ztrace_maps.zip
- SHA256 245b59e45e6e62cc7d4dd018e77a682611195eb70028afc16e906ff89d715ae8
Overview
overview
7Static
static
3WSDPrintProxy.dll
windows10-2004-x64
1WSDScanProxy.dll
windows10-2004-x64
1WSHTCPIP.dll
windows10-2004-x64
1WSManMigra...in.dll
windows10-2004-x64
1WUDFCoinstaller.dll
windows10-2004-x64
1WUDFPlatform.dll
windows10-2004-x64
1WUDFx.dll
windows10-2004-x64
1WUDFx02000.dll
windows10-2004-x64
1WWanAPI.dll
windows10-2004-x64
1WsdProviderUtil.dll
windows10-2004-x64
1WsmAgent.dll
windows10-2004-x64
1WsmAuto.dll
windows10-2004-x64
1WsmRes.dll
windows10-2004-x64
1WsmSvc.dll
windows10-2004-x64
1WsmWmiPl.dll
windows10-2004-x64
1WudfSMCClassExt.dll
windows10-2004-x64
1WwaApi.dll
windows10-2004-x64
7WwaExt.dll
windows10-2004-x64
1WwanPrfl.dll
windows10-2004-x64
1WwanRadioManager.dll
windows10-2004-x64
1XAudio2_8.dll
windows10-2004-x64
1XAudio2_9.dll
windows10-2004-x64
1XInput1_4.dll
windows10-2004-x64
1XInput9_1_0.dll
windows10-2004-x64
1XInputUap.dll
windows10-2004-x64
1XamlTileRender.dll
windows10-2004-x64
1XblAuthManager.dll
windows10-2004-x64
1XblAuthMan...xy.dll
windows10-2004-x64
1XblAuthTok...xt.dll
windows10-2004-x64
1XblGameSave.dll
windows10-2004-x64
1XblGameSaveExt.dll
windows10-2004-x64
1XblGameSaveProxy.dll
windows10-2004-x64
7Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
WSDPrintProxy.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
WSDScanProxy.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
WSHTCPIP.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
WSManMigrationPlugin.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
WUDFCoinstaller.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
WUDFPlatform.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
WUDFx.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
WUDFx02000.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
WWanAPI.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
WsdProviderUtil.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
WsmAgent.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
WsmAuto.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
WsmRes.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
WsmSvc.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
WsmWmiPl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
WudfSMCClassExt.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
WwaApi.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral18
Sample
WwaExt.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
WwanPrfl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
WwanRadioManager.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
XAudio2_8.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
XAudio2_9.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
XInput1_4.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
XInput9_1_0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
XInputUap.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
XamlTileRender.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
XblAuthManager.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
XblAuthManagerProxy.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
XblAuthTokenBrokerExt.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
XblGameSave.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
XblGameSaveExt.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
XblGameSaveProxy.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target ztrace_maps.zip
- Size 12.0MB
- Sample260812-gn3mbazelf
- SHA256 245b59e45e6e62cc7d4dd018e77a682611195eb70028afc16e906ff89d715ae8
- MD5 fda1bc2805a24f39aff1ce3392583146
- SHA1 cf29a9f5316897e9d5aa0db36cd50558393621ac
- SHA512 32459b6052bf3e9a9907bd4ac131f467d5c11b85669ddd6933cdf61d54900ca2a4e93abb89ae2217bc3745124ee4929c62e06babaa65372769541606df417eec
- SSDEEP 393216:QGHfSsfXKEeQ5yEG0DPiGhyxXmY0FMmVdi:QGK88syEG0D1sxXmY0FMmS
- TLSH T152D63360F5D80918FC99F3398518F802D1E11A1A8FAC50D975B32C607EB9E618F6BF5A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 71 IoCs
Checks for missing Authenticode signature.
resource unpack001/WSDPrintProxy.DLL unpack001/WSDScanProxy.dll unpack001/WSHTCPIP.DLL unpack001/WSManMigrationPlugin.dll unpack001/WUDFCoinstaller.dll unpack001/WUDFx.dll unpack001/WsdProviderUtil.dll unpack001/WsmAgent.dll unpack001/WsmAuto.dll unpack001/WsmRes.dll unpack001/WsmSvc.dll unpack001/WsmWmiPl.dll unpack001/WudfSMCClassExt.dll unpack001/WwaApi.dll unpack001/WwaExt.dll unpack001/WwanPrfl.dll unpack001/WwanRadioManager.dll unpack001/XAudio2_8.dll unpack001/XAudio2_9.dll unpack001/XInput1_4.dll unpack001/XInput9_1_0.dll unpack001/XInputUap.dll unpack001/XamlTileRender.dll unpack001/XblAuthManager.dll unpack001/XblAuthManagerProxy.dll unpack001/XblAuthTokenBrokerExt.dll unpack001/XblGameSave.dll unpack001/XblGameSaveExt.dll unpack001/XblGameSaveProxy.dll unpack001/XboxGipRadioManager.dll unpack001/XboxNetApiSvc.dll unpack001/XpsDocumentTargetPrint.dll unpack001/XpsGdiConverter.dll unpack001/XpsPrint.dll unpack001/XpsRasterService.dll unpack001/XpsToPclmConverter.dll unpack001/XpsToPwgrConverter.dll unpack001/XpsToTiffConverter.dll unpack001/wsecedit.dll unpack001/wsepno.dll unpack001/wshbth.dll unpack001/wshcon.dll unpack001/wshelper.dll unpack001/wshext.dll unpack001/wship6.dll unpack001/wshqos.dll unpack001/wshrm.dll unpack001/wslapi.dll unpack001/wsmplpxy.dll unpack001/wsnmp32.dll unpack001/wsock32.dll unpack001/wsplib.dll unpack001/wuceffects.dll unpack001/wudriver.dll unpack001/wvc.dll unpack001/wwancfg.dll unpack001/wwanprotdim.dll unpack001/wwansvc.dll unpack001/xboxgipsvc.dll unpack001/xboxgipsynthetic.dll unpack001/xmlprovi.dll unpack001/xolehlp.dll unpack001/xpspushlayer.dll unpack001/xpsservices.dll unpack001/xwizards.dll unpack001/xwreg.dll unpack001/xwtpdui.dll unpack001/xwtpw32.dll unpack001/zipcontainer.dll unpack001/zipfldr.dll unpack001/ztrace_maps.dll
File Explorer
-
ztrace_maps.zip.zip 12.0MB
-
WSDPrintProxy.DLL.dll 116KB
-
WSDScanProxy.dll.dll 88KB
-
WSHTCPIP.DLL.dll 32KB
-
WSManMigrationPlugin.dll.dll 108KB
-
WUDFCoinstaller.dll.dll 104KB
-
WUDFPlatform.dll.dll 267KB
-
WUDFx.dll.dll 676KB
-
WUDFx02000.dll.dll 820KB
-
WWanAPI.dll.dll 546KB
-
WsdProviderUtil.dll.dll 52KB
-
WsmAgent.dll.dll 60KB
-
WsmAuto.dll.dll 192KB
-
WsmRes.dll.dll 68KB
-
WsmSvc.dll.dll 2.6MB
-
WsmWmiPl.dll.dll 328KB
-
WudfSMCClassExt.dll.dll 76KB
-
WwaApi.dll.dll 528KB
-
WwaExt.dll.dll 64KB
-
WwanPrfl.dll.dll 144KB
-
WwanRadioManager.dll.dll 116KB
-
XAudio2_8.dll.dll 12KB
-
XAudio2_9.dll.dll 576KB
-
XInput1_4.dll.dll 108KB
-
XInput9_1_0.dll.dll 36KB
-
XInputUap.dll.dll 96KB
-
XamlTileRender.dll.dll 288KB
-
XblAuthManager.dll.dll 1.0MB
-
XblAuthManagerProxy.dll.dll 136KB
-
XblAuthTokenBrokerExt.dll.dll 112KB
-
XblGameSave.dll.dll 828KB
-
XblGameSaveExt.dll.dll 196KB
-
XblGameSaveProxy.dll.dll 64KB
-
XboxGipRadioManager.dll.dll 92KB
-
XboxNetApiSvc.dll.dll 1.2MB
-
XpsDocumentTargetPrint.dll.dll 380KB
-
XpsGdiConverter.dll.dll 384KB
-
XpsPrint.dll.dll 1.1MB
-
XpsRasterService.dll.dll 1.2MB
-
XpsToPclmConverter.dll.dll 212KB
-
XpsToPwgrConverter.dll.dll 116KB
-
XpsToTiffConverter.dll.dll 100KB
-
wsecedit.dll.dll 736KB
-
wsepno.dll.dll 100KB
-
wshbth.dll.dll 88KB
-
wshcon.dll.dll 48KB
-
wshelper.dll.dll 44KB
-
wshext.dll.dll 108KB
-
wshhyperv.dll.dll 37KB
-
wship6.dll.dll 32KB
-
wshqos.dll.dll 40KB
-
wshrm.dll.dll 44KB
-
wshunix.dll.dll 41KB
-
wslapi.dll.dll 108KB
-
wsmplpxy.dll.dll 36KB
-
wsnmp32.dll.dll 100KB
-
wsock32.dll.dll 40KB
-
wsp_fs.dll.dll 1.7MB
-
wsp_health.dll.dll 1.4MB
-
wsp_sr.dll.dll 881KB
-
wsplib.dll.dll 68KB
-
wtdccm.dll.dll 77KB
-
wtdhost.dll.dll 53KB
-
wtdsensor.dll.dll 53KB
-
wtsapi32.dll.dll 175KB
-
wuapi.dll.dll 224KB
-
wuaueng.dll.dll 175KB
-
wuceffects.dll.dll 324KB
-
wudriver.dll.dll 128KB
-
wups.dll.dll 141KB
-
wups2.dll.dll 142KB
-
wusys.dll.dll 321KB
-
wvc.dll.dll 556KB
-
wwancfg.dll.dll 236KB
-
wwanprotdim.dll.dll 428KB
-
wwansvc.dll.dll 1.5MB
-
wwapi.dll.dll 203KB
-
xboxgipsvc.dll.dll 128KB
-
xboxgipsynthetic.dll.dll 120KB
-
xmlfilter.dll.dll 157KB
-
xmllite.dll.dll 275KB
-
xmlprovi.dll.dll 52KB
-
xolehlp.dll.dll 92KB
-
xpspushlayer.dll.dll 304KB
-
xpsservices.dll.dll 2.3MB
-
xwizards.dll.dll 448KB
-
xwreg.dll.dll 148KB
-
xwtpdui.dll.dll 280KB
-
xwtpw32.dll.dll 164KB
-
ze_loader.dll.dll 375KB
-
ze_tracing_layer.dll.dll 466KB
-
ze_validation_layer.dll.dll 148KB
-
zipcontainer.dll.dll 116KB
-
zipfldr.dll.dll 608KB
-
ztrace_maps.dll.dll 52KB
WSDPrintProxy.DLL
- IMPHASH f52b16c167cff70890ddd790c544056b
- SHA256 d1fa0353bfa1c2d9c0cea01826f39d4792eb7e040ff2415ce738dc8b44859be7
- MD5 9ee023605b3b70445bb300b5efc489dc
- SHA1 9a0d97711e472d659c3c2d5e18cd92b86f5a075e
- SHA512 73187393056bcd59658c97d4ec67bfa4077788aa83f8e941c13326551a1e8099ff02a75569c881eaca7c0f97ed4ae1d30c973126a58269516e0efa8d76acff3f
- SSDEEP 3072:8WXihYQYM08qRNAokbgpS2FQjbb4yCrFjrr4l:ehYQYM08qFrFXr
- TLSH T1B7C3DD4BAAE8154BE1BA9BB855778D698775BC299F91C2EF0260014D4D73BC08D38F33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5200
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WSDPrintProxy.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___stdio_common_vswprintf
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__register_onexit_function
_o__seh_filter_dll
_o_free
_o_malloc
_o___std_type_info_destroy_list
memcmp
wcschr
__C_specific_handler
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
CreateEventW
DeleteCriticalSection
InitializeCriticalSection
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameW
DisableThreadLibraryCalls
GetModuleHandleExW
api-ms-win-core-heap-l1-1-0
HeapDestroy
rpcrt4
UuidCreate
crypt32
CryptStringToBinaryW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-devices-query-l1-1-0
DevFreeObjectProperties
DevGetObjectProperties
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
28KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=45, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1117, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=4, id=259, version=33145,
count=19, id=261, version=33145,
count=1, id=256, version=33145,
count=9, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WSDScanProxy.dll
- IMPHASH 84f0376ba62c79a221af3683c032d920
- SHA256 2f6a60a68c73f8f7631b092f0d3b063b80796ac53368023c91cb0eab7527e497
- MD5 b3ec63a162712a347a325e6efc74c181
- SHA1 19e7fc21c261d989601c0963880839c8d1297176
- SHA512 e31d4b94363589f459b7b9916d67ea1f395fbc18a07854a4f64332e3f8b83ff87b7d007784c8dc02b8ee620ec10cba92a43d9fba7dd08bc2fe109d35a9564d2b
- SSDEEP 768:7xNGsPdG+TAHKwYAJYLW6IwrtRIEqz2juHxQOuaHfQ26DpExkwoedXOdgC0dFRyL:9PdG+TAHKwYAKLNIw6d+dZ0pHXxdw
- TLSH T1329330A66BFC2911E4BA5B3C58774D15E535FE691F51C6EF02A0020DAE62BC08E30F72
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5168
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WSDScanProxy.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___stdio_common_vswprintf
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__register_onexit_function
_o__seh_filter_dll
_o_free
_o_malloc
_o___std_type_info_destroy_list
__C_specific_handler
api-ms-win-crt-string-l1-1-0
memset
atl
ord21
ord15
ord32
ord16
advapi32
TraceMessage
GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
kernel32
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
LeaveCriticalSection
EnterCriticalSection
RtlCaptureContext
DisableThreadLibraryCalls
InitializeCriticalSection
GetModuleFileNameW
CloseHandle
GetLastError
CreateEventW
WaitForSingleObject
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
GetCurrentProcess
DeleteCriticalSection
TerminateProcess
ole32
PropVariantClear
oleaut32
SysAllocString
SysFreeString
rpcrt4
UuidCreate
wsdapi
WSDFreeLinkedMemory
WSDDetachLinkedMemory
WSDCreateHttpAddress
WSDCreateDeviceProxyAdvanced
WSDXMLCreateContext
WSDSetConfigurationOption
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
20KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=257, version=33145,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1113, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=4, id=259, version=33145,
count=19, id=261, version=33145,
count=1, id=256, version=33145,
count=7, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WSHTCPIP.DLL
- IMPHASH 81af26da75b32f0cdf22d424213bb9a6
- SHA256 16ac1aed18660dc229644e5c11e2d5190c61a7b6cf250f2d09d7118bcd76ba83
- MD5 7c327a38dab841744d1f4ba1753f9048
- SHA1 eed580f8fa24a45b8f7305dda7e044120564c6cb
- SHA512 d6cbd9ce6caa83c0a0ccc93f9d65c70a492e5e266b09fcd65d2f17acef8528b33396f6e7dd53626a635297dee2620312eacda9635f4026d51bba30de905cfcfc
- SSDEEP 192:WX39nsrhOkV9Mdtpme9Hhxp62tlWEDWSn:Wd8OU9Kpzm0lWEDWSn
- TLSH T17EE2D84573D9257AF578C33C84A70B1AB979701087734BEF5AE4827A1D21BD0B930F95
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5296
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wshtcpip.pdb
ntdll
RtlUnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlIpv4StringToAddressExW
RtlCaptureContext
RtlAllocateHeap
_wcsicmp
RtlIpv4AddressToStringExW
RtlInitUnicodeString
RtlIntegerToUnicodeString
RtlIpv6AddressToStringExW
NtTerminateProcess
RtlAppendUnicodeStringToString
LdrDisableThreadCalloutsForDll
memmove
ws2_32
ntohs
WSAGetLastError
setsockopt
WSHAddressToString
WSHEnumProtocols
WSHGetBroadcastSockaddr
WSHGetProviderGuid
WSHGetSockaddrType
WSHGetSocketInformation
WSHGetWSAProtocolInfo
WSHGetWildcardSockaddr
WSHGetWinsockMapping
WSHIoctl
WSHJoinLeaf
WSHNotify
WSHOpenSocket
WSHOpenSocket2
WSHSetSocketInformation
WSHStringToAddress
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
192B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=257, version=33136,
count=19, id=1, productName=Unmarked objects,
count=5, id=260, version=33136,
count=3, id=259, version=33136,
count=2, id=264, version=33136,
count=1, id=256, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
WSManMigrationPlugin.dll
- IMPHASH 422a65279dc0df0c9abac98683491f5e
- SHA256 710f94996c3f1382b488a5b063bbc5fc935c6883289606bb4dd64285a9857fca
- MD5 5ebc3c32f5e1fc73f9f3eb9e8d5607e9
- SHA1 a34f297c1ec7fc57b241c324cc1cfc6322fbab16
- SHA512 866bfe13607d62eeddd83564543a3a34001430eb3c3ced5ed5e9edff73c58239f692d29fe93fb0ddcc7d2624fafb1bc79dce46a0de96514a2fa528d7c57ad4af
- SSDEEP 1536:1UxoYxUhIsepOBMtkCgKPK5qPxulpGX+aQxQUd6VSxRLBd:1Uxo9IseqMtkesqPxe2+7QUdmS/b
- TLSH T13BB3186FA6AD109BE1A9913C85570A06D732F034131267EF53A4C27E5F2BBE05E39F60
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7648
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB paths
WSManMigrationPlugin.pdb
msvcrt
_errno
realloc
_CxxThrowException
_onexit
??1type_info@@UEAA@XZ
__CxxFrameHandler3
?what@exception@@UEBAPEBDXZ
memcmp
__CxxFrameHandler4
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
memcpy
memmove
_XcptFilter
_amsg_exit
__dllonexit
??0exception@@QEAA@AEBQEBD@Z
_purecall
_ultow_s
wcsstr
wcsrchr
memmove_s
_vsnwprintf
wcscat_s
wcscpy_s
memcpy_s
free
malloc
wcsncpy_s
_unlock
_lock
?terminate@@YAXXZ
__C_specific_handler
_initterm
memset
oleaut32
LoadTypeLi
SysAllocString
SysAllocStringByteLen
LoadRegTypeLi
VarUI4FromStr
SysFreeString
GetErrorInfo
SysStringLen
api-ms-win-core-libraryloader-l1-1-0
FreeLibrary
DisableThreadLibraryCalls
GetProcAddress
LoadLibraryExA
SizeofResource
LoadResource
FindResourceExW
GetModuleFileNameW
LockResource
GetModuleHandleW
LoadLibraryExW
api-ms-win-core-com-l1-1-0
CoTaskMemRealloc
CoCreateInstance
StringFromCLSID
StringFromGUID2
CoTaskMemAlloc
CoTaskMemFree
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-errorhandling-l1-1-0
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
api-ms-win-core-localization-l1-2-0
GetThreadLocale
SetThreadLocale
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
ReleaseSRWLockExclusive
DeleteCriticalSection
AcquireSRWLockExclusive
EnterCriticalSection
InitializeCriticalSection
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage
api-ms-win-core-heap-l1-1-0
HeapSize
HeapReAlloc
HeapDestroy
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-heap-obsolete-l1-1-0
LocalFree
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemInfo
GetSystemTimeAsFileTime
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
wsmsvc
??0AutoBstr@@QEAA@PEAG@Z
??1AutoBstr@@QEAA@XZ
??1?$AutoDeleteVector@G@@QEAA@XZ
?Free@WSManMemory@@SAXPEAXH@Z
?Alloc@WSManMemory@@SAPEAX_KHW4_NitsFaultMode@@@Z
?Error@EventLog@@SAXKGPEAPEBG@Z
HandleMigration
??0?$AutoDeleteVector@G@@QEAA@PEAG@Z
WSManError
??1CWSManCriticalSection@@QEAA@XZ
api-ms-win-core-memory-l1-1-0
VirtualQuery
VirtualProtect
??0?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@XZ
??0?$SafeMap_Iterator@VKey@Locale@@K@@QEAA@AEAV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@_N@Z
??0?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@AEBV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@_N@Z
??1?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@XZ
??1?$SafeMap_Iterator@VKey@Locale@@K@@QEAA@XZ
??1?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@XZ
??1CWSManCriticalSectionWithConditionVar@@QEAA@XZ
??_7?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@6B@
?Acquire@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEBAXXZ
?Acquire@?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAAXXZ
?Acquired@?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA_NXZ
?AsReference@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAAAEAV1@XZ
?Data@?$SafeMap_Iterator@VKey@Locale@@K@@IEBAAEAV?$STLMap@VKey@Locale@@K@@XZ
?DeInitialize@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEAA_NAEAVIRequestContext@@@Z
?GetInitError@CWSManCriticalSection@@QEBAKXZ
?GetMap@?$SafeMap_Iterator@VKey@Locale@@K@@QEBAAEAV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@XZ
?GetMap@?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEBAAEBV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@XZ
?Initialize@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEAA_NAEAVIRequestContext@@@Z
?IsValid@?$SafeMap_Iterator@VKey@Locale@@K@@QEBA_NXZ
?Release@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEBAXXZ
?Reset@?$SafeMap_Iterator@VKey@Locale@@K@@QEAAXXZ
?SkipOrphans@?$SafeMap_Iterator@VKey@Locale@@K@@IEAAXXZ
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
Name
.text
Size
52KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=48, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=16, id=260, version=33145,
count=149, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=9, id=261, version=33145,
count=1, id=256, version=33145,
count=11, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WUDFCoinstaller.dll
- IMPHASH 98992b11df1382afbfc41394fee88a63
- SHA256 5888c3c9f4832ceaa1239a4b0a4230b30fd71d09d20a7eab43343caecaa5d0ff
- MD5 66743e749bfcbb736ad639f49fdfe178
- SHA1 695b1e4f567b233b38e81599c7d2b498a1639ae8
- SHA512 79e4b34418c886648b6c353d87150a72fb2e5b959155780badfd3fc603af01393d3c905abdbd09e0d1899f86fa9ef714fee05be9b1cb61ee0f465f8529bb0fd4
- SSDEEP 1536:ZTKXvae3TJ5NpR3JK0wI1h4r91mqbsm0RM4En4GKAm1M:ZSvjJpCI1h4rzmqbmK4E4VAm1M
- TLSH T194A3A34813FD20A8F4B7AB78897945159AB2BC656B3193EF0390C47D1F72BC09D79B22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
51680
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WUDFCoinstaller.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__configure_narrow_argv
_o__crt_atexit
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memcpy
_o__wcsicmp
_o__wcstoui64
_o_free
_o_malloc
_o_memcpy_s
_o_wcstoul
__C_specific_handler
_o___stdio_common_vsnwprintf_s
_o__cexit
wcsrchr
_o___std_type_info_destroy_list
_o__callnewh
memcmp
api-ms-win-crt-string-l1-1-0
memset
memmove_s
kernel32
WaitForSingleObject
WaitForThreadpoolTimerCallbacks
InitializeCriticalSectionEx
LeaveCriticalSection
ReleaseSemaphore
EnterCriticalSection
HeapFree
CreateSemaphoreExW
GetModuleFileNameA
SetThreadpoolTimer
ReleaseSRWLockShared
CreateThreadpoolTimer
HeapAlloc
ReleaseSRWLockExclusive
OutputDebugStringW
CloseThreadpoolTimer
GetProcessHeap
DebugBreak
GetSystemWindowsDirectoryW
CloseHandle
CreateFileW
LocalFree
FormatMessageW
GetVersionExW
GetModuleHandleExW
SetLastError
GetProcAddress
GetLastError
ReleaseMutex
AcquireSRWLockExclusive
OpenSemaphoreW
GetModuleHandleW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetLocalTime
CreateMutexExW
AcquireSRWLockShared
DeleteCriticalSection
WaitForSingleObjectEx
advapi32
EventWriteTransfer
EventRegister
RegOpenKeyExW
EventUnregister
RegCloseKey
RegSetValueExW
RegCreateKeyExW
setupapi
SetupInstallFromInfSectionW
SetupGetFieldCount
SetupDiGetDeviceInstanceIdW
SetupOpenInfFileW
SetupGetStringFieldW
SetupDiGetSelectedDriverW
SetupDiGetActualSectionToInstallExW
SetupDiGetDriverInfoDetailW
SetupFindFirstLineW
SetupGetIntField
SetupFindNextMatchLineW
SetupGetLineCountW
SetupDiOpenDevRegKey
SetupCloseInfFile
SetupOpenAppendInfFileW
SetupDiCreateDevRegKeyW
SetupOpenLog
SetupLogErrorW
SetupCloseLog
ole32
StringFromGUID2
CLSIDFromString
shlwapi
SHDeleteKeyW
CoDeviceInstall
Name
.text
Size
52KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
196B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=257, version=33145,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1162, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=18, id=261, version=33145,
count=1, id=256, version=33145,
count=9, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WUDFPlatform.dll
- IMPHASH 7a7ed537bc62538fdeaf726c0b267a4a
- SHA256 33c9bd25ee89af181dea1c5288236dee623b95071759f6f6a56a4284c0307701
- MD5 07143cc35df05f6ce204cf77253a1560
- SHA1 f41fe8c586e8df4dc856cc59dee4f2469f5a6933
- SHA512 c48480a88fc65cb584506a7723445003c80703a91558ac304f0854337b518abf2bfd9c95eb3c32dca81ec20ce7b11041d8fa9aaa0e604f18d2c2503a59dff80f
- SSDEEP 3072:67a5TaHeAuvzDOAplCfjN9qrM0nz9zJuzufL1CqJL4uxhhVv8j5kW5aDfWPLgpUs:GHyvmUlCf3qrM0z5MzA5JLR3vTWqSs
- TLSH T16F44F71A63F91489F1B76A3899B64611A6727C606B34D6CF02A0863C2F73FD4ED35723
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
57:3b:e0:c1:07:7d:fa:51:55:f0:07:9a:20:18:af:b1:b4:02:bc:63:4c:87:6a:3f:3a:52:f5:48:ee:97:b6:75
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:3605-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:13:b0:43:35:66:cf:af:95:e8:00:01:00:00:02:13
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
58320
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WUDFPlatform.pdb
api-ms-win-crt-string-l1-1-0
memset
wcscspn
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcslwr_s
_o__wcsnicmp
_o_iswalpha
_o_wcscpy_s
_o__cexit
_o___stdio_common_vsnwprintf_s
_o___std_type_info_destroy_list
__C_specific_handler
memcmp
memcpy
ntdll
RtlCreateServiceSid
RtlAnsiStringToUnicodeString
RtlSetDaclSecurityDescriptor
NtAlpcCancelMessage
RtlAddAccessAllowedAce
RtlCreateAcl
NtCancelSynchronousIoFile
RtlNtStatusToDosError
NtAlpcConnectPort
AlpcGetMessageAttribute
RtlCaptureStackBackTrace
NtAlpcSetInformation
NtCreateDirectoryObject
NtClose
DbgPrintEx
NtAlpcDeletePortSection
NtAlpcDeleteResourceReserve
RtlInitAnsiString
RtlLengthSid
LdrEnumerateLoadedModules
RtlCaptureContext
vDbgPrintEx
NtQuerySystemInformation
DbgBreakPoint
NtAlpcDisconnectPort
NtAlpcSendWaitReceivePort
NtAlpcCreatePortSection
NtAlpcCreateResourceReserve
RtlLookupFunctionEntry
NtAlpcCreateSectionView
NtAlpcImpersonateClientOfPort
NtAlpcCreateSecurityContext
NtAlpcDeleteSectionView
NtAlpcAcceptConnectPort
AlpcInitializeMessageAttribute
NtAlpcCreatePort
RtlCreateSecurityDescriptor
NtAlpcDeleteSecurityContext
RtlVirtualUnwind
RtlInitUnicodeString
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-processthreads-l1-1-0
TlsGetValue
GetProcessId
GetCurrentProcess
TlsFree
TlsAlloc
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
OpenProcessToken
CreateThread
TlsSetValue
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-file-l1-1-0
DeleteFileW
CreateFileW
GetLongPathNameW
WriteFile
GetFullPathNameW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionEx
LeaveCriticalSection
ReleaseSemaphore
EnterCriticalSection
OpenEventW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WaitForSingleObjectEx
ReleaseMutex
ReleaseSRWLockShared
CreateMutexExW
AcquireSRWLockShared
DeleteCriticalSection
CreateEventW
CancelWaitableTimer
SetWaitableTimer
CreateWaitableTimerExW
OpenSemaphoreW
WaitForSingleObject
CreateSemaphoreExW
SetEvent
ResetEvent
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
SetLastError
RaiseException
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetLocalTime
GetSystemInfo
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
api-ms-win-core-io-l1-1-0
CancelIoEx
api-ms-win-security-base-l1-1-0
AllocateAndInitializeSid
AllocateLocallyUniqueId
AdjustTokenPrivileges
GetTokenInformation
InitializeAcl
AddAccessAllowedAce
CreateWellKnownSid
SetTokenInformation
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetModuleHandleExW
GetModuleFileNameA
LoadLibraryExA
FreeLibrary
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventSetInformation
EventWriteTransfer
EventRegister
api-ms-win-eventing-classicprovider-l1-1-0
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage
api-ms-win-core-version-l1-1-0
GetFileVersionInfoSizeExW
VerQueryValueW
GetFileVersionInfoExW
api-ms-win-core-misc-l1-1-0
FormatMessageW
lstrcmpW
LocalAlloc
LocalFree
api-ms-win-core-psapi-obsolete-l1-1-0
K32GetModuleInformation
api-ms-win-downlevel-kernel32-l1-1-0
VirtualQuery
VirtualProtect
ExpandEnvironmentStringsW
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
InitializeSListHead
ClearPlatformTestingCallbacks
DllGetClassObject
DllMain
GetAndInitializePlatformObject
GetPlatformObject
InitializePlatformLibrary
PlatformSimulateUnhandledException
PlatformUnhandledExceptionFilter
SetPlatformErrorReportingCallbacks
SetPlatformTestingCallbacks
ShutdownPlatformLibrary
WdfGetLpcInterface
WudfDebugBreakPoint
WudfIsAnyDebuggerPresent
WudfIsKernelDebuggerPresent
WudfIsUserDebuggerPresent
WudfWaitForDebugger
Name
.text
Size
124KB
Virtual Size
121KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
56KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
240B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
48KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=53, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1242, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=14, id=261, version=33145,
count=1, id=256, version=33145,
count=34, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WUDFx.dll
- IMPHASH 5f4c5378e2695d0f50dcfea8de110167
- SHA256 781fb2d7b0add0bdf2c0623fdf31d87736032953fc55a521c9419686f25922ac
- MD5 835a96dc5d7c79f8d68c4b6f6d25b2d8
- SHA1 e1bb5989be7b5a59fd6b4bde1c3348e8fec194a4
- SHA512 a4cc7457138eca9c87f5ce8b5a9312223532f652713a8d7ebc573e036a01f67a22da13fe7c2321e3d58830e53499482db8da06f6c1203651aed4c014d501be19
- SSDEEP 6144:r7IrpkFwT51dRtTK+C8O0ZVoc6ZkYpnP5zHqGaAeecReUHG8L4iyz9l6N7pK77Z1:r7IrpkCBTvC8O0ZuFHzHqGaA5UUi10
- TLSH T185E4390EA7F824D5D6BFC07A86474607EB7474642752B7CB0960C279AF3BBE4283A711
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
257184
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WUDFx.pdb
msvcrt
strchr
wcschr
realloc
_wcsicmp
_callnewh
memmove
memcpy
memcmp
_onexit
memmove_s
_XcptFilter
_amsg_exit
_initterm
_errno
_lock
_unlock
__dllonexit
_vsnprintf_s
wcsncpy_s
malloc
free
_purecall
memcpy_s
__C_specific_handler
_vsnwprintf_s
memset
ntdll
RtlInitAnsiString
RtlCompareMemory
RtlAnsiStringToUnicodeString
RtlCompareUnicodeString
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
DbgPrint
RtlInitUnicodeString
RtlQueryRegistryValues
kernel32
UnregisterWaitEx
CreateWaitableTimerA
GetVersionExA
LoadLibraryA
CancelWaitableTimer
SetWaitableTimer
IsDebuggerPresent
AcquireSRWLockShared
GetModuleHandleA
SleepEx
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
HeapFree
GetCurrentThreadId
CloseThreadpoolWait
CreateEventW
GetLastError
WaitForThreadpoolWaitCallbacks
SetEvent
CreateThreadpoolWait
CloseHandle
SetThreadpoolWait
HeapAlloc
GetProcessHeap
DebugBreak
CloseThreadpool
CreateThreadpool
SetThreadpoolThreadMinimum
SetThreadpoolThreadMaximum
GetSystemInfo
ResetEvent
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SizeofResource
GetModuleFileNameW
InitializeCriticalSection
MultiByteToWideChar
RaiseException
FindResourceExW
LoadResource
GetProcAddress
GetModuleHandleW
FreeLibrary
lstrcmpiW
LoadLibraryExW
WaitForSingleObject
GetCurrentThread
GetCurrentProcess
DuplicateHandle
WaitForSingleObjectEx
CreateTimerQueue
DeleteTimerQueueEx
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
SetLastError
GetModuleHandleExW
DisableThreadLibraryCalls
ExpandEnvironmentStringsW
Sleep
CreateFileW
CreateMutexExW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
GetModuleFileNameA
CreateSemaphoreExW
ReleaseSemaphore
InitializeCriticalSectionEx
WaitForThreadpoolTimerCallbacks
ReleaseMutex
FormatMessageW
ReleaseSRWLockExclusive
OutputDebugStringW
CloseThreadpoolTimer
AcquireSRWLockExclusive
OpenSemaphoreW
SetThreadpoolTimer
ReleaseSRWLockShared
CreateThreadpoolTimer
RegisterWaitForSingleObject
advapi32
UnregisterTraceGuids
EventWriteTransfer
TraceMessage
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegEnumValueW
EventRegister
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
TraceMessageVa
EventUnregister
RegQueryValueExW
RegCloseKey
RegQueryInfoKeyW
oleaut32
VarUI4FromStr
SysStringLen
user32
UnregisterClassA
CharNextW
api-ms-win-core-com-l1-1-0
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
DllCanUnloadNow
DllGetClassObject
Microsoft_WDF_UMDF_Version
Name
.text
Size
496KB
Virtual Size
494KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
PAGEWdfV
Size
4KB
Virtual Size
62B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
128KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
24KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=17, id=260, version=33145,
count=168, id=1, productName=Unmarked objects,
count=13, id=257, version=33145,
count=5, id=261, version=33145,
count=1, id=256, version=33145,
count=114, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WUDFx02000.dll
- IMPHASH 2f3961e2ce336475f582925bfe5c1a17
- SHA256 6404c811cdda1288c5e96bbd5936e22e2109910e3798c5519410cf9ef05ec72a
- MD5 6e1b652ea8e981832edef65174b447b2
- SHA1 eaa58f60efa0c0978abb9da81e548c5e05e657ee
- SHA512 daea9b2f832e694e0b36bb47801550862e5f4fe4dab00666ab34a96228e011eb4f8a4c3a9d22cc54c506c71b3d9edab940aa0bd68db0cd672f0936ec7745acac
- SSDEEP 12288:5ewiIHna8lKSFdybxQr08++KknwV/tODkjWuY42:5jFlKEdyKQ/knAtQuYn
- TLSH T13C055B19A7B820D5D9BBD07DCA47921BFBB474242321B6CB096086799F37FE4163E318
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
43:0c:b4:8a:21:29:e6:bb:92:07:c7:82:75:80:25:3c:66:0f:0a:c4:e5:87:29:59:44:cb:94:a4:8a:3f:bf:1b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:55:46:a8:83:17:24:6f:63:e9:00:00:00:00:05:55
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 13, 2025 - Oct 18, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8900-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:22:41:d2:f6:aa:ff:c8:b5:ff:00:01:00:00:02:22
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
360512
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Wudfx02000.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
__C_specific_handler
_o__cexit
_o___stdio_common_vsnwprintf_s
_o___std_type_info_destroy_list
wcsrchr
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
ntdll
RtlVirtualUnwind
RtlPrefixUnicodeString
RtlLookupFunctionEntry
RtlCaptureContext
RtlCaptureStackBackTrace
RtlInitAnsiString
RtlAnsiStringToUnicodeString
RtlInitUnicodeString
RtlCompareUnicodeString
RtlGetVersion
RtlQueryRegistryValuesEx
DbgBreakPoint
DbgPrintEx
NtQuerySystemInformation
RtlCompareMemory
ZwDeleteValueKey
ZwQueryKey
RtlEqualUnicodeString
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
SetLastError
GetLastError
UnhandledExceptionFilter
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-libraryloader-l1-1-0
GetModuleHandleExA
GetModuleFileNameA
GetModuleHandleExW
GetProcAddress
GetModuleHandleW
DisableThreadLibraryCalls
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
WaitForSingleObjectEx
ReleaseSRWLockExclusive
ReleaseSRWLockShared
CreateMutexExW
AcquireSRWLockShared
DeleteCriticalSection
ResetEvent
SleepEx
ReleaseMutex
WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection
ReleaseSemaphore
EnterCriticalSection
CreateSemaphoreExW
OpenSemaphoreW
InitializeCriticalSectionAndSpinCount
SetEvent
CreateEventW
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
GetTickCount64
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
WaitForThreadpoolWorkCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpool
CreateThreadpool
SetThreadpoolThreadMinimum
SetThreadpoolThreadMaximum
CloseThreadpoolWait
api-ms-win-core-file-l1-1-0
CreateFileW
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegSetValueExW
RegOpenKeyExW
api-ms-win-core-sysinfo-l1-2-0
GetSystemTimePreciseAsFileTime
api-ms-win-eventing-provider-l1-1-0
EventActivityIdControl
EventWriteTransfer
EventUnregister
EventSetInformation
EventRegister
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessageVa
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
rpcrt4
UuidCreate
FxFrameworkEntryUm
Microsoft_WDF_UMDF_Version
Name
.text
Size
616KB
Virtual Size
615KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
PAGEWdfV
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
116KB
Virtual Size
113KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=33145,
count=45, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1177, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33145,
count=5, id=259, version=33145,
count=14, id=261, version=33145,
count=1, id=256, version=33145,
count=1, id=253, version=33145,
count=177, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WWanAPI.dll
- IMPHASH e8aefe54d553af0593c23a5b28f7a6c1
- SHA256 ac2d07804622a8f1ed9c4c4b6cd59444c8758673b9b93fedd1df2eb4f050fccc
- MD5 6a875e65ffc2aed795b3879d2028332f
- SHA1 e9155e61563181fda4c73cb20bfec2aab48e92be
- SHA512 84a448100b5d44e47a8f601a16fa28f459e8ebcb66cd254b5ff4a8d597daacd33a2463b12ece295813357881a71f9d4259a0e0441ed55ebf2cd2d7a2cc2d6208
- SSDEEP 12288:IuJSTMqQwNwVrf88GHvRDcxZh4xOBeL/Uy:IuJiQwNwV/wYxExOs/Uy
- TLSH T1E7C45B5A7B9404A3D52A937C89934209F67174442753E3CF02AAC3BDBE27BF42E79B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
30:02:34:58:09:ed:0f:1a:dc:89:4a:f3:da:e6:6f:68:c4:2b:6b:4d:3a:69:46:3d:ad:7b:d4:6d:6e:53:9c:1e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6B05-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:11:45:18:39:9b:43:cf:fc:6c:00:01:00:00:02:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
114800
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wwanapi.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o__wcsnset_s
_o_calloc
_o_free
_o_malloc
_o_terminate
_o_wcscpy_s
__current_exception
__current_exception_context
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_CxxThrowException
_o___std_type_info_name
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__C_specific_handler
__std_terminate
__CxxFrameHandler4
__C_specific_handler_noexcept
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
wcsncmp
memset
api-ms-win-core-synch-l1-1-0
InitializeCriticalSection
EnterCriticalSection
TryEnterCriticalSection
SetEvent
ResetEvent
InitializeCriticalSectionEx
ReleaseSRWLockShared
CreateSemaphoreExW
ReleaseSemaphore
CreateEventW
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
ReleaseMutex
AcquireSRWLockShared
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
DeleteCriticalSection
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventSetInformation
EventWriteTransfer
EventRegister
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleExA
DisableThreadLibraryCalls
FreeLibraryAndExitThread
GetModuleHandleW
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetLastError
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
api-ms-win-core-com-l1-1-0
StringFromGUID2
CoTaskMemFree
CoUninitialize
StringFromIID
CoSetProxyBlanket
IIDFromString
CoTaskMemAlloc
CoInitializeEx
CoCreateInstance
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
CreateThread
OpenThreadToken
GetCurrentThread
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetTickCount64
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-core-registry-l1-1-0
RegGetValueW
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CloseThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
SubmitThreadpoolWork
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-handle-l1-1-0
CloseHandle
ntdll
RtlQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlNtStatusToDosError
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlQueryPackageIdentity
api-ms-win-security-base-l1-1-0
ImpersonateSelf
RevertToSelf
GetTokenInformation
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-psapi-l1-1-0
K32GetModuleFileNameExW
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
mobilenetworking
GetPersistentRegPath
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
320KB
Virtual Size
317KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
96KB
Virtual Size
95KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
576B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
68KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=71, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33145,
count=5, id=259, version=33145,
count=27, id=261, version=33145,
count=1250, id=1, productName=Unmarked objects,
count=4, id=257, version=33145,
count=1, id=256, version=33145,
count=92, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WsdProviderUtil.dll
- IMPHASH 17e48993105eee3cf7ff5c967a967c45
- SHA256 6f4f41056a02a1694a2b535afe9d96b805fc3340763afa37d9b53da87d2e67e6
- MD5 94638f85f8092b84d27c5d10b83cca3e
- SHA1 5dd2063460d132d354e2ca34dc43dab8c85f05f5
- SHA512 1f702fdec114596a8d4056edaaf75d65e299f038a901f03f238c1be2bffa7a4f776af84311652aa808d6ca886674b4ea3e0f92d4bcce6e7a7da57db6c99e4c9c
- SSDEEP 384:dmRD6D3TAAmsLb5Ypj6udseqUh4YnOrFt23P/PW7byaLuabb04AGTZzt0rqWjMWO:uG5FYphiesYnOZcuf3LRbo4FTZzK
- TLSH T174332A092BD81DE9F17A427D88635A19E672F8226713C7DF43E0813E0F36BD09A35782
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5056
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WsdProviderUtil.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___stdio_common_vswprintf
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
memcpy
_o___std_type_info_destroy_list
_o__wcsicmp
_o__wcsnicmp
_o_free
_o_iswdigit
_o_iswxdigit
_o_malloc
_o_towlower
__C_specific_handler
_o___std_exception_destroy
_CxxThrowException
_o___std_exception_copy
wcschr
api-ms-win-crt-string-l1-1-0
memset
ntdll
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
winhttp
WinHttpCrackUrl
iphlpapi
GetIpNetEntry2
ResolveIpNetEntry2
api-ms-win-core-com-l1-1-0
CoUninitialize
CLSIDFromString
CoInitializeEx
PropVariantClear
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
ws2_32
FreeAddrInfoW
GetAddrInfoW
oleaut32
SysAllocString
bcrypt
BCryptGetProperty
BCryptCreateHash
BCryptOpenAlgorithmProvider
BCryptFinishHash
BCryptHashData
BCryptDestroyHash
BCryptCloseAlgorithmProvider
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-url-l1-1-0
UrlCombineW
Name
.text
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
924B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
268B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1108, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=20, id=261, version=33145,
