUrlCacheEntryFileW
RetrieveUrlCacheEntryStreamA
RetrieveUrlCacheEntryStreamW
RunOnceUrlCache
SetUrlCacheConfigInfoA
SetUrlCacheConfigInfoW
SetUrlCacheEntryGroup
SetUrlCacheEntryGroupA
SetUrlCacheEntryGroupW
SetUrlCacheEntryInfoA
SetUrlCacheEntryInfoW
SetUrlCacheGroupAttributeA
SetUrlCacheGroupAttributeW
SetUrlCacheHeaderData
ShowCertificate
ShowClientAuthCerts
ShowSecurityInfo
ShowX509EncodedCertificate
UnlockUrlCacheEntryFile
UnlockUrlCacheEntryFileA
UnlockUrlCacheEntryFileW
UnlockUrlCacheEntryStream
UpdateUrlCacheContentPath
UrlCacheCheckEntriesExist
UrlCacheCloseEntryHandle
UrlCacheContainerSetEntryMaximumAge
UrlCacheCreateContainer
UrlCacheFindFirstEntry
UrlCacheFindNextEntry
UrlCacheFreeEntryInfo
UrlCacheFreeGlobalSpace
UrlCacheGetContentPaths
UrlCacheGetEntryInfo
UrlCacheGetGlobalCacheSize
UrlCacheGetGlobalLimit
UrlCacheReadEntryStream
UrlCacheReloadSettings
UrlCacheRetrieveEntryFile
UrlCacheRetrieveEntryStream
UrlCacheServer
UrlCacheSetGlobalLimit
UrlCacheUpdateEntryExtraData
UrlZonesDetach
_GetFileExtensionFromUrl
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
_wpp_sf
Size
136KB
Virtual Size
133KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
476KB
Virtual Size
473KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
72KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=33145,
count=105, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=4, id=259, version=33145,
count=25, id=261, version=33145,
count=1748, id=1, productName=Unmarked objects,
count=32, id=260, version=33145,
count=1, id=256, version=33145,
count=340, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wininetlui.dll
- IMPHASH 9391a0f28db17953afadbccd1c9688f3
- SHA256 9c6320b9a481a9ae4f59c51ee3ead3939b9eed3c57372b49147a38585611af45
- MD5 668dec0ba631761ffb24452e6641020e
- SHA1 0b410aeca17a2931a9f2a1a037ed28e7fbd75aa3
- SHA512 6a949c1ed5f859c6d8058bd272fd15a8fe790f27fa0f9fa708533ac13335aed6529714af6011cad8b54bd0255bd4a1c363c864dc6c1e8f7fdcaa4ae70e9e0a36
- SSDEEP 1536:KFfhPD4hnw6fAOcbeyOpA4iUNxPbZ5+rOqS/SEaxDtoYivvvvvvvvvvvvvvvvvvf:YhcRfgbQNpbyrOqSat53Kg9Pw
- TLSH T129D32A45E3A4B0DBE0A5803481138635AB71B82513185BFF53D8F6BF6F327E62039E5A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
41:fe:21:dc:b1:84:99:98:c6:64:cd:83:c9:33:b1:c3:34:2d:6f:41:85:e2:6c:20:09:67:dc:9e:4b:11:3d:48
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:431A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1d:4b:c0:92:87:38:85:7e:39:00:01:00:00:02:1d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
5216
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wininetlui.pdb
msvcrt
__C_specific_handler
_lock
malloc
free
_amsg_exit
_unlock
_XcptFilter
memcpy
__dllonexit
_initterm
_onexit
memmove_s
_purecall
??3@YAXPEAX@Z
memcpy_s
_vsnwprintf
memcmp
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
LoadStringW
GetProcAddress
GetModuleHandleExW
GetModuleFileNameA
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
AcquireSRWLockShared
CreateMutexExW
OpenSemaphoreW
ReleaseSRWLockExclusive
DeleteCriticalSection
EnterCriticalSection
ReleaseMutex
WaitForSingleObject
ReleaseSRWLockShared
InitializeCriticalSectionEx
WaitForSingleObjectEx
LeaveCriticalSection
CreateSemaphoreExW
ReleaseSemaphore
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
SetLastError
UnhandledExceptionFilter
api-ms-win-eventing-provider-l1-1-0
EventWriteEx
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetUserDefaultLCID
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-com-l1-1-0
CoCreateInstance
oleaut32
SysAllocString
SysFreeString
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
api-ms-win-core-datetime-l1-1-0
GetTimeFormatW
GetDateFormatW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
InternetErrorDlgEx
Name
.text
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
_wpp_sf
Size
4KB
Virtual Size
253B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
288B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
304B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=40, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33145,
count=5, id=259, version=33145,
count=112, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=1, id=256, version=33145,
count=6, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wininitext.dll
- IMPHASH 2d4c473ca5cf116a87532ee0284e9e40
- SHA256 308e1c262b26496e284f2c01a7667c9c2b0f148f63ab35e7f63fb61b53388f8e
- MD5 fc588868abcee53d58a0e3a66f53d42d
- SHA1 70c22b5d789796f3883b147d25263e62d59000bc
- SHA512 d575fc63d2053b579e139ad8d5dbee4fb2e70709caa274dca7e96ad004d6744bec96a84db27aec7f5281c641439ade4d69c2b927683f607f46a5037c5cd4fb9d
- SSDEEP 1536:hEbxescPrNvEhI/VhGTOkhj+Ngu8Wn94PbXG66MDEF9prDwSV1UgPZZzfa:nlvEed3khj+NguJn94Pb+TrMs1UgLG
- TLSH T1D5A36C5EA3B820E9E5BA917CC1968606E7B1B464270147FF07B0C2BD1F17BD46E38B52
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
01:18:3b:de:40:5e:23:25:2f:f1:f4:b9:54:20:79:47:8f:8e:5f:4f:9b:4f:aa:bb:cd:e8:6a:e1:ee:ea:1d:43
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:2D1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:12:d1:08:06:3c:ca:18:4f:aa:00:01:00:00:02:12
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
5792
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wininitext.pdb
msvcrt
__C_specific_handler
_initterm
_lock
_unlock
memcmp
free
_amsg_exit
_XcptFilter
memmove_s
_purecall
__dllonexit
_vsnwprintf
malloc
??3@YAXPEAX@Z
memcpy_s
_onexit
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetModuleHandleW
GetModuleHandleExA
GetModuleFileNameA
GetProcAddress
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
api-ms-win-core-synch-l1-1-0
OpenSemaphoreW
CreateEventW
ReleaseSRWLockShared
CreateSemaphoreExW
AcquireSRWLockExclusive
EnterCriticalSection
ReleaseSemaphore
CreateMutexExW
WaitForSingleObjectEx
LeaveCriticalSection
AcquireSRWLockShared
InitializeCriticalSectionEx
InitializeCriticalSection
DeleteCriticalSection
OpenEventW
WaitForSingleObject
ReleaseMutex
ReleaseSRWLockExclusive
SetEvent
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
CreateThread
TerminateProcess
ResumeThread
GetCurrentProcess
DeleteProcThreadAttributeList
GetCurrentThreadId
GetCurrentProcessId
CreateProcessAsUserW
InitializeProcThreadAttributeList
CreateProcessW
UpdateProcThreadAttribute
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetVersionExW
GetSystemTimeAsFileTime
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceExecuteOnce
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-security-base-l1-1-0
GetTokenInformation
AdjustTokenPrivileges
SetTokenInformation
GetSecurityDescriptorDacl
CreateRestrictedToken
FreeSid
GetLengthSid
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
ntdll
RtlInitUnicodeString
RtlSetEnvironmentVariable
RtlAddAce
RtlSetDaclSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlLengthSid
RtlCopySid
TpSimpleTryPost
RtlSetSaclSecurityDescriptor
RtlAddMandatoryAce
RtlCreateAcl
RtlCreateSecurityDescriptor
NtSetInformationThread
RtlNtStatusToDosError
RtlFreeSid
RtlAllocateAndInitializeSid
EtwTraceMessage
kernelbase
AppContainerDeriveSidFromMoniker
WTSGetServiceSessionId
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
GetLoggedOnUserCount
LaunchUmfdHostWithVirtualAccountWorker
PrimaryTerminalAndHookWorker
StartLoadingFontsWorker
UIStartupWorker
WaitForWinstationShutdown
WinStationSystemShutdownStartedWorker
Name
.text
Size
44KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
288B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=52, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=16, id=260, version=33145,
count=179, id=1, productName=Unmarked objects,
count=7, id=257, version=33145,
count=1, id=256, version=33145,
count=11, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
winipcfile.dll
- IMPHASH 76f1fb29c15838b596d18618f399090c
- SHA256 1f261228f98bfd5bf225356f3c4eceacc88ef007c5062c74bf30e13507a5320f
- MD5 6a657c093febaefcc743af3f68fc0717
- SHA1 c5a10ab8a0cc5af1d7403c48f8d8289c9d7b4ef6
- SHA512 ab2b2f767b886f1ddc177e4db72a40271d9cad1dc38afd93c47c9bf7ced968b9c1c552c26b9492fd6df24f2443450a32f7eb838d2a1cbaf2cdf626b747714c2f
- SSDEEP 6144:oCenXq9woNsQm4elxEJ8/H7nU9vcqbAZ6+21PZg57MPPotajYjjiN9AxCrWCXEYP:oGnRg1GUnZp2Lyeotajei7qTC
- TLSH T128B4291DB6EC0090E1B6D2B98963C516EA3278614331A7DF06A0C57E5E37FD8EE36B11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
13488
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
winipcfile.pdb
msvcrt
towlower
strcspn
localeconv
swprintf_s
_errno
sprintf_s
wcsncmp
calloc
fclose
fseek
??0bad_cast@@QEAA@PEBD@Z
_wcsnicmp
wcsstr
fputc
fflush
fgetc
fwrite
fgetpos
setvbuf
ungetc
fsetpos
_fseeki64
wcsnlen
strnlen
setlocale
__uncaught_exception
__pctype_func
isupper
___lc_handle_func
??1bad_cast@@UEAA@XZ
___mb_cur_max_func
_ismbblead
islower
_wcsdup
??8type_info@@QEBAHAEBV0@@Z
__crtLCMapStringW
__crtLCMapStringA
_wsetlocale
_wfsopen
abort
memset
free
_amsg_exit
_XcptFilter
_initterm
??0bad_cast@@QEAA@AEBV0@@Z
__C_specific_handler
memmove
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_onexit
__dllonexit
_vsnwprintf
??_V@YAXPEAX@Z
memcpy_s
??3@YAXPEAX@Z
_wcsicmp
__CxxFrameHandler4
_wsplitpath_s
memcpy
__CxxFrameHandler3
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
_lock
_vsnprintf
___lc_codepage_func
_purecall
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBQEBD@Z
_callnewh
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBV0@@Z
_unlock
strchr
malloc
__RTDynamicCast
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventActivityIdControl
EventEnabled
EventUnregister
EventRegister
EventWrite
EventWriteTransfer
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExA
AddDllDirectory
GetModuleHandleExW
RemoveDllDirectory
GetModuleFileNameW
GetModuleFileNameA
GetProcAddress
FreeLibrary
GetModuleHandleW
LoadLibraryExW
api-ms-win-core-synch-l1-2-0
InitOnceComplete
WakeAllConditionVariable
Sleep
SleepConditionVariableSRW
InitOnceBeginInitialize
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockExclusive
InitializeCriticalSection
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
InitializeCriticalSectionAndSpinCount
ReleaseMutex
WaitForSingleObject
ReleaseSemaphore
DeleteCriticalSection
EnterCriticalSection
CreateSemaphoreExW
InitializeCriticalSectionEx
LeaveCriticalSection
api-ms-win-core-heap-l1-1-0
HeapReAlloc
HeapDestroy
HeapSize
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
RaiseException
SetLastError
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringA
OutputDebugStringW
api-ms-win-core-com-l1-1-0
CoInitializeEx
CoCreateGuid
CoCreateInstance
CLSIDFromString
CoUninitialize
StringFromGUID2
CoTaskMemAlloc
CoTaskMemFree
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcessId
OpenProcessToken
GetCurrentThreadId
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
GetUserPreferredUILanguages
LocaleNameToLCID
FormatMessageW
GetSystemPreferredUILanguages
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
GetStringTypeW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetVersionExW
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetSystemWindowsDirectoryW
GetTickCount
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-security-cryptoapi-l1-1-0
CryptReleaseContext
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-file-l1-1-0
CreateFileW
SetFileAttributesW
GetVolumeInformationW
DeleteFileW
GetFileAttributesW
GetFileInformationByHandle
LockFileEx
GetFileAttributesExW
SetFilePointerEx
GetFullPathNameW
UnlockFileEx
ReadFile
SetEndOfFile
WriteFile
FlushFileBuffers
api-ms-win-core-com-l2-1-1
CreateILockBytesOnHGlobal
api-ms-win-core-file-l2-1-0
ReplaceFileW
api-ms-win-core-file-l2-1-2
CopyFileW
api-ms-win-core-kernel32-legacy-l1-1-0
MoveFileW
api-ms-win-core-file-l1-2-3
GetTempPath2W
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-security-provider-l1-1-0
GetNamedSecurityInfoW
SetNamedSecurityInfoW
api-ms-win-security-base-l1-1-0
GetSecurityDescriptorControl
AdjustTokenPrivileges
api-ms-win-security-lsalookup-l2-1-0
LookupPrivilegeValueW
api-ms-win-core-version-l1-1-0
GetFileVersionInfoSizeExW
GetFileVersionInfoExW
VerQueryValueW
api-ms-win-core-sysinfo-l1-2-0
GetNativeSystemInfo
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
api-ms-win-core-registry-l2-1-0
RegEnumKeyW
api-ms-win-core-memory-l1-1-0
VirtualQuery
VirtualProtect
api-ms-win-core-shlwapi-obsolete-l1-1-0
QISearch
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
Name
.text
Size
304KB
Virtual Size
303KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
144KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
288B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=112, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=465, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=27, id=261, version=33145,
count=69, id=260, version=33145,
count=1, id=256, version=33145,
count=141, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
winipcsecproc.dll
- IMPHASH 4dedadc1c37bda2333174c4dcba0698c
- SHA256 30fdddcf4fac49ab8fa437883a2c15b9e63c061ba8a36edee34613108d93d271
- MD5 e5bd99caaf149232593f338ebe990d69
- SHA1 4d10f9cf0fe31f500f4e343ef17afebf8a42de98
- SHA512 578a8fa87b6e7d7c2c465d82d39c5f31ded340adc67a96f96324225bcc8a67792389258edecce239c3a8764b263c46f23aec5253beaac221d4bd2e277e98dffc
- SSDEEP 12288:447YqPndC4kyc6A7rJsrC6VWBlKMTEhMsbRfg3Ad7cub46upfiGZSc:5MdLrJsrpVSvTsB9UKcuE6IfNEc
- TLSH T1AC156E8AE79A0005D4B1C27ADB7E850BE777B8261310E3DB1190825F7E1BFEE4639761
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
16976
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
winipcsecproc.pdb
msvcrt
___lc_handle_func
_wsetlocale
__crtLCMapStringW
_wcsdup
?terminate@@YAXXZ
memcpy_s
__RTDynamicCast
_snwprintf_s
??1type_info@@UEAA@XZ
_onexit
sprintf_s
__dllonexit
??1bad_cast@@UEAA@XZ
??0bad_cast@@QEAA@PEBD@Z
??0bad_cast@@QEAA@AEBV0@@Z
strcspn
localeconv
wcstol
_wcstoi64
calloc
setlocale
__uncaught_exception
__pctype_func
___lc_codepage_func
___mb_cur_max_func
_ismbblead
abort
memset
memcmp
_unlock
wcsstr
_wcsicmp
wcscpy_s
wcsncmp
_lock
_initterm
??_V@YAXPEAX@Z
_amsg_exit
_XcptFilter
_vsnwprintf
_callnewh
__CxxFrameHandler4
memmove
memcpy
__CxxFrameHandler3
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@XZ
_purecall
malloc
free
??3@YAXPEAX@Z
__C_specific_handler
wcstombs_s
_vsnprintf
_errno
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
OutputDebugStringA
DebugBreak
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
SetLastError
GetLastError
RaiseException
UnhandledExceptionFilter
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
DisableThreadLibraryCalls
GetModuleHandleW
FreeLibrary
GetModuleFileNameA
GetModuleHandleExW
api-ms-win-core-heap-l1-1-0
HeapDestroy
HeapSize
HeapSetInformation
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
GetSystemTime
GetVersionExW
api-ms-win-core-file-l1-1-0
CreateFileW
GetDriveTypeW
GetFileAttributesW
CreateDirectoryW
SetFileAttributesW
ReadFile
CompareFileTime
WriteFile
GetFileTime
SetFileTime
GetLogicalDriveStringsW
SetFilePointer
DeleteFileW
GetVolumeInformationW
api-ms-win-core-synch-l1-1-0
CreateSemaphoreExW
ReleaseSemaphore
EnterCriticalSection
CreateMutexW
CreateEventW
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
InitializeCriticalSectionEx
InitializeCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
ReleaseMutex
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-security-cryptoapi-l1-1-0
CryptGenRandom
CryptGetDefaultProviderW
CryptDecrypt
CryptVerifySignatureW
CryptExportKey
CryptCreateHash
CryptDuplicateKey
CryptReleaseContext
CryptGenKey
CryptGetHashParam
CryptSignHashW
CryptEncrypt
CryptAcquireContextW
CryptDeriveKey
CryptGetKeyParam
CryptHashData
CryptSetHashParam
CryptImportKey
CryptContextAddRef
CryptSetKeyParam
CryptDestroyKey
CryptDestroyHash
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
Sleep
InitOnceComplete
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThread
OpenThreadToken
GetCurrentThreadId
OpenProcessToken
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventSetInformation
EventWriteTransfer
EventRegister
api-ms-win-core-string-l1-1-0
GetStringTypeW
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-core-localization-l1-2-0
FormatMessageW
crypt32
CryptUnprotectData
CryptProtectData
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
FileTimeToSystemTime
api-ms-win-core-com-l1-1-0
CoCreateGuid
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegCloseKey
RegDeleteValueW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
IpcSPAttest
IpcSPBindLicense
IpcSPCheckEnvironmentSecurity
IpcSPCloseHandle
IpcSPCommit
IpcSPCreateDecryptor
IpcSPCreateEnablingPrincipal
IpcSPCreateEncryptor
IpcSPCreateMachineCerts
IpcSPCreatePCE
IpcSPCreateSecurityProcessor
IpcSPDecrypt
IpcSPDecryptFinal
IpcSPDecryptUpdate
IpcSPDecryptWithRac
IpcSPEnableAndEncrypt
IpcSPEnablePublishingLicense
IpcSPEncrypt
IpcSPEncryptFinal
IpcSPEncryptUpdate
IpcSPGetBoundRightKey
IpcSPGetCurrentTime
IpcSPGetInfo
IpcSPGetProcAddress
IpcSPInitialize
IpcSPIsActivated
IpcSPLoadLibrary
IpcSPSign
Name
.text
Size
660KB
Virtual Size
659KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
180KB
Virtual Size
178KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
225KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
28KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=108, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=415, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=26, id=261, version=33145,
count=69, id=260, version=33145,
count=221, id=264, version=33145,
count=1, id=256, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
winipsec.dll
- IMPHASH f9d309523108b05644323d0f1cfbf2a1
- SHA256 e701056ec2745d18280a0bd04a54b023d4a754710a619f0372831ca37bd916be
- MD5 11b3e69b106324a99c4414d60dd06aa0
- SHA1 1070709e4f55e027969952c7f6fac68c96067121
- SHA512 de22c9818d9639df3a47a280467bd4a878141f06c39ff5a38a2b0c6c152830f7bda0e8c7832c123bb19ead5205f67c99304cd9b64f166981dc1b031fcfd549b4
- SSDEEP 1536:rKZBZTOdl9ZMm4jptl4EZ3EIq7aTSt+W+deDVca1gYtbibr:+ZbTGq/NZUIq7HDVcEg4ibr
- TLSH T1C7C3D59BEB8490ABC43982B8C4570731B373F725275317CB4264C2299F433D6AF75A9A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4784
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
winipsec.pdb
msvcrt
__dllonexit
_onexit
_lock
_initterm
_unlock
free
_amsg_exit
_XcptFilter
_vsnwprintf
memcmp
malloc
__C_specific_handler
memset
rpcrt4
RpcSsDestroyClientContext
RpcRaiseException
RpcBindingFree
RpcEpResolveBinding
RpcStringFreeW
RpcStringBindingComposeW
RpcBindingSetAuthInfoW
RpcBindingFromStringBindingW
NdrClientCall3
RpcBindingSetOption
api-ms-win-eventing-classicprovider-l1-1-0
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
UnregisterTraceGuids
TraceMessage
GetTraceLoggerHandle
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
ntdll
DbgPrint
ws2_32
htonl
ntohl
api-ms-win-service-management-l1-1-0
OpenSCManagerW
StartServiceW
CloseServiceHandle
OpenServiceW
api-ms-win-service-winsvc-l1-1-0
QueryServiceStatus
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
AddMMAuthMethods
AddMMFilter
AddMMFilterEx
AddMMPolicy
AddQMPolicy
AddSAs
AddTransportFilter
AddTransportFilterEx
AddTunnelFilter
CloseIKENegotiationHandle
CloseIKENotifyHandle
CloseMMFilterHandle
CloseTransportFilterHandle
CloseTunnelFilterHandle
DeleteMMAuthMethods
DeleteMMFilter
DeleteMMPolicy
DeleteMMSAs
DeleteQMPolicy
DeleteQMSAs
DeleteTransportFilter
DeleteTunnelFilter
DllMain
EnumIPSecInterfaces
EnumMMAuthMethods
EnumMMFilters
EnumMMFiltersEx
EnumMMPolicies
EnumMMSAs
EnumQMPolicies
EnumQMSAs
EnumTransportFilters
EnumTransportFiltersEx
EnumTunnelFilters
GetConfigurationVariables
GetMMAuthMethods
GetMMFilter
GetMMFilterEx
GetMMPolicy
GetMMPolicyByID
GetQMPolicy
GetQMPolicyByID
GetTransportFilter
GetTransportFilterEx
GetTunnelFilter
InitiateIKENegotiation
MatchMMFilter
MatchMMFilterEx
MatchTransportFilter
MatchTransportFilterEx
MatchTunnelFilter
OpenMMFilterHandle
OpenMMFilterHandleEx
OpenTransportFilterHandle
OpenTransportFilterHandleEx
OpenTunnelFilterHandle
QueryIKENegotiationStatus
QueryIKENotifyData
QueryIKEStatistics
QueryIPSecStatistics
QuerySpdPolicyState
RegisterIKENotifyClient
SPDApiBufferAllocate
SPDApiBufferFree
SetConfigurationVariables
SetMMAuthMethods
SetMMFilter
SetMMFilterEx
SetMMPolicy
SetQMPolicy
SetTransportFilter
SetTransportFilterEx
SetTunnelFilter
Name
.text
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
48KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=30, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33136,
count=4, id=259, version=33136,
count=59, id=1, productName=Unmarked objects,
count=5, id=257, version=33136,
count=1, id=256, version=33136,
count=15, id=264, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
winlogonext.dll
- IMPHASH 79e1aafa1564aefaae559ca33c6d0918
- SHA256 d707498fa3f4e0b6d18921c088595b8e6c09da893485275db4911a2966bcba34
- MD5 c10feab439a02a5a760a3ab06e36cb14
- SHA1 b2a77fe84888289a313dcdbe7272eaa87d430d7d
- SHA512 713e9b630422815a3af0caccb18ec793b966bb8fd59697c8be4dacf913f41474410cd3c570de945944613a474b66bb86a0ba4c913822dcc15034a90a4aab7d38
- SSDEEP 1536:89Q2W7GtMwhnKqr+T54JsVSZeOZEgtWn3sFGGjeCt97mm/IVg98CS0uS/pAGbd:8y97Es245cZZvo3iOpZX0uS/pAQd
- TLSH T11EE3C71FB654586BD87A8236C49B0A36BBB6FB64134307CF0540823E6E173CA2F75E95
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5216
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
winlogonext.pdb
msvcrt
_onexit
memcpy
__dllonexit
__C_specific_handler
??3@YAXPEAX@Z
_unlock
_vsnwprintf
_wcsnicmp
memcpy_s
_purecall
memmove_s
_XcptFilter