count=1, id=256, version=33145,
count=3, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WsmAgent.dll
- IMPHASH f983dffb8863f08f03859fcd327b8921
- SHA256 6a887086b431ade46c0b8c73155ad0721fa3e04758103d22e4e6e194a6e82a9f
- MD5 5ae13008e4c0d116a4b2527f67b5cd80
- SHA1 2ff133035453b32e69b3dc48abca5abf06f3aaee
- SHA512 e75b32b39a257ce058f1ad67724177e593288a29d6652ba5eac187cdbd46c29ec938444f64e17568728a726a38a71e49d0ede05e620fbcd55bd48f2b9f3fe9d2
- SSDEEP 384:KVx4cxXsW4i6THG2tyPEnvq6zCFxJkZJwodUDsMmbVxbSgIVr67yFnV0MZuAWPhP:54shKP8xzCnJkZuodUDsxc9FhZUP5
- TLSH T1B853084AE7F854A8EA72467CD8371E169372F9341B1293DF05B0822D2F677E09634F92
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4784
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wsmagent.pdb
msvcrt
__CxxFrameHandler4
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_purecall
malloc
free
swprintf_s
memset
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
GetTraceEnableFlags
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceLoggerHandle
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
GetSystemDirectoryW
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
api-ms-win-core-libraryloader-l1-1-0
LoadLibraryExW
FreeLibrary
GetProcAddress
DisableThreadLibraryCalls
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcess
OpenThreadToken
GetCurrentProcessId
GetCurrentThreadId
GetCurrentThread
api-ms-win-security-base-l1-1-0
CheckTokenMembership
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
wsmsvc
?Alloc@WSManMemory@@SAPEAX_KHW4_NitsFaultMode@@@Z
??1CWSManCriticalSection@@QEAA@XZ
?GetSid@CSecurity@@SAPEAXXZ
?IsLocalSystemSid@CSecurity@@SAHPEAX@Z
StringIsBlank
??1?$AutoDelete@U_SID@@@@QEAA@XZ
??1AutoImpersonateUser@@QEAA@XZ
??0?$AutoDelete@U_SID@@@@QEAA@PEAU_SID@@@Z
?Free@WSManMemory@@SAXPEAXH@Z
?BeginRevertToSelf@CSecurity@@SAHPEAPEAXK@Z
??0AutoImpersonateUser@@QEAA@XZ
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
??1CWSManCriticalSectionWithConditionVar@@QEAA@XZ
?GetInitError@CWSManCriticalSection@@QEBAKXZ
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
GetProviderClassID
MI_Main
Name
.text
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
756B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
776B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=26, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=261, version=33145,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33145,
count=4, id=259, version=33145,
count=74, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=1, id=256, version=33145,
count=10, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WsmAuto.dll
- IMPHASH 31f3c7163202323b6767e9fb611ae9d3
- SHA256 bb50fbd030353142001f2840ad647f241a5b35c52b710fabd0fb921b0944c892
- MD5 8f105efc5bc8f0678e99ce7e2082d39c
- SHA1 ccd2690d10a63ab9d3b40a1e94d5dfb9a9c78322
- SHA512 42555a048f295d907d4811716b3b85284ab40e40512125baf6147d39ab6dc9597fb22f890acbb3076700bd5fe9c4d9cd50eb6d9bc2f73435f62bb2eaea7f7834
- SSDEEP 3072:9GWxBpA3sw4q+Z/by+7qaPanoUcsBpX3VEAPaxJ:9BxBpa4q+Z/byGtUcW3EHJ
- TLSH T172143B1A379A14ABE1AB933C8C431602D3B2B4644F038BEF15E5433E2EA77D95D35E60
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7216
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WsmAuto.pdb
msvcrt
memcmp
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
__CxxFrameHandler4
memcpy
__CxxFrameHandler3
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_vsnwprintf
_scwprintf
_wcsicmp
wcscpy_s
realloc
wcscat_s
malloc
free
__C_specific_handler
_purecall
memmove
__RTDynamicCast
memset
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
api-ms-win-security-base-l1-1-0
ImpersonateLoggedOnUser
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-handle-l1-1-0
CloseHandle
oleaut32
SysAllocStringLen
VariantClear
VariantChangeTypeEx
VariantInit
SetErrorInfo
CreateErrorInfo
LoadTypeLi
SysAllocString
SysStringLen
RegisterTypeLi
VarUI4FromStr
SysFreeString
api-ms-win-core-threadpool-legacy-l1-1-0
UnregisterWaitEx
api-ms-win-core-heap-obsolete-l1-1-0
LocalAlloc
LocalFree
api-ms-win-core-libraryloader-l1-1-0
LoadLibraryExW
LoadResource
GetModuleHandleW
GetProcAddress
FreeLibrary
DisableThreadLibraryCalls
GetModuleFileNameW
FindResourceExW
SizeofResource
api-ms-win-core-registry-l1-1-0
RegEnumValueW
RegDeleteValueW
RegCloseKey
RegQueryInfoKeyW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegEnumKeyExW
api-ms-win-core-string-l2-1-0
CharNextW
CharPrevW
api-ms-win-core-string-obsolete-l1-1-0
lstrcpynW
lstrcpyW
lstrcmpiW
api-ms-win-core-memory-l1-1-0
VirtualProtect
VirtualAlloc
VirtualQuery
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableLevel
TraceMessage
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceLoggerHandle
api-ms-win-core-heap-l1-1-0
HeapDestroy
api-ms-win-core-processenvironment-l1-1-0
GetCommandLineW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
miutils
RtlReleaseFastLockShared
RtlTryAcquireFastLockShared
RtlReleaseFastLockExclusive
RtlQueueAcquireFastLockExclusive
RtlInterlockedWakeAll
RtlQueueAcquireFastLockShared
RtlTryAcquireFastLockExclusive
RtlInterlockedCompareWait
wsmsvc
FwXmlGetAttributeValue
FwXmlFindAttribute
FwXmlCompareElementName
?GetRoot@XmlReader@@QEAAPEAU_FWXML_ELEMENT@@XZ
?Init@XmlReader@@QEAAHPEAVIRequestContext@@PEAUWSMAN_OBJECT@@@Z
??0CWSManSecurityUI@@QEAA@XZ
StringCchEqualsCI
??1XmlReader@@QEAA@XZ
??0XmlReader@@QEAA@XZ
?ClearOptions@CWSManResourceNoResourceUri@@QEAAHXZ
?AddOption@CWSManResourceNoResourceUri@@QEAAHPEBG0HPEAVIRequestContext@@@Z
?ClearKeys@CWSManResourceNoResourceUri@@QEAAHXZ
?AddKey@CWSManResourceNoResourceUri@@QEAAHPEBG0PEAVIRequestContext@@@Z
?GetLocator@CWSManResource@@QEAAPEAU_WSMAN_RESOURCE_LOCATOR@@XZ
?SetFragmentDialect@CWSManResourceNoResourceUri@@QEAAHPEBGPEAVIRequestContext@@@Z
?SetFragmentPath@CWSManResourceNoResourceUri@@QEAAHPEBGPEAVIRequestContext@@@Z
?GetFragmentPath@CWSManResourceNoResourceUri@@QEAAPEBGXZ
?SetUri@CWSManResource@@QEAAHPEBGPEAVIRequestContext@@@Z
?SetMachineName@CRequestContext@@QEAAKPEBG_K@Z
?GetUri@CWSManResource@@QEAAPEBGXZ
?RecordXml@CRequestContext@@AEAAHKPEAU_FWXML_ELEMENT@@K@Z
?RecordText@CRequestContext@@AEAAHKPEBG_KK@Z
?Init@CWSManSecurityUI@@QEAAHPEAG0PEAVIRequestContext@@@Z
?UpdateKey@CWSManResourceNoResourceUri@@QEAAHPEAVIRequestContext@@PEBG1@Z
?GetFaultXMLPrivate@CRequestContext@@AEAAXPEAPEAD0KHKKPEBG11@Z
?Alloc@WSManMemory@@SAPEAX_KHW4_NitsFaultMode@@@Z
?Free@WSManMemory@@SAXPEAXH@Z
?GetKeyValue@CWSManResourceNoResourceUri@@QEAAPEBGPEBG@Z
?FreeBstr@WSManMemory@@SAXPEAGHH@Z
??0PacketFormatter@@QEAA@XZ
?SetCharsetAndBom@PacketFormatter@@QEAAXW4Charset@1@0@Z
?SetCharset@PacketFormatter@@QEAAXW4Charset@1@@Z
?GetFormat@PacketFormatter@@QEBA?AW4Charset@1@XZ
?Parse@CWSManResource@@SAPEAV1@PEAVIRequestContext@@PEBGH@Z
?InternalParse@CWSManResource@@MEAAHPEAVIRequestContext@@@Z
??0CErrorContext@@QEAA@_N@Z
?Reset@CRequestContext@@UEAAXH@Z
PrintUnregisterWaitTrace
?GetSpaceUsed@CircularBufferFormatter@@UEBAK_N@Z
?GetCalculationSize@CircularBufferFormatter@@UEBAK_N@Z
?Uri@CResourceAlias@@QEAAPEBGXZ
?GetUpdatedSDDL@CWSManSecurityUI@@QEAAPEAGPEAVIRequestContext@@@Z
FwXmlEncodeXmlEscapes
??1CResourceAlias@@QEAA@XZ
?GrowBuffer@CircularBufferFormatter@@UEAAKK@Z
?GrowBuffer@CircularBufferFormatter@@UEAAKXZ
PrintHandleTrace
WSManCloseObjectHandle
??0CWSManResourceNoResourceUri@@QEAA@H@Z
?BuildSelectorSet@CWSManResourceNoResourceUri@@UEAAHAEAVBufferFormatter@@@Z
?BuildFragmentTransfer@CWSManResourceNoResourceUri@@UEAAHAEAVBufferFormatter@@@Z
?IsEPR@CWSManResourceNoResourceUri@@UEAAHXZ
??1CWSManResourceNoResourceUri@@UEAA@XZ
??0CResourceAlias@@QEAA@PEBG@Z
WSManCloseEnumerationHandle
WSManCloseSessionHandle
WSManCreateSessionInternal
WSManEnumerateInternalEx
WSManIdentifyInternal
WSManInvokeInternalEx
WSManDeleteInternalEx
WSManCreateInternalEx
WSManPutInternalEx
??6BufferFormatter@@UEAAAEAV0@AEAVBufferFormatterDataFormatULONGLONG@@@Z
??6BufferFormatter@@UEAAAEAV0@AEAVBufferFormatterDataXmlEscape@@@Z
?RecordFailure@CRequestContext@@UEAAXPEAU_WSMAN_FAULT_OBJECT@@@Z
WSManGetInternalEx
WSManCloseEnumeratorHandle
WSManEnumeratorNextObject
WSManPull
?GrowBuffer@BufferFormatter@@UEAAKXZ
??6BufferFormatter@@UEAAAEAV0@AEAVBufferFormatterDataFormatDWORD@@@Z
FwXmlCloseParser
??6BufferFormatter@@UEAAAEAV0@AEAVBufferFormatterDataPCWSTR@@@Z
?GrowBuffer@BufferFormatter@@UEAAKK@Z
?PrepareToCommitWithSize@BufferFormatter@@UEAAKK@Z
??6BufferFormatter@@UEAAAEAV0@AEAVBufferFormatterDataPUCHAR@@@Z
??6BufferFormatter@@UEAAAEAV0@PEAU_FWXML_ELEMENT@@@Z
??6BufferFormatter@@UEAAAEAV0@K@Z
WSManEncodeObject
??1CWSManCriticalSection@@QEAA@XZ
??0CWSManCriticalSection@@QEAA@XZ
WSManError
?GetString@Locale@@QEAAPEBGXZ
?SetLocale@Locale@@QEAA_NKPEBGPEAVIRequestContext@@@Z
?AllocBstrLen@WSManMemory@@SAPEAGPEBGIHH@Z
WSManDecodeObject
??0Locale@@QEAA@XZ
?GetMessageEmpty@Locale@@QEBAPEBGAEAVAutoLocalFree@@K@Z
??0CRequestContext@@QEAA@XZ
PrintReleaseTrace
?AllocBstr@WSManMemory@@SAPEAGPEBGHH@Z
??1CRequestContext@@UEAA@XZ
WSManMemoryOperation
?GetBuffer@CircularBufferFormatter@@UEAAPEAEXZ
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
??0?$AutoCleanup@V?$AutoDeleteVector@E@@PEAE@@QEAA@PEAE@Z
??0?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@QEAA@PEAG@Z
??0?$AutoCleanup@V?$AutoFree@E@@PEAE@@QEAA@PEAE@Z
??0?$AutoCleanup@V?$AutoRelease@VCRequestContext@@@@PEAVCRequestContext@@@@QEAA@PEAVCRequestContext@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCWSManSecurityUI@@@@PEAVCWSManSecurityUI@@@@QEAA@PEAVCWSManSecurityUI@@@Z
??0?$AutoCleanup@VAutoBstr@@PEAG@@QEAA@PEAG@Z
??0?$AutoCleanup@VAutoBstr@@PEAG@@QEAA@XZ
??0?$AutoCleanup@VAutoBstrNoAlloc@@PEAG@@QEAA@PEAG@Z
??0?$AutoCleanup@VAutoBstrNoAlloc@@PEAG@@QEAA@XZ
??0?$AutoCleanup@VAutoCertContext@@PEBU_CERT_CONTEXT@@@@QEAA@PEBU_CERT_CONTEXT@@@Z
??0?$AutoCleanup@VAutoCertContext@@PEBU_CERT_CONTEXT@@@@QEAA@XZ
??0?$AutoCleanup@VAutoChainContext@@PEBU_CERT_CHAIN_CONTEXT@@@@QEAA@PEBU_CERT_CHAIN_CONTEXT@@@Z
??0?$AutoCleanup@VAutoChainContext@@PEBU_CERT_CHAIN_CONTEXT@@@@QEAA@XZ
??0?$AutoCleanup@VAutoCoTaskMemFree@@PEAX@@QEAA@PEAX@Z
??0?$AutoCleanup@VAutoCoTaskMemFree@@PEAX@@QEAA@XZ
??0?$AutoCleanup@VAutoFwXmlCloseParser@@PEAX@@QEAA@PEAX@Z
??0?$AutoCleanup@VAutoFwXmlCloseParser@@PEAX@@QEAA@XZ
??0?$AutoCleanup@VAutoHandle@@PEAX@@QEAA@PEAX@Z
??0?$AutoCleanup@VAutoHandle@@PEAX@@QEAA@XZ
??0?$AutoCleanup@VAutoImpersonateUser@@PEAX@@QEAA@PEAX@Z
??0?$AutoCleanup@VAutoImpersonateUser@@PEAX@@QEAA@XZ
??0?$AutoCleanup@VAutoLibrary@@PEAUHINSTANCE__@@@@QEAA@PEAUHINSTANCE__@@@Z
??0?$AutoCleanup@VAutoLibrary@@PEAUHINSTANCE__@@@@QEAA@XZ
??0?$AutoCleanup@VAutoLocalFree@@PEAX@@QEAA@PEAX@Z
??0?$AutoCleanup@VAutoLocalFree@@PEAX@@QEAA@XZ
??0?$AutoCleanup@VAutoMIClass@@PEAU_MI_Class@@@@QEAA@PEAU_MI_Class@@@Z
??0?$AutoCleanup@VAutoMIClass@@PEAU_MI_Class@@@@QEAA@XZ
??0?$AutoCleanup@VAutoMIInstance@@PEAU_MI_Instance@@@@QEAA@PEAU_MI_Instance@@@Z
??0?$AutoCleanup@VAutoMIInstance@@PEAU_MI_Instance@@@@QEAA@XZ
??0?$AutoCleanup@VAutoObject@@PEAUWSMAN_OBJECT@@@@QEAA@PEAUWSMAN_OBJECT@@@Z
??0?$AutoCleanup@VAutoObject@@PEAUWSMAN_OBJECT@@@@QEAA@XZ
??0?$AutoCleanup@VAutoRegKey@@PEAUHKEY__@@@@QEAA@PEAUHKEY__@@@Z
??0?$AutoCleanup@VAutoRegKey@@PEAUHKEY__@@@@QEAA@XZ
??0?$AutoCleanup@VAutoSecurityDescriptor@@PEAX@@QEAA@PEAX@Z
??0?$AutoCleanup@VAutoSecurityDescriptor@@PEAX@@QEAA@XZ
??0?$AutoCleanup@VAutoWaitHandle@@PEAX@@QEAA@PEAX@Z
??0?$AutoCleanup@VAutoWaitHandle@@PEAX@@QEAA@XZ
??0?$AutoDeleteVector@E@@QEAA@XZ
??0?$AutoDeleteVector@G@@QEAA@PEAG@Z
??0?$AutoDeleteVector@G@@QEAA@XZ
??0?$AutoFree@E@@QEAA@PEAE@Z
??0?$AutoRelease@VCRequestContext@@@@QEAA@PEAVCRequestContext@@@Z
??0?$AutoRelease@VCWSManSecurityUI@@@@QEAA@XZ
??0?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@XZ
??0?$SafeMap_Iterator@VKey@Locale@@K@@QEAA@AEAV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@_N@Z
??0?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@AEBV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@_N@Z
??0?$SimpleQueue@T_LARGE_INTEGER@@@@QEAA@XZ
??0AutoBstr@@QEAA@PEAG@Z
??0AutoBstr@@QEAA@XZ
??0AutoBstrNoAlloc@@QEAA@PEAG@Z
??0AutoBstrNoAlloc@@QEAA@XZ
??0AutoCertContext@@QEAA@PEBU_CERT_CONTEXT@@@Z
??0AutoCertContext@@QEAA@XZ
??0AutoChainContext@@QEAA@PEBU_CERT_CHAIN_CONTEXT@@@Z
??0AutoChainContext@@QEAA@XZ
??0AutoCoTaskMemFree@@QEAA@PEAX@Z
??0AutoCoTaskMemFree@@QEAA@XZ
??0AutoFwXmlCloseParser@@QEAA@PEAX@Z
??0AutoFwXmlCloseParser@@QEAA@XZ
??0AutoHandle@@QEAA@PEAX@Z
??0AutoHandle@@QEAA@XZ
??0AutoImpersonateUser@@QEAA@PEAX@Z
??0AutoImpersonateUser@@QEAA@XZ
??0AutoLibrary@@QEAA@PEAUHINSTANCE__@@@Z
??0AutoLibrary@@QEAA@XZ
??0AutoLocalFree@@QEAA@PEAX@Z
??0AutoLocalFree@@QEAA@XZ
??0AutoMIClass@@QEAA@PEAU_MI_Class@@@Z
??0AutoMIClass@@QEAA@XZ
??0AutoMIInstance@@QEAA@PEAU_MI_Instance@@@Z
??0AutoMIInstance@@QEAA@XZ
??0AutoObject@@QEAA@PEAUWSMAN_OBJECT@@@Z
??0AutoObject@@QEAA@XZ
??0AutoRegKey@@QEAA@PEAUHKEY__@@@Z
??0AutoRegKey@@QEAA@XZ
??0AutoSecurityDescriptor@@QEAA@PEAX@Z
??0AutoSecurityDescriptor@@QEAA@XZ
??0AutoWaitHandle@@QEAA@PEAX@Z
??0AutoWaitHandle@@QEAA@XZ
??0BufferFormatter@@QEAA@PEAEK@Z
??0BufferFormatter@@QEAA@XZ
??0CWSManResource@@QEAA@H@Z
??0ChildLifeTimeManager@@QEAA@AEBV0@@Z
??0ChildLifeTimeManager@@QEAA@XZ
??0CircularBufferFormatter@@QEAA@XZ
??0EtwCorrelationHelper@@QEAA@AEBV0@@Z
??0FastLock@@QEAA@XZ
??0ILifeTimeMgmt@@QEAA@AEBV0@@Z
??0ILifeTimeMgmt@@QEAA@XZ
??0IRequestContext@@IEAA@XZ
??0OwnLock@@QEAA@AEAVFastLock@@@Z
??0ShareLock@@QEAA@AEAVFastLock@@@Z
??1?$AutoCleanup@V?$AutoDelete@G@@PEAG@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDeleteVector@E@@PEAE@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDeleteVector@PEBG@@PEAPEBG@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDeleteVector@U_WSMAN_OPTION@@@@PEAU_WSMAN_OPTION@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoFree@E@@PEAE@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VCRequestContext@@@@PEAVCRequestContext@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VCWSManSecurityUI@@@@PEAVCWSManSecurityUI@@@@QEAA@XZ
??1?$AutoCleanup@VAutoBstr@@PEAG@@QEAA@XZ
??1?$AutoCleanup@VAutoBstrNoAlloc@@PEAG@@QEAA@XZ
??1?$AutoCleanup@VAutoCertContext@@PEBU_CERT_CONTEXT@@@@QEAA@XZ
??1?$AutoCleanup@VAutoChainContext@@PEBU_CERT_CHAIN_CONTEXT@@@@QEAA@XZ
??1?$AutoCleanup@VAutoCoTaskMemFree@@PEAX@@QEAA@XZ
??1?$AutoCleanup@VAutoFwXmlCloseParser@@PEAX@@QEAA@XZ
??1?$AutoCleanup@VAutoHandle@@PEAX@@QEAA@XZ
??1?$AutoCleanup@VAutoImpersonateUser@@PEAX@@QEAA@XZ
??1?$AutoCleanup@VAutoLibrary@@PEAUHINSTANCE__@@@@QEAA@XZ
??1?$AutoCleanup@VAutoLocalFree@@PEAX@@QEAA@XZ
??1?$AutoCleanup@VAutoMIClass@@PEAU_MI_Class@@@@QEAA@XZ
??1?$AutoCleanup@VAutoMIInstance@@PEAU_MI_Instance@@@@QEAA@XZ
??1?$AutoCleanup@VAutoObject@@PEAUWSMAN_OBJECT@@@@QEAA@XZ
??1?$AutoCleanup@VAutoRegKey@@PEAUHKEY__@@@@QEAA@XZ
??1?$AutoCleanup@VAutoSecurityDescriptor@@PEAX@@QEAA@XZ
??1?$AutoCleanup@VAutoWaitHandle@@PEAX@@QEAA@XZ
??1?$AutoDelete@G@@QEAA@XZ
??1?$AutoDeleteVector@E@@QEAA@XZ
??1?$AutoDeleteVector@G@@QEAA@XZ
??1?$AutoDeleteVector@PEBG@@QEAA@XZ
??1?$AutoDeleteVector@U_WSMAN_OPTION@@@@QEAA@XZ
??1?$AutoFree@E@@QEAA@XZ
??1?$AutoRelease@VCRequestContext@@@@QEAA@XZ
??1?$AutoRelease@VCWSManSecurityUI@@@@QEAA@XZ
??1?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@XZ
??1?$SafeMap_Iterator@VKey@Locale@@K@@QEAA@XZ
??1?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@XZ
??1?$SimpleQueue@T_LARGE_INTEGER@@@@QEAA@XZ
??1AutoBstr@@QEAA@XZ
??1AutoBstrNoAlloc@@QEAA@XZ
??1AutoCertContext@@QEAA@XZ
??1AutoChainContext@@QEAA@XZ
??1AutoCoTaskMemFree@@QEAA@XZ
??1AutoFwXmlCloseParser@@QEAA@XZ
??1AutoHandle@@QEAA@XZ
??1AutoImpersonateUser@@QEAA@XZ
??1AutoLibrary@@QEAA@XZ
??1AutoLocalFree@@QEAA@XZ
??1AutoMIClass@@QEAA@XZ
??1AutoMIInstance@@QEAA@XZ
??1AutoObject@@QEAA@XZ
??1AutoRegKey@@QEAA@XZ
??1AutoSecurityDescriptor@@QEAA@XZ
??1AutoWaitHandle@@QEAA@XZ
??1BufferFormatter@@UEAA@XZ
??1CWSManCriticalSectionWithConditionVar@@QEAA@XZ
??1CWSManResource@@UEAA@XZ
??1ChildLifeTimeManager@@QEAA@XZ
??1CircularBufferFormatter@@UEAA@XZ
??1EtwCorrelationHelper@@UEAA@XZ
??1ILifeTimeMgmt@@UEAA@XZ
??1IRequestContext@@UEAA@XZ
??1OwnLock@@QEAA@XZ
??1ShareLock@@QEAA@XZ
??4?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@QEAAAEAV?$AutoDeleteVector@G@@PEAG@Z
??4?$AutoCleanup@V?$AutoRelease@VCWSManSecurityUI@@@@PEAVCWSManSecurityUI@@@@QEAAAEAV?$AutoRelease@VCWSManSecurityUI@@@@PEAVCWSManSecurityUI@@@Z
??4?$AutoCleanup@VAutoBstr@@PEAG@@QEAAAEAVAutoBstr@@PEAG@Z
??4?$AutoCleanup@VAutoBstrNoAlloc@@PEAG@@QEAAAEAVAutoBstrNoAlloc@@PEAG@Z
??4?$AutoCleanup@VAutoCertContext@@PEBU_CERT_CONTEXT@@@@QEAAAEAVAutoCertContext@@PEBU_CERT_CONTEXT@@@Z
??4?$AutoCleanup@VAutoChainContext@@PEBU_CERT_CHAIN_CONTEXT@@@@QEAAAEAVAutoChainContext@@PEBU_CERT_CHAIN_CONTEXT@@@Z
??4?$AutoCleanup@VAutoCoTaskMemFree@@PEAX@@QEAAAEAVAutoCoTaskMemFree@@PEAX@Z
??4?$AutoCleanup@VAutoFwXmlCloseParser@@PEAX@@QEAAAEAVAutoFwXmlCloseParser@@PEAX@Z
??4?$AutoCleanup@VAutoHandle@@PEAX@@QEAAAEAVAutoHandle@@PEAX@Z
??4?$AutoCleanup@VAutoImpersonateUser@@PEAX@@QEAAAEAVAutoImpersonateUser@@PEAX@Z
??4?$AutoCleanup@VAutoLibrary@@PEAUHINSTANCE__@@@@QEAAAEAVAutoLibrary@@PEAUHINSTANCE__@@@Z
??4?$AutoCleanup@VAutoLocalFree@@PEAX@@QEAAAEAVAutoLocalFree@@PEAX@Z
??4?$AutoCleanup@VAutoMIClass@@PEAU_MI_Class@@@@QEAAAEAVAutoMIClass@@PEAU_MI_Class@@@Z
??4?$AutoCleanup@VAutoMIInstance@@PEAU_MI_Instance@@@@QEAAAEAVAutoMIInstance@@PEAU_MI_Instance@@@Z
??4?$AutoCleanup@VAutoObject@@PEAUWSMAN_OBJECT@@@@QEAAAEAVAutoObject@@PEAUWSMAN_OBJECT@@@Z
??4?$AutoCleanup@VAutoRegKey@@PEAUHKEY__@@@@QEAAAEAVAutoRegKey@@PEAUHKEY__@@@Z
??4?$AutoCleanup@VAutoSecurityDescriptor@@PEAX@@QEAAAEAVAutoSecurityDescriptor@@PEAX@Z
??4?$AutoCleanup@VAutoWaitHandle@@PEAX@@QEAAAEAVAutoWaitHandle@@PEAX@Z
??4?$AutoDeleteVector@G@@QEAAAEAV0@PEAG@Z
??4?$AutoRelease@VCWSManSecurityUI@@@@QEAAAEAV0@PEAVCWSManSecurityUI@@@Z
??4?$SimpleQueue@T_LARGE_INTEGER@@@@QEAAAEAV0@AEBV0@@Z
??4AutoBstr@@QEAAAEAV0@PEAG@Z
??4AutoBstrNoAlloc@@QEAAAEAV0@PEAG@Z
??4AutoCertContext@@QEAAAEAV0@PEBU_CERT_CONTEXT@@@Z
??4AutoChainContext@@QEAAAEAV0@PEBU_CERT_CHAIN_CONTEXT@@@Z
??4AutoCoTaskMemFree@@QEAAAEAV0@PEAX@Z
??4AutoFwXmlCloseParser@@QEAAAEAV0@PEAX@Z
??4AutoHandle@@QEAAAEAV0@PEAX@Z
??4AutoImpersonateUser@@QEAAAEAV0@PEAX@Z
??4AutoLibrary@@QEAAAEAV0@PEAUHINSTANCE__@@@Z
??4AutoLocalFree@@QEAAAEAV0@PEAX@Z
??4AutoMIClass@@QEAAAEAV0@PEAU_MI_Class@@@Z
??4AutoMIInstance@@QEAAAEAV0@PEAU_MI_Instance@@@Z
??4AutoObject@@QEAAAEAV0@PEAUWSMAN_OBJECT@@@Z
??4AutoRegKey@@QEAAAEAV0@PEAUHKEY__@@@Z
??4AutoSecurityDescriptor@@QEAAAEAV0@PEAX@Z
??4AutoWaitHandle@@QEAAAEAV0@PEAX@Z
??4ChildLifeTimeManager@@QEAAAEAV0@AEBV0@@Z
??4EtwCorrelationHelper@@QEAAAEAV0@AEBV0@@Z
??4EventLog@@QEAAAEAV0@$$QEAV0@@Z
??4EventLog@@QEAAAEAV0@AEBV0@@Z
??4FastLock@@QEAAAEAV0@$$QEAV0@@Z
??4FastLock@@QEAAAEAV0@AEBV0@@Z
??4ILifeTimeMgmt@@QEAAAEAV0@AEBV0@@Z
??4PacketFormatter@@QEAAAEAV0@$$QEAV0@@Z
??4PacketFormatter@@QEAAAEAV0@AEBV0@@Z
??7?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoRelease@VCRequestContext@@@@PEAVCRequestContext@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoRelease@VCWSManSecurityUI@@@@PEAVCWSManSecurityUI@@@@QEBA_NXZ
??B?$AutoCleanup@V?$AutoDeleteVector@E@@PEAE@@QEAAPEAEXZ
??B?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@QEAAPEAGXZ
??B?$AutoCleanup@V?$AutoDeleteVector@PEBG@@PEAPEBG@@QEAAPEAPEBGXZ
??B?$AutoCleanup@V?$AutoDeleteVector@U_WSMAN_OPTION@@@@PEAU_WSMAN_OPTION@@@@QEAAPEAU_WSMAN_OPTION@@XZ
??B?$AutoCleanup@V?$AutoFree@E@@PEAE@@QEAAPEAEXZ
??B?$AutoCleanup@V?$AutoFree@E@@PEAE@@QEBAQEAEXZ
??B?$AutoCleanup@V?$AutoRelease@VCWSManSecurityUI@@@@PEAVCWSManSecurityUI@@@@QEAAPEAVCWSManSecurityUI@@XZ
??B?$AutoCleanup@VAutoLocalFree@@PEAX@@QEAAPEAXXZ
??C?$AutoCleanup@V?$AutoRelease@VCRequestContext@@@@PEAVCRequestContext@@@@QEAAPEAVCRequestContext@@XZ
??C?$AutoCleanup@V?$AutoRelease@VCWSManSecurityUI@@@@PEAVCWSManSecurityUI@@@@QEAAPEAVCWSManSecurityUI@@XZ
??_7?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@6B@
??_7BufferFormatter@@6B@
??_7CWSManResource@@6B@
??_7CircularBufferFormatter@@6B@
??_7EtwCorrelationHelper@@6B@
??_7ILifeTimeMgmt@@6B@
??_7IRequestContext@@6B@
??_FCErrorContext@@QEAAXXZ
?Acquire@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEBAXXZ
?Acquire@?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAAXXZ
?AcquireExclusive@FastLock@@QEAAXXZ
?AcquireShared@FastLock@@QEAAXXZ
?Acquired@?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA_NXZ
?AddRef@ILifeTimeMgmt@@UEAAJXZ
?AsReference@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAAAEAV1@XZ
?Data@?$SafeMap_Iterator@VKey@Locale@@K@@IEBAAEAV?$STLMap@VKey@Locale@@K@@XZ
?DeInitialize@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEAA_NAEAVIRequestContext@@@Z
?Detach@?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@QEAAPEAGXZ
?Detach@?$AutoCleanup@V?$AutoFree@E@@PEAE@@QEAAPEAEXZ
?Detach@BufferFormatter@@QEAAPEAEXZ
?GetBomIndex@PacketFormatter@@QEBA?AW4Charset@1@XZ
?GetBuffer@BufferFormatter@@UEAAPEAEXZ
?GetBuffer@BufferFormatter@@UEBAPEBEXZ
?GetBuffer@CircularBufferFormatter@@UEBAPEBEXZ
?GetBuffer@XmlReader@@QEAAPEBGXZ
?GetBufferSize@BufferFormatter@@QEBAKXZ
?GetCalculationSize@BufferFormatter@@UEBAK_N@Z
?GetCharset@PacketFormatter@@QEBA?AW4Charset@1@XZ
?GetChildCount@ChildLifeTimeManager@@QEBAJXZ
?GetError@BufferFormatter@@QEBAKXZ
?GetErrorCode@CErrorContext@@UEBAKXZ
?GetFaultXML@CErrorContext@@UEBAPEBGXZ
?GetFaultXML@CRequestContext@@UEBAPEBGXZ
?GetFormatterMode@BufferFormatter@@QEAA?AW4Charset@PacketFormatter@@XZ
?GetInitError@CWSManCriticalSection@@QEBAKXZ
?GetLCID@Locale@@QEAAKXZ
?GetLength@XmlReader@@QEAA_KXZ
?GetLocale@CRequestContext@@QEAAAEAVLocale@@XZ
?GetLocaleString@CRequestContext@@QEAAPEBGXZ
?GetMap@?$SafeMap_Iterator@VKey@Locale@@K@@QEBAAEAV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@XZ
?GetMap@?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEBAAEBV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@XZ
?GetMessageId@CErrorContext@@UEBAKXZ
?GetMessageId@CRequestContext@@UEBAKXZ
?GetOptionCount@CWSManResourceNoResourceUri@@QEAAKXZ
?GetOptionTypes@CWSManResourceNoResourceUri@@QEAAPEAPEBGXZ
?GetOptions@CWSManResourceNoResourceUri@@QEAAPEAU_WSMAN_OPTION@@XZ
?GetOptionsMustUnderstandValue@CWSManResourceNoResourceUri@@QEAAHXZ
?GetParser@XmlReader@@QEAAPEAXXZ
?GetRefCount@ILifeTimeMgmt@@QEAAJXZ
?GetSpaceUsed@BufferFormatter@@UEBAK_N@Z
?HasFaultXML@CRequestContext@@QEBAHXZ
?HasHtmlError@CRequestContext@@AEBAHXZ
?Initialize@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEAA_NAEAVIRequestContext@@@Z
?IsActive@ChildLifeTimeManager@@QEAA_NXZ
?IsCIM_Error@CRequestContext@@QEAAHXZ
?IsGeneratingError@CErrorContext@@UEBA_NXZ
?IsInCommitMode@BufferFormatter@@QEAA_NXZ
?IsValid@?$SafeMap_Iterator@VKey@Locale@@K@@QEBA_NXZ
?LogErrorCode@CRequestContext@@QEAAXXZ
?Me@?$AutoCleanup@V?$AutoDelete@G@@PEAG@@AEAAAEAV?$AutoDelete@G@@XZ
?Me@?$AutoCleanup@V?$AutoDeleteVector@E@@PEAE@@AEAAAEAV?$AutoDeleteVector@E@@XZ
?Me@?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@AEAAAEAV?$AutoDeleteVector@G@@XZ
?Me@?$AutoCleanup@V?$AutoDeleteVector@PEBG@@PEAPEBG@@AEAAAEAV?$AutoDeleteVector@PEBG@@XZ
?Me@?$AutoCleanup@V?$AutoDeleteVector@U_WSMAN_OPTION@@@@PEAU_WSMAN_OPTION@@@@AEAAAEAV?$AutoDeleteVector@U_WSMAN_OPTION@@@@XZ
?Me@?$AutoCleanup@V?$AutoFree@E@@PEAE@@AEAAAEAV?$AutoFree@E@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VCRequestContext@@@@PEAVCRequestContext@@@@AEAAAEAV?$AutoRelease@VCRequestContext@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VCWSManSecurityUI@@@@PEAVCWSManSecurityUI@@@@AEAAAEAV?$AutoRelease@VCWSManSecurityUI@@@@XZ
?Me@?$AutoCleanup@VAutoBstr@@PEAG@@AEAAAEAVAutoBstr@@XZ
?Me@?$AutoCleanup@VAutoBstrNoAlloc@@PEAG@@AEAAAEAVAutoBstrNoAlloc@@XZ
?Me@?$AutoCleanup@VAutoCertContext@@PEBU_CERT_CONTEXT@@@@AEAAAEAVAutoCertContext@@XZ
?Me@?$AutoCleanup@VAutoChainContext@@PEBU_CERT_CHAIN_CONTEXT@@@@AEAAAEAVAutoChainContext@@XZ
?Me@?$AutoCleanup@VAutoCoTaskMemFree@@PEAX@@AEAAAEAVAutoCoTaskMemFree@@XZ
?Me@?$AutoCleanup@VAutoFwXmlCloseParser@@PEAX@@AEAAAEAVAutoFwXmlCloseParser@@XZ
?Me@?$AutoCleanup@VAutoHandle@@PEAX@@AEAAAEAVAutoHandle@@XZ
?Me@?$AutoCleanup@VAutoImpersonateUser@@PEAX@@AEAAAEAVAutoImpersonateUser@@XZ
?Me@?$AutoCleanup@VAutoLibrary@@PEAUHINSTANCE__@@@@AEAAAEAVAutoLibrary@@XZ
?Me@?$AutoCleanup@VAutoLocalFree@@PEAX@@AEAAAEAVAutoLocalFree@@XZ
?Me@?$AutoCleanup@VAutoMIClass@@PEAU_MI_Class@@@@AEAAAEAVAutoMIClass@@XZ
?Me@?$AutoCleanup@VAutoMIInstance@@PEAU_MI_Instance@@@@AEAAAEAVAutoMIInstance@@XZ
?Me@?$AutoCleanup@VAutoObject@@PEAUWSMAN_OBJECT@@@@AEAAAEAVAutoObject@@XZ
?Me@?$AutoCleanup@VAutoRegKey@@PEAUHKEY__@@@@AEAAAEAVAutoRegKey@@XZ
?Me@?$AutoCleanup@VAutoSecurityDescriptor@@PEAX@@AEAAAEAVAutoSecurityDescriptor@@XZ
?Me@?$AutoCleanup@VAutoWaitHandle@@PEAX@@AEAAAEAVAutoWaitHandle@@XZ
?Passed@CErrorContext@@UEBAHXZ
?PrepareToCommitWithSize@CircularBufferFormatter@@UEAAKK@Z
?ProcessContext@CRequestContext@@QEAAHHPEAU_WSMAN_ENUMERATOR_RESULT@@@Z
?ProcessContext@CRequestContext@@QEAAHHPEAU_WSMAN_EVENTS_RESULT@@@Z
?ProcessContext@CRequestContext@@QEAAHHPEAU_WSMAN_RESULT@@@Z
?ProcessContext@CRequestContext@@QEAAHHPEAU_WSMAN_STATUS@@@Z
?ProviderFailure@CErrorContext@@UEBAHXZ
?RecordAccessDenied@CRequestContext@@UEAAXXZ
?RecordFailure@CRequestContext@@UEAAXK@Z
?RecordHtmlError@CRequestContext@@QEAAHKPEAU_FWXML_ELEMENT@@@Z
?RecordHtmlError@CRequestContext@@QEAAHKPEBGK@Z
?RecordMIFailure@IRequestContext@@QEAAXW4_MI_Result@@K@Z
?RecordOutOfMemory@CRequestContext@@UEAAXXZ
?RecordProviderFailure@CRequestContext@@QEAAXKHPEBG00@Z
?RecordSoapError@CRequestContext@@QEAAHKPEAU_FWXML_ELEMENT@@@Z
?RecordSoapError@CRequestContext@@UEAAHKPEBG@Z
?RegisterChild@ChildLifeTimeManager@@QEAA_NXZ
?Release@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEBAXXZ
?Release@ILifeTimeMgmt@@UEAAJP6AXPEAX@Z0@Z
?ReleaseExclusive@FastLock@@QEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@G@@PEAG@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDeleteVector@E@@PEAE@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDeleteVector@PEBG@@PEAPEBG@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDeleteVector@U_WSMAN_OPTION@@@@PEAU_WSMAN_OPTION@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoFree@E@@PEAE@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VCRequestContext@@@@PEAVCRequestContext@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VCWSManSecurityUI@@@@PEAVCWSManSecurityUI@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoBstr@@PEAG@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoBstrNoAlloc@@PEAG@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoCertContext@@PEBU_CERT_CONTEXT@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoChainContext@@PEBU_CERT_CHAIN_CONTEXT@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoCoTaskMemFree@@PEAX@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoFwXmlCloseParser@@PEAX@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoHandle@@PEAX@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoImpersonateUser@@PEAX@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoLibrary@@PEAUHINSTANCE__@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoLocalFree@@PEAX@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoMIClass@@PEAU_MI_Class@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoMIInstance@@PEAU_MI_Instance@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoObject@@PEAUWSMAN_OBJECT@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoRegKey@@PEAUHKEY__@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoSecurityDescriptor@@PEAX@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoWaitHandle@@PEAX@@AEAAXXZ
?ReleaseShared@FastLock@@QEAAXXZ
?Reset@?$SafeMap_Iterator@VKey@Locale@@K@@QEAAXXZ
?Reset@BufferFormatter@@UEAAXXZ
?Reset@CircularBufferFormatter@@UEAAXXZ
?SetCIM_Error@CErrorContext@@UEAAXXZ
?SetCIM_Error@CRequestContext@@UEAAXXZ
?SetExtraLogInfo@CErrorContext@@QEAAXPEBG000@Z
?SetFormatterMode@BufferFormatter@@QEAAXW4Charset@PacketFormatter@@0@Z
?SetGeneratingError@CErrorContext@@UEAAXXZ
?SetLocale@CRequestContext@@QEAA_NPEBGK@Z
?SetMachineName@CRequestContext@@QEAAKPEBG@Z
?SetMaxEnvelopeSize@CircularBufferFormatter@@QEAAXK@Z
?SetOptionsMustUnderstandValue@CWSManResourceNoResourceUri@@QEAAXH@Z
?SetUpdateMode@BufferFormatter@@UEAAXW4Mode@1@@Z
?SetUpdateMode@CircularBufferFormatter@@UEAAXW4Mode@BufferFormatter@@@Z
?Shutdown@ChildLifeTimeManager@@QEAAXXZ
?SkipOrphans@?$SafeMap_Iterator@VKey@Locale@@K@@IEAAXXZ
?UnregisterChild@ChildLifeTimeManager@@QEAAXXZ
?UseDefaultConfig@CErrorContext@@UEBAHXZ
?UsingDefaultLCID@Locale@@QEAA_NXZ
?WaitForAllChildrenToUnregister@ChildLifeTimeManager@@QEAAXK@Z
?WakeAllWaitingOnNoOfChildren@ChildLifeTimeManager@@AEAAXXZ
?empty@?$SimpleQueue@T_LARGE_INTEGER@@@@QEBA_NXZ
?getBufSync@BufferFormatter@@UEAAPEAVCWSManCriticalSection@@XZ
?pop@?$SimpleQueue@T_LARGE_INTEGER@@@@QEAAXXZ
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
80KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
64KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=48, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=18, id=260, version=33145,
count=5, id=259, version=33145,
count=217, id=1, productName=Unmarked objects,
count=7, id=257, version=33145,
count=8, id=261, version=33145,
count=1, id=256, version=33145,
count=11, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WsmRes.dll
- SHA256 2f20f2cc49ca8962ec57ab75c75c96a5b712b41c11f6ce65680a5979eff3bd0e
- MD5 89abb07bf080882e95146cfc2ef18518
- SHA1 a0146e06635d1500d08eed779cf221131e7d220b
- SHA512 085433c1af18dc408fca6eb0a9efb95ab2aad8b50d47791161cffadbbcbbaf6834956de14ecb236a02cd12b48f3f8a6fb1097d7446ed27db773cd8e9440124ea
- SSDEEP 768:QrUZi7bX8FohSjEzGZoadnkXV0/s62PEPKl/J:Q4i7bX8uhSjESZoalkXV0/sFPn
- TLSH T1F86348035FEC9806F0BB5731797A86693236F968DB51E42FB052275C9CB2F408EE1726
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
4KB
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WsmSvc.dll
- IMPHASH 7d166f442edcf8d0f7ee1ba0769b1f0a
- SHA256 f11966b5c7aef2923507c76c15f38a7644e06c5ca79f8d8a1fa906597edb735d
- MD5 b0fac2714613a44e7fa7ae4b9290fe53
- SHA1 ff9a757eb4c50785df28c3dd0d99ebeb3b7dfbaa
- SHA512 5fc332ebf1639db4850441abd4a856ae58afdc9d74e0d37adcdd90288969a56f274d5646ec0c1df3b8c79fbe90f6d1ac57982b47a0aa1b52fe7da627961b8f19
- SSDEEP 49152:Tn8IJk9xUKXMjjs/aRHPszMvF5Ttk4eWqRmiyYoSV4w3UunAua/T7kkajcgJ1AE:T7EDc0/efZkt6Nc
- TLSH T11AD55C5977E800EEEABBD77CC9530617DAB2B4151B23DADB006441297FA77E1093AF20
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
1049728
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WsmSvc.pdb
msvcrt
iswalnum
strncmp
fwprintf
wcscpy_s
_i64tow_s
fclose
fopen_s
strcmp
_onexit
strchr
__dllonexit
_unlock
_lock
??1type_info@@UEAA@XZ
_fpclass
?terminate@@YAXXZ
__C_specific_handler
_initterm
_HUGE
wcstod
wcsspn
rand
srand
_itow_s
memmove_s
malloc
memcpy_s
wcscat_s
wcsncpy_s
_wcslwr_s
swprintf_s
_ultow_s
wcstoul
wcscspn
wcspbrk
free
_amsg_exit
_XcptFilter
memmove
wcsstr
_vsnprintf
wcsrchr
memset
memcmp
time
rand_s
__iob_func
_scprintf
isspace
_strnicmp
_wtoi
_wtof
swscanf_s
iswspace
iswdigit
_atoi64
tolower
iswxdigit
_wtoi64
_wcsnicmp
__CxxFrameHandler4
wcsncmp
_wcsrev
memcpy
__CxxFrameHandler3
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@XZ
_scwprintf
_vsnwprintf
wcschr
_wcsicmp
_purecall
isdigit
wcscmp
api-ms-win-core-errorhandling-l1-1-0
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
oleaut32
VariantInit
VariantClear
SysAllocString
SysStringLen
VarCmp
SysAllocStringLen
GetErrorInfo
SysFreeString
api-ms-win-security-base-l1-1-0
CreateWellKnownSid
CheckTokenMembership
AllocateAndInitializeSid
FreeSid
SetSecurityDescriptorSacl
MapGenericMask
MakeSelfRelativeSD
GetAce
GetSecurityDescriptorDacl
AddAccessAllowedAceEx
IsValidSid
GetSecurityDescriptorSacl
InitializeSecurityDescriptor
MakeAbsoluteSD
SetSecurityDescriptorGroup
GetSecurityDescriptorLength
GetKernelObjectSecurity
InitializeAcl
AccessCheckAndAuditAlarmW
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
SetSecurityDescriptorOwner
ImpersonateLoggedOnUser
SetKernelObjectSecurity
DuplicateTokenEx
ImpersonateSelf
AdjustTokenPrivileges
RevertToSelf
GetTokenInformation
CopySid
GetLengthSid
IsWellKnownSid
EqualSid
SetSecurityDescriptorDacl
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-threadpool-legacy-l1-1-0
DeleteTimerQueueTimer
QueueUserWorkItem
UnregisterWaitEx
CreateTimerQueueTimer
api-ms-win-core-heap-obsolete-l1-1-0
LocalAlloc
LocalFree
GlobalFree
api-ms-win-core-libraryloader-l1-1-0
FreeLibrary
DisableThreadLibraryCalls
LoadLibraryExW
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA
GetProcAddress
api-ms-win-core-registry-l1-1-0
RegEnumKeyExW
RegCreateKeyExW
RegDeleteTreeW
RegDeleteValueW
RegNotifyChangeKeyValue
RegSetValueExW
RegSetKeySecurity
RegGetValueW
RegQueryValueExW
RegOpenKeyExW
RegDeleteKeyExW
RegQueryInfoKeyW
RegCloseKey
RegCopyTreeW
RegEnumValueW
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage
GetTraceLoggerHandle
api-ms-win-core-synch-l1-1-0
OpenEventW
AcquireSRWLockShared
ReleaseSemaphore
ReleaseSRWLockShared
TryEnterCriticalSection
InitializeCriticalSectionEx
OpenSemaphoreW
WaitForSingleObjectEx
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ReleaseMutex
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CreateEventW
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
ResetEvent
WaitForMultipleObjectsEx
CreateSemaphoreExW
CreateMutexExW
SetEvent
api-ms-win-core-kernel32-legacy-l1-1-0
UnregisterWait
RegisterWaitForSingleObject
api-ms-win-core-heap-l1-1-0
HeapReAlloc
HeapFree
HeapDestroy
HeapSize
HeapAlloc
GetProcessHeap
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThread
GetCurrentProcess
GetCurrentThreadId
TerminateProcess
SetThreadToken
OpenProcessToken
OpenThreadToken
ExitProcess
CreateThread
OpenThread
api-ms-win-core-synch-l1-2-0
WakeAllConditionVariable
SleepConditionVariableSRW
SleepConditionVariableCS
Sleep
InitializeConditionVariable
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
GetSystemDirectoryA
GetSystemDirectoryW
GetTickCount64
GetSystemTime
GetVersionExW
GetTickCount
GetSystemTimeAsFileTime
GetComputerNameExW
GetLocalTime
miutils
RtlQueueAcquireFastLockShared
RtlTryAcquireFastLockExclusive
RtlQueueAcquireFastLockExclusive
Instance_New
OSC_Batch_Strdup
RCClass_New
Instance_InitDynamic
Instance_SetResourceURI
ClassCache_AddClass
ClassCache_GetClass
Instance_GetResourceURI
ClassCache_New
RtlReleaseFastLockShared
ClassCache_Delete
MiErrorCategoryFromWindowsError
OSC_Batch_Get
RtlReleaseFastLockExclusive
OSC_Batch_Destroy
RtlTryAcquireFastLockShared
RtlInterlockedWakeAll
RtlInterlockedCompareWait
api-ms-win-core-string-l1-1-0
CompareStringW
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-timezone-l1-1-0
GetTimeZoneInformation
FileTimeToSystemTime
SystemTimeToFileTime
api-ms-win-core-localization-l1-2-0
GetThreadUILanguage
GetLocaleInfoW
FormatMessageW
GetThreadLocale
FindNLSString
SetThreadPreferredUILanguages
SetThreadUILanguage
api-ms-win-core-localization-obsolete-l1-1-0
GetUserDefaultUILanguage
EnumUILanguagesW
api-ms-win-eventing-provider-l1-1-0
EventActivityIdControl
api-ms-win-core-interlocked-l1-1-0
InterlockedPopEntrySList
InitializeSListHead
QueryDepthSList
InterlockedPushEntrySList
InterlockedFlushSList
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
CreateThreadpoolWork
CloseThreadpoolWork
CreateThreadpoolTimer
SubmitThreadpoolWork
WaitForThreadpoolIoCallbacks
CloseThreadpoolIo
StartThreadpoolIo
CancelThreadpoolIo
SetThreadpoolTimer
CreateThreadpoolIo
CreateThreadpoolCleanupGroup
CreateThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolCleanupGroup
FreeLibraryWhenCallbackReturns
WaitForThreadpoolTimerCallbacks
api-ms-win-core-file-l1-1-0
GetFullPathNameW
CreateFileW
CompareFileTime
LocalFileTimeToFileTime
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
OutputDebugStringA
api-ms-win-core-sysinfo-l1-2-0
VerSetConditionMask
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-psapi-l1-1-0
K32GetProcessMemoryInfo
ntdll
NtAllocateLocallyUniqueId
RtlInitString
RtlFreeUnicodeString
RtlCreateUnicodeStringFromAsciiz
NtCompareTokens
RtlNtStatusToDosError
RtlLengthSid
EtwEventRegister
EtwEventUnregister
EtwEventWrite
EtwEventProviderEnabled
RtlFreeSid
RtlAllocateAndInitializeSid
RtlInitUnicodeString
EtwEventWriteTransfer
EtwEventEnabled
pcwum
PerfCreateInstance
PerfSetCounterRefValue
PerfDeleteInstance
PerfStopProvider
PerfSetCounterSetInfo
PerfStartProvider
api-ms-win-core-job-l2-1-0
QueryInformationJobObject
AssignProcessToJobObject
CreateJobObjectW
OpenJobObjectW
SetInformationJobObject
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-kernel32-legacy-l1-1-1
VerifyVersionInfoW
mi
mi_clientFT_V1
MI_Application_InitializeV1
??0?$AutoCleanup@V?$AutoDelete@D@@PEAD@@QEAA@PEAD@Z
??0?$AutoCleanup@V?$AutoDelete@G@@PEAG@@QEAA@PEAG@Z
??0?$AutoCleanup@V?$AutoDelete@UIPRange@CWSManIPFilter@@@@PEAUIPRange@CWSManIPFilter@@@@QEAA@PEAUIPRange@CWSManIPFilter@@@Z
??0?$AutoCleanup@V?$AutoDelete@U_SID@@@@PEAU_SID@@@@QEAA@PEAU_SID@@@Z
??0?$AutoCleanup@V?$AutoDelete@U_WSMAN_STREAM_ID_SET@@@@PEAU_WSMAN_STREAM_ID_SET@@@@QEAA@PEAU_WSMAN_STREAM_ID_SET@@@Z
??0?$AutoCleanup@V?$AutoDelete@V?$Handle@VISubscription@@@@@@PEAV?$Handle@VISubscription@@@@@@QEAA@PEAV?$Handle@VISubscription@@@@@Z
??0?$AutoCleanup@V?$AutoDelete@V?$SafeMap_Iterator@VStringKeyCI@@K@@@@PEAV?$SafeMap_Iterator@VStringKeyCI@@K@@@@QEAA@PEAV?$SafeMap_Iterator@VStringKeyCI@@K@@@Z
??0?$AutoCleanup@V?$AutoDelete@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@PEAV?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@QEAA@PEAV?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@Z
??0?$AutoCleanup@V?$AutoDelete@V?$SafeSet@PEAVCCertMapping@@@@@@PEAV?$SafeSet@PEAVCCertMapping@@@@@@QEAA@PEAV?$SafeSet@PEAVCCertMapping@@@@@Z
??0?$AutoCleanup@V?$AutoDelete@V?$SafeSet@PEAVCShellUriSettings@@@@@@PEAV?$SafeSet@PEAVCShellUriSettings@@@@@@QEAA@PEAV?$SafeSet@PEAVCShellUriSettings@@@@@Z
??0?$AutoCleanup@V?$AutoDelete@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@PEAV?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@QEAA@PEAV?$SafeSet_Iterator@PEAVCListenerOperation@@@@@Z
??0?$AutoCleanup@V?$AutoDelete@V?$SimpleStack@VCListenerOperation@@@@@@PEAV?$SimpleStack@VCListenerOperation@@@@@@QEAA@PEAV?$SimpleStack@VCListenerOperation@@@@@Z
??0?$AutoCleanup@V?$AutoDelete@V?$SimpleStack@VShellHostEntry@@@@@@PEAV?$SimpleStack@VShellHostEntry@@@@@@QEAA@PEAV?$SimpleStack@VShellHostEntry@@@@@Z
??0?$AutoCleanup@V?$AutoDelete@V?$set@PEAVCListenerSettings@@VCListenerSettingsLessFunctor@CServiceConfigSettings@@V?$transport_allocator@PEAVCListenerSettings@@@@@std@@@@PEAV?$set@PEAVCListenerSettings@@VCListenerSettingsLessFunctor@CServiceConfigSettings@@V?$transport_allocator@PEAVCListenerSettings@@@@@std@@@@QEAA@PEAV?$set@PEAVCListenerSettings@@VCListenerSettingsLessFunctor@CServiceConfigSettings@@V?$transport_allocator@PEAVCListenerSettings@@@@@std@@@Z
??0?$AutoCleanup@V?$AutoDelete@V?$set@Usockaddr_storage@@VSockAddrLessFunctor@CListenerSettings@@V?$transport_allocator@Usockaddr_storage@@@@@std@@@@PEAV?$set@Usockaddr_storage@@VSockAddrLessFunctor@CListenerSettings@@V?$transport_allocator@Usockaddr_storage@@@@@std@@@@QEAA@PEAV?$set@Usockaddr_storage@@VSockAddrLessFunctor@CListenerSettings@@V?$transport_allocator@Usockaddr_storage@@@@@std@@@Z