_amsg_exit
free
malloc
_initterm
memcmp
_lock
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetProcAddress
GetModuleFileNameA
GetModuleHandleExW
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
ReleaseMutex
EnterCriticalSection
WaitForSingleObject
ReleaseSemaphore
ReleaseSRWLockShared
LeaveCriticalSection
CreateSemaphoreExW
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
SetLastError
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
kernelbase
LocalAlloc
rpcrt4
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcBindingSetAuthInfoExW
RpcStringFreeW
RpcBindingBind
RpcBindingCreateW
I_RpcMapWin32Status
I_RpcExceptionFilter
NdrClientCall3
RpcBindingFree
kernel32
GetComputerNameExW
LocalFree
api-ms-win-security-base-l1-1-0
CreateWellKnownSid
api-ms-win-service-management-l1-1-0
StartServiceW
OpenServiceW
CloseServiceHandle
OpenSCManagerW
api-ms-win-service-winsvc-l1-1-0
QueryServiceStatus
ConfigureUserArso
EnableDisableElevationForSessionWorker
NotifyInteractiveSessionLogoff
UpdateUserTokenSessionId
WinLogonExt
Name
.text
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
80KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=40, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=15, id=260, version=33145,
count=159, id=1, productName=Unmarked objects,
count=13, id=257, version=33145,
count=1, id=256, version=33145,
count=14, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
winmde.dll
- IMPHASH 88c1bb3a6ea976118fd72630a47ec85a
- SHA256 9423a818b814e1971f3ec76aef12160c95a40e14afd98cc9ff2adeb5e3df56bd
- MD5 9f63bd8b01afa513c9123f99ca3af659
- SHA1 3c17b9b26e346a954fd5f230328107cf03e090b2
- SHA512 250d3839045dade0b7feb62475dc7112e0d6ff763b85ba9edec390e30a51cc4c8330d578df5306831716898cfba0398bb915710485996d5fcd7e03cc56675849
- SSDEEP 24576:3TIHeUDyqFfHXu0FUTIdTe0c1qyaCbTeQMxjwrdDqfHe/RdPC4:38HNDFFf3u0STWe2C+JjwQfeJRC4
- TLSH T18FA52B1D22F802A8FEABA17AC953821AF63534147F62FBC7021583785F53AD53D7AD12
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
47:b7:66:1c:71:85:0b:01:18:f0:81:4e:d2:ac:9a:a9:98:72:bd:97:57:45:87:dd:54:5a:e2:4f:1b:56:db:ac
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:7F00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1e:a3:ac:a4:6e:39:6f:7c:49:00:01:00:00:02:1e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
247616
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
winmde.pdb
api-ms-win-crt-string-l1-1-0
wcscmp
wcsncmp
strnlen
strncmp
memset
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__gcvt_s
_o__i64toa_s
_o__i64tow_s
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__ltoa_s
_o__ltow_s
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
_o__ui64toa_s
_o__ui64tow_s
_o__ultoa_s
_o__ultow_s
memmove
_o__wcsicmp
_o__wcsnicmp
_o__wtol
_o_bsearch
_o_free
_o_isalpha
_o_isdigit
_o_islower
_o_iswalpha
_o_iswdigit
_o_iswxdigit
_o_malloc
_o_memcpy_s
_o_qsort
_o_rand
_o_realloc
_o_strncpy_s
_o_toupper
_o_towlower
_o_towupper
_o_wcsncpy_s
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
wcschr
__CxxFrameHandler3
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___std_type_info_destroy_list
wcsstr
__C_specific_handler
memchr
memcmp
memcpy
api-ms-win-core-synch-l1-1-0
SetWaitableTimer
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CreateWaitableTimerExW
OpenEventW
SetEvent
CreateEventA
ReleaseSemaphore
ReleaseMutex
WaitForMultipleObjectsEx
WaitForSingleObjectEx
AcquireSRWLockShared
WaitForSingleObject
ReleaseSRWLockShared
OpenSemaphoreW
LeaveCriticalSection
ResetEvent
EnterCriticalSection
CreateEventW
InitializeCriticalSectionAndSpinCount
CreateMutexExW
DeleteCriticalSection
CreateSemaphoreExW
CreateEventExW
InitializeCriticalSection
InitializeSRWLock
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventUnregister
EventEnabled
EventSetInformation
EventRegister
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
GetLastError
RaiseException
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-eventing-classicprovider-l1-1-0
RegisterTraceGuidsW
GetTraceEnableFlags
TraceMessage
GetTraceEnableLevel
UnregisterTraceGuids
GetTraceLoggerHandle
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
FindResourceExW
GetModuleHandleW
SizeofResource
DisableThreadLibraryCalls
GetModuleHandleExW
GetProcAddress
GetModuleFileNameA
GetModuleFileNameW
LoadResource
FreeLibrary
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-registry-l1-1-0
RegEnumKeyExW
RegNotifyChangeKeyValue
RegQueryInfoKeyW
RegOpenKeyExW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegEnumValueW
RegGetValueW
RegCloseKey
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
CompareStringOrdinal
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-0
CreateThread
GetCurrentThreadId
GetProcessTimes
GetCurrentProcessId
TlsGetValue
TerminateProcess
GetCurrentProcess
TlsSetValue
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
GetTickCount64
GetSystemInfo
GetSystemTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-file-l1-1-0
GetFileSize
WriteFile
CreateFileW
GetFileAttributesExW
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
FileTimeToSystemTime
ntdll
NtQuerySystemInformation
NtDeviceIoControlFile
NtClose
NtCreateFile
RtlInitUnicodeString
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolWait
CloseThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
api-ms-win-core-featurestaging-l1-1-0
SubscribeFeatureStateChangeNotification
RecordFeatureUsage
UnsubscribeFeatureStateChangeNotification
sspicli
EncryptMessage
QueryContextAttributesW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
d3d11
D3D11CreateDevice
rtworkq
RtwqInvokeCallback
RtwqCreateAsyncResult
RtwqSetLongRunning
RtwqCancelDeadline
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-toolhelp-l1-1-0
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
api-ms-win-core-heap-l2-1-0
LocalFree
GlobalFree
api-ms-win-core-heap-obsolete-l1-1-0
GlobalLock
GlobalUnlock
api-ms-win-core-memory-l1-1-0
MapViewOfFileEx
OpenFileMappingW
VirtualQueryEx
UnmapViewOfFile
CreateFileMappingW
api-ms-win-core-version-l1-1-0
VerQueryValueW
api-ms-win-core-version-l1-1-1
GetFileVersionInfoW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
MFCreateNetVRoot
MFCreateWMPMDEOpCenter
MFCreateWinMDEOpCenter
Name
.text
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
232KB
Virtual Size
229KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
52KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
44KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=33145,
count=97, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1439, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=25, id=260, version=33145,
count=6, id=259, version=33145,
count=29, id=261, version=33145,
count=1, id=256, version=33145,
count=182, id=264, version=33145,
count=2, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
winml.dll
- IMPHASH aa04b920cab8e26c09654ebbce8f8c7e
- SHA256 06a5fa3651404e9ddb8d7cca062e98dca3dbcc67fe14f11db4a5dac0392bc1a9
- MD5 29a837e96853580402252689270c9120
- SHA1 2f51c3156c279e546df86dd88a333477a65bc868
- SHA512 39719576a1700d5880a99d8d96056e1642bf2c1dc788686fa82b27e118725ef80fa443b1e861a63515094bd4509ebb7aa00f102a89a5dd370d8b5087d44fe279
- SSDEEP 768:8/LM7r9PV/r36K1hlxCiFbs0y1FsQQ4A6J3pAakFzCplMNy6iksc0IeU78BfO+Dl:8DozrK0bNs0y1FbXD5
- TLSH T192532A997F888495E179873D8EE78E99A276F8214F318BDF1390035F1E76BE049346B0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5840
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
winml.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___std_exception_copy
_o___std_exception_destroy
_o___std_type_info_destroy_list
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o_free
_o_malloc
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
_CxxThrowException
__CxxFrameHandler3
memmove
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
FreeLibrary
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
GetSystemTimeAsFileTime
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventRegister
EventUnregister
EventSetInformation
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
InitializeCriticalSection
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
WinMLCreateRuntime
Name
.text
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
472B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=29, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1098, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33138,
count=4, id=259, version=33138,
count=23, id=261, version=33138,
count=1, id=256, version=33138,
count=9, id=264, version=33138,
count=2, id=253, version=33138,
count=1, id=255, version=33138,
count=1, id=258, version=33138,
winmm.dll
- IMPHASH 63e2570eefc0f897cf163ff1bb2a01a6
- SHA256 ed76d6396a53c168f91aec28b69ec50da47bfea1c3966f28a107a6d93e97a2bd
- MD5 392199155b577269f38eef774b632314
- SHA1 1d56c1d90edf568505c9d72ae75eb9f1d516cfa1
- SHA512 0bd9ecb63ab47354ec09ef078452fde21a4841768e339497d1d39697e72ab20017d1eafed2302f1ede8b87216c64d3369203d91d7b9b723979accdfa7b44a4a4
- SSDEEP 3072:6OCzZkezc9x27dle8pvp5Qd6gi+szXj38HirhQHsKsMuRbyTZLhf2LUSgm:7Cz3zc9476ip5Qd6pXIirhQRsQhe
- TLSH T104244B1D77EC10A7E97B973888A24615F672F8711B1283DF02D0827D1E27FD8AA34B95
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
59:c0:a3:3b:94:23:89:70:d5:9c:c6:ea:78:01:1f:b4:b9:f0:46:e3:c5:7a:96:6c:5c:89:ac:12:aa:39:c8:c8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:4C1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:18:25:d9:92:05:e2:e7:e5:e4:00:01:00:00:02:18
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
53680
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
winmm.pdb
ntdll
EtwGetTraceEnableFlags
EtwUnregisterTraceGuids
memmove
RtlGetActiveConsoleId
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwRegisterTraceGuidsW
wcsstr
RtlMultiByteToUnicodeN
RtlUnicodeToMultiByteN
wcschr
__C_specific_handler
_vsnwprintf
NtQueryTimerResolution
NtCreateTimer
NtWaitForMultipleObjects
NtSetEvent
NtCreateEvent
NtCancelTimer
NtClose
NtSetTimer
__chkstk
memcmp
memcpy
EtwTraceMessage
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_CxxThrowException
_o__wcslwr_s
_o_free
_o_iswdigit
_o_malloc
_o_terminate
_o_towlower
__current_exception
__current_exception_context
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o__execute_onexit_table
_o__errno
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
api-ms-win-mm-time-l1-1-0
timeBeginPeriod
timeGetDevCaps
timeGetTime
timeGetSystemTime
timeEndPeriod
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceBeginInitialize
InitOnceComplete
InitOnceExecuteOnce
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegGetValueW
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegCloseKey
RegOpenCurrentUser
api-ms-win-core-synch-l1-1-0
CreateSemaphoreExW
SleepEx
ReleaseMutex
AcquireSRWLockShared
SetEvent
InitializeCriticalSection
ReleaseSRWLockExclusive
DeleteCriticalSection
CreateMutexExW
ResetEvent
ReleaseSemaphore
CreateEventW
ReleaseSRWLockShared
OpenEventW
OpenSemaphoreW
WaitForSingleObject
LeaveCriticalSection
WaitForSingleObjectEx
AcquireSRWLockExclusive
EnterCriticalSection
InitializeCriticalSectionEx
CreateEventA
api-ms-win-core-processthreads-l1-1-0
TlsFree
ProcessIdToSessionId
CreateThread
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
SetThreadPriority
ExitThread
TerminateProcess
GetCurrentThread
TlsAlloc
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
LoadResource
LockResource
GetModuleHandleW
FreeLibrary
LoadStringW
GetModuleFileNameA
DisableThreadLibraryCalls
LoadLibraryExA
FreeResource
GetModuleFileNameW
GetProcAddress
LoadStringA
LoadLibraryExW
SizeofResource
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-kernel32-legacy-l1-1-0
PulseEvent
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
HeapSize
GetProcessHeap
api-ms-win-core-processenvironment-l1-1-0
GetCurrentDirectoryW
SearchPathW
SetCurrentDirectoryW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-errorhandling-l1-1-0
SetErrorMode
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
RaiseException
SetLastError
api-ms-win-core-libraryloader-l1-2-1
FindResourceW
api-ms-win-core-privateprofile-l1-1-0
GetProfileStringW
GetPrivateProfileStringW
api-ms-win-core-file-l1-1-0
GetFileTime
GetFileAttributesW
GetFileSize
CompareFileTime
CreateFileW
api-ms-win-core-path-l1-1-0
PathCchStripToRoot
PathCchIsRoot
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventSetInformation
EventUnregister
EventWriteTransfer
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
api-ms-win-core-localization-l1-2-0
GetACP
FormatMessageW
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFileExistsW
api-ms-win-core-util-l1-1-0
Beep
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
GetSystemTimeAsFileTime
api-ms-win-core-kernel32-private-l1-1-2
CheckForReadOnlyResource
api-ms-win-core-kernel32-private-l1-1-0
_lread
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
CloseDriver
DefDriverProc
DriverCallback
DrvGetModuleHandle
GetDriverModuleHandle
OpenDriver
PlaySound
PlaySoundA
PlaySoundW
SendDriverMessage
WOWAppExit
auxGetDevCapsA
auxGetDevCapsW
auxGetNumDevs
auxGetVolume
auxOutMessage
auxSetVolume
joyConfigChanged
joyGetDevCapsA
joyGetDevCapsW
joyGetNumDevs
joyGetPos
joyGetPosEx
joyGetThreshold
joyReleaseCapture
joySetCapture
joySetThreshold
mciDriverNotify
mciDriverYield
mciExecute
mciFreeCommandResource
mciGetCreatorTask
mciGetDeviceIDA
mciGetDeviceIDFromElementIDA
mciGetDeviceIDFromElementIDW
mciGetDeviceIDW
mciGetDriverData
mciGetErrorStringA
mciGetErrorStringW
mciGetYieldProc
mciLoadCommandResource
mciSendCommandA
mciSendCommandW
mciSendStringA
mciSendStringW
mciSetDriverData
mciSetYieldProc
midiConnect
midiDisconnect
midiInAddBuffer
midiInClose
midiInGetDevCapsA
midiInGetDevCapsW
midiInGetErrorTextA
midiInGetErrorTextW
midiInGetID
midiInGetNumDevs
midiInMessage
midiInOpen
midiInPrepareHeader
midiInReset
midiInStart
midiInStop
midiInUnprepareHeader
midiOutCacheDrumPatches
midiOutCachePatches
midiOutClose
midiOutGetDevCapsA
midiOutGetDevCapsW
midiOutGetErrorTextA
midiOutGetErrorTextW
midiOutGetID
midiOutGetNumDevs
midiOutGetVolume
midiOutLongMsg
midiOutMessage
midiOutOpen
midiOutPrepareHeader
midiOutReset
midiOutSetVolume
midiOutShortMsg
midiOutUnprepareHeader
midiStreamClose
midiStreamOpen
midiStreamOut
midiStreamPause
midiStreamPosition
midiStreamProperty
midiStreamRestart
midiStreamStop
mixerClose
mixerGetControlDetailsA
mixerGetControlDetailsW
mixerGetDevCapsA
mixerGetDevCapsW
mixerGetID
mixerGetLineControlsA
mixerGetLineControlsW
mixerGetLineInfoA
mixerGetLineInfoW
mixerGetNumDevs
mixerMessage
mixerOpen
mixerSetControlDetails
mmDrvInstall
mmGetCurrentTask
mmTaskBlock
mmTaskCreate
mmTaskSignal
mmTaskYield
mmioAdvance
mmioAscend
mmioClose
mmioCreateChunk
mmioDescend
mmioFlush
mmioGetInfo
mmioInstallIOProcA
mmioInstallIOProcW
mmioOpenA
mmioOpenW
mmioRead
mmioRenameA
mmioRenameW
mmioSeek
mmioSendMessage
mmioSetBuffer
mmioSetInfo
mmioStringToFOURCCA
mmioStringToFOURCCW
mmioWrite
mmsystemGetVersion
sndPlaySoundA
sndPlaySoundW
timeBeginPeriod
timeEndPeriod
timeGetDevCaps
timeGetSystemTime
timeGetTime
timeKillEvent
timeSetEvent
waveInAddBuffer
waveInClose
waveInGetDevCapsA
waveInGetDevCapsW
waveInGetErrorTextA
waveInGetErrorTextW
waveInGetID
waveInGetNumDevs
waveInGetPosition
waveInMessage
waveInOpen
waveInPrepareHeader
waveInReset
waveInStart
waveInStop
waveInUnprepareHeader
waveOutBreakLoop
waveOutClose
waveOutGetDevCapsA
waveOutGetDevCapsW
waveOutGetErrorTextA
waveOutGetErrorTextW
waveOutGetID
waveOutGetNumDevs
waveOutGetPitch
waveOutGetPlaybackRate
waveOutGetPosition
waveOutGetVolume
waveOutMessage
waveOutOpen
waveOutPause
waveOutPrepareHeader
waveOutReset
waveOutRestart
waveOutSetPitch
waveOutSetPlaybackRate
waveOutSetVolume
waveOutUnprepareHeader
waveOutWrite
Name
.text
Size
116KB
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.guids
Size
4KB
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
692B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=82, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=4, id=259, version=33145,
count=21, id=261, version=33145,
count=14, id=260, version=33145,
count=3, id=257, version=33145,
count=1403, id=1, productName=Unmarked objects,
count=1, id=256, version=33145,
count=21, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
winmmbase.dll
- IMPHASH ffddeecb21553cf01078c227a9c990fa
- SHA256 401969c10eb7bd1092f249635469202b25a983049e3252486a934b5421f7b93a
- MD5 4e3f2e8cb68086557e9f8d74f8411511
- SHA1 a38bab0ee3f2703381e074627a5f01c3c50f4e72
- SHA512 5e636ea38ee15cb31b45dc914a825bb4b087f87e3ae6fc396382bf0fe5b07af00af49e6faf13e1885bdcc54a47a10dc2a4cc576883fdc25a50b8c437d8d69c54
- SSDEEP 3072:tS0M/Iukc+ZPOFI8c6tTM8tE2cTUpm0mcAWlbXful3+M/eHk4SUM2JaYg9:sRWc+pO2+TdE2cTUo0mc3l0jCSUM
- TLSH T194346C5E32A410A6ED7B927988838216D272B435075067CF06E1C7789F2BBEC7B39F45
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
2a:1c:57:e4:16:95:39:1c:2d:00:75:ee:c1:0c:34:d9:ef:ec:76:95:82:05:b1:4e:25:0d:f4:1a:53:5a:5f:71
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3703-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1f:3a:70:69:e4:a2:30:2e:95:00:01:00:00:02:1f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
70368
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WINMMBASE.pdb
api-ms-win-crt-string-l1-1-0
memset
wcsncmp
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__register_onexit_function
_o__seh_filter_dll
memcpy
_o_free
_o_mbstowcs
_o_wcstol
wcsrchr
wcschr
__CxxFrameHandler4
__std_terminate
__C_specific_handler
_o__execute_onexit_table
_o___stdio_common_vswprintf
_o__errno
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_CxxThrowException
ntdll
RtlMultiByteToUnicodeN
RtlUnicodeToMultiByteN
EtwTraceMessage
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-heap-obsolete-l1-1-0
GlobalHandle
GlobalReAlloc
GlobalLock
GlobalUnlock
api-ms-win-core-processenvironment-l1-1-0
SearchPathW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapReAlloc
HeapFree
HeapAlloc
api-ms-win-core-file-l1-1-0
DeleteFileW
GetFileSize
GetTempFileNameW
CreateFileW
GetFullPathNameW
GetFileAttributesW
api-ms-win-core-stringansi-l1-1-0
CharUpperA
api-ms-win-core-processthreads-l1-1-0
TlsFree
CreateThread
TerminateProcess
GetCurrentProcess
ProcessIdToSessionId
TlsSetValue
GetCurrentThreadId
TlsGetValue
GetCurrentThread
ExitThread
SetThreadPriority
GetCurrentProcessId
TlsAlloc
api-ms-win-core-kernel32-private-l1-1-0
_lread
_lwrite
_lclose
_llseek
api-ms-win-core-heap-l2-1-0
GlobalFree
GlobalAlloc
LocalAlloc
LocalFree
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-file-l1-2-3
GetTempPath2W
api-ms-win-core-kernel32-legacy-l1-1-0
MoveFileW
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
WideCharToMultiByte
MultiByteToWideChar
CompareStringW
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
InitializeCriticalSection
CreateMutexExW
SetEvent
CreateEventA
WaitForSingleObjectEx
DeleteCriticalSection
CreateEventW
OpenSemaphoreW
LeaveCriticalSection
EnterCriticalSection
ReleaseMutex
api-ms-win-core-errorhandling-l1-1-0
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetErrorMode
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableFlags
GetTraceLoggerHandle
TraceMessage
RegisterTraceGuidsW
GetTraceEnableLevel
UnregisterTraceGuids
api-ms-win-core-libraryloader-l1-2-0
LoadStringW
GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleFileNameA
GetProcAddress
FreeLibrary
LoadLibraryExW
LoadStringA
LoadLibraryExA
GetModuleHandleW
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegGetValueW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
lstrcmpW
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetACP
api-ms-win-mm-time-l1-1-0
timeGetDevCaps
timeEndPeriod
timeGetTime
timeBeginPeriod
api-ms-win-core-featurestaging-l1-1-0
SubscribeFeatureStateChangeNotification
RecordFeatureUsage
GetFeatureEnabledState
UnsubscribeFeatureStateChangeNotification
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventUnregister
EventRegister
api-ms-win-devices-query-l1-1-0
DevFreeObjects
DevFindProperty
DevGetObjects
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-largeinteger-l1-1-0
MulDiv
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
CloseDriver
DefDriverProc
DriverCallback
DrvGetModuleHandle
GetDriverModuleHandle
OpenDriver
SendDriverMessage
auxGetDevCapsA
auxGetDevCapsW
auxGetNumDevs
auxGetVolume
auxOutMessage
auxSetVolume
midiConnect
midiDisconnect
midiInAddBuffer
midiInClose
midiInGetDevCapsA
midiInGetDevCapsW
midiInGetErrorTextA
midiInGetErrorTextW
midiInGetID
midiInGetNumDevs
midiInMessage
midiInOpen
midiInPrepareHeader
midiInReset
midiInStart
midiInStop
midiInUnprepareHeader
midiOutCacheDrumPatches
midiOutCachePatches
midiOutClose
midiOutGetDevCapsA
midiOutGetDevCapsW
midiOutGetErrorTextA
midiOutGetErrorTextW
midiOutGetID
midiOutGetNumDevs
midiOutGetVolume
midiOutLongMsg
midiOutMessage
midiOutOpen
midiOutPrepareHeader
midiOutReset
midiOutSetVolume
midiOutShortMsg
midiOutUnprepareHeader
midiStreamClose
midiStreamOpen
midiStreamOut
midiStreamPause
midiStreamPosition
midiStreamProperty
midiStreamRestart
midiStreamStop
mixerClose
mixerGetControlDetailsA
mixerGetControlDetailsW
mixerGetDevCapsA
mixerGetDevCapsW
mixerGetID
mixerGetLineControlsA
mixerGetLineControlsW
mixerGetLineInfoA
mixerGetLineInfoW
mixerGetNumDevs
mixerMessage
mixerOpen
mixerSetControlDetails
mmDrvInstall
mmGetCurrentTask
mmTaskBlock
mmTaskCreate
mmTaskSignal
mmTaskYield
mmioAdvance
mmioAscend
mmioClose
mmioCreateChunk