??0?$AutoCleanup@V?$AutoDelete@V?$vector@PEAVHandleImpl@Client@WSMan@@V?$transport_allocator@PEAVHandleImpl@Client@WSMan@@@@@std@@@@PEAV?$vector@PEAVHandleImpl@Client@WSMan@@V?$transport_allocator@PEAVHandleImpl@Client@WSMan@@@@@std@@@@QEAA@PEAV?$vector@PEAVHandleImpl@Client@WSMan@@V?$transport_allocator@PEAVHandleImpl@Client@WSMan@@@@@std@@@Z
??0?$AutoCleanup@V?$AutoDelete@V?$vector@PEAVIServiceConfigObserver@@V?$transport_allocator@PEAVIServiceConfigObserver@@@@@std@@@@PEAV?$vector@PEAVIServiceConfigObserver@@V?$transport_allocator@PEAVIServiceConfigObserver@@@@@std@@@@QEAA@PEAV?$vector@PEAVIServiceConfigObserver@@V?$transport_allocator@PEAVIServiceConfigObserver@@@@@std@@@Z
??0?$AutoCleanup@V?$AutoDelete@VAdminSid@CSecurity@@@@PEAVAdminSid@CSecurity@@@@QEAA@PEAVAdminSid@CSecurity@@@Z
??0?$AutoCleanup@V?$AutoDelete@VBlockedRecord@@@@PEAVBlockedRecord@@@@QEAA@PEAVBlockedRecord@@@Z
??0?$AutoCleanup@V?$AutoDelete@VCBaseConfigCache@@@@PEAVCBaseConfigCache@@@@QEAA@PEAVCBaseConfigCache@@@Z
??0?$AutoCleanup@V?$AutoDelete@VCCertMapping@@@@PEAVCCertMapping@@@@QEAA@PEAVCCertMapping@@@Z
??0?$AutoCleanup@V?$AutoDelete@VCConfigChangeSource@@@@PEAVCConfigChangeSource@@@@QEAA@PEAVCConfigChangeSource@@@Z
??0?$AutoCleanup@V?$AutoDelete@VCListenerSettings@@@@PEAVCListenerSettings@@@@QEAA@PEAVCListenerSettings@@@Z
??0?$AutoCleanup@V?$AutoDelete@VCObserverConfigChangeErrors@@@@PEAVCObserverConfigChangeErrors@@@@QEAA@PEAVCObserverConfigChangeErrors@@@Z
??0?$AutoCleanup@V?$AutoDelete@VCServiceWatcher@CServiceConfigCache@@@@PEAVCServiceWatcher@CServiceConfigCache@@@@QEAA@PEAVCServiceWatcher@CServiceConfigCache@@@Z
??0?$AutoCleanup@V?$AutoDelete@VCShellUriSettings@@@@PEAVCShellUriSettings@@@@QEAA@PEAVCShellUriSettings@@@Z
??0?$AutoCleanup@V?$AutoDelete@VCWSManEPR@@@@PEAVCWSManEPR@@@@QEAA@PEAVCWSManEPR@@@Z
??0?$AutoCleanup@V?$AutoDelete@VCWSManResource@@@@PEAVCWSManResource@@@@QEAA@PEAVCWSManResource@@@Z
??0?$AutoCleanup@V?$AutoDelete@VCertHash@@@@PEAVCertHash@@@@QEAA@PEAVCertHash@@@Z
??0?$AutoCleanup@V?$AutoDelete@VConfigUpdate@@@@PEAVConfigUpdate@@@@QEAA@PEAVConfigUpdate@@@Z
??0?$AutoCleanup@V?$AutoDelete@VEnumSinkEx@@@@PEAVEnumSinkEx@@@@QEAA@PEAVEnumSinkEx@@@Z
??0?$AutoCleanup@V?$AutoDelete@VEnumSinkEx@@@@PEAVEnumSinkEx@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoDelete@VEventHandler@WSMan@@@@PEAVEventHandler@WSMan@@@@QEAA@PEAVEventHandler@WSMan@@@Z
??0?$AutoCleanup@V?$AutoDelete@VExpiredOperationIdRecord@@@@PEAVExpiredOperationIdRecord@@@@QEAA@PEAVExpiredOperationIdRecord@@@Z
??0?$AutoCleanup@V?$AutoDelete@VGPApiManager@@@@PEAVGPApiManager@@@@QEAA@PEAVGPApiManager@@@Z
??0?$AutoCleanup@V?$AutoDelete@VGeneralSinkEx@@@@PEAVGeneralSinkEx@@@@QEAA@PEAVGeneralSinkEx@@@Z
??0?$AutoCleanup@V?$AutoDelete@VGeneralSinkEx@@@@PEAVGeneralSinkEx@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoDelete@VIChannelObserverFactory@@@@PEAVIChannelObserverFactory@@@@QEAA@PEAVIChannelObserverFactory@@@Z
??0?$AutoCleanup@V?$AutoDelete@VIQueryDASHSMASHInterface@@@@PEAVIQueryDASHSMASHInterface@@@@QEAA@PEAVIQueryDASHSMASHInterface@@@Z
??0?$AutoCleanup@V?$AutoDelete@VIQueryDASHSMASHInterface@@@@PEAVIQueryDASHSMASHInterface@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoDelete@VISpecification@@@@PEAVISpecification@@@@QEAA@PEAVISpecification@@@Z
??0?$AutoCleanup@V?$AutoDelete@VISpecification@@@@PEAVISpecification@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoDelete@VInteractiveSid@CSecurity@@@@PEAVInteractiveSid@CSecurity@@@@QEAA@PEAVInteractiveSid@CSecurity@@@Z
??0?$AutoCleanup@V?$AutoDelete@VIpHlpApiDllLoader@@@@PEAVIpHlpApiDllLoader@@@@QEAA@PEAVIpHlpApiDllLoader@@@Z
??0?$AutoCleanup@V?$AutoDelete@VMachineName@@@@PEAVMachineName@@@@QEAA@PEAVMachineName@@@Z
??0?$AutoCleanup@V?$AutoDelete@VNetworkServiceSid@CSecurity@@@@PEAVNetworkServiceSid@CSecurity@@@@QEAA@PEAVNetworkServiceSid@CSecurity@@@Z
??0?$AutoCleanup@V?$AutoDelete@VNtDsApiDllLoader@@@@PEAVNtDsApiDllLoader@@@@QEAA@PEAVNtDsApiDllLoader@@@Z
??0?$AutoCleanup@V?$AutoDelete@VOptionValue@SessionOptions@Client@WSMan@@@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@QEAA@PEAVOptionValue@SessionOptions@Client@WSMan@@@Z
??0?$AutoCleanup@V?$AutoDelete@VPacketCreator@@@@PEAVPacketCreator@@@@QEAA@PEAVPacketCreator@@@Z
??0?$AutoCleanup@V?$AutoDelete@VPacketParser@@@@PEAVPacketParser@@@@QEAA@PEAVPacketParser@@@Z
??0?$AutoCleanup@V?$AutoDelete@VResources@Locale@@@@PEAVResources@Locale@@@@QEAA@PEAVResources@Locale@@@Z
??0?$AutoCleanup@V?$AutoDelete@VRunAsConfiguration@@@@PEAVRunAsConfiguration@@@@QEAA@PEAVRunAsConfiguration@@@Z
??0?$AutoCleanup@V?$AutoDelete@VSecurityEntry@Catalog@@@@PEAVSecurityEntry@Catalog@@@@QEAA@PEAVSecurityEntry@Catalog@@@Z
??0?$AutoCleanup@V?$AutoDelete@VSendPacketArgs@RobustConnectionBuffer@@@@PEAVSendPacketArgs@RobustConnectionBuffer@@@@QEAA@PEAVSendPacketArgs@RobustConnectionBuffer@@@Z
??0?$AutoCleanup@V?$AutoDelete@VServiceSoapProcessor@@@@PEAVServiceSoapProcessor@@@@QEAA@PEAVServiceSoapProcessor@@@Z
??0?$AutoCleanup@V?$AutoDelete@VShell32DllLoader@@@@PEAVShell32DllLoader@@@@QEAA@PEAVShell32DllLoader@@@Z
??0?$AutoCleanup@V?$AutoDelete@VShlWApiDllLoader@@@@PEAVShlWApiDllLoader@@@@QEAA@PEAVShlWApiDllLoader@@@Z
??0?$AutoCleanup@V?$AutoDelete@VSubscriptionEnumerator@@@@PEAVSubscriptionEnumerator@@@@QEAA@PEAVSubscriptionEnumerator@@@Z
??0?$AutoCleanup@V?$AutoDelete@VSubscriptionManager@@@@PEAVSubscriptionManager@@@@QEAA@PEAVSubscriptionManager@@@Z
??0?$AutoCleanup@V?$AutoDelete@VTSTRBUFFER@@@@PEAVTSTRBUFFER@@@@QEAA@PEAVTSTRBUFFER@@@Z
??0?$AutoCleanup@V?$AutoDelete@VTSTRBUFFER@@@@PEAVTSTRBUFFER@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoDelete@VUniqueStringOverflow@@@@PEAVUniqueStringOverflow@@@@QEAA@PEAVUniqueStringOverflow@@@Z
??0?$AutoCleanup@V?$AutoDelete@VUser32DllLoader@@@@PEAVUser32DllLoader@@@@QEAA@PEAVUser32DllLoader@@@Z
??0?$AutoCleanup@V?$AutoDelete@VWSMANCONFIGTABLE_IDENTITY@@@@PEAVWSMANCONFIGTABLE_IDENTITY@@@@QEAA@PEAVWSMANCONFIGTABLE_IDENTITY@@@Z
??0?$AutoCleanup@V?$AutoDelete@VWSManMemCryptManager@@@@PEAVWSManMemCryptManager@@@@QEAA@PEAVWSManMemCryptManager@@@Z
??0?$AutoCleanup@V?$AutoDelete@VWmiEnumContext@@@@PEAVWmiEnumContext@@@@QEAA@PEAVWmiEnumContext@@@Z
??0?$AutoCleanup@V?$AutoDelete@VWmiEnumContext@@@@PEAVWmiEnumContext@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoDelete@VXmlReader@@@@PEAVXmlReader@@@@QEAA@PEAVXmlReader@@@Z
??0?$AutoCleanup@V?$AutoDeleteVector@$$CBG@@PEBG@@QEAA@PEBG@Z
??0?$AutoCleanup@V?$AutoDeleteVector@D@@PEAD@@QEAA@PEAD@Z
??0?$AutoCleanup@V?$AutoDeleteVector@E@@PEAE@@QEAA@PEAE@Z
??0?$AutoCleanup@V?$AutoDeleteVector@E@@PEAE@@QEAA@XZ
??0?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@QEAA@PEAG@Z
??0?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@QEAA@XZ
??0?$AutoCleanup@V?$AutoDeleteVector@H@@PEAH@@QEAA@PEAH@Z
??0?$AutoCleanup@V?$AutoDeleteVector@PEAG@@PEAPEAG@@QEAA@PEAPEAG@Z
??0?$AutoCleanup@V?$AutoDeleteVector@PEAG@@PEAPEAG@@QEAA@XZ
??0?$AutoCleanup@V?$AutoDeleteVector@PEBG@@PEAPEBG@@QEAA@PEAPEBG@Z
??0?$AutoCleanup@V?$AutoDeleteVector@PEBG@@PEAPEBG@@QEAA@XZ
??0?$AutoCleanup@V?$AutoDeleteVector@U_CONFIG_UPDATE@@@@PEAU_CONFIG_UPDATE@@@@QEAA@PEAU_CONFIG_UPDATE@@@Z
??0?$AutoCleanup@V?$AutoDeleteVector@U_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@PEAU_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@QEAA@PEAU_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@Z
??0?$AutoCleanup@V?$AutoDeleteVector@U_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@PEAU_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoDeleteVector@U_WINRS_RUN_COMMAND_ARG@@@@PEAU_WINRS_RUN_COMMAND_ARG@@@@QEAA@PEAU_WINRS_RUN_COMMAND_ARG@@@Z
??0?$AutoCleanup@V?$AutoDeleteVector@U_WINRS_RUN_COMMAND_ARG@@@@PEAU_WINRS_RUN_COMMAND_ARG@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoDeleteVector@U_WSMAN_OPTION@@@@PEAU_WSMAN_OPTION@@@@QEAA@PEAU_WSMAN_OPTION@@@Z
??0?$AutoCleanup@V?$AutoDeleteVector@X@@PEAX@@QEAA@PEAX@Z
??0?$AutoCleanup@V?$AutoFree@E@@PEAE@@QEAA@PEAE@Z
??0?$AutoCleanup@V?$AutoLocklessItemRecycle@VPacket@@@@PEAVPacket@@@@QEAA@PEAVPacket@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIAppHostAdminManager@@@@PEAUIAppHostAdminManager@@@@QEAA@PEAUIAppHostAdminManager@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIAppHostChildElementCollection@@@@PEAUIAppHostChildElementCollection@@@@QEAA@PEAUIAppHostChildElementCollection@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIAppHostConfigException@@@@PEAUIAppHostConfigException@@@@QEAA@PEAUIAppHostConfigException@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIAppHostElement@@@@PEAUIAppHostElement@@@@QEAA@PEAUIAppHostElement@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIAppHostElementCollection@@@@PEAUIAppHostElementCollection@@@@QEAA@PEAUIAppHostElementCollection@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIAppHostProperty@@@@PEAUIAppHostProperty@@@@QEAA@PEAUIAppHostProperty@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIAppHostPropertyCollection@@@@PEAUIAppHostPropertyCollection@@@@QEAA@PEAUIAppHostPropertyCollection@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIClientSecurity@@@@PEAUIClientSecurity@@@@QEAA@PEAUIClientSecurity@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIClientSecurity@@@@PEAUIClientSecurity@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoRelease@UIEnumWbemClassObject@@@@PEAUIEnumWbemClassObject@@@@QEAA@PEAUIEnumWbemClassObject@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIEnumWbemClassObject@@@@PEAUIEnumWbemClassObject@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoRelease@UIErrorInfo@@@@PEAUIErrorInfo@@@@QEAA@PEAUIErrorInfo@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIErrorInfo@@@@PEAUIErrorInfo@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoRelease@UIUnknown@@@@PEAUIUnknown@@@@QEAA@PEAUIUnknown@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIUnknown@@@@PEAUIUnknown@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoRelease@UIWbemClassObject@@@@PEAUIWbemClassObject@@@@QEAA@PEAUIWbemClassObject@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIWbemClassObject@@@@PEAUIWbemClassObject@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoRelease@UIWbemContext@@@@PEAUIWbemContext@@@@QEAA@PEAUIWbemContext@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIWbemContext@@@@PEAUIWbemContext@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoRelease@UIWbemLocator@@@@PEAUIWbemLocator@@@@QEAA@PEAUIWbemLocator@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIWbemLocator@@@@PEAUIWbemLocator@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoRelease@UIWbemObjectTextSrc@@@@PEAUIWbemObjectTextSrc@@@@QEAA@PEAUIWbemObjectTextSrc@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIWbemObjectTextSrc@@@@PEAUIWbemObjectTextSrc@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoRelease@UIWbemPath@@@@PEAUIWbemPath@@@@QEAA@PEAUIWbemPath@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIWbemPath@@@@PEAUIWbemPath@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoRelease@UIWbemPathKeyList@@@@PEAUIWbemPathKeyList@@@@QEAA@PEAUIWbemPathKeyList@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIWbemPathKeyList@@@@PEAUIWbemPathKeyList@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoRelease@UIWbemQualifierSet@@@@PEAUIWbemQualifierSet@@@@QEAA@PEAUIWbemQualifierSet@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIWbemQualifierSet@@@@PEAUIWbemQualifierSet@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoRelease@UIWbemQuery@@@@PEAUIWbemQuery@@@@QEAA@PEAUIWbemQuery@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIWbemQuery@@@@PEAUIWbemQuery@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoRelease@UIWbemServices@@@@PEAUIWbemServices@@@@QEAA@PEAUIWbemServices@@@Z
??0?$AutoCleanup@V?$AutoRelease@UIWbemServices@@@@PEAUIWbemServices@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoRelease@VApplication@Client@WSMan@@@@PEAVApplication@Client@WSMan@@@@QEAA@PEAVApplication@Client@WSMan@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCBaseConfigCache@@@@PEAVCBaseConfigCache@@@@QEAA@PEAVCBaseConfigCache@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCClientConfigSettings@@@@PEAVCClientConfigSettings@@@@QEAA@PEAVCClientConfigSettings@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCCommonConfigSettings@@@@PEAVCCommonConfigSettings@@@@QEAA@PEAVCCommonConfigSettings@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCConfigCacheMap@CBaseConfigCache@@@@PEAVCConfigCacheMap@CBaseConfigCache@@@@QEAA@PEAVCConfigCacheMap@CBaseConfigCache@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCConfigManager@@@@PEAVCConfigManager@@@@QEAA@PEAVCConfigManager@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCRemoteOperation@@@@PEAVCRemoteOperation@@@@QEAA@PEAVCRemoteOperation@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCRemoteSession@@@@PEAVCRemoteSession@@@@QEAA@PEAVCRemoteSession@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCRequestContext@@@@PEAVCRequestContext@@@@QEAA@PEAVCRequestContext@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCServiceCommonConfigSettings@@@@PEAVCServiceCommonConfigSettings@@@@QEAA@PEAVCServiceCommonConfigSettings@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCServiceConfigCache@@@@PEAVCServiceConfigCache@@@@QEAA@PEAVCServiceConfigCache@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCServiceConfigSettings@@@@PEAVCServiceConfigSettings@@@@QEAA@PEAVCServiceConfigSettings@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCWSManEPR@@@@PEAVCWSManEPR@@@@QEAA@PEAVCWSManEPR@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCWSManEPR@@@@PEAVCWSManEPR@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoRelease@VCWSManGroupPolicyCache@@@@PEAVCWSManGroupPolicyCache@@@@QEAA@PEAVCWSManGroupPolicyCache@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCWSManGroupPolicyManager@@@@PEAVCWSManGroupPolicyManager@@@@QEAA@PEAVCWSManGroupPolicyManager@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCWSManObject@@@@PEAVCWSManObject@@@@QEAA@PEAVCWSManObject@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCWSManResource@@@@PEAVCWSManResource@@@@QEAA@PEAVCWSManResource@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCWinRSPluginConfigCache@@@@PEAVCWinRSPluginConfigCache@@@@QEAA@PEAVCWinRSPluginConfigCache@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCWinRSPluginConfigCache@@@@PEAVCWinRSPluginConfigCache@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoRelease@VCWinRSPluginConfigSettings@@@@PEAVCWinRSPluginConfigSettings@@@@QEAA@PEAVCWinRSPluginConfigSettings@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCommand@Client@WSMan@@@@PEAVCommand@Client@WSMan@@@@QEAA@PEAVCommand@Client@WSMan@@@Z
??0?$AutoCleanup@V?$AutoRelease@VConfigNotification@@@@PEAVConfigNotification@@@@QEAA@PEAVConfigNotification@@@Z
??0?$AutoCleanup@V?$AutoRelease@VConnectShellOperation@Client@WSMan@@@@PEAVConnectShellOperation@Client@WSMan@@@@QEAA@PEAVConnectShellOperation@Client@WSMan@@@Z
??0?$AutoCleanup@V?$AutoRelease@VCreateShellOperation@Client@WSMan@@@@PEAVCreateShellOperation@Client@WSMan@@@@QEAA@PEAVCreateShellOperation@Client@WSMan@@@Z
??0?$AutoCleanup@V?$AutoRelease@VDeleteShellOperation@Client@WSMan@@@@PEAVDeleteShellOperation@Client@WSMan@@@@QEAA@PEAVDeleteShellOperation@Client@WSMan@@@Z
??0?$AutoCleanup@V?$AutoRelease@VDisconnectOperation@Client@WSMan@@@@PEAVDisconnectOperation@Client@WSMan@@@@QEAA@PEAVDisconnectOperation@Client@WSMan@@@Z
??0?$AutoCleanup@V?$AutoRelease@VEnumSinkEx@@@@PEAVEnumSinkEx@@@@QEAA@PEAVEnumSinkEx@@@Z
??0?$AutoCleanup@V?$AutoRelease@VEnumSinkEx@@@@PEAVEnumSinkEx@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoRelease@VGeneralSinkEx@@@@PEAVGeneralSinkEx@@@@QEAA@PEAVGeneralSinkEx@@@Z
??0?$AutoCleanup@V?$AutoRelease@VGeneralSinkEx@@@@PEAVGeneralSinkEx@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoRelease@VIISConfigSettings@@@@PEAVIISConfigSettings@@@@QEAA@PEAVIISConfigSettings@@@Z
??0?$AutoCleanup@V?$AutoRelease@VIPCSoapProcessor@@@@PEAVIPCSoapProcessor@@@@QEAA@PEAVIPCSoapProcessor@@@Z
??0?$AutoCleanup@V?$AutoRelease@VIRequestContext@@@@PEAVIRequestContext@@@@QEAA@PEAVIRequestContext@@@Z
??0?$AutoCleanup@V?$AutoRelease@VIRequestContext@@@@PEAVIRequestContext@@@@QEAA@XZ
??0?$AutoCleanup@V?$AutoRelease@VISubscription@@@@PEAVISubscription@@@@QEAA@PEAVISubscription@@@Z
??0?$AutoCleanup@V?$AutoRelease@VInboundRequestDetails@@@@PEAVInboundRequestDetails@@@@QEAA@PEAVInboundRequestDetails@@@Z
??0?$AutoCleanup@V?$AutoRelease@VReceiveOperation@Client@WSMan@@@@PEAVReceiveOperation@Client@WSMan@@@@QEAA@PEAVReceiveOperation@Client@WSMan@@@Z
??0?$AutoCleanup@V?$AutoRelease@VReconnectOperation@Client@WSMan@@@@PEAVReconnectOperation@Client@WSMan@@@@QEAA@PEAVReconnectOperation@Client@WSMan@@@Z
??0?$AutoCleanup@V?$AutoRelease@VSendOperation@Client@WSMan@@@@PEAVSendOperation@Client@WSMan@@@@QEAA@PEAVSendOperation@Client@WSMan@@@Z
??0?$AutoCleanup@V?$AutoRelease@VShell@Client@WSMan@@@@PEAVShell@Client@WSMan@@@@QEAA@PEAVShell@Client@WSMan@@@Z
??0?$AutoCleanup@V?$AutoRelease@VShellInfo@@@@PEAVShellInfo@@@@QEAA@PEAVShellInfo@@@Z
??0?$AutoCleanup@V?$AutoRelease@VSignalOperation@Client@WSMan@@@@PEAVSignalOperation@Client@WSMan@@@@QEAA@PEAVSignalOperation@Client@WSMan@@@Z
??0?$AutoCleanup@V?$AutoRelease@VUserRecord@@@@PEAVUserRecord@@@@QEAA@PEAVUserRecord@@@Z
??0?$AutoCleanup@V?$AutoRelease@VWSManHttpListener@@@@PEAVWSManHttpListener@@@@QEAA@PEAVWSManHttpListener@@@Z
??0?$AutoCleanup@V?$AutoReleaseEx@VHostMappingTableEntry@@@@PEAVHostMappingTableEntry@@@@QEAA@PEAVHostMappingTableEntry@@@Z
??0?$AutoCleanup@V?$AutoReleaseEx@VShell@Client@WSMan@@@@PEAVShell@Client@WSMan@@@@QEAA@PEAVShell@Client@WSMan@@@Z
??0?$AutoCleanup@VAutoBstr@@PEAG@@QEAA@PEAG@Z
??0?$AutoCleanup@VAutoBstr@@PEAG@@QEAA@XZ
??0?$AutoCleanup@VAutoBstrNoAlloc@@PEAG@@QEAA@PEAG@Z
??0?$AutoCleanup@VAutoBstrNoAlloc@@PEAG@@QEAA@XZ
??0?$AutoCleanup@VAutoCertContext@@PEBU_CERT_CONTEXT@@@@QEAA@PEBU_CERT_CONTEXT@@@Z
??0?$AutoCleanup@VAutoCertContext@@PEBU_CERT_CONTEXT@@@@QEAA@XZ
??0?$AutoCleanup@VAutoChainContext@@PEBU_CERT_CHAIN_CONTEXT@@@@QEAA@PEBU_CERT_CHAIN_CONTEXT@@@Z
??0?$AutoCleanup@VAutoChainContext@@PEBU_CERT_CHAIN_CONTEXT@@@@QEAA@XZ
??0?$AutoCleanup@VAutoCoTaskMemFree@@PEAX@@QEAA@PEAX@Z
??0?$AutoCleanup@VAutoCoTaskMemFree@@PEAX@@QEAA@XZ
??0?$AutoCleanup@VAutoFwXmlCloseParser@@PEAX@@QEAA@PEAX@Z
??0?$AutoCleanup@VAutoFwXmlCloseParser@@PEAX@@QEAA@XZ
??0?$AutoCleanup@VAutoHandle@@PEAX@@QEAA@PEAX@Z
??0?$AutoCleanup@VAutoHandle@@PEAX@@QEAA@XZ
??0?$AutoCleanup@VAutoImpersonateUser@@PEAX@@QEAA@PEAX@Z
??0?$AutoCleanup@VAutoImpersonateUser@@PEAX@@QEAA@XZ
??0?$AutoCleanup@VAutoLibrary@@PEAUHINSTANCE__@@@@QEAA@PEAUHINSTANCE__@@@Z
??0?$AutoCleanup@VAutoLibrary@@PEAUHINSTANCE__@@@@QEAA@XZ
??0?$AutoCleanup@VAutoLocalFree@@PEAX@@QEAA@PEAX@Z
??0?$AutoCleanup@VAutoLocalFree@@PEAX@@QEAA@XZ
??0?$AutoCleanup@VAutoMIClass@@PEAU_MI_Class@@@@QEAA@PEAU_MI_Class@@@Z
??0?$AutoCleanup@VAutoMIClass@@PEAU_MI_Class@@@@QEAA@XZ
??0?$AutoCleanup@VAutoMIInstance@@PEAU_MI_Instance@@@@QEAA@PEAU_MI_Instance@@@Z
??0?$AutoCleanup@VAutoMIInstance@@PEAU_MI_Instance@@@@QEAA@XZ
??0?$AutoCleanup@VAutoObject@@PEAUWSMAN_OBJECT@@@@QEAA@PEAUWSMAN_OBJECT@@@Z
??0?$AutoCleanup@VAutoObject@@PEAUWSMAN_OBJECT@@@@QEAA@XZ
??0?$AutoCleanup@VAutoRegKey@@PEAUHKEY__@@@@QEAA@PEAUHKEY__@@@Z
??0?$AutoCleanup@VAutoRegKey@@PEAUHKEY__@@@@QEAA@XZ
??0?$AutoCleanup@VAutoSecurityDescriptor@@PEAX@@QEAA@PEAX@Z
??0?$AutoCleanup@VAutoSecurityDescriptor@@PEAX@@QEAA@XZ
??0?$AutoCleanup@VAutoWaitHandle@@PEAX@@QEAA@PEAX@Z
??0?$AutoCleanup@VAutoWaitHandle@@PEAX@@QEAA@XZ
??0?$AutoDelete@D@@QEAA@XZ
??0?$AutoDelete@G@@QEAA@PEAG@Z
??0?$AutoDelete@G@@QEAA@XZ
??0?$AutoDelete@UIPRange@CWSManIPFilter@@@@QEAA@XZ
??0?$AutoDelete@U_SID@@@@QEAA@PEAU_SID@@@Z
??0?$AutoDelete@U_WSMAN_STREAM_ID_SET@@@@QEAA@PEAU_WSMAN_STREAM_ID_SET@@@Z
??0?$AutoDelete@V?$Handle@VISubscription@@@@@@QEAA@PEAV?$Handle@VISubscription@@@@@Z
??0?$AutoDelete@V?$SafeMap_Iterator@VStringKeyCI@@K@@@@QEAA@XZ
??0?$AutoDelete@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@QEAA@XZ
??0?$AutoDelete@V?$SafeSet@PEAVCCertMapping@@@@@@QEAA@PEAV?$SafeSet@PEAVCCertMapping@@@@@Z
??0?$AutoDelete@V?$SafeSet@PEAVCCertMapping@@@@@@QEAA@XZ
??0?$AutoDelete@V?$SafeSet@PEAVCShellUriSettings@@@@@@QEAA@PEAV?$SafeSet@PEAVCShellUriSettings@@@@@Z
??0?$AutoDelete@V?$SafeSet@PEAVCShellUriSettings@@@@@@QEAA@XZ
??0?$AutoDelete@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@QEAA@XZ
??0?$AutoDelete@V?$SimpleStack@VCListenerOperation@@@@@@QEAA@XZ
??0?$AutoDelete@V?$SimpleStack@VShellHostEntry@@@@@@QEAA@XZ
??0?$AutoDelete@V?$set@PEAVCListenerSettings@@VCListenerSettingsLessFunctor@CServiceConfigSettings@@V?$transport_allocator@PEAVCListenerSettings@@@@@std@@@@QEAA@PEAV?$set@PEAVCListenerSettings@@VCListenerSettingsLessFunctor@CServiceConfigSettings@@V?$transport_allocator@PEAVCListenerSettings@@@@@std@@@Z
??0?$AutoDelete@V?$set@PEAVCListenerSettings@@VCListenerSettingsLessFunctor@CServiceConfigSettings@@V?$transport_allocator@PEAVCListenerSettings@@@@@std@@@@QEAA@XZ
??0?$AutoDelete@V?$set@Usockaddr_storage@@VSockAddrLessFunctor@CListenerSettings@@V?$transport_allocator@Usockaddr_storage@@@@@std@@@@QEAA@XZ
??0?$AutoDelete@V?$vector@PEAVHandleImpl@Client@WSMan@@V?$transport_allocator@PEAVHandleImpl@Client@WSMan@@@@@std@@@@QEAA@XZ
??0?$AutoDelete@V?$vector@PEAVIServiceConfigObserver@@V?$transport_allocator@PEAVIServiceConfigObserver@@@@@std@@@@QEAA@XZ
??0?$AutoDelete@VAdminSid@CSecurity@@@@QEAA@PEAVAdminSid@CSecurity@@@Z
??0?$AutoDelete@VBlockedRecord@@@@QEAA@XZ
??0?$AutoDelete@VCBaseConfigCache@@@@QEAA@PEAVCBaseConfigCache@@@Z
??0?$AutoDelete@VCCertMapping@@@@QEAA@PEAVCCertMapping@@@Z
??0?$AutoDelete@VCConfigChangeSource@@@@QEAA@XZ
??0?$AutoDelete@VCListenerSettings@@@@QEAA@PEAVCListenerSettings@@@Z
??0?$AutoDelete@VCObserverConfigChangeErrors@@@@QEAA@XZ
??0?$AutoDelete@VCServiceWatcher@CServiceConfigCache@@@@QEAA@PEAVCServiceWatcher@CServiceConfigCache@@@Z
??0?$AutoDelete@VCServiceWatcher@CServiceConfigCache@@@@QEAA@XZ
??0?$AutoDelete@VCShellUriSettings@@@@QEAA@PEAVCShellUriSettings@@@Z
??0?$AutoDelete@VCWSManEPR@@@@QEAA@PEAVCWSManEPR@@@Z
??0?$AutoDelete@VCWSManResource@@@@QEAA@PEAVCWSManResource@@@Z
??0?$AutoDelete@VCWSManResource@@@@QEAA@XZ
??0?$AutoDelete@VCertHash@@@@QEAA@PEAVCertHash@@@Z
??0?$AutoDelete@VCertHash@@@@QEAA@XZ
??0?$AutoDelete@VConfigUpdate@@@@QEAA@PEAVConfigUpdate@@@Z
??0?$AutoDelete@VConfigUpdate@@@@QEAA@XZ
??0?$AutoDelete@VEnumSinkEx@@@@QEAA@PEAVEnumSinkEx@@@Z
??0?$AutoDelete@VEnumSinkEx@@@@QEAA@XZ
??0?$AutoDelete@VEventHandler@WSMan@@@@QEAA@PEAVEventHandler@WSMan@@@Z
??0?$AutoDelete@VExpiredOperationIdRecord@@@@QEAA@PEAVExpiredOperationIdRecord@@@Z
??0?$AutoDelete@VGPApiManager@@@@QEAA@XZ
??0?$AutoDelete@VGeneralSinkEx@@@@QEAA@PEAVGeneralSinkEx@@@Z
??0?$AutoDelete@VGeneralSinkEx@@@@QEAA@XZ
??0?$AutoDelete@VIChannelObserverFactory@@@@QEAA@PEAVIChannelObserverFactory@@@Z
??0?$AutoDelete@VIChannelObserverFactory@@@@QEAA@XZ
??0?$AutoDelete@VIQueryDASHSMASHInterface@@@@QEAA@PEAVIQueryDASHSMASHInterface@@@Z
??0?$AutoDelete@VIQueryDASHSMASHInterface@@@@QEAA@XZ
??0?$AutoDelete@VISpecification@@@@QEAA@PEAVISpecification@@@Z
??0?$AutoDelete@VISpecification@@@@QEAA@XZ
??0?$AutoDelete@VInteractiveSid@CSecurity@@@@QEAA@PEAVInteractiveSid@CSecurity@@@Z
??0?$AutoDelete@VIpHlpApiDllLoader@@@@QEAA@PEAVIpHlpApiDllLoader@@@Z
??0?$AutoDelete@VMachineName@@@@QEAA@PEAVMachineName@@@Z
??0?$AutoDelete@VNetworkServiceSid@CSecurity@@@@QEAA@PEAVNetworkServiceSid@CSecurity@@@Z
??0?$AutoDelete@VNtDsApiDllLoader@@@@QEAA@PEAVNtDsApiDllLoader@@@Z
??0?$AutoDelete@VOptionValue@SessionOptions@Client@WSMan@@@@QEAA@PEAVOptionValue@SessionOptions@Client@WSMan@@@Z
??0?$AutoDelete@VPacketCreator@@@@QEAA@PEAVPacketCreator@@@Z
??0?$AutoDelete@VPacketCreator@@@@QEAA@XZ
??0?$AutoDelete@VPacketParser@@@@QEAA@XZ
??0?$AutoDelete@VResources@Locale@@@@QEAA@PEAVResources@Locale@@@Z
??0?$AutoDelete@VRunAsConfiguration@@@@QEAA@PEAVRunAsConfiguration@@@Z
??0?$AutoDelete@VSecurityEntry@Catalog@@@@QEAA@PEAVSecurityEntry@Catalog@@@Z
??0?$AutoDelete@VSendPacketArgs@RobustConnectionBuffer@@@@QEAA@PEAVSendPacketArgs@RobustConnectionBuffer@@@Z
??0?$AutoDelete@VServiceSoapProcessor@@@@QEAA@XZ
??0?$AutoDelete@VShell32DllLoader@@@@QEAA@PEAVShell32DllLoader@@@Z
??0?$AutoDelete@VShlWApiDllLoader@@@@QEAA@PEAVShlWApiDllLoader@@@Z
??0?$AutoDelete@VSubscriptionEnumerator@@@@QEAA@XZ
??0?$AutoDelete@VSubscriptionManager@@@@QEAA@PEAVSubscriptionManager@@@Z
??0?$AutoDelete@VTSTRBUFFER@@@@QEAA@PEAVTSTRBUFFER@@@Z
??0?$AutoDelete@VTSTRBUFFER@@@@QEAA@XZ
??0?$AutoDelete@VUniqueStringOverflow@@@@QEAA@XZ
??0?$AutoDelete@VUser32DllLoader@@@@QEAA@PEAVUser32DllLoader@@@Z
??0?$AutoDelete@VWSMANCONFIGTABLE_IDENTITY@@@@QEAA@PEAVWSMANCONFIGTABLE_IDENTITY@@@Z
??0?$AutoDelete@VWSManMemCryptManager@@@@QEAA@PEAVWSManMemCryptManager@@@Z
??0?$AutoDelete@VWmiEnumContext@@@@QEAA@PEAVWmiEnumContext@@@Z
??0?$AutoDelete@VWmiEnumContext@@@@QEAA@XZ
??0?$AutoDelete@VXmlReader@@@@QEAA@PEAVXmlReader@@@Z
??0?$AutoDelete@VXmlReader@@@@QEAA@XZ
??0?$AutoDeleteVector@$$CBG@@QEAA@XZ
??0?$AutoDeleteVector@D@@QEAA@PEAD@Z
??0?$AutoDeleteVector@D@@QEAA@XZ
??0?$AutoDeleteVector@E@@QEAA@PEAE@Z
??0?$AutoDeleteVector@E@@QEAA@XZ
??0?$AutoDeleteVector@G@@QEAA@PEAG@Z
??0?$AutoDeleteVector@G@@QEAA@XZ
??0?$AutoDeleteVector@H@@QEAA@PEAH@Z
??0?$AutoDeleteVector@PEAG@@QEAA@PEAPEAG@Z
??0?$AutoDeleteVector@PEAG@@QEAA@XZ
??0?$AutoDeleteVector@PEBG@@QEAA@PEAPEBG@Z
??0?$AutoDeleteVector@PEBG@@QEAA@XZ
??0?$AutoDeleteVector@U_CONFIG_UPDATE@@@@QEAA@XZ
??0?$AutoDeleteVector@U_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@QEAA@PEAU_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@Z
??0?$AutoDeleteVector@U_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@QEAA@XZ
??0?$AutoDeleteVector@U_WINRS_RUN_COMMAND_ARG@@@@QEAA@PEAU_WINRS_RUN_COMMAND_ARG@@@Z
??0?$AutoDeleteVector@U_WINRS_RUN_COMMAND_ARG@@@@QEAA@XZ
??0?$AutoDeleteVector@U_WSMAN_OPTION@@@@QEAA@PEAU_WSMAN_OPTION@@@Z
??0?$AutoDeleteVector@U_WSMAN_OPTION@@@@QEAA@XZ
??0?$AutoDeleteVector@X@@QEAA@PEAX@Z
??0?$AutoDeleteVector@X@@QEAA@XZ
??0?$AutoFree@E@@QEAA@PEAE@Z
??0?$AutoFree@E@@QEAA@XZ
??0?$AutoLocklessItemRecycle@VPacket@@@@QEAA@PEAVPacket@@@Z
??0?$AutoLocklessItemRecycle@VPacket@@@@QEAA@XZ
??0?$AutoRelease@UIAppHostAdminManager@@@@QEAA@PEAUIAppHostAdminManager@@@Z
??0?$AutoRelease@UIAppHostChildElementCollection@@@@QEAA@XZ
??0?$AutoRelease@UIAppHostConfigException@@@@QEAA@PEAUIAppHostConfigException@@@Z
??0?$AutoRelease@UIAppHostElement@@@@QEAA@PEAUIAppHostElement@@@Z
??0?$AutoRelease@UIAppHostElement@@@@QEAA@XZ
??0?$AutoRelease@UIAppHostElementCollection@@@@QEAA@XZ
??0?$AutoRelease@UIAppHostProperty@@@@QEAA@XZ
??0?$AutoRelease@UIAppHostPropertyCollection@@@@QEAA@XZ
??0?$AutoRelease@UIClientSecurity@@@@QEAA@PEAUIClientSecurity@@@Z
??0?$AutoRelease@UIClientSecurity@@@@QEAA@XZ
??0?$AutoRelease@UIEnumWbemClassObject@@@@QEAA@PEAUIEnumWbemClassObject@@@Z
??0?$AutoRelease@UIEnumWbemClassObject@@@@QEAA@XZ
??0?$AutoRelease@UIErrorInfo@@@@QEAA@PEAUIErrorInfo@@@Z
??0?$AutoRelease@UIErrorInfo@@@@QEAA@XZ
??0?$AutoRelease@UIUnknown@@@@QEAA@PEAUIUnknown@@@Z
??0?$AutoRelease@UIUnknown@@@@QEAA@XZ
??0?$AutoRelease@UIWbemClassObject@@@@QEAA@PEAUIWbemClassObject@@@Z
??0?$AutoRelease@UIWbemClassObject@@@@QEAA@XZ
??0?$AutoRelease@UIWbemContext@@@@QEAA@PEAUIWbemContext@@@Z
??0?$AutoRelease@UIWbemContext@@@@QEAA@XZ
??0?$AutoRelease@UIWbemLocator@@@@QEAA@PEAUIWbemLocator@@@Z
??0?$AutoRelease@UIWbemLocator@@@@QEAA@XZ
??0?$AutoRelease@UIWbemObjectTextSrc@@@@QEAA@PEAUIWbemObjectTextSrc@@@Z
??0?$AutoRelease@UIWbemObjectTextSrc@@@@QEAA@XZ
??0?$AutoRelease@UIWbemPath@@@@QEAA@PEAUIWbemPath@@@Z
??0?$AutoRelease@UIWbemPath@@@@QEAA@XZ
??0?$AutoRelease@UIWbemPathKeyList@@@@QEAA@PEAUIWbemPathKeyList@@@Z
??0?$AutoRelease@UIWbemPathKeyList@@@@QEAA@XZ
??0?$AutoRelease@UIWbemQualifierSet@@@@QEAA@PEAUIWbemQualifierSet@@@Z
??0?$AutoRelease@UIWbemQualifierSet@@@@QEAA@XZ
??0?$AutoRelease@UIWbemQuery@@@@QEAA@PEAUIWbemQuery@@@Z
??0?$AutoRelease@UIWbemQuery@@@@QEAA@XZ
??0?$AutoRelease@UIWbemServices@@@@QEAA@PEAUIWbemServices@@@Z
??0?$AutoRelease@UIWbemServices@@@@QEAA@XZ
??0?$AutoRelease@VApplication@Client@WSMan@@@@QEAA@XZ
??0?$AutoRelease@VCBaseConfigCache@@@@QEAA@PEAVCBaseConfigCache@@@Z
??0?$AutoRelease@VCClientConfigSettings@@@@QEAA@PEAVCClientConfigSettings@@@Z
??0?$AutoRelease@VCClientConfigSettings@@@@QEAA@XZ
??0?$AutoRelease@VCCommonConfigSettings@@@@QEAA@PEAVCCommonConfigSettings@@@Z
??0?$AutoRelease@VCCommonConfigSettings@@@@QEAA@XZ
??0?$AutoRelease@VCConfigCacheMap@CBaseConfigCache@@@@QEAA@PEAVCConfigCacheMap@CBaseConfigCache@@@Z
??0?$AutoRelease@VCConfigCacheMap@CBaseConfigCache@@@@QEAA@XZ
??0?$AutoRelease@VCConfigManager@@@@QEAA@PEAVCConfigManager@@@Z
??0?$AutoRelease@VCConfigManager@@@@QEAA@XZ
??0?$AutoRelease@VCRemoteOperation@@@@QEAA@PEAVCRemoteOperation@@@Z
??0?$AutoRelease@VCRemoteSession@@@@QEAA@PEAVCRemoteSession@@@Z
??0?$AutoRelease@VCRemoteSession@@@@QEAA@XZ
??0?$AutoRelease@VCRequestContext@@@@QEAA@PEAVCRequestContext@@@Z
??0?$AutoRelease@VCRequestContext@@@@QEAA@XZ
??0?$AutoRelease@VCServiceCommonConfigSettings@@@@QEAA@PEAVCServiceCommonConfigSettings@@@Z
??0?$AutoRelease@VCServiceCommonConfigSettings@@@@QEAA@XZ
??0?$AutoRelease@VCServiceConfigCache@@@@QEAA@PEAVCServiceConfigCache@@@Z
??0?$AutoRelease@VCServiceConfigCache@@@@QEAA@XZ
??0?$AutoRelease@VCServiceConfigSettings@@@@QEAA@PEAVCServiceConfigSettings@@@Z
??0?$AutoRelease@VCServiceConfigSettings@@@@QEAA@XZ
??0?$AutoRelease@VCWSManEPR@@@@QEAA@PEAVCWSManEPR@@@Z
??0?$AutoRelease@VCWSManEPR@@@@QEAA@XZ
??0?$AutoRelease@VCWSManGroupPolicyCache@@@@QEAA@PEAVCWSManGroupPolicyCache@@@Z
??0?$AutoRelease@VCWSManGroupPolicyManager@@@@QEAA@PEAVCWSManGroupPolicyManager@@@Z
??0?$AutoRelease@VCWSManObject@@@@QEAA@PEAVCWSManObject@@@Z
??0?$AutoRelease@VCWSManResource@@@@QEAA@PEAVCWSManResource@@@Z
??0?$AutoRelease@VCWSManResource@@@@QEAA@XZ
??0?$AutoRelease@VCWinRSPluginConfigCache@@@@QEAA@PEAVCWinRSPluginConfigCache@@@Z
??0?$AutoRelease@VCWinRSPluginConfigCache@@@@QEAA@XZ
??0?$AutoRelease@VCWinRSPluginConfigSettings@@@@QEAA@PEAVCWinRSPluginConfigSettings@@@Z
??0?$AutoRelease@VCommand@Client@WSMan@@@@QEAA@PEAVCommand@Client@WSMan@@@Z
??0?$AutoRelease@VConfigNotification@@@@QEAA@PEAVConfigNotification@@@Z
??0?$AutoRelease@VConnectShellOperation@Client@WSMan@@@@QEAA@PEAVConnectShellOperation@Client@WSMan@@@Z
??0?$AutoRelease@VCreateShellOperation@Client@WSMan@@@@QEAA@PEAVCreateShellOperation@Client@WSMan@@@Z
??0?$AutoRelease@VDeleteShellOperation@Client@WSMan@@@@QEAA@PEAVDeleteShellOperation@Client@WSMan@@@Z
??0?$AutoRelease@VDisconnectOperation@Client@WSMan@@@@QEAA@PEAVDisconnectOperation@Client@WSMan@@@Z
??0?$AutoRelease@VEnumSinkEx@@@@QEAA@PEAVEnumSinkEx@@@Z
??0?$AutoRelease@VEnumSinkEx@@@@QEAA@XZ
??0?$AutoRelease@VGeneralSinkEx@@@@QEAA@PEAVGeneralSinkEx@@@Z
??0?$AutoRelease@VGeneralSinkEx@@@@QEAA@XZ
??0?$AutoRelease@VIISConfigSettings@@@@QEAA@XZ
??0?$AutoRelease@VIPCSoapProcessor@@@@QEAA@PEAVIPCSoapProcessor@@@Z
??0?$AutoRelease@VIRequestContext@@@@QEAA@PEAVIRequestContext@@@Z
??0?$AutoRelease@VIRequestContext@@@@QEAA@XZ
??0?$AutoRelease@VISubscription@@@@QEAA@PEAVISubscription@@@Z
??0?$AutoRelease@VInboundRequestDetails@@@@QEAA@XZ
??0?$AutoRelease@VReceiveOperation@Client@WSMan@@@@QEAA@PEAVReceiveOperation@Client@WSMan@@@Z
??0?$AutoRelease@VReconnectOperation@Client@WSMan@@@@QEAA@PEAVReconnectOperation@Client@WSMan@@@Z
??0?$AutoRelease@VSendOperation@Client@WSMan@@@@QEAA@PEAVSendOperation@Client@WSMan@@@Z
??0?$AutoRelease@VShell@Client@WSMan@@@@QEAA@PEAVShell@Client@WSMan@@@Z
??0?$AutoRelease@VShellInfo@@@@QEAA@XZ
??0?$AutoRelease@VSignalOperation@Client@WSMan@@@@QEAA@PEAVSignalOperation@Client@WSMan@@@Z
??0?$AutoRelease@VUserRecord@@@@QEAA@XZ
??0?$AutoRelease@VWSManHttpListener@@@@QEAA@PEAVWSManHttpListener@@@Z
??0?$AutoReleaseEx@VHostMappingTableEntry@@@@QEAA@XZ
??0?$AutoReleaseEx@VShell@Client@WSMan@@@@QEAA@PEAVShell@Client@WSMan@@@Z
??0?$ILoader@VAdminSid@CSecurity@@@@QEAA@P8AdminSid@CSecurity@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$ILoader@VEventHandler@WSMan@@@@QEAA@P8EventHandler@WSMan@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$ILoader@VInteractiveSid@CSecurity@@@@QEAA@P8InteractiveSid@CSecurity@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$ILoader@VIpHlpApiDllLoader@@@@QEAA@P8IpHlpApiDllLoader@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$ILoader@VMachineName@@@@QEAA@P8MachineName@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$ILoader@VNetworkServiceSid@CSecurity@@@@QEAA@P8NetworkServiceSid@CSecurity@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$ILoader@VNtDsApiDllLoader@@@@QEAA@P8NtDsApiDllLoader@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$ILoader@VResources@Locale@@@@QEAA@P8Resources@Locale@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$ILoader@VShell32DllLoader@@@@QEAA@P8Shell32DllLoader@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$ILoader@VShlWApiDllLoader@@@@QEAA@P8ShlWApiDllLoader@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$ILoader@VSubscriptionManager@@@@QEAA@P8SubscriptionManager@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$ILoader@VUser32DllLoader@@@@QEAA@P8User32DllLoader@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$ILoader@VWSManMemCryptManager@@@@QEAA@P8WSManMemCryptManager@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$Loader@VAdminSid@CSecurity@@$00@@QEAA@XZ
??0?$Loader@VEventHandler@WSMan@@$00@@QEAA@XZ
??0?$Loader@VInteractiveSid@CSecurity@@$00@@QEAA@XZ
??0?$Loader@VIpHlpApiDllLoader@@$00@@QEAA@XZ
??0?$Loader@VMachineName@@$00@@QEAA@XZ
??0?$Loader@VNetworkServiceSid@CSecurity@@$00@@QEAA@XZ
??0?$Loader@VNtDsApiDllLoader@@$00@@QEAA@XZ
??0?$Loader@VResources@Locale@@$0A@@@QEAA@XZ
??0?$Loader@VShell32DllLoader@@$00@@QEAA@XZ
??0?$Loader@VShlWApiDllLoader@@$00@@QEAA@XZ
??0?$Loader@VUser32DllLoader@@$00@@QEAA@XZ
??0?$Loader@VWSManMemCryptManager@@$00@@QEAA@XZ
??0?$LoaderSerializer@VAdminSid@CSecurity@@$00@@QEAA@P8AdminSid@CSecurity@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$LoaderSerializer@VEventHandler@WSMan@@$00@@QEAA@P8EventHandler@WSMan@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$LoaderSerializer@VInteractiveSid@CSecurity@@$00@@QEAA@P8InteractiveSid@CSecurity@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$LoaderSerializer@VIpHlpApiDllLoader@@$00@@QEAA@P8IpHlpApiDllLoader@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$LoaderSerializer@VMachineName@@$00@@QEAA@P8MachineName@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$LoaderSerializer@VNetworkServiceSid@CSecurity@@$00@@QEAA@P8NetworkServiceSid@CSecurity@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$LoaderSerializer@VNtDsApiDllLoader@@$00@@QEAA@P8NtDsApiDllLoader@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$LoaderSerializer@VResources@Locale@@$0A@@@QEAA@P8Resources@Locale@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$LoaderSerializer@VShell32DllLoader@@$00@@QEAA@P8Shell32DllLoader@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$LoaderSerializer@VShlWApiDllLoader@@$00@@QEAA@P8ShlWApiDllLoader@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$LoaderSerializer@VSubscriptionManager@@$01@@QEAA@P8SubscriptionManager@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$LoaderSerializer@VUser32DllLoader@@$00@@QEAA@P8User32DllLoader@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$LoaderSerializer@VWSManMemCryptManager@@$00@@QEAA@P8WSManMemCryptManager@@EAA_NAEAVIRequestContext@@@Z1@Z
??0?$PacketElement@K@PacketParser@@QEAA@XZ
??0?$PacketElement@PEAU_FWXML_ELEMENT@@@PacketParser@@QEAA@XZ
??0?$PacketElement@PEBG@PacketParser@@QEAA@XZ
??0?$PacketElement@_K@PacketParser@@QEAA@XZ
??0?$SafeMap@PEAVCCertMapping@@UEmpty@@V?$SafeSet_Iterator@PEAVCCertMapping@@@@@@QEAA@XZ
??0?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@QEAA@XZ
??0?$SafeMap@PEAVCShellUriSettings@@UEmpty@@V?$SafeSet_Iterator@PEAVCShellUriSettings@@@@@@QEAA@XZ
??0?$SafeMap@PEAXUEmpty@@V?$SafeSet_Iterator@PEAX@@@@QEAA@XZ
??0?$SafeMap@UPluginKey@@KV?$SafeMap_Iterator@UPluginKey@@K@@@@QEAA@XZ
??0?$SafeMap@UUserKey@@PEAVBlockedRecord@@V?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@@@QEAA@XZ
??0?$SafeMap@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@V?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@@@QEAA@XZ
??0?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@XZ
??0?$SafeMap@VStringKeyCI@@KV?$SafeMap_Iterator@VStringKeyCI@@K@@@@QEAA@XZ
??0?$SafeMap@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@V?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@@@QEAA@XZ
??0?$SafeMap@VStringKeyStore@@PEAVExpiredOperationIdRecord@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@@@QEAA@XZ
??0?$SafeMap@VStringKeyStore@@PEAVServerFullDuplexChannel@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@@@QEAA@XZ
??0?$SafeMap@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@QEAA@XZ
??0?$SafeMap@_KPEAVSendPacketArgs@RobustConnectionBuffer@@V?$SafeMap_Iterator@_KPEAVSendPacketArgs@RobustConnectionBuffer@@@@@@QEAA@XZ
??0?$SafeMap_Iterator@PEAVCCertMapping@@UEmpty@@@@QEAA@AEAV?$SafeMap@PEAVCCertMapping@@UEmpty@@V?$SafeMap_Iterator@PEAVCCertMapping@@UEmpty@@@@@@_N@Z
??0?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@QEAA@AEAV?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@@@_N@Z
??0?$SafeMap_Iterator@PEAVCShellUriSettings@@UEmpty@@@@QEAA@AEAV?$SafeMap@PEAVCShellUriSettings@@UEmpty@@V?$SafeMap_Iterator@PEAVCShellUriSettings@@UEmpty@@@@@@_N@Z
??0?$SafeMap_Iterator@PEAXUEmpty@@@@QEAA@AEAV?$SafeMap@PEAXUEmpty@@V?$SafeMap_Iterator@PEAXUEmpty@@@@@@_N@Z
??0?$SafeMap_Iterator@UPluginKey@@K@@QEAA@AEAV?$SafeMap@UPluginKey@@KV?$SafeMap_Iterator@UPluginKey@@K@@@@_N@Z
??0?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@QEAA@AEAV?$SafeMap@UUserKey@@PEAVBlockedRecord@@V?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@@@_N@Z
??0?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@QEAA@AEAV?$SafeMap@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@V?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@@@_N@Z
??0?$SafeMap_Iterator@VKey@Locale@@K@@QEAA@AEAV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@_N@Z
??0?$SafeMap_Iterator@VStringKeyCI@@K@@QEAA@AEAV?$SafeMap@VStringKeyCI@@KV?$SafeMap_Iterator@VStringKeyCI@@K@@@@_N@Z
??0?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@QEAA@AEAV?$SafeMap@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@V?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@@@_N@Z
??0?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@QEAA@AEAV?$SafeMap@VStringKeyStore@@PEAVExpiredOperationIdRecord@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@@@_N@Z
??0?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@QEAA@AEAV?$SafeMap@VStringKeyStore@@PEAVServerFullDuplexChannel@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@@@_N@Z
??0?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@QEAA@AEAV?$SafeMap@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@_N@Z
??0?$SafeMap_Iterator@_KPEAVSendPacketArgs@RobustConnectionBuffer@@@@QEAA@AEAV?$SafeMap@_KPEAVSendPacketArgs@RobustConnectionBuffer@@V?$SafeMap_Iterator@_KPEAVSendPacketArgs@RobustConnectionBuffer@@@@@@_N@Z
??0?$SafeMap_Lock@PEAVCCertMapping@@UEmpty@@V?$SafeMap_Iterator@PEAVCCertMapping@@UEmpty@@@@@@QEAA@AEBV?$SafeMap@PEAVCCertMapping@@UEmpty@@V?$SafeMap_Iterator@PEAVCCertMapping@@UEmpty@@@@@@_N@Z