mmioDescend
mmioFlush
mmioGetInfo
mmioInstallIOProcA
mmioInstallIOProcW
mmioOpenA
mmioOpenW
mmioRead
mmioRenameA
mmioRenameW
mmioSeek
mmioSendMessage
mmioSetBuffer
mmioSetInfo
mmioStringToFOURCCA
mmioStringToFOURCCW
mmioWrite
sndOpenSound
waveInAddBuffer
waveInClose
waveInGetDevCapsA
waveInGetDevCapsW
waveInGetErrorTextA
waveInGetErrorTextW
waveInGetID
waveInGetNumDevs
waveInGetPosition
waveInMessage
waveInOpen
waveInPrepareHeader
waveInReset
waveInStart
waveInStop
waveInUnprepareHeader
waveOutBreakLoop
waveOutClose
waveOutGetDevCapsA
waveOutGetDevCapsW
waveOutGetErrorTextA
waveOutGetErrorTextW
waveOutGetID
waveOutGetNumDevs
waveOutGetPitch
waveOutGetPlaybackRate
waveOutGetPosition
waveOutGetVolume
waveOutMessage
waveOutOpen
waveOutPause
waveOutPrepareHeader
waveOutReset
waveOutRestart
waveOutSetPitch
waveOutSetPlaybackRate
waveOutSetVolume
waveOutUnprepareHeader
waveOutWrite
winmmbaseFreeMMEHandles
winmmbaseGetWOWHandle
winmmbaseHandle32FromHandle16
winmmbaseSetWOWHandle
Name
.text
Size
136KB
Virtual Size
133KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
384B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=79, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1255, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33145,
count=5, id=259, version=33145,
count=20, id=261, version=33145,
count=23, id=264, version=33145,
count=1, id=256, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
winmsipc.dll
- IMPHASH ae27665ad841f5f8e38adf569e34f4f3
- SHA256 cbbd18a06bb22ffea08acb3f6458352ecd1129fe352ff5b370c08d4ed9a14768
- MD5 da3f81ee985dcb183b71e6f5f422b061
- SHA1 76535c1abcfe21df35d0373b48a2af09d31d7682
- SHA512 185d64159737a91ddeedff35020e846de5c7c07556e5732eda68e7760b546e4f0c762c8aef293b097fac8d084ac83cd8a72a5e6db5b15113677dfa14439daaa9
- SSDEEP 49152:nq8CTPinnfN0eOBgEOSVGx1VBCHx4LiOt:TcAV1zLi
- TLSH T135A5494AB7EC0094E1F2D6B9DA779016EA7278204B3193EF1554896E4E37FC4CA36F12
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
17424
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
winmsipc.pdb
msvcrt
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
___lc_handle_func
_wsetlocale
__crtLCMapStringA
__crtLCMapStringW
__crtCompareStringW
??8type_info@@QEBAHAEBV0@@Z
_wcsdup
memmove
memcpy
__CxxFrameHandler3
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1bad_cast@@UEAA@XZ
??0bad_cast@@QEAA@PEBD@Z
??0bad_cast@@QEAA@AEBV0@@Z
towlower
wcstol
iswspace
strcspn
localeconv
swprintf_s
_errno
wcscpy_s
strrchr
wcschr
wcsstr
fwscanf_s
calloc
_wfopen_s
fclose
fseek
_strlwr_s
strncmp
_wcslwr_s
_ultoa_s
strstr
_wcsnicmp
wcsrchr
_time64
_ultow_s
_wtoi
_itow_s
realloc
wcstoul
wcstok_s
toupper
setlocale
__uncaught_exception
__pctype_func
isupper
___lc_codepage_func
___mb_cur_max_func
_ismbblead
islower
abort
memset
___lc_collate_cp_func
memcmp
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_callnewh
wcsncmp
wcsncpy_s
strnlen
wcsnlen
sprintf_s
strchr
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
??3@YAXPEAX@Z
_vsnprintf
_wcsicmp
isalpha
?name@type_info@@QEBAPEBDXZ
iswalnum
_mbsinc
_ismbcspace
_mbsrev
_mbscspn
_mbsstr
memmove_s
memcpy_s
_vsnwprintf
__RTDynamicCast
??_V@YAXPEAX@Z
__CxxFrameHandler4
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
malloc
free
_vscwprintf
_amsg_exit
_XcptFilter
_purecall
_vsnwprintf_s
wcscmp
api-ms-win-core-libraryloader-l1-2-0
SizeofResource
LockResource
FindResourceExW
GetModuleFileNameA
LoadResource
GetModuleHandleExW
GetModuleHandleW
FreeLibrary
LoadLibraryExW
GetModuleFileNameW
GetProcAddress
LoadLibraryExA
api-ms-win-core-synch-l1-2-0
SleepConditionVariableSRW
WakeAllConditionVariable
InitOnceBeginInitialize
Sleep
InitOnceComplete
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
OpenProcessToken
GetCurrentProcessId
OpenThreadToken
TlsSetValue
GetCurrentThread
TlsAlloc
GetCurrentProcess
TlsGetValue
TerminateProcess
api-ms-win-core-sysinfo-l1-1-0
GetVersionExW
GetComputerNameExW
GetSystemTime
GetTickCount
GetSystemInfo
GetSystemTimeAsFileTime
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-errorhandling-l1-1-0
RaiseException
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventRegister
EventUnregister
EventActivityIdControl
EventWrite
EventWriteTransfer
EventEnabled
api-ms-win-core-synch-l1-1-0
CreateMutexExW
InitializeCriticalSection
ResetEvent
InitializeCriticalSectionEx
SetEvent
CreateSemaphoreExW
ReleaseSemaphore
WaitForSingleObject
CreateEventW
ReleaseMutex
ReleaseSRWLockExclusive
DeleteCriticalSection
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexW
EnterCriticalSection
CreateEventExW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
api-ms-win-core-heap-l1-1-0
HeapReAlloc
HeapSize
HeapDestroy
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
OutputDebugStringA
DebugBreak
api-ms-win-core-com-l1-1-0
CoCreateGuid
CLSIDFromString
CoInitializeEx
StringFromGUID2
CoUninitialize
CoCreateInstance
api-ms-win-core-localization-l1-2-0
GetThreadLocale
FormatMessageW
LocaleNameToLCID
GetUserPreferredUILanguages
GetSystemPreferredUILanguages
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
GetStringTypeW
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
api-ms-win-core-version-l1-1-0
GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeExW
bcrypt
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptDestroyHash
BCryptCreateHash
BCryptHashData
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
GlobalFree
api-ms-win-core-sysinfo-l1-2-0
GetNativeSystemInfo
api-ms-win-core-file-l1-1-0
SetEndOfFile
GetFileAttributesExW
GetFileSize
DeleteFileW
CreateDirectoryW
SetFileAttributesW
ReadFile
FindFirstFileW
FindNextFileW
WriteFile
SetFilePointer
FindClose
CreateFileW
GetFileAttributesW
CompareFileTime
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegEnumValueW
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
api-ms-win-core-registry-l2-1-0
RegDeleteKeyW
RegEnumKeyW
api-ms-win-core-memory-l1-1-0
VirtualQuery
VirtualProtect
netutils
NetApiBufferFree
api-ms-win-rtcore-ntuser-window-l1-1-0
GetDesktopWindow
api-ms-win-security-cryptoapi-l1-1-0
CryptGenRandom
CryptVerifySignatureW
CryptImportKey
CryptSetKeyParam
CryptGetHashParam
CryptDecrypt
CryptEncrypt
CryptAcquireContextW
CryptCreateHash
CryptDestroyKey
CryptHashData
CryptSetHashParam
CryptReleaseContext
CryptDestroyHash
api-ms-win-core-localization-l1-2-2
LCIDToLocaleName
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
SystemTimeToFileTime
GetDynamicTimeZoneInformation
api-ms-win-core-url-l1-1-0
PathIsURLW
UrlGetPartW
ext-ms-win-shell32-shellfolders-l1-1-0
SHGetFolderPathW
wldap32
ord73
ord13
ord16
ord140
ord41
ord145
ord26
ord208
ord224
logoncli
DsGetDcNameW
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
dnsapi
DnsFree
DnsQuery_W
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
644KB
Virtual Size
642KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
64KB
Virtual Size
297KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
56KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
416B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=100, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=408, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=26, id=261, version=33145,
count=68, id=260, version=33145,
count=1, id=256, version=33145,
count=185, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
winnlsres.dll
- SHA256 a38760ed22446d0858cde2317d3bd1574719eebb7d9ee50d33d878fc768eabf3
- MD5 9467e7d0f605c617e23d34be5c716745
- SHA1 dc3a8113768861b6101f77c22f5508ce7345222a
- SHA512 61869aff435cb7c0a48f3ecfb0912cac7a382966af9eb78b45591c9e934cfdfa558304db0dd7cd67f90e1bcb5744b97a5bea8d65305ec80cc2a1101c77c95336
- SSDEEP 384:FWxGWeBNA42BmSIWtE1Y0Ki1R85m6hOYfak7QPFmi7gUwc4a3+fUDxu7:oz42MUDiw5mreQNVgxc4aOfUDk7
- TLSH T122D22983DD88EF32EC4A9275E6A2780B7B70E8149675C31B491C933E6E73301EDA7558
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
4KB
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=33145,
count=1, id=258, version=33145,
winnsi.dll
- IMPHASH cb882faf8e1dbdde2731828091829e73
- SHA256 e772e2fdee88b93ef93bdc8684b59cb13108b5eff983574679d21920e5b896da
- MD5 453ddea08dabddc17b6ce4891145fa99
- SHA1 9d6a6ec71f7eeac30f6306bea5b835e7bc325324
- SHA512 2cfd9c1149cc46701833b842792def8df32dc5536bb09500f21197bdb8e3a03abf8584fc0211c748fcc6d84543cdb984647e7797ff9d61414d8207d619576527
- SSDEEP 768:0DmC9KAtoR2MHr2FH5dHijMYNasW4v1PS/9z4:09KAtoRjHrSBijLN/WKPMz4
- TLSH T1AB635A8DE36420C4E96AD074466B8FA6AE75F579031296EF42E0C67C0E63BC1BA34F45
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
33:24:6d:6c:7e:8f:1c:f0:fe:d1:4b:81:d5:21:b0:e5:39:b5:88:da:24:b1:dd:63:a2:25:2d:c4:44:b8:46:bd
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 11, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9600-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:26:35:b4:3e:67:43:93:f6:1f:00:01:00:00:02:26
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
11360
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
winnsi.pdb
api-ms-win-core-crt-l1-1-0
__C_specific_handler
memset
api-ms-win-core-crt-l2-1-0
_initterm
_initterm_e
ntdll
RtlLookupFunctionEntry
RtlCaptureContext
RtlUnsubscribeWnfNotificationWaitForCompletion
NtQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlVirtualUnwind
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
SetLastError
SetUnhandledExceptionFilter
api-ms-win-core-synch-l1-1-0
CreateEventW
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-threadpool-legacy-l1-1-0
UnregisterWaitEx
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-threadpool-private-l1-1-0
RegisterWaitForSingleObjectEx
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
NsiConnectToServer
NsiDisconnectFromServer
NsiRpcDeregisterChangeNotification
NsiRpcDeregisterChangeNotificationEx
NsiRpcEnumerateObjectsAllParameters
NsiRpcGetAllParameters
NsiRpcGetAllParametersEx
NsiRpcGetParameter
NsiRpcGetParameterEx
NsiRpcRegisterChangeNotification
NsiRpcRegisterChangeNotificationEx
NsiRpcSetAllParameters
NsiRpcSetAllParametersEx
NsiRpcSetParameter
NsiRpcSetParameterEx
Name
.text
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
376B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=1, productName=Unmarked objects (old),
count=4, id=259, version=33145,
count=14, id=260, version=33145,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=61, id=1, productName=Unmarked objects,
count=1, id=256, version=33145,
count=6, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
winrnr.dll
- IMPHASH fed3854fecf7e1bea08ad5e4453b1eb7
- SHA256 99af9dec93013a5050de3ea24cb6407e7645fa62187edd52c9ce4050ce02a4a8
- MD5 cde6f5a474039bf9abced978ddf751ce
- SHA1 28043ff6501ee7c06f29ae14dca01db6a8c235cf
- SHA512 7781ab79b6979ef1858f8da5e8a02dea51207ac168af2195bc16934e946fef947ec3d0295e63084ade833c0930333dc66d1b010045893884affde63a2a82fcf6
- SSDEEP 768:amHb1VpEGYekHu/mkvqQC95CLzuSvUVqPk5mAxNQxb0i7t95v1Pp9zMsw:amHbDpEGTtukvQCL1vQYWQxbVTPLzO
- TLSH T1E1833C2993A820D5E47BC17886678607FE30B0392311A2FF47A0D57D5FA7FE4A538B51
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c5:ef:2b:a6:f7:e5:0d:d5:01:4b:13:75:dd:53:14:33:b9:4c:cf:a6:92:8c:21:f7:3f:57:45:29:7e:8c:2e:c2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 19, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:651A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:15:18:03:d3:81:07:26:7c:53:00:01:00:00:02:15
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
8976
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
winrnr.pdb
msvcrt
__C_specific_handler
memcpy
wcschr
_initterm
malloc
free
_amsg_exit
_XcptFilter
memset
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
TlsGetValue
TlsFree
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
TlsAlloc
TlsSetValue
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
DisableThreadLibraryCalls
GetModuleHandleW
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventUnregister
EventWriteEx
EventSetInformation
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
InstallNTDSProvider
NSPStartup
RemoveNTDSProvider
Name
.text
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
_wpp_sf
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
232B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=24, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33145,
count=4, id=259, version=33145,
count=82, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=1, id=256, version=33145,
count=5, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
winrscmd.dll
- IMPHASH beeb186e4d093cfc101666192380481a
- SHA256 fedd77289654bda7039f3af0a979330916e891fddfc44cf6d0af2b333396ff8d
- MD5 e52f8dd0cf604a60e237154a1a0a6a8b
- SHA1 9194be543afc25bc663dbef75068206ed562cfa1
- SHA512 114cff506c659fa7a3114cf607150a7e3ea64c2b5722f9b09d1a1a50a0ac894d9052f71e3a30eed9a561ee07cdc9e3e9d6173b4e946fd945f26559a779f1bdb3
- SSDEEP 1536:8/w2AXZyst1vDTfBTDmammPYmDD0+Zk7w/eS6wgn7n0N+PSbBhOBanvMMY4Tu4:84TyytzD0ev6z0N+6bBhYanvMM7Tu4
- TLSH T1D8E3E73EF2A52076E5A5923885920B169F32703D2B2257EF11F0D139AF07BE49E78F54
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7408
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
winrscmd.pdb
msvcrt
malloc
??0exception@@QEAA@AEBQEBDH@Z
memmove
memcpy
_initterm
__C_specific_handler
?terminate@@YAXXZ
__CxxFrameHandler3
??1type_info@@UEAA@XZ
??0exception@@QEAA@AEBQEBD@Z
free
_purecall
_amsg_exit
_XcptFilter
_unlock
__dllonexit
_onexit
_CxxThrowException
memset
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
__CxxFrameHandler4
_lock
_wcsicmp
_wcsnicmp
wcscmp
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableLevel
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableFlags
TraceMessage
UnregisterTraceGuids
api-ms-win-core-libraryloader-l1-1-0
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
EnterCriticalSection
SetEvent
InitializeCriticalSection
DeleteCriticalSection
WaitForMultipleObjectsEx
CreateEventW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
OpenProcessToken
GetCurrentThread
OpenThreadToken
GetExitCodeProcess
CreateThread
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
ResumeThread
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetVersionExW
GetTickCount
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
wsmsvc
WSManPluginReceiveResult
??0CWSManCriticalSection@@QEAA@XZ
??1?$AutoRelease@VCWinRSPluginConfigCache@@@@QEAA@XZ
??1?$AutoRelease@VCWinRSPluginConfigSettings@@@@QEAA@XZ
??0?$AutoRelease@VCWinRSPluginConfigSettings@@@@QEAA@PEAVCWinRSPluginConfigSettings@@@Z
??4?$AutoRelease@VCWinRSPluginConfigCache@@@@QEAAAEAV0@PEAVCWinRSPluginConfigCache@@@Z
??0?$AutoRelease@VCWinRSPluginConfigCache@@@@QEAA@XZ
?CreateActivityId@EventHandler@WSMan@@SAXAEAU_GUID@@@Z
?GetConfigCache@CWinRSPluginConfigCache@@SAPEAV1@PEAVIRequestContext@@W4ErrorLogging@@H@Z
StringCchEqualsCI
WrapperCoSetProxyBlanket
?GetErrorCode@CErrorContext@@UEBAKXZ
?GetCurrentSettings@CWinRSPluginConfigCache@@QEAAPEAVCWinRSPluginConfigSettings@@PEAVIRequestContext@@@Z
??1CErrorContext@@UEAA@XZ
??0CErrorContext@@QEAA@_N@Z
??1?$AutoDeleteVector@U_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@QEAA@XZ
??4?$AutoDeleteVector@U_WINRS_RUN_COMMAND_ARG@@@@QEAAAEAV0@PEAU_WINRS_RUN_COMMAND_ARG@@@Z
??4?$AutoDeleteVector@U_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@QEAAAEAV0@PEAU_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@Z
??0?$AutoDeleteVector@U_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@QEAA@XZ
??4?$AutoDeleteVector@G@@QEAAAEAV0@PEAG@Z
??0?$AutoDeleteVector@G@@QEAA@PEAG@Z
?StringToDword@@YAHPEBGPEAK@Z
??1AutoHandle@@QEAA@XZ
?IsValid@CWSManCriticalSection@@QEBAHXZ
?GenerateTransferId@EventHandler@WSMan@@SAXAEBU_EVENT_DESCRIPTOR@@PEBU_GUID@@1@Z
?IsEventEnabled@EventHandler@WSMan@@SA_NAEBU_EVENT_DESCRIPTOR@@@Z
?Release@CWSManCriticalSection@@QEAAXXZ
?Acquire@CWSManCriticalSection@@QEAAXXZ
??4AutoHandle@@QEAAAEAV0@PEAX@Z
?EnsureActivityIdOnThread@EventHandler@WSMan@@SAXXZ
?IsEventProviderEnabled@EventHandler@WSMan@@SA_NXZ
??0AutoHandle@@QEAA@XZ
??0AutoHandle@@QEAA@PEAX@Z
??1?$AutoDeleteVector@G@@QEAA@XZ
??1?$AutoDeleteVector@U_WINRS_RUN_COMMAND_ARG@@@@QEAA@XZ
??0?$AutoDeleteVector@U_WINRS_RUN_COMMAND_ARG@@@@QEAA@XZ
??0?$AutoDeleteVector@G@@QEAA@XZ
?RecordFailure@CRequestContext@@UEAAXKKZZ
?Free@WSManMemory@@SAXPEAXH@Z
?Alloc@WSManMemory@@SAPEAX_KHW4_NitsFaultMode@@@Z
??1CWSManCriticalSection@@QEAA@XZ
WSManError
?ProviderShutdownCleanup@CWinRSPluginConfigCache@@SAXXZ
?ShutdownLocaleMap@Locale@@SAXXZ
?Shutdown@CWSManGroupPolicyManager@@SAHXZ
?Shutdown@CConfigManager@@SAHXZ
WSManPluginOperationComplete
WSManPluginGetOperationParameters
??0CRequestContext@@QEAA@XZ
??1CRequestContext@@UEAA@XZ
?ProcessContext@CRequestContext@@UEAAHHPEAU_WSMAN_ERROR@@@Z
WSManPluginReportContext
WSManPluginFreeRequestDetails
??0CRequestContext@@QEAA@PEBG@Z
api-ms-win-core-heap-obsolete-l1-1-0
LocalFree
api-ms-win-core-heap-l1-1-0
HeapCreate
HeapFree
HeapAlloc
HeapDestroy
GetProcessHeap
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-file-l1-1-0
ReadFile
WriteFile
api-ms-win-security-base-l1-1-0
GetTokenInformation
GetLengthSid
CopySid
rpcrt4
UuidToStringW
RpcStringFreeW
UuidCreate
api-ms-win-core-threadpool-legacy-l1-1-0
UnregisterWaitEx
QueueUserWorkItem
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-kernel32-legacy-l1-1-0
RegisterWaitForSingleObject
api-ms-win-core-namedpipe-l1-1-0
CreatePipe
api-ms-win-core-io-l1-1-0
CancelIoEx
ntdll
RtlInitUnicodeString
api-ms-win-core-job-l2-1-0
CreateJobObjectW
AssignProcessToJobObject
TerminateJobObject
SetInformationJobObject
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
??0?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@XZ
??0?$SafeMap_Iterator@VKey@Locale@@K@@QEAA@AEAV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@_N@Z
??0?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@AEBV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@_N@Z
??1?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@XZ
??1?$SafeMap_Iterator@VKey@Locale@@K@@QEAA@XZ
??1?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@XZ
??1CWSManCriticalSectionWithConditionVar@@QEAA@XZ
??_7?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@6B@
?Acquire@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEBAXXZ
?Acquire@?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAAXXZ
?Acquired@?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA_NXZ
?AsReference@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAAAEAV1@XZ
?Data@?$SafeMap_Iterator@VKey@Locale@@K@@IEBAAEAV?$STLMap@VKey@Locale@@K@@XZ
?DeInitialize@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEAA_NAEAVIRequestContext@@@Z
?GetInitError@CWSManCriticalSection@@QEBAKXZ
?GetMap@?$SafeMap_Iterator@VKey@Locale@@K@@QEBAAEAV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@XZ
?GetMap@?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEBAAEBV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@XZ
?Initialize@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEAA_NAEAVIRequestContext@@@Z
?IsValid@?$SafeMap_Iterator@VKey@Locale@@K@@QEBA_NXZ
?Release@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEBAXXZ
?Reset@?$SafeMap_Iterator@VKey@Locale@@K@@QEAAXXZ
?SkipOrphans@?$SafeMap_Iterator@VKey@Locale@@K@@IEAAXXZ
WSManPluginCommand
WSManPluginReceive
WSManPluginReleaseCommandContext
WSManPluginReleaseShellContext
WSManPluginSend
WSManPluginShell
WSManPluginShutdown
WSManPluginSignal
WSManPluginStartup
Name
.text
Size
84KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
80B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
992B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
608B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=50, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=14, id=260, version=33145,
count=4, id=259, version=33145,
count=175, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=5, id=261, version=33145,
count=1, id=256, version=33145,
count=14, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
winrsmgr.dll
- SHA256 acd198eefe1c97a0badb6145d985f418dfe68d7ca945786c541344a47afb1b9e
- MD5 eb4697ece77bb27dac8a235d277e41cc
- SHA1 83486361caa4bf77a2e0fced7accd0cf4195833b
- SHA512 6f642d52cebbe4c9ca8af509a1d8978fba52680bd92e04617fbcf1bd87b1a7caf3fc6aec6b9ca6987652179f1f68f712948780945e23b11a3de47974c04cf337
- SSDEEP 24:eH1GSZdVoRkM4q1wIZW0HGfcNkhbpa135WWdPfPNw:ypE4ZIZWUGikh9at5Ww1
- TLSH T1D442DB4A53F80979F0FB0B75ACE35A276039BC249A36936D0A90012E2C35820ED71F32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
4KB
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=33145,
count=1, id=258, version=33145,
winrssrv.dll
- IMPHASH d1eb4eacb120a226a6aa4947f78e7d99
- SHA256 2e91f39fa0a29df06aa8ec8c133d024f30ecccdd65203d277d31a0caf0d3d46c
- MD5 159f836347a75fea65a4e9a4bafcfbbd
- SHA1 7689f31c49ca0896ee11643f9ee5095748fbcf3f
- SHA512 c51b0f9fe6c703a29839fb8134f286e9c3a33b890d4e2c48ef64120415d6b6757b6ceda7d93a902b338c77e5a18b82b6b009290b7032a80e0d654b4570ee5a70
- SSDEEP 192:MVVvDSrfD7qT84Ecl7XIT+1VGlpGYAP7pvAPWDUIaUWW:MnE7qpljdEGDh8WPvWW
- TLSH T1B8F2C646B3245DB9F071827A84AB1E42A2B6F90407D257DF5270960E1D7F3D19B38FD2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4752
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
winrssrv.pdb
msvcrt
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
rpcrt4
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrOleAllocate
NdrDllRegisterProxy
NdrDllUnregisterProxy
NdrOleFree
api-ms-win-core-libraryloader-l1-1-0
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
308B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33145,