??0?$SafeMap_Lock@PEAVCCertMapping@@UEmpty@@V?$SafeSet_Iterator@PEAVCCertMapping@@@@@@QEAA@AEBV?$SafeMap@PEAVCCertMapping@@UEmpty@@V?$SafeSet_Iterator@PEAVCCertMapping@@@@@@_N@Z
??0?$SafeMap_Lock@PEAVCListenerOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@@@QEAA@AEBV?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@@@_N@Z
??0?$SafeMap_Lock@PEAVCListenerOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@QEAA@AEBV?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@_N@Z
??0?$SafeMap_Lock@PEAVCShellUriSettings@@UEmpty@@V?$SafeMap_Iterator@PEAVCShellUriSettings@@UEmpty@@@@@@QEAA@AEBV?$SafeMap@PEAVCShellUriSettings@@UEmpty@@V?$SafeMap_Iterator@PEAVCShellUriSettings@@UEmpty@@@@@@_N@Z
??0?$SafeMap_Lock@PEAVCShellUriSettings@@UEmpty@@V?$SafeSet_Iterator@PEAVCShellUriSettings@@@@@@QEAA@AEBV?$SafeMap@PEAVCShellUriSettings@@UEmpty@@V?$SafeSet_Iterator@PEAVCShellUriSettings@@@@@@_N@Z
??0?$SafeMap_Lock@PEAXUEmpty@@V?$SafeMap_Iterator@PEAXUEmpty@@@@@@QEAA@AEBV?$SafeMap@PEAXUEmpty@@V?$SafeMap_Iterator@PEAXUEmpty@@@@@@_N@Z
??0?$SafeMap_Lock@PEAXUEmpty@@V?$SafeSet_Iterator@PEAX@@@@QEAA@AEBV?$SafeMap@PEAXUEmpty@@V?$SafeSet_Iterator@PEAX@@@@_N@Z
??0?$SafeMap_Lock@UPluginKey@@KV?$SafeMap_Iterator@UPluginKey@@K@@@@QEAA@AEBV?$SafeMap@UPluginKey@@KV?$SafeMap_Iterator@UPluginKey@@K@@@@_N@Z
??0?$SafeMap_Lock@UUserKey@@PEAVBlockedRecord@@V?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@@@QEAA@AEBV?$SafeMap@UUserKey@@PEAVBlockedRecord@@V?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@@@_N@Z
??0?$SafeMap_Lock@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@V?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@@@QEAA@AEBV?$SafeMap@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@V?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@@@_N@Z
??0?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@AEBV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@_N@Z
??0?$SafeMap_Lock@VStringKeyCI@@KV?$SafeMap_Iterator@VStringKeyCI@@K@@@@QEAA@AEBV?$SafeMap@VStringKeyCI@@KV?$SafeMap_Iterator@VStringKeyCI@@K@@@@_N@Z
??0?$SafeMap_Lock@VStringKeyCI@@UEmpty@@V?$SafeSet_Iterator@VStringKeyCI@@@@@@QEAA@AEBV?$SafeMap@VStringKeyCI@@UEmpty@@V?$SafeSet_Iterator@VStringKeyCI@@@@@@_N@Z
??0?$SafeMap_Lock@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@V?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@@@QEAA@AEBV?$SafeMap@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@V?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@@@_N@Z
??0?$SafeMap_Lock@VStringKeyStore@@PEAVExpiredOperationIdRecord@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@@@QEAA@AEBV?$SafeMap@VStringKeyStore@@PEAVExpiredOperationIdRecord@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@@@_N@Z
??0?$SafeMap_Lock@VStringKeyStore@@PEAVServerFullDuplexChannel@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@@@QEAA@AEBV?$SafeMap@VStringKeyStore@@PEAVServerFullDuplexChannel@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@@@_N@Z
??0?$SafeMap_Lock@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@QEAA@AEBV?$SafeMap@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@_N@Z
??0?$SafeMap_Lock@_KPEAVSendPacketArgs@RobustConnectionBuffer@@V?$SafeMap_Iterator@_KPEAVSendPacketArgs@RobustConnectionBuffer@@@@@@QEAA@AEBV?$SafeMap@_KPEAVSendPacketArgs@RobustConnectionBuffer@@V?$SafeMap_Iterator@_KPEAVSendPacketArgs@RobustConnectionBuffer@@@@@@_N@Z
??0?$SafeSet@PEAVCCertMapping@@@@QEAA@XZ
??0?$SafeSet@PEAVCListenerOperation@@@@QEAA@XZ
??0?$SafeSet@PEAVCShellUriSettings@@@@QEAA@XZ
??0?$SafeSet@PEAX@@QEAA@XZ
??0?$SafeSet_Iterator@PEAVCCertMapping@@@@QEAA@AEAV?$SafeMap@PEAVCCertMapping@@UEmpty@@V?$SafeSet_Iterator@PEAVCCertMapping@@@@@@_N@Z
??0?$SafeSet_Iterator@PEAVCCertMapping@@@@QEAA@AEAV?$SafeSet@PEAVCCertMapping@@@@@Z
??0?$SafeSet_Iterator@PEAVCListenerOperation@@@@QEAA@AEAV?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@_N@Z
??0?$SafeSet_Iterator@PEAVCListenerOperation@@@@QEAA@AEAV?$SafeSet@PEAVCListenerOperation@@@@@Z
??0?$SafeSet_Iterator@PEAVCShellUriSettings@@@@QEAA@AEAV?$SafeMap@PEAVCShellUriSettings@@UEmpty@@V?$SafeSet_Iterator@PEAVCShellUriSettings@@@@@@_N@Z
??0?$SafeSet_Iterator@PEAX@@QEAA@AEAV?$SafeMap@PEAXUEmpty@@V?$SafeSet_Iterator@PEAX@@@@_N@Z
??0?$SimpleQueue@T_LARGE_INTEGER@@@@QEAA@XZ
??0AutoBstr@@QEAA@PEAG@Z
??0AutoBstr@@QEAA@XZ
??0AutoBstrNoAlloc@@QEAA@PEAG@Z
??0AutoBstrNoAlloc@@QEAA@XZ
??0AutoCertContext@@QEAA@PEBU_CERT_CONTEXT@@@Z
??0AutoCertContext@@QEAA@XZ
??0AutoChainContext@@QEAA@PEBU_CERT_CHAIN_CONTEXT@@@Z
??0AutoChainContext@@QEAA@XZ
??0AutoCoTaskMemFree@@QEAA@PEAX@Z
??0AutoCoTaskMemFree@@QEAA@XZ
??0AutoFwXmlCloseParser@@QEAA@PEAX@Z
??0AutoFwXmlCloseParser@@QEAA@XZ
??0AutoHandle@@QEAA@PEAX@Z
??0AutoHandle@@QEAA@XZ
??0AutoImpersonateUser@@QEAA@PEAX@Z
??0AutoImpersonateUser@@QEAA@XZ
??0AutoLibrary@@QEAA@PEAUHINSTANCE__@@@Z
??0AutoLibrary@@QEAA@XZ
??0AutoLocalFree@@QEAA@PEAX@Z
??0AutoLocalFree@@QEAA@XZ
??0AutoMIClass@@QEAA@PEAU_MI_Class@@@Z
??0AutoMIClass@@QEAA@XZ
??0AutoMIInstance@@QEAA@PEAU_MI_Instance@@@Z
??0AutoMIInstance@@QEAA@XZ
??0AutoObject@@QEAA@PEAUWSMAN_OBJECT@@@Z
??0AutoObject@@QEAA@XZ
??0AutoRegKey@@QEAA@PEAUHKEY__@@@Z
??0AutoRegKey@@QEAA@XZ
??0AutoSecurityDescriptor@@QEAA@PEAX@Z
??0AutoSecurityDescriptor@@QEAA@XZ
??0AutoWaitHandle@@QEAA@PEAX@Z
??0AutoWaitHandle@@QEAA@XZ
??0BufferFormatter@@QEAA@PEAEK@Z
??0BufferFormatter@@QEAA@XZ
??0CBaseConfigCache@@IEAA@W4ConfigLocation@CConfigChangeSource@@PEAVFastLock@@PEAVCConfigCacheMap@0@@Z
??0CClientConfigCache@@AEAA@XZ
??0CConfigManager@@AEAA@XZ
??0CErrorContext@@QEAA@_N@Z
??0CRequestContext@@QEAA@PEBG@Z
??0CRequestContext@@QEAA@XZ
??0CResourceAlias@@QEAA@PEBG@Z
??0CServiceConfigCache@@AEAA@XZ
??0CServiceWatcher@CServiceConfigCache@@AEAA@PEAV1@PEAVIServiceConfigObserver@@@Z
??0CWSManCriticalSection@@QEAA@XZ
??0CWSManCriticalSectionWithConditionVar@@QEAA@XZ
??0CWSManEPR@@QEAA@H@Z
??0CWSManGroupPolicyManager@@AEAA@XZ
??0CWSManResource@@QEAA@H@Z
??0CWSManResourceNoResourceUri@@QEAA@H@Z
??0CWSManSecurityUI@@QEAA@XZ
??0CWinRSPluginConfigCache@@AEAA@XZ
??0ChildLifeTimeManager@@QEAA@AEBV0@@Z
??0ChildLifeTimeManager@@QEAA@XZ
??0CircularBufferFormatter@@QEAA@XZ
??0ConfigRegistry@@IEAA@XZ
??0EtwCorrelationHelper@@QEAA@AEBV0@@Z
??0EventHandler@WSMan@@QEAA@XZ
??0ExtendedSemantic@@QEAA@K@Z
??0FastLock@@QEAA@XZ
??0Fragment@PacketParser@@QEAA@XZ
??0IConfigChangeObserver@@QEAA@AEBV0@@Z
??0IConfigChangeObserver@@QEAA@XZ
??0ILifeTimeMgmt@@QEAA@AEBV0@@Z
??0ILifeTimeMgmt@@QEAA@XZ
??0IRequestContext@@IEAA@XZ
??0IWSManGroupPolicyObserver@@QEAA@AEBV0@@Z
??0IWSManGroupPolicyObserver@@QEAA@XZ
??0IWSManGroupPolicyPublisher@@QEAA@AEBV0@@Z
??0IWSManGroupPolicyPublisher@@QEAA@XZ
??0Locale@@QEAA@AEBV0@@Z
??0Locale@@QEAA@PEAVIRequestContext@@@Z
??0Locale@@QEAA@XZ
??0MessageId@PacketParser@@QEAA@XZ
??0NotUnderstandSoapHeader@PacketParser@@QEAA@XZ
??0OnHTTPInitialize@@QEAA@XZ
??0OperationId@PacketParser@@QEAA@XZ
??0OwnLock@@QEAA@AEAVFastLock@@@Z
??0PacketFormatter@@QEAA@XZ
??0PacketParser@@QEAA@XZ
??0RBUFFER@@QEAA@I@Z
??0RBUFFER@@QEAA@PEAEI@Z
??0ReferenceParameters@PacketParser@@QEAA@XZ
??0SBUFFER@@QEAA@XZ
??0SessionId@PacketParser@@QEAA@XZ
??0ShareLock@@QEAA@AEAVFastLock@@@Z
??0SoapSemanticConverter@@QEAA@XZ
??0TSTRBUFFER@@QEAA@XZ
??0UserAuthzRecord@@QEAA@$$QEAV0@@Z
??0UserAuthzRecord@@QEAA@AEBV0@@Z
??0UserAuthzRecord@@QEAA@XZ
??0UserRecord@@QEAA@XZ
??0XmlReader@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@D@@PEAD@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@G@@PEAG@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@UIPRange@CWSManIPFilter@@@@PEAUIPRange@CWSManIPFilter@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@U_SID@@@@PEAU_SID@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@U_WSMAN_STREAM_ID_SET@@@@PEAU_WSMAN_STREAM_ID_SET@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@V?$Handle@VISubscription@@@@@@PEAV?$Handle@VISubscription@@@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@V?$SafeMap_Iterator@PEAVCListenerConnect@@PEAV1@@@@@PEAV?$SafeMap_Iterator@PEAVCListenerConnect@@PEAV1@@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@V?$SafeMap_Iterator@PEAVCListenerReceive@@PEAV1@@@@@PEAV?$SafeMap_Iterator@PEAVCListenerReceive@@PEAV1@@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@V?$SafeMap_Iterator@PEAVCListenerSend@@PEAV1@@@@@PEAV?$SafeMap_Iterator@PEAVCListenerSend@@PEAV1@@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@V?$SafeMap_Iterator@PEAVCListenerSignal@@PEAV1@@@@@PEAV?$SafeMap_Iterator@PEAVCListenerSignal@@PEAV1@@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@V?$SafeMap_Iterator@VGuidKey@@PEAVCListenerCommand@@@@@@PEAV?$SafeMap_Iterator@VGuidKey@@PEAVCListenerCommand@@@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@V?$SafeMap_Iterator@VStringKeyCI@@K@@@@PEAV?$SafeMap_Iterator@VStringKeyCI@@K@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@PEAV?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@V?$SafeSet@PEAVCCertMapping@@@@@@PEAV?$SafeSet@PEAVCCertMapping@@@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@V?$SafeSet@PEAVCShellUriSettings@@@@@@PEAV?$SafeSet@PEAVCShellUriSettings@@@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@PEAV?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@V?$SafeSet_Iterator@PEAVCollector@@@@@@PEAV?$SafeSet_Iterator@PEAVCollector@@@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@V?$SafeSet_Iterator@PEAVHostOperation@@@@@@PEAV?$SafeSet_Iterator@PEAVHostOperation@@@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@V?$SafeSet_Iterator@PEAVListenerSourceSubscription@@@@@@PEAV?$SafeSet_Iterator@PEAVListenerSourceSubscription@@@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@V?$SimpleStack@VCListenerOperation@@@@@@PEAV?$SimpleStack@VCListenerOperation@@@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@V?$SimpleStack@VShellHostEntry@@@@@@PEAV?$SimpleStack@VShellHostEntry@@@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@V?$queue@PEAU_WSMAN_PUBLISHER_EVENT_STRUCT@@V?$deque@PEAU_WSMAN_PUBLISHER_EVENT_STRUCT@@V?$transport_allocator@PEAU_WSMAN_PUBLISHER_EVENT_STRUCT@@@@@std@@@std@@@@PEAV?$queue@PEAU_WSMAN_PUBLISHER_EVENT_STRUCT@@V?$deque@PEAU_WSMAN_PUBLISHER_EVENT_STRUCT@@V?$transport_allocator@PEAU_WSMAN_PUBLISHER_EVENT_STRUCT@@@@@std@@@std@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@V?$set@PEAVCListenerSettings@@VCListenerSettingsLessFunctor@CServiceConfigSettings@@V?$transport_allocator@PEAVCListenerSettings@@@@@std@@@@PEAV?$set@PEAVCListenerSettings@@VCListenerSettingsLessFunctor@CServiceConfigSettings@@V?$transport_allocator@PEAVCListenerSettings@@@@@std@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@V?$set@Usockaddr_storage@@VSockAddrLessFunctor@CListenerSettings@@V?$transport_allocator@Usockaddr_storage@@@@@std@@@@PEAV?$set@Usockaddr_storage@@VSockAddrLessFunctor@CListenerSettings@@V?$transport_allocator@Usockaddr_storage@@@@@std@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@V?$vector@PEAVCWSManRequest@@V?$transport_allocator@PEAVCWSManRequest@@@@@std@@@@PEAV?$vector@PEAVCWSManRequest@@V?$transport_allocator@PEAVCWSManRequest@@@@@std@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@V?$vector@PEAVHandleImpl@Client@WSMan@@V?$transport_allocator@PEAVHandleImpl@Client@WSMan@@@@@std@@@@PEAV?$vector@PEAVHandleImpl@Client@WSMan@@V?$transport_allocator@PEAVHandleImpl@Client@WSMan@@@@@std@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@V?$vector@PEAVIServiceConfigObserver@@V?$transport_allocator@PEAVIServiceConfigObserver@@@@@std@@@@PEAV?$vector@PEAVIServiceConfigObserver@@V?$transport_allocator@PEAVIServiceConfigObserver@@@@@std@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@V?$vector@PEAVWSManHttpSenderConnection@@V?$transport_allocator@PEAVWSManHttpSenderConnection@@@@@std@@@@PEAV?$vector@PEAVWSManHttpSenderConnection@@V?$transport_allocator@PEAVWSManHttpSenderConnection@@@@@std@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VAdminSid@CSecurity@@@@PEAVAdminSid@CSecurity@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VBlockedRecord@@@@PEAVBlockedRecord@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VCBaseConfigCache@@@@PEAVCBaseConfigCache@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VCCertMapping@@@@PEAVCCertMapping@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VCConfigChangeSource@@@@PEAVCConfigChangeSource@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VCListenerSettings@@@@PEAVCListenerSettings@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VCObserverConfigChangeErrors@@@@PEAVCObserverConfigChangeErrors@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VCServiceWatcher@CServiceConfigCache@@@@PEAVCServiceWatcher@CServiceConfigCache@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VCShellUriSettings@@@@PEAVCShellUriSettings@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VCWSManEPR@@@@PEAVCWSManEPR@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VCWSManResource@@@@PEAVCWSManResource@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VCertHash@@@@PEAVCertHash@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VConfigUpdate@@@@PEAVConfigUpdate@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VEnumSinkEx@@@@PEAVEnumSinkEx@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VEventHandler@WSMan@@@@PEAVEventHandler@WSMan@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VExpiredOperationIdRecord@@@@PEAVExpiredOperationIdRecord@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VGPApiManager@@@@PEAVGPApiManager@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VGeneralSinkEx@@@@PEAVGeneralSinkEx@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VIChannelObserverFactory@@@@PEAVIChannelObserverFactory@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VIQueryDASHSMASHInterface@@@@PEAVIQueryDASHSMASHInterface@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VISpecification@@@@PEAVISpecification@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VInteractiveSid@CSecurity@@@@PEAVInteractiveSid@CSecurity@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VIpHlpApiDllLoader@@@@PEAVIpHlpApiDllLoader@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VMachineName@@@@PEAVMachineName@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VMasterReceiveData@CListenerReceive@@@@PEAVMasterReceiveData@CListenerReceive@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VNetworkServiceSid@CSecurity@@@@PEAVNetworkServiceSid@CSecurity@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VNtDsApiDllLoader@@@@PEAVNtDsApiDllLoader@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VOptionValue@SessionOptions@Client@WSMan@@@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VPacketCreator@@@@PEAVPacketCreator@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VPacketParser@@@@PEAVPacketParser@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VResources@Locale@@@@PEAVResources@Locale@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VRunAsConfiguration@@@@PEAVRunAsConfiguration@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VSecurityEntry@Catalog@@@@PEAVSecurityEntry@Catalog@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VSendPacketArgs@RobustConnectionBuffer@@@@PEAVSendPacketArgs@RobustConnectionBuffer@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VServiceSoapProcessor@@@@PEAVServiceSoapProcessor@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VShell32DllLoader@@@@PEAVShell32DllLoader@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VShlWApiDllLoader@@@@PEAVShlWApiDllLoader@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VSubscriptionEnumerator@@@@PEAVSubscriptionEnumerator@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VSubscriptionManager@@@@PEAVSubscriptionManager@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VTSTRBUFFER@@@@PEAVTSTRBUFFER@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VUniqueStringOverflow@@@@PEAVUniqueStringOverflow@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VUser32DllLoader@@@@PEAVUser32DllLoader@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VWSMANCONFIGTABLE_IDENTITY@@@@PEAVWSMANCONFIGTABLE_IDENTITY@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VWSManMemCryptManager@@@@PEAVWSManMemCryptManager@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VWmiEnumContext@@@@PEAVWmiEnumContext@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDelete@VXmlReader@@@@PEAVXmlReader@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDeleteVector@$$CBG@@PEBG@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDeleteVector@D@@PEAD@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDeleteVector@E@@PEAE@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDeleteVector@H@@PEAH@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDeleteVector@PEAG@@PEAPEAG@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDeleteVector@PEBG@@PEAPEBG@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDeleteVector@U_CONFIG_UPDATE@@@@PEAU_CONFIG_UPDATE@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDeleteVector@U_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@PEAU_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDeleteVector@U_WINRS_RUN_COMMAND_ARG@@@@PEAU_WINRS_RUN_COMMAND_ARG@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDeleteVector@U_WSMAN_OPTION@@@@PEAU_WSMAN_OPTION@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoDeleteVector@X@@PEAX@@QEAA@XZ
??1?$AutoCleanup@V?$AutoFree@E@@PEAE@@QEAA@XZ
??1?$AutoCleanup@V?$AutoLocklessItemRecycle@VPacket@@@@PEAVPacket@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@UIAppHostAdminManager@@@@PEAUIAppHostAdminManager@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@UIAppHostChildElementCollection@@@@PEAUIAppHostChildElementCollection@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@UIAppHostConfigException@@@@PEAUIAppHostConfigException@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@UIAppHostElement@@@@PEAUIAppHostElement@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@UIAppHostElementCollection@@@@PEAUIAppHostElementCollection@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@UIAppHostProperty@@@@PEAUIAppHostProperty@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@UIAppHostPropertyCollection@@@@PEAUIAppHostPropertyCollection@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@UIClientSecurity@@@@PEAUIClientSecurity@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@UIEnumWbemClassObject@@@@PEAUIEnumWbemClassObject@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@UIErrorInfo@@@@PEAUIErrorInfo@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@UIUnknown@@@@PEAUIUnknown@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@UIWbemClassObject@@@@PEAUIWbemClassObject@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@UIWbemContext@@@@PEAUIWbemContext@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@UIWbemLocator@@@@PEAUIWbemLocator@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@UIWbemObjectTextSrc@@@@PEAUIWbemObjectTextSrc@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@UIWbemPath@@@@PEAUIWbemPath@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@UIWbemPathKeyList@@@@PEAUIWbemPathKeyList@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@UIWbemQualifierSet@@@@PEAUIWbemQualifierSet@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@UIWbemQuery@@@@PEAUIWbemQuery@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@UIWbemServices@@@@PEAUIWbemServices@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VApplication@Client@WSMan@@@@PEAVApplication@Client@WSMan@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VCBaseConfigCache@@@@PEAVCBaseConfigCache@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VCClientConfigCache@@@@PEAVCClientConfigCache@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VCClientConfigSettings@@@@PEAVCClientConfigSettings@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VCCommonConfigSettings@@@@PEAVCCommonConfigSettings@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VCConfigCacheMap@CBaseConfigCache@@@@PEAVCConfigCacheMap@CBaseConfigCache@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VCConfigManager@@@@PEAVCConfigManager@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VCListenerCommand@@@@PEAVCListenerCommand@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VCListenerMasterOperation@@@@PEAVCListenerMasterOperation@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VCListenerReceive@@@@PEAVCListenerReceive@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VCListenerShell@@@@PEAVCListenerShell@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VCRemoteOperation@@@@PEAVCRemoteOperation@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VCRemoteSession@@@@PEAVCRemoteSession@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VCRequestContext@@@@PEAVCRequestContext@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VCServiceCommonConfigSettings@@@@PEAVCServiceCommonConfigSettings@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VCServiceConfigCache@@@@PEAVCServiceConfigCache@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VCServiceConfigSettings@@@@PEAVCServiceConfigSettings@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VCWSManEPR@@@@PEAVCWSManEPR@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VCWSManGroupPolicyCache@@@@PEAVCWSManGroupPolicyCache@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VCWSManGroupPolicyManager@@@@PEAVCWSManGroupPolicyManager@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VCWSManObject@@@@PEAVCWSManObject@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VCWSManResource@@@@PEAVCWSManResource@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VCWSManSession@@@@PEAVCWSManSession@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VCWinRSPluginConfigCache@@@@PEAVCWinRSPluginConfigCache@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VCWinRSPluginConfigSettings@@@@PEAVCWinRSPluginConfigSettings@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VCommand@Client@WSMan@@@@PEAVCommand@Client@WSMan@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VConfigNotification@@@@PEAVConfigNotification@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VConnectShellOperation@Client@WSMan@@@@PEAVConnectShellOperation@Client@WSMan@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VCreateShellOperation@Client@WSMan@@@@PEAVCreateShellOperation@Client@WSMan@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VDeleteShellOperation@Client@WSMan@@@@PEAVDeleteShellOperation@Client@WSMan@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VDisconnectOperation@Client@WSMan@@@@PEAVDisconnectOperation@Client@WSMan@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VEnumSinkEx@@@@PEAVEnumSinkEx@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VGeneralSinkEx@@@@PEAVGeneralSinkEx@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VHostMappingTable@@@@PEAVHostMappingTable@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VIISConfigSettings@@@@PEAVIISConfigSettings@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VIPCSoapProcessor@@@@PEAVIPCSoapProcessor@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VIRequestContext@@@@PEAVIRequestContext@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VISubscription@@@@PEAVISubscription@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VInboundRequestDetails@@@@PEAVInboundRequestDetails@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VProxyManager@Client@WSMan@@@@PEAVProxyManager@Client@WSMan@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VProxySelection@Client@WSMan@@@@PEAVProxySelection@Client@WSMan@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VPushSubscribeOperation@@@@PEAVPushSubscribeOperation@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VPushSubscription@@@@PEAVPushSubscription@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VReceiveOperation@Client@WSMan@@@@PEAVReceiveOperation@Client@WSMan@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VReconnectOperation@Client@WSMan@@@@PEAVReconnectOperation@Client@WSMan@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VSendOperation@Client@WSMan@@@@PEAVSendOperation@Client@WSMan@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VShell@Client@WSMan@@@@PEAVShell@Client@WSMan@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VShellInfo@@@@PEAVShellInfo@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VSignalOperation@Client@WSMan@@@@PEAVSignalOperation@Client@WSMan@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VUserRecord@@@@PEAVUserRecord@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoRelease@VWSManHttpListener@@@@PEAVWSManHttpListener@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoReleaseEx@VHostMappingTableEntry@@@@PEAVHostMappingTableEntry@@@@QEAA@XZ
??1?$AutoCleanup@V?$AutoReleaseEx@VShell@Client@WSMan@@@@PEAVShell@Client@WSMan@@@@QEAA@XZ
??1?$AutoCleanup@VAutoBstr@@PEAG@@QEAA@XZ
??1?$AutoCleanup@VAutoBstrNoAlloc@@PEAG@@QEAA@XZ
??1?$AutoCleanup@VAutoCertContext@@PEBU_CERT_CONTEXT@@@@QEAA@XZ
??1?$AutoCleanup@VAutoChainContext@@PEBU_CERT_CHAIN_CONTEXT@@@@QEAA@XZ
??1?$AutoCleanup@VAutoCoTaskMemFree@@PEAX@@QEAA@XZ
??1?$AutoCleanup@VAutoFwXmlCloseParser@@PEAX@@QEAA@XZ
??1?$AutoCleanup@VAutoHandle@@PEAX@@QEAA@XZ
??1?$AutoCleanup@VAutoImpersonateUser@@PEAX@@QEAA@XZ
??1?$AutoCleanup@VAutoLibrary@@PEAUHINSTANCE__@@@@QEAA@XZ
??1?$AutoCleanup@VAutoLocalFree@@PEAX@@QEAA@XZ
??1?$AutoCleanup@VAutoMIClass@@PEAU_MI_Class@@@@QEAA@XZ
??1?$AutoCleanup@VAutoMIInstance@@PEAU_MI_Instance@@@@QEAA@XZ
??1?$AutoCleanup@VAutoObject@@PEAUWSMAN_OBJECT@@@@QEAA@XZ
??1?$AutoCleanup@VAutoRegKey@@PEAUHKEY__@@@@QEAA@XZ
??1?$AutoCleanup@VAutoSecurityDescriptor@@PEAX@@QEAA@XZ
??1?$AutoCleanup@VAutoWaitHandle@@PEAX@@QEAA@XZ
??1?$AutoDelete@D@@QEAA@XZ
??1?$AutoDelete@G@@QEAA@XZ
??1?$AutoDelete@UIPRange@CWSManIPFilter@@@@QEAA@XZ
??1?$AutoDelete@U_SID@@@@QEAA@XZ
??1?$AutoDelete@U_WSMAN_STREAM_ID_SET@@@@QEAA@XZ
??1?$AutoDelete@V?$Handle@VISubscription@@@@@@QEAA@XZ
??1?$AutoDelete@V?$SafeMap_Iterator@PEAVCListenerConnect@@PEAV1@@@@@QEAA@XZ
??1?$AutoDelete@V?$SafeMap_Iterator@PEAVCListenerReceive@@PEAV1@@@@@QEAA@XZ
??1?$AutoDelete@V?$SafeMap_Iterator@PEAVCListenerSend@@PEAV1@@@@@QEAA@XZ
??1?$AutoDelete@V?$SafeMap_Iterator@PEAVCListenerSignal@@PEAV1@@@@@QEAA@XZ
??1?$AutoDelete@V?$SafeMap_Iterator@VGuidKey@@PEAVCListenerCommand@@@@@@QEAA@XZ
??1?$AutoDelete@V?$SafeMap_Iterator@VStringKeyCI@@K@@@@QEAA@XZ
??1?$AutoDelete@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@QEAA@XZ
??1?$AutoDelete@V?$SafeSet@PEAVCCertMapping@@@@@@QEAA@XZ
??1?$AutoDelete@V?$SafeSet@PEAVCShellUriSettings@@@@@@QEAA@XZ
??1?$AutoDelete@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@QEAA@XZ
??1?$AutoDelete@V?$SafeSet_Iterator@PEAVCollector@@@@@@QEAA@XZ
??1?$AutoDelete@V?$SafeSet_Iterator@PEAVHostOperation@@@@@@QEAA@XZ
??1?$AutoDelete@V?$SafeSet_Iterator@PEAVListenerSourceSubscription@@@@@@QEAA@XZ
??1?$AutoDelete@V?$SimpleStack@VCListenerOperation@@@@@@QEAA@XZ
??1?$AutoDelete@V?$SimpleStack@VShellHostEntry@@@@@@QEAA@XZ
??1?$AutoDelete@V?$queue@PEAU_WSMAN_PUBLISHER_EVENT_STRUCT@@V?$deque@PEAU_WSMAN_PUBLISHER_EVENT_STRUCT@@V?$transport_allocator@PEAU_WSMAN_PUBLISHER_EVENT_STRUCT@@@@@std@@@std@@@@QEAA@XZ
??1?$AutoDelete@V?$set@PEAVCListenerSettings@@VCListenerSettingsLessFunctor@CServiceConfigSettings@@V?$transport_allocator@PEAVCListenerSettings@@@@@std@@@@QEAA@XZ
??1?$AutoDelete@V?$set@Usockaddr_storage@@VSockAddrLessFunctor@CListenerSettings@@V?$transport_allocator@Usockaddr_storage@@@@@std@@@@QEAA@XZ
??1?$AutoDelete@V?$vector@PEAVCWSManRequest@@V?$transport_allocator@PEAVCWSManRequest@@@@@std@@@@QEAA@XZ
??1?$AutoDelete@V?$vector@PEAVHandleImpl@Client@WSMan@@V?$transport_allocator@PEAVHandleImpl@Client@WSMan@@@@@std@@@@QEAA@XZ
??1?$AutoDelete@V?$vector@PEAVIServiceConfigObserver@@V?$transport_allocator@PEAVIServiceConfigObserver@@@@@std@@@@QEAA@XZ
??1?$AutoDelete@V?$vector@PEAVWSManHttpSenderConnection@@V?$transport_allocator@PEAVWSManHttpSenderConnection@@@@@std@@@@QEAA@XZ
??1?$AutoDelete@VAdminSid@CSecurity@@@@QEAA@XZ
??1?$AutoDelete@VBlockedRecord@@@@QEAA@XZ
??1?$AutoDelete@VCBaseConfigCache@@@@QEAA@XZ
??1?$AutoDelete@VCCertMapping@@@@QEAA@XZ
??1?$AutoDelete@VCConfigChangeSource@@@@QEAA@XZ
??1?$AutoDelete@VCListenerSettings@@@@QEAA@XZ
??1?$AutoDelete@VCObserverConfigChangeErrors@@@@QEAA@XZ
??1?$AutoDelete@VCServiceWatcher@CServiceConfigCache@@@@QEAA@XZ
??1?$AutoDelete@VCShellUriSettings@@@@QEAA@XZ
??1?$AutoDelete@VCWSManEPR@@@@QEAA@XZ
??1?$AutoDelete@VCWSManResource@@@@QEAA@XZ
??1?$AutoDelete@VCertHash@@@@QEAA@XZ
??1?$AutoDelete@VConfigUpdate@@@@QEAA@XZ
??1?$AutoDelete@VEnumSinkEx@@@@QEAA@XZ
??1?$AutoDelete@VEventHandler@WSMan@@@@QEAA@XZ
??1?$AutoDelete@VExpiredOperationIdRecord@@@@QEAA@XZ
??1?$AutoDelete@VGPApiManager@@@@QEAA@XZ
??1?$AutoDelete@VGeneralSinkEx@@@@QEAA@XZ
??1?$AutoDelete@VIChannelObserverFactory@@@@QEAA@XZ
??1?$AutoDelete@VIQueryDASHSMASHInterface@@@@QEAA@XZ
??1?$AutoDelete@VISpecification@@@@QEAA@XZ
??1?$AutoDelete@VInteractiveSid@CSecurity@@@@QEAA@XZ
??1?$AutoDelete@VIpHlpApiDllLoader@@@@QEAA@XZ
??1?$AutoDelete@VMachineName@@@@QEAA@XZ
??1?$AutoDelete@VMasterReceiveData@CListenerReceive@@@@QEAA@XZ
??1?$AutoDelete@VNetworkServiceSid@CSecurity@@@@QEAA@XZ
??1?$AutoDelete@VNtDsApiDllLoader@@@@QEAA@XZ
??1?$AutoDelete@VOptionValue@SessionOptions@Client@WSMan@@@@QEAA@XZ
??1?$AutoDelete@VPacketCreator@@@@QEAA@XZ
??1?$AutoDelete@VPacketParser@@@@QEAA@XZ
??1?$AutoDelete@VResources@Locale@@@@QEAA@XZ
??1?$AutoDelete@VRunAsConfiguration@@@@QEAA@XZ
??1?$AutoDelete@VSecurityEntry@Catalog@@@@QEAA@XZ
??1?$AutoDelete@VSendPacketArgs@RobustConnectionBuffer@@@@QEAA@XZ
??1?$AutoDelete@VServiceSoapProcessor@@@@QEAA@XZ
??1?$AutoDelete@VShell32DllLoader@@@@QEAA@XZ
??1?$AutoDelete@VShlWApiDllLoader@@@@QEAA@XZ
??1?$AutoDelete@VSubscriptionEnumerator@@@@QEAA@XZ
??1?$AutoDelete@VSubscriptionManager@@@@QEAA@XZ
??1?$AutoDelete@VTSTRBUFFER@@@@QEAA@XZ
??1?$AutoDelete@VUniqueStringOverflow@@@@QEAA@XZ
??1?$AutoDelete@VUser32DllLoader@@@@QEAA@XZ
??1?$AutoDelete@VWSMANCONFIGTABLE_IDENTITY@@@@QEAA@XZ
??1?$AutoDelete@VWSManMemCryptManager@@@@QEAA@XZ
??1?$AutoDelete@VWmiEnumContext@@@@QEAA@XZ
??1?$AutoDelete@VXmlReader@@@@QEAA@XZ
??1?$AutoDeleteVector@$$CBG@@QEAA@XZ
??1?$AutoDeleteVector@D@@QEAA@XZ
??1?$AutoDeleteVector@E@@QEAA@XZ
??1?$AutoDeleteVector@G@@QEAA@XZ
??1?$AutoDeleteVector@H@@QEAA@XZ
??1?$AutoDeleteVector@PEAG@@QEAA@XZ
??1?$AutoDeleteVector@PEBG@@QEAA@XZ
??1?$AutoDeleteVector@U_CONFIG_UPDATE@@@@QEAA@XZ
??1?$AutoDeleteVector@U_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@QEAA@XZ
??1?$AutoDeleteVector@U_WINRS_RUN_COMMAND_ARG@@@@QEAA@XZ
??1?$AutoDeleteVector@U_WSMAN_OPTION@@@@QEAA@XZ
??1?$AutoDeleteVector@X@@QEAA@XZ
??1?$AutoFree@E@@QEAA@XZ
??1?$AutoLocklessItemRecycle@VPacket@@@@QEAA@XZ
??1?$AutoRelease@UIAppHostAdminManager@@@@QEAA@XZ
??1?$AutoRelease@UIAppHostChildElementCollection@@@@QEAA@XZ
??1?$AutoRelease@UIAppHostConfigException@@@@QEAA@XZ
??1?$AutoRelease@UIAppHostElement@@@@QEAA@XZ
??1?$AutoRelease@UIAppHostElementCollection@@@@QEAA@XZ
??1?$AutoRelease@UIAppHostProperty@@@@QEAA@XZ
??1?$AutoRelease@UIAppHostPropertyCollection@@@@QEAA@XZ
??1?$AutoRelease@UIClientSecurity@@@@QEAA@XZ
??1?$AutoRelease@UIEnumWbemClassObject@@@@QEAA@XZ
??1?$AutoRelease@UIErrorInfo@@@@QEAA@XZ
??1?$AutoRelease@UIUnknown@@@@QEAA@XZ
??1?$AutoRelease@UIWbemClassObject@@@@QEAA@XZ
??1?$AutoRelease@UIWbemContext@@@@QEAA@XZ
??1?$AutoRelease@UIWbemLocator@@@@QEAA@XZ
??1?$AutoRelease@UIWbemObjectTextSrc@@@@QEAA@XZ
??1?$AutoRelease@UIWbemPath@@@@QEAA@XZ
??1?$AutoRelease@UIWbemPathKeyList@@@@QEAA@XZ
??1?$AutoRelease@UIWbemQualifierSet@@@@QEAA@XZ
??1?$AutoRelease@UIWbemQuery@@@@QEAA@XZ
??1?$AutoRelease@UIWbemServices@@@@QEAA@XZ
??1?$AutoRelease@VApplication@Client@WSMan@@@@QEAA@XZ
??1?$AutoRelease@VCBaseConfigCache@@@@QEAA@XZ
??1?$AutoRelease@VCClientConfigCache@@@@QEAA@XZ
??1?$AutoRelease@VCClientConfigSettings@@@@QEAA@XZ
??1?$AutoRelease@VCCommonConfigSettings@@@@QEAA@XZ
??1?$AutoRelease@VCConfigCacheMap@CBaseConfigCache@@@@QEAA@XZ
??1?$AutoRelease@VCConfigManager@@@@QEAA@XZ
??1?$AutoRelease@VCListenerCommand@@@@QEAA@XZ
??1?$AutoRelease@VCListenerMasterOperation@@@@QEAA@XZ
??1?$AutoRelease@VCListenerReceive@@@@QEAA@XZ
??1?$AutoRelease@VCListenerShell@@@@QEAA@XZ
??1?$AutoRelease@VCRemoteOperation@@@@QEAA@XZ
??1?$AutoRelease@VCRemoteSession@@@@QEAA@XZ
??1?$AutoRelease@VCRequestContext@@@@QEAA@XZ
??1?$AutoRelease@VCServiceCommonConfigSettings@@@@QEAA@XZ
??1?$AutoRelease@VCServiceConfigCache@@@@QEAA@XZ
??1?$AutoRelease@VCServiceConfigSettings@@@@QEAA@XZ
??1?$AutoRelease@VCWSManEPR@@@@QEAA@XZ
??1?$AutoRelease@VCWSManGroupPolicyCache@@@@QEAA@XZ
??1?$AutoRelease@VCWSManGroupPolicyManager@@@@QEAA@XZ
??1?$AutoRelease@VCWSManObject@@@@QEAA@XZ
??1?$AutoRelease@VCWSManResource@@@@QEAA@XZ
??1?$AutoRelease@VCWSManSession@@@@QEAA@XZ
??1?$AutoRelease@VCWinRSPluginConfigCache@@@@QEAA@XZ
??1?$AutoRelease@VCWinRSPluginConfigSettings@@@@QEAA@XZ
??1?$AutoRelease@VCommand@Client@WSMan@@@@QEAA@XZ
??1?$AutoRelease@VConfigNotification@@@@QEAA@XZ
??1?$AutoRelease@VConnectShellOperation@Client@WSMan@@@@QEAA@XZ
??1?$AutoRelease@VCreateShellOperation@Client@WSMan@@@@QEAA@XZ
??1?$AutoRelease@VDeleteShellOperation@Client@WSMan@@@@QEAA@XZ
??1?$AutoRelease@VDisconnectOperation@Client@WSMan@@@@QEAA@XZ
??1?$AutoRelease@VEnumSinkEx@@@@QEAA@XZ
??1?$AutoRelease@VGeneralSinkEx@@@@QEAA@XZ
??1?$AutoRelease@VHostMappingTable@@@@QEAA@XZ
??1?$AutoRelease@VIISConfigSettings@@@@QEAA@XZ
??1?$AutoRelease@VIPCSoapProcessor@@@@QEAA@XZ
??1?$AutoRelease@VIRequestContext@@@@QEAA@XZ
??1?$AutoRelease@VISubscription@@@@QEAA@XZ
??1?$AutoRelease@VInboundRequestDetails@@@@QEAA@XZ
??1?$AutoRelease@VProxyManager@Client@WSMan@@@@QEAA@XZ
??1?$AutoRelease@VProxySelection@Client@WSMan@@@@QEAA@XZ
??1?$AutoRelease@VPushSubscribeOperation@@@@QEAA@XZ
??1?$AutoRelease@VPushSubscription@@@@QEAA@XZ
??1?$AutoRelease@VReceiveOperation@Client@WSMan@@@@QEAA@XZ
??1?$AutoRelease@VReconnectOperation@Client@WSMan@@@@QEAA@XZ
??1?$AutoRelease@VSendOperation@Client@WSMan@@@@QEAA@XZ
??1?$AutoRelease@VShell@Client@WSMan@@@@QEAA@XZ
??1?$AutoRelease@VShellInfo@@@@QEAA@XZ
??1?$AutoRelease@VSignalOperation@Client@WSMan@@@@QEAA@XZ
??1?$AutoRelease@VUserRecord@@@@QEAA@XZ
??1?$AutoRelease@VWSManHttpListener@@@@QEAA@XZ
??1?$AutoReleaseEx@VHostMappingTableEntry@@@@QEAA@XZ
??1?$AutoReleaseEx@VShell@Client@WSMan@@@@QEAA@XZ
??1?$ILoader@VAdminSid@CSecurity@@@@QEAA@XZ
??1?$ILoader@VEventHandler@WSMan@@@@QEAA@XZ
??1?$ILoader@VInteractiveSid@CSecurity@@@@QEAA@XZ
??1?$ILoader@VIpHlpApiDllLoader@@@@QEAA@XZ
??1?$ILoader@VMachineName@@@@QEAA@XZ
??1?$ILoader@VNetworkServiceSid@CSecurity@@@@QEAA@XZ
??1?$ILoader@VNtDsApiDllLoader@@@@QEAA@XZ
??1?$ILoader@VResources@Locale@@@@QEAA@XZ
??1?$ILoader@VShell32DllLoader@@@@QEAA@XZ
??1?$ILoader@VShlWApiDllLoader@@@@QEAA@XZ
??1?$ILoader@VSubscriptionManager@@@@QEAA@XZ
??1?$ILoader@VUser32DllLoader@@@@QEAA@XZ
??1?$ILoader@VWSManMemCryptManager@@@@QEAA@XZ
??1?$Loader@VAdminSid@CSecurity@@$00@@QEAA@XZ
??1?$Loader@VEventHandler@WSMan@@$00@@QEAA@XZ
??1?$Loader@VInteractiveSid@CSecurity@@$00@@QEAA@XZ
??1?$Loader@VIpHlpApiDllLoader@@$00@@QEAA@XZ
??1?$Loader@VMachineName@@$00@@QEAA@XZ
??1?$Loader@VNetworkServiceSid@CSecurity@@$00@@QEAA@XZ
??1?$Loader@VNtDsApiDllLoader@@$00@@QEAA@XZ
??1?$Loader@VResources@Locale@@$0A@@@QEAA@XZ
??1?$Loader@VShell32DllLoader@@$00@@QEAA@XZ
??1?$Loader@VShlWApiDllLoader@@$00@@QEAA@XZ
??1?$Loader@VSubscriptionManager@@$01@@QEAA@XZ
??1?$Loader@VUser32DllLoader@@$00@@QEAA@XZ
??1?$Loader@VWSManMemCryptManager@@$00@@QEAA@XZ
??1?$LoaderSerializer@VAdminSid@CSecurity@@$00@@QEAA@XZ
??1?$LoaderSerializer@VEventHandler@WSMan@@$00@@QEAA@XZ
??1?$LoaderSerializer@VInteractiveSid@CSecurity@@$00@@QEAA@XZ
??1?$LoaderSerializer@VIpHlpApiDllLoader@@$00@@QEAA@XZ
??1?$LoaderSerializer@VMachineName@@$00@@QEAA@XZ
??1?$LoaderSerializer@VNetworkServiceSid@CSecurity@@$00@@QEAA@XZ
??1?$LoaderSerializer@VNtDsApiDllLoader@@$00@@QEAA@XZ
??1?$LoaderSerializer@VResources@Locale@@$0A@@@QEAA@XZ
??1?$LoaderSerializer@VShell32DllLoader@@$00@@QEAA@XZ
??1?$LoaderSerializer@VShlWApiDllLoader@@$00@@QEAA@XZ
??1?$LoaderSerializer@VSubscriptionManager@@$01@@QEAA@XZ
??1?$LoaderSerializer@VUser32DllLoader@@$00@@QEAA@XZ
??1?$LoaderSerializer@VWSManMemCryptManager@@$00@@QEAA@XZ
??1?$SafeMap@PEAVCCertMapping@@UEmpty@@V?$SafeSet_Iterator@PEAVCCertMapping@@@@@@QEAA@XZ
??1?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@QEAA@XZ
??1?$SafeMap@PEAVCShellUriSettings@@UEmpty@@V?$SafeSet_Iterator@PEAVCShellUriSettings@@@@@@QEAA@XZ
??1?$SafeMap@PEAVCollector@@UEmpty@@V?$SafeSet_Iterator@PEAVCollector@@@@@@QEAA@XZ
??1?$SafeMap@PEAVHostOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVHostOperation@@@@@@QEAA@XZ
??1?$SafeMap@PEAVIOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVIOperation@@@@@@QEAA@XZ
??1?$SafeMap@PEAVListenerSourceSubscription@@UEmpty@@V?$SafeSet_Iterator@PEAVListenerSourceSubscription@@@@@@QEAA@XZ
??1?$SafeMap@PEAVPushSubscription@@UEmpty@@V?$SafeSet_Iterator@PEAVPushSubscription@@@@@@QEAA@XZ
??1?$SafeMap@PEAXUEmpty@@V?$SafeSet_Iterator@PEAX@@@@QEAA@XZ
??1?$SafeMap@UPluginKey@@KV?$SafeMap_Iterator@UPluginKey@@K@@@@QEAA@XZ
??1?$SafeMap@UUserKey@@PEAVBlockedRecord@@V?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@@@QEAA@XZ
??1?$SafeMap@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@V?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@@@QEAA@XZ
??1?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@XZ
??1?$SafeMap@VStringKeyCI@@KV?$SafeMap_Iterator@VStringKeyCI@@K@@@@QEAA@XZ
??1?$SafeMap@VStringKeyCI@@UEmpty@@V?$SafeSet_Iterator@VStringKeyCI@@@@@@QEAA@XZ
??1?$SafeMap@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@V?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@@@QEAA@XZ
??1?$SafeMap@VStringKeyStore@@PEAVExpiredOperationIdRecord@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@@@QEAA@XZ
??1?$SafeMap@VStringKeyStore@@PEAVServerFullDuplexChannel@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@@@QEAA@XZ
??1?$SafeMap@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@QEAA@XZ
??1?$SafeMap@_KPEAVSendPacketArgs@RobustConnectionBuffer@@V?$SafeMap_Iterator@_KPEAVSendPacketArgs@RobustConnectionBuffer@@@@@@QEAA@XZ
??1?$SafeMap_Iterator@PEAVCCertMapping@@UEmpty@@@@QEAA@XZ
??1?$SafeMap_Iterator@PEAVCListenerConnect@@PEAV1@@@QEAA@XZ
??1?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@QEAA@XZ
??1?$SafeMap_Iterator@PEAVCListenerReceive@@PEAV1@@@QEAA@XZ
??1?$SafeMap_Iterator@PEAVCListenerSend@@PEAV1@@@QEAA@XZ
??1?$SafeMap_Iterator@PEAVCListenerSignal@@PEAV1@@@QEAA@XZ
??1?$SafeMap_Iterator@PEAVCShellUriSettings@@UEmpty@@@@QEAA@XZ
??1?$SafeMap_Iterator@PEAVCollector@@UEmpty@@@@QEAA@XZ
??1?$SafeMap_Iterator@PEAVHostOperation@@UEmpty@@@@QEAA@XZ
??1?$SafeMap_Iterator@PEAVIOperation@@UEmpty@@@@QEAA@XZ
??1?$SafeMap_Iterator@PEAVListenerSourceSubscription@@UEmpty@@@@QEAA@XZ
??1?$SafeMap_Iterator@PEAVPushSubscription@@UEmpty@@@@QEAA@XZ
??1?$SafeMap_Iterator@PEAXUEmpty@@@@QEAA@XZ
??1?$SafeMap_Iterator@UPluginKey@@K@@QEAA@XZ
??1?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@QEAA@XZ
??1?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@QEAA@XZ
??1?$SafeMap_Iterator@VGuidKey@@PEAVCListenerCommand@@@@QEAA@XZ