count=4, id=259, version=33145,
count=31, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=1, id=256, version=33145,
count=4, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
winshfhc.dll
- IMPHASH 3a5740112aec8cefebdcdee04fcb7b6a
- SHA256 beb29c31ac485e30ff24a6aa80606ead8a7216ca0fcfadce5108d85fc8ee1772
- MD5 377e3b378932f5b7b633bad0e73eec40
- SHA1 bf2e6ccaff230aaa415ae2a7e52a66c469ee29ab
- SHA512 f36675afc5127dfdd8a28ed5f922daa299d2622aa2bdf893cb3ba6fa510af9b1005ca55130b5ddfcbd86543626a700bd4bc43f7a2c9feb8920d9c221782b4323
- SSDEEP 384:ETkFPEBGL6raD7HqEQQoyMC+WVnDUeY6rUnD4Fk6jFWkzHWU8G:Wpa/KE3odC+4UH6rkD4CAnzN
- TLSH T13B13F62E63F91479FAB3823C85A60027D936B830631255FF41B092BE5D72BD0ED39E56
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4752
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
winshfhc.pdb
msvcrt
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
malloc
__C_specific_handler
free
towupper
_amsg_exit
_XcptFilter
__CxxFrameHandler4
??3@YAXPEAX@Z
_initterm
_CxxThrowException
api-ms-win-core-com-l1-1-0
CoCreateInstance
api-ms-win-core-registry-l1-1-0
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegDeleteTreeW
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
OpenProcessToken
oleaut32
SysAllocString
SysFreeString
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-registry-l2-1-0
RegDeleteKeyW
api-ms-win-security-base-l1-1-0
AdjustTokenPrivileges
api-ms-win-security-lsalookup-l2-1-0
LookupPrivilegeValueW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
wdscore
WdsSetupLogMessageW
ConstructPartialMsgVW
CurrentIP
MRTComponent_Generalize
Name
.text
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
444B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=26, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=261, version=33145,
count=1, productName=Unmarked objects (old),
count=4, id=259, version=33145,
count=15, id=260, version=33145,
count=50, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=1, id=256, version=33145,
count=5, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
winsku.dll
- IMPHASH 59a9b235bed4e946579fa27a751623ff
- SHA256 a3db7792a433fa543c55e93059792cc8cce63a4992e19853eab1c9d83a2cd0b3
- MD5 4e9abf495cc8779e650aee1375f9e7c7
- SHA1 dbaf1b73e2024ca74fa95cbbb581f1796791dab7
- SHA512 5e200671572316ca54f7d61e12a1c3f7b2a218232d06fd8fac9d2db819b6b201a4e907a00c7f1730b58e387f052f189204cfeea53151e4c4bb13dff7baeef1fe
- SSDEEP 6144:MVNK8H1JvHwowRLNZfKBUq9rDAZr7j/Ybjetl/KSnUyDFbFgN7xIoTR:MVNKowVfKS06Ye3ZKxI6
- TLSH T1BD845A3EE7A055E5E56EC13882B74D12EAB1302413526ACB02A481BD6F77FE4AF3D750
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5776
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
winsku.pdb
msvcrt
wcsncmp
memmove
_onexit
_wcsnicmp
__CxxFrameHandler4
memcpy_s
__dllonexit
memmove_s
memcmp
_unlock
_purecall
_lock
_wcsicmp
_CxxThrowException
?terminate@@YAXXZ
__C_specific_handler
_initterm
bsearch
malloc
_amsg_exit
_XcptFilter
??1exception@@UEAA@XZ
memcpy
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??1type_info@@UEAA@XZ
wcschr
_vsnwprintf
_snprintf_s
strncmp
free
iswspace
wcstoul
memset
ntdll
RtlHashUnicodeString
DbgPrintEx
RtlDowncaseUnicodeChar
RtlReAllocateHeap
NtWriteFile
RtlInitUnicodeString
NtReadFile
NtClose
RtlExpandEnvironmentStrings
NtCreateFile
NtWaitForSingleObject
NtOpenFile
NtYieldExecution
RtlDeleteCriticalSection
RtlTimeToTimeFields
RtlEnterCriticalSection
RtlInitializeCriticalSection
RtlLeaveCriticalSection
LdrGetProcedureAddress
NtOpenKey
LdrUnloadDll
RtlDosPathNameToNtPathName_U
LdrGetDllHandleEx
RtlQueryEnvironmentVariable_U
DbgPrint
NtQueryValueKey
RtlCreateUnicodeStringFromAsciiz
NtQueryPerformanceCounter
RtlNtStatusToDosErrorNoTeb
NtQueryInformationFile
RtlDosPathNameToNtPathName_U_WithStatus
RtlNtStatusToDosError
NtSetInformationFile
RtlFreeHeap
RtlAllocateHeap
RtlRaiseStatus
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExA
LoadLibraryExW
FreeLibrary
GetModuleFileNameA
GetModuleHandleW
DisableThreadLibraryCalls
GetModuleHandleExW
GetProcAddress
api-ms-win-core-synch-l1-2-0
WakeAllConditionVariable
Sleep
SleepConditionVariableSRW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemWindowsDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
api-ms-win-core-errorhandling-l1-1-0
SetLastError
RaiseException
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetLocaleInfoW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionEx
ReleaseSemaphore
EnterCriticalSection
DeleteCriticalSection
WaitForSingleObjectEx
AcquireSRWLockExclusive
WaitForSingleObject
OpenSemaphoreW
ReleaseSRWLockExclusive
CreateMutexExW
AcquireSRWLockShared
CreateSemaphoreExW
LeaveCriticalSection
ReleaseMutex
ReleaseSRWLockShared
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-string-l1-1-0
CompareStringW
WideCharToMultiByte
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-file-l1-1-0
GetFileAttributesW
GetFullPathNameW
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoTaskMemAlloc
api-ms-win-core-memory-l1-1-0
VirtualProtect
VirtualQuery
api-ms-win-core-localization-obsolete-l1-2-0
GetUserDefaultUILanguage
SkuFreeBuffer
SkuGetEditionEulaFilePath
Name
.text
Size
276KB
Virtual Size
273KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
84KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=68, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=16, id=260, version=33145,
count=322, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=6, id=261, version=33145,
count=1, id=256, version=33145,
count=99, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
winsqlite3.dll
- IMPHASH fbaa7ef9586c718c093ef505e13a2c32
- SHA256 21052016067029f33a10f441e9f7d612368a8efcd548bf2e82092e3aa3c49b3c
- MD5 101afbea7695f23b7209719cec2fcb9b
- SHA1 4a62f68e1807ff5199a961474f62b4080ac300d5
- SHA512 e174e0a0e0b2e1392c0969962d7330c2bd3173d36829db0a7cf671621cdd7fa661bd860aa6506daffcab32e0bd5c98a277567f105a011f382ad3750e4e39a712
- SSDEEP 24576:ubRxMs9ybgh4rpcahskqx6yUGRUb39clkoIcrNV5ACN1yT:Axv9xUSaUUGRUb3q15jnbo
- TLSH T124358E96A3AC1099E8BB9178C646860BD7F1B416137087CB56F04BDA6F17FE2163F321
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
53:33:c7:73:b4:a5:ff:4a:05:8d:5d:da:71:48:09:c1:bf:b7:ae:95:93:39:9b:cc:85:dd:53:44:0a:64:a4:0c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows 3rd party Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 8, 2026
CN=Microsoft Windows 3rd party Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows 3rd party Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:40:67:f6:98:6b:31:08:b8:72:00:00:00:00:01:40
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 13, 2025 - Nov 10, 2026
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6B05-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:11:45:18:39:9b:43:cf:fc:6c:00:01:00:00:02:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
539888
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
winsqlite3.pdb
api-ms-win-crt-string-l1-1-0
strcmp
memset
strspn
strncmp
strcspn
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__configure_narrow_argv
_o__endthreadex
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__msize
_o__seh_filter_dll
memmove
_o_free
_o_log
_o_malloc
_o_qsort
_o_realloc
_o__cexit
_o__beginthreadex
_o___std_type_info_destroy_list
strrchr
strchr
__C_specific_handler
memchr
memcmp
memcpy
api-ms-win-core-file-l1-2-2
GetTempPathA
AreFileApisANSI
api-ms-win-core-file-l1-1-0
GetDiskFreeSpaceW
GetFullPathNameW
LockFile
SetFilePointer
CreateFileA
DeleteFileA
LockFileEx
GetFullPathNameA
GetFileAttributesExW
GetFileAttributesA
SetEndOfFile
ReadFile
UnlockFileEx
WriteFile
CreateFileW
GetFileAttributesW
FlushFileBuffers
DeleteFileW
UnlockFile
GetDiskFreeSpaceA
GetFileSize
api-ms-win-core-synch-l1-1-0
InitializeCriticalSection
LeaveCriticalSection
WaitForSingleObjectEx
CreateMutexW
TryEnterCriticalSection
WaitForSingleObject
EnterCriticalSection
DeleteCriticalSection
api-ms-win-core-heap-l1-1-0
HeapSize
HeapReAlloc
HeapFree
HeapValidate
GetProcessHeap
HeapAlloc
HeapCompact
HeapCreate
HeapDestroy
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-file-l1-2-0
GetTempPathW
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
TerminateProcess
api-ms-win-core-memory-l1-1-0
FlushViewOfFile
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-localization-l1-2-0
FormatMessageW
FormatMessageA
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
RaiseException
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryA
LoadLibraryW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
GetSystemInfo
GetSystemTime
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
FreeLibrary
GetModuleHandleW
GetProcAddress
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_autovacuum_pages
sqlite3_backup_finish
sqlite3_backup_init
sqlite3_backup_pagecount
sqlite3_backup_remaining
sqlite3_backup_step
sqlite3_bind_blob
sqlite3_bind_blob64
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_pointer
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_text64
sqlite3_bind_value
sqlite3_bind_zeroblob
sqlite3_bind_zeroblob64
sqlite3_blob_bytes
sqlite3_blob_close
sqlite3_blob_open
sqlite3_blob_read
sqlite3_blob_reopen
sqlite3_blob_write
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_cancel_auto_extension
sqlite3_changes
sqlite3_changes64
sqlite3_clear_bindings
sqlite3_close
sqlite3_close_v2
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_database_name
sqlite3_column_database_name16
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_double
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_origin_name
sqlite3_column_origin_name16
sqlite3_column_table_name
sqlite3_column_table_name16
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_compileoption_get
sqlite3_compileoption_used
sqlite3_complete
sqlite3_complete16
sqlite3_config
sqlite3_context_db_handle
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_collation_v2
sqlite3_create_filename
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_function_v2
sqlite3_create_module
sqlite3_create_module_v2
sqlite3_create_window_function
sqlite3_data_count
sqlite3_data_directory
sqlite3_database_file_object
sqlite3_db_cacheflush
sqlite3_db_config
sqlite3_db_filename
sqlite3_db_handle
sqlite3_db_mutex
sqlite3_db_name
sqlite3_db_readonly
sqlite3_db_release_memory
sqlite3_db_status
sqlite3_db_status64
sqlite3_declare_vtab
sqlite3_deserialize
sqlite3_drop_modules
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_error_offset
sqlite3_errstr
sqlite3_exec
sqlite3_expanded_sql
sqlite3_expired
sqlite3_extended_errcode
sqlite3_extended_result_codes
sqlite3_file_control
sqlite3_filename_database
sqlite3_filename_journal
sqlite3_filename_wal
sqlite3_finalize
sqlite3_free
sqlite3_free_filename
sqlite3_free_table
sqlite3_fts3_may_be_corrupt
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_clientdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_hard_heap_limit64
sqlite3_initialize
sqlite3_interrupt
sqlite3_is_interrupted
sqlite3_keyword_check
sqlite3_keyword_count
sqlite3_keyword_name
sqlite3_last_insert_rowid
sqlite3_libversion
sqlite3_libversion_number
sqlite3_limit
sqlite3_load_extension
sqlite3_log
sqlite3_malloc
sqlite3_malloc64
sqlite3_memory_alarm
sqlite3_memory_highwater
sqlite3_memory_used
sqlite3_mprintf
sqlite3_msize
sqlite3_mutex_alloc
sqlite3_mutex_enter
sqlite3_mutex_free
sqlite3_mutex_leave
sqlite3_mutex_try
sqlite3_next_stmt
sqlite3_open
sqlite3_open16
sqlite3_open_v2
sqlite3_os_end
sqlite3_os_init
sqlite3_overload_function
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_v2
sqlite3_prepare16_v3
sqlite3_prepare_v2
sqlite3_prepare_v3
sqlite3_profile
sqlite3_progress_handler
sqlite3_randomness
sqlite3_realloc
sqlite3_realloc64
sqlite3_release_memory
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_result_blob
sqlite3_result_blob64
sqlite3_result_double
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_error_code
sqlite3_result_error_nomem
sqlite3_result_error_toobig
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_null
sqlite3_result_pointer
sqlite3_result_subtype
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_text64
sqlite3_result_value
sqlite3_result_zeroblob
sqlite3_result_zeroblob64
sqlite3_rollback_hook
sqlite3_rtree_geometry_callback
sqlite3_rtree_query_callback
sqlite3_serialize
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_set_clientdata
sqlite3_set_errmsg
sqlite3_set_last_insert_rowid
sqlite3_setlk_timeout
sqlite3_shutdown
sqlite3_sleep
sqlite3_snprintf
sqlite3_soft_heap_limit
sqlite3_soft_heap_limit64
sqlite3_sourceid
sqlite3_sql
sqlite3_status
sqlite3_status64
sqlite3_step
sqlite3_stmt_busy
sqlite3_stmt_explain
sqlite3_stmt_isexplain
sqlite3_stmt_readonly
sqlite3_stmt_status
sqlite3_str_append
sqlite3_str_appendall
sqlite3_str_appendchar
sqlite3_str_appendf
sqlite3_str_errcode
sqlite3_str_finish
sqlite3_str_length
sqlite3_str_new
sqlite3_str_reset
sqlite3_str_value
sqlite3_str_vappendf
sqlite3_strglob
sqlite3_stricmp
sqlite3_strlike
sqlite3_strnicmp
sqlite3_system_errno
sqlite3_table_column_metadata
sqlite3_temp_directory
sqlite3_test_control
sqlite3_thread_cleanup
sqlite3_threadsafe
sqlite3_total_changes
sqlite3_total_changes64
sqlite3_trace
sqlite3_trace_v2
sqlite3_transfer_bindings
sqlite3_txn_state
sqlite3_unsupported_selecttrace
sqlite3_update_hook
sqlite3_uri_boolean
sqlite3_uri_int64
sqlite3_uri_key
sqlite3_uri_parameter
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_dup
sqlite3_value_encoding
sqlite3_value_free
sqlite3_value_frombind
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_nochange
sqlite3_value_numeric_type
sqlite3_value_pointer
sqlite3_value_subtype
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_type
sqlite3_version
sqlite3_vfs_find
sqlite3_vfs_register
sqlite3_vfs_unregister
sqlite3_vmprintf
sqlite3_vsnprintf
sqlite3_vtab_collation
sqlite3_vtab_config
sqlite3_vtab_distinct
sqlite3_vtab_in
sqlite3_vtab_in_first
sqlite3_vtab_in_next
sqlite3_vtab_nochange
sqlite3_vtab_on_conflict
sqlite3_vtab_rhs_value
sqlite3_wal_autocheckpoint
sqlite3_wal_checkpoint
sqlite3_wal_checkpoint_v2
sqlite3_wal_hook
sqlite3_win32_is_nt
sqlite3_win32_mbcs_to_utf8
sqlite3_win32_mbcs_to_utf8_v2
sqlite3_win32_set_directory
sqlite3_win32_set_directory16
sqlite3_win32_set_directory8
sqlite3_win32_sleep
sqlite3_win32_unicode_to_utf8
sqlite3_win32_utf8_to_mbcs
sqlite3_win32_utf8_to_mbcs_v2
sqlite3_win32_utf8_to_unicode
sqlite3_win32_write_debug
Name
.text
Size
884KB
Virtual Size
881KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
128KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
36KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=51, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1158, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=14, id=261, version=33145,
count=1, id=256, version=33145,
count=3, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
winsrv.dll
- IMPHASH 0d19b1428d247b1ecfbcab1de7b681ea
- SHA256 469d8bdf7c0a8522c1e9d894b5578a321e87a433104c417864c770b6e069aa74
- MD5 6a8e7bdec49749b3d160a32b80ab8caa
- SHA1 09d89e3b9db652c5518ef3bd10494db853cded1e
- SHA512 c8a8d7d5239f5c8d3f09f9b19106d0ad22a99022e807ba5c549f9a62691cff13511aface0259121fde5db422f0ca2a8e18dac96b46c445a1de4213623b81c6bf
- SSDEEP 384:cvDYrPiU9DtdR6HPJOL4Tn4gGvrUHwEvWq7LgKfk06WNcpu/pVowB7Oufano5wAW:ckrPiUdIvkEr4zUauYotCtGBw
- TLSH T14593508763948991E1660634C827CA7519A0BD369F01AEEB93E0FF2F3C713D4AB35318
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4384
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
winsrv.pdb
ntdll
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
NtOpenProcessToken
RtlCreateSecurityDescriptor
RtlCreateTagHeap
RtlFreeHeap
RtlCreateUserThread
NtClose
NtReadVirtualMemory
NtQueryInformationToken
NtSetInformationThread
NtOpenProcess
NtQueryInformationProcess
RtlSetDaclSecurityDescriptor
DbgPrintEx
RtlAllocateHeap
csrsrv
CsrDereferenceProcess
CsrLockedReferenceProcess
CsrLockProcessByClientId
CsrUnlockProcess
basesrv
BaseGetProcessCrtlRoutine
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
GetProcAddress
DisableThreadLibraryCalls
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-apiquery-l2-1-0
IsApiSetImplemented
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
SrvEndTask
UserCreateCallbackThread
UserHardError
UserServerDllInitialization
UserServerDllInitializationWin1
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
216B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
52KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=257, version=33145,
count=45, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=4, id=259, version=33145,
count=1, id=256, version=33145,
count=3, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
winsrvext.dll
- IMPHASH 9d32fbf9e012dbf1b4d4aee14e5c122f
- SHA256 9aca736bd71d95db7900027eb816daa3c8773115607524ff26df811d0df0c3e3
- MD5 25363c20ee8101f684b0f568b05fb93f
- SHA1 afae259f7219d4f172e37b73c1c494aec5b12740
- SHA512 64498a761cc37ea344ad258110fb131367880fb92f6353a07062355ad344f233dcc6b57bc14650af9db31eca9d8107e5c05bcbfcc50927963877ccbc1b6ec384
- SSDEEP 3072:2W2H8IhEw9komtV73P7wzHvC0YgnRd7LT5:9IhEw9kosVzP7wzqdW
- TLSH T15BD3191E36BA20A5D97A927895660304E7B3743027116BFF09D0C47C8F27BE9BD39E45
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
19360
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
winsrvext.pdb
kernelbase
lstrcmpiW
LocalAlloc
WTSGetServiceSessionId
LocalReAlloc
GetApplicationUserModelId
Sleep
__chkstk
ntdll
NtDeviceIoControlFile
NtDuplicateObject
NtOpenProcess
NtAlpcConnectPort
NtAlpcSendWaitReceivePort
NtSetValueKey
NtQuerySystemInformation
NtOpenEvent
RtlQueryPackageClaims
RtlCreateUnicodeString
NtOpenProcessToken
NtDuplicateToken
RtlFindMessage
wcsrchr
_strnicmp
LdrFlushAlternateResourceModules
RtlFreeAnsiString
RtlOpenCurrentUser
RtlAnsiStringToUnicodeString
strstr
RtlUnicodeStringToAnsiString
NtReadVirtualMemory
NtEnumerateValueKey
RtlDeriveCapabilitySidsFromName
qsort
NtQueryInformationToken
NtAlpcOpenSenderProcess
RtlEqualUnicodeString
NtQuerySymbolicLinkObject
RtlUnicodeStringToInteger
NtWaitForSingleObject
RtlExitUserThread
NtResetEvent
NtWaitForMultipleObjects
NtOpenSymbolicLinkObject
NtAlertThread
DbgUiIssueRemoteBreakin
NtSetInformationThread
RtlNtStatusToDosError
NtPowerInformation
NtEnumerateKey
EvtIntReportEventAndSourceAsync
RtlFreeSid
_wtoi
memmove
NtOpenThreadToken
RtlSetDaclSecurityDescriptor
NtDeleteValueKey
RtlCreateSecurityDescriptor
RtlCopySid
RtlAddAccessAllowedAce
RtlCreateAcl
RtlLengthSid
NtClearEvent
wcsncmp
RtlAllocateAndInitializeSid
RtlUnsubscribeWnfStateChangeNotification
NtOpenThread
NtTerminateProcess
RtlQueryPackageIdentity
RtlSubscribeWnfStateChangeNotification
NtQueryInformationProcess
NtNotifyChangeKey
NtSetSystemInformation
NtQueryValueKey
EtwEventWrite
EtwEventEnabled
RtlFreeUnicodeString
RtlAppendUnicodeToString
RtlCopyUnicodeString
RtlFormatCurrentUserKeyPath
RtlLeaveCriticalSection
NtResumeThread
RtlCreateUserThread
NtCreateKey
NtOpenKey
RtlInitUnicodeString
NtCreateEvent
RtlEnterCriticalSection
RtlInitializeCriticalSection
NtClose
RtlDeleteCriticalSection
EtwEventUnregister
EtwEventRegister
memcpy
RtlFreeHeap
RtlCaptureContext
RtlRegisterThreadWithCsrss
NtSetEvent
RtlLookupFunctionEntry
RtlVirtualUnwind
_vsnwprintf
RtlGetNtProductType
PssNtFreeSnapshot
ZwQueryWnfStateNameInformation
ZwUpdateWnfStateData
EtwEventWriteNoRegistration
PssNtCaptureSnapshot
memset
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetCurrentThread
GetCurrentProcessId
GetThreadId
GetExitCodeThread
GetExitCodeProcess
OpenProcessToken
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventWrite
EventUnregister
EventSetInformation
EventRegister
api-ms-win-eventing-classicprovider-l1-1-0
RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage
GetTraceEnableFlags
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-synch-l1-1-0
CreateEventW
OpenMutexW
api-ms-win-core-file-l1-1-0
ReadFile
GetLogicalDrives
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
LoadLibraryExW
FreeLibrary
GetModuleHandleExA
GetModuleHandleW
api-ms-win-security-base-l1-1-0
AllocateAndInitializeSid
DuplicateTokenEx
GetTokenInformation
CheckTokenMembership
FreeSid
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-processthreads-l1-1-2
IsProcessCritical
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-io-l1-1-0
GetOverlappedResult
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-windowserrorreporting-l1-1-0
GetApplicationRestartSettings
api-ms-win-core-kernel32-legacy-l1-1-0
GetComputerNameW
api-ms-win-core-timezone-private-l1-1-0
SetClientTimeZoneInformation
SetClientDynamicTimeZoneInformation
basesrv
BaseGetProcessCrtlRoutine
BaseSrvNlsLogon
BaseSrvNlsUpdateRegistryCache
BaseSetProcessCreateNotify
csrsrv
CsrDereferenceThread
CsrGetProcessLuid
CsrConnectToUser
CsrRevertToSelf
CsrImpersonateClient
CsrAddStaticServerThread
CsrExecServerThread
CsrShutdownProcesses
CsrLockThreadByClientId
CsrReplyToMessage
CsrValidateMessageBuffer
CsrLockedReferenceProcess
CsrDereferenceProcess
CsrUnlockProcess
CsrReferenceThread
CsrLockProcessByClientId
CsrUnlockThread
CsrQueryApiPort
win32u
NtUserRemoteShadowStart
NtUserRemoteShadowStop
NtUserRemoteShadowCleanup
NtUserRemotePassthruEnable
NtUserRemoteShadowSetup
NtUserRemoteStopScreenUpdates
NtUserRemoteRedrawRectangle
NtUserRemoteRedrawScreen
NtUserCtxDisplayIOCtl
NtUserRemotePassthruDisable
NtUserWakeRITForShutdown
NtUserRemoteNotify
NtUserRemoteConsoleShadowStop
NtUserRemoteDisconnect