??1?$SafeMap_Iterator@VKey@Locale@@K@@QEAA@XZ
??1?$SafeMap_Iterator@VStringKeyCI@@K@@QEAA@XZ
??1?$SafeMap_Iterator@VStringKeyCI@@UEmpty@@@@QEAA@XZ
??1?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@QEAA@XZ
??1?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@QEAA@XZ
??1?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@QEAA@XZ
??1?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@QEAA@XZ
??1?$SafeMap_Iterator@_KPEAVSendPacketArgs@RobustConnectionBuffer@@@@QEAA@XZ
??1?$SafeMap_Lock@PEAVCCertMapping@@UEmpty@@V?$SafeMap_Iterator@PEAVCCertMapping@@UEmpty@@@@@@QEAA@XZ
??1?$SafeMap_Lock@PEAVCCertMapping@@UEmpty@@V?$SafeSet_Iterator@PEAVCCertMapping@@@@@@QEAA@XZ
??1?$SafeMap_Lock@PEAVCListenerConnect@@PEAV1@V?$SafeMap_Iterator@PEAVCListenerConnect@@PEAV1@@@@@QEAA@XZ
??1?$SafeMap_Lock@PEAVCListenerOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@@@QEAA@XZ
??1?$SafeMap_Lock@PEAVCListenerOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@QEAA@XZ
??1?$SafeMap_Lock@PEAVCListenerReceive@@PEAV1@V?$SafeMap_Iterator@PEAVCListenerReceive@@PEAV1@@@@@QEAA@XZ
??1?$SafeMap_Lock@PEAVCListenerSend@@PEAV1@V?$SafeMap_Iterator@PEAVCListenerSend@@PEAV1@@@@@QEAA@XZ
??1?$SafeMap_Lock@PEAVCListenerSignal@@PEAV1@V?$SafeMap_Iterator@PEAVCListenerSignal@@PEAV1@@@@@QEAA@XZ
??1?$SafeMap_Lock@PEAVCShellUriSettings@@UEmpty@@V?$SafeMap_Iterator@PEAVCShellUriSettings@@UEmpty@@@@@@QEAA@XZ
??1?$SafeMap_Lock@PEAVCShellUriSettings@@UEmpty@@V?$SafeSet_Iterator@PEAVCShellUriSettings@@@@@@QEAA@XZ
??1?$SafeMap_Lock@PEAVCollector@@UEmpty@@V?$SafeMap_Iterator@PEAVCollector@@UEmpty@@@@@@QEAA@XZ
??1?$SafeMap_Lock@PEAVHostOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVHostOperation@@UEmpty@@@@@@QEAA@XZ
??1?$SafeMap_Lock@PEAVIOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVIOperation@@UEmpty@@@@@@QEAA@XZ
??1?$SafeMap_Lock@PEAVListenerSourceSubscription@@UEmpty@@V?$SafeMap_Iterator@PEAVListenerSourceSubscription@@UEmpty@@@@@@QEAA@XZ
??1?$SafeMap_Lock@PEAVPushSubscription@@UEmpty@@V?$SafeMap_Iterator@PEAVPushSubscription@@UEmpty@@@@@@QEAA@XZ
??1?$SafeMap_Lock@PEAXUEmpty@@V?$SafeMap_Iterator@PEAXUEmpty@@@@@@QEAA@XZ
??1?$SafeMap_Lock@PEAXUEmpty@@V?$SafeSet_Iterator@PEAX@@@@QEAA@XZ
??1?$SafeMap_Lock@UPluginKey@@KV?$SafeMap_Iterator@UPluginKey@@K@@@@QEAA@XZ
??1?$SafeMap_Lock@UUserKey@@PEAVBlockedRecord@@V?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@@@QEAA@XZ
??1?$SafeMap_Lock@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@V?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@@@QEAA@XZ
??1?$SafeMap_Lock@VGuidKey@@PEAVCListenerCommand@@V?$SafeMap_Iterator@VGuidKey@@PEAVCListenerCommand@@@@@@QEAA@XZ
??1?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@XZ
??1?$SafeMap_Lock@VStringKeyCI@@KV?$SafeMap_Iterator@VStringKeyCI@@K@@@@QEAA@XZ
??1?$SafeMap_Lock@VStringKeyCI@@UEmpty@@V?$SafeMap_Iterator@VStringKeyCI@@UEmpty@@@@@@QEAA@XZ
??1?$SafeMap_Lock@VStringKeyCI@@UEmpty@@V?$SafeSet_Iterator@VStringKeyCI@@@@@@QEAA@XZ
??1?$SafeMap_Lock@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@V?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@@@QEAA@XZ
??1?$SafeMap_Lock@VStringKeyStore@@PEAVExpiredOperationIdRecord@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@@@QEAA@XZ
??1?$SafeMap_Lock@VStringKeyStore@@PEAVServerFullDuplexChannel@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@@@QEAA@XZ
??1?$SafeMap_Lock@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@QEAA@XZ
??1?$SafeMap_Lock@_KPEAVSendPacketArgs@RobustConnectionBuffer@@V?$SafeMap_Iterator@_KPEAVSendPacketArgs@RobustConnectionBuffer@@@@@@QEAA@XZ
??1?$SafeSet@PEAVCCertMapping@@@@QEAA@XZ
??1?$SafeSet@PEAVCListenerOperation@@@@QEAA@XZ
??1?$SafeSet@PEAVCShellUriSettings@@@@QEAA@XZ
??1?$SafeSet@PEAVCollector@@@@QEAA@XZ
??1?$SafeSet@PEAVHostOperation@@@@QEAA@XZ
??1?$SafeSet@PEAVIOperation@@@@QEAA@XZ
??1?$SafeSet@PEAVListenerSourceSubscription@@@@QEAA@XZ
??1?$SafeSet@PEAVPushSubscription@@@@QEAA@XZ
??1?$SafeSet@PEAX@@QEAA@XZ
??1?$SafeSet@VStringKeyCI@@@@QEAA@XZ
??1?$SafeSet_Iterator@PEAVCCertMapping@@@@QEAA@XZ
??1?$SafeSet_Iterator@PEAVCListenerOperation@@@@QEAA@XZ
??1?$SafeSet_Iterator@PEAVCShellUriSettings@@@@QEAA@XZ
??1?$SafeSet_Iterator@PEAVCollector@@@@QEAA@XZ
??1?$SafeSet_Iterator@PEAVHostOperation@@@@QEAA@XZ
??1?$SafeSet_Iterator@PEAVIOperation@@@@QEAA@XZ
??1?$SafeSet_Iterator@PEAVListenerSourceSubscription@@@@QEAA@XZ
??1?$SafeSet_Iterator@PEAVPushSubscription@@@@QEAA@XZ
??1?$SafeSet_Iterator@PEAX@@QEAA@XZ
??1?$SafeSet_Iterator@VStringKeyCI@@@@QEAA@XZ
??1?$SimpleQueue@T_LARGE_INTEGER@@@@QEAA@XZ
??1AutoBstr@@QEAA@XZ
??1AutoBstrNoAlloc@@QEAA@XZ
??1AutoCertContext@@QEAA@XZ
??1AutoChainContext@@QEAA@XZ
??1AutoCoTaskMemFree@@QEAA@XZ
??1AutoFwXmlCloseParser@@QEAA@XZ
??1AutoHandle@@QEAA@XZ
??1AutoImpersonateUser@@QEAA@XZ
??1AutoLibrary@@QEAA@XZ
??1AutoLocalFree@@QEAA@XZ
??1AutoMIClass@@QEAA@XZ
??1AutoMIInstance@@QEAA@XZ
??1AutoObject@@QEAA@XZ
??1AutoRegKey@@QEAA@XZ
??1AutoSecurityDescriptor@@QEAA@XZ
??1AutoWaitHandle@@QEAA@XZ
??1BufferFormatter@@UEAA@XZ
??1CBaseConfigCache@@UEAA@XZ
??1CClientConfigCache@@UEAA@XZ
??1CCommonConfigSettings@@UEAA@XZ
??1CConfigManager@@UEAA@XZ
??1CErrorContext@@UEAA@XZ
??1CRequestContext@@UEAA@XZ
??1CResourceAlias@@QEAA@XZ
??1CServiceConfigCache@@EEAA@XZ
??1CServiceWatcher@CServiceConfigCache@@QEAA@XZ
??1CWSManCriticalSection@@QEAA@XZ
??1CWSManCriticalSectionWithConditionVar@@QEAA@XZ
??1CWSManEPR@@UEAA@XZ
??1CWSManGroupPolicyManager@@EEAA@XZ
??1CWSManResource@@UEAA@XZ
??1CWSManResourceNoResourceUri@@UEAA@XZ
??1CWSManSecurityUI@@QEAA@XZ
??1CWinRSPluginConfigCache@@EEAA@XZ
??1ChildLifeTimeManager@@QEAA@XZ
??1CircularBufferFormatter@@UEAA@XZ
??1ConfigRegistry@@IEAA@XZ
??1EtwCorrelationHelper@@UEAA@XZ
??1EventHandler@WSMan@@QEAA@XZ
??1IConfigChangeObserver@@UEAA@XZ
??1ILifeTimeMgmt@@UEAA@XZ
??1IRequestContext@@UEAA@XZ
??1IWSManGroupPolicyObserver@@UEAA@XZ
??1IWSManGroupPolicyPublisher@@UEAA@XZ
??1MessageId@PacketParser@@QEAA@XZ
??1OnHTTPInitialize@@QEAA@XZ
??1OperationId@PacketParser@@QEAA@XZ
??1OwnLock@@QEAA@XZ
??1PacketParser@@QEAA@XZ
??1RBUFFER@@QEAA@XZ
??1ReferenceParameters@PacketParser@@QEAA@XZ
??1SBUFFER@@QEAA@XZ
??1ShareLock@@QEAA@XZ
??1SoapSemanticConverter@@QEAA@XZ
??1TSTRBUFFER@@QEAA@XZ
??1UserRecord@@QEAA@XZ
??1XmlReader@@QEAA@XZ
??4?$AutoCleanup@V?$AutoDelete@D@@PEAD@@QEAAAEAV?$AutoDelete@D@@PEAD@Z
??4?$AutoCleanup@V?$AutoDelete@G@@PEAG@@QEAAAEAV?$AutoDelete@G@@PEAG@Z
??4?$AutoCleanup@V?$AutoDelete@V?$SafeMap_Iterator@VStringKeyCI@@K@@@@PEAV?$SafeMap_Iterator@VStringKeyCI@@K@@@@QEAAAEAV?$AutoDelete@V?$SafeMap_Iterator@VStringKeyCI@@K@@@@PEAV?$SafeMap_Iterator@VStringKeyCI@@K@@@Z
??4?$AutoCleanup@V?$AutoDelete@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@PEAV?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@QEAAAEAV?$AutoDelete@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@PEAV?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@Z
??4?$AutoCleanup@V?$AutoDelete@V?$SafeSet@PEAVCCertMapping@@@@@@PEAV?$SafeSet@PEAVCCertMapping@@@@@@QEAAAEAV?$AutoDelete@V?$SafeSet@PEAVCCertMapping@@@@@@PEAV?$SafeSet@PEAVCCertMapping@@@@@Z
??4?$AutoCleanup@V?$AutoDelete@V?$SafeSet@PEAVCShellUriSettings@@@@@@PEAV?$SafeSet@PEAVCShellUriSettings@@@@@@QEAAAEAV?$AutoDelete@V?$SafeSet@PEAVCShellUriSettings@@@@@@PEAV?$SafeSet@PEAVCShellUriSettings@@@@@Z
??4?$AutoCleanup@V?$AutoDelete@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@PEAV?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@QEAAAEAV?$AutoDelete@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@PEAV?$SafeSet_Iterator@PEAVCListenerOperation@@@@@Z
??4?$AutoCleanup@V?$AutoDelete@V?$set@PEAVCListenerSettings@@VCListenerSettingsLessFunctor@CServiceConfigSettings@@V?$transport_allocator@PEAVCListenerSettings@@@@@std@@@@PEAV?$set@PEAVCListenerSettings@@VCListenerSettingsLessFunctor@CServiceConfigSettings@@V?$transport_allocator@PEAVCListenerSettings@@@@@std@@@@QEAAAEAV?$AutoDelete@V?$set@PEAVCListenerSettings@@VCListenerSettingsLessFunctor@CServiceConfigSettings@@V?$transport_allocator@PEAVCListenerSettings@@@@@std@@@@PEAV?$set@PEAVCListenerSettings@@VCListenerSettingsLessFunctor@CServiceConfigSettings@@V?$transport_allocator@PEAVCListenerSettings@@@@@std@@@Z
??4?$AutoCleanup@V?$AutoDelete@V?$set@Usockaddr_storage@@VSockAddrLessFunctor@CListenerSettings@@V?$transport_allocator@Usockaddr_storage@@@@@std@@@@PEAV?$set@Usockaddr_storage@@VSockAddrLessFunctor@CListenerSettings@@V?$transport_allocator@Usockaddr_storage@@@@@std@@@@QEAAAEAV?$AutoDelete@V?$set@Usockaddr_storage@@VSockAddrLessFunctor@CListenerSettings@@V?$transport_allocator@Usockaddr_storage@@@@@std@@@@PEAV?$set@Usockaddr_storage@@VSockAddrLessFunctor@CListenerSettings@@V?$transport_allocator@Usockaddr_storage@@@@@std@@@Z
??4?$AutoCleanup@V?$AutoDelete@V?$vector@PEAVHandleImpl@Client@WSMan@@V?$transport_allocator@PEAVHandleImpl@Client@WSMan@@@@@std@@@@PEAV?$vector@PEAVHandleImpl@Client@WSMan@@V?$transport_allocator@PEAVHandleImpl@Client@WSMan@@@@@std@@@@QEAAAEAV?$AutoDelete@V?$vector@PEAVHandleImpl@Client@WSMan@@V?$transport_allocator@PEAVHandleImpl@Client@WSMan@@@@@std@@@@PEAV?$vector@PEAVHandleImpl@Client@WSMan@@V?$transport_allocator@PEAVHandleImpl@Client@WSMan@@@@@std@@@Z
??4?$AutoCleanup@V?$AutoDelete@V?$vector@PEAVIServiceConfigObserver@@V?$transport_allocator@PEAVIServiceConfigObserver@@@@@std@@@@PEAV?$vector@PEAVIServiceConfigObserver@@V?$transport_allocator@PEAVIServiceConfigObserver@@@@@std@@@@QEAAAEAV?$AutoDelete@V?$vector@PEAVIServiceConfigObserver@@V?$transport_allocator@PEAVIServiceConfigObserver@@@@@std@@@@PEAV?$vector@PEAVIServiceConfigObserver@@V?$transport_allocator@PEAVIServiceConfigObserver@@@@@std@@@Z
??4?$AutoCleanup@V?$AutoDelete@VBlockedRecord@@@@PEAVBlockedRecord@@@@QEAAAEAV?$AutoDelete@VBlockedRecord@@@@PEAVBlockedRecord@@@Z
??4?$AutoCleanup@V?$AutoDelete@VCConfigChangeSource@@@@PEAVCConfigChangeSource@@@@QEAAAEAV?$AutoDelete@VCConfigChangeSource@@@@PEAVCConfigChangeSource@@@Z
??4?$AutoCleanup@V?$AutoDelete@VCObserverConfigChangeErrors@@@@PEAVCObserverConfigChangeErrors@@@@QEAAAEAV?$AutoDelete@VCObserverConfigChangeErrors@@@@PEAVCObserverConfigChangeErrors@@@Z
??4?$AutoCleanup@V?$AutoDelete@VCServiceWatcher@CServiceConfigCache@@@@PEAVCServiceWatcher@CServiceConfigCache@@@@QEAAAEAV?$AutoDelete@VCServiceWatcher@CServiceConfigCache@@@@PEAVCServiceWatcher@CServiceConfigCache@@@Z
??4?$AutoCleanup@V?$AutoDelete@VCWSManResource@@@@PEAVCWSManResource@@@@QEAAAEAV?$AutoDelete@VCWSManResource@@@@PEAVCWSManResource@@@Z
??4?$AutoCleanup@V?$AutoDelete@VCertHash@@@@PEAVCertHash@@@@QEAAAEAV?$AutoDelete@VCertHash@@@@PEAVCertHash@@@Z
??4?$AutoCleanup@V?$AutoDelete@VConfigUpdate@@@@PEAVConfigUpdate@@@@QEAAAEAV?$AutoDelete@VConfigUpdate@@@@PEAVConfigUpdate@@@Z
??4?$AutoCleanup@V?$AutoDelete@VEnumSinkEx@@@@PEAVEnumSinkEx@@@@QEAAAEAV?$AutoDelete@VEnumSinkEx@@@@PEAVEnumSinkEx@@@Z
??4?$AutoCleanup@V?$AutoDelete@VGPApiManager@@@@PEAVGPApiManager@@@@QEAAAEAV?$AutoDelete@VGPApiManager@@@@PEAVGPApiManager@@@Z
??4?$AutoCleanup@V?$AutoDelete@VGeneralSinkEx@@@@PEAVGeneralSinkEx@@@@QEAAAEAV?$AutoDelete@VGeneralSinkEx@@@@PEAVGeneralSinkEx@@@Z
??4?$AutoCleanup@V?$AutoDelete@VIChannelObserverFactory@@@@PEAVIChannelObserverFactory@@@@QEAAAEAV?$AutoDelete@VIChannelObserverFactory@@@@PEAVIChannelObserverFactory@@@Z
??4?$AutoCleanup@V?$AutoDelete@VIQueryDASHSMASHInterface@@@@PEAVIQueryDASHSMASHInterface@@@@QEAAAEAV?$AutoDelete@VIQueryDASHSMASHInterface@@@@PEAVIQueryDASHSMASHInterface@@@Z
??4?$AutoCleanup@V?$AutoDelete@VISpecification@@@@PEAVISpecification@@@@QEAAAEAV?$AutoDelete@VISpecification@@@@PEAVISpecification@@@Z
??4?$AutoCleanup@V?$AutoDelete@VPacketCreator@@@@PEAVPacketCreator@@@@QEAAAEAV?$AutoDelete@VPacketCreator@@@@PEAVPacketCreator@@@Z
??4?$AutoCleanup@V?$AutoDelete@VPacketParser@@@@PEAVPacketParser@@@@QEAAAEAV?$AutoDelete@VPacketParser@@@@PEAVPacketParser@@@Z
??4?$AutoCleanup@V?$AutoDelete@VRunAsConfiguration@@@@PEAVRunAsConfiguration@@@@QEAAAEAV?$AutoDelete@VRunAsConfiguration@@@@PEAVRunAsConfiguration@@@Z
??4?$AutoCleanup@V?$AutoDelete@VSecurityEntry@Catalog@@@@PEAVSecurityEntry@Catalog@@@@QEAAAEAV?$AutoDelete@VSecurityEntry@Catalog@@@@PEAVSecurityEntry@Catalog@@@Z
??4?$AutoCleanup@V?$AutoDelete@VServiceSoapProcessor@@@@PEAVServiceSoapProcessor@@@@QEAAAEAV?$AutoDelete@VServiceSoapProcessor@@@@PEAVServiceSoapProcessor@@@Z
??4?$AutoCleanup@V?$AutoDelete@VSubscriptionEnumerator@@@@PEAVSubscriptionEnumerator@@@@QEAAAEAV?$AutoDelete@VSubscriptionEnumerator@@@@PEAVSubscriptionEnumerator@@@Z
??4?$AutoCleanup@V?$AutoDelete@VTSTRBUFFER@@@@PEAVTSTRBUFFER@@@@QEAAAEAV?$AutoDelete@VTSTRBUFFER@@@@PEAVTSTRBUFFER@@@Z
??4?$AutoCleanup@V?$AutoDelete@VUniqueStringOverflow@@@@PEAVUniqueStringOverflow@@@@QEAAAEAV?$AutoDelete@VUniqueStringOverflow@@@@PEAVUniqueStringOverflow@@@Z
??4?$AutoCleanup@V?$AutoDelete@VWSMANCONFIGTABLE_IDENTITY@@@@PEAVWSMANCONFIGTABLE_IDENTITY@@@@QEAAAEAV?$AutoDelete@VWSMANCONFIGTABLE_IDENTITY@@@@PEAVWSMANCONFIGTABLE_IDENTITY@@@Z
??4?$AutoCleanup@V?$AutoDelete@VWmiEnumContext@@@@PEAVWmiEnumContext@@@@QEAAAEAV?$AutoDelete@VWmiEnumContext@@@@PEAVWmiEnumContext@@@Z
??4?$AutoCleanup@V?$AutoDelete@VXmlReader@@@@PEAVXmlReader@@@@QEAAAEAV?$AutoDelete@VXmlReader@@@@PEAVXmlReader@@@Z
??4?$AutoCleanup@V?$AutoDeleteVector@$$CBG@@PEBG@@QEAAAEAV?$AutoDeleteVector@$$CBG@@PEBG@Z
??4?$AutoCleanup@V?$AutoDeleteVector@D@@PEAD@@QEAAAEAV?$AutoDeleteVector@D@@PEAD@Z
??4?$AutoCleanup@V?$AutoDeleteVector@E@@PEAE@@QEAAAEAV?$AutoDeleteVector@E@@PEAE@Z
??4?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@QEAAAEAV?$AutoDeleteVector@G@@PEAG@Z
??4?$AutoCleanup@V?$AutoDeleteVector@PEAG@@PEAPEAG@@QEAAAEAV?$AutoDeleteVector@PEAG@@PEAPEAG@Z
??4?$AutoCleanup@V?$AutoDeleteVector@PEBG@@PEAPEBG@@QEAAAEAV?$AutoDeleteVector@PEBG@@PEAPEBG@Z
??4?$AutoCleanup@V?$AutoDeleteVector@U_CONFIG_UPDATE@@@@PEAU_CONFIG_UPDATE@@@@QEAAAEAV?$AutoDeleteVector@U_CONFIG_UPDATE@@@@PEAU_CONFIG_UPDATE@@@Z
??4?$AutoCleanup@V?$AutoDeleteVector@U_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@PEAU_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@QEAAAEAV?$AutoDeleteVector@U_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@PEAU_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@Z
??4?$AutoCleanup@V?$AutoDeleteVector@U_WINRS_RUN_COMMAND_ARG@@@@PEAU_WINRS_RUN_COMMAND_ARG@@@@QEAAAEAV?$AutoDeleteVector@U_WINRS_RUN_COMMAND_ARG@@@@PEAU_WINRS_RUN_COMMAND_ARG@@@Z
??4?$AutoCleanup@V?$AutoDeleteVector@U_WSMAN_OPTION@@@@PEAU_WSMAN_OPTION@@@@QEAAAEAV?$AutoDeleteVector@U_WSMAN_OPTION@@@@PEAU_WSMAN_OPTION@@@Z
??4?$AutoCleanup@V?$AutoDeleteVector@X@@PEAX@@QEAAAEAV?$AutoDeleteVector@X@@PEAX@Z
??4?$AutoCleanup@V?$AutoFree@E@@PEAE@@QEAAAEAV?$AutoFree@E@@PEAE@Z
??4?$AutoCleanup@V?$AutoLocklessItemRecycle@VPacket@@@@PEAVPacket@@@@QEAAAEAV?$AutoLocklessItemRecycle@VPacket@@@@PEAVPacket@@@Z
??4?$AutoCleanup@V?$AutoRelease@UIClientSecurity@@@@PEAUIClientSecurity@@@@QEAAAEAV?$AutoRelease@UIClientSecurity@@@@PEAUIClientSecurity@@@Z
??4?$AutoCleanup@V?$AutoRelease@UIEnumWbemClassObject@@@@PEAUIEnumWbemClassObject@@@@QEAAAEAV?$AutoRelease@UIEnumWbemClassObject@@@@PEAUIEnumWbemClassObject@@@Z
??4?$AutoCleanup@V?$AutoRelease@UIErrorInfo@@@@PEAUIErrorInfo@@@@QEAAAEAV?$AutoRelease@UIErrorInfo@@@@PEAUIErrorInfo@@@Z
??4?$AutoCleanup@V?$AutoRelease@UIUnknown@@@@PEAUIUnknown@@@@QEAAAEAV?$AutoRelease@UIUnknown@@@@PEAUIUnknown@@@Z
??4?$AutoCleanup@V?$AutoRelease@UIWbemClassObject@@@@PEAUIWbemClassObject@@@@QEAAAEAV?$AutoRelease@UIWbemClassObject@@@@PEAUIWbemClassObject@@@Z
??4?$AutoCleanup@V?$AutoRelease@UIWbemContext@@@@PEAUIWbemContext@@@@QEAAAEAV?$AutoRelease@UIWbemContext@@@@PEAUIWbemContext@@@Z
??4?$AutoCleanup@V?$AutoRelease@UIWbemLocator@@@@PEAUIWbemLocator@@@@QEAAAEAV?$AutoRelease@UIWbemLocator@@@@PEAUIWbemLocator@@@Z
??4?$AutoCleanup@V?$AutoRelease@UIWbemObjectTextSrc@@@@PEAUIWbemObjectTextSrc@@@@QEAAAEAV?$AutoRelease@UIWbemObjectTextSrc@@@@PEAUIWbemObjectTextSrc@@@Z
??4?$AutoCleanup@V?$AutoRelease@UIWbemPath@@@@PEAUIWbemPath@@@@QEAAAEAV?$AutoRelease@UIWbemPath@@@@PEAUIWbemPath@@@Z
??4?$AutoCleanup@V?$AutoRelease@UIWbemPathKeyList@@@@PEAUIWbemPathKeyList@@@@QEAAAEAV?$AutoRelease@UIWbemPathKeyList@@@@PEAUIWbemPathKeyList@@@Z
??4?$AutoCleanup@V?$AutoRelease@UIWbemQualifierSet@@@@PEAUIWbemQualifierSet@@@@QEAAAEAV?$AutoRelease@UIWbemQualifierSet@@@@PEAUIWbemQualifierSet@@@Z
??4?$AutoCleanup@V?$AutoRelease@UIWbemQuery@@@@PEAUIWbemQuery@@@@QEAAAEAV?$AutoRelease@UIWbemQuery@@@@PEAUIWbemQuery@@@Z
??4?$AutoCleanup@V?$AutoRelease@UIWbemServices@@@@PEAUIWbemServices@@@@QEAAAEAV?$AutoRelease@UIWbemServices@@@@PEAUIWbemServices@@@Z
??4?$AutoCleanup@V?$AutoRelease@VApplication@Client@WSMan@@@@PEAVApplication@Client@WSMan@@@@QEAAAEAV?$AutoRelease@VApplication@Client@WSMan@@@@PEAVApplication@Client@WSMan@@@Z
??4?$AutoCleanup@V?$AutoRelease@VCBaseConfigCache@@@@PEAVCBaseConfigCache@@@@QEAAAEAV?$AutoRelease@VCBaseConfigCache@@@@PEAVCBaseConfigCache@@@Z
??4?$AutoCleanup@V?$AutoRelease@VCClientConfigSettings@@@@PEAVCClientConfigSettings@@@@QEAAAEAV?$AutoRelease@VCClientConfigSettings@@@@PEAVCClientConfigSettings@@@Z
??4?$AutoCleanup@V?$AutoRelease@VCCommonConfigSettings@@@@PEAVCCommonConfigSettings@@@@QEAAAEAV?$AutoRelease@VCCommonConfigSettings@@@@PEAVCCommonConfigSettings@@@Z
??4?$AutoCleanup@V?$AutoRelease@VCConfigCacheMap@CBaseConfigCache@@@@PEAVCConfigCacheMap@CBaseConfigCache@@@@QEAAAEAV?$AutoRelease@VCConfigCacheMap@CBaseConfigCache@@@@PEAVCConfigCacheMap@CBaseConfigCache@@@Z
??4?$AutoCleanup@V?$AutoRelease@VCConfigManager@@@@PEAVCConfigManager@@@@QEAAAEAV?$AutoRelease@VCConfigManager@@@@PEAVCConfigManager@@@Z
??4?$AutoCleanup@V?$AutoRelease@VCRemoteOperation@@@@PEAVCRemoteOperation@@@@QEAAAEAV?$AutoRelease@VCRemoteOperation@@@@PEAVCRemoteOperation@@@Z
??4?$AutoCleanup@V?$AutoRelease@VCRemoteSession@@@@PEAVCRemoteSession@@@@QEAAAEAV?$AutoRelease@VCRemoteSession@@@@PEAVCRemoteSession@@@Z
??4?$AutoCleanup@V?$AutoRelease@VCRequestContext@@@@PEAVCRequestContext@@@@QEAAAEAV?$AutoRelease@VCRequestContext@@@@PEAVCRequestContext@@@Z
??4?$AutoCleanup@V?$AutoRelease@VCServiceCommonConfigSettings@@@@PEAVCServiceCommonConfigSettings@@@@QEAAAEAV?$AutoRelease@VCServiceCommonConfigSettings@@@@PEAVCServiceCommonConfigSettings@@@Z
??4?$AutoCleanup@V?$AutoRelease@VCServiceConfigCache@@@@PEAVCServiceConfigCache@@@@QEAAAEAV?$AutoRelease@VCServiceConfigCache@@@@PEAVCServiceConfigCache@@@Z
??4?$AutoCleanup@V?$AutoRelease@VCServiceConfigSettings@@@@PEAVCServiceConfigSettings@@@@QEAAAEAV?$AutoRelease@VCServiceConfigSettings@@@@PEAVCServiceConfigSettings@@@Z
??4?$AutoCleanup@V?$AutoRelease@VCWSManEPR@@@@PEAVCWSManEPR@@@@QEAAAEAV?$AutoRelease@VCWSManEPR@@@@PEAVCWSManEPR@@@Z
??4?$AutoCleanup@V?$AutoRelease@VCWSManGroupPolicyManager@@@@PEAVCWSManGroupPolicyManager@@@@QEAAAEAV?$AutoRelease@VCWSManGroupPolicyManager@@@@PEAVCWSManGroupPolicyManager@@@Z
??4?$AutoCleanup@V?$AutoRelease@VCWSManResource@@@@PEAVCWSManResource@@@@QEAAAEAV?$AutoRelease@VCWSManResource@@@@PEAVCWSManResource@@@Z
??4?$AutoCleanup@V?$AutoRelease@VCWinRSPluginConfigCache@@@@PEAVCWinRSPluginConfigCache@@@@QEAAAEAV?$AutoRelease@VCWinRSPluginConfigCache@@@@PEAVCWinRSPluginConfigCache@@@Z
??4?$AutoCleanup@V?$AutoRelease@VCWinRSPluginConfigSettings@@@@PEAVCWinRSPluginConfigSettings@@@@QEAAAEAV?$AutoRelease@VCWinRSPluginConfigSettings@@@@PEAVCWinRSPluginConfigSettings@@@Z
??4?$AutoCleanup@V?$AutoRelease@VEnumSinkEx@@@@PEAVEnumSinkEx@@@@QEAAAEAV?$AutoRelease@VEnumSinkEx@@@@PEAVEnumSinkEx@@@Z
??4?$AutoCleanup@V?$AutoRelease@VGeneralSinkEx@@@@PEAVGeneralSinkEx@@@@QEAAAEAV?$AutoRelease@VGeneralSinkEx@@@@PEAVGeneralSinkEx@@@Z
??4?$AutoCleanup@V?$AutoRelease@VIRequestContext@@@@PEAVIRequestContext@@@@QEAAAEAV?$AutoRelease@VIRequestContext@@@@PEAVIRequestContext@@@Z
??4?$AutoCleanup@V?$AutoRelease@VISubscription@@@@PEAVISubscription@@@@QEAAAEAV?$AutoRelease@VISubscription@@@@PEAVISubscription@@@Z
??4?$AutoCleanup@V?$AutoRelease@VInboundRequestDetails@@@@PEAVInboundRequestDetails@@@@QEAAAEAV?$AutoRelease@VInboundRequestDetails@@@@PEAVInboundRequestDetails@@@Z
??4?$AutoCleanup@V?$AutoRelease@VUserRecord@@@@PEAVUserRecord@@@@QEAAAEAV?$AutoRelease@VUserRecord@@@@PEAVUserRecord@@@Z
??4?$AutoCleanup@V?$AutoRelease@VWSManHttpListener@@@@PEAVWSManHttpListener@@@@QEAAAEAV?$AutoRelease@VWSManHttpListener@@@@PEAVWSManHttpListener@@@Z
??4?$AutoCleanup@V?$AutoReleaseEx@VShell@Client@WSMan@@@@PEAVShell@Client@WSMan@@@@QEAAAEAV?$AutoReleaseEx@VShell@Client@WSMan@@@@PEAVShell@Client@WSMan@@@Z
??4?$AutoCleanup@VAutoBstr@@PEAG@@QEAAAEAVAutoBstr@@PEAG@Z
??4?$AutoCleanup@VAutoBstrNoAlloc@@PEAG@@QEAAAEAVAutoBstrNoAlloc@@PEAG@Z
??4?$AutoCleanup@VAutoCertContext@@PEBU_CERT_CONTEXT@@@@QEAAAEAVAutoCertContext@@PEBU_CERT_CONTEXT@@@Z
??4?$AutoCleanup@VAutoChainContext@@PEBU_CERT_CHAIN_CONTEXT@@@@QEAAAEAVAutoChainContext@@PEBU_CERT_CHAIN_CONTEXT@@@Z
??4?$AutoCleanup@VAutoCoTaskMemFree@@PEAX@@QEAAAEAVAutoCoTaskMemFree@@PEAX@Z
??4?$AutoCleanup@VAutoFwXmlCloseParser@@PEAX@@QEAAAEAVAutoFwXmlCloseParser@@PEAX@Z
??4?$AutoCleanup@VAutoHandle@@PEAX@@QEAAAEAVAutoHandle@@PEAX@Z
??4?$AutoCleanup@VAutoImpersonateUser@@PEAX@@QEAAAEAVAutoImpersonateUser@@PEAX@Z
??4?$AutoCleanup@VAutoLibrary@@PEAUHINSTANCE__@@@@QEAAAEAVAutoLibrary@@PEAUHINSTANCE__@@@Z
??4?$AutoCleanup@VAutoLocalFree@@PEAX@@QEAAAEAVAutoLocalFree@@PEAX@Z
??4?$AutoCleanup@VAutoMIClass@@PEAU_MI_Class@@@@QEAAAEAVAutoMIClass@@PEAU_MI_Class@@@Z
??4?$AutoCleanup@VAutoMIInstance@@PEAU_MI_Instance@@@@QEAAAEAVAutoMIInstance@@PEAU_MI_Instance@@@Z
??4?$AutoCleanup@VAutoObject@@PEAUWSMAN_OBJECT@@@@QEAAAEAVAutoObject@@PEAUWSMAN_OBJECT@@@Z
??4?$AutoCleanup@VAutoRegKey@@PEAUHKEY__@@@@QEAAAEAVAutoRegKey@@PEAUHKEY__@@@Z
??4?$AutoCleanup@VAutoSecurityDescriptor@@PEAX@@QEAAAEAVAutoSecurityDescriptor@@PEAX@Z
??4?$AutoCleanup@VAutoWaitHandle@@PEAX@@QEAAAEAVAutoWaitHandle@@PEAX@Z
??4?$AutoDelete@D@@QEAAAEAV0@PEAD@Z
??4?$AutoDelete@G@@QEAAAEAV0@PEAG@Z
??4?$AutoDelete@V?$SafeMap_Iterator@VStringKeyCI@@K@@@@QEAAAEAV0@PEAV?$SafeMap_Iterator@VStringKeyCI@@K@@@Z
??4?$AutoDelete@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@QEAAAEAV0@PEAV?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@Z
??4?$AutoDelete@V?$SafeSet@PEAVCCertMapping@@@@@@QEAAAEAV0@PEAV?$SafeSet@PEAVCCertMapping@@@@@Z
??4?$AutoDelete@V?$SafeSet@PEAVCShellUriSettings@@@@@@QEAAAEAV0@PEAV?$SafeSet@PEAVCShellUriSettings@@@@@Z
??4?$AutoDelete@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@QEAAAEAV0@PEAV?$SafeSet_Iterator@PEAVCListenerOperation@@@@@Z
??4?$AutoDelete@V?$set@PEAVCListenerSettings@@VCListenerSettingsLessFunctor@CServiceConfigSettings@@V?$transport_allocator@PEAVCListenerSettings@@@@@std@@@@QEAAAEAV0@PEAV?$set@PEAVCListenerSettings@@VCListenerSettingsLessFunctor@CServiceConfigSettings@@V?$transport_allocator@PEAVCListenerSettings@@@@@std@@@Z
??4?$AutoDelete@V?$set@Usockaddr_storage@@VSockAddrLessFunctor@CListenerSettings@@V?$transport_allocator@Usockaddr_storage@@@@@std@@@@QEAAAEAV0@PEAV?$set@Usockaddr_storage@@VSockAddrLessFunctor@CListenerSettings@@V?$transport_allocator@Usockaddr_storage@@@@@std@@@Z
??4?$AutoDelete@V?$vector@PEAVHandleImpl@Client@WSMan@@V?$transport_allocator@PEAVHandleImpl@Client@WSMan@@@@@std@@@@QEAAAEAV0@PEAV?$vector@PEAVHandleImpl@Client@WSMan@@V?$transport_allocator@PEAVHandleImpl@Client@WSMan@@@@@std@@@Z
??4?$AutoDelete@V?$vector@PEAVIServiceConfigObserver@@V?$transport_allocator@PEAVIServiceConfigObserver@@@@@std@@@@QEAAAEAV0@PEAV?$vector@PEAVIServiceConfigObserver@@V?$transport_allocator@PEAVIServiceConfigObserver@@@@@std@@@Z
??4?$AutoDelete@VBlockedRecord@@@@QEAAAEAV0@PEAVBlockedRecord@@@Z
??4?$AutoDelete@VCConfigChangeSource@@@@QEAAAEAV0@PEAVCConfigChangeSource@@@Z
??4?$AutoDelete@VCObserverConfigChangeErrors@@@@QEAAAEAV0@PEAVCObserverConfigChangeErrors@@@Z
??4?$AutoDelete@VCServiceWatcher@CServiceConfigCache@@@@QEAAAEAV0@PEAVCServiceWatcher@CServiceConfigCache@@@Z
??4?$AutoDelete@VCWSManResource@@@@QEAAAEAV0@PEAVCWSManResource@@@Z
??4?$AutoDelete@VCertHash@@@@QEAAAEAV0@PEAVCertHash@@@Z
??4?$AutoDelete@VConfigUpdate@@@@QEAAAEAV0@PEAVConfigUpdate@@@Z
??4?$AutoDelete@VEnumSinkEx@@@@QEAAAEAV0@PEAVEnumSinkEx@@@Z
??4?$AutoDelete@VGPApiManager@@@@QEAAAEAV0@PEAVGPApiManager@@@Z
??4?$AutoDelete@VGeneralSinkEx@@@@QEAAAEAV0@PEAVGeneralSinkEx@@@Z
??4?$AutoDelete@VIChannelObserverFactory@@@@QEAAAEAV0@PEAVIChannelObserverFactory@@@Z
??4?$AutoDelete@VIQueryDASHSMASHInterface@@@@QEAAAEAV0@PEAVIQueryDASHSMASHInterface@@@Z
??4?$AutoDelete@VISpecification@@@@QEAAAEAV0@PEAVISpecification@@@Z
??4?$AutoDelete@VPacketCreator@@@@QEAAAEAV0@PEAVPacketCreator@@@Z
??4?$AutoDelete@VPacketParser@@@@QEAAAEAV0@PEAVPacketParser@@@Z
??4?$AutoDelete@VRunAsConfiguration@@@@QEAAAEAV0@PEAVRunAsConfiguration@@@Z
??4?$AutoDelete@VSecurityEntry@Catalog@@@@QEAAAEAV0@PEAVSecurityEntry@Catalog@@@Z
??4?$AutoDelete@VServiceSoapProcessor@@@@QEAAAEAV0@PEAVServiceSoapProcessor@@@Z
??4?$AutoDelete@VSubscriptionEnumerator@@@@QEAAAEAV0@PEAVSubscriptionEnumerator@@@Z
??4?$AutoDelete@VTSTRBUFFER@@@@QEAAAEAV0@PEAVTSTRBUFFER@@@Z
??4?$AutoDelete@VUniqueStringOverflow@@@@QEAAAEAV0@PEAVUniqueStringOverflow@@@Z
??4?$AutoDelete@VWSMANCONFIGTABLE_IDENTITY@@@@QEAAAEAV0@PEAVWSMANCONFIGTABLE_IDENTITY@@@Z
??4?$AutoDelete@VWmiEnumContext@@@@QEAAAEAV0@PEAVWmiEnumContext@@@Z
??4?$AutoDelete@VXmlReader@@@@QEAAAEAV0@PEAVXmlReader@@@Z
??4?$AutoDeleteVector@$$CBG@@QEAAAEAV0@PEBG@Z
??4?$AutoDeleteVector@D@@QEAAAEAV0@PEAD@Z
??4?$AutoDeleteVector@E@@QEAAAEAV0@PEAE@Z
??4?$AutoDeleteVector@G@@QEAAAEAV0@PEAG@Z
??4?$AutoDeleteVector@PEAG@@QEAAAEAV0@PEAPEAG@Z
??4?$AutoDeleteVector@PEBG@@QEAAAEAV0@PEAPEBG@Z
??4?$AutoDeleteVector@U_CONFIG_UPDATE@@@@QEAAAEAV0@PEAU_CONFIG_UPDATE@@@Z
??4?$AutoDeleteVector@U_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@QEAAAEAV0@PEAU_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@Z
??4?$AutoDeleteVector@U_WINRS_RUN_COMMAND_ARG@@@@QEAAAEAV0@PEAU_WINRS_RUN_COMMAND_ARG@@@Z
??4?$AutoDeleteVector@U_WSMAN_OPTION@@@@QEAAAEAV0@PEAU_WSMAN_OPTION@@@Z
??4?$AutoDeleteVector@X@@QEAAAEAV0@PEAX@Z
??4?$AutoFree@E@@QEAAAEAV0@PEAE@Z
??4?$AutoLocklessItemRecycle@VPacket@@@@QEAAAEAV0@PEAVPacket@@@Z
??4?$AutoRelease@UIClientSecurity@@@@QEAAAEAV0@PEAUIClientSecurity@@@Z
??4?$AutoRelease@UIEnumWbemClassObject@@@@QEAAAEAV0@PEAUIEnumWbemClassObject@@@Z
??4?$AutoRelease@UIErrorInfo@@@@QEAAAEAV0@PEAUIErrorInfo@@@Z
??4?$AutoRelease@UIUnknown@@@@QEAAAEAV0@PEAUIUnknown@@@Z
??4?$AutoRelease@UIWbemClassObject@@@@QEAAAEAV0@PEAUIWbemClassObject@@@Z
??4?$AutoRelease@UIWbemContext@@@@QEAAAEAV0@PEAUIWbemContext@@@Z
??4?$AutoRelease@UIWbemLocator@@@@QEAAAEAV0@PEAUIWbemLocator@@@Z
??4?$AutoRelease@UIWbemObjectTextSrc@@@@QEAAAEAV0@PEAUIWbemObjectTextSrc@@@Z
??4?$AutoRelease@UIWbemPath@@@@QEAAAEAV0@PEAUIWbemPath@@@Z
??4?$AutoRelease@UIWbemPathKeyList@@@@QEAAAEAV0@PEAUIWbemPathKeyList@@@Z
??4?$AutoRelease@UIWbemQualifierSet@@@@QEAAAEAV0@PEAUIWbemQualifierSet@@@Z
??4?$AutoRelease@UIWbemQuery@@@@QEAAAEAV0@PEAUIWbemQuery@@@Z
??4?$AutoRelease@UIWbemServices@@@@QEAAAEAV0@PEAUIWbemServices@@@Z
??4?$AutoRelease@VApplication@Client@WSMan@@@@QEAAAEAV0@PEAVApplication@Client@WSMan@@@Z
??4?$AutoRelease@VCBaseConfigCache@@@@QEAAAEAV0@PEAVCBaseConfigCache@@@Z
??4?$AutoRelease@VCClientConfigSettings@@@@QEAAAEAV0@PEAVCClientConfigSettings@@@Z
??4?$AutoRelease@VCCommonConfigSettings@@@@QEAAAEAV0@PEAVCCommonConfigSettings@@@Z
??4?$AutoRelease@VCConfigCacheMap@CBaseConfigCache@@@@QEAAAEAV0@PEAVCConfigCacheMap@CBaseConfigCache@@@Z
??4?$AutoRelease@VCConfigManager@@@@QEAAAEAV0@PEAVCConfigManager@@@Z
??4?$AutoRelease@VCRemoteOperation@@@@QEAAAEAV0@PEAVCRemoteOperation@@@Z
??4?$AutoRelease@VCRemoteSession@@@@QEAAAEAV0@PEAVCRemoteSession@@@Z
??4?$AutoRelease@VCRequestContext@@@@QEAAAEAV0@PEAVCRequestContext@@@Z
??4?$AutoRelease@VCServiceCommonConfigSettings@@@@QEAAAEAV0@PEAVCServiceCommonConfigSettings@@@Z
??4?$AutoRelease@VCServiceConfigCache@@@@QEAAAEAV0@PEAVCServiceConfigCache@@@Z
??4?$AutoRelease@VCServiceConfigSettings@@@@QEAAAEAV0@PEAVCServiceConfigSettings@@@Z
??4?$AutoRelease@VCWSManEPR@@@@QEAAAEAV0@PEAVCWSManEPR@@@Z
??4?$AutoRelease@VCWSManGroupPolicyManager@@@@QEAAAEAV0@PEAVCWSManGroupPolicyManager@@@Z
??4?$AutoRelease@VCWSManResource@@@@QEAAAEAV0@PEAVCWSManResource@@@Z
??4?$AutoRelease@VCWinRSPluginConfigCache@@@@QEAAAEAV0@PEAVCWinRSPluginConfigCache@@@Z
??4?$AutoRelease@VCWinRSPluginConfigSettings@@@@QEAAAEAV0@PEAVCWinRSPluginConfigSettings@@@Z
??4?$AutoRelease@VEnumSinkEx@@@@QEAAAEAV0@PEAVEnumSinkEx@@@Z
??4?$AutoRelease@VGeneralSinkEx@@@@QEAAAEAV0@PEAVGeneralSinkEx@@@Z
??4?$AutoRelease@VIRequestContext@@@@QEAAAEAV0@PEAVIRequestContext@@@Z
??4?$AutoRelease@VISubscription@@@@QEAAAEAV0@PEAVISubscription@@@Z
??4?$AutoRelease@VInboundRequestDetails@@@@QEAAAEAV0@PEAVInboundRequestDetails@@@Z
??4?$AutoRelease@VUserRecord@@@@QEAAAEAV0@PEAVUserRecord@@@Z
??4?$AutoRelease@VWSManHttpListener@@@@QEAAAEAV0@PEAVWSManHttpListener@@@Z
??4?$AutoReleaseEx@VShell@Client@WSMan@@@@QEAAAEAV0@PEAVShell@Client@WSMan@@@Z
??4?$PacketElement@K@PacketParser@@QEAAAEAV01@$$QEAV01@@Z
??4?$PacketElement@K@PacketParser@@QEAAAEAV01@AEBV01@@Z
??4?$PacketElement@PEAU_FWXML_ELEMENT@@@PacketParser@@QEAAAEAV01@$$QEAV01@@Z
??4?$PacketElement@PEAU_FWXML_ELEMENT@@@PacketParser@@QEAAAEAV01@AEBV01@@Z
??4?$PacketElement@PEBG@PacketParser@@QEAAAEAV01@$$QEAV01@@Z
??4?$PacketElement@PEBG@PacketParser@@QEAAAEAV01@AEBV01@@Z
??4?$PacketElement@_K@PacketParser@@QEAAAEAV01@$$QEAV01@@Z
??4?$PacketElement@_K@PacketParser@@QEAAAEAV01@AEBV01@@Z
??4?$SimpleQueue@T_LARGE_INTEGER@@@@QEAAAEAV0@AEBV0@@Z
??4AutoBstr@@QEAAAEAV0@PEAG@Z
??4AutoBstrNoAlloc@@QEAAAEAV0@PEAG@Z
??4AutoCertContext@@QEAAAEAV0@PEBU_CERT_CONTEXT@@@Z
??4AutoChainContext@@QEAAAEAV0@PEBU_CERT_CHAIN_CONTEXT@@@Z
??4AutoCoTaskMemFree@@QEAAAEAV0@PEAX@Z
??4AutoFwXmlCloseParser@@QEAAAEAV0@PEAX@Z
??4AutoHandle@@QEAAAEAV0@PEAX@Z
??4AutoImpersonateUser@@QEAAAEAV0@PEAX@Z
??4AutoLibrary@@QEAAAEAV0@PEAUHINSTANCE__@@@Z
??4AutoLocalFree@@QEAAAEAV0@PEAX@Z
??4AutoMIClass@@QEAAAEAV0@PEAU_MI_Class@@@Z
??4AutoMIInstance@@QEAAAEAV0@PEAU_MI_Instance@@@Z
??4AutoObject@@QEAAAEAV0@PEAUWSMAN_OBJECT@@@Z
??4AutoRegKey@@QEAAAEAV0@PEAUHKEY__@@@Z
??4AutoSecurityDescriptor@@QEAAAEAV0@PEAX@Z
??4AutoWaitHandle@@QEAAAEAV0@PEAX@Z
??4ChildLifeTimeManager@@QEAAAEAV0@AEBV0@@Z
??4ConfigRegistry@@QEAAAEAV0@AEBV0@@Z
??4EtwCorrelationHelper@@QEAAAEAV0@AEBV0@@Z
??4EventLog@@QEAAAEAV0@$$QEAV0@@Z
??4EventLog@@QEAAAEAV0@AEBV0@@Z
??4ExtendedSemantic@@QEAAAEAV0@$$QEAV0@@Z
??4ExtendedSemantic@@QEAAAEAV0@AEBV0@@Z
??4FastLock@@QEAAAEAV0@$$QEAV0@@Z
??4FastLock@@QEAAAEAV0@AEBV0@@Z
??4Fragment@PacketParser@@QEAAAEAV01@$$QEAV01@@Z
??4Fragment@PacketParser@@QEAAAEAV01@AEBV01@@Z
??4IConfigChangeObserver@@QEAAAEAV0@AEBV0@@Z
??4ILifeTimeMgmt@@QEAAAEAV0@AEBV0@@Z
??4IWSManGroupPolicyObserver@@QEAAAEAV0@AEBV0@@Z
??4IWSManGroupPolicyPublisher@@QEAAAEAV0@AEBV0@@Z
??4Locale@@QEAAAEAV0@AEBV0@@Z
??4NotUnderstandSoapHeader@PacketParser@@QEAAAEAV01@$$QEAV01@@Z
??4NotUnderstandSoapHeader@PacketParser@@QEAAAEAV01@AEBV01@@Z
??4PacketFormatter@@QEAAAEAV0@$$QEAV0@@Z
??4PacketFormatter@@QEAAAEAV0@AEBV0@@Z
??4RBUFFER@@QEAAAEAV0@AEBV0@@Z
??4SBUFFER@@QEAAAEAV0@$$QEAV0@@Z
??4SBUFFER@@QEAAAEAV0@AEBV0@@Z
??4SessionId@PacketParser@@QEAAAEAV01@$$QEAV01@@Z
??4SessionId@PacketParser@@QEAAAEAV01@AEBV01@@Z
??4SoapSemanticConverter@@QEAAAEAV0@AEBV0@@Z
??4UserAuthzRecord@@QEAAAEAV0@$$QEAV0@@Z
??4UserAuthzRecord@@QEAAAEAV0@AEBV0@@Z
??6BufferFormatter@@UEAAAEAV0@AEAVBufferFormatterDataFormatDWORD@@@Z
??6BufferFormatter@@UEAAAEAV0@AEAVBufferFormatterDataFormatULONGLONG@@@Z
??6BufferFormatter@@UEAAAEAV0@AEAVBufferFormatterDataPCWSTR@@@Z
??6BufferFormatter@@UEAAAEAV0@AEAVBufferFormatterDataPUCHAR@@@Z
??6BufferFormatter@@UEAAAEAV0@AEAVBufferFormatterDataXmlEscape@@@Z
??6BufferFormatter@@UEAAAEAV0@K@Z
??6BufferFormatter@@UEAAAEAV0@PEAU_FWXML_ELEMENT@@@Z
??7?$AutoCleanup@V?$AutoDelete@G@@PEAG@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoDelete@V?$SafeSet@PEAVCCertMapping@@@@@@PEAV?$SafeSet@PEAVCCertMapping@@@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoDelete@V?$SafeSet@PEAVCShellUriSettings@@@@@@PEAV?$SafeSet@PEAVCShellUriSettings@@@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoDelete@V?$set@PEAVCListenerSettings@@VCListenerSettingsLessFunctor@CServiceConfigSettings@@V?$transport_allocator@PEAVCListenerSettings@@@@@std@@@@PEAV?$set@PEAVCListenerSettings@@VCListenerSettingsLessFunctor@CServiceConfigSettings@@V?$transport_allocator@PEAVCListenerSettings@@@@@std@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoDelete@VConfigUpdate@@@@PEAVConfigUpdate@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoDelete@VEnumSinkEx@@@@PEAVEnumSinkEx@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoDelete@VGeneralSinkEx@@@@PEAVGeneralSinkEx@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoDelete@VIQueryDASHSMASHInterface@@@@PEAVIQueryDASHSMASHInterface@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoDelete@VISpecification@@@@PEAVISpecification@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoDelete@VRunAsConfiguration@@@@PEAVRunAsConfiguration@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoDelete@VSubscriptionEnumerator@@@@PEAVSubscriptionEnumerator@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoDelete@VTSTRBUFFER@@@@PEAVTSTRBUFFER@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoDelete@VWmiEnumContext@@@@PEAVWmiEnumContext@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoDeleteVector@D@@PEAD@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoDeleteVector@E@@PEAE@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoDeleteVector@PEAG@@PEAPEAG@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoDeleteVector@PEBG@@PEAPEBG@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoDeleteVector@U_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@PEAU_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoDeleteVector@U_WINRS_RUN_COMMAND_ARG@@@@PEAU_WINRS_RUN_COMMAND_ARG@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoDeleteVector@X@@PEAX@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoRelease@UIClientSecurity@@@@PEAUIClientSecurity@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoRelease@UIEnumWbemClassObject@@@@PEAUIEnumWbemClassObject@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoRelease@UIErrorInfo@@@@PEAUIErrorInfo@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoRelease@UIUnknown@@@@PEAUIUnknown@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoRelease@UIWbemClassObject@@@@PEAUIWbemClassObject@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoRelease@UIWbemContext@@@@PEAUIWbemContext@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoRelease@UIWbemLocator@@@@PEAUIWbemLocator@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoRelease@UIWbemObjectTextSrc@@@@PEAUIWbemObjectTextSrc@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoRelease@UIWbemPath@@@@PEAUIWbemPath@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoRelease@UIWbemPathKeyList@@@@PEAUIWbemPathKeyList@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoRelease@UIWbemQualifierSet@@@@PEAUIWbemQualifierSet@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoRelease@UIWbemQuery@@@@PEAUIWbemQuery@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoRelease@UIWbemServices@@@@PEAUIWbemServices@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoRelease@VCClientConfigSettings@@@@PEAVCClientConfigSettings@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoRelease@VCConfigManager@@@@PEAVCConfigManager@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoRelease@VCRemoteSession@@@@PEAVCRemoteSession@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoRelease@VCRequestContext@@@@PEAVCRequestContext@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoRelease@VCWSManEPR@@@@PEAVCWSManEPR@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoRelease@VCWSManResource@@@@PEAVCWSManResource@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoRelease@VCWinRSPluginConfigCache@@@@PEAVCWinRSPluginConfigCache@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoRelease@VEnumSinkEx@@@@PEAVEnumSinkEx@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoRelease@VGeneralSinkEx@@@@PEAVGeneralSinkEx@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoRelease@VIRequestContext@@@@PEAVIRequestContext@@@@QEBA_NXZ
??7?$AutoCleanup@V?$AutoRelease@VInboundRequestDetails@@@@PEAVInboundRequestDetails@@@@QEBA_NXZ
??7?$AutoCleanup@VAutoBstrNoAlloc@@PEAG@@QEBA_NXZ
??7?$AutoCleanup@VAutoCertContext@@PEBU_CERT_CONTEXT@@@@QEBA_NXZ
??7?$AutoCleanup@VAutoHandle@@PEAX@@QEBA_NXZ
??7?$AutoCleanup@VAutoImpersonateUser@@PEAX@@QEBA_NXZ
??7?$AutoCleanup@VAutoMIClass@@PEAU_MI_Class@@@@QEBA_NXZ
??7?$AutoCleanup@VAutoRegKey@@PEAUHKEY__@@@@QEBA_NXZ
??7?$AutoCleanup@VAutoSecurityDescriptor@@PEAX@@QEBA_NXZ
??A?$SafeMap@UPluginKey@@KV?$SafeMap_Iterator@UPluginKey@@K@@@@QEAAPEAKAEBUPluginKey@@@Z
??A?$SafeMap@UUserKey@@PEAVBlockedRecord@@V?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@@@QEAAPEAPEAVBlockedRecord@@AEBUUserKey@@@Z
??A?$SafeMap@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@V?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@@@QEAAPEAVCertThumbprintMappedSet@CServiceConfigSettings@@AEBVCertThumbprintKey@@@Z
??A?$SafeMap@VStringKeyCI@@KV?$SafeMap_Iterator@VStringKeyCI@@K@@@@QEAAPEAKAEBVStringKeyCI@@@Z
??A?$SafeMap@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@V?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@@@QEAAPEAUUSER_CONTEXT_INFO@WSManHttpListener@@AEBVStringKeyCI@@@Z
??A?$SafeMap@VStringKeyStore@@PEAVExpiredOperationIdRecord@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@@@QEAAPEAPEAVExpiredOperationIdRecord@@AEBVStringKeyStore@@@Z
??A?$SafeMap@VStringKeyStore@@PEAVServerFullDuplexChannel@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@@@QEAAPEAPEAVServerFullDuplexChannel@@AEBVStringKeyStore@@@Z
??A?$SafeMap@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@QEAAPEAPEAVOptionValue@SessionOptions@Client@WSMan@@AEBW4WSManSessionOption@@@Z
??A?$SafeMap@_KPEAVSendPacketArgs@RobustConnectionBuffer@@V?$SafeMap_Iterator@_KPEAVSendPacketArgs@RobustConnectionBuffer@@@@@@QEAAPEAPEAVSendPacketArgs@RobustConnectionBuffer@@AEB_K@Z
??A?$SafeSet@PEAX@@QEBAPEBQEAXAEBQEAX@Z
??B?$AutoCleanup@V?$AutoDelete@D@@PEAD@@QEAAPEADXZ
??B?$AutoCleanup@V?$AutoDelete@G@@PEAG@@QEAAPEAGXZ
??B?$AutoCleanup@V?$AutoDelete@G@@PEAG@@QEBAQEAGXZ
??B?$AutoCleanup@V?$AutoDelete@UIPRange@CWSManIPFilter@@@@PEAUIPRange@CWSManIPFilter@@@@QEAAPEAUIPRange@CWSManIPFilter@@XZ
??B?$AutoCleanup@V?$AutoDelete@U_SID@@@@PEAU_SID@@@@QEAAPEAU_SID@@XZ
??B?$AutoCleanup@V?$AutoDelete@U_WSMAN_STREAM_ID_SET@@@@PEAU_WSMAN_STREAM_ID_SET@@@@QEAAPEAU_WSMAN_STREAM_ID_SET@@XZ
??B?$AutoCleanup@V?$AutoDelete@V?$Handle@VISubscription@@@@@@PEAV?$Handle@VISubscription@@@@@@QEAAPEAV?$Handle@VISubscription@@@@XZ
??B?$AutoCleanup@V?$AutoDelete@V?$SafeMap_Iterator@VStringKeyCI@@K@@@@PEAV?$SafeMap_Iterator@VStringKeyCI@@K@@@@QEAAPEAV?$SafeMap_Iterator@VStringKeyCI@@K@@XZ
??B?$AutoCleanup@V?$AutoDelete@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@PEAV?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@QEAAPEAV?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@XZ
??B?$AutoCleanup@V?$AutoDelete@V?$SafeSet@PEAVCCertMapping@@@@@@PEAV?$SafeSet@PEAVCCertMapping@@@@@@QEAAPEAV?$SafeSet@PEAVCCertMapping@@@@XZ
??B?$AutoCleanup@V?$AutoDelete@V?$SafeSet@PEAVCShellUriSettings@@@@@@PEAV?$SafeSet@PEAVCShellUriSettings@@@@@@QEAAPEAV?$SafeSet@PEAVCShellUriSettings@@@@XZ