NtUserRemoteReconnect
NtUserRemoteConnect
NtUserHardErrorControl
NtUserQueryWindow
NtUserQueryInformationThread
NtUserHandleSystemThreadCreationFailure
NtUserCreateSystemThreads
NtUserGetDeviceChangeInfo
NtUserUserPowerCalloutWorker
NtUserProcessConnect
gDispatchTableValues
NtUserSetInformationThread
NtUserInitialize
NtUserNotifyProcessCreate
NtUserRemoteThinwireStats
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
UserServerDllInitializationExt
Name
.text
Size
76KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
832B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
520B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=48, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=11, id=257, version=33145,
count=330, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33145,
count=4, id=259, version=33145,
count=1, id=256, version=33145,
count=21, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
winsta.dll
- IMPHASH 9d68fffd974435d18e1c132e203c7db5
- SHA256 e44c55a20f1a2c38713988401b92146118324010ab75acf1df6fc2012b10a9af
- MD5 36e047f31ac5ed4f2035963734424201
- SHA1 758ae21d43e8c105e32df037c00298e386a00a43
- SHA512 f772733a681726075afdc7284691aba424e8e64e5132d26cf71b7fd8cf21bf8c0fab46eac264f6b87733f8258b45dbb3911ee5c100dba11f39a6db3575c0cb1c
- SSDEEP 6144:cy2HvzP1Gdj1BQV5FYWuDbdgZ1qEcNyBV4aqpOK6annQH+fmrDQ:gL0dj1irFJsd/EGyyHCQ
- TLSH T1D684395DE79504A8C477817985774212EBB27828536282EB3284C17A9E77FC83F3DF86
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
45:dd:ad:0c:55:92:c6:55:1e:29:61:75:68:79:1f:ca:43:b5:f7:e6:6b:4e:6f:04:3a:07:28:45:d7:23:cd:79
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:23:4f:d9:60:24:53:cf:fe:2b:00:01:00:00:02:23
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
136304
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
winsta.pdb
msvcrt
free
__C_specific_handler
_XcptFilter
_vsnprintf
_wcsicmp
_strnicmp
memcpy_s
_vsnwprintf
??1type_info@@UEAA@XZ
memmove
memcpy
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
_amsg_exit
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_callnewh
rand
??3@YAXPEAX@Z
time
memset
_onexit
??_V@YAXPEAX@Z
__dllonexit
_unlock
_resetstkoflw
_purecall
_lock
__CxxFrameHandler3
_initterm
srand
malloc
wcscmp
ntdll
RtlFreeSid
RtlCaptureStackBackTrace
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlLeaveCriticalSection
RtlGetSuiteMask
RtlInitializeCriticalSection
RtlUnicodeToMultiByteSize
RtlEnterCriticalSection
RtlDeleteCriticalSection
EtwEventUnregister
NtTerminateProcess
RtlNtStatusToDosError
RtlCopySid
RtlAdjustPrivilege
NtClose
RtlLengthSid
NtQueryInformationToken
NtOpenProcess
NtQueryInformationProcess
RtlUnicodeToMultiByteN
NtQuerySystemInformation
NtQuerySystemTime
NtOpenProcessToken
RtlValidSid
RtlMultiByteToUnicodeN
RtlAllocateAndInitializeSid
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
FreeLibrary
GetModuleFileNameA
GetProcAddress
LoadLibraryExW
DisableThreadLibraryCalls
GetModuleHandleExW
GetModuleHandleExA
GetModuleFileNameW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-processthreads-l1-1-0
OpenProcessToken
GetExitCodeThread
ProcessIdToSessionId
GetCurrentProcess
GetCurrentProcessId
CreateThread
OpenThreadToken
GetCurrentThread
TerminateProcess
GetCurrentThreadId
api-ms-win-core-synch-l1-1-0
CreateEventW
LeaveCriticalSection
EnterCriticalSection
OpenEventW
CreateMutexExW
SetEvent
AcquireSRWLockExclusive
InitializeCriticalSection
ReleaseSRWLockExclusive
ReleaseMutex
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
WaitForSingleObjectEx
DeleteCriticalSection
OpenSemaphoreW
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringA
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-kernel32-legacy-l1-1-0
GetComputerNameW
kernelbase
WTSGetServiceSessionId
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventWriteTransfer
EventSetInformation
EventUnregister
api-ms-win-core-processthreads-l1-1-1
GetProcessMitigationPolicy
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-threadpool-legacy-l1-1-0
QueueUserWorkItem
LogonIdFromWinStationNameA
LogonIdFromWinStationNameW
RemoteAssistancePrepareSystemRestore
ServerGetInternetConnectorStatus
ServerLicensingClose
ServerLicensingDeactivateCurrentPolicy
ServerLicensingFreePolicyInformation
ServerLicensingGetAadInfo
ServerLicensingGetAvailablePolicyIds
ServerLicensingGetPolicy
ServerLicensingGetPolicyInformationA
ServerLicensingGetPolicyInformationW
ServerLicensingLoadPolicy
ServerLicensingOpenA
ServerLicensingOpenW
ServerLicensingSetAadInfo
ServerLicensingSetPolicy
ServerLicensingUnloadPolicy
ServerQueryInetConnectorInformationA
ServerQueryInetConnectorInformationW
ServerSetInternetConnectorStatus
WTSRegisterSessionNotificationEx
WTSUnRegisterSessionNotificationEx
WinStationActivateLicense
WinStationActiveSessionExists
WinStationAutoReconnect
WinStationBroadcastSystemMessage
WinStationCheckAccess
WinStationCheckLoopBack
WinStationCloseServer
WinStationConnectA
WinStationConnectAndLockDesktop
WinStationConnectCallback
WinStationConnectEx
WinStationConnectW
WinStationConsumeCacheSession
WinStationCreateChildSessionTransport
WinStationDisconnect
WinStationEnableChildSessions
WinStationEnumerateA
WinStationEnumerateContainerSessions
WinStationEnumerateExW
WinStationEnumerateLicenses
WinStationEnumerateProcesses
WinStationEnumerateW
WinStationEnumerate_IndexedA
WinStationEnumerate_IndexedW
WinStationFreeConsoleNotification
WinStationFreeEXECENVDATAEX
WinStationFreeGAPMemory
WinStationFreeMemory
WinStationFreePropertyValue
WinStationFreeSessionNotification
WinStationFreeUserCertificates
WinStationFreeUserCredentials
WinStationFreeUserSessionInfo
WinStationGenerateLicense
WinStationGetAllProcesses
WinStationGetAllSessionsEx
WinStationGetAllSessionsW
WinStationGetAllUserSessions
WinStationGetChildSessionId
WinStationGetConnectionProperty
WinStationGetCurrentSessionCapabilities
WinStationGetCurrentSessionConnectionProperty
WinStationGetCurrentSessionTerminalName
WinStationGetDeviceId
WinStationGetInitialApplication
WinStationGetLanAdapterNameA
WinStationGetLanAdapterNameW
WinStationGetLastWinlogonNotification
WinStationGetLoggedOnCount
WinStationGetMachinePolicy
WinStationGetParentSessionId
WinStationGetProcessSid
WinStationGetRedirectAuthInfo
WinStationGetRestrictedLogonInfo
WinStationGetSessionIds
WinStationGetTermSrvCountersValue
WinStationGetUserCertificates
WinStationGetUserCredentials
WinStationGetUserProfile
WinStationInstallLicense
WinStationIsBoundToCacheTerminal
WinStationIsChildSessionsEnabled
WinStationIsCurrentSessionRemoteable
WinStationIsHelpAssistantSession
WinStationIsSessionPermitted
WinStationIsSessionRemoteable
WinStationNameFromLogonIdA
WinStationNameFromLogonIdW
WinStationNegotiateSession
WinStationNtsdDebug
WinStationOpenServerA
WinStationOpenServerExA
WinStationOpenServerExW
WinStationOpenServerW
WinStationPreCreateGlassReplacementSession
WinStationPreCreateGlassReplacementSessionEx
WinStationQueryAllowConcurrentConnections
WinStationQueryCurrentSessionInformation
WinStationQueryEnforcementCore
WinStationQueryInformationA
WinStationQueryInformationW
WinStationQueryLicense
WinStationQueryLogonCredentialsW
WinStationQuerySessionVirtualIP
WinStationQueryUpdateRequired
WinStationRcmShadow2
WinStationRedirectErrorMessage
WinStationRedirectLogonBeginPainting
WinStationRedirectLogonError
WinStationRedirectLogonMessage
WinStationRedirectLogonStatus
WinStationRegisterConsoleNotification
WinStationRegisterConsoleNotificationEx
WinStationRegisterConsoleNotificationEx2
WinStationRegisterCurrentSessionNotificationEvent
WinStationRegisterNotificationEvent
WinStationRegisterSessionNotification
WinStationRegisterSessionNotificationEx
WinStationRemoveLicense
WinStationRenameA
WinStationRenameW
WinStationReportLoggedOnCompleted
WinStationReportUIResult
WinStationReset
WinStationRevertFromServicesSession
WinStationSendMessageA
WinStationSendMessageW
WinStationSendWindowMessage
WinStationServerPing
WinStationSetAutologonPassword
WinStationSetInformationA
WinStationSetInformationW
WinStationSetLastWinlogonNotification
WinStationSetPoolCount
WinStationSetRenderHint
WinStationShadow
WinStationShadowAccessCheck
WinStationShadowStop
WinStationShadowStop2
WinStationShutdownSystem
WinStationSwitchToServicesSession
WinStationSystemShutdownStarted
WinStationSystemShutdownWait
WinStationTerminateGlassReplacementSession
WinStationTerminateProcess
WinStationUnRegisterConsoleNotification
WinStationUnRegisterNotificationEvent
WinStationUnRegisterSessionNotification
WinStationUserLoginAccessCheck
WinStationVerify
WinStationVirtualOpen
WinStationVirtualOpenEx
WinStationWaitSystemEvent
_NWLogonQueryAdmin
_NWLogonSetAdmin
_WinStationAnnoyancePopup
_WinStationBeepOpen
_WinStationBreakPoint
_WinStationCallback
_WinStationCheckForApplicationName
_WinStationFUSCanRemoteUserDisconnect
_WinStationGetApplicationInfo
_WinStationNotifyDisconnectPipe
_WinStationNotifyLogoff
_WinStationNotifyLogon
_WinStationNotifyNewSession
_WinStationOpenSessionDirectory
_WinStationReInitializeSecurity
_WinStationReadRegistry
_WinStationSessionInitialized
_WinStationShadowTarget
_WinStationShadowTarget2
_WinStationShadowTargetSetup
_WinStationUpdateClientCachedCredentials
_WinStationUpdateSettings
_WinStationUpdateUserConfig
_WinStationWaitForConnect
_WinStationWaitForConnectEx
Name
.text
Size
204KB
Virtual Size
201KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
136KB
Virtual Size
133KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
360B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=62, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=15, id=260, version=33145,
count=5, id=259, version=33145,
count=286, id=1, productName=Unmarked objects,
count=7, id=257, version=33145,
count=7, id=261, version=33145,
count=1, id=256, version=33145,
count=59, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wintrust.dll
- IMPHASH 7fb36ef267a6f12886db7902b62c0e7b
- SHA256 d5ad31861ee61f091ec268ecb3885e14150f30978c533fcf332fa260ec5fcdf3
- MD5 ed532fa0c163ca70c9591e9f2bb66fad
- SHA1 43a62436884791031ac2fee751afc4c689c2e7b4
- SHA512 a37b857acc11cd28f2f927bee1fe034551fc61a0714c7bc0f0bbc349857f474523efa66c8f6b943364b5c4143b917db79b81818c834a3275ebc8d3bdf81aeabb
- SSDEEP 12288:A6k/SG2vQd/3H4HQx44BGeniYNyeiDI9GKbLHf:A6gSL4d/XJyY3N/LoKb7f
- TLSH T1E4C44B2E72BC16E4E4B69178C9438605EAB37435233196CF02A4C67D9F1BFE4663AF11
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
3e:f8:94:f8:6c:11:68:c2:d5:5c:52:0a:ba:d6:4e:42:cc:e8:02:2a:d7:5e:53:22:95:18:24:64:77:b3:b4:04
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:431A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1d:4b:c0:92:87:38:85:7e:39:00:01:00:00:02:1d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
214832
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wintrust.pdb
msvcrt
atol
__CxxFrameHandler4
memcpy
memmove
_CxxThrowException
?what@exception@@UEBAPEBDXZ
_XcptFilter
??0exception@@QEAA@AEBQEBDH@Z
_amsg_exit
memmove_s
_initterm
__CxxFrameHandler3
_purecall
??1type_info@@UEAA@XZ
_lock
_wcsicmp
_unlock
__dllonexit
_onexit
strcmp
??0exception@@QEAA@AEBQEBD@Z
memset
memcmp
_callnewh
malloc
free
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
memcpy_s
_vsnwprintf
__C_specific_handler
wcsrchr
bsearch
_ltoa
_vsnprintf
towupper
_wtol
wcscat_s
_snwscanf_s
qsort_s
qsort
wcschr
wcstol
_itow_s
_memicmp
_stricmp
_wcsnicmp
_snwprintf_s
wcscmp
api-ms-win-core-version-private-l1-1-0
GetFileVersionInfoByHandle
api-ms-win-core-libraryloader-l1-2-0
SizeofResource
LoadLibraryExW
GetModuleFileNameA
DisableThreadLibraryCalls
GetModuleFileNameW
GetProcAddress
GetModuleHandleExW
FreeResource
LoadResource
LoadLibraryExA
GetModuleHandleExA
LockResource
GetModuleHandleW
FreeLibrary
api-ms-win-core-file-l1-1-0
FindClose
FindNextFileW
WriteFile
CreateDirectoryW
GetFileInformationByHandle
GetFileSizeEx
CompareFileTime
GetFileSize
SetFilePointerEx
GetFileAttributesExW
CreateFileW
SetFilePointer
ReadFile
GetFileAttributesW
FindFirstFileW
SetFileAttributesW
SetEndOfFile
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-synch-l1-1-0
SetEvent
EnterCriticalSection
WaitForMultipleObjectsEx
ReleaseSemaphore
CreateMutexA
ReleaseSRWLockExclusive
LeaveCriticalSection
AcquireSRWLockShared
CreateMutexExW
CreateSemaphoreExW
ReleaseMutex
ReleaseSRWLockShared
InitializeCriticalSection
OpenSemaphoreW
ResetEvent
WaitForSingleObjectEx
CreateEventA
DeleteCriticalSection
InitializeCriticalSectionEx
AcquireSRWLockExclusive
WaitForSingleObject
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
OpenThreadToken
GetCurrentThreadId
OpenProcessToken
GetCurrentThread
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
OutputDebugStringA
api-ms-win-core-heap-l2-1-0
LocalReAlloc
LocalFree
LocalAlloc
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-eventing-provider-l1-1-0
EventWrite
EventWriteTransfer
EventUnregister
EventRegister
EventSetInformation
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemInfo
GetSystemDirectoryW
GetTickCount64
GetTickCount
GetLocalTime
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GetCurrentDirectoryW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
api-ms-win-core-libraryloader-l1-2-1
FindResourceW
LoadLibraryA
LoadLibraryW
api-ms-win-core-registry-l1-1-0
RegOpenKeyExA
RegEnumKeyExA
RegSetValueExW
RegOpenKeyExW
RegDeleteKeyExW
RegQueryValueExW
RegCloseKey
RegSetValueExA
RegEnumValueA
RegGetValueW
RegCreateKeyExW
RegQueryValueExA
RegQueryInfoKeyA
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
Sleep
api-ms-win-core-memory-l1-1-0
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-memory-l1-1-1
VirtualUnlock
api-ms-win-core-version-l1-1-0
VerQueryValueW
api-ms-win-core-wow64-l1-1-1
IsWow64Process2
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-datetime-l1-1-0
GetTimeFormatA
GetDateFormatA
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
api-ms-win-security-base-l1-1-0
IsValidSid
CopySid
SetFileSecurityW
GetSidSubAuthority
GetSidSubAuthorityCount
GetAclInformation
GetSecurityDescriptorDacl
GetAce
AllocateAndInitializeSid
GetSidIdentifierAuthority
GetTokenInformation
SetSecurityDescriptorDacl
AddAce
EqualSid
AddAccessAllowedAceEx
FreeSid
GetFileSecurityW
GetLengthSid
InitializeSecurityDescriptor
InitializeAcl
rpcrt4
RpcStringFreeW
RpcEpResolveBinding
RpcBindingFree
NdrClientCall3
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcBindingSetAuthInfoExW
api-ms-win-core-kernel32-legacy-l1-1-0
FindResourceExA
CreateFileMappingA
api-ms-win-core-string-obsolete-l1-1-0
lstrlenW
lstrcmpA
lstrcmpW
lstrlenA
ntdll
RtlCopyUnicodeString
NtQuerySecurityAttributesToken
NtQueryEaFile
RtlGetVersion
RtlCreateUnicodeString
NtQuerySecurityObject
RtlImageNtHeaderEx
RtlRunOnceExecuteOnce
RtlInitUnicodeString
RtlFreeUnicodeString
ZwQueryVolumeInformationFile
NtQuerySystemInformation
RtlNtStatusToDosError
RtlIsStateSeparationEnabled
RtlInitializeSRWLock
RtlReleaseSRWLockExclusive
RtlAllocateHeap
RtlAcquireSRWLockShared
RtlReleaseSRWLockShared
RtlCompareUnicodeString
RtlAppendUnicodeStringToString
RtlEqualUnicodeString
RtlPrefixUnicodeString
RtlIsNameInUnUpcasedExpression
RtlGetAce
RtlGetOwnerSecurityDescriptor
RtlGetNtSystemRoot
RtlInitializeSidEx
RtlEqualSid
RtlGetDaclSecurityDescriptor
LdrResSearchResource
RtlGetPersistedStateLocation
RtlFreeHeap
RtlAcquireSRWLockExclusive
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
AddPersonalTrustDBPages
CatalogCompactHashDatabase
ComputeFirstPageHash
ConfigCiFinalPolicy
ConfigCiPackageFamilyNameCheck
CryptCATAdminAcquireContext
CryptCATAdminAcquireContext2
CryptCATAdminAddCatalog
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminCalcHashFromFileHandle2
CryptCATAdminCalcHashFromFileHandle3
CryptCATAdminEnumCatalogFromHash
CryptCATAdminPauseServiceForBackup
CryptCATAdminReleaseCatalogContext
CryptCATAdminReleaseContext
CryptCATAdminRemoveCatalog
CryptCATAdminResolveCatalogPath
CryptCATAllocSortedMemberInfo
CryptCATCDFClose
CryptCATCDFEnumAttributes
CryptCATCDFEnumAttributesWithCDFTag
CryptCATCDFEnumCatAttributes
CryptCATCDFEnumMembers
CryptCATCDFEnumMembersByCDFTag
CryptCATCDFEnumMembersByCDFTagEx
CryptCATCDFOpen
CryptCATCatalogInfoFromContext
CryptCATClose
CryptCATEnumerateAttr
CryptCATEnumerateCatAttr
CryptCATEnumerateMember
CryptCATFreeSortedMemberInfo
CryptCATGetAttrInfo
CryptCATGetCatAttrInfo
CryptCATGetMemberInfo
CryptCATHandleFromStore
CryptCATOpen
CryptCATPersistStore
CryptCATPutAttrInfo
CryptCATPutCatAttrInfo
CryptCATPutMemberInfo
CryptCATStoreFromHandle
CryptCATVerifyMember
CryptSIPCreateIndirectData
CryptSIPGetCaps
CryptSIPGetInfo
CryptSIPGetRegWorkingFlags
CryptSIPGetSealedDigest
CryptSIPGetSignedDataMsg
CryptSIPPutSignedDataMsg
CryptSIPRemoveSignedDataMsg
CryptSIPVerifyIndirectData
DllRegisterServer
DllUnregisterServer
DriverCleanupPolicy
DriverFinalPolicy
DriverInitializePolicy
FindCertsByIssuer
GenericChainCertificateTrust
GenericChainFinalProv
GetAuthenticodeSha256Hash
HTTPSCertificateTrust
HTTPSFinalProv
IsCatalogFile
MsCatConstructHashTag
MsCatFreeHashTag
OfficeCleanupPolicy
OfficeInitializePolicy
OpenPersonalTrustDBDialog
OpenPersonalTrustDBDialogEx
SetMessageDigestInfo
SoftpubAuthenticode
SoftpubCheckCert
SoftpubCleanup
SoftpubDefCertInit
SoftpubDllRegisterServer
SoftpubDllUnregisterServer
SoftpubDumpStructure
SoftpubFreeDefUsageCallData
SoftpubInitialize
SoftpubLoadDefUsageCallData
SoftpubLoadMessage
SoftpubLoadSignature
SrpCheckSmartlockerEAandProcessToken
TrustDecode
TrustFindIssuerCertificate
TrustFreeDecode
TrustIsCertificateSelfSigned
TrustOpenStores
WTConfigCiFreePrivateData
WTConvertCertCtxToChainInfo
WTGetBioSignatureInfo
WTGetPluginSignatureInfo
WTGetSignatureInfo
WTHelperCertCheckValidSignature
WTHelperCertFindIssuerCertificate
WTHelperCertIsSelfSigned
WTHelperCheckCertUsage
WTHelperGetAgencyInfo
WTHelperGetFileHandle
WTHelperGetFileHash
WTHelperGetFileName
WTHelperGetKnownUsages
WTHelperGetProvCertFromChain
WTHelperGetProvPrivateDataFromChain
WTHelperGetProvSignerFromChain
WTHelperIsChainedToMicrosoft
WTHelperIsChainedToMicrosoftFromStateData
WTHelperIsInRootStore
WTHelperOpenKnownStores
WTHelperProvDataFromStateData
WTIsFirstConfigCiResultPreferred
WTLogConfigCiScriptEvent
WTLogConfigCiScriptEvent2
WTLogConfigCiSignerEvent
WTLogSmartAppControlDefenderInfo
WTValidateBioSignaturePolicy
WVTAsn1CatMemberInfo2Decode
WVTAsn1CatMemberInfo2Encode
WVTAsn1CatMemberInfoDecode
WVTAsn1CatMemberInfoEncode
WVTAsn1CatNameValueDecode
WVTAsn1CatNameValueEncode
WVTAsn1IntentToSealAttributeDecode
WVTAsn1IntentToSealAttributeEncode
WVTAsn1SealingSignatureAttributeDecode
WVTAsn1SealingSignatureAttributeEncode
WVTAsn1SealingTimestampAttributeDecode
WVTAsn1SealingTimestampAttributeEncode
WVTAsn1SpcFinancialCriteriaInfoDecode
WVTAsn1SpcFinancialCriteriaInfoEncode
WVTAsn1SpcIndirectDataContentDecode
WVTAsn1SpcIndirectDataContentEncode
WVTAsn1SpcLinkDecode
WVTAsn1SpcLinkEncode
WVTAsn1SpcMinimalCriteriaInfoDecode
WVTAsn1SpcMinimalCriteriaInfoEncode
WVTAsn1SpcPeImageDataDecode
WVTAsn1SpcPeImageDataEncode
WVTAsn1SpcSigInfoDecode
WVTAsn1SpcSigInfoEncode
WVTAsn1SpcSpAgencyInfoDecode
WVTAsn1SpcSpAgencyInfoEncode
WVTAsn1SpcSpOpusInfoDecode
WVTAsn1SpcSpOpusInfoEncode
WVTAsn1SpcStatementTypeDecode
WVTAsn1SpcStatementTypeEncode
WinVerifyTrust
WinVerifyTrustEx
WintrustAddActionID
WintrustAddDefaultForUsage
WintrustAddProviderToProcess
WintrustCertificateTrust
WintrustGetDefaultForUsage
WintrustGetHash
WintrustGetRegPolicyFlags
WintrustLoadFunctionPointers
WintrustRemoveActionID
WintrustSetDefaultIncludePEPageHashes
WintrustSetRegPolicyFlags
WintrustUserWriteabilityCheck
mscat32DllRegisterServer
mscat32DllUnregisterServer
mssip32DllRegisterServer
mssip32DllUnregisterServer
Name
.text
Size
364KB
Virtual Size
361KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
PAGE
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
104KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=70, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=16, id=260, version=33145,
count=5, id=259, version=33145,
count=453, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=1, id=256, version=33145,
count=114, id=264, version=33145,
count=8, id=261, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
winusb.dll
- IMPHASH 0ba622767cc7889fbbe498429bf7613d
- SHA256 5d4c0816d8c2d809640a9e35a2b519cde5be59bb6c12aea294d2d3d627ae56ae
- MD5 e726e46c95dfa4cc73db8ee415bf95a1
- SHA1 4c3720b17bbac493667745d15dee8ee09f9599a3
- SHA512 03a7bb501217b8877c7b1890d1f9bfe2a9168bcf0b6e900ea367fd8dc3025a3efdd5dec43db552bcc83440bc32736fd3e0eac513c6f4db0326657decc91c4d27
- SSDEEP 768:PtTEzId5WsqzzNWwOsP6yVSSqBawAe1kW39TAe6GNLCTwBU2:JiId5Ws0D61kWNTAe6GNLCT0T
- TLSH T1E733D50DABEA31F4E4BAC679928B4796E574F4315B0266FF46E0C93D9A02FE06131F41
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5056
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
winusb.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
memcpy
_o___std_type_info_destroy_list
__C_specific_handler
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
SetLastError
api-ms-win-core-io-l1-1-0
DeviceIoControl
GetOverlappedResult
CancelIoEx
api-ms-win-core-synch-l1-1-0
ResetEvent
WaitForSingleObject
CreateEventA
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
ntdll
NtQueryInformationFile
WinUsb_AbortPipe
WinUsb_AbortPipeAsync
WinUsb_ControlTransfer
WinUsb_FlushPipe
WinUsb_Free
WinUsb_GetAdjustedFrameNumber
WinUsb_GetAssociatedInterface
WinUsb_GetCurrentAlternateSetting
WinUsb_GetCurrentFrameNumber
WinUsb_GetCurrentFrameNumberAndQpc
WinUsb_GetDescriptor
WinUsb_GetOverlappedResult
WinUsb_GetPipePolicy
WinUsb_GetPowerPolicy
WinUsb_Initialize
WinUsb_ParseConfigurationDescriptor
WinUsb_ParseDescriptors
WinUsb_QueryDeviceInformation
WinUsb_QueryInterfaceSettings
WinUsb_QueryPipe
WinUsb_QueryPipeEx
WinUsb_ReadIsochPipe
WinUsb_ReadIsochPipeAsap
WinUsb_ReadPipe
WinUsb_RegisterIsochBuffer
WinUsb_ResetPipe
WinUsb_ResetPipeAsync
WinUsb_SetCurrentAlternateSetting
WinUsb_SetCurrentAlternateSettingAsync
WinUsb_SetPipePolicy
WinUsb_SetPowerPolicy
WinUsb_StartTrackingForTimeSync
WinUsb_StopTrackingForTimeSync
WinUsb_UnregisterIsochBuffer
WinUsb_WriteIsochPipe
WinUsb_WriteIsochPipeAsap
WinUsb_WritePipe
Name
.text
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
132B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33138,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1099, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33138,
count=4, id=259, version=33138,
count=14, id=261, version=33138,
count=1, id=256, version=33138,
count=2, id=264, version=33138,
count=1, id=253, version=33138,
count=1, id=255, version=33138,
count=1, id=258, version=33138,
wisp.dll
- IMPHASH 1780003685915c6923764c78902ab1a1
- SHA256 7008b9036d498a58fe3920a97cba89cd744888e52d79a5a8fd0d5c6af802fcf1
- MD5 139b38d053e0117ef8b1509541323a13
- SHA1 2adfaaf731727111d49107ebd8026252e5ba5064
- SHA512 5f59bf45a9dc6be0ed008f3b4a5bb207ec2228aeb574f83676e057c8304396e3314e9ccaabbc93781a86df388b4fbe35b37b80fcfa292688b859122dc04d8548
- SSDEEP 6144:QjJc3v+SpiQW5Y1g5fY9pF8Dq4grVrlJ6hGIKj:QjJc3v+SpiQW5Y1gpY9pSKrVrlJ64
- TLSH T1F3645C5E73A94CA6E976903CC947860AE7B278201711D7CF1360837E5F37BD86A36B60
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
125504
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wisp.pdb
msvcrt
wcschr
atan2
fmod
fmodf
memcmp
memset
powf
sqrt
_errno
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
memmove
memcpy
__CxxFrameHandler3
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_callnewh
swprintf_s
_beginthreadex
memmove_s
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
_vsnwprintf
_purecall
memcpy_s
malloc
wcsncpy_s
realloc
free
__C_specific_handler
??_V@YAXPEAX@Z
__CxxFrameHandler4
??3@YAXPEAX@Z
rand
wcsrchr
wcscmp
ntdll
RtlCompareUnicodeString
RtlNtStatusToDosErrorNoTeb
RtlAllocateHeap
RtlInitUnicodeString
NtQueryInformationToken
RtlFreeHeap
RtlVirtualUnwind
RtlLookupFunctionEntry
ZwUpdateWnfStateData
EtwEventUnregister
EtwEventSetInformation
EtwEventRegister
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwEventWriteTransfer
EtwTraceMessage
RtlCaptureContext
user32
CreateWindowExW
SetWindowFeedbackSetting
GetPointerDeviceRects
EnumDisplaySettingsExW
WindowFromPoint
ScreenToClient
ChildWindowFromPointEx
IsChild
GetCursorPos
SetPhysicalCursorPos
UnregisterClassA
GetClassInfoExW
RegisterClassExW
DispatchMessageW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjectsEx
RegisterPointerDeviceNotifications
PostThreadMessageW
ClientToScreen
ReleaseDC
GetDC
GetMonitorInfoW
MonitorFromWindow
GetRawPointerDeviceData
GetPointerInfoHistory
GetPointerPenInfo
GetPointerCursorId
GetCurrentInputMessageSource
GetMessageExtraInfo
SendMessageCallbackW
GetPropW
GetPointerDevices
DestroyWindow
GetDesktopWindow
SendNotifyMessageW
GetPointerDevice
GetPointerDeviceCursors
GetPointerDeviceProperties
GetRawInputDeviceInfoW
PtInRect
InflateRect
SetRectEmpty
PostMessageW
EqualRect
GetAncestor
GetWindowLongW
IsWindow
MapWindowPoints
GetClientRect
CallWindowProcW
DefWindowProcW
GetWindowLongPtrW
SetWindowLongPtrW
CharNextW
SystemParametersInfoW
GetSystemMetrics
GetDoubleClickTime
LoadCursorW
ord2508
ord2560
ord2503
GetPointerInfo
ord2504
kernel32
LeaveCriticalSection
SetThreadpoolTimer
ReleaseSemaphore
CloseHandle
SetLastError
GetCurrentPackageFullName
GetTickCount64
OutputDebugStringA
GetSystemTimeAsFileTime
SleepConditionVariableSRW
WakeAllConditionVariable
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
DecodePointer
EncodePointer
LoadLibraryExA
VirtualAlloc
VirtualFree
DisableThreadLibraryCalls
MulDiv
InitializeCriticalSectionAndSpinCount
GetCurrentThread
SetThreadPriority
WaitForMultipleObjectsEx
SetThreadDescription
CreateSemaphoreExW
CreateMutexExW
GetCurrentProcessId
GlobalAddAtomW
GlobalDeleteAtom
CreateThreadpoolTimer
OpenSemaphoreW
DelayLoadFailureHook
ResolveDelayLoadedAPI
InitializeCriticalSectionEx
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
OutputDebugStringW
IsDebuggerPresent
WideCharToMultiByte
DebugBreak
GetModuleFileNameA
GetModuleHandleExW
HeapFree
HeapAlloc
GetProcessHeap
FormatMessageW
GetCurrentThreadId
ResetEvent
UnmapViewOfFile
SetEvent
MapViewOfFile
CreateFileMappingW
QueryPerformanceCounter
LocalFree
CreateMutexW
CreateEventW
DuplicateHandle
GetCurrentProcess
GetTickCount
OpenProcess
ReleaseMutex
WaitForSingleObject
WaitForThreadpoolTimerCallbacks
GetModuleFileNameW
FindResourceExW
LoadResource
SizeofResource
MultiByteToWideChar
RaiseException
lstrcmpiW
GetModuleHandleW
LoadLibraryExW
GetProcAddress
FreeLibrary
CloseThreadpoolTimer
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetLastError
WaitForSingleObjectEx
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
196KB
Virtual Size
193KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
52KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
240B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
28KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=18, id=260, version=33145,
count=275, id=1, productName=Unmarked objects,
count=9, id=257, version=33145,
count=12, id=261, version=33145,
count=1, id=256, version=33145,
count=45, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
witnesswmiv2provider.dll
- IMPHASH 40506c70e428f582e4389d534919dcff
- SHA256 373aba935ec1aefdc382a8fb7db0707d6a9efa07968308e258e9e9bda756db8d
- MD5 a2040c9072bbadafb0b6006a4b735f1f
- SHA1 2f71701364b10ec0c729467cfbe002c661569d31
- SHA512 2262d9dffd19278cea79aa7e26abfd7da102477ed040ddc417d9b0755291d1fa1d586cff8a7e5c36fadd8915f568ff82ec2b1b6f4a6efa50aaac805aeaee7b7b
- SSDEEP 768:QTnXuZjuUAMgoVWhpTe1pcYgZtZjkr5/VZHT:7ZpAwVWhZgN0Hjkd/VZHT
- TLSH T1CF53D749E3E51099E4B28238857B0E21A7B1FC391B128BEF0674813D6F577D0AB78F91
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4752
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WitnessWmiv2Provider.pdb
msvcrt
_XcptFilter
malloc
free
_amsg_exit
_initterm
memcpy
__C_specific_handler
swprintf_s
memset
api-ms-win-core-sysinfo-l1-1-0
GetComputerNameExW
GetTickCount
GetSystemDirectoryW
GetSystemTimeAsFileTime
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
GetProcAddress
LoadStringW
GetModuleHandleW
FreeLibrary
DisableThreadLibraryCalls
api-ms-win-security-base-l1-1-0
SetSecurityDescriptorDacl
AccessCheck
RevertToSelf
SetSecurityDescriptorOwner
AllocateAndInitializeSid
CheckTokenMembership
SetSecurityDescriptorGroup
MakeSelfRelativeSD
ImpersonateLoggedOnUser
AddAccessAllowedAce
FreeSid
InitializeSecurityDescriptor
InitializeAcl
DuplicateTokenEx
GetTokenInformation
GetLengthSid
rpcrt4
RpcServerRegisterAuthInfoW
NdrServerCall2
NdrServerCallAll
NdrClientCall3
RpcBindingFree
RpcMgmtInqServerPrincNameW
RpcEpResolveBinding
RpcServerUnregisterIfEx
RpcBindingSetAuthInfoExW
I_RpcExceptionFilter
RpcStringBindingComposeW
RpcServerInqDefaultPrincNameW
RpcBindingFromStringBindingW
RpcServerInqBindings
RpcServerInqCallAttributesW
RpcEpRegisterW
RpcEpUnregister
RpcStringFreeW
RpcRevertToSelf
RpcImpersonateClient
RpcBindingVectorFree
RpcBindingInqAuthClientW
RpcServerRegisterIfEx
RpcServerUseProtseqEpW
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
OpenProcessToken
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
OpenThreadToken
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-com-l1-1-0
CoRevertToSelf
CoImpersonateClient
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
ext-ms-win-cluster-clusapi-l1-1-0
CloseClusterNode
OpenClusterNode
OpenCluster
CloseCluster
CloseClusterResource
ClusterResourceControl
ext-ms-win-cluster-resutils-l1-1-0
ResUtilGetCoreClusterResources
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
GetProviderClassID
MI_Main
WitnessWmiInitialize
WitnessWmiTerminate
Name
.text
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
732B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=34, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=14, id=260, version=33138,
count=4, id=259, version=33138,
count=94, id=1, productName=Unmarked objects,
count=3, id=257, version=33138,
count=1, id=256, version=33138,
count=10, id=264, version=33138,
count=1, id=255, version=33138,
count=1, id=258, version=33138,
wkscli.dll
- IMPHASH 3f729d8b487c6614270aeecc59f7d05e
- SHA256 9207aa4d33ed79d9a5199185514ecae5c4e85b4bcef633268875898dba5a3367
- MD5 634e5baad00cc318daa11fcb6a1ebb7a
- SHA1 cae83aa46fa74f9d7682fb4bf6edfab55d156222
- SHA512 11366ded98aa224973c08dbb0936928d3322435eba308e60f15473642ecd5eedd53ba7bdf06c2e5b6183aee0a79806afc43cf6c82c88b0af9e04e5c3c67c617b
- SSDEEP 3072:VlWmqXAYj4i379sx5MVhzPABs81ndI46QaBXtMqSFN1i:fMFvfLA5ndFbaBXt6Q
- TLSH T18BC32A1BA665209BF83BC27645BB561BA735FA61132003DF0690813ADE177C6BF3CB94
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ed:5e:dc:f3:4f:e7:12:e8:41:8e:a3:c6:c3:d9:53:a1:6f:e9:be:26:6d:8b:2e:a9:7c:92:03:e4:a1:3d:4e:27
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 24, 2025
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:18:41:84:19:ad:cb:ad:29:4f:00:00:00:00:05:18
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 19, 2025 - Jun 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:09:08:07:e0:f9:5c:8c:e6:55:00:01:00:00:02:09
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
13600
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wkscli.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__itow_s
_o__seh_filter_dll
memcpy
_o__wcsicmp
_o__wcsnicmp
_o_free
_o_isdigit
_o_strcpy_s
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o___std_type_info_destroy_list
strchr
__C_specific_handler
__RTDynamicCast
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
DisableThreadLibraryCalls
GetProcAddress
LoadLibraryExW
api-ms-win-core-heap-l2-1-0
LocalReAlloc
LocalAlloc
LocalFree
rpcrt4
I_RpcExceptionFilter
NdrClientCall3
RpcBindingFree
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcStringFreeW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetComputerNameExW
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
ntdll
RtlOemStringToUnicodeString
RtlUnicodeToOemN
RtlxUnicodeStringToOemSize
NtOpenThreadToken
NtImpersonateAnonymousToken
NtCreateFile
NtFsControlFile
NtSetInformationThread
RtlInitAnsiString
RtlGetLastNtStatus
RtlReleaseResource
RtlDeleteResource
NtClose
RtlRunEncodeUnicodeString
RtlInitUnicodeString
RtlInitializeResource
RtlNtStatusToDosError
RtlAcquireResourceExclusive
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-timezone-l1-1-0
GetTimeZoneInformation
NetAddAlternateComputerName
NetEnumerateComputerNames
NetGetJoinInformation
NetGetJoinableOUs
NetJoinDomain
NetRemoveAlternateComputerName
NetRenameMachineInDomain
NetSetPrimaryComputerName
NetUnjoinDomain
NetUseAdd
NetUseDel
NetUseEnum
NetUseGetInfo
NetValidateName
NetWkstaGetInfo
NetWkstaSetInfo
NetWkstaStatisticsGet
NetWkstaTransportAdd
NetWkstaTransportDel
NetWkstaTransportEnum
NetWkstaUserEnum
NetWkstaUserGetInfo
NetWkstaUserSetInfo
NetpWkstaClientCertificateMappingAdd
NetpWkstaClientCertificateMappingEnum
NetpWkstaClientCertificateMappingGet
NetpWkstaClientCertificateMappingModify
NetpWkstaClientCertificateMappingRemove
NetpWkstaClientSmbDirectModuleControl
Name
.text
Size
48KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=41, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1170, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=4, id=259, version=33145,
count=16, id=261, version=33145,
count=1, id=256, version=33145,
count=43, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wkspbrokerAx.dll
- IMPHASH a24e6ba307460343f0d1a8cc381aea54
- SHA256 42674cc5ba8dff9e50addab346c6a2ec2bcc7150410d490d92c147253a91dc7f
- MD5 65471bdf78bfaa9dddb902d0da31d1fd
- SHA1 a367e5efb750a0e7a4c33996771df445d72f002b
- SHA512 e419fec723f1e1243c417931eb24b8511cd636d029bc4e2704cf668649e9f3cf8c10569e7b2b2104c51df29af6853f6f8970444701561793df6cb9122f31bd68
- SSDEEP 3072:w6F0D+LUCwTCaGJNPsO2jW2JVN8lO+lEdKJqXVMe:1e+LUCwTCaGJ9HGW2JVWc4qe
- TLSH T1ECE32A1FB26810ABD435817D45470B19E3B2B8281B5257DF42A0E23E5F37BE8AF35E91
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7952
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wkspbrokerAx.pdb
msvcrt
_lock
realloc
_errno
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
memmove
memcpy
__CxxFrameHandler3
_CxxThrowException
?what@exception@@UEBAPEBDXZ
_unlock
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_callnewh
wcscat_s
wcscpy_s
calloc
_purecall
_resetstkoflw
swprintf_s
wcsncpy_s
memcpy_s
free
__dllonexit
_onexit
memset
??3@YAXPEAX@Z
memcmp
_vsnwprintf
??1exception@@UEAA@XZ
malloc
__C_specific_handler
??_V@YAXPEAX@Z
__CxxFrameHandler4
wcscmp
kernel32
LoadLibraryExW
FindResourceExW
LoadResource
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetProcAddress
GetModuleHandleW
lstrcmpiW
RaiseException
SizeofResource
GetModuleFileNameW
GetModuleHandleExA
InitializeCriticalSection
GetCurrentThreadId
SetLastError
GetThreadLocale
SetThreadLocale
HeapFree
VirtualFree
GetCurrentProcess
VirtualAlloc
LoadLibraryExA
GetModuleHandleExW
HeapAlloc
DecodePointer
GetProcessHeap
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
ReleaseSRWLockExclusive
MulDiv
WakeAllConditionVariable
SleepConditionVariableSRW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
WaitForSingleObject
ReleaseMutex
FormatMessageW
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
DebugBreak
IsDebuggerPresent
LocalFree
ReleaseSemaphore
LocalAlloc
CloseHandle
lstrcmpW
MultiByteToWideChar
GetLastError
AcquireSRWLockExclusive
CreateSemaphoreExW
EncodePointer
LoadLibraryW
GetModuleFileNameA
advapi32
TraceMessage
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
oleaut32
SafeArrayGetLBound
SysFreeString
BSTR_UserSize
BSTR_UserFree
BSTR_UserUnmarshal64
BSTR_UserUnmarshal
BSTR_UserMarshal
BSTR_UserFree64
BSTR_UserSize64
SysStringLen
SysAllocString
VariantInit
VariantClear
SysStringByteLen
VarUI4FromStr
SysAllocStringByteLen
SafeArrayDestroy
SafeArrayGetVartype
LoadRegTypeLi
LoadTypeLi
SafeArrayGetUBound
BSTR_UserMarshal64
SafeArrayLock
SafeArrayUnlock
UnRegisterTypeLi
RegisterTypeLi
user32
CreateWindowExW
DestroyWindow
GetWindowLongPtrW
SetWindowLongPtrW
GetClientRect
BeginPaint
EndPaint
GetDC
ReleaseDC
IsChild
IsWindow
GetClassNameW
CharNextW
UnregisterClassA
CallWindowProcW
EnumChildWindows
AllowSetForegroundWindow
RegisterClassExW
LoadCursorW
GetClassInfoExW
DefWindowProcW
GetFocus
gdi32
SetViewportOrgEx
SetMapMode
LPtoDP
RestoreDC
SetWindowOrgEx
SaveDC
TextOutW
SetTextAlign
CreateDCW
GetDeviceCaps
DeleteDC
rpcrt4
NdrOleFree
IUnknown_Release_Proxy
NdrDllUnregisterProxy
NdrOleAllocate
NdrDllRegisterProxy
NdrDllGetClassObject
IUnknown_QueryInterface_Proxy
NdrStubCall3
NdrDllCanUnloadNow
NdrStubForwardingFunction
IUnknown_AddRef_Proxy
ole32
StringFromGUID2
CoCreateInstance
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
ObjectStublessClient25
ObjectStublessClient24
NdrProxyForwardingFunction3
ObjectStublessClient21
ObjectStublessClient16
ObjectStublessClient10
ObjectStublessClient17
ObjectStublessClient26
ObjectStublessClient9
ObjectStublessClient8
NdrProxyForwardingFunction5
NdrProxyForwardingFunction4
ObjectStublessClient19
ObjectStublessClient13
ObjectStublessClient7
NdrProxyForwardingFunction6
ObjectStublessClient23
ObjectStublessClient15
ObjectStublessClient20
ObjectStublessClient18
ObjectStublessClient27
ObjectStublessClient22
ObjectStublessClient11
ObjectStublessClient14
ObjectStublessClient12
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
combase
ord157
ord90
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
Name
.text
Size
84KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=22, id=260, version=33145,
count=313, id=1, productName=Unmarked objects,
count=25, id=257, version=33145,
count=12, id=261, version=33145,
count=1, id=256, version=33145,
count=26, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wksprtPS.dll
- IMPHASH 6af3aa487da2d2e44295ea2dcbd408d7
- SHA256 66e4d1944735b7f6f8cac718e58f3f60020b3f02cd3fe9ef37e4f1e7fadf7097
- MD5 1f1748033001a3e5a3206875e8b8c3fd
- SHA1 dde9cf4766a6f76c5358859070d5fc86f8098940
- SHA512 e2149867b7366e0250c9131f167f2eb3e80f2775934faa2debf2a03dd79be997dcbca28729c41be95907473c018ed243a9fc8f52aafa3ab5326289d086f99adf
- SSDEEP 384:aGN+mWgWhcx1/IT/4lcHCKFpNtLbarSWyc+yW0MEyyr:5+GGcx1/IT/4lcHCK/fyDZ
- TLSH T10643C5C5FB041865E43842BC485F0E69B379EA3C5BD343CB66B5909E5DBA7C18B30AC6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5104
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wksprtPS.pdb
msvcrt
memcmp
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
kernel32
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
DisableThreadLibraryCalls
Sleep
GetCurrentProcessId
ole32
ObjectStublessClient16
ObjectStublessClient10
ObjectStublessClient9
ObjectStublessClient8
ObjectStublessClient6
NdrProxyForwardingFunction5
NdrProxyForwardingFunction4
ObjectStublessClient13
ObjectStublessClient7
NdrProxyForwardingFunction3
ObjectStublessClient15
ObjectStublessClient11
ObjectStublessClient14
ObjectStublessClient12
ObjectStublessClient4
ObjectStublessClient5
ObjectStublessClient3
NdrProxyForwardingFunction6
oleaut32
LPSAFEARRAY_UserUnmarshal
LPSAFEARRAY_UserFree64
LPSAFEARRAY_UserMarshal64
LPSAFEARRAY_UserUnmarshal64
LPSAFEARRAY_UserMarshal
LPSAFEARRAY_UserSize64
BSTR_UserUnmarshal
BSTR_UserMarshal
BSTR_UserFree64
BSTR_UserSize64
LPSAFEARRAY_UserSize
BSTR_UserMarshal64
BSTR_UserUnmarshal64
BSTR_UserFree
BSTR_UserSize
LPSAFEARRAY_UserFree
rpcrt4
CStdStubBuffer_DebugServerRelease
NdrDllGetClassObject
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
CStdStubBuffer_Invoke
NdrCStdStubBuffer_Release
IUnknown_QueryInterface_Proxy
NdrDllCanUnloadNow
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Connect
NdrStubForwardingFunction
CStdStubBuffer_Disconnect
NdrCStdStubBuffer2_Release
NdrDllUnregisterProxy
NdrDllRegisterProxy
NdrStubCall3
NdrOleAllocate
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo
Name
.text
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
264B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33136,
count=4, id=259, version=33136,
count=81, id=1, productName=Unmarked objects,
count=11, id=257, version=33136,
count=1, id=256, version=33136,
count=6, id=264, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
wkssvc.dll
- IMPHASH 2904f918f0f5ded917975127cf8a8cfe
- SHA256 1160cee8c565452a35024b977b8facdbe0d443282cf81bbf65130d9c5c4db628
- MD5 a539bb0df8903d991815dbfb170a151c
- SHA1 6f54c6713d2748c390ffa96a9b247b13b0e22af5
- SHA512 2cbbef267561d3e8299708fbc5cc05d77fd9641d27edabd22e9f71df77b1e106753ed9027cf0d7ba426139e0b7fdb080363cded4d60d714359a733b31b434862
- SSDEEP 6144:4kJXkMLB3dq5fhgK13SqZZUz/AZiKZvndFDco14j0bMFU3f:jJXkMLB3dq5fmyfZuz/8iULEy
- TLSH T1CA84F51DABE90099F0B7CA34857742169BB278382762C2DF2190C53C5E27FD5AE78F16
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
118768
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wkssvc.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__itow_s
_o__seh_filter_dll
_o__callnewh
memmove
_o__wcsnicmp
_o_free
_o_iswalpha
_o_malloc
_o_rand_s
_o_tolower
_o_towupper
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstoul
__C_specific_handler
_CxxThrowException
wcsstr
__std_terminate
__CxxFrameHandler4
wcschr
_o___stdio_common_vswprintf
_o__configure_narrow_argv
_o__cexit
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
memcmp
memcpy
_o__wcsicmp
api-ms-win-crt-string-l1-1-0
memset
wcscmp
wcsspn
ntdll
NtQueryInformationFile
RtlGetNtProductType
NtQueryVolumeInformationFile
NtOpenFile
RtlRunEncodeUnicodeString
RtlIpv4AddressToStringW
RtlIpv6AddressToStringW
RtlRunDecodeUnicodeString
RtlIpv6StringToAddressW
RtlIpv4AddressToStringExW
RtlIpv6AddressToStringExW
DbgPrint
RtlValidRelativeSecurityDescriptor
WinSqmSetDWORD
RtlAcquireResourceShared
RtlCopyLuid
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
RtlIpv4StringToAddressW
NtWaitForSingleObject
RtlDeregisterWaitEx
RtlDeleteElementGenericTable
RtlDeregisterWait
RtlInsertElementGenericTable
RtlLookupElementGenericTable
RtlEnumerateGenericTable
NtCreateFile
RtlInitializeGenericTable
RtlRegisterWait
RtlInitString
RtlMapSecurityErrorToNtStatus
RtlIntegerToUnicodeString
RtlCreateEnvironment
RtlNtStatusToDosError
RtlUnicodeToUTF8N
RtlSetEnvironmentVariable
NtCreateEvent
NtFsControlFile
RtlAcquireResourceExclusive
NtClose
RtlReleaseResource
RtlAdjustPrivilege
NtAccessCheckAndAuditAlarm
NtDeviceIoControlFile
NtOpenThreadToken
RtlUnicodeStringToInteger
RtlCopySid
RtlLengthSid
RtlCreateAcl
RtlAddAce
RtlCreateSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlSetSaclSecurityDescriptor
NtOpenProcessToken
RtlNewSecurityObject
RtlDeleteSecurityObject
RtlGetPersistedStateLocation
RtlQueryEnvironmentVariable_U
RtlInitUnicodeString
RtlFreeUnicodeString
RtlDeleteRegistryValue
RtlDestroyEnvironment
RtlQueryRegistryValuesEx
RtlDeleteResource
RtlInitializeResource
RtlHashUnicodeString
RtlCompareUnicodeString
NtOpenKey
NtQueryInformationToken
WinSqmIsOptedIn
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegFlushKey
RegDeleteKeyExW
RegNotifyChangeKeyValue
RegGetKeySecurity
RegSetValueExW
RegQueryValueExW
RegCloseKey
RegEnumKeyExW
RegCreateKeyExW