??B?$AutoCleanup@V?$AutoDelete@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@PEAV?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@QEAAPEAV?$SafeSet_Iterator@PEAVCListenerOperation@@@@XZ
??B?$AutoCleanup@V?$AutoDelete@V?$set@PEAVCListenerSettings@@VCListenerSettingsLessFunctor@CServiceConfigSettings@@V?$transport_allocator@PEAVCListenerSettings@@@@@std@@@@PEAV?$set@PEAVCListenerSettings@@VCListenerSettingsLessFunctor@CServiceConfigSettings@@V?$transport_allocator@PEAVCListenerSettings@@@@@std@@@@QEAAPEAV?$set@PEAVCListenerSettings@@VCListenerSettingsLessFunctor@CServiceConfigSettings@@V?$transport_allocator@PEAVCListenerSettings@@@@@std@@XZ
??B?$AutoCleanup@V?$AutoDelete@V?$set@Usockaddr_storage@@VSockAddrLessFunctor@CListenerSettings@@V?$transport_allocator@Usockaddr_storage@@@@@std@@@@PEAV?$set@Usockaddr_storage@@VSockAddrLessFunctor@CListenerSettings@@V?$transport_allocator@Usockaddr_storage@@@@@std@@@@QEAAPEAV?$set@Usockaddr_storage@@VSockAddrLessFunctor@CListenerSettings@@V?$transport_allocator@Usockaddr_storage@@@@@std@@XZ
??B?$AutoCleanup@V?$AutoDelete@V?$vector@PEAVHandleImpl@Client@WSMan@@V?$transport_allocator@PEAVHandleImpl@Client@WSMan@@@@@std@@@@PEAV?$vector@PEAVHandleImpl@Client@WSMan@@V?$transport_allocator@PEAVHandleImpl@Client@WSMan@@@@@std@@@@QEAAPEAV?$vector@PEAVHandleImpl@Client@WSMan@@V?$transport_allocator@PEAVHandleImpl@Client@WSMan@@@@@std@@XZ
??B?$AutoCleanup@V?$AutoDelete@V?$vector@PEAVHandleImpl@Client@WSMan@@V?$transport_allocator@PEAVHandleImpl@Client@WSMan@@@@@std@@@@PEAV?$vector@PEAVHandleImpl@Client@WSMan@@V?$transport_allocator@PEAVHandleImpl@Client@WSMan@@@@@std@@@@QEBAQEAV?$vector@PEAVHandleImpl@Client@WSMan@@V?$transport_allocator@PEAVHandleImpl@Client@WSMan@@@@@std@@XZ
??B?$AutoCleanup@V?$AutoDelete@V?$vector@PEAVIServiceConfigObserver@@V?$transport_allocator@PEAVIServiceConfigObserver@@@@@std@@@@PEAV?$vector@PEAVIServiceConfigObserver@@V?$transport_allocator@PEAVIServiceConfigObserver@@@@@std@@@@QEAAPEAV?$vector@PEAVIServiceConfigObserver@@V?$transport_allocator@PEAVIServiceConfigObserver@@@@@std@@XZ
??B?$AutoCleanup@V?$AutoDelete@VAdminSid@CSecurity@@@@PEAVAdminSid@CSecurity@@@@QEAAPEAVAdminSid@CSecurity@@XZ
??B?$AutoCleanup@V?$AutoDelete@VBlockedRecord@@@@PEAVBlockedRecord@@@@QEAAPEAVBlockedRecord@@XZ
??B?$AutoCleanup@V?$AutoDelete@VCBaseConfigCache@@@@PEAVCBaseConfigCache@@@@QEAAPEAVCBaseConfigCache@@XZ
??B?$AutoCleanup@V?$AutoDelete@VCCertMapping@@@@PEAVCCertMapping@@@@QEAAPEAVCCertMapping@@XZ
??B?$AutoCleanup@V?$AutoDelete@VCConfigChangeSource@@@@PEAVCConfigChangeSource@@@@QEAAPEAVCConfigChangeSource@@XZ
??B?$AutoCleanup@V?$AutoDelete@VCListenerSettings@@@@PEAVCListenerSettings@@@@QEAAPEAVCListenerSettings@@XZ
??B?$AutoCleanup@V?$AutoDelete@VCObserverConfigChangeErrors@@@@PEAVCObserverConfigChangeErrors@@@@QEAAPEAVCObserverConfigChangeErrors@@XZ
??B?$AutoCleanup@V?$AutoDelete@VCServiceWatcher@CServiceConfigCache@@@@PEAVCServiceWatcher@CServiceConfigCache@@@@QEAAPEAVCServiceWatcher@CServiceConfigCache@@XZ
??B?$AutoCleanup@V?$AutoDelete@VCShellUriSettings@@@@PEAVCShellUriSettings@@@@QEAAPEAVCShellUriSettings@@XZ
??B?$AutoCleanup@V?$AutoDelete@VCWSManEPR@@@@PEAVCWSManEPR@@@@QEAAPEAVCWSManEPR@@XZ
??B?$AutoCleanup@V?$AutoDelete@VCWSManResource@@@@PEAVCWSManResource@@@@QEAAPEAVCWSManResource@@XZ
??B?$AutoCleanup@V?$AutoDelete@VCertHash@@@@PEAVCertHash@@@@QEAAPEAVCertHash@@XZ
??B?$AutoCleanup@V?$AutoDelete@VConfigUpdate@@@@PEAVConfigUpdate@@@@QEAAPEAVConfigUpdate@@XZ
??B?$AutoCleanup@V?$AutoDelete@VEnumSinkEx@@@@PEAVEnumSinkEx@@@@QEAAPEAVEnumSinkEx@@XZ
??B?$AutoCleanup@V?$AutoDelete@VEnumSinkEx@@@@PEAVEnumSinkEx@@@@QEBAQEAVEnumSinkEx@@XZ
??B?$AutoCleanup@V?$AutoDelete@VEventHandler@WSMan@@@@PEAVEventHandler@WSMan@@@@QEAAPEAVEventHandler@WSMan@@XZ
??B?$AutoCleanup@V?$AutoDelete@VExpiredOperationIdRecord@@@@PEAVExpiredOperationIdRecord@@@@QEAAPEAVExpiredOperationIdRecord@@XZ
??B?$AutoCleanup@V?$AutoDelete@VGPApiManager@@@@PEAVGPApiManager@@@@QEAAPEAVGPApiManager@@XZ
??B?$AutoCleanup@V?$AutoDelete@VGeneralSinkEx@@@@PEAVGeneralSinkEx@@@@QEAAPEAVGeneralSinkEx@@XZ
??B?$AutoCleanup@V?$AutoDelete@VGeneralSinkEx@@@@PEAVGeneralSinkEx@@@@QEBAQEAVGeneralSinkEx@@XZ
??B?$AutoCleanup@V?$AutoDelete@VIChannelObserverFactory@@@@PEAVIChannelObserverFactory@@@@QEAAPEAVIChannelObserverFactory@@XZ
??B?$AutoCleanup@V?$AutoDelete@VIQueryDASHSMASHInterface@@@@PEAVIQueryDASHSMASHInterface@@@@QEAAPEAVIQueryDASHSMASHInterface@@XZ
??B?$AutoCleanup@V?$AutoDelete@VIQueryDASHSMASHInterface@@@@PEAVIQueryDASHSMASHInterface@@@@QEBAQEAVIQueryDASHSMASHInterface@@XZ
??B?$AutoCleanup@V?$AutoDelete@VISpecification@@@@PEAVISpecification@@@@QEAAPEAVISpecification@@XZ
??B?$AutoCleanup@V?$AutoDelete@VISpecification@@@@PEAVISpecification@@@@QEBAQEAVISpecification@@XZ
??B?$AutoCleanup@V?$AutoDelete@VInteractiveSid@CSecurity@@@@PEAVInteractiveSid@CSecurity@@@@QEAAPEAVInteractiveSid@CSecurity@@XZ
??B?$AutoCleanup@V?$AutoDelete@VIpHlpApiDllLoader@@@@PEAVIpHlpApiDllLoader@@@@QEAAPEAVIpHlpApiDllLoader@@XZ
??B?$AutoCleanup@V?$AutoDelete@VMachineName@@@@PEAVMachineName@@@@QEAAPEAVMachineName@@XZ
??B?$AutoCleanup@V?$AutoDelete@VNetworkServiceSid@CSecurity@@@@PEAVNetworkServiceSid@CSecurity@@@@QEAAPEAVNetworkServiceSid@CSecurity@@XZ
??B?$AutoCleanup@V?$AutoDelete@VNtDsApiDllLoader@@@@PEAVNtDsApiDllLoader@@@@QEAAPEAVNtDsApiDllLoader@@XZ
??B?$AutoCleanup@V?$AutoDelete@VOptionValue@SessionOptions@Client@WSMan@@@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@QEAAPEAVOptionValue@SessionOptions@Client@WSMan@@XZ
??B?$AutoCleanup@V?$AutoDelete@VPacketCreator@@@@PEAVPacketCreator@@@@QEAAPEAVPacketCreator@@XZ
??B?$AutoCleanup@V?$AutoDelete@VPacketParser@@@@PEAVPacketParser@@@@QEAAPEAVPacketParser@@XZ
??B?$AutoCleanup@V?$AutoDelete@VResources@Locale@@@@PEAVResources@Locale@@@@QEAAPEAVResources@Locale@@XZ
??B?$AutoCleanup@V?$AutoDelete@VSecurityEntry@Catalog@@@@PEAVSecurityEntry@Catalog@@@@QEAAPEAVSecurityEntry@Catalog@@XZ
??B?$AutoCleanup@V?$AutoDelete@VServiceSoapProcessor@@@@PEAVServiceSoapProcessor@@@@QEAAPEAVServiceSoapProcessor@@XZ
??B?$AutoCleanup@V?$AutoDelete@VShell32DllLoader@@@@PEAVShell32DllLoader@@@@QEAAPEAVShell32DllLoader@@XZ
??B?$AutoCleanup@V?$AutoDelete@VShlWApiDllLoader@@@@PEAVShlWApiDllLoader@@@@QEAAPEAVShlWApiDllLoader@@XZ
??B?$AutoCleanup@V?$AutoDelete@VSubscriptionManager@@@@PEAVSubscriptionManager@@@@QEAAPEAVSubscriptionManager@@XZ
??B?$AutoCleanup@V?$AutoDelete@VTSTRBUFFER@@@@PEAVTSTRBUFFER@@@@QEAAPEAVTSTRBUFFER@@XZ
??B?$AutoCleanup@V?$AutoDelete@VTSTRBUFFER@@@@PEAVTSTRBUFFER@@@@QEBAQEAVTSTRBUFFER@@XZ
??B?$AutoCleanup@V?$AutoDelete@VUniqueStringOverflow@@@@PEAVUniqueStringOverflow@@@@QEAAPEAVUniqueStringOverflow@@XZ
??B?$AutoCleanup@V?$AutoDelete@VUser32DllLoader@@@@PEAVUser32DllLoader@@@@QEAAPEAVUser32DllLoader@@XZ
??B?$AutoCleanup@V?$AutoDelete@VWSMANCONFIGTABLE_IDENTITY@@@@PEAVWSMANCONFIGTABLE_IDENTITY@@@@QEAAPEAVWSMANCONFIGTABLE_IDENTITY@@XZ
??B?$AutoCleanup@V?$AutoDelete@VWSManMemCryptManager@@@@PEAVWSManMemCryptManager@@@@QEAAPEAVWSManMemCryptManager@@XZ
??B?$AutoCleanup@V?$AutoDelete@VWmiEnumContext@@@@PEAVWmiEnumContext@@@@QEAAPEAVWmiEnumContext@@XZ
??B?$AutoCleanup@V?$AutoDelete@VWmiEnumContext@@@@PEAVWmiEnumContext@@@@QEBAQEAVWmiEnumContext@@XZ
??B?$AutoCleanup@V?$AutoDelete@VXmlReader@@@@PEAVXmlReader@@@@QEAAPEAVXmlReader@@XZ
??B?$AutoCleanup@V?$AutoDeleteVector@$$CBG@@PEBG@@QEAAPEBGXZ
??B?$AutoCleanup@V?$AutoDeleteVector@D@@PEAD@@QEAAPEADXZ
??B?$AutoCleanup@V?$AutoDeleteVector@E@@PEAE@@QEAAPEAEXZ
??B?$AutoCleanup@V?$AutoDeleteVector@E@@PEAE@@QEBAQEAEXZ
??B?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@QEAAPEAGXZ
??B?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@QEBAQEAGXZ
??B?$AutoCleanup@V?$AutoDeleteVector@H@@PEAH@@QEAAPEAHXZ
??B?$AutoCleanup@V?$AutoDeleteVector@PEAG@@PEAPEAG@@QEAAPEAPEAGXZ
??B?$AutoCleanup@V?$AutoDeleteVector@PEAG@@PEAPEAG@@QEBAQEAPEAGXZ
??B?$AutoCleanup@V?$AutoDeleteVector@PEBG@@PEAPEBG@@QEAAPEAPEBGXZ
??B?$AutoCleanup@V?$AutoDeleteVector@PEBG@@PEAPEBG@@QEBAQEAPEBGXZ
??B?$AutoCleanup@V?$AutoDeleteVector@U_CONFIG_UPDATE@@@@PEAU_CONFIG_UPDATE@@@@QEAAPEAU_CONFIG_UPDATE@@XZ
??B?$AutoCleanup@V?$AutoDeleteVector@U_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@PEAU_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@QEAAPEAU_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@XZ
??B?$AutoCleanup@V?$AutoDeleteVector@U_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@PEAU_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@QEBAQEAU_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@XZ
??B?$AutoCleanup@V?$AutoDeleteVector@U_WINRS_RUN_COMMAND_ARG@@@@PEAU_WINRS_RUN_COMMAND_ARG@@@@QEAAPEAU_WINRS_RUN_COMMAND_ARG@@XZ
??B?$AutoCleanup@V?$AutoDeleteVector@U_WINRS_RUN_COMMAND_ARG@@@@PEAU_WINRS_RUN_COMMAND_ARG@@@@QEBAQEAU_WINRS_RUN_COMMAND_ARG@@XZ
??B?$AutoCleanup@V?$AutoDeleteVector@U_WSMAN_OPTION@@@@PEAU_WSMAN_OPTION@@@@QEAAPEAU_WSMAN_OPTION@@XZ
??B?$AutoCleanup@V?$AutoDeleteVector@X@@PEAX@@QEAAPEAXXZ
??B?$AutoCleanup@V?$AutoFree@E@@PEAE@@QEAAPEAEXZ
??B?$AutoCleanup@V?$AutoFree@E@@PEAE@@QEBAQEAEXZ
??B?$AutoCleanup@V?$AutoLocklessItemRecycle@VPacket@@@@PEAVPacket@@@@QEAAPEAVPacket@@XZ
??B?$AutoCleanup@V?$AutoRelease@UIAppHostChildElementCollection@@@@PEAUIAppHostChildElementCollection@@@@QEAAPEAUIAppHostChildElementCollection@@XZ
??B?$AutoCleanup@V?$AutoRelease@UIAppHostElement@@@@PEAUIAppHostElement@@@@QEAAPEAUIAppHostElement@@XZ
??B?$AutoCleanup@V?$AutoRelease@UIAppHostElementCollection@@@@PEAUIAppHostElementCollection@@@@QEAAPEAUIAppHostElementCollection@@XZ
??B?$AutoCleanup@V?$AutoRelease@UIClientSecurity@@@@PEAUIClientSecurity@@@@QEAAPEAUIClientSecurity@@XZ
??B?$AutoCleanup@V?$AutoRelease@UIClientSecurity@@@@PEAUIClientSecurity@@@@QEBAQEAUIClientSecurity@@XZ
??B?$AutoCleanup@V?$AutoRelease@UIEnumWbemClassObject@@@@PEAUIEnumWbemClassObject@@@@QEAAPEAUIEnumWbemClassObject@@XZ
??B?$AutoCleanup@V?$AutoRelease@UIEnumWbemClassObject@@@@PEAUIEnumWbemClassObject@@@@QEBAQEAUIEnumWbemClassObject@@XZ
??B?$AutoCleanup@V?$AutoRelease@UIErrorInfo@@@@PEAUIErrorInfo@@@@QEAAPEAUIErrorInfo@@XZ
??B?$AutoCleanup@V?$AutoRelease@UIErrorInfo@@@@PEAUIErrorInfo@@@@QEBAQEAUIErrorInfo@@XZ
??B?$AutoCleanup@V?$AutoRelease@UIUnknown@@@@PEAUIUnknown@@@@QEAAPEAUIUnknown@@XZ
??B?$AutoCleanup@V?$AutoRelease@UIUnknown@@@@PEAUIUnknown@@@@QEBAQEAUIUnknown@@XZ
??B?$AutoCleanup@V?$AutoRelease@UIWbemClassObject@@@@PEAUIWbemClassObject@@@@QEAAPEAUIWbemClassObject@@XZ
??B?$AutoCleanup@V?$AutoRelease@UIWbemClassObject@@@@PEAUIWbemClassObject@@@@QEBAQEAUIWbemClassObject@@XZ
??B?$AutoCleanup@V?$AutoRelease@UIWbemContext@@@@PEAUIWbemContext@@@@QEAAPEAUIWbemContext@@XZ
??B?$AutoCleanup@V?$AutoRelease@UIWbemContext@@@@PEAUIWbemContext@@@@QEBAQEAUIWbemContext@@XZ
??B?$AutoCleanup@V?$AutoRelease@UIWbemLocator@@@@PEAUIWbemLocator@@@@QEAAPEAUIWbemLocator@@XZ
??B?$AutoCleanup@V?$AutoRelease@UIWbemLocator@@@@PEAUIWbemLocator@@@@QEBAQEAUIWbemLocator@@XZ
??B?$AutoCleanup@V?$AutoRelease@UIWbemObjectTextSrc@@@@PEAUIWbemObjectTextSrc@@@@QEAAPEAUIWbemObjectTextSrc@@XZ
??B?$AutoCleanup@V?$AutoRelease@UIWbemObjectTextSrc@@@@PEAUIWbemObjectTextSrc@@@@QEBAQEAUIWbemObjectTextSrc@@XZ
??B?$AutoCleanup@V?$AutoRelease@UIWbemPath@@@@PEAUIWbemPath@@@@QEAAPEAUIWbemPath@@XZ
??B?$AutoCleanup@V?$AutoRelease@UIWbemPath@@@@PEAUIWbemPath@@@@QEBAQEAUIWbemPath@@XZ
??B?$AutoCleanup@V?$AutoRelease@UIWbemPathKeyList@@@@PEAUIWbemPathKeyList@@@@QEAAPEAUIWbemPathKeyList@@XZ
??B?$AutoCleanup@V?$AutoRelease@UIWbemPathKeyList@@@@PEAUIWbemPathKeyList@@@@QEBAQEAUIWbemPathKeyList@@XZ
??B?$AutoCleanup@V?$AutoRelease@UIWbemQualifierSet@@@@PEAUIWbemQualifierSet@@@@QEAAPEAUIWbemQualifierSet@@XZ
??B?$AutoCleanup@V?$AutoRelease@UIWbemQualifierSet@@@@PEAUIWbemQualifierSet@@@@QEBAQEAUIWbemQualifierSet@@XZ
??B?$AutoCleanup@V?$AutoRelease@UIWbemQuery@@@@PEAUIWbemQuery@@@@QEAAPEAUIWbemQuery@@XZ
??B?$AutoCleanup@V?$AutoRelease@UIWbemQuery@@@@PEAUIWbemQuery@@@@QEBAQEAUIWbemQuery@@XZ
??B?$AutoCleanup@V?$AutoRelease@UIWbemServices@@@@PEAUIWbemServices@@@@QEAAPEAUIWbemServices@@XZ
??B?$AutoCleanup@V?$AutoRelease@UIWbemServices@@@@PEAUIWbemServices@@@@QEBAQEAUIWbemServices@@XZ
??B?$AutoCleanup@V?$AutoRelease@VCBaseConfigCache@@@@PEAVCBaseConfigCache@@@@QEAAPEAVCBaseConfigCache@@XZ
??B?$AutoCleanup@V?$AutoRelease@VCClientConfigSettings@@@@PEAVCClientConfigSettings@@@@QEAAPEAVCClientConfigSettings@@XZ
??B?$AutoCleanup@V?$AutoRelease@VCCommonConfigSettings@@@@PEAVCCommonConfigSettings@@@@QEAAPEAVCCommonConfigSettings@@XZ
??B?$AutoCleanup@V?$AutoRelease@VCConfigCacheMap@CBaseConfigCache@@@@PEAVCConfigCacheMap@CBaseConfigCache@@@@QEAAPEAVCConfigCacheMap@CBaseConfigCache@@XZ
??B?$AutoCleanup@V?$AutoRelease@VCConfigManager@@@@PEAVCConfigManager@@@@QEAAPEAVCConfigManager@@XZ
??B?$AutoCleanup@V?$AutoRelease@VCRemoteSession@@@@PEAVCRemoteSession@@@@QEAAPEAVCRemoteSession@@XZ
??B?$AutoCleanup@V?$AutoRelease@VCRequestContext@@@@PEAVCRequestContext@@@@QEAAPEAVCRequestContext@@XZ
??B?$AutoCleanup@V?$AutoRelease@VCServiceCommonConfigSettings@@@@PEAVCServiceCommonConfigSettings@@@@QEAAPEAVCServiceCommonConfigSettings@@XZ
??B?$AutoCleanup@V?$AutoRelease@VCServiceConfigCache@@@@PEAVCServiceConfigCache@@@@QEAAPEAVCServiceConfigCache@@XZ
??B?$AutoCleanup@V?$AutoRelease@VCServiceConfigSettings@@@@PEAVCServiceConfigSettings@@@@QEAAPEAVCServiceConfigSettings@@XZ
??B?$AutoCleanup@V?$AutoRelease@VCWSManEPR@@@@PEAVCWSManEPR@@@@QEAAPEAVCWSManEPR@@XZ
??B?$AutoCleanup@V?$AutoRelease@VCWSManEPR@@@@PEAVCWSManEPR@@@@QEBAQEAVCWSManEPR@@XZ
??B?$AutoCleanup@V?$AutoRelease@VCWSManGroupPolicyCache@@@@PEAVCWSManGroupPolicyCache@@@@QEAAPEAVCWSManGroupPolicyCache@@XZ
??B?$AutoCleanup@V?$AutoRelease@VCWSManGroupPolicyManager@@@@PEAVCWSManGroupPolicyManager@@@@QEAAPEAVCWSManGroupPolicyManager@@XZ
??B?$AutoCleanup@V?$AutoRelease@VCWSManObject@@@@PEAVCWSManObject@@@@QEAAPEAVCWSManObject@@XZ
??B?$AutoCleanup@V?$AutoRelease@VCWSManResource@@@@PEAVCWSManResource@@@@QEAAPEAVCWSManResource@@XZ
??B?$AutoCleanup@V?$AutoRelease@VCWSManResource@@@@PEAVCWSManResource@@@@QEBAQEAVCWSManResource@@XZ
??B?$AutoCleanup@V?$AutoRelease@VCWinRSPluginConfigCache@@@@PEAVCWinRSPluginConfigCache@@@@QEAAPEAVCWinRSPluginConfigCache@@XZ
??B?$AutoCleanup@V?$AutoRelease@VCWinRSPluginConfigCache@@@@PEAVCWinRSPluginConfigCache@@@@QEBAQEAVCWinRSPluginConfigCache@@XZ
??B?$AutoCleanup@V?$AutoRelease@VCWinRSPluginConfigSettings@@@@PEAVCWinRSPluginConfigSettings@@@@QEAAPEAVCWinRSPluginConfigSettings@@XZ
??B?$AutoCleanup@V?$AutoRelease@VCommand@Client@WSMan@@@@PEAVCommand@Client@WSMan@@@@QEAAPEAVCommand@Client@WSMan@@XZ
??B?$AutoCleanup@V?$AutoRelease@VConfigNotification@@@@PEAVConfigNotification@@@@QEAAPEAVConfigNotification@@XZ
??B?$AutoCleanup@V?$AutoRelease@VConnectShellOperation@Client@WSMan@@@@PEAVConnectShellOperation@Client@WSMan@@@@QEAAPEAVConnectShellOperation@Client@WSMan@@XZ
??B?$AutoCleanup@V?$AutoRelease@VCreateShellOperation@Client@WSMan@@@@PEAVCreateShellOperation@Client@WSMan@@@@QEAAPEAVCreateShellOperation@Client@WSMan@@XZ
??B?$AutoCleanup@V?$AutoRelease@VDeleteShellOperation@Client@WSMan@@@@PEAVDeleteShellOperation@Client@WSMan@@@@QEAAPEAVDeleteShellOperation@Client@WSMan@@XZ
??B?$AutoCleanup@V?$AutoRelease@VDisconnectOperation@Client@WSMan@@@@PEAVDisconnectOperation@Client@WSMan@@@@QEAAPEAVDisconnectOperation@Client@WSMan@@XZ
??B?$AutoCleanup@V?$AutoRelease@VEnumSinkEx@@@@PEAVEnumSinkEx@@@@QEAAPEAVEnumSinkEx@@XZ
??B?$AutoCleanup@V?$AutoRelease@VEnumSinkEx@@@@PEAVEnumSinkEx@@@@QEBAQEAVEnumSinkEx@@XZ
??B?$AutoCleanup@V?$AutoRelease@VGeneralSinkEx@@@@PEAVGeneralSinkEx@@@@QEAAPEAVGeneralSinkEx@@XZ
??B?$AutoCleanup@V?$AutoRelease@VGeneralSinkEx@@@@PEAVGeneralSinkEx@@@@QEBAQEAVGeneralSinkEx@@XZ
??B?$AutoCleanup@V?$AutoRelease@VIISConfigSettings@@@@PEAVIISConfigSettings@@@@QEAAPEAVIISConfigSettings@@XZ
??B?$AutoCleanup@V?$AutoRelease@VIPCSoapProcessor@@@@PEAVIPCSoapProcessor@@@@QEAAPEAVIPCSoapProcessor@@XZ
??B?$AutoCleanup@V?$AutoRelease@VIRequestContext@@@@PEAVIRequestContext@@@@QEAAPEAVIRequestContext@@XZ
??B?$AutoCleanup@V?$AutoRelease@VIRequestContext@@@@PEAVIRequestContext@@@@QEBAQEAVIRequestContext@@XZ
??B?$AutoCleanup@V?$AutoRelease@VISubscription@@@@PEAVISubscription@@@@QEAAPEAVISubscription@@XZ
??B?$AutoCleanup@V?$AutoRelease@VInboundRequestDetails@@@@PEAVInboundRequestDetails@@@@QEAAPEAVInboundRequestDetails@@XZ
??B?$AutoCleanup@V?$AutoRelease@VInboundRequestDetails@@@@PEAVInboundRequestDetails@@@@QEBAQEAVInboundRequestDetails@@XZ
??B?$AutoCleanup@V?$AutoRelease@VReceiveOperation@Client@WSMan@@@@PEAVReceiveOperation@Client@WSMan@@@@QEAAPEAVReceiveOperation@Client@WSMan@@XZ
??B?$AutoCleanup@V?$AutoRelease@VReconnectOperation@Client@WSMan@@@@PEAVReconnectOperation@Client@WSMan@@@@QEAAPEAVReconnectOperation@Client@WSMan@@XZ
??B?$AutoCleanup@V?$AutoRelease@VSendOperation@Client@WSMan@@@@PEAVSendOperation@Client@WSMan@@@@QEAAPEAVSendOperation@Client@WSMan@@XZ
??B?$AutoCleanup@V?$AutoRelease@VShell@Client@WSMan@@@@PEAVShell@Client@WSMan@@@@QEAAPEAVShell@Client@WSMan@@XZ
??B?$AutoCleanup@V?$AutoRelease@VShell@Client@WSMan@@@@PEAVShell@Client@WSMan@@@@QEBAQEAVShell@Client@WSMan@@XZ
??B?$AutoCleanup@V?$AutoRelease@VSignalOperation@Client@WSMan@@@@PEAVSignalOperation@Client@WSMan@@@@QEAAPEAVSignalOperation@Client@WSMan@@XZ
??B?$AutoCleanup@V?$AutoRelease@VUserRecord@@@@PEAVUserRecord@@@@QEAAPEAVUserRecord@@XZ
??B?$AutoCleanup@V?$AutoRelease@VUserRecord@@@@PEAVUserRecord@@@@QEBAQEAVUserRecord@@XZ
??B?$AutoCleanup@VAutoBstr@@PEAG@@QEAAPEAGXZ
??B?$AutoCleanup@VAutoBstrNoAlloc@@PEAG@@QEAAPEAGXZ
??B?$AutoCleanup@VAutoBstrNoAlloc@@PEAG@@QEBAQEAGXZ
??B?$AutoCleanup@VAutoCertContext@@PEBU_CERT_CONTEXT@@@@QEAAPEBU_CERT_CONTEXT@@XZ
??B?$AutoCleanup@VAutoHandle@@PEAX@@QEAAPEAXXZ
??B?$AutoCleanup@VAutoHandle@@PEAX@@QEBAQEAXXZ
??B?$AutoCleanup@VAutoImpersonateUser@@PEAX@@QEAAPEAXXZ
??B?$AutoCleanup@VAutoImpersonateUser@@PEAX@@QEBAQEAXXZ
??B?$AutoCleanup@VAutoLibrary@@PEAUHINSTANCE__@@@@QEAAPEAUHINSTANCE__@@XZ
??B?$AutoCleanup@VAutoLocalFree@@PEAX@@QEAAPEAXXZ
??B?$AutoCleanup@VAutoMIClass@@PEAU_MI_Class@@@@QEAAPEAU_MI_Class@@XZ
??B?$AutoCleanup@VAutoMIInstance@@PEAU_MI_Instance@@@@QEAAPEAU_MI_Instance@@XZ
??B?$AutoCleanup@VAutoRegKey@@PEAUHKEY__@@@@QEAAPEAUHKEY__@@XZ
??B?$AutoCleanup@VAutoSecurityDescriptor@@PEAX@@QEAAPEAXXZ
??B?$SafeMap_Iterator@PEAVCCertMapping@@UEmpty@@@@QEBA_NXZ
??B?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@QEBA_NXZ
??B?$SafeMap_Iterator@PEAVCShellUriSettings@@UEmpty@@@@QEBA_NXZ
??B?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@QEBA_NXZ
??B?$SafeMap_Iterator@VKey@Locale@@K@@QEBA_NXZ
??B?$SafeMap_Iterator@VStringKeyCI@@K@@QEBA_NXZ
??B?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@QEBA_NXZ
??B?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@QEBA_NXZ
??B?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@QEBA_NXZ
??C?$AutoCleanup@V?$AutoDelete@U_WSMAN_STREAM_ID_SET@@@@PEAU_WSMAN_STREAM_ID_SET@@@@QEAAPEAU_WSMAN_STREAM_ID_SET@@XZ
??C?$AutoCleanup@V?$AutoDelete@V?$Handle@VISubscription@@@@@@PEAV?$Handle@VISubscription@@@@@@QEAAPEAV?$Handle@VISubscription@@@@XZ
??C?$AutoCleanup@V?$AutoDelete@V?$SafeMap_Iterator@VStringKeyCI@@K@@@@PEAV?$SafeMap_Iterator@VStringKeyCI@@K@@@@QEAAPEAV?$SafeMap_Iterator@VStringKeyCI@@K@@XZ
??C?$AutoCleanup@V?$AutoDelete@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@PEAV?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@QEAAPEAV?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@XZ
??C?$AutoCleanup@V?$AutoDelete@V?$SafeSet@PEAVCCertMapping@@@@@@PEAV?$SafeSet@PEAVCCertMapping@@@@@@QEAAPEAV?$SafeSet@PEAVCCertMapping@@@@XZ
??C?$AutoCleanup@V?$AutoDelete@V?$SafeSet@PEAVCShellUriSettings@@@@@@PEAV?$SafeSet@PEAVCShellUriSettings@@@@@@QEAAPEAV?$SafeSet@PEAVCShellUriSettings@@@@XZ
??C?$AutoCleanup@V?$AutoDelete@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@PEAV?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@QEAAPEAV?$SafeSet_Iterator@PEAVCListenerOperation@@@@XZ
??C?$AutoCleanup@V?$AutoDelete@V?$set@PEAVCListenerSettings@@VCListenerSettingsLessFunctor@CServiceConfigSettings@@V?$transport_allocator@PEAVCListenerSettings@@@@@std@@@@PEAV?$set@PEAVCListenerSettings@@VCListenerSettingsLessFunctor@CServiceConfigSettings@@V?$transport_allocator@PEAVCListenerSettings@@@@@std@@@@QEAAPEAV?$set@PEAVCListenerSettings@@VCListenerSettingsLessFunctor@CServiceConfigSettings@@V?$transport_allocator@PEAVCListenerSettings@@@@@std@@XZ
??C?$AutoCleanup@V?$AutoDelete@V?$set@Usockaddr_storage@@VSockAddrLessFunctor@CListenerSettings@@V?$transport_allocator@Usockaddr_storage@@@@@std@@@@PEAV?$set@Usockaddr_storage@@VSockAddrLessFunctor@CListenerSettings@@V?$transport_allocator@Usockaddr_storage@@@@@std@@@@QEAAPEAV?$set@Usockaddr_storage@@VSockAddrLessFunctor@CListenerSettings@@V?$transport_allocator@Usockaddr_storage@@@@@std@@XZ
??C?$AutoCleanup@V?$AutoDelete@V?$vector@PEAVHandleImpl@Client@WSMan@@V?$transport_allocator@PEAVHandleImpl@Client@WSMan@@@@@std@@@@PEAV?$vector@PEAVHandleImpl@Client@WSMan@@V?$transport_allocator@PEAVHandleImpl@Client@WSMan@@@@@std@@@@QEAAPEAV?$vector@PEAVHandleImpl@Client@WSMan@@V?$transport_allocator@PEAVHandleImpl@Client@WSMan@@@@@std@@XZ
??C?$AutoCleanup@V?$AutoDelete@V?$vector@PEAVIServiceConfigObserver@@V?$transport_allocator@PEAVIServiceConfigObserver@@@@@std@@@@PEAV?$vector@PEAVIServiceConfigObserver@@V?$transport_allocator@PEAVIServiceConfigObserver@@@@@std@@@@QEAAPEAV?$vector@PEAVIServiceConfigObserver@@V?$transport_allocator@PEAVIServiceConfigObserver@@@@@std@@XZ
??C?$AutoCleanup@V?$AutoDelete@VBlockedRecord@@@@PEAVBlockedRecord@@@@QEAAPEAVBlockedRecord@@XZ
??C?$AutoCleanup@V?$AutoDelete@VCBaseConfigCache@@@@PEAVCBaseConfigCache@@@@QEAAPEAVCBaseConfigCache@@XZ
??C?$AutoCleanup@V?$AutoDelete@VCCertMapping@@@@PEAVCCertMapping@@@@QEAAPEAVCCertMapping@@XZ
??C?$AutoCleanup@V?$AutoDelete@VCConfigChangeSource@@@@PEAVCConfigChangeSource@@@@QEAAPEAVCConfigChangeSource@@XZ
??C?$AutoCleanup@V?$AutoDelete@VCListenerSettings@@@@PEAVCListenerSettings@@@@QEAAPEAVCListenerSettings@@XZ
??C?$AutoCleanup@V?$AutoDelete@VCServiceWatcher@CServiceConfigCache@@@@PEAVCServiceWatcher@CServiceConfigCache@@@@QEAAPEAVCServiceWatcher@CServiceConfigCache@@XZ
??C?$AutoCleanup@V?$AutoDelete@VCShellUriSettings@@@@PEAVCShellUriSettings@@@@QEAAPEAVCShellUriSettings@@XZ
??C?$AutoCleanup@V?$AutoDelete@VCWSManEPR@@@@PEAVCWSManEPR@@@@QEAAPEAVCWSManEPR@@XZ
??C?$AutoCleanup@V?$AutoDelete@VCWSManResource@@@@PEAVCWSManResource@@@@QEAAPEAVCWSManResource@@XZ
??C?$AutoCleanup@V?$AutoDelete@VCertHash@@@@PEAVCertHash@@@@QEAAPEAVCertHash@@XZ
??C?$AutoCleanup@V?$AutoDelete@VConfigUpdate@@@@PEAVConfigUpdate@@@@QEAAPEAVConfigUpdate@@XZ
??C?$AutoCleanup@V?$AutoDelete@VEnumSinkEx@@@@PEAVEnumSinkEx@@@@QEAAPEAVEnumSinkEx@@XZ
??C?$AutoCleanup@V?$AutoDelete@VEnumSinkEx@@@@PEAVEnumSinkEx@@@@QEBAQEAVEnumSinkEx@@XZ
??C?$AutoCleanup@V?$AutoDelete@VExpiredOperationIdRecord@@@@PEAVExpiredOperationIdRecord@@@@QEAAPEAVExpiredOperationIdRecord@@XZ
??C?$AutoCleanup@V?$AutoDelete@VGPApiManager@@@@PEAVGPApiManager@@@@QEAAPEAVGPApiManager@@XZ
??C?$AutoCleanup@V?$AutoDelete@VGeneralSinkEx@@@@PEAVGeneralSinkEx@@@@QEAAPEAVGeneralSinkEx@@XZ
??C?$AutoCleanup@V?$AutoDelete@VGeneralSinkEx@@@@PEAVGeneralSinkEx@@@@QEBAQEAVGeneralSinkEx@@XZ
??C?$AutoCleanup@V?$AutoDelete@VIChannelObserverFactory@@@@PEAVIChannelObserverFactory@@@@QEAAPEAVIChannelObserverFactory@@XZ
??C?$AutoCleanup@V?$AutoDelete@VIQueryDASHSMASHInterface@@@@PEAVIQueryDASHSMASHInterface@@@@QEAAPEAVIQueryDASHSMASHInterface@@XZ
??C?$AutoCleanup@V?$AutoDelete@VIQueryDASHSMASHInterface@@@@PEAVIQueryDASHSMASHInterface@@@@QEBAQEAVIQueryDASHSMASHInterface@@XZ
??C?$AutoCleanup@V?$AutoDelete@VISpecification@@@@PEAVISpecification@@@@QEAAPEAVISpecification@@XZ
??C?$AutoCleanup@V?$AutoDelete@VISpecification@@@@PEAVISpecification@@@@QEBAQEAVISpecification@@XZ
??C?$AutoCleanup@V?$AutoDelete@VMasterReceiveData@CListenerReceive@@@@PEAVMasterReceiveData@CListenerReceive@@@@QEAAPEAVMasterReceiveData@CListenerReceive@@XZ
??C?$AutoCleanup@V?$AutoDelete@VOptionValue@SessionOptions@Client@WSMan@@@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@QEAAPEAVOptionValue@SessionOptions@Client@WSMan@@XZ
??C?$AutoCleanup@V?$AutoDelete@VPacketCreator@@@@PEAVPacketCreator@@@@QEAAPEAVPacketCreator@@XZ
??C?$AutoCleanup@V?$AutoDelete@VPacketParser@@@@PEAVPacketParser@@@@QEAAPEAVPacketParser@@XZ
??C?$AutoCleanup@V?$AutoDelete@VRunAsConfiguration@@@@PEAVRunAsConfiguration@@@@QEAAPEAVRunAsConfiguration@@XZ
??C?$AutoCleanup@V?$AutoDelete@VSecurityEntry@Catalog@@@@PEAVSecurityEntry@Catalog@@@@QEAAPEAVSecurityEntry@Catalog@@XZ
??C?$AutoCleanup@V?$AutoDelete@VSendPacketArgs@RobustConnectionBuffer@@@@PEAVSendPacketArgs@RobustConnectionBuffer@@@@QEAAPEAVSendPacketArgs@RobustConnectionBuffer@@XZ
??C?$AutoCleanup@V?$AutoDelete@VServiceSoapProcessor@@@@PEAVServiceSoapProcessor@@@@QEAAPEAVServiceSoapProcessor@@XZ
??C?$AutoCleanup@V?$AutoDelete@VSubscriptionEnumerator@@@@PEAVSubscriptionEnumerator@@@@QEAAPEAVSubscriptionEnumerator@@XZ
??C?$AutoCleanup@V?$AutoDelete@VTSTRBUFFER@@@@PEAVTSTRBUFFER@@@@QEAAPEAVTSTRBUFFER@@XZ
??C?$AutoCleanup@V?$AutoDelete@VTSTRBUFFER@@@@PEAVTSTRBUFFER@@@@QEBAQEAVTSTRBUFFER@@XZ
??C?$AutoCleanup@V?$AutoDelete@VUniqueStringOverflow@@@@PEAVUniqueStringOverflow@@@@QEAAPEAVUniqueStringOverflow@@XZ
??C?$AutoCleanup@V?$AutoDelete@VWSMANCONFIGTABLE_IDENTITY@@@@PEAVWSMANCONFIGTABLE_IDENTITY@@@@QEAAPEAVWSMANCONFIGTABLE_IDENTITY@@XZ
??C?$AutoCleanup@V?$AutoDelete@VWmiEnumContext@@@@PEAVWmiEnumContext@@@@QEAAPEAVWmiEnumContext@@XZ
??C?$AutoCleanup@V?$AutoDelete@VWmiEnumContext@@@@PEAVWmiEnumContext@@@@QEBAQEAVWmiEnumContext@@XZ
??C?$AutoCleanup@V?$AutoDelete@VXmlReader@@@@PEAVXmlReader@@@@QEAAPEAVXmlReader@@XZ
??C?$AutoCleanup@V?$AutoDeleteVector@E@@PEAE@@QEAAPEAEXZ
??C?$AutoCleanup@V?$AutoDeleteVector@E@@PEAE@@QEBAQEAEXZ
??C?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@QEAAPEAGXZ
??C?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@QEBAQEAGXZ
??C?$AutoCleanup@V?$AutoDeleteVector@PEAG@@PEAPEAG@@QEAAPEAPEAGXZ
??C?$AutoCleanup@V?$AutoDeleteVector@PEAG@@PEAPEAG@@QEBAQEAPEAGXZ
??C?$AutoCleanup@V?$AutoDeleteVector@PEBG@@PEAPEBG@@QEAAPEAPEBGXZ
??C?$AutoCleanup@V?$AutoDeleteVector@PEBG@@PEAPEBG@@QEBAQEAPEBGXZ
??C?$AutoCleanup@V?$AutoDeleteVector@U_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@PEAU_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@QEAAPEAU_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@XZ
??C?$AutoCleanup@V?$AutoDeleteVector@U_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@PEAU_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@QEBAQEAU_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@XZ
??C?$AutoCleanup@V?$AutoDeleteVector@U_WINRS_RUN_COMMAND_ARG@@@@PEAU_WINRS_RUN_COMMAND_ARG@@@@QEAAPEAU_WINRS_RUN_COMMAND_ARG@@XZ
??C?$AutoCleanup@V?$AutoDeleteVector@U_WINRS_RUN_COMMAND_ARG@@@@PEAU_WINRS_RUN_COMMAND_ARG@@@@QEBAQEAU_WINRS_RUN_COMMAND_ARG@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIAppHostAdminManager@@@@PEAUIAppHostAdminManager@@@@QEAAPEAUIAppHostAdminManager@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIAppHostChildElementCollection@@@@PEAUIAppHostChildElementCollection@@@@QEAAPEAUIAppHostChildElementCollection@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIAppHostConfigException@@@@PEAUIAppHostConfigException@@@@QEAAPEAUIAppHostConfigException@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIAppHostElementCollection@@@@PEAUIAppHostElementCollection@@@@QEAAPEAUIAppHostElementCollection@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIAppHostProperty@@@@PEAUIAppHostProperty@@@@QEAAPEAUIAppHostProperty@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIAppHostPropertyCollection@@@@PEAUIAppHostPropertyCollection@@@@QEAAPEAUIAppHostPropertyCollection@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIClientSecurity@@@@PEAUIClientSecurity@@@@QEAAPEAUIClientSecurity@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIClientSecurity@@@@PEAUIClientSecurity@@@@QEBAQEAUIClientSecurity@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIEnumWbemClassObject@@@@PEAUIEnumWbemClassObject@@@@QEAAPEAUIEnumWbemClassObject@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIEnumWbemClassObject@@@@PEAUIEnumWbemClassObject@@@@QEBAQEAUIEnumWbemClassObject@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIErrorInfo@@@@PEAUIErrorInfo@@@@QEAAPEAUIErrorInfo@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIErrorInfo@@@@PEAUIErrorInfo@@@@QEBAQEAUIErrorInfo@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIUnknown@@@@PEAUIUnknown@@@@QEAAPEAUIUnknown@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIUnknown@@@@PEAUIUnknown@@@@QEBAQEAUIUnknown@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIWbemClassObject@@@@PEAUIWbemClassObject@@@@QEAAPEAUIWbemClassObject@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIWbemClassObject@@@@PEAUIWbemClassObject@@@@QEBAQEAUIWbemClassObject@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIWbemContext@@@@PEAUIWbemContext@@@@QEAAPEAUIWbemContext@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIWbemContext@@@@PEAUIWbemContext@@@@QEBAQEAUIWbemContext@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIWbemLocator@@@@PEAUIWbemLocator@@@@QEAAPEAUIWbemLocator@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIWbemLocator@@@@PEAUIWbemLocator@@@@QEBAQEAUIWbemLocator@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIWbemObjectTextSrc@@@@PEAUIWbemObjectTextSrc@@@@QEAAPEAUIWbemObjectTextSrc@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIWbemObjectTextSrc@@@@PEAUIWbemObjectTextSrc@@@@QEBAQEAUIWbemObjectTextSrc@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIWbemPath@@@@PEAUIWbemPath@@@@QEAAPEAUIWbemPath@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIWbemPath@@@@PEAUIWbemPath@@@@QEBAQEAUIWbemPath@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIWbemPathKeyList@@@@PEAUIWbemPathKeyList@@@@QEAAPEAUIWbemPathKeyList@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIWbemPathKeyList@@@@PEAUIWbemPathKeyList@@@@QEBAQEAUIWbemPathKeyList@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIWbemQualifierSet@@@@PEAUIWbemQualifierSet@@@@QEAAPEAUIWbemQualifierSet@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIWbemQualifierSet@@@@PEAUIWbemQualifierSet@@@@QEBAQEAUIWbemQualifierSet@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIWbemQuery@@@@PEAUIWbemQuery@@@@QEAAPEAUIWbemQuery@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIWbemQuery@@@@PEAUIWbemQuery@@@@QEBAQEAUIWbemQuery@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIWbemServices@@@@PEAUIWbemServices@@@@QEAAPEAUIWbemServices@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIWbemServices@@@@PEAUIWbemServices@@@@QEBAQEAUIWbemServices@@XZ
??C?$AutoCleanup@V?$AutoRelease@VCBaseConfigCache@@@@PEAVCBaseConfigCache@@@@QEAAPEAVCBaseConfigCache@@XZ
??C?$AutoCleanup@V?$AutoRelease@VCClientConfigSettings@@@@PEAVCClientConfigSettings@@@@QEAAPEAVCClientConfigSettings@@XZ
??C?$AutoCleanup@V?$AutoRelease@VCConfigCacheMap@CBaseConfigCache@@@@PEAVCConfigCacheMap@CBaseConfigCache@@@@QEAAPEAVCConfigCacheMap@CBaseConfigCache@@XZ
??C?$AutoCleanup@V?$AutoRelease@VCConfigManager@@@@PEAVCConfigManager@@@@QEAAPEAVCConfigManager@@XZ
??C?$AutoCleanup@V?$AutoRelease@VCListenerReceive@@@@PEAVCListenerReceive@@@@QEAAPEAVCListenerReceive@@XZ
??C?$AutoCleanup@V?$AutoRelease@VCRemoteSession@@@@PEAVCRemoteSession@@@@QEAAPEAVCRemoteSession@@XZ
??C?$AutoCleanup@V?$AutoRelease@VCRemoteSession@@@@PEAVCRemoteSession@@@@QEBAQEAVCRemoteSession@@XZ
??C?$AutoCleanup@V?$AutoRelease@VCRequestContext@@@@PEAVCRequestContext@@@@QEAAPEAVCRequestContext@@XZ
??C?$AutoCleanup@V?$AutoRelease@VCServiceCommonConfigSettings@@@@PEAVCServiceCommonConfigSettings@@@@QEAAPEAVCServiceCommonConfigSettings@@XZ
??C?$AutoCleanup@V?$AutoRelease@VCServiceConfigCache@@@@PEAVCServiceConfigCache@@@@QEAAPEAVCServiceConfigCache@@XZ
??C?$AutoCleanup@V?$AutoRelease@VCServiceConfigSettings@@@@PEAVCServiceConfigSettings@@@@QEAAPEAVCServiceConfigSettings@@XZ
??C?$AutoCleanup@V?$AutoRelease@VCWSManEPR@@@@PEAVCWSManEPR@@@@QEAAPEAVCWSManEPR@@XZ
??C?$AutoCleanup@V?$AutoRelease@VCWSManEPR@@@@PEAVCWSManEPR@@@@QEBAQEAVCWSManEPR@@XZ
??C?$AutoCleanup@V?$AutoRelease@VCWSManGroupPolicyCache@@@@PEAVCWSManGroupPolicyCache@@@@QEAAPEAVCWSManGroupPolicyCache@@XZ
??C?$AutoCleanup@V?$AutoRelease@VCWSManGroupPolicyManager@@@@PEAVCWSManGroupPolicyManager@@@@QEAAPEAVCWSManGroupPolicyManager@@XZ
??C?$AutoCleanup@V?$AutoRelease@VCWSManObject@@@@PEAVCWSManObject@@@@QEAAPEAVCWSManObject@@XZ
??C?$AutoCleanup@V?$AutoRelease@VCWSManResource@@@@PEAVCWSManResource@@@@QEAAPEAVCWSManResource@@XZ
??C?$AutoCleanup@V?$AutoRelease@VCWinRSPluginConfigCache@@@@PEAVCWinRSPluginConfigCache@@@@QEAAPEAVCWinRSPluginConfigCache@@XZ
??C?$AutoCleanup@V?$AutoRelease@VCWinRSPluginConfigCache@@@@PEAVCWinRSPluginConfigCache@@@@QEBAQEAVCWinRSPluginConfigCache@@XZ
??C?$AutoCleanup@V?$AutoRelease@VCWinRSPluginConfigSettings@@@@PEAVCWinRSPluginConfigSettings@@@@QEAAPEAVCWinRSPluginConfigSettings@@XZ
??C?$AutoCleanup@V?$AutoRelease@VCommand@Client@WSMan@@@@PEAVCommand@Client@WSMan@@@@QEAAPEAVCommand@Client@WSMan@@XZ
??C?$AutoCleanup@V?$AutoRelease@VConfigNotification@@@@PEAVConfigNotification@@@@QEAAPEAVConfigNotification@@XZ
??C?$AutoCleanup@V?$AutoRelease@VConnectShellOperation@Client@WSMan@@@@PEAVConnectShellOperation@Client@WSMan@@@@QEAAPEAVConnectShellOperation@Client@WSMan@@XZ
??C?$AutoCleanup@V?$AutoRelease@VCreateShellOperation@Client@WSMan@@@@PEAVCreateShellOperation@Client@WSMan@@@@QEAAPEAVCreateShellOperation@Client@WSMan@@XZ
??C?$AutoCleanup@V?$AutoRelease@VDeleteShellOperation@Client@WSMan@@@@PEAVDeleteShellOperation@Client@WSMan@@@@QEAAPEAVDeleteShellOperation@Client@WSMan@@XZ
??C?$AutoCleanup@V?$AutoRelease@VDisconnectOperation@Client@WSMan@@@@PEAVDisconnectOperation@Client@WSMan@@@@QEAAPEAVDisconnectOperation@Client@WSMan@@XZ
??C?$AutoCleanup@V?$AutoRelease@VEnumSinkEx@@@@PEAVEnumSinkEx@@@@QEAAPEAVEnumSinkEx@@XZ
??C?$AutoCleanup@V?$AutoRelease@VEnumSinkEx@@@@PEAVEnumSinkEx@@@@QEBAQEAVEnumSinkEx@@XZ
??C?$AutoCleanup@V?$AutoRelease@VGeneralSinkEx@@@@PEAVGeneralSinkEx@@@@QEAAPEAVGeneralSinkEx@@XZ
??C?$AutoCleanup@V?$AutoRelease@VGeneralSinkEx@@@@PEAVGeneralSinkEx@@@@QEBAQEAVGeneralSinkEx@@XZ
??C?$AutoCleanup@V?$AutoRelease@VIPCSoapProcessor@@@@PEAVIPCSoapProcessor@@@@QEAAPEAVIPCSoapProcessor@@XZ
??C?$AutoCleanup@V?$AutoRelease@VIRequestContext@@@@PEAVIRequestContext@@@@QEAAPEAVIRequestContext@@XZ
??C?$AutoCleanup@V?$AutoRelease@VIRequestContext@@@@PEAVIRequestContext@@@@QEBAQEAVIRequestContext@@XZ
??C?$AutoCleanup@V?$AutoRelease@VInboundRequestDetails@@@@PEAVInboundRequestDetails@@@@QEAAPEAVInboundRequestDetails@@XZ
??C?$AutoCleanup@V?$AutoRelease@VInboundRequestDetails@@@@PEAVInboundRequestDetails@@@@QEBAQEAVInboundRequestDetails@@XZ
??C?$AutoCleanup@V?$AutoRelease@VReceiveOperation@Client@WSMan@@@@PEAVReceiveOperation@Client@WSMan@@@@QEAAPEAVReceiveOperation@Client@WSMan@@XZ
??C?$AutoCleanup@V?$AutoRelease@VReconnectOperation@Client@WSMan@@@@PEAVReconnectOperation@Client@WSMan@@@@QEAAPEAVReconnectOperation@Client@WSMan@@XZ
??C?$AutoCleanup@V?$AutoRelease@VSendOperation@Client@WSMan@@@@PEAVSendOperation@Client@WSMan@@@@QEAAPEAVSendOperation@Client@WSMan@@XZ
??C?$AutoCleanup@V?$AutoRelease@VShell@Client@WSMan@@@@PEAVShell@Client@WSMan@@@@QEAAPEAVShell@Client@WSMan@@XZ
??C?$AutoCleanup@V?$AutoRelease@VShell@Client@WSMan@@@@PEAVShell@Client@WSMan@@@@QEBAQEAVShell@Client@WSMan@@XZ
??C?$AutoCleanup@V?$AutoRelease@VSignalOperation@Client@WSMan@@@@PEAVSignalOperation@Client@WSMan@@@@QEAAPEAVSignalOperation@Client@WSMan@@XZ
??C?$AutoCleanup@V?$AutoRelease@VUserRecord@@@@PEAVUserRecord@@@@QEAAPEAVUserRecord@@XZ
??C?$AutoCleanup@V?$AutoRelease@VWSManHttpListener@@@@PEAVWSManHttpListener@@@@QEAAPEAVWSManHttpListener@@XZ
??C?$AutoCleanup@VAutoBstrNoAlloc@@PEAG@@QEAAPEAGXZ
??C?$AutoCleanup@VAutoBstrNoAlloc@@PEAG@@QEBAQEAGXZ
??C?$AutoCleanup@VAutoChainContext@@PEBU_CERT_CHAIN_CONTEXT@@@@QEAAPEBU_CERT_CHAIN_CONTEXT@@XZ
??C?$AutoCleanup@VAutoImpersonateUser@@PEAX@@QEAAPEAXXZ
??C?$AutoCleanup@VAutoImpersonateUser@@PEAX@@QEBAQEAXXZ
??C?$AutoCleanup@VAutoMIClass@@PEAU_MI_Class@@@@QEAAPEAU_MI_Class@@XZ
??C?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@QEBAAEAPEAVExpiredOperationIdRecord@@XZ
??C?$SafeSet_Iterator@PEAVCListenerOperation@@@@QEBAAEBQEAVCListenerOperation@@XZ
??D?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@QEBAAEAVCertThumbprintMappedSet@CServiceConfigSettings@@XZ
??D?$SafeMap_Iterator@VKey@Locale@@K@@QEBAAEAKXZ
??D?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@QEBAAEAPEAVExpiredOperationIdRecord@@XZ
??D?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@QEBAAEAPEAVOptionValue@SessionOptions@Client@WSMan@@XZ
??D?$SafeSet_Iterator@PEAVCCertMapping@@@@QEBAAEBQEAVCCertMapping@@XZ
??D?$SafeSet_Iterator@PEAVCListenerOperation@@@@QEBAAEBQEAVCListenerOperation@@XZ
??D?$SafeSet_Iterator@PEAVCShellUriSettings@@@@QEBAAEBQEAVCShellUriSettings@@XZ
??E?$SafeMap_Iterator@PEAVCCertMapping@@UEmpty@@@@QEAAXH@Z
??E?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@QEAAXH@Z
??E?$SafeMap_Iterator@PEAVCShellUriSettings@@UEmpty@@@@QEAAXH@Z
??E?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@QEAAXH@Z
??E?$SafeMap_Iterator@VStringKeyCI@@K@@QEAAXH@Z
??E?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@QEAAXH@Z
??E?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@QEAAXH@Z
??E?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@QEAAXH@Z
??_7?$SafeMap@PEAVCCertMapping@@UEmpty@@V?$SafeSet_Iterator@PEAVCCertMapping@@@@@@6B@
??_7?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@6B@
??_7?$SafeMap@PEAVCShellUriSettings@@UEmpty@@V?$SafeSet_Iterator@PEAVCShellUriSettings@@@@@@6B@
??_7?$SafeMap@PEAVCollector@@UEmpty@@V?$SafeSet_Iterator@PEAVCollector@@@@@@6B@
??_7?$SafeMap@PEAVHostOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVHostOperation@@@@@@6B@
??_7?$SafeMap@PEAVIOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVIOperation@@@@@@6B@
??_7?$SafeMap@PEAVListenerSourceSubscription@@UEmpty@@V?$SafeSet_Iterator@PEAVListenerSourceSubscription@@@@@@6B@
??_7?$SafeMap@PEAVPushSubscription@@UEmpty@@V?$SafeSet_Iterator@PEAVPushSubscription@@@@@@6B@
??_7?$SafeMap@PEAXUEmpty@@V?$SafeSet_Iterator@PEAX@@@@6B@
??_7?$SafeMap@UPluginKey@@KV?$SafeMap_Iterator@UPluginKey@@K@@@@6B@
??_7?$SafeMap@UUserKey@@PEAVBlockedRecord@@V?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@@@6B@
??_7?$SafeMap@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@V?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@@@6B@
??_7?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@6B@
??_7?$SafeMap@VStringKeyCI@@KV?$SafeMap_Iterator@VStringKeyCI@@K@@@@6B@
??_7?$SafeMap@VStringKeyCI@@UEmpty@@V?$SafeSet_Iterator@VStringKeyCI@@@@@@6B@
??_7?$SafeMap@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@V?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@@@6B@
??_7?$SafeMap@VStringKeyStore@@PEAVExpiredOperationIdRecord@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@@@6B@
??_7?$SafeMap@VStringKeyStore@@PEAVServerFullDuplexChannel@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@@@6B@
??_7?$SafeMap@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@6B@
??_7?$SafeMap@_KPEAVSendPacketArgs@RobustConnectionBuffer@@V?$SafeMap_Iterator@_KPEAVSendPacketArgs@RobustConnectionBuffer@@@@@@6B@
??_7?$SafeSet@PEAVCCertMapping@@@@6B@
??_7?$SafeSet@PEAVCListenerOperation@@@@6B@
??_7?$SafeSet@PEAVCShellUriSettings@@@@6B@
??_7?$SafeSet@PEAX@@6B@
??_7BufferFormatter@@6B@
??_7CBaseConfigCache@@6BIConfigChangeObserver@@@
??_7CBaseConfigCache@@6BILifeTimeMgmt@@@
??_7CClientConfigCache@@6BIConfigChangeObserver@@@
??_7CClientConfigCache@@6BILifeTimeMgmt@@@
??_7CConfigManager@@6B@
??_7CErrorContext@@6B@
??_7CRequestContext@@6BCErrorContext@@@
??_7CRequestContext@@6BEtwCorrelationHelper@@@
??_7CServiceConfigCache@@6BIConfigChangeObserver@@@
??_7CServiceConfigCache@@6BILifeTimeMgmt@@@
??_7CWSManEPR@@6B@
??_7CWSManGroupPolicyManager@@6B@
??_7CWSManResource@@6B@
??_7CWSManResourceNoResourceUri@@6B@
??_7CWSManSecurityUI@@6B@
??_7CWinRSPluginConfigCache@@6BIConfigChangeObserver@@@
??_7CWinRSPluginConfigCache@@6BILifeTimeMgmt@@@
??_7CircularBufferFormatter@@6B@
??_7EtwCorrelationHelper@@6B@
??_7IConfigChangeObserver@@6B@
??_7ILifeTimeMgmt@@6B@
??_7IRequestContext@@6B@
??_7IWSManGroupPolicyObserver@@6B@
??_7IWSManGroupPolicyPublisher@@6B@
??_7PacketParser@@6B@
??_7UserAuthzRecord@@6B@
??_7UserRecord@@6B@
??_FCErrorContext@@QEAAXXZ
??_FRBUFFER@@QEAAXXZ
?Acquire@?$SafeMap@PEAVCCertMapping@@UEmpty@@V?$SafeMap_Iterator@PEAVCCertMapping@@UEmpty@@@@@@UEBAXXZ
?Acquire@?$SafeMap@PEAVCCertMapping@@UEmpty@@V?$SafeSet_Iterator@PEAVCCertMapping@@@@@@UEBAXXZ
?Acquire@?$SafeMap@PEAVCListenerConnect@@PEAV1@V?$SafeMap_Iterator@PEAVCListenerConnect@@PEAV1@@@@@UEBAXXZ
?Acquire@?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@@@UEBAXXZ
?Acquire@?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@UEBAXXZ
?Acquire@?$SafeMap@PEAVCListenerReceive@@PEAV1@V?$SafeMap_Iterator@PEAVCListenerReceive@@PEAV1@@@@@UEBAXXZ
?Acquire@?$SafeMap@PEAVCListenerSend@@PEAV1@V?$SafeMap_Iterator@PEAVCListenerSend@@PEAV1@@@@@UEBAXXZ
?Acquire@?$SafeMap@PEAVCListenerSignal@@PEAV1@V?$SafeMap_Iterator@PEAVCListenerSignal@@PEAV1@@@@@UEBAXXZ
?Acquire@?$SafeMap@PEAVCShellUriSettings@@UEmpty@@V?$SafeSet_Iterator@PEAVCShellUriSettings@@@@@@UEBAXXZ
?Acquire@?$SafeMap@PEAVCollector@@UEmpty@@V?$SafeMap_Iterator@PEAVCollector@@UEmpty@@@@@@UEBAXXZ
?Acquire@?$SafeMap@PEAVCollector@@UEmpty@@V?$SafeSet_Iterator@PEAVCollector@@@@@@UEBAXXZ
?Acquire@?$SafeMap@PEAVHostOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVHostOperation@@UEmpty@@@@@@UEBAXXZ
?Acquire@?$SafeMap@PEAVHostOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVHostOperation@@@@@@UEBAXXZ
?Acquire@?$SafeMap@PEAVIOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVIOperation@@UEmpty@@@@@@UEBAXXZ
?Acquire@?$SafeMap@PEAVIOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVIOperation@@@@@@UEBAXXZ
?Acquire@?$SafeMap@PEAVListenerSourceSubscription@@UEmpty@@V?$SafeMap_Iterator@PEAVListenerSourceSubscription@@UEmpty@@@@@@UEBAXXZ
?Acquire@?$SafeMap@PEAVListenerSourceSubscription@@UEmpty@@V?$SafeSet_Iterator@PEAVListenerSourceSubscription@@@@@@UEBAXXZ
?Acquire@?$SafeMap@PEAVPushSubscription@@UEmpty@@V?$SafeMap_Iterator@PEAVPushSubscription@@UEmpty@@@@@@UEBAXXZ
?Acquire@?$SafeMap@PEAVPushSubscription@@UEmpty@@V?$SafeSet_Iterator@PEAVPushSubscription@@@@@@UEBAXXZ
?Acquire@?$SafeMap@PEAXUEmpty@@V?$SafeSet_Iterator@PEAX@@@@UEBAXXZ
?Acquire@?$SafeMap@UPluginKey@@KV?$SafeMap_Iterator@UPluginKey@@K@@@@UEBAXXZ
?Acquire@?$SafeMap@UUserKey@@PEAVBlockedRecord@@V?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@@@UEBAXXZ
?Acquire@?$SafeMap@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@V?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@@@UEBAXXZ
?Acquire@?$SafeMap@VGuidKey@@PEAVCListenerCommand@@V?$SafeMap_Iterator@VGuidKey@@PEAVCListenerCommand@@@@@@UEBAXXZ
?Acquire@?$SafeMap@VKey@CWmiPtrCache@@VMapping@2@V?$SafeMap_Iterator@VKey@CWmiPtrCache@@VMapping@2@@@@@UEBAXXZ
?Acquire@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEBAXXZ
?Acquire@?$SafeMap@VStringKey@@PEAVListenerEvents@@V?$SafeMap_Iterator@VStringKey@@PEAVListenerEvents@@@@@@UEBAXXZ
?Acquire@?$SafeMap@VStringKey@@PEAVListenerSourceSubscription@@V?$SafeMap_Iterator@VStringKey@@PEAVListenerSourceSubscription@@@@@@UEBAXXZ
?Acquire@?$SafeMap@VStringKey@@UOption@WinRM_OperationOptions@@V?$SafeMap_Iterator@VStringKey@@UOption@WinRM_OperationOptions@@@@@@UEBAXXZ
?Acquire@?$SafeMap@VStringKeyCI@@KV?$SafeMap_Iterator@VStringKeyCI@@K@@@@UEBAXXZ
?Acquire@?$SafeMap@VStringKeyCI@@PEAVIISEndpoint@@V?$SafeMap_Iterator@VStringKeyCI@@PEAVIISEndpoint@@@@@@UEBAXXZ
?Acquire@?$SafeMap@VStringKeyCI@@UEmpty@@V?$SafeMap_Iterator@VStringKeyCI@@UEmpty@@@@@@UEBAXXZ
?Acquire@?$SafeMap@VStringKeyCI@@UEmpty@@V?$SafeSet_Iterator@VStringKeyCI@@@@@@UEBAXXZ
?Acquire@?$SafeMap@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@V?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@@@UEBAXXZ
?Acquire@?$SafeMap@VStringKeyStore@@PEAVExpiredOperationIdRecord@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@@@UEBAXXZ
?Acquire@?$SafeMap@VStringKeyStore@@PEAVServerFullDuplexChannel@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@@@UEBAXXZ
?Acquire@?$SafeMap@VTokenCacheKey@ServiceSoapProcessor@@VTokenCacheMapping@2@V?$SafeMap_Iterator@VTokenCacheKey@ServiceSoapProcessor@@VTokenCacheMapping@2@@@@@UEBAXXZ
?Acquire@?$SafeMap@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@UEBAXXZ
?Acquire@?$SafeMap@_KPEAVSendPacketArgs@RobustConnectionBuffer@@V?$SafeMap_Iterator@_KPEAVSendPacketArgs@RobustConnectionBuffer@@@@@@UEBAXXZ
?Acquire@?$SafeMap_Lock@PEAVCCertMapping@@UEmpty@@V?$SafeMap_Iterator@PEAVCCertMapping@@UEmpty@@@@@@QEAAXXZ
?Acquire@?$SafeMap_Lock@PEAVCCertMapping@@UEmpty@@V?$SafeSet_Iterator@PEAVCCertMapping@@@@@@QEAAXXZ
?Acquire@?$SafeMap_Lock@PEAVCListenerOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@@@QEAAXXZ
?Acquire@?$SafeMap_Lock@PEAVCListenerOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@QEAAXXZ
?Acquire@?$SafeMap_Lock@PEAVCShellUriSettings@@UEmpty@@V?$SafeMap_Iterator@PEAVCShellUriSettings@@UEmpty@@@@@@QEAAXXZ
?Acquire@?$SafeMap_Lock@PEAVCShellUriSettings@@UEmpty@@V?$SafeSet_Iterator@PEAVCShellUriSettings@@@@@@QEAAXXZ
?Acquire@?$SafeMap_Lock@PEAXUEmpty@@V?$SafeMap_Iterator@PEAXUEmpty@@@@@@QEAAXXZ
?Acquire@?$SafeMap_Lock@PEAXUEmpty@@V?$SafeSet_Iterator@PEAX@@@@QEAAXXZ
?Acquire@?$SafeMap_Lock@UPluginKey@@KV?$SafeMap_Iterator@UPluginKey@@K@@@@QEAAXXZ
?Acquire@?$SafeMap_Lock@UUserKey@@PEAVBlockedRecord@@V?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@@@QEAAXXZ
?Acquire@?$SafeMap_Lock@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@V?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@@@QEAAXXZ
?Acquire@?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAAXXZ
?Acquire@?$SafeMap_Lock@VStringKeyCI@@KV?$SafeMap_Iterator@VStringKeyCI@@K@@@@QEAAXXZ
?Acquire@?$SafeMap_Lock@VStringKeyCI@@UEmpty@@V?$SafeSet_Iterator@VStringKeyCI@@@@@@QEAAXXZ
?Acquire@?$SafeMap_Lock@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@V?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@@@QEAAXXZ
?Acquire@?$SafeMap_Lock@VStringKeyStore@@PEAVExpiredOperationIdRecord@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@@@QEAAXXZ
?Acquire@?$SafeMap_Lock@VStringKeyStore@@PEAVServerFullDuplexChannel@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@@@QEAAXXZ
?Acquire@?$SafeMap_Lock@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@QEAAXXZ
?Acquire@?$SafeMap_Lock@_KPEAVSendPacketArgs@RobustConnectionBuffer@@V?$SafeMap_Iterator@_KPEAVSendPacketArgs@RobustConnectionBuffer@@@@@@QEAAXXZ
?Acquire@CWSManCriticalSection@@QEAAXXZ
?AcquireExclusive@FastLock@@QEAAXXZ
?AcquireShared@FastLock@@QEAAXXZ
?Acquired@?$SafeMap_Lock@PEAVCCertMapping@@UEmpty@@V?$SafeMap_Iterator@PEAVCCertMapping@@UEmpty@@@@@@QEAA_NXZ
?Acquired@?$SafeMap_Lock@PEAVCListenerConnect@@PEAV1@V?$SafeMap_Iterator@PEAVCListenerConnect@@PEAV1@@@@@QEAA_NXZ
?Acquired@?$SafeMap_Lock@PEAVCListenerOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@@@QEAA_NXZ
?Acquired@?$SafeMap_Lock@PEAVCListenerReceive@@PEAV1@V?$SafeMap_Iterator@PEAVCListenerReceive@@PEAV1@@@@@QEAA_NXZ
?Acquired@?$SafeMap_Lock@PEAVCListenerSend@@PEAV1@V?$SafeMap_Iterator@PEAVCListenerSend@@PEAV1@@@@@QEAA_NXZ
?Acquired@?$SafeMap_Lock@PEAVCListenerSignal@@PEAV1@V?$SafeMap_Iterator@PEAVCListenerSignal@@PEAV1@@@@@QEAA_NXZ
?Acquired@?$SafeMap_Lock@PEAVCShellUriSettings@@UEmpty@@V?$SafeMap_Iterator@PEAVCShellUriSettings@@UEmpty@@@@@@QEAA_NXZ
?Acquired@?$SafeMap_Lock@PEAVCollector@@UEmpty@@V?$SafeMap_Iterator@PEAVCollector@@UEmpty@@@@@@QEAA_NXZ
?Acquired@?$SafeMap_Lock@PEAVHostOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVHostOperation@@UEmpty@@@@@@QEAA_NXZ
?Acquired@?$SafeMap_Lock@PEAVIOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVIOperation@@UEmpty@@@@@@QEAA_NXZ
?Acquired@?$SafeMap_Lock@PEAVListenerSourceSubscription@@UEmpty@@V?$SafeMap_Iterator@PEAVListenerSourceSubscription@@UEmpty@@@@@@QEAA_NXZ
?Acquired@?$SafeMap_Lock@PEAVPushSubscription@@UEmpty@@V?$SafeMap_Iterator@PEAVPushSubscription@@UEmpty@@@@@@QEAA_NXZ
?Acquired@?$SafeMap_Lock@PEAXUEmpty@@V?$SafeMap_Iterator@PEAXUEmpty@@@@@@QEAA_NXZ
?Acquired@?$SafeMap_Lock@UPluginKey@@KV?$SafeMap_Iterator@UPluginKey@@K@@@@QEAA_NXZ
?Acquired@?$SafeMap_Lock@UUserKey@@PEAVBlockedRecord@@V?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@@@QEAA_NXZ
?Acquired@?$SafeMap_Lock@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@V?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@@@QEAA_NXZ
?Acquired@?$SafeMap_Lock@VGuidKey@@PEAVCListenerCommand@@V?$SafeMap_Iterator@VGuidKey@@PEAVCListenerCommand@@@@@@QEAA_NXZ
?Acquired@?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA_NXZ
?Acquired@?$SafeMap_Lock@VStringKeyCI@@KV?$SafeMap_Iterator@VStringKeyCI@@K@@@@QEAA_NXZ
?Acquired@?$SafeMap_Lock@VStringKeyCI@@UEmpty@@V?$SafeMap_Iterator@VStringKeyCI@@UEmpty@@@@@@QEAA_NXZ
?Acquired@?$SafeMap_Lock@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@V?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@@@QEAA_NXZ
?Acquired@?$SafeMap_Lock@VStringKeyStore@@PEAVExpiredOperationIdRecord@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@@@QEAA_NXZ
?Acquired@?$SafeMap_Lock@VStringKeyStore@@PEAVServerFullDuplexChannel@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@@@QEAA_NXZ
?Acquired@?$SafeMap_Lock@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@QEAA_NXZ
?Acquired@?$SafeMap_Lock@_KPEAVSendPacketArgs@RobustConnectionBuffer@@V?$SafeMap_Iterator@_KPEAVSendPacketArgs@RobustConnectionBuffer@@@@@@QEAA_NXZ
?Add@?$SafeMap@PEAVCCertMapping@@UEmpty@@V?$SafeSet_Iterator@PEAVCCertMapping@@@@@@QEAA_NAEBQEAVCCertMapping@@AEBUEmpty@@AEAVIRequestContext@@@Z
?Add@?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@QEAA_NAEBQEAVCListenerOperation@@AEBUEmpty@@AEAVIRequestContext@@@Z
?Add@?$SafeMap@PEAVCShellUriSettings@@UEmpty@@V?$SafeSet_Iterator@PEAVCShellUriSettings@@@@@@QEAA_NAEBQEAVCShellUriSettings@@AEBUEmpty@@AEAVIRequestContext@@@Z
?Add@?$SafeMap@PEAXUEmpty@@V?$SafeSet_Iterator@PEAX@@@@QEAA_NAEBQEAXAEBUEmpty@@AEAVIRequestContext@@@Z
?Add@?$SafeMap@UPluginKey@@KV?$SafeMap_Iterator@UPluginKey@@K@@@@QEAA_NAEBUPluginKey@@AEBKAEAVIRequestContext@@@Z
?Add@?$SafeMap@UUserKey@@PEAVBlockedRecord@@V?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@@@QEAA_NAEBUUserKey@@AEBQEAVBlockedRecord@@AEAVIRequestContext@@@Z
?Add@?$SafeMap@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@V?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@@@QEAA_NAEBVCertThumbprintKey@@AEBVCertThumbprintMappedSet@CServiceConfigSettings@@AEAVIRequestContext@@@Z
?Add@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA_NAEBVKey@Locale@@AEBKAEAVIRequestContext@@@Z
?Add@?$SafeMap@VStringKeyCI@@KV?$SafeMap_Iterator@VStringKeyCI@@K@@@@QEAA_NAEBVStringKeyCI@@AEBKAEAVIRequestContext@@@Z
?Add@?$SafeMap@VStringKeyCI@@UEmpty@@V?$SafeSet_Iterator@VStringKeyCI@@@@@@QEAA_NAEBVStringKeyCI@@AEBUEmpty@@AEAVIRequestContext@@@Z
?Add@?$SafeMap@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@V?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@@@QEAA_NAEBVStringKeyCI@@AEBUUSER_CONTEXT_INFO@WSManHttpListener@@AEAVIRequestContext@@@Z
?Add@?$SafeMap@VStringKeyStore@@PEAVExpiredOperationIdRecord@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@@@QEAA_NAEBVStringKeyStore@@AEBQEAVExpiredOperationIdRecord@@AEAVIRequestContext@@@Z
?Add@?$SafeMap@VStringKeyStore@@PEAVServerFullDuplexChannel@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@@@QEAA_NAEBVStringKeyStore@@AEBQEAVServerFullDuplexChannel@@AEAVIRequestContext@@@Z
?Add@?$SafeMap@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@QEAA_NAEBW4WSManSessionOption@@AEBQEAVOptionValue@SessionOptions@Client@WSMan@@AEAVIRequestContext@@@Z
?Add@?$SafeMap@_KPEAVSendPacketArgs@RobustConnectionBuffer@@V?$SafeMap_Iterator@_KPEAVSendPacketArgs@RobustConnectionBuffer@@@@@@QEAA_NAEB_KAEBQEAVSendPacketArgs@RobustConnectionBuffer@@AEAVIRequestContext@@@Z
?Add@?$SafeSet@PEAVCCertMapping@@@@QEAA_NAEBQEAVCCertMapping@@AEAVIRequestContext@@@Z
?Add@?$SafeSet@PEAVCListenerOperation@@@@QEAA_NAEBQEAVCListenerOperation@@AEAVIRequestContext@@@Z
?Add@?$SafeSet@PEAVCShellUriSettings@@@@QEAA_NAEBQEAVCShellUriSettings@@AEAVIRequestContext@@@Z
?Add@?$SafeSet@PEAX@@QEAA_NAEBQEAXAEAVIRequestContext@@@Z
?Add@?$SafeSet@VStringKeyCI@@@@QEAA_NAEBVStringKeyCI@@AEAVIRequestContext@@@Z
?AddDefaultPlugins@ConfigUpdate@@SAHPEAVIRequestContext@@H@Z
?AddKey@CWSManResourceNoResourceUri@@QEAAHPEBG0PEAVIRequestContext@@@Z
?AddMessage@CRequestContext@@AEAAHPEBGPEAPEAD1@Z
?AddOption@CWSManResourceNoResourceUri@@QEAAHPEBG0HPEAVIRequestContext@@@Z
?AddOptionSet@CWSManResourceNoResourceUri@@QEAAHPEAU_WSMAN_OPTION_SET@@PEAVIRequestContext@@@Z
?AddPacket@PacketParser@@QEAA_NPEAVPacket@@_N11@Z
?AddRef@CWSManSecurityUI@@UEAAKXZ
?AddRef@ILifeTimeMgmt@@UEAAJXZ
?AddRef@UserRecord@@QEAA_NAEAVIRequestContext@@@Z
?AddSource@CBaseConfigCache@@IEAAHPEAVIRequestContext@@PEAVCConfigChangeSource@@@Z
?AddToMap@CBaseConfigCache@@AEAAHPEAVIRequestContext@@AEAVAutoLocalFree@@@Z
?Alloc@WSManMemory@@SAPEAX_KHW4_NitsFaultMode@@@Z
?AllocBstr@WSManMemory@@SAPEAGPEBGHH@Z
?AllocBstrLen@WSManMemory@@SAPEAGPEBGIHH@Z
?AllocCache@CClientConfigCache@@CAPEAVCBaseConfigCache@@XZ
?AllocCache@CServiceConfigCache@@CAPEAVCBaseConfigCache@@XZ
?AllocCache@CWinRSPluginConfigCache@@CAPEAVCBaseConfigCache@@XZ
?AllocSysString@TSTRBUFFER@@QEBAJPEAPEAG@Z
?AllowBasic@CCommonConfigSettings@@UEBAHXZ
?AllowClientCertificate@CCommonConfigSettings@@UEBAHXZ
?AllowCredSsp@CCommonConfigSettings@@UEBAHXZ
?AllowKerberos@CCommonConfigSettings@@UEBAHXZ
?AllowNegotiate@CCommonConfigSettings@@UEBAHXZ
?AllowUnencrypted@CCommonConfigSettings@@UEBAHXZ
?Append@SBUFFER@@QEAAJPEAEI@Z
?Append@SBUFFER@@QEAAJPEAV1@@Z
?Append@TSTRBUFFER@@QEAAJPEBG@Z
?Append@TSTRBUFFER@@QEAAJPEBGII@Z
?AppendChar@TSTRBUFFER@@QEAAJG@Z
?AppendEscapeXmlAttribute@TSTRBUFFER@@QEAAJPEBGG@Z
?AppendEscapeXmlContent@TSTRBUFFER@@QEAAJPEBG_N@Z
?AppendXmlElem@TSTRBUFFER@@QEAAJPEBG0HKPEAU_XML_ATTRIB@@@Z
?AppendXmlElemWithNamespace@TSTRBUFFER@@QEAAJPEBG00HKPEAU_XML_ATTRIB@@@Z
?AppendXmlElemWithNamespaceAndPrefix@TSTRBUFFER@@QEAAJPEBG000HKPEAU_XML_ATTRIB@@@Z
?AppendXmlElemWithPrefix@TSTRBUFFER@@QEAAJPEBG00HKPEAU_XML_ATTRIB@@@Z
?AppendXmlEndElem@TSTRBUFFER@@QEAAJPEBG@Z
?AppendXmlEndElemWithPrefix@TSTRBUFFER@@QEAAJPEBG0@Z
?AppendXmlEndFragment@TSTRBUFFER@@QEAAJXZ
?AppendXmlEndItem@TSTRBUFFER@@QEAAJXZ
?AppendXmlStartElem@TSTRBUFFER@@QEAAJPEBGHKPEAU_XML_ATTRIB@@@Z
?AppendXmlStartElemWithNamespace@TSTRBUFFER@@QEAAJPEBG0HKPEAU_XML_ATTRIB@@@Z
?AppendXmlStartElemWithNamespaceAndPrefix@TSTRBUFFER@@QEAAJPEBG00HKPEAU_XML_ATTRIB@@@Z
?AppendXmlStartElemWithNamespaces@TSTRBUFFER@@QEAAJPEBGKPEAU_XML_NAMESPACE_PREFIX@@HKPEAU_XML_ATTRIB@@@Z
?AppendXmlStartElemWithNamespacesAndPrefixes@TSTRBUFFER@@QEAAJPEBG0KPEAU_XML_NAMESPACE_PREFIX@@HKPEAU_XML_ATTRIB@@@Z
?AppendXmlStartElemWithPrefix@TSTRBUFFER@@QEAAJPEBG0HKPEAU_XML_ATTRIB@@@Z
?AppendXmlStartFragment@TSTRBUFFER@@QEAAJXZ
?AppendXmlStartItem@TSTRBUFFER@@QEAAJXZ
?ApplyQuota@UserRecord@@QEAA_NW4OperationType@@AEAVIRequestContext@@PEBVProvider@Catalog@@PEAVCServiceConfigSettings@@@Z
?ApplySecurity@ConfigRegistry@@IEAAHPEAVIRequestContext@@PEAUHKEY__@@PEBG2@Z
?AsReference@?$SafeMap@PEAVCCertMapping@@UEmpty@@V?$SafeSet_Iterator@PEAVCCertMapping@@@@@@QEAAAEAV1@XZ
?AsReference@?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@QEAAAEAV1@XZ
?AsReference@?$SafeMap@PEAVCShellUriSettings@@UEmpty@@V?$SafeSet_Iterator@PEAVCShellUriSettings@@@@@@QEAAAEAV1@XZ
?AsReference@?$SafeMap@PEAXUEmpty@@V?$SafeSet_Iterator@PEAX@@@@QEAAAEAV1@XZ
?AsReference@?$SafeMap@UPluginKey@@KV?$SafeMap_Iterator@UPluginKey@@K@@@@QEAAAEAV1@XZ
?AsReference@?$SafeMap@UUserKey@@PEAVBlockedRecord@@V?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@@@QEAAAEAV1@XZ
?AsReference@?$SafeMap@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@V?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@@@QEAAAEAV1@XZ
?AsReference@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAAAEAV1@XZ
?AsReference@?$SafeMap@VStringKeyCI@@KV?$SafeMap_Iterator@VStringKeyCI@@K@@@@QEAAAEAV1@XZ
?AsReference@?$SafeMap@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@V?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@@@QEAAAEAV1@XZ
?AsReference@?$SafeMap@VStringKeyStore@@PEAVExpiredOperationIdRecord@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@@@QEAAAEAV1@XZ
?AsReference@?$SafeMap@VStringKeyStore@@PEAVServerFullDuplexChannel@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@@@QEAAAEAV1@XZ
?AsReference@?$SafeMap@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@QEAAAEAV1@XZ
?AsReference@?$SafeMap@_KPEAVSendPacketArgs@RobustConnectionBuffer@@V?$SafeMap_Iterator@_KPEAVSendPacketArgs@RobustConnectionBuffer@@@@@@QEAAAEAV1@XZ
?AuthzComplete@UserRecord@@UEAAKPEAX0W4AdministratorType@UserAuthzRecord@@KPEBG@Z
?BOMS@PacketFormatter@@0QBUBOMInfo@1@B
?BeginRevertToSelf@CSecurity@@SAHPEAPEAXK@Z
?BuildFragmentTransfer@CWSManResourceNoResourceUri@@UEAAHAEAVBufferFormatter@@@Z
?BuildOptionSet@CWSManResourceNoResourceUri@@QEAAHAEAVBufferFormatter@@@Z
?BuildSelectorSet@CWSManEPR@@UEAAHAEAVBufferFormatter@@@Z
?BuildSelectorSet@CWSManResourceNoResourceUri@@UEAAHAEAVBufferFormatter@@@Z
?CHARSETS@PacketFormatter@@0QBUCharsetInfo@1@B
?ChangeLogging@CServiceConfigCache@@QEAAXW4ErrorLogging@@@Z
?CheckSharedSSLConfiguration@ConfigRegistry@@IEAAHPEAVIRequestContext@@PEBG1HPEAH@Z
?Clear@?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@QEAAXXZ
?Clear@?$SafeMap@UPluginKey@@KV?$SafeMap_Iterator@UPluginKey@@K@@@@QEAAXXZ
?Clear@?$SafeMap@VStringKeyCI@@KV?$SafeMap_Iterator@VStringKeyCI@@K@@@@QEAAXXZ
?Clear@?$SafeMap@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@V?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@@@QEAAXXZ
?Clear@?$SafeMap@VStringKeyStore@@PEAVExpiredOperationIdRecord@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@@@QEAAXXZ
?ClearKeys@CWSManResourceNoResourceUri@@QEAAHXZ
?ClearOptions@CWSManResourceNoResourceUri@@QEAAHXZ
?ClearRegistryKeys@ConfigRegistry@@IEAAHPEAVIRequestContext@@@Z
?CompleteWithErrorContext@CRequestContext@@QEAAXPEAU_WSMAN_PLUGIN_REQUEST@@@Z
?Confirm@ExtendedSemantic@@2KB
?Copy@TSTRBUFFER@@QEAAJPEBG@Z
?CopyString@@YAPEAGPEAVIRequestContext@@W4CallSiteId@@PEBG@Z
?CopyString@@YAPEAGPEBGAEBHAEAVIRequestContext@@@Z
?CopyString@MessageId@PacketParser@@QEAAKPEBGH@Z
?CopyTo@CErrorContext@@UEBAXPEAVIRequestContext@@@Z
?CopyTo@CRequestContext@@UEBAXPEAVIRequestContext@@@Z
?CreateActivityId@EventHandler@WSMan@@SAXAEAU_GUID@@@Z
?CreateAnEvent@SoapSemanticConverter@@QEAAKKPEAVSemanticMessage@@AEAVBufferFormatter@@PEAVIRequestContext@@@Z
?CreateAutoConfiguredListener@CConfigManager@@AEAAHPEAVIRequestContext@@PEAVLISTENER_IDENTITY@@@Z
?CreateInstance@?$ILoader@VAdminSid@CSecurity@@@@IEAA_NAEAVIRequestContext@@@Z
?CreateInstance@?$ILoader@VEventHandler@WSMan@@@@IEAA_NAEAVIRequestContext@@@Z
?CreateInstance@?$ILoader@VInteractiveSid@CSecurity@@@@IEAA_NAEAVIRequestContext@@@Z
?CreateInstance@?$ILoader@VIpHlpApiDllLoader@@@@IEAA_NAEAVIRequestContext@@@Z
?CreateInstance@?$ILoader@VMachineName@@@@IEAA_NAEAVIRequestContext@@@Z
?CreateInstance@?$ILoader@VNetworkServiceSid@CSecurity@@@@IEAA_NAEAVIRequestContext@@@Z
?CreateInstance@?$ILoader@VNtDsApiDllLoader@@@@IEAA_NAEAVIRequestContext@@@Z
?CreateInstance@?$ILoader@VResources@Locale@@@@IEAA_NAEAVIRequestContext@@@Z
?CreateInstance@?$ILoader@VShell32DllLoader@@@@IEAA_NAEAVIRequestContext@@@Z
?CreateInstance@?$ILoader@VShlWApiDllLoader@@@@IEAA_NAEAVIRequestContext@@@Z
?CreateInstance@?$ILoader@VSubscriptionManager@@@@IEAA_NAEAVIRequestContext@@@Z
?CreateInstance@?$ILoader@VUser32DllLoader@@@@IEAA_NAEAVIRequestContext@@@Z
?CreateInstance@?$ILoader@VWSManMemCryptManager@@@@IEAA_NAEAVIRequestContext@@@Z
?CreateKey@ConfigRegistry@@IEAAHPEAVIRequestContext@@PEBGPEAPEAUHKEY__@@1KPEAK@Z
?CreateNew@CBaseConfigCache@@CAPEAV1@PEAVIRequestContext@@PEAVCConfigCacheMap@1@P6APEAV1@XZW4ErrorLogging@@H@Z
?CreateRenderingInformation@CWSManSecurityUI@@AEAAHPEAVIRequestContext@@@Z
?CreateResponse@SoapSemanticConverter@@QEAAKKW4_MI_OperationCallback_ResponseType@@AEAVBufferFormatter@@PEAVIRequestContext@@@Z
?CreateSessionGuid@SessionId@PacketParser@@QEAAKPEBGH@Z
?Data@?$SafeMap_Iterator@PEAVCCertMapping@@UEmpty@@@@IEBAAEAV?$STLMap@PEAVCCertMapping@@UEmpty@@@@XZ
?Data@?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@IEBAAEAV?$STLMap@PEAVCListenerOperation@@UEmpty@@@@XZ
?Data@?$SafeMap_Iterator@PEAVCShellUriSettings@@UEmpty@@@@IEBAAEAV?$STLMap@PEAVCShellUriSettings@@UEmpty@@@@XZ
?Data@?$SafeMap_Iterator@PEAXUEmpty@@@@IEBAAEAV?$STLMap@PEAXUEmpty@@@@XZ
?Data@?$SafeMap_Iterator@UPluginKey@@K@@IEBAAEAV?$STLMap@UPluginKey@@K@@XZ
?Data@?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@IEBAAEAV?$STLMap@UUserKey@@PEAVBlockedRecord@@@@XZ
?Data@?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@IEBAAEAV?$STLMap@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@XZ
?Data@?$SafeMap_Iterator@VKey@Locale@@K@@IEBAAEAV?$STLMap@VKey@Locale@@K@@XZ
?Data@?$SafeMap_Iterator@VStringKeyCI@@K@@IEBAAEAV?$STLMap@VStringKeyCI@@K@@XZ
?Data@?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@IEBAAEAV?$STLMap@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@XZ
?Data@?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@IEBAAEAV?$STLMap@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@XZ
?Data@?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@IEBAAEAV?$STLMap@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@XZ
?Data@?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@IEBAAEAV?$STLMap@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@XZ
?Data@?$SafeMap_Iterator@_KPEAVSendPacketArgs@RobustConnectionBuffer@@@@IEBAAEAV?$STLMap@_KPEAVSendPacketArgs@RobustConnectionBuffer@@@@XZ
?DeInitialize@?$SafeMap@PEAVCCertMapping@@UEmpty@@V?$SafeMap_Iterator@PEAVCCertMapping@@UEmpty@@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@PEAVCCertMapping@@UEmpty@@V?$SafeSet_Iterator@PEAVCCertMapping@@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@PEAVCListenerConnect@@PEAV1@V?$SafeMap_Iterator@PEAVCListenerConnect@@PEAV1@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@PEAVCListenerReceive@@PEAV1@V?$SafeMap_Iterator@PEAVCListenerReceive@@PEAV1@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@PEAVCListenerSend@@PEAV1@V?$SafeMap_Iterator@PEAVCListenerSend@@PEAV1@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@PEAVCListenerSignal@@PEAV1@V?$SafeMap_Iterator@PEAVCListenerSignal@@PEAV1@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@PEAVCShellUriSettings@@UEmpty@@V?$SafeSet_Iterator@PEAVCShellUriSettings@@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@PEAVCollector@@UEmpty@@V?$SafeMap_Iterator@PEAVCollector@@UEmpty@@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@PEAVCollector@@UEmpty@@V?$SafeSet_Iterator@PEAVCollector@@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@PEAVHostOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVHostOperation@@UEmpty@@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@PEAVHostOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVHostOperation@@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@PEAVIOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVIOperation@@UEmpty@@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@PEAVIOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVIOperation@@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@PEAVListenerSourceSubscription@@UEmpty@@V?$SafeMap_Iterator@PEAVListenerSourceSubscription@@UEmpty@@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@PEAVListenerSourceSubscription@@UEmpty@@V?$SafeSet_Iterator@PEAVListenerSourceSubscription@@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@PEAVPushSubscription@@UEmpty@@V?$SafeMap_Iterator@PEAVPushSubscription@@UEmpty@@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@PEAVPushSubscription@@UEmpty@@V?$SafeSet_Iterator@PEAVPushSubscription@@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@PEAXUEmpty@@V?$SafeSet_Iterator@PEAX@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@UPluginKey@@KV?$SafeMap_Iterator@UPluginKey@@K@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@UUserKey@@PEAVBlockedRecord@@V?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@V?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@VGuidKey@@PEAVCListenerCommand@@V?$SafeMap_Iterator@VGuidKey@@PEAVCListenerCommand@@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@VKey@CWmiPtrCache@@VMapping@2@V?$SafeMap_Iterator@VKey@CWmiPtrCache@@VMapping@2@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@VStringKey@@PEAVListenerEvents@@V?$SafeMap_Iterator@VStringKey@@PEAVListenerEvents@@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@VStringKey@@PEAVListenerSourceSubscription@@V?$SafeMap_Iterator@VStringKey@@PEAVListenerSourceSubscription@@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@VStringKey@@UOption@WinRM_OperationOptions@@V?$SafeMap_Iterator@VStringKey@@UOption@WinRM_OperationOptions@@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@VStringKeyCI@@KV?$SafeMap_Iterator@VStringKeyCI@@K@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@VStringKeyCI@@PEAVIISEndpoint@@V?$SafeMap_Iterator@VStringKeyCI@@PEAVIISEndpoint@@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@VStringKeyCI@@UEmpty@@V?$SafeMap_Iterator@VStringKeyCI@@UEmpty@@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@VStringKeyCI@@UEmpty@@V?$SafeSet_Iterator@VStringKeyCI@@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@V?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@VStringKeyStore@@PEAVExpiredOperationIdRecord@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@VStringKeyStore@@PEAVServerFullDuplexChannel@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@VTokenCacheKey@ServiceSoapProcessor@@VTokenCacheMapping@2@V?$SafeMap_Iterator@VTokenCacheKey@ServiceSoapProcessor@@VTokenCacheMapping@2@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@_KPEAVSendPacketArgs@RobustConnectionBuffer@@V?$SafeMap_Iterator@_KPEAVSendPacketArgs@RobustConnectionBuffer@@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@CWSManGroupPolicyManager@@AEAAHXZ
?DeInitialize@EventHandler@WSMan@@QEAA_NAEAVIRequestContext@@@Z
?Debug@ExtendedSemantic@@2KB
?Decode@PacketFormatter@@QEBAKPEAPEAVPacket@@_N@Z
?DecodeFaultObject@CRequestContext@@AEAAKPEAU_FWXML_ELEMENT@@AEAPEBG11@Z
?DecodeFaultObject@CRequestContext@@AEAAKPEBGKAEAPEBG11@Z
?DecodeFaultObjectProvider@CRequestContext@@AEAAKPEAU_FWXML_ELEMENT@@AEAPEBG1@Z
?DecodeFaultObjectProviderMessage@CRequestContext@@AEAAKPEAU_FWXML_ELEMENT@@AEAPEBG@Z
?DecodeFaultReason@CRequestContext@@AEAAKPEAU_FWXML_ELEMENT@@AEAPEBG@Z
?DecreaseProfileCount@UserRecord@@QEAAXXZ
?DeleteConfigKey@ConfigRegistry@@KAHPEAVIRequestContext@@PEBG1H@Z
?DeleteCredentialsFromCredmanStore@CConfigManager@@SAHPEAVIRequestContext@@PEAG@Z
?DeleteKey@@YAHPEAVIRequestContext@@PEBG1@Z
?DeleteKey@ConfigRegistry@@KAHPEAVIRequestContext@@PEBGH@Z
?DeleteSubkeys@ConfigRegistry@@KAHPEAVIRequestContext@@PEAUHKEY__@@PEBGHH@Z
?DeleteValues@ConfigRegistry@@KAHPEAVIRequestContext@@PEAUHKEY__@@@Z
?Detach@?$AutoCleanup@V?$AutoDelete@G@@PEAG@@QEAAPEAGXZ
?Detach@?$AutoCleanup@V?$AutoDelete@UIPRange@CWSManIPFilter@@@@PEAUIPRange@CWSManIPFilter@@@@QEAAPEAUIPRange@CWSManIPFilter@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@U_WSMAN_STREAM_ID_SET@@@@PEAU_WSMAN_STREAM_ID_SET@@@@QEAAPEAU_WSMAN_STREAM_ID_SET@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@V?$Handle@VISubscription@@@@@@PEAV?$Handle@VISubscription@@@@@@QEAAPEAV?$Handle@VISubscription@@@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@V?$SafeSet@PEAVCCertMapping@@@@@@PEAV?$SafeSet@PEAVCCertMapping@@@@@@QEAAPEAV?$SafeSet@PEAVCCertMapping@@@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@V?$SafeSet@PEAVCShellUriSettings@@@@@@PEAV?$SafeSet@PEAVCShellUriSettings@@@@@@QEAAPEAV?$SafeSet@PEAVCShellUriSettings@@@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@V?$set@PEAVCListenerSettings@@VCListenerSettingsLessFunctor@CServiceConfigSettings@@V?$transport_allocator@PEAVCListenerSettings@@@@@std@@@@PEAV?$set@PEAVCListenerSettings@@VCListenerSettingsLessFunctor@CServiceConfigSettings@@V?$transport_allocator@PEAVCListenerSettings@@@@@std@@@@QEAAPEAV?$set@PEAVCListenerSettings@@VCListenerSettingsLessFunctor@CServiceConfigSettings@@V?$transport_allocator@PEAVCListenerSettings@@@@@std@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@VAdminSid@CSecurity@@@@PEAVAdminSid@CSecurity@@@@QEAAPEAVAdminSid@CSecurity@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@VBlockedRecord@@@@PEAVBlockedRecord@@@@QEAAPEAVBlockedRecord@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@VCBaseConfigCache@@@@PEAVCBaseConfigCache@@@@QEAAPEAVCBaseConfigCache@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@VCCertMapping@@@@PEAVCCertMapping@@@@QEAAPEAVCCertMapping@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@VCListenerSettings@@@@PEAVCListenerSettings@@@@QEAAPEAVCListenerSettings@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@VCServiceWatcher@CServiceConfigCache@@@@PEAVCServiceWatcher@CServiceConfigCache@@@@QEAAPEAVCServiceWatcher@CServiceConfigCache@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@VCShellUriSettings@@@@PEAVCShellUriSettings@@@@QEAAPEAVCShellUriSettings@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@VCWSManEPR@@@@PEAVCWSManEPR@@@@QEAAPEAVCWSManEPR@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@VCWSManResource@@@@PEAVCWSManResource@@@@QEAAPEAVCWSManResource@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@VCertHash@@@@PEAVCertHash@@@@QEAAPEAVCertHash@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@VConfigUpdate@@@@PEAVConfigUpdate@@@@QEAAPEAVConfigUpdate@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@VEnumSinkEx@@@@PEAVEnumSinkEx@@@@QEAAPEAVEnumSinkEx@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@VEventHandler@WSMan@@@@PEAVEventHandler@WSMan@@@@QEAAPEAVEventHandler@WSMan@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@VExpiredOperationIdRecord@@@@PEAVExpiredOperationIdRecord@@@@QEAAPEAVExpiredOperationIdRecord@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@VGeneralSinkEx@@@@PEAVGeneralSinkEx@@@@QEAAPEAVGeneralSinkEx@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@VIQueryDASHSMASHInterface@@@@PEAVIQueryDASHSMASHInterface@@@@QEAAPEAVIQueryDASHSMASHInterface@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@VISpecification@@@@PEAVISpecification@@@@QEAAPEAVISpecification@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@VInteractiveSid@CSecurity@@@@PEAVInteractiveSid@CSecurity@@@@QEAAPEAVInteractiveSid@CSecurity@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@VIpHlpApiDllLoader@@@@PEAVIpHlpApiDllLoader@@@@QEAAPEAVIpHlpApiDllLoader@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@VMachineName@@@@PEAVMachineName@@@@QEAAPEAVMachineName@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@VNetworkServiceSid@CSecurity@@@@PEAVNetworkServiceSid@CSecurity@@@@QEAAPEAVNetworkServiceSid@CSecurity@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@VNtDsApiDllLoader@@@@PEAVNtDsApiDllLoader@@@@QEAAPEAVNtDsApiDllLoader@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@VOptionValue@SessionOptions@Client@WSMan@@@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@QEAAPEAVOptionValue@SessionOptions@Client@WSMan@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@VResources@Locale@@@@PEAVResources@Locale@@@@QEAAPEAVResources@Locale@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@VSecurityEntry@Catalog@@@@PEAVSecurityEntry@Catalog@@@@QEAAPEAVSecurityEntry@Catalog@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@VServiceSoapProcessor@@@@PEAVServiceSoapProcessor@@@@QEAAPEAVServiceSoapProcessor@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@VShell32DllLoader@@@@PEAVShell32DllLoader@@@@QEAAPEAVShell32DllLoader@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@VShlWApiDllLoader@@@@PEAVShlWApiDllLoader@@@@QEAAPEAVShlWApiDllLoader@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@VSubscriptionManager@@@@PEAVSubscriptionManager@@@@QEAAPEAVSubscriptionManager@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@VTSTRBUFFER@@@@PEAVTSTRBUFFER@@@@QEAAPEAVTSTRBUFFER@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@VUser32DllLoader@@@@PEAVUser32DllLoader@@@@QEAAPEAVUser32DllLoader@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@VWSManMemCryptManager@@@@PEAVWSManMemCryptManager@@@@QEAAPEAVWSManMemCryptManager@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@VWmiEnumContext@@@@PEAVWmiEnumContext@@@@QEAAPEAVWmiEnumContext@@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@VXmlReader@@@@PEAVXmlReader@@@@QEAAPEAVXmlReader@@XZ
?Detach@?$AutoCleanup@V?$AutoDeleteVector@$$CBG@@PEBG@@QEAAPEBGXZ
?Detach@?$AutoCleanup@V?$AutoDeleteVector@D@@PEAD@@QEAAPEADXZ
?Detach@?$AutoCleanup@V?$AutoDeleteVector@E@@PEAE@@QEAAPEAEXZ
?Detach@?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@QEAAPEAGXZ
?Detach@?$AutoCleanup@V?$AutoDeleteVector@PEAG@@PEAPEAG@@QEAAPEAPEAGXZ
?Detach@?$AutoCleanup@V?$AutoDeleteVector@PEBG@@PEAPEBG@@QEAAPEAPEBGXZ
?Detach@?$AutoCleanup@V?$AutoDeleteVector@U_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@PEAU_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@QEAAPEAU_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@XZ
?Detach@?$AutoCleanup@V?$AutoDeleteVector@U_WINRS_RUN_COMMAND_ARG@@@@PEAU_WINRS_RUN_COMMAND_ARG@@@@QEAAPEAU_WINRS_RUN_COMMAND_ARG@@XZ
?Detach@?$AutoCleanup@V?$AutoDeleteVector@U_WSMAN_OPTION@@@@PEAU_WSMAN_OPTION@@@@QEAAPEAU_WSMAN_OPTION@@XZ
?Detach@?$AutoCleanup@V?$AutoFree@E@@PEAE@@QEAAPEAEXZ
?Detach@?$AutoCleanup@V?$AutoLocklessItemRecycle@VPacket@@@@PEAVPacket@@@@QEAAPEAVPacket@@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@UIClientSecurity@@@@PEAUIClientSecurity@@@@QEAAPEAUIClientSecurity@@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@UIEnumWbemClassObject@@@@PEAUIEnumWbemClassObject@@@@QEAAPEAUIEnumWbemClassObject@@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@UIErrorInfo@@@@PEAUIErrorInfo@@@@QEAAPEAUIErrorInfo@@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@UIUnknown@@@@PEAUIUnknown@@@@QEAAPEAUIUnknown@@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@UIWbemClassObject@@@@PEAUIWbemClassObject@@@@QEAAPEAUIWbemClassObject@@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@UIWbemContext@@@@PEAUIWbemContext@@@@QEAAPEAUIWbemContext@@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@UIWbemLocator@@@@PEAUIWbemLocator@@@@QEAAPEAUIWbemLocator@@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@UIWbemObjectTextSrc@@@@PEAUIWbemObjectTextSrc@@@@QEAAPEAUIWbemObjectTextSrc@@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@UIWbemPath@@@@PEAUIWbemPath@@@@QEAAPEAUIWbemPath@@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@UIWbemPathKeyList@@@@PEAUIWbemPathKeyList@@@@QEAAPEAUIWbemPathKeyList@@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@UIWbemQualifierSet@@@@PEAUIWbemQualifierSet@@@@QEAAPEAUIWbemQualifierSet@@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@UIWbemQuery@@@@PEAUIWbemQuery@@@@QEAAPEAUIWbemQuery@@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@UIWbemServices@@@@PEAUIWbemServices@@@@QEAAPEAUIWbemServices@@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@VApplication@Client@WSMan@@@@PEAVApplication@Client@WSMan@@@@QEAAPEAVApplication@Client@WSMan@@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@VCBaseConfigCache@@@@PEAVCBaseConfigCache@@@@QEAAPEAVCBaseConfigCache@@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@VCClientConfigSettings@@@@PEAVCClientConfigSettings@@@@QEAAPEAVCClientConfigSettings@@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@VCCommonConfigSettings@@@@PEAVCCommonConfigSettings@@@@QEAAPEAVCCommonConfigSettings@@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@VCConfigManager@@@@PEAVCConfigManager@@@@QEAAPEAVCConfigManager@@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@VCRemoteSession@@@@PEAVCRemoteSession@@@@QEAAPEAVCRemoteSession@@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@VCRequestContext@@@@PEAVCRequestContext@@@@QEAAPEAVCRequestContext@@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@VCServiceConfigSettings@@@@PEAVCServiceConfigSettings@@@@QEAAPEAVCServiceConfigSettings@@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@VCWSManEPR@@@@PEAVCWSManEPR@@@@QEAAPEAVCWSManEPR@@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@VCWSManGroupPolicyCache@@@@PEAVCWSManGroupPolicyCache@@@@QEAAPEAVCWSManGroupPolicyCache@@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@VCWSManGroupPolicyManager@@@@PEAVCWSManGroupPolicyManager@@@@QEAAPEAVCWSManGroupPolicyManager@@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@VCWSManObject@@@@PEAVCWSManObject@@@@QEAAPEAVCWSManObject@@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@VCWinRSPluginConfigCache@@@@PEAVCWinRSPluginConfigCache@@@@QEAAPEAVCWinRSPluginConfigCache@@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@VCWinRSPluginConfigSettings@@@@PEAVCWinRSPluginConfigSettings@@@@QEAAPEAVCWinRSPluginConfigSettings@@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@VCommand@Client@WSMan@@@@PEAVCommand@Client@WSMan@@@@QEAAPEAVCommand@Client@WSMan@@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@VEnumSinkEx@@@@PEAVEnumSinkEx@@@@QEAAPEAVEnumSinkEx@@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@VGeneralSinkEx@@@@PEAVGeneralSinkEx@@@@QEAAPEAVGeneralSinkEx@@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@VIPCSoapProcessor@@@@PEAVIPCSoapProcessor@@@@QEAAPEAVIPCSoapProcessor@@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@VIRequestContext@@@@PEAVIRequestContext@@@@QEAAPEAVIRequestContext@@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@VReceiveOperation@Client@WSMan@@@@PEAVReceiveOperation@Client@WSMan@@@@QEAAPEAVReceiveOperation@Client@WSMan@@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@VSendOperation@Client@WSMan@@@@PEAVSendOperation@Client@WSMan@@@@QEAAPEAVSendOperation@Client@WSMan@@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@VShell@Client@WSMan@@@@PEAVShell@Client@WSMan@@@@QEAAPEAVShell@Client@WSMan@@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@VSignalOperation@Client@WSMan@@@@PEAVSignalOperation@Client@WSMan@@@@QEAAPEAVSignalOperation@Client@WSMan@@XZ