RegGetValueW
RegQueryInfoKeyW
RegSetKeySecurity
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableFlags
TraceMessage
GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
api-ms-win-security-activedirectoryclient-l1-1-0
DsMakePasswordCredentialsW
DsFreePasswordCredentials
DsCrackNamesW
DsFreeDomainControllerInfoW
DsBindWithSpnExW
DsUnBindW
DsGetDomainControllerInfoW
DsFreeNameResultW
api-ms-win-core-heap-l2-1-0
LocalLock
LocalAlloc
LocalReAlloc
LocalUnlock
LocalFree
api-ms-win-security-base-l1-1-0
RevertToSelf
PrivilegeCheck
CheckTokenMembership
CreateWellKnownSid
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpW
api-ms-win-core-synch-l1-1-0
SetEvent
OpenEventW
WaitForSingleObject
WaitForMultipleObjectsEx
ResetEvent
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
CreateEventW
EnterCriticalSection
api-ms-win-core-kernel32-private-l1-1-0
DosPathToSessionPathW
SetLocalPrimaryComputerNameW
RemoveLocalAlternateComputerNameW
EnumerateLocalComputerNamesW
api-ms-win-core-kernel32-legacy-l1-1-0
RegisterWaitForSingleObject
DnsHostnameToComputerNameW
AddLocalAlternateComputerNameW
api-ms-win-core-sysinfo-l1-1-0
GetVersion
GetTickCount64
GetVersionExW
GlobalMemoryStatusEx
GetLocalTime
GetComputerNameExW
GetSystemTimeAsFileTime
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-file-l1-1-0
DefineDosDeviceW
QueryDosDeviceW
CreateFileW
api-ms-win-core-processthreads-l1-1-0
SetThreadToken
OpenThreadToken
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
CreateThread
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
LeaveCriticalSectionWhenCallbackReturns
IsThreadpoolTimerSet
CreateThreadpoolCleanupGroup
WaitForThreadpoolWaitCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolTimer
SetThreadpoolWait
CreateThreadpoolTimer
CloseThreadpoolWait
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolCleanupGroup
TrySubmitThreadpoolCallback
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
DisableThreadLibraryCalls
FreeLibrary
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlCompareMemory
RtlLookupFunctionEntry
api-ms-win-core-threadpool-legacy-l1-1-0
UnregisterWaitEx
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
GetProcessMitigationPolicy
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventUnregister
EventWriteTransfer
api-ms-win-core-io-l1-1-0
GetQueuedCompletionStatus
CreateIoCompletionPort
PostQueuedCompletionStatus
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
ServiceMain
SvchostPushServiceGlobals
Name
.text
Size
228KB
Virtual Size
224KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
104KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
20KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=71, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=21, id=261, version=33145,
count=1459, id=1, productName=Unmarked objects,
count=2, id=257, version=33145,
count=1, id=256, version=33145,
count=69, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wlanapi.dll
- IMPHASH 15dc8cc6aaeb181aae522f582a778d90
- SHA256 e90476680bb255a4c122da0fbe5daf8d2aeb89b94f73b30175c455edf7fe9c3f
- MD5 69b127e9424fcd21ab15bd07af3c5799
- SHA1 b2d63e56855813a3338893a9009776f5ce86616f
- SHA512 35cc7c519e6a8701bff5e8b2e316b1911a66f1c53880e334c1abbc66428fa381d61ba54170e83ed4235f474486be09f55acc4b1b4e4b71e17f48d8103bfb2a66
- SSDEEP 12288:+zMFeEs6MlVumL3WJXWEEawfqYTfNNy2X0hKDhQL:+YFeEs6Mzu8yTrwf37yOXDhQ
- TLSH T1FDC45C1EF3E806A5D4BEC1BC88830662F772B1557B214ACB916082395F17BE56F39B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e2:c7:c7:8f:c8:8e:5f:d7:0d:ed:44:46:42:b8:de:9c:37:a6:b9:b4:0b:21:0d:85:b3:5c:f2:fa:f6:aa:aa:ce
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:3605-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:13:b0:43:35:66:cf:af:95:e8:00:01:00:00:02:13
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
106272
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wlanapi.pdb
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-string-l1-1-0
wcsncmp
memset
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_abort
_o_free
_o_iswalnum
_o_iswdigit
_o_iswspace
_o_iswxdigit
_o_malloc
_o_mbtowc
_o_memcpy_s
_o_towlower
_o_wcscpy_s
_o_wcsncpy_s
_o_wmemcpy_s
__CxxFrameHandler3
_CxxThrowException
_o__errno
_o__crt_atexit
_o__endthreadex
_o___stdio_common_vswprintf_s
_o__configure_narrow_argv
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnwprintf_s
_o__cexit
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__callnewh
_o__beginthreadex
__C_specific_handler
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
DisableThreadLibraryCalls
LoadStringW
FreeLibrary
GetModuleHandleW
GetProcAddress
GetModuleHandleExW
api-ms-win-core-heap-l1-1-0
HeapFree
HeapDestroy
GetProcessHeap
HeapAlloc
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
CreateThread
GetCurrentProcessId
ProcessIdToSessionId
GetCurrentProcess
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
ntdll
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfStateChangeNotification
EtwGetTraceLoggerHandle
WinSqmIncrementDWORD
NtQueryWnfStateData
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
EtwEventWriteTransfer
RtlNtStatusToDosError
EtwTraceMessage
RtlUnsubscribeWnfNotificationWaitForCompletion
api-ms-win-core-synch-l1-1-0
OpenSemaphoreW
EnterCriticalSection
LeaveCriticalSection
SetEvent
WaitForSingleObjectEx
ResetEvent
CreateEventA
WaitForSingleObject
InitializeSRWLock
TryAcquireSRWLockExclusive
CreateSemaphoreExW
CreateMutexExW
CreateEventW
InitializeCriticalSection
ReleaseSRWLockShared
ReleaseSRWLockExclusive
DeleteCriticalSection
WaitForMultipleObjectsEx
InitializeCriticalSectionEx
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseMutex
ReleaseSemaphore
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
SetLastError
RaiseException
UnhandledExceptionFilter
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
CloseThreadpoolCleanupGroupMembers
SetThreadpoolWait
CreateThreadpoolWait
CreateThreadpoolCleanupGroup
CreateThreadpoolTimer
CloseThreadpoolCleanupGroup
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CloseThreadpoolWait
api-ms-win-core-sysinfo-l1-1-0
GetVersionExW
GetSystemWindowsDirectoryW
GetTickCount
GetTickCount64
GetSystemTimeAsFileTime
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventUnregister
EventRegister
EventSetInformation
EventActivityIdControl
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-file-l1-1-0
CreateFileW
CompareFileTime
GetFileTime
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegGetValueW
RegQueryValueExW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-security-base-l1-1-0
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
InitializeAcl
GetLengthSid
GetSecurityDescriptorLength
AddAccessAllowedAce
MakeSelfRelativeSD
SetSecurityDescriptorGroup
AddAccessDeniedAce
IsValidSid
GetSecurityDescriptorDacl
SetSecurityDescriptorOwner
CreateWellKnownSid
GetAce
EqualSid
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpW
api-ms-win-core-kernel32-legacy-l1-1-0
WTSGetActiveConsoleSessionId
api-ms-win-core-sysinfo-l1-2-0
VerSetConditionMask
api-ms-win-core-kernel32-legacy-l1-1-1
VerifyVersionInfoW
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
AcmGenerateConnectionId
AcmGenerateConnectionIdForNotification
AcmGenerateNetworkId
ConvertFrequencyToBandChannel
ConvertPassPhraseKeyStringToBuffer
FreeMSMSecConfig
MSMSecAuthCipherValidForSafeMode
MSMSecCreateDefaultProfileStatic
MSMSecGetCopyOfSupportedAuthCiphers
MSMSecGetNetworkCapabilitiesFromBSSDescriptionList
MSMSecProfileValidForSafeMode
MSMSecSanitizeAuthCipherList
MSMSecValidateL2UIRequest
QueryNetconStatus
QueryNetconVirtualCharacteristic
ShouldUseWlanString
SsidToStringW
WFDAbortSessionInt
WFDAcceptConnectRequestAndOpenSessionInt
WFDAcceptGroupRequestAndOpenSessionInt
WFDCancelConnectorPairWithOOB
WFDCancelListenerPairWithOOB
WFDCancelOpenSession
WFDCancelOpenSessionInt
WFDCloseHandle
WFDCloseHandleInt
WFDCloseLegacySessionInt
WFDCloseOOBPairingSession
WFDCloseSession
WFDCloseSessionInt
WFDConfigureFirewallForSessionInt
WFDCreateDHPrivatePublicKeyPairInt
WFDDeclineConnectRequestInt
WFDDeclineGroupRequestInt
WFDDiscoverDeviceServiceInformationInt
WFDDiscoverDevicesExInt
WFDDiscoverDevicesInt
WFDFlushVisibleDeviceListInt
WFDForceDisconnectInt
WFDForceDisconnectLegacyPeerInt
WFDFreeMemoryInt
WFDGetDefaultGroupProfileInt
WFDGetDeviceDescriptorForPendingRequestInt
WFDGetNFCCarrierConfigBlobInt
WFDGetOOBBlob
WFDGetPrimaryAdapterStateInt
WFDGetProfileKeyInfoInt
WFDGetSessionEndpointPairsInt
WFDGetVisibleDevicesExInt
WFDGetVisibleDevicesInt
WFDIsInterfaceWiFiDirect
WFDIsWiFiDirectRunningOnWiFiAdapter
WFDLowPrivCancelOpenSessionInt
WFDLowPrivCloseHandleInt
WFDLowPrivCloseLegacySessionInt
WFDLowPrivCloseSessionInt
WFDLowPrivConfigureFirewallForSessionInt
WFDLowPrivDeclineDeviceApiConnectionRequestInt
WFDLowPrivGetPendingGroupRequestDetailsInt
WFDLowPrivGetSessionEndpointPairsInt
WFDLowPrivIsWfdSupportedInt
WFDLowPrivOpenHandleInt
WFDLowPrivOpenLegacySessionInt
WFDLowPrivOpenSessionByDafObjectIdInt
WFDLowPrivQueryPropertyInt
WFDLowPrivRegisterNotificationInt
WFDLowPrivRegisterVMgrCallerInt
WFDLowPrivSetPropertyInt
WFDLowPrivStartDeviceApiConnectionRequestListenerInt
WFDLowPrivStartUsingGroupInt
WFDLowPrivStopDeviceApiConnectionRequestListenerInt
WFDLowPrivStopUsingGroupInt
WFDLowPrivUnregisterVMgrCallerInt
WFDOpenHandle
WFDOpenHandleInt
WFDOpenLegacySession
WFDOpenLegacySessionInt
WFDPairCancelByDeviceAddressInt
WFDPairCancelInt
WFDPairContinuePairWithDeviceInt
WFDPairEnumerateCeremoniesInt
WFDPairSelectCeremonyInt
WFDPairWithDeviceAndOpenSessionExInt
WFDPairWithDeviceAndOpenSessionInt
WFDParseOOBBlob
WFDParseOOBBlobTypeAndGetPayloadInt
WFDParseProfileXmlInt
WFDParseWfaNfcCarrierConfigBlobInt
WFDQueryPropertyInt
WFDRegisterNotificationInt
WFDRegisterVMgrCallerInt
WFDResetSelectedWfdMgrInt
WFDSetAdditionalIEsInt
WFDSetPropertyInt
WFDSetSecondaryDeviceTypeListInt
WFDSetSelectedWfdMgrInt
WFDStartBackgroundDiscoveryInt
WFDStartConnectorPairWithOOB
WFDStartListenerPairWithOOB
WFDStartOffloadedDiscoveryInt
WFDStartOpenSession
WFDStartOpenSessionInt
WFDStartUsingGroupExInt
WFDStartUsingGroupInt
WFDStopBackgroundDiscoveryInt
WFDStopDiscoverDevicesExInt
WFDStopDiscoverDevicesInt
WFDStopOffloadedDiscoveryInt
WFDStopUsingGroupInt
WFDSvcLowPrivAcceptSessionInt
WFDSvcLowPrivCancelSessionInt
WFDSvcLowPrivCloseSessionInt
WFDSvcLowPrivConfigureSessionInt
WFDSvcLowPrivConnectSessionInt
WFDSvcLowPrivGetProvisioningInfoInt
WFDSvcLowPrivGetSessionEndpointPairsInt
WFDSvcLowPrivOpenAdvertiserSessionInt
WFDSvcLowPrivOpenSeekerSessionInt
WFDSvcLowPrivPublishServiceInt
WFDSvcLowPrivUnpublishServiceInt
WFDUnregisterVMgrCallerInt
WFDUpdateDeviceVisibility
WiFiDisplayResetSinkStateInt
WiFiDisplaySetSinkClientHandleInt
WiFiDisplaySetSinkStateInt
WlanAllocateMemory
WlanAllocateProfileIpConfiguration
WlanCancelPlap
WlanCloseHandle
WlanConnect
WlanConnectEx
WlanConnectWithInput
WlanDeinitPlapParams
WlanDeleteProfile
WlanDeviceServiceCommand
WlanDisconnect
WlanDoPlap
WlanDoesBssMatchSecurity
WlanEnumAllInterfaces
WlanEnumInterfaces
WlanExtractPsdIEDataList
WlanFreeMemory
WlanGenerateProfileXmlBasicSettings
WlanGenerateProfileXmlBasicSettingsWithTransitionMode
WlanGetAvailableNetworkList
WlanGetAvailableNetworkList2
WlanGetExtensibilityInfo
WlanGetFilterList
WlanGetInterfaceCapability
WlanGetMFPNegotiated
WlanGetNetworkBssList
WlanGetProfile
WlanGetProfileCustomUserData
WlanGetProfileEapUserDataInfo
WlanGetProfileIndex
WlanGetProfileKeyInfo
WlanGetProfileList
WlanGetProfileMetadata
WlanGetProfileMetadataWithProfileGuid
WlanGetProfileSsidList
WlanGetRadioInformation
WlanGetSecuritySettings
WlanGetStoredRadioState
WlanGetSupportedDeviceServices
WlanHostedNetworkForceStart
WlanHostedNetworkForceStop
WlanHostedNetworkFreeWCNSettings
WlanHostedNetworkHlpQueryEverUsed
WlanHostedNetworkInitSettings
WlanHostedNetworkQueryProperty
WlanHostedNetworkQuerySecondaryKey
WlanHostedNetworkQueryStatus
WlanHostedNetworkQueryWCNSettings
WlanHostedNetworkRefreshSecuritySettings
WlanHostedNetworkSetProperty
WlanHostedNetworkSetSecondaryKey
WlanHostedNetworkSetWCNSettings
WlanHostedNetworkStartUsing
WlanHostedNetworkStopUsing
WlanIhvControl
WlanInitPlapParams
WlanInternalCancelFTMRequest
WlanInternalGetNetworkBssListWithFTMData
WlanInternalNonDisruptiveScan
WlanInternalNonDisruptiveScanEx
WlanInternalRequestFTM
WlanInternalScan
WlanIsActiveConsoleUser
WlanIsNetworkSuppressed
WlanIsUIRequestPending
WlanLowPrivCloseHandle
WlanLowPrivEnumInterfaces
WlanLowPrivFreeMemory
WlanLowPrivNotifyVsIeProviderInt
WlanLowPrivOpenHandle
WlanLowPrivQueryInterface
WlanLowPrivSetInterface
WlanNotifyVsIeProviderExInt
WlanNotifyVsIeProviderInt
WlanOpenHandle
WlanParseProfileXmlBasicSettings
WlanPrivateCanDeleteProfile
WlanPrivateClearAnqpCache
WlanPrivateDeleteProfile
WlanPrivateGetAnqpCacheResponse
WlanPrivateGetAnqpVenueUrl
WlanPrivateGetAvailableNetworkList
WlanPrivateGetBssInfo
WlanPrivateParseAnqpRawData
WlanPrivateQuery11adPairedConfig
WlanPrivateQueryInterface
WlanPrivateQuerySignalStrength
WlanPrivateRefreshAnqpCache
WlanPrivateSetInterface
WlanPrivateSetLocationPrivacyFlags
WlanPrivateSetProfile
WlanProfileIpConfigurationGetAddressList
WlanProfileIpConfigurationGetDnsServerConfigurationList
WlanProfileIpConfigurationGetDnsServerList
WlanProfileIpConfigurationGetGatewayList
WlanQueryAutoConfigParameter
WlanQueryCreateAllUserProfileRestricted
WlanQueryInterface
WlanQueryPlapCredentials
WlanQueryPreConnectInput
WlanQueryVirtualInterfaceType
WlanReasonCodeToString
WlanRefreshConnections
WlanRegisterDeviceServiceNotification
WlanRegisterNotification
WlanRegisterVirtualStationNotification
WlanRemoveUIForwardingNetworkList
WlanRenameProfile
WlanSaveTemporaryProfile
WlanScan
WlanSendUIResponse
WlanSetAllUserProfileRestricted
WlanSetAutoConfigParameter
WlanSetExtensibilityInfo
WlanSetFilterList
WlanSetInterface
WlanSetProfile
WlanSetProfileCustomUserData
WlanSetProfileEapUserData
WlanSetProfileEapXmlUserData
WlanSetProfileList
WlanSetProfileListForOffload
WlanSetProfileMetadata
WlanSetProfilePosition
WlanSetProtectedScenario
WlanSetPsdIEDataList
WlanSetSecuritySettings
WlanSetUIForwardingNetworkList
WlanSignalValueToBar
WlanSignalValueToBarEx
WlanSsidToDisplayName
WlanStartAP
WlanStartMovementDetector
WlanStopAP
WlanStopMovementDetector
WlanStoreRadioStateOnEnteringAirPlaneMode
WlanStringToSsid
WlanStringToUtf8Ssid
WlanTryUpgradeCurrentConnectionAuthCipher
WlanUpdateBasicProfileSecurity
WlanUpdateProfileWithAuthCipher
WlanUtf8SsidToDisplayName
WlanVMgrQueryCurrentScenariosInt
WlanVerifyProfileIpConfiguration
WlanWcmDisconnect
WlanWcmGetInterface
WlanWcmGetProfileList
WlanWcmSetInterface
WlanWcmSetProfile
WlanWfdGOSetWCNSettings
WlanWfdGetPeerInfo
WlanWfdStartGO
WlanWfdStopGO
WpAllocMemory
WpDuplicateProfile
WpFreeMemory
WpFreeProfile
WpGenerateProfileXml
WpLoadProfile
WpParseProfileXml
WpSaveProfile
WpValidateProfile
Name
.text
Size
392KB
Virtual Size
390KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
132KB
Virtual Size
129KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=74, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33145,
count=5, id=259, version=33145,
count=1332, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=30, id=261, version=33145,
count=1, id=256, version=33145,
count=73, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wlancfg.dll
- IMPHASH 806629f966c211f64cd0c3f394010cc9
- SHA256 ee7cca4d73e816316251bf29d5b2e129a48e819cefd35e06aa5ae548ab8e0e5b
- MD5 4e9130b2ec22962c94900211a3085a9d
- SHA1 94d428635efd3dd9d277536920acf1249d43575e
- SHA512 eda4c2cf26797e3b4bf3197ff63eb29f8efb42a7e61d36a2edafc8e83c07fa5a2c01d88781060ddc27e4f473834a11def747ce69f5ddfe57dfc0537d2e86b52c
- SSDEEP 6144:PcNKevlAFsw8OMIA3Dvc+/r2riurpq06mGmhCo:kNDAF5MI0v5o6vT
- TLSH T18E84391EA7F80454E572817C89778212E2B37878273296DF12A8C47E5B27FE4A778F05
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5936
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wlancfg.pdb
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
_Mtx_unlock
_Mtx_lock
_Mtx_init_in_situ
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_destroy_in_situ
api-ms-win-crt-string-l1-1-0
memset
wcscmp
api-ms-win-crt-runtime-l1-1-0
__doserrno
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__isatty
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsicmp
memmove
_o__wfopen_s
_o__wgetenv_s
_o__wsplitpath_s
_o__wtoi
_o_exit
_o_fclose
_o_floor
_o_free
_o_iswdigit
_o_iswxdigit
_o_malloc
_o_memcpy_s
_o_toupper
_o_towlower
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__execute_onexit_table
_o__errno
_o__dup2
_o__dup
_o__fileno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vfwprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___acrt_iob_func
strrchr
wcschr
wcsstr
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
ntdll
RtlLookupFunctionEntry
RtlVirtualUnwind
NtOpenFile
RtlNtStatusToDosError
EtwTraceMessage
RtlCaptureContext
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
LoadStringW
DisableThreadLibraryCalls
LockResource
GetModuleFileNameA
FindResourceExW
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleExW
LoadResource
SizeofResource
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
RaiseException
SetLastError
SetUnhandledExceptionFilter
GetLastError
api-ms-win-security-cryptoapi-l1-1-0
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
InitializeCriticalSectionEx
WaitForSingleObject
CreateSemaphoreExW
LeaveCriticalSection
ReleaseSemaphore
InitializeCriticalSection
ReleaseMutex
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseSRWLockShared
CreateMutexExW
AcquireSRWLockShared
DeleteCriticalSection
api-ms-win-core-heap-l1-1-0
HeapReAlloc
GetProcessHeap
HeapSize
HeapFree
HeapDestroy
HeapAlloc
rpcrt4
RpcStringFreeW
UuidToStringW
iphlpapi
GetAdaptersAddresses
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
api-ms-win-core-file-l1-1-0
GetTempFileNameW
GetFileAttributesW
FileTimeToLocalFileTime
CreateDirectoryW
ReadFile
CompareFileTime
WriteFile
FindFirstFileW
SetFilePointer
RemoveDirectoryW
GetFileInformationByHandle
CreateFileA
DeleteFileA
DeleteFileW
FindClose
FindNextFileW
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetExitCodeProcess
TerminateProcess
GetCurrentProcess
CreateThread
GetCurrentProcessId
OpenProcessToken
CreateProcessW
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-shlwapi-legacy-l1-1-0
PathStripPathW
PathFileExistsW
PathRemoveFileSpecW
PathFindFileNameW
PathRenameExtensionW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
SetHandleInformation
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-sysinfo-l1-1-0
GetLocalTime
GetVersionExW
GetSystemWindowsDirectoryW
GetSystemTimeAsFileTime
GetTickCount
GetSystemTime
api-ms-win-security-base-l1-1-0
CopySid
GetSidLengthRequired
GetSidSubAuthority
InitializeSid
CheckTokenMembership
IsValidSid
GetLengthSid
GetTokenInformation
api-ms-win-core-processenvironment-l1-1-0
GetStdHandle
ExpandEnvironmentStringsW
api-ms-win-core-console-l1-1-0
GetConsoleMode
SetConsoleMode
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
FileTimeToSystemTime
api-ms-win-core-datetime-l1-1-0
GetTimeFormatW
GetDateFormatW
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegGetValueW
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegCloseKey
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-file-l2-1-0
MoveFileExW
api-ms-win-core-file-l2-1-2
CopyFileW
api-ms-win-core-file-l1-2-3
GetTempPath2A
GetTempPath2W
api-ms-win-shell-shdirectory-l1-1-0
ord290
api-ms-win-core-path-l1-1-0
PathCchAppend
api-ms-win-core-registry-l2-1-0
RegOpenKeyW
api-ms-win-eventing-controller-l1-1-0
ControlTraceW
api-ms-win-core-namedpipe-l1-1-0
CreatePipe
api-ms-win-core-kernel32-legacy-l1-1-0
GetComputerNameW
FileTimeToDosDateTime
cabinet
ord13
ord11
ord10
ord14
api-ms-win-core-file-l1-2-2
GetTempFileNameA
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpW
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
cfgmgr32
CM_Get_DevNode_Status_Ex
netsh.exe
MatchEnumTag
PrintMessageFromModule
RegisterHelper
MatchTagsInCmdLine
RegisterContext
wlanapi
WlanHostedNetworkRefreshSecuritySettings
WlanHostedNetworkSetProperty
WlanGetInterfaceCapability
WlanPrivateQueryInterface
WlanHostedNetworkQueryStatus
WlanEnumAllInterfaces
WlanGetProfileEapUserDataInfo
WlanQueryCreateAllUserProfileRestricted
WlanHostedNetworkSetSecondaryKey
WlanSsidToDisplayName
WlanHostedNetworkForceStart
WlanCloseHandle
WlanQueryAutoConfigParameter
WlanGetFilterList
WlanEnumInterfaces
WlanSetAutoConfigParameter
WlanPrivateSetInterface
WlanFreeMemory
WlanSetFilterList
WlanPrivateGetBssInfo
WlanSetProfilePosition
WlanGetAvailableNetworkList2
WlanDeleteProfile
WlanUtf8SsidToDisplayName
WlanStringToSsid
WlanSetProfile
WlanHostedNetworkQuerySecondaryKey
WlanGetNetworkBssList
WlanQueryInterface
WlanSetProfileList
WlanOpenHandle
WlanReasonCodeToString
WlanSetInterface
WlanConnect
WlanGetProfile
WlanGetProfileList
WlanDisconnect
WlanHostedNetworkQueryProperty
WlanGetAvailableNetworkList
WlanHostedNetworkForceStop
WlanSetAllUserProfileRestricted
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryValueW
GetResourceString
InitHelperDll
Name
.text
Size
256KB
Virtual Size
253KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
84KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
544B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1004B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=110, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=15, id=260, version=33145,
count=5, id=259, version=33145,
count=1383, id=1, productName=Unmarked objects,
count=9, id=257, version=33145,
count=27, id=261, version=33145,
count=1, id=256, version=33145,
count=68, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wlandlg.dll
- IMPHASH c23584b283b51707202a3db3093fce23
- SHA256 9063716f185562039113b17877007efa60677c30531c0b3588fb4102f7db8928
- MD5 73afa9238b43ea766124cc693756991b
- SHA1 c460b4eb8fad3fb8ba6dfbe30bdb551000ed32ce
- SHA512 2c9df0ebacee438cc601b11ada94926dc24c5ccde15634a52a1436b590751312f4540751a267771444f9716e2b4494b70325d8efae2a72c2f6b49bfb9f5ddb2e
- SSDEEP 6144:5KTy00Up13+0Iz4L3FxT11meRpkYKCg25eV:sTHpH1FxTzmevkYKVi
- TLSH T1FF2409AAF819694DE0FFD13AC5668E8441EDB4A9472217DF1157A1ADCEE27C00E703F2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7440
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wlandlg.pdb
msvcrt
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
realloc
_errno
_initterm
_amsg_exit
_XcptFilter
??1type_info@@UEAA@XZ
memcpy
__CxxFrameHandler3
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_callnewh
swprintf_s
memmove
memset
wcsncpy_s
malloc
free
_purecall
wcscat_s
wcscpy_s
memcpy_s
??_V@YAXPEAX@Z
__C_specific_handler
__CxxFrameHandler4
??3@YAXPEAX@Z
ntdll
WinSqmIncrementDWORD
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
advapi32
TraceMessage
EventUnregister
RegOpenKeyExW
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
RegSetValueExW
GetTraceEnableFlags
RegEnumKeyExW
GetTraceLoggerHandle
RegCreateKeyExW
EventRegister
RegQueryInfoKeyW
RegCloseKey
EventWriteTransfer
RegDeleteValueW
user32
SendMessageW
PostMessageW
GetPropW
SetWindowLongPtrW
RemovePropW
LoadStringW
SetPropW
GetParent
UnregisterClassA
CharNextW
ole32
CoCreateInstance
StringFromGUID2
CoTaskMemRealloc
CoTaskMemFree
StringFromCLSID
CoTaskMemAlloc
oleaut32
VariantInit
SysAllocStringByteLen
VariantClear
UnRegisterTypeLi
LoadTypeLi
SysFreeString
RegisterTypeLi
SysAllocString
SysStringLen
VarUI4FromStr
kernel32
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
ActivateActCtx
DeactivateActCtx
CreateActCtxW
ReleaseActCtx
FreeLibrary
GetModuleHandleW
DeleteCriticalSection
GetProcAddress
LoadResource
FindResourceExW
RaiseException
DisableThreadLibraryCalls
GetLastError
MultiByteToWideChar
InitializeCriticalSection
LeaveCriticalSection
GetModuleFileNameW
EnterCriticalSection
SizeofResource
LoadLibraryExW
lstrcmpiW
eappcfg
EapHostPeerFreeMemory
EapHostPeerFreeErrorMemory
wlanapi
WlanFreeMemory
WlanSendUIResponse
ConvertPassPhraseKeyStringToBuffer
WlanAllocateMemory
onex
OneXFreeMemory
onexui
OneXMapEAPHostInteractiveUIToOneXUIResponse
OneXShowUI
dui70
?UserTextChanged@TouchEditBase@DirectUI@@SA?AVUID@@XZ
?SetPasswordCharacter@TouchEditBase@DirectUI@@QEAAJH@Z
?SetMaxLength@TouchEditBase@DirectUI@@QEAAJH@Z
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z
?GetContentString@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z
?Release@Value@DirectUI@@QEAAXXZ
?HasContent@Element@DirectUI@@QEAA_NXZ
?SetVisible@Element@DirectUI@@QEAAJ_N@Z
?SetLayoutPos@Element@DirectUI@@QEAAJH@Z
?SetClass@Element@DirectUI@@QEAAJPEBG@Z
DuiCreateObject
StrToID
?GetEncodedContentString@Element@DirectUI@@QEAAJPEAG_K@Z
?Click@TouchButton@DirectUI@@SA?AVUID@@XZ
?GetID@Element@DirectUI@@QEAAGXZ
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
120KB
Virtual Size
119KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=17, id=260, version=33145,
count=165, id=1, productName=Unmarked objects,
count=25, id=257, version=33145,
count=13, id=261, version=33145,
count=1, id=256, version=33145,
count=15, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wlangpui.dll
- IMPHASH a1730e20ed3efe1134b7d30524ce659e
- SHA256 f935b4ecb0aac3b82784e3e49070c8d64500b6f609e997f72b61e92a445aeecc
- MD5 5c256c8c3ae666356dba15a54c7776a9
- SHA1 93a6460bf1627b1462b37b99df1552623ab6edab
- SHA512 d0a7ac32d7b62c3819a700464ade2613e6ef32a829f312b882d16dd279ccbb65cbd5bb2781d40d3d1734b31bb7dd925db4dd0dadac9c70f89281c9accd7042c1
- SSDEEP 6144:RplK52T/GN4unUpOiI+4oU7Ysu3n3YGFpPnKA/YbWjrxXILsVOP+toXY:RK5sOiIdoou3noG5nKA/Vj1YBy
- TLSH T13F94181EE7B80168E166813C8A538E09E272F478139366CF2664C17E9F1BFF05A78F55
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
8576
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wlangpui.pdb
mfc42u
ord1043
ord629
ord3740
ord2408
ord2427
ord1574
ord286
ord3830
ord3790
ord1441
ord1647
ord1122
ord624
ord2975
ord5887
ord6886
ord5584
ord5585
ord5583
ord5304
ord5114
ord5352
ord5687
ord5246
ord5406
ord2517
ord6437
ord4365
ord1777
ord4752
ord5663
ord2399
ord5586
ord6812
ord4694
ord5709
ord4017
ord5227
ord4789
ord2670
ord2060
ord6814
ord3933
ord5484
ord1736
ord5683
ord2457
ord2140
ord5699
ord3049
ord3243
ord3362
ord4815
ord3231
ord3366
ord3052
ord3166
ord3046
ord4082
ord4083
ord4077
ord3164
ord4371
ord4988
ord4771
ord5382
ord999
ord551
ord2906
ord4612
ord1287
ord2876
ord2121
ord5804
ord6821
ord5815
ord6832
ord1499
ord1677
ord2676
ord1498
ord567
ord1005
ord2846
ord1259
ord568
ord1006
ord1355
ord5950
ord6880
ord6223
ord3872
ord659
ord1063
ord4214
ord2752
ord1426
ord3916
ord4770
ord4983
ord3534
ord6053
ord5711
ord5730
ord5065
ord4368
ord5724
ord5722
ord3468
ord1463
ord5615
ord1388
ord4191
ord6071
ord2515
ord2559
ord4836
ord6813
ord2593
ord6440
ord1778
ord4747
ord5712
ord5229
ord3501
ord3806
ord665
ord912
ord2586
ord4741
ord3535
ord3743
ord822
ord2329
ord4257
ord2902
ord6393
ord2661
ord6385
ord561
ord1003
ord6588
ord1365
ord2532
ord3177
ord1404
ord3396
ord6351
ord4375
ord3234
ord2856
ord4424
ord1906
ord4582
ord549
ord6418
ord5077
ord4699
ord4722
ord4860
ord2629
ord6705
ord6708
ord2422
ord2023
ord4542
ord2589
ord4743
ord3751
ord832
ord2328
ord6767
ord6326
ord3180
ord867
ord3774
ord6614
ord625
ord1781
ord6328
ord4131
ord4344
ord2384
ord2311
ord1123
ord5912
ord6706
ord1442
ord1443
ord6147
ord6395
ord372
ord2518
ord3652
ord6021
ord6216
ord852
ord3417
ord1812
ord337
ord4557
ord5245
ord5702
ord4721
ord1082
ord288
ord812
ord1544
ord1586
ord1555
ord1583
ord1585
ord355
ord1477
ord1553
ord1416
ord1491
ord1577
ord1284
ord4473
ord3754
ord287
ord6887
ord620
ord626
ord1126
ord2412
ord1040
msvcrt
memmove_s
??0exception@@QEAA@XZ
realloc
time
__CxxFrameHandler4
_wtoi
calloc
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
memcpy_s
iswxdigit
_wcsnset_s
wcscat_s
??0exception@@QEAA@AEBQEBD@Z
_wcsdup
wcscpy_s
swprintf_s
__CxxFrameHandler3
_CxxThrowException
_XcptFilter
_amsg_exit
??0exception@@QEAA@AEBV0@@Z
wcsncpy_s
_initterm
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_lock
memcmp
__RTDynamicCast
_unlock
__dllonexit
_onexit
memcpy
_vsnwprintf
_purecall
_wcsicmp
__C_specific_handler
malloc
towlower
iswdigit
free
memset
atl
ord30
ord16
ord21
ord15
ord18
ord22
ord43
ord44
ord32
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleExW
GetModuleFileNameA
LoadStringW
LoadLibraryExA
GetProcAddress
GetModuleHandleW
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionEx
CreateSemaphoreExW
InitializeCriticalSection
AcquireSRWLockShared
WaitForSingleObject
WaitForSingleObjectEx
LeaveCriticalSection
EnterCriticalSection
ReleaseSemaphore
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseMutex
DeleteCriticalSection
OpenSemaphoreW
ReleaseSRWLockShared
CreateMutexExW
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
ws2_32
WSACleanup
WSAStartup
api-ms-win-core-heap-l2-1-0
LocalFree
GlobalFree
LocalAlloc
GlobalAlloc
api-ms-win-core-errorhandling-l1-1-0
RaiseException
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
OutputDebugStringA
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegCloseKey
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegDeleteValueW
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
GetSystemWindowsDirectoryW
api-ms-win-core-file-l1-1-0
FileTimeToLocalFileTime
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
api-ms-win-core-datetime-l1-1-0
GetTimeFormatW
GetDateFormatW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-localization-l1-2-0
FormatMessageW
rpcrt4
UuidToStringW
RpcStringFreeW
api-ms-win-core-synch-l1-2-0
WakeAllConditionVariable
SleepConditionVariableSRW
Sleep
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-kernel32-legacy-l1-1-0
GetComputerNameW
api-ms-win-core-sidebyside-l1-1-0
ReleaseActCtx
CreateActCtxW
QueryActCtxW
ActivateActCtx
DeactivateActCtx
FindActCtxSectionStringW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpW
lstrcmpiW
l2gpstore
L2GPPolicyDataRead
L2GPPolicyFreeMem
L2GPPolicyDataWrite
L2GPPolicyDataDelete
L2GPPolicyStoreClose
L2GPPolicyStoreOpen
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-memory-l1-1-0
VirtualAlloc
VirtualFree
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-processthreads-l1-1-1
FlushInstructionCache
api-ms-win-core-interlocked-l1-1-0
InterlockedPopEntrySList
InterlockedPushEntrySList
ntdll
EtwTraceMessage
api-ms-win-ntuser-sysparams-l1-1-0
GetSystemMetrics
api-ms-win-ole32-ie-l1-1-0
CoInitialize
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetAdPolicyAsXML
GetWmiPolicyAsXML
Name
.text
Size
292KB
Virtual Size
289KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
96KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
736B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=76, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=19, id=260, version=33145,
count=11, id=257, version=33145,
count=500, id=1, productName=Unmarked objects,
count=15, id=261, version=33145,
count=1, id=256, version=33145,
count=84, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wlanhlp.dll
- SHA256 17c633b6408427ce987b0168ac4d2f369e2c310d0b9ab6ef6e426945c0bb330a
- MD5 0cbe55e261bd5763428e25e05b17ff99
- SHA1 ba35bf430190cebae0fd892775886d146f98fc1c
- SHA512 c2edef3abf83451a13cfc0b68de08147c161a69cfb6e800ad35c226a666e3b9dda98c0c58cd4c203538efbde97be4e4408df1e516c99671c8663943212473aac
- SSDEEP 192:quT8i3xBVw44mW3AKCyUNULr9sUYc20l1c1VHg0i5XxWiouQskHfbwuEwgAIjo7c:qZiNwYW3AKOVHg0tu33mRALkWMpWu8
- TLSH T17DB22DC2E3D40562EEAE9B3FCCF046D56E6F840768B9901D3EC62707CD9B6903298656
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wlanhlp.pdb
AcmGenerateConnectionId
AcmGenerateConnectionIdForNotification
AcmGenerateNetworkId
ConvertFrequencyToBandChannel
ConvertPassPhraseKeyStringToBuffer
FreeMSMSecConfig
MSMSecAuthCipherValidForSafeMode
MSMSecCreateDefaultProfileStatic
MSMSecGetCopyOfSupportedAuthCiphers
MSMSecGetNetworkCapabilitiesFromBSSDescriptionList
MSMSecProfileValidForSafeMode
MSMSecSanitizeAuthCipherList
MSMSecValidateL2UIRequest
QueryNetconStatus
QueryNetconVirtualCharacteristic
ShouldUseWlanString
SsidToStringW
WFDAbortSessionInt
WFDAcceptConnectRequestAndOpenSessionInt
WFDAcceptGroupRequestAndOpenSessionInt
WFDCancelConnectorPairWithOOB
WFDCancelListenerPairWithOOB
WFDCancelOpenSessionInt
WFDCloseHandleInt
WFDCloseLegacySessionInt
WFDCloseOOBPairingSession
WFDCloseSessionInt
WFDConfigureFirewallForSessionInt
WFDCreateDHPrivatePublicKeyPairInt
WFDDeclineConnectRequestInt
WFDDeclineGroupRequestInt
WFDDiscoverDeviceServiceInformationInt
WFDDiscoverDevicesExInt
WFDDiscoverDevicesInt
WFDFlushVisibleDeviceListInt
WFDForceDisconnectInt
WFDForceDisconnectLegacyPeerInt
WFDFreeMemoryInt
WFDGetDefaultGroupProfileInt
WFDGetDeviceDescriptorForPendingRequestInt
WFDGetNFCCarrierConfigBlobInt
WFDGetOOBBlob
WFDGetPrimaryAdapterStateInt
WFDGetProfileKeyInfoInt
WFDGetSessionEndpointPairsInt
WFDGetVisibleDevicesExInt
WFDGetVisibleDevicesInt
WFDIsInterfaceWiFiDirect
WFDIsWiFiDirectRunningOnWiFiAdapter
WFDLowPrivCancelOpenSessionInt
WFDLowPrivCloseHandleInt
WFDLowPrivCloseLegacySessionInt
WFDLowPrivCloseSessionInt
WFDLowPrivConfigureFirewallForSessionInt
WFDLowPrivDeclineDeviceApiConnectionRequestInt
WFDLowPrivGetPendingGroupRequestDetailsInt
WFDLowPrivGetSessionEndpointPairsInt
WFDLowPrivIsWfdSupportedInt
WFDLowPrivOpenHandleInt
WFDLowPrivOpenLegacySessionInt
WFDLowPrivOpenSessionByDafObjectIdInt
WFDLowPrivQueryPropertyInt
WFDLowPrivRegisterNotificationInt
WFDLowPrivRegisterVMgrCallerInt
WFDLowPrivSetPropertyInt
WFDLowPrivStartDeviceApiConnectionRequestListenerInt
WFDLowPrivStartUsingGroupInt
WFDLowPrivStopDeviceApiConnectionRequestListenerInt
WFDLowPrivStopUsingGroupInt
WFDLowPrivUnregisterVMgrCallerInt
WFDOpenHandleInt
WFDOpenLegacySessionInt
WFDPairCancelByDeviceAddressInt
WFDPairCancelInt
WFDPairContinuePairWithDeviceInt
WFDPairEnumerateCeremoniesInt
WFDPairSelectCeremonyInt
WFDPairWithDeviceAndOpenSessionExInt
WFDPairWithDeviceAndOpenSessionInt
WFDParseOOBBlob
WFDParseOOBBlobTypeAndGetPayloadInt
WFDParseProfileXmlInt
WFDParseWfaNfcCarrierConfigBlobInt
WFDQueryPropertyInt
WFDRegisterNotificationInt
WFDRegisterVMgrCallerInt
WFDResetSelectedWfdMgrInt
WFDSetAdditionalIEsInt
WFDSetPropertyInt
WFDSetSecondaryDeviceTypeListInt
WFDSetSelectedWfdMgrInt
WFDStartBackgroundDiscoveryInt
WFDStartConnectorPairWithOOB
WFDStartListenerPairWithOOB
WFDStartOffloadedDiscoveryInt
WFDStartOpenSessionInt
WFDStartUsingGroupExInt
WFDStartUsingGroupInt
WFDStopBackgroundDiscoveryInt
WFDStopDiscoverDevicesExInt
WFDStopDiscoverDevicesInt
WFDStopOffloadedDiscoveryInt
WFDStopUsingGroupInt
WFDSvcLowPrivAcceptSessionInt
WFDSvcLowPrivCancelSessionInt
WFDSvcLowPrivCloseSessionInt
WFDSvcLowPrivConfigureSessionInt
WFDSvcLowPrivConnectSessionInt
WFDSvcLowPrivGetProvisioningInfoInt
WFDSvcLowPrivGetSessionEndpointPairsInt
WFDSvcLowPrivOpenAdvertiserSessionInt
WFDSvcLowPrivOpenSeekerSessionInt
WFDSvcLowPrivPublishServiceInt
WFDSvcLowPrivUnpublishServiceInt
WFDUnregisterVMgrCallerInt
WiFiDisplayResetSinkStateInt
WiFiDisplaySetSinkClientHandleInt
WiFiDisplaySetSinkStateInt
WlanCancelPlap
WlanConnectWithInput
WlanDeinitPlapParams
WlanDoPlap
WlanDoesBssMatchSecurity
WlanEnumAllInterfaces
WlanGenerateProfileXmlBasicSettings
WlanGenerateProfileXmlBasicSettingsWithTransitionMode
WlanGetExtensibilityInfo
WlanGetMFPNegotiated
WlanGetProfileEapUserDataInfo
WlanGetProfileIndex
WlanGetProfileKeyInfo
WlanGetProfileMetadata
WlanGetProfileMetadataWithProfileGuid
WlanGetProfileSsidList
WlanGetRadioInformation
WlanGetStoredRadioState
WlanHostedNetworkFreeWCNSettings
WlanHostedNetworkHlpQueryEverUsed
WlanHostedNetworkQueryWCNSettings
WlanHostedNetworkSetWCNSettings
WlanInitPlapParams
WlanInternalCancelFTMRequest
WlanInternalGetNetworkBssListWithFTMData
WlanInternalNonDisruptiveScan
WlanInternalNonDisruptiveScanEx
WlanInternalRequestFTM
WlanInternalScan
WlanIsNetworkSuppressed
WlanIsUIRequestPending
WlanLowPrivCloseHandle
WlanLowPrivEnumInterfaces
WlanLowPrivFreeMemory
WlanLowPrivNotifyVsIeProviderInt
WlanLowPrivOpenHandle
WlanLowPrivQueryInterface
WlanLowPrivSetInterface
WlanNotifyVsIeProviderExInt
WlanNotifyVsIeProviderInt
WlanParseProfileXmlBasicSettings
WlanPrivateClearAnqpCache
WlanPrivateGetAnqpCacheResponse
WlanPrivateGetAnqpVenueUrl
WlanPrivateGetAvailableNetworkList
WlanPrivateParseAnqpRawData
WlanPrivateRefreshAnqpCache
WlanPrivateSetLocationPrivacyFlags
WlanQueryCreateAllUserProfileRestricted
WlanQueryPlapCredentials
WlanQueryPreConnectInput
WlanQueryVirtualInterfaceType
WlanRefreshConnections
WlanRemoveUIForwardingNetworkList
WlanSendUIResponse
WlanSetAllUserProfileRestricted
WlanSetExtensibilityInfo
WlanSetProfileMetadata
WlanSetProtectedScenario
WlanSetUIForwardingNetworkList
WlanStartAP
WlanStartMovementDetector
WlanStopAP
WlanStopMovementDetector
WlanStoreRadioStateOnEnteringAirPlaneMode
WlanTryUpgradeCurrentConnectionAuthCipher
WlanUpdateProfileWithAuthCipher
WlanVMgrQueryCurrentScenariosInt
WlanWcmDisconnect
WlanWcmGetInterface
WlanWcmGetProfileList
WlanWcmSetInterface
WlanWcmSetProfile
WlanWfdGOSetWCNSettings
WlanWfdGetPeerInfo
WlanWfdStartGO
WlanWfdStopGO
WpAllocMemory
WpDuplicateProfile
WpFreeMemory
WpFreeProfile
WpGenerateProfileXml
WpLoadProfile
WpParseProfileXml
WpSaveProfile
WpValidateProfile
Name
.rdata
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wlanmsm.dll
- IMPHASH 7757f8f64beb66207688c1b484b302b8
- SHA256 12a21260f571d8c0961ca6c35213a5ef6f8cbc42f58aecfa7c8e8c33e024e740
- MD5 95b7f5a124cdaf3ba4cd24fc29f23e20
- SHA1 850a476cebb684f71c59962214f35c326a7906cc
- SHA512 40a42a0d0322ac919cda79db261316f1a6ddce42d5824a61f884e54a96984f72aaef37ee58cd3e2d83b3fbeb639420032447189542846c3dfa95d2b2e70ea173
- SSDEEP 6144:KvrUMkseZHgw2LL/0QmROVs9SKEHV/THFw5L8sFQHYvBK/:KvrUMkseZHGsQmROVg5E1LHFRs8CU
- TLSH T113B44C5E63F81ABAE0F6927999C74306E3B074192B3057CB537085792F17BF05A3A34A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
9040
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wlanmsm.pdb
api-ms-win-crt-string-l1-1-0
memset
wcscmp
__isascii
wcsnlen
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsnicmp
_o__wcsnset_s
_o__wgetenv
_o_free
_o_isupper
_o_malloc
_o_mbtowc
_o_memcpy_s
_o_tolower
_o_towupper
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o__execute_onexit_table
_o__errno
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
__CxxFrameHandler3
_CxxThrowException
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__C_specific_handler
wcschr
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA
FreeLibrary
DisableThreadLibraryCalls
GetProcAddress
LoadStringW
GetModuleHandleExA
api-ms-win-core-synch-l1-1-0
WaitForSingleObjectEx
CreateSemaphoreExW
CreateEventW
ResetEvent
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
ReleaseSemaphore
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
InitializeCriticalSection
ReleaseSRWLockShared
OpenSemaphoreW
SetEvent
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
LeaveCriticalSection
ReleaseMutex
InitializeCriticalSectionEx
WaitForSingleObject
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
SetLastError
UnhandledExceptionFilter
RaiseException
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
OpenThreadToken
TerminateProcess
OpenProcessToken
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
CreateProcessW
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventEnabled
EventWrite
EventActivityIdControl
EventRegister
EventUnregister
EventWriteTransfer
api-ms-win-eventing-classicprovider-l1-1-0
UnregisterTraceGuids
GetTraceEnableFlags
RegisterTraceGuidsW
TraceMessage
GetTraceEnableLevel
GetTraceLoggerHandle
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
GetTickCount64
GetVersionExW
api-ms-win-core-heap-l2-1-0
LocalFree
rpcrt4
RpcImpersonateClient
RpcBindingVectorFree
RpcServerUnregisterIfEx
RpcRevertToSelf
RpcServerRegisterAuthInfoW
RpcServerRegisterIfEx
RpcEpRegisterW
RpcServerInqBindings
RpcServerUseProtseqW
RpcBindingInqAuthClientW
RpcStringBindingParseW
RpcBindingToStringBindingW
NdrServerCall2
NdrServerCallAll
NdrClientCall3
RpcBindingFree
RpcStringBindingComposeW
RpcBindingFromStringBindingW
UuidCreate
UuidToStringW
RpcStringFreeW
I_RpcExceptionFilter
RpcEpResolveBinding
RpcBindingSetOption
RpcMgmtInqServerPrincNameW
RpcBindingSetAuthInfoExW
RpcEpUnregister
iphlpapi
ConvertInterfaceGuidToLuid
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-threadpool-legacy-l1-1-0
CreateTimerQueueTimer
DeleteTimerQueueTimer
CreateTimerQueue
DeleteTimerQueueEx
QueueUserWorkItem
ChangeTimerQueueTimer
nsi
NsiSetParameter
ntdll
EtwEventActivityIdControl
WinSqmSetDWORD
WinSqmIsOptedIn
EtwEventWriteTransfer
EtwTraceMessage
NtOpenFile
RtlGetDeviceFamilyInfoEnum
NtWaitForSingleObject
NtDeviceIoControlFile
RtlFreeUnicodeString
RtlStringFromGUID
WinSqmAddToAverageDWORD
EtwEventWrite
WinSqmIncrementDWORD
RtlNtStatusToDosError
wlanapi
WlanSignalValueToBar
wlansec
MSMSecStopSecurity
MSMSecConnectionHealthCheck
MSMSecRecvIndication
MSMSecRecvPacket
MSMSecUIResponse
MSMSecIsUIRequestPending
MSMSecCreateDiscoveryProfiles
MSMSecStopPostAssociateSecurity
MSMSecPerformPreAssociateSecurityEx
MSMSecGetPeerIpAddress
MSMSecInitializeAdapter
MSMSecSendPktCompletion
MSMSecRedoSecurity
MSMSecFreeMemory
MSMSecFreeProfile
MSMSecPerformCapabilityMatch
MSMSecSetRuntimeState
MSMSecProcessSessionChange
MSMSecDeinitialize
MSMSecInitialize
MSMSecPerformPostAssociateSecurity
MSMSecSetWcnOneXEnable
MSMSecSetAPSecondaryPSK
MSMSecQueryAPPeerPSKIndex
MSMSecPerformPreAssociateSecurity
MSMSecSetAPPeerKey
MSMSecRemoveAPPeerKey
MSMSecEnableIpAddressAllocation
MSMSecDisableIpAddressAllocation
MSMSecDeinitializeAdapter
api-ms-win-core-file-l1-1-0
CreateFileW
ReadFile
WriteFile
api-ms-win-core-io-l1-1-1
CancelIo
api-ms-win-core-io-l1-1-0
CancelIoEx
DeviceIoControl
bcrypt
BCryptCreateHash
BCryptHashData
BCryptDestroyHash
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptFinishHash
BCryptCloseAlgorithmProvider
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-security-base-l1-1-0
GetLengthSid
CopySid
IsValidSid
GetTokenInformation
EqualSid
ws2_32
htons
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-kernel32-legacy-l1-1-0
BindIoCompletionCallback
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
onex
OneXCreateSupplicantPort
OneXDestroySupplicantPort
OneXIndicatePacket
OneXCreateDiscoveryProfiles
OneXSetRuntimeState
OneXAddEapAttributes
OneXFreeMemory
OneXUIResponse
OneXQueryPendingUIRequest
OneXStopAuthentication
OneXIndicateSessionChange
OneXStartAuthentication
OneXUpdatePortProfile
OneXReasonCodeToString
Dot11MsmDeInit
Dot11MsmInit
InitializeDll
Name
.text
Size
412KB
Virtual Size
409KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
64KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=257, version=33145,
count=85, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1350, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33145,
count=5, id=259, version=33145,
count=28, id=261, version=33145,
count=1, id=256, version=33145,
count=114, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,