?Detach@?$AutoCleanup@VAutoBstrNoAlloc@@PEAG@@QEAAPEAGXZ
?Detach@?$AutoCleanup@VAutoCertContext@@PEBU_CERT_CONTEXT@@@@QEAAPEBU_CERT_CONTEXT@@XZ
?Detach@?$AutoCleanup@VAutoHandle@@PEAX@@QEAAPEAXXZ
?Detach@?$AutoCleanup@VAutoImpersonateUser@@PEAX@@QEAAPEAXXZ
?Detach@?$AutoCleanup@VAutoLocalFree@@PEAX@@QEAAPEAXXZ
?Detach@?$AutoCleanup@VAutoMIClass@@PEAU_MI_Class@@@@QEAAPEAU_MI_Class@@XZ
?Detach@?$AutoCleanup@VAutoMIInstance@@PEAU_MI_Instance@@@@QEAAPEAU_MI_Instance@@XZ
?Detach@?$AutoCleanup@VAutoRegKey@@PEAUHKEY__@@@@QEAAPEAUHKEY__@@XZ
?Detach@?$AutoCleanup@VAutoSecurityDescriptor@@PEAX@@QEAAPEAXXZ
?Detach@?$AutoCleanup@VAutoWaitHandle@@PEAX@@QEAAPEAXXZ
?Detach@BufferFormatter@@QEAAPEAEXZ
?Discard@CServiceWatcher@CServiceConfigCache@@QEAAXXZ
?DoOnChange@CBaseConfigCache@@IEAAXW4ConfigChangeSources@@KW4ConfigChangeSeverityType@@@Z
?DoesThreadOwnLock@CWSManCriticalSection@@QEAAHXZ
?Down@?$LoaderSerializer@VSubscriptionManager@@$01@@AEAAJXZ
?DropData@CircularBufferFormatter@@QEAAXK@Z
?DuplicateCurrentToken@CSecurity@@SAHPEAPEAXKPEAU_SECURITY_ATTRIBUTES@@W4_SECURITY_IMPERSONATION_LEVEL@@W4_TOKEN_TYPE@@H@Z
?Encode@PacketFormatter@@QEBAKPEAPEAVPacket@@@Z
?Encode@PacketFormatter@@QEBAKPEBGKPEAEKPEAPEAEPEAK_N@Z
?EndOfStream@PacketParser@@QEAAXK@Z
?EndRevertToSelf@CSecurity@@SAHPEAX@Z
?EnsureActivityIdOnThread@EventHandler@WSMan@@SAXXZ
?EnsureNoActiveCaches@CClientConfigCache@@SAXXZ
?EnsureNoActiveCaches@CServiceConfigCache@@SAXXZ
?Error@EventLog@@SAXK@Z
?Error@EventLog@@SAXKGPEAPEBG@Z
?Error@EventLog@@SAXKPEBG@Z
?ErrorAction@ExtendedSemantic@@2KB
?EventEnabled@EventHandler@WSMan@@AEAA_NAEBU_EVENT_DESCRIPTOR@@@Z
?EventProviderEnabled@EventHandler@WSMan@@AEAA_NXZ
?EventWrite@EventHandler@WSMan@@AEAAXAEBU_EVENT_DESCRIPTOR@@KPEAU_EVENT_DATA_DESCRIPTOR@@@Z
?ExtractContextId@PacketParser@@QEAAHPEAPEBGKPEBG@Z
?ExtractShellId@PacketParser@@QEAAHPEAVCRequestContext@@PEAGK@Z
?ExtractSidFromToken@CSecurity@@SAHPEAVIRequestContext@@PEAXAEAVAutoLocalFree@@@Z
?FindExisting@CBaseConfigCache@@CAPEAV1@PEAVCConfigCacheMap@1@PEBGW4ErrorLogging@@@Z
?FindMatch@CResourceAlias@@AEAAPEAU_ALIAS_INFORMATION@@PEBG@Z
?First@TSTRBUFFER@@QEBAPEBGXZ
?Format@Locale@@AEBA_NKPEAPEADPEAPEAXPEAGKGW4CallSiteId@@@Z
?FormatDataDescriptor@EventHandler@WSMan@@SAXAEAU_EVENT_DATA_DESCRIPTOR@@AEAG@Z
?FormatDataDescriptor@EventHandler@WSMan@@SAXAEAU_EVENT_DATA_DESCRIPTOR@@AEAJ@Z
?FormatDataDescriptor@EventHandler@WSMan@@SAXAEAU_EVENT_DATA_DESCRIPTOR@@AEAK@Z
?FormatDataDescriptor@EventHandler@WSMan@@SAXAEAU_EVENT_DATA_DESCRIPTOR@@PEBD@Z
?FormatDataDescriptor@EventHandler@WSMan@@SAXAEAU_EVENT_DATA_DESCRIPTOR@@PEBG@Z
?FormatWithFallback@Locale@@AEBA_NKPEAPEAD0PEAPEAXPEAGK@Z
?Free@WSManMemory@@SAXPEAXH@Z
?FreeBstr@WSManMemory@@SAXPEAGHH@Z
?FreeInstance@?$ILoader@VAdminSid@CSecurity@@@@QEAA_NAEAVIRequestContext@@_N@Z
?FreeInstance@?$ILoader@VEventHandler@WSMan@@@@QEAA_NAEAVIRequestContext@@_N@Z
?FreeInstance@?$ILoader@VInteractiveSid@CSecurity@@@@QEAA_NAEAVIRequestContext@@_N@Z
?FreeInstance@?$ILoader@VIpHlpApiDllLoader@@@@QEAA_NAEAVIRequestContext@@_N@Z
?FreeInstance@?$ILoader@VMachineName@@@@QEAA_NAEAVIRequestContext@@_N@Z
?FreeInstance@?$ILoader@VNetworkServiceSid@CSecurity@@@@QEAA_NAEAVIRequestContext@@_N@Z
?FreeInstance@?$ILoader@VNtDsApiDllLoader@@@@QEAA_NAEAVIRequestContext@@_N@Z
?FreeInstance@?$ILoader@VResources@Locale@@@@QEAA_NAEAVIRequestContext@@_N@Z
?FreeInstance@?$ILoader@VShell32DllLoader@@@@QEAA_NAEAVIRequestContext@@_N@Z
?FreeInstance@?$ILoader@VShlWApiDllLoader@@@@QEAA_NAEAVIRequestContext@@_N@Z
?FreeInstance@?$ILoader@VSubscriptionManager@@@@QEAA_NAEAVIRequestContext@@_N@Z
?FreeInstance@?$ILoader@VUser32DllLoader@@@@QEAA_NAEAVIRequestContext@@_N@Z
?FreeInstance@?$ILoader@VWSManMemCryptManager@@@@QEAA_NAEAVIRequestContext@@_N@Z
?FreeInstance@?$LoaderSerializer@VSubscriptionManager@@$01@@QEAA_NAEAVIRequestContext@@_N@Z
?FreeMemory@RBUFFER@@QEAAXXZ
?FreeMemory@SBUFFER@@QEAAXXZ
?FreePacket@PacketParser@@QEAAXXZ
?FreeXmlStructure@PacketParser@@QEAAXXZ
?GenerateTransferId@EventHandler@WSMan@@SAXAEBU_EVENT_DESCRIPTOR@@PEBU_GUID@@1@Z
?GenerateTransferIdImp@EventHandler@WSMan@@AEAAXAEBU_EVENT_DESCRIPTOR@@PEBU_GUID@@1@Z
?GetAccessRights@CWSManSecurityUI@@UEAAJPEBU_GUID@@KPEAPEAU_SI_ACCESS@@PEAK2@Z
?GetAction@PacketParser@@QEBAAEBV?$PacketElement@PEBG@1@XZ
?GetActionType@SoapSemanticConverter@@AEAA_NPEBGPEAW4_MI_OperationCallback_ResponseType@@PEAW4_MI_CallbackMode@@PEAVIRequestContext@@@Z
?GetActivityIdOnCurrentThread@EventHandler@WSMan@@SAXAEAU_GUID@@@Z
?GetBaseUri@CWSManResource@@QEAAPEBGXZ
?GetBomIndex@PacketFormatter@@QEBA?AW4Charset@1@XZ
?GetBookmarkXml@PacketParser@@QEAAAEBV?$PacketElement@PEAU_FWXML_ELEMENT@@@1@XZ
?GetBool@CConfigManager@@QEAAHPEAVIRequestContext@@W4ConfigSetting@@PEAHPEAW4WSManConfigSource@@@Z
?GetBool@CWSManGroupPolicyManager@@QEAAHPEAVIRequestContext@@W4WSManGroupPolicySetting@@PEAHPEAW4WSManGroupPolicySettingState@@@Z
?GetBuffer@BufferFormatter@@UEAAPEAEXZ
?GetBuffer@BufferFormatter@@UEBAPEBEXZ
?GetBuffer@CircularBufferFormatter@@UEAAPEAEXZ
?GetBuffer@CircularBufferFormatter@@UEBAPEBEXZ
?GetBuffer@XmlReader@@QEAAPEBGXZ
?GetBufferLength@PacketParser@@UEAAKXZ
?GetBufferPtr@PacketParser@@UEAAPEAPEAGXZ
?GetBufferSize@BufferFormatter@@QEBAKXZ
?GetCacheCount@CClientConfigCache@@SAKXZ
?GetCacheCount@CServiceConfigCache@@SAKXZ
?GetCalculationSize@BufferFormatter@@UEBAK_N@Z
?GetCalculationSize@CircularBufferFormatter@@UEBAK_N@Z
?GetCharInUse@TSTRBUFFER@@QEBAIXZ
?GetCharset@PacketFormatter@@QEBA?AW4Charset@1@XZ
?GetCharsetLen@PacketFormatter@@QEBAKXZ
?GetCharsetName@PacketFormatter@@QEBAPEBDXZ
?GetChildCount@ChildLifeTimeManager@@QEBAJXZ
?GetConfigCache@CBaseConfigCache@@KAPEAV1@PEAVIRequestContext@@W4ErrorLogging@@P6APEAV1@XZPEAVFastLock@@AEAV?$AutoRelease@VCConfigCacheMap@CBaseConfigCache@@@@H@Z
?GetConfigCache@CClientConfigCache@@SAPEAV1@PEAVIRequestContext@@H@Z
?GetConfigCache@CServiceConfigCache@@SAPEAV1@PEAVIRequestContext@@W4ErrorLogging@@H@Z
?GetConfigCache@CWinRSPluginConfigCache@@SAPEAV1@PEAVIRequestContext@@W4ErrorLogging@@H@Z
?GetConfigManager@CConfigManager@@SAPEAV1@XZ
?GetConfigManagerForCertMapping@CConfigManager@@SAPEAV1@PEAVCERTMAPPING_IDENTITY@@PEAVIRequestContext@@@Z
?GetConfigManagerForListener@CConfigManager@@SAPEAV1@PEAVLISTENER_IDENTITY@@PEAVIRequestContext@@@Z
?GetConfigManagerForShellUri@CConfigManager@@SAPEAV1@PEAVSHELLURI_IDENTITY@@PEAVIRequestContext@@@Z
?GetConfigManagerForTable@CConfigManager@@SAPEAV1@PEAVWSMANCONFIGTABLE_IDENTITY@@PEAVIRequestContext@@@Z
?GetConfigXml@CConfigManager@@QEAAHPEAVIRequestContext@@PEAPEBGPEAPEAVXmlReader@@PEAH@Z
?GetCorrelationId@PacketParser@@QEAAAEAU_GUID@@XZ
?GetCurrentCertMappingIdentity@CConfigManager@@QEAAHPEAVCERTMAPPING_IDENTITY@@PEAVIRequestContext@@@Z
?GetCurrentListenerIdentity@CConfigManager@@QEAAHPEAVLISTENER_IDENTITY@@PEAVIRequestContext@@@Z
?GetCurrentSettings@CBaseConfigCache@@IEAAPEAVCCommonConfigSettings@@PEAVIRequestContext@@@Z
?GetCurrentSettings@CClientConfigCache@@QEAAPEAVCClientConfigSettings@@PEAVIRequestContext@@@Z
?GetCurrentSettings@CServiceConfigCache@@QEAAPEAVCServiceConfigSettings@@PEAVIRequestContext@@@Z
?GetCurrentSettings@CWinRSPluginConfigCache@@QEAAPEAVCWinRSPluginConfigSettings@@PEAVIRequestContext@@@Z
?GetCurrentShellUriIdentity@CConfigManager@@QEAAHPEAVSHELLURI_IDENTITY@@PEAVIRequestContext@@@Z
?GetCurrentTableIdentity@CConfigManager@@QEAAHPEAVWSMANCONFIGTABLE_IDENTITY@@PEAVIRequestContext@@@Z
?GetDataLocale@PacketParser@@QEBAAEBV?$PacketElement@PEBG@1@XZ
?GetDataLocaleHelper@PacketParser@@QEAAAEAVLocale@@XZ
?GetDescriptionElement@SoapSemanticConverter@@QEAAPEAU_FWXML_ELEMENT@@PEAU2@PEAVIRequestContext@@@Z
?GetDestructorIter@?$SafeMap@PEAVCCertMapping@@UEmpty@@V?$SafeSet_Iterator@PEAVCCertMapping@@@@@@QEAAAEAV?$SafeSet_Iterator@PEAVCCertMapping@@@@XZ
?GetDestructorIter@?$SafeMap@PEAVCShellUriSettings@@UEmpty@@V?$SafeSet_Iterator@PEAVCShellUriSettings@@@@@@QEAAAEAV?$SafeSet_Iterator@PEAVCShellUriSettings@@@@XZ
?GetDestructorIter@?$SafeMap@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@V?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@@@QEAAAEAV?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@XZ
?GetDestructorIter@?$SafeMap@VStringKeyStore@@PEAVExpiredOperationIdRecord@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@@@QEAAAEAV?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@XZ
?GetDestructorIter@?$SafeMap@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@QEAAAEAV?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@XZ
?GetDialect@Fragment@PacketParser@@QEBAPEBGXZ
?GetError@BufferFormatter@@QEBAKXZ
?GetErrorCode@CErrorContext@@UEBAKXZ
?GetEventType@SoapSemanticConverter@@AEAAKPEBGPEAVIRequestContext@@@Z
?GetEventTypeAndResponseElement@SoapSemanticConverter@@AEAAPEAU_FWXML_ELEMENT@@PEAU2@PEAKPEAVIRequestContext@@@Z
?GetExtendedErrorString@CErrorContext@@UEAAPEAGXZ
?GetExtendedErrorString@CRequestContext@@UEAAPEAGXZ
?GetFaultToXml@PacketParser@@QEBAAEBVReferenceParameters@1@XZ
?GetFaultXML@CErrorContext@@UEBAPEBGXZ
?GetFaultXML@CRequestContext@@UEBAPEBGXZ
?GetFaultXMLPrivate@CRequestContext@@AEAAXPEAPEAD0KHKKPEBG11@Z
?GetFirstConfigManagerForCertMapping@CConfigManager@@SAPEAV1@PEBG@Z
?GetFirstConfigManagerForListener@CConfigManager@@SAPEAV1@PEBG@Z
?GetFirstConfigManagerForShellUri@CConfigManager@@SAPEAV1@PEBG@Z
?GetFirstConfigManagerForTable@CConfigManager@@SAPEAV1@W4WSMANTableConfigType@@PEBG@Z
?GetFormat@PacketFormatter@@QEBA?AW4Charset@1@XZ
?GetFormatterMode@BufferFormatter@@QEAA?AW4Charset@PacketFormatter@@XZ
?GetFragment@PacketParser@@QEBAAEBVFragment@1@XZ
?GetFragmentDialect@CWSManResourceNoResourceUri@@QEAAPEBGXZ
?GetFragmentPath@CWSManResourceNoResourceUri@@QEAAPEBGXZ
?GetGroupPolicyManager@CWSManGroupPolicyManager@@SAPEAV1@PEAVIRequestContext@@PEBG@Z
?GetHeap@WSManMemory@@SAPEAXXZ
?GetIISConfiguration@CConfigManager@@SAHPEAVIRequestContext@@PEBGPEAPEAVXmlReader@@@Z
?GetImpersonationToken@UserRecord@@QEAAPEAXXZ
?GetInheritTypes@CWSManSecurityUI@@UEAAJPEAPEAU_SI_INHERIT_TYPE@@PEAK@Z
?GetInitError@CWSManCriticalSection@@QEBAKXZ
?GetInstance@?$LoaderSerializer@VAdminSid@CSecurity@@$00@@QEAAPEAVAdminSid@CSecurity@@AEAVIRequestContext@@@Z
?GetInstance@?$LoaderSerializer@VEventHandler@WSMan@@$00@@QEAAPEAVEventHandler@WSMan@@AEAVIRequestContext@@@Z
?GetInstance@?$LoaderSerializer@VInteractiveSid@CSecurity@@$00@@QEAAPEAVInteractiveSid@CSecurity@@AEAVIRequestContext@@@Z
?GetInstance@?$LoaderSerializer@VIpHlpApiDllLoader@@$00@@QEAAPEAVIpHlpApiDllLoader@@AEAVIRequestContext@@@Z
?GetInstance@?$LoaderSerializer@VMachineName@@$00@@QEAAPEAVMachineName@@AEAVIRequestContext@@@Z
?GetInstance@?$LoaderSerializer@VNetworkServiceSid@CSecurity@@$00@@QEAAPEAVNetworkServiceSid@CSecurity@@AEAVIRequestContext@@@Z
?GetInstance@?$LoaderSerializer@VNtDsApiDllLoader@@$00@@QEAAPEAVNtDsApiDllLoader@@AEAVIRequestContext@@@Z
?GetInstance@?$LoaderSerializer@VResources@Locale@@$0A@@@QEAAPEAVResources@Locale@@AEAVIRequestContext@@@Z
?GetInstance@?$LoaderSerializer@VShell32DllLoader@@$00@@QEAAPEAVShell32DllLoader@@AEAVIRequestContext@@@Z
?GetInstance@?$LoaderSerializer@VShlWApiDllLoader@@$00@@QEAAPEAVShlWApiDllLoader@@AEAVIRequestContext@@@Z
?GetInstance@?$LoaderSerializer@VSubscriptionManager@@$01@@QEAAPEAVSubscriptionManager@@AEAVIRequestContext@@@Z
?GetInstance@?$LoaderSerializer@VUser32DllLoader@@$00@@QEAAPEAVUser32DllLoader@@AEAVIRequestContext@@@Z
?GetInstance@?$LoaderSerializer@VWSManMemCryptManager@@$00@@QEAAPEAVWSManMemCryptManager@@AEAVIRequestContext@@@Z
?GetInt@CConfigManager@@QEAAHPEAVIRequestContext@@W4ConfigSetting@@PEAKPEAW4WSManConfigSource@@@Z
?GetInt@CWSManGroupPolicyManager@@QEAAHPEAVIRequestContext@@W4WSManGroupPolicySetting@@PEAKPEAW4WSManGroupPolicySettingState@@@Z
?GetKey@UserRecord@@QEBA?AUUserKey@@XZ
?GetKeyCount@CWSManResourceNoResourceUri@@QEAAKXZ
?GetKeyValue@CWSManResourceNoResourceUri@@QEAAPEBGPEBG@Z
?GetKeys@CWSManResourceNoResourceUri@@QEAAPEAU_WSMAN_KEY@@XZ
?GetLCID@Locale@@QEAAKXZ
?GetLength@XmlReader@@QEAA_KXZ
?GetLocale@CRequestContext@@QEAAAEAVLocale@@XZ
?GetLocale@PacketParser@@QEBAAEBV?$PacketElement@PEBG@1@XZ
?GetLocaleHelper@PacketParser@@QEAAAEAVLocale@@XZ
?GetLocaleString@CRequestContext@@QEAAPEBGXZ
?GetLocator@CWSManResource@@QEAAPEAU_WSMAN_RESOURCE_LOCATOR@@XZ
?GetMachineId@PacketParser@@QEBAAEBV?$PacketElement@PEBG@1@XZ
?GetMap@?$SafeMap_Iterator@PEAVCCertMapping@@UEmpty@@@@QEBAAEAV?$SafeMap@PEAVCCertMapping@@UEmpty@@V?$SafeMap_Iterator@PEAVCCertMapping@@UEmpty@@@@@@XZ
?GetMap@?$SafeMap_Iterator@PEAVCListenerConnect@@PEAV1@@@QEBAAEAV?$SafeMap@PEAVCListenerConnect@@PEAV1@V?$SafeMap_Iterator@PEAVCListenerConnect@@PEAV1@@@@@XZ
?GetMap@?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@QEBAAEAV?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@@@XZ
?GetMap@?$SafeMap_Iterator@PEAVCListenerReceive@@PEAV1@@@QEBAAEAV?$SafeMap@PEAVCListenerReceive@@PEAV1@V?$SafeMap_Iterator@PEAVCListenerReceive@@PEAV1@@@@@XZ
?GetMap@?$SafeMap_Iterator@PEAVCListenerSend@@PEAV1@@@QEBAAEAV?$SafeMap@PEAVCListenerSend@@PEAV1@V?$SafeMap_Iterator@PEAVCListenerSend@@PEAV1@@@@@XZ
?GetMap@?$SafeMap_Iterator@PEAVCListenerSignal@@PEAV1@@@QEBAAEAV?$SafeMap@PEAVCListenerSignal@@PEAV1@V?$SafeMap_Iterator@PEAVCListenerSignal@@PEAV1@@@@@XZ
?GetMap@?$SafeMap_Iterator@PEAVCShellUriSettings@@UEmpty@@@@QEBAAEAV?$SafeMap@PEAVCShellUriSettings@@UEmpty@@V?$SafeMap_Iterator@PEAVCShellUriSettings@@UEmpty@@@@@@XZ
?GetMap@?$SafeMap_Iterator@PEAVCollector@@UEmpty@@@@QEBAAEAV?$SafeMap@PEAVCollector@@UEmpty@@V?$SafeMap_Iterator@PEAVCollector@@UEmpty@@@@@@XZ
?GetMap@?$SafeMap_Iterator@PEAVHostOperation@@UEmpty@@@@QEBAAEAV?$SafeMap@PEAVHostOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVHostOperation@@UEmpty@@@@@@XZ
?GetMap@?$SafeMap_Iterator@PEAVIOperation@@UEmpty@@@@QEBAAEAV?$SafeMap@PEAVIOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVIOperation@@UEmpty@@@@@@XZ
?GetMap@?$SafeMap_Iterator@PEAVListenerSourceSubscription@@UEmpty@@@@QEBAAEAV?$SafeMap@PEAVListenerSourceSubscription@@UEmpty@@V?$SafeMap_Iterator@PEAVListenerSourceSubscription@@UEmpty@@@@@@XZ
?GetMap@?$SafeMap_Iterator@PEAVPushSubscription@@UEmpty@@@@QEBAAEAV?$SafeMap@PEAVPushSubscription@@UEmpty@@V?$SafeMap_Iterator@PEAVPushSubscription@@UEmpty@@@@@@XZ
?GetMap@?$SafeMap_Iterator@PEAXUEmpty@@@@QEBAAEAV?$SafeMap@PEAXUEmpty@@V?$SafeMap_Iterator@PEAXUEmpty@@@@@@XZ
?GetMap@?$SafeMap_Iterator@UPluginKey@@K@@QEBAAEAV?$SafeMap@UPluginKey@@KV?$SafeMap_Iterator@UPluginKey@@K@@@@XZ
?GetMap@?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@QEBAAEAV?$SafeMap@UUserKey@@PEAVBlockedRecord@@V?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@@@XZ
?GetMap@?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@QEBAAEAV?$SafeMap@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@V?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@@@XZ
?GetMap@?$SafeMap_Iterator@VGuidKey@@PEAVCListenerCommand@@@@QEBAAEAV?$SafeMap@VGuidKey@@PEAVCListenerCommand@@V?$SafeMap_Iterator@VGuidKey@@PEAVCListenerCommand@@@@@@XZ
?GetMap@?$SafeMap_Iterator@VKey@Locale@@K@@QEBAAEAV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@XZ
?GetMap@?$SafeMap_Iterator@VStringKeyCI@@K@@QEBAAEAV?$SafeMap@VStringKeyCI@@KV?$SafeMap_Iterator@VStringKeyCI@@K@@@@XZ
?GetMap@?$SafeMap_Iterator@VStringKeyCI@@UEmpty@@@@QEBAAEAV?$SafeMap@VStringKeyCI@@UEmpty@@V?$SafeMap_Iterator@VStringKeyCI@@UEmpty@@@@@@XZ
?GetMap@?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@QEBAAEAV?$SafeMap@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@V?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@@@XZ
?GetMap@?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@QEBAAEAV?$SafeMap@VStringKeyStore@@PEAVExpiredOperationIdRecord@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@@@XZ
?GetMap@?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@QEBAAEAV?$SafeMap@VStringKeyStore@@PEAVServerFullDuplexChannel@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@@@XZ
?GetMap@?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@QEBAAEAV?$SafeMap@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@XZ
?GetMap@?$SafeMap_Iterator@_KPEAVSendPacketArgs@RobustConnectionBuffer@@@@QEBAAEAV?$SafeMap@_KPEAVSendPacketArgs@RobustConnectionBuffer@@V?$SafeMap_Iterator@_KPEAVSendPacketArgs@RobustConnectionBuffer@@@@@@XZ
?GetMap@?$SafeMap_Lock@PEAVCCertMapping@@UEmpty@@V?$SafeMap_Iterator@PEAVCCertMapping@@UEmpty@@@@@@QEBAAEBV?$SafeMap@PEAVCCertMapping@@UEmpty@@V?$SafeMap_Iterator@PEAVCCertMapping@@UEmpty@@@@@@XZ
?GetMap@?$SafeMap_Lock@PEAVCListenerConnect@@PEAV1@V?$SafeMap_Iterator@PEAVCListenerConnect@@PEAV1@@@@@QEBAAEBV?$SafeMap@PEAVCListenerConnect@@PEAV1@V?$SafeMap_Iterator@PEAVCListenerConnect@@PEAV1@@@@@XZ
?GetMap@?$SafeMap_Lock@PEAVCListenerOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@@@QEBAAEBV?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@@@XZ
?GetMap@?$SafeMap_Lock@PEAVCListenerReceive@@PEAV1@V?$SafeMap_Iterator@PEAVCListenerReceive@@PEAV1@@@@@QEBAAEBV?$SafeMap@PEAVCListenerReceive@@PEAV1@V?$SafeMap_Iterator@PEAVCListenerReceive@@PEAV1@@@@@XZ
?GetMap@?$SafeMap_Lock@PEAVCListenerSend@@PEAV1@V?$SafeMap_Iterator@PEAVCListenerSend@@PEAV1@@@@@QEBAAEBV?$SafeMap@PEAVCListenerSend@@PEAV1@V?$SafeMap_Iterator@PEAVCListenerSend@@PEAV1@@@@@XZ
?GetMap@?$SafeMap_Lock@PEAVCListenerSignal@@PEAV1@V?$SafeMap_Iterator@PEAVCListenerSignal@@PEAV1@@@@@QEBAAEBV?$SafeMap@PEAVCListenerSignal@@PEAV1@V?$SafeMap_Iterator@PEAVCListenerSignal@@PEAV1@@@@@XZ
?GetMap@?$SafeMap_Lock@PEAVCShellUriSettings@@UEmpty@@V?$SafeMap_Iterator@PEAVCShellUriSettings@@UEmpty@@@@@@QEBAAEBV?$SafeMap@PEAVCShellUriSettings@@UEmpty@@V?$SafeMap_Iterator@PEAVCShellUriSettings@@UEmpty@@@@@@XZ
?GetMap@?$SafeMap_Lock@PEAVCollector@@UEmpty@@V?$SafeMap_Iterator@PEAVCollector@@UEmpty@@@@@@QEBAAEBV?$SafeMap@PEAVCollector@@UEmpty@@V?$SafeMap_Iterator@PEAVCollector@@UEmpty@@@@@@XZ
?GetMap@?$SafeMap_Lock@PEAVHostOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVHostOperation@@UEmpty@@@@@@QEBAAEBV?$SafeMap@PEAVHostOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVHostOperation@@UEmpty@@@@@@XZ
?GetMap@?$SafeMap_Lock@PEAVIOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVIOperation@@UEmpty@@@@@@QEBAAEBV?$SafeMap@PEAVIOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVIOperation@@UEmpty@@@@@@XZ
?GetMap@?$SafeMap_Lock@PEAVListenerSourceSubscription@@UEmpty@@V?$SafeMap_Iterator@PEAVListenerSourceSubscription@@UEmpty@@@@@@QEBAAEBV?$SafeMap@PEAVListenerSourceSubscription@@UEmpty@@V?$SafeMap_Iterator@PEAVListenerSourceSubscription@@UEmpty@@@@@@XZ
?GetMap@?$SafeMap_Lock@PEAVPushSubscription@@UEmpty@@V?$SafeMap_Iterator@PEAVPushSubscription@@UEmpty@@@@@@QEBAAEBV?$SafeMap@PEAVPushSubscription@@UEmpty@@V?$SafeMap_Iterator@PEAVPushSubscription@@UEmpty@@@@@@XZ
?GetMap@?$SafeMap_Lock@PEAXUEmpty@@V?$SafeMap_Iterator@PEAXUEmpty@@@@@@QEBAAEBV?$SafeMap@PEAXUEmpty@@V?$SafeMap_Iterator@PEAXUEmpty@@@@@@XZ
?GetMap@?$SafeMap_Lock@UPluginKey@@KV?$SafeMap_Iterator@UPluginKey@@K@@@@QEBAAEBV?$SafeMap@UPluginKey@@KV?$SafeMap_Iterator@UPluginKey@@K@@@@XZ
?GetMap@?$SafeMap_Lock@UUserKey@@PEAVBlockedRecord@@V?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@@@QEBAAEBV?$SafeMap@UUserKey@@PEAVBlockedRecord@@V?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@@@XZ
?GetMap@?$SafeMap_Lock@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@V?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@@@QEBAAEBV?$SafeMap@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@V?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@@@XZ
?GetMap@?$SafeMap_Lock@VGuidKey@@PEAVCListenerCommand@@V?$SafeMap_Iterator@VGuidKey@@PEAVCListenerCommand@@@@@@QEBAAEBV?$SafeMap@VGuidKey@@PEAVCListenerCommand@@V?$SafeMap_Iterator@VGuidKey@@PEAVCListenerCommand@@@@@@XZ
?GetMap@?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEBAAEBV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@XZ
?GetMap@?$SafeMap_Lock@VStringKeyCI@@KV?$SafeMap_Iterator@VStringKeyCI@@K@@@@QEBAAEBV?$SafeMap@VStringKeyCI@@KV?$SafeMap_Iterator@VStringKeyCI@@K@@@@XZ
?GetMap@?$SafeMap_Lock@VStringKeyCI@@UEmpty@@V?$SafeMap_Iterator@VStringKeyCI@@UEmpty@@@@@@QEBAAEBV?$SafeMap@VStringKeyCI@@UEmpty@@V?$SafeMap_Iterator@VStringKeyCI@@UEmpty@@@@@@XZ
?GetMap@?$SafeMap_Lock@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@V?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@@@QEBAAEBV?$SafeMap@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@V?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@@@XZ
?GetMap@?$SafeMap_Lock@VStringKeyStore@@PEAVExpiredOperationIdRecord@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@@@QEBAAEBV?$SafeMap@VStringKeyStore@@PEAVExpiredOperationIdRecord@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@@@XZ
?GetMap@?$SafeMap_Lock@VStringKeyStore@@PEAVServerFullDuplexChannel@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@@@QEBAAEBV?$SafeMap@VStringKeyStore@@PEAVServerFullDuplexChannel@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@@@XZ
?GetMap@?$SafeMap_Lock@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@QEBAAEBV?$SafeMap@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@XZ
?GetMap@?$SafeMap_Lock@_KPEAVSendPacketArgs@RobustConnectionBuffer@@V?$SafeMap_Iterator@_KPEAVSendPacketArgs@RobustConnectionBuffer@@@@@@QEBAAEBV?$SafeMap@_KPEAVSendPacketArgs@RobustConnectionBuffer@@V?$SafeMap_Iterator@_KPEAVSendPacketArgs@RobustConnectionBuffer@@@@@@XZ
?GetMaxBatchItems@CCommonConfigSettings@@UEAAKXZ
?GetMaxBatchSize@CCommonConfigSettings@@UEAAKXZ
?GetMaxEnvelopeSize@CCommonConfigSettings@@UEAAKXZ
?GetMaxEnvelopeSize@PacketParser@@QEBAAEBV?$PacketElement@K@1@XZ
?GetMaxTimeOut@CCommonConfigSettings@@UEAAKXZ
?GetMessageAlloc@Locale@@QEBAPEBGAEAVAutoLocalFree@@KZZ
?GetMessageEmpty@Locale@@QEBAPEBGAEAVAutoLocalFree@@K@Z
?GetMessageId@CErrorContext@@UEBAKXZ
?GetMessageId@CRequestContext@@UEBAKXZ
?GetMessageId@PacketParser@@QEBAAEBV?$PacketElement@PEBG@1@XZ
?GetMessageW@Locale@@QEBA_NKPEAPEAD0PEAGK@Z
?GetMinBatchItems@CCommonConfigSettings@@UEAAKXZ
?GetMinBatchSize@CCommonConfigSettings@@UEAAKXZ
?GetMinBatchTimeout@CCommonConfigSettings@@UEAAKXZ
?GetMinEnvelopeSize@CCommonConfigSettings@@UEAAKXZ
?GetMinTimeOut@CCommonConfigSettings@@UEAAKXZ
?GetNamespacePrefix@NotUnderstandSoapHeader@PacketParser@@QEBAPEBGXZ
?GetNamespaceUrl@NotUnderstandSoapHeader@PacketParser@@QEBAPEBGXZ
?GetNewStorage@RBUFFER@@IEAAHI@Z
?GetNotUnderstandHeader@PacketParser@@QEBAAEBVNotUnderstandSoapHeader@1@XZ
?GetObjectInformation@CWSManSecurityUI@@UEAAJPEAU_SI_OBJECT_INFO@@@Z
?GetObjectW@?$ILoader@VAdminSid@CSecurity@@@@IEBAPEAVAdminSid@CSecurity@@XZ
?GetObjectW@?$ILoader@VEventHandler@WSMan@@@@IEBAPEAVEventHandler@WSMan@@XZ
?GetObjectW@?$ILoader@VInteractiveSid@CSecurity@@@@IEBAPEAVInteractiveSid@CSecurity@@XZ
?GetObjectW@?$ILoader@VIpHlpApiDllLoader@@@@IEBAPEAVIpHlpApiDllLoader@@XZ
?GetObjectW@?$ILoader@VMachineName@@@@IEBAPEAVMachineName@@XZ
?GetObjectW@?$ILoader@VNetworkServiceSid@CSecurity@@@@IEBAPEAVNetworkServiceSid@CSecurity@@XZ
?GetObjectW@?$ILoader@VNtDsApiDllLoader@@@@IEBAPEAVNtDsApiDllLoader@@XZ
?GetObjectW@?$ILoader@VResources@Locale@@@@IEBAPEAVResources@Locale@@XZ
?GetObjectW@?$ILoader@VShell32DllLoader@@@@IEBAPEAVShell32DllLoader@@XZ
?GetObjectW@?$ILoader@VShlWApiDllLoader@@@@IEBAPEAVShlWApiDllLoader@@XZ
?GetObjectW@?$ILoader@VSubscriptionManager@@@@IEBAPEAVSubscriptionManager@@XZ
?GetObjectW@?$ILoader@VUser32DllLoader@@@@IEBAPEAVUser32DllLoader@@XZ
?GetObjectW@?$ILoader@VWSManMemCryptManager@@@@IEBAPEAVWSManMemCryptManager@@XZ
?GetOperationId@PacketParser@@QEBAAEBV?$PacketElement@PEBG@1@XZ
?GetOptionCount@CWSManResourceNoResourceUri@@QEAAKXZ
?GetOptionTypes@CWSManResourceNoResourceUri@@QEAAPEAPEBGXZ
?GetOptionValue@CWSManResourceNoResourceUri@@QEAAPEBGPEBG@Z
?GetOptions@CWSManResourceNoResourceUri@@QEAAPEAU_WSMAN_OPTION@@XZ
?GetOptionsMustUnderstandValue@CWSManResourceNoResourceUri@@QEAAHXZ
?GetOptionsSetXml@PacketParser@@QEAAAEBV?$PacketElement@PEAU_FWXML_ELEMENT@@@1@XZ
?GetOriginalUri@CWSManResource@@QEAAPEBGXZ
?GetPacket@PacketParser@@QEAAPEAVPacket@@XZ
?GetPacketPool@PacketParser@@QEAAAEAVPacketPool@@XZ
?GetParser@XmlReader@@QEAAPEAXXZ
?GetPath@Fragment@PacketParser@@QEBAPEBGXZ
?GetPolicyLocation@CWSManGroupPolicyManager@@AEAAPEBGPEBU_WSMAN_POLICY_INFO@@@Z
?GetPolicyValueForConfigSetting@CConfigManager@@AEAAJW4ConfigSetting@@KPEAGPEAKPEAW4WSManGroupPolicySettingState@@PEAVIRequestContext@@@Z
?GetPolicyValueForConfigSetting@CConfigManager@@AEAAJW4ConfigSetting@@PEAKPEAW4WSManGroupPolicySettingState@@PEAVIRequestContext@@@Z
?GetProfileCount@UserRecord@@QEAAJXZ
?GetProfileHandle@UserRecord@@QEAA_JXZ
?GetPromptType@SoapSemanticConverter@@AEAA_NPEBGPEAW4_MI_PromptType@@PEAVIRequestContext@@@Z
?GetQuotaRecord@UserRecord@@QEBAPEBVQuotaRecord@@XZ
?GetRefCount@ILifeTimeMgmt@@QEAAJXZ
?GetReferenceParameters@ReferenceParameters@PacketParser@@QEBAPEBGXZ
?GetReferenceProperties@ReferenceParameters@PacketParser@@QEBAPEBGXZ
?GetRemainderPacket@PacketParser@@QEAAPEAVPacket@@PEAVIRequestContext@@@Z
?GetReplyToXml@PacketParser@@QEBAAEBVReferenceParameters@1@XZ
?GetRequestedDataLocale@PacketParser@@QEBAAEBV?$PacketElement@PEBG@1@XZ
?GetRequestedLocale@PacketParser@@QEBAAEBV?$PacketElement@PEBG@1@XZ
?GetResourceUri@PacketParser@@QEBAAEBV?$PacketElement@PEBG@1@XZ
?GetRoot@XmlReader@@QEAAPEAU_FWXML_ELEMENT@@XZ
?GetSecurity@CWSManSecurityUI@@UEAAJKPEAPEAXH@Z
?GetSecurityDescriptor@CConfigManager@@QEAAHPEAVIRequestContext@@W4ConfigSetting@@PEAPEAXPEAW4WSManConfigSource@@@Z
?GetSelectorSetXml@PacketParser@@QEAAAEBV?$PacketElement@PEAU_FWXML_ELEMENT@@@1@XZ
?GetSequenceId@PacketParser@@QEBAAEBV?$PacketElement@_K@1@XZ
?GetSessionId@PacketParser@@QEBAAEBV?$PacketElement@PEBG@1@XZ
?GetSessionIdGuid@PacketParser@@QEAAAEAU_GUID@@XZ
?GetSessionIdGuid@SessionId@PacketParser@@QEAAAEAU_GUID@@XZ
?GetSetting@CConfigManager@@QEAAHPEAVIRequestContext@@W4ConfigSetting@@KPEAGPEAKPEAW4WSManConfigSource@@@Z
?GetShellCompressionType@PacketParser@@QEBAAEBV?$PacketElement@PEBG@1@XZ
?GetSid@CSecurity@@SAPEAXXZ
?GetSizeInUse@SBUFFER@@QEBAIXZ
?GetSoapBody@PacketParser@@QEAAPEAU_FWXML_ELEMENT@@XZ
?GetSoapHeaders@PacketParser@@QEAAPEAU_FWXML_ELEMENT@@XZ
?GetSourceSubscriptionId@PacketParser@@QEBAAEBV?$PacketElement@PEBG@1@XZ
?GetSpaceUsed@BufferFormatter@@UEBAK_N@Z
?GetSpaceUsed@CircularBufferFormatter@@UEBAK_N@Z
?GetStrPtr@TSTRBUFFER@@QEAAPEAGXZ
?GetString@CConfigManager@@QEAAHPEAVIRequestContext@@W4ConfigSetting@@KPEAGPEAKPEAW4WSManConfigSource@@@Z
?GetString@CWSManGroupPolicyManager@@QEAAHPEAVIRequestContext@@W4WSManGroupPolicySetting@@KPEAGPEAKPEAW4WSManGroupPolicySettingState@@@Z
?GetString@Locale@@QEAAPEBGXZ
?GetStringInternal@CConfigManager@@AEAAHPEAVIRequestContext@@W4ConfigSetting@@KKPEAGPEAKPEAW4WSManConfigSource@@@Z
?GetStringInternal@CWSManGroupPolicyManager@@AEAAHPEAVIRequestContext@@W4WSManGroupPolicySetting@@KKPEAGPEAKPEAW4WSManGroupPolicySettingState@@@Z
?GetSubscriptionId@PacketParser@@QEBAAEBV?$PacketElement@PEBG@1@XZ
?GetSuccessCode@OnHTTPInitialize@@QEBAKXZ
?GetTimeout@PacketParser@@QEBAAEBV?$PacketElement@K@1@XZ
?GetTo@PacketParser@@QEBAAEBV?$PacketElement@PEBG@1@XZ
?GetToken@CSecurity@@SAPEAXXZ
?GetToken@UserRecord@@QEAAPEAXXZ
?GetUpdatedSDDL@CWSManSecurityUI@@QEAAPEAGPEAVIRequestContext@@@Z
?GetUri@CWSManResource@@QEAAPEBGXZ
?GetUserAdministratorType@UserRecord@@QEBA?AW4AdministratorType@UserAuthzRecord@@XZ
?GetUserNameW@UserRecord@@QEAAPEBGXZ
?GetValue@?$PacketElement@K@PacketParser@@QEBAKXZ
?GetValue@?$PacketElement@PEAU_FWXML_ELEMENT@@@PacketParser@@QEBAPEAU_FWXML_ELEMENT@@XZ
?GetValue@?$PacketElement@PEBG@PacketParser@@QEBAPEBGXZ
?GetValue@?$PacketElement@_K@PacketParser@@QEBA_KXZ
?GetWsmanData@TSTRBUFFER@@QEAAXPEAU_WSMAN_DATA@@@Z
?GetXmlDoc@PacketParser@@QEAAPEAUFWXML_DOCUMENT@@XZ
?GrowBuffer@BufferFormatter@@UEAAKK@Z
?GrowBuffer@BufferFormatter@@UEAAKXZ
?GrowBuffer@CircularBufferFormatter@@UEAAKK@Z
?GrowBuffer@CircularBufferFormatter@@UEAAKXZ
?HandleAutoConfiguredListener@CConfigManager@@QEAAHPEAVIRequestContext@@PEAVLISTENER_IDENTITY@@@Z
?HasFaultXML@CRequestContext@@QEBAHXZ
?HasHtmlError@CRequestContext@@AEBAHXZ
?HasOption@CWSManResourceNoResourceUri@@QEAAHPEBG@Z
?ImpersonateUserOrSelf@CSecurity@@SAHW4CallSiteId@@PEAX@Z
?IncreaseProfileCount@UserRecord@@QEAAXXZ
?Info@EventLog@@SAXK@Z
?Info@EventLog@@SAXKGPEAPEBG@Z
?Info@EventLog@@SAXKPEBG@Z
?Init@CBaseConfigCache@@IEAAHPEAVIRequestContext@@H@Z
?Init@CWSManSecurityUI@@QEAAHPEAG0PEAVIRequestContext@@@Z
?Init@ConfigRegistry@@IEAAHXZ
?Init@XmlReader@@QEAAHPEAVIRequestContext@@PEAUWSMAN_OBJECT@@@Z
?Init@XmlReader@@QEAAHPEAVIRequestContext@@PEBG@Z
?InitCfgMgr@CConfigManager@@AEAAHPEAVWSMANCONFIGTABLE_IDENTITY@@@Z
?InitCfgMgr@CConfigManager@@AEAAHPEAVWSMANCONFIGTABLE_IDENTITY@@PEAUHKEY__@@1@Z
?InitMap@CBaseConfigCache@@CAHPEAVIRequestContext@@AEAV?$AutoRelease@VCConfigCacheMap@CBaseConfigCache@@@@@Z
?Initialize@?$SafeMap@PEAVCCertMapping@@UEmpty@@V?$SafeMap_Iterator@PEAVCCertMapping@@UEmpty@@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@PEAVCCertMapping@@UEmpty@@V?$SafeSet_Iterator@PEAVCCertMapping@@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@PEAVCListenerConnect@@PEAV1@V?$SafeMap_Iterator@PEAVCListenerConnect@@PEAV1@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@PEAVCListenerReceive@@PEAV1@V?$SafeMap_Iterator@PEAVCListenerReceive@@PEAV1@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@PEAVCListenerSend@@PEAV1@V?$SafeMap_Iterator@PEAVCListenerSend@@PEAV1@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@PEAVCListenerSignal@@PEAV1@V?$SafeMap_Iterator@PEAVCListenerSignal@@PEAV1@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@PEAVCShellUriSettings@@UEmpty@@V?$SafeSet_Iterator@PEAVCShellUriSettings@@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@PEAVCollector@@UEmpty@@V?$SafeMap_Iterator@PEAVCollector@@UEmpty@@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@PEAVCollector@@UEmpty@@V?$SafeSet_Iterator@PEAVCollector@@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@PEAVHostOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVHostOperation@@UEmpty@@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@PEAVHostOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVHostOperation@@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@PEAVIOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVIOperation@@UEmpty@@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@PEAVIOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVIOperation@@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@PEAVListenerSourceSubscription@@UEmpty@@V?$SafeMap_Iterator@PEAVListenerSourceSubscription@@UEmpty@@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@PEAVListenerSourceSubscription@@UEmpty@@V?$SafeSet_Iterator@PEAVListenerSourceSubscription@@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@PEAVPushSubscription@@UEmpty@@V?$SafeMap_Iterator@PEAVPushSubscription@@UEmpty@@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@PEAVPushSubscription@@UEmpty@@V?$SafeSet_Iterator@PEAVPushSubscription@@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@PEAXUEmpty@@V?$SafeSet_Iterator@PEAX@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@UPluginKey@@KV?$SafeMap_Iterator@UPluginKey@@K@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@UUserKey@@PEAVBlockedRecord@@V?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@V?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@VGuidKey@@PEAVCListenerCommand@@V?$SafeMap_Iterator@VGuidKey@@PEAVCListenerCommand@@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@VKey@CWmiPtrCache@@VMapping@2@V?$SafeMap_Iterator@VKey@CWmiPtrCache@@VMapping@2@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@VStringKey@@PEAVListenerEvents@@V?$SafeMap_Iterator@VStringKey@@PEAVListenerEvents@@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@VStringKey@@PEAVListenerSourceSubscription@@V?$SafeMap_Iterator@VStringKey@@PEAVListenerSourceSubscription@@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@VStringKey@@UOption@WinRM_OperationOptions@@V?$SafeMap_Iterator@VStringKey@@UOption@WinRM_OperationOptions@@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@VStringKeyCI@@KV?$SafeMap_Iterator@VStringKeyCI@@K@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@VStringKeyCI@@PEAVIISEndpoint@@V?$SafeMap_Iterator@VStringKeyCI@@PEAVIISEndpoint@@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@VStringKeyCI@@UEmpty@@V?$SafeMap_Iterator@VStringKeyCI@@UEmpty@@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@VStringKeyCI@@UEmpty@@V?$SafeSet_Iterator@VStringKeyCI@@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@V?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@VStringKeyStore@@PEAVExpiredOperationIdRecord@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@VStringKeyStore@@PEAVServerFullDuplexChannel@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@VTokenCacheKey@ServiceSoapProcessor@@VTokenCacheMapping@2@V?$SafeMap_Iterator@VTokenCacheKey@ServiceSoapProcessor@@VTokenCacheMapping@2@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@_KPEAVSendPacketArgs@RobustConnectionBuffer@@V?$SafeMap_Iterator@_KPEAVSendPacketArgs@RobustConnectionBuffer@@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap_Iterator@PEAVCCertMapping@@UEmpty@@@@QEAAAEAV1@XZ
?Initialize@?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@QEAAAEAV1@XZ
?Initialize@?$SafeMap_Iterator@PEAVCShellUriSettings@@UEmpty@@@@QEAAAEAV1@XZ
?Initialize@?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@QEAAAEAV1@XZ
?Initialize@?$SafeMap_Iterator@VStringKeyCI@@K@@QEAAAEAV1@XZ
?Initialize@?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@QEAAAEAV1@XZ
?Initialize@?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@QEAAAEAV1@XZ
?Initialize@CWSManGroupPolicyManager@@AEAAHPEAVIRequestContext@@PEBG@Z
?Initialize@EventHandler@WSMan@@QEAA_NAEAVIRequestContext@@@Z
?Initialize@UserRecord@@SAXAEAV1@AEBUInitializer@1@@Z
?InitializeSources@CBaseConfigCache@@IEAAHPEAVIRequestContext@@HH@Z
?InitializeSourcesHelper@CBaseConfigCache@@MEAAHPEAVIRequestContext@@H@Z
?InitializeSourcesHelper@CClientConfigCache@@EEAAHPEAVIRequestContext@@H@Z
?InsertAtPosition@TSTRBUFFER@@QEAAJPEBGI@Z
?InternalFailure@CErrorContext@@UEAAXKZZ
?InternalFailure@CRequestContext@@UEAAXKZZ
?InternalHResult@CErrorContext@@UEAAXKKZZ
?InternalHResult@CRequestContext@@UEAAXKKZZ
?InternalParse@CWSManEPR@@MEAAHPEAVIRequestContext@@@Z
?InternalParse@CWSManResource@@MEAAHPEAVIRequestContext@@@Z
?IsActive@ChildLifeTimeManager@@QEAA_NXZ
?IsAdmin@UserRecord@@QEBA_NXZ
?IsAutoListenerConfigurationOn@CConfigManager@@SAHPEAVIRequestContext@@PEAH@Z
?IsCIM_Error@CRequestContext@@QEAAHXZ
?IsCurrentListenerAutoConfigured@CConfigManager@@QEAAHPEAVIRequestContext@@PEAH@Z
?IsCurrentListenerCompat@CConfigManager@@QEBA_NXZ
?IsDynAlloced@RBUFFER@@IEBAHXZ
?IsEPR@CWSManEPR@@UEAAHXZ
?IsEPR@CWSManResourceNoResourceUri@@UEAAHXZ
?IsEmpty@?$ILoader@VAdminSid@CSecurity@@@@QEBA_NXZ
?IsEmpty@?$ILoader@VEventHandler@WSMan@@@@QEBA_NXZ
?IsEmpty@?$ILoader@VInteractiveSid@CSecurity@@@@QEBA_NXZ
?IsEmpty@?$ILoader@VIpHlpApiDllLoader@@@@QEBA_NXZ
?IsEmpty@?$ILoader@VMachineName@@@@QEBA_NXZ
?IsEmpty@?$ILoader@VNetworkServiceSid@CSecurity@@@@QEBA_NXZ
?IsEmpty@?$ILoader@VNtDsApiDllLoader@@@@QEBA_NXZ
?IsEmpty@?$ILoader@VResources@Locale@@@@QEBA_NXZ
?IsEmpty@?$ILoader@VShell32DllLoader@@@@QEBA_NXZ
?IsEmpty@?$ILoader@VShlWApiDllLoader@@@@QEBA_NXZ
?IsEmpty@?$ILoader@VSubscriptionManager@@@@QEBA_NXZ
?IsEmpty@?$ILoader@VUser32DllLoader@@@@QEBA_NXZ
?IsEmpty@?$ILoader@VWSManMemCryptManager@@@@QEBA_NXZ
?IsEmpty@?$SafeMap@VStringKeyCI@@KV?$SafeMap_Iterator@VStringKeyCI@@K@@@@QEBA_NXZ
?IsEmpty@?$SafeMap@VStringKeyCI@@UEmpty@@V?$SafeSet_Iterator@VStringKeyCI@@@@@@QEBA_NXZ
?IsEvent@SoapSemanticConverter@@QEAA_NPEAU_FWXML_ELEMENT@@@Z
?IsEventEnabled@EventHandler@WSMan@@SA_NAEBU_EVENT_DESCRIPTOR@@@Z
?IsEventProviderEnabled@EventHandler@WSMan@@SA_NXZ
?IsFound@?$PacketElement@K@PacketParser@@QEBAHXZ
?IsFound@?$PacketElement@PEAU_FWXML_ELEMENT@@@PacketParser@@QEBAHXZ
?IsFound@?$PacketElement@PEBG@PacketParser@@QEBAHXZ
?IsFound@?$PacketElement@_K@PacketParser@@QEBAHXZ
?IsGeneratingError@CErrorContext@@UEBA_NXZ
?IsIdentifyPacket@PacketParser@@QEBAHXZ
?IsInCommitMode@BufferFormatter@@QEAA_NXZ
?IsInteractive@UserRecord@@QEBA_NXZ
?IsLocalSystemSid@CSecurity@@SAHPEAX@Z
?IsMustUnderstand@?$PacketElement@PEBG@PacketParser@@QEBAHXZ
?IsNonOperativePacket@PacketParser@@QEBAHXZ
?IsPolicyControlledSetting@CConfigManager@@QEAAHPEAVIRequestContext@@W4ConfigSetting@@PEAH@Z
?IsRobustConnectionPacket@PacketParser@@QEBAHXZ
?IsStreamingEvent@SoapSemanticConverter@@QEAA_NPEAU_FWXML_ELEMENT@@PEAVIRequestContext@@@Z
?IsValid@?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@QEBA_NXZ
?IsValid@?$SafeMap@UPluginKey@@KV?$SafeMap_Iterator@UPluginKey@@K@@@@QEBA_NXZ
?IsValid@?$SafeMap@VStringKeyCI@@KV?$SafeMap_Iterator@VStringKeyCI@@K@@@@QEBA_NXZ
?IsValid@?$SafeMap@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@V?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@@@QEBA_NXZ
?IsValid@?$SafeMap@VStringKeyStore@@PEAVServerFullDuplexChannel@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@@@QEBA_NXZ
?IsValid@?$SafeMap@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@PEAVCCertMapping@@UEmpty@@@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@PEAVCListenerConnect@@PEAV1@@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@PEAVCListenerReceive@@PEAV1@@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@PEAVCListenerSend@@PEAV1@@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@PEAVCListenerSignal@@PEAV1@@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@PEAVCShellUriSettings@@UEmpty@@@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@PEAVCollector@@UEmpty@@@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@PEAVHostOperation@@UEmpty@@@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@PEAVIOperation@@UEmpty@@@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@PEAVListenerSourceSubscription@@UEmpty@@@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@PEAVPushSubscription@@UEmpty@@@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@PEAXUEmpty@@@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@UPluginKey@@K@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@VGuidKey@@PEAVCListenerCommand@@@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@VKey@CWmiPtrCache@@VMapping@2@@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@VKey@Locale@@K@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@VStringKey@@PEAVListenerEvents@@@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@VStringKey@@PEAVListenerSourceSubscription@@@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@VStringKey@@UOption@WinRM_OperationOptions@@@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@VStringKeyCI@@K@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@VStringKeyCI@@PEAVIISEndpoint@@@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@VStringKeyCI@@UEmpty@@@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@VTokenCacheKey@ServiceSoapProcessor@@VTokenCacheMapping@2@@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@_KPEAVSendPacketArgs@RobustConnectionBuffer@@@@QEBA_NXZ
?IsValid@CWSManCriticalSection@@QEBAHXZ
?IsValid@RBUFFER@@IEBAHXZ
?Key@?$SafeMap@VStringKeyCI@@KV?$SafeMap_Iterator@VStringKeyCI@@K@@@@QEBAPEBVStringKeyCI@@AEBV2@@Z
?Key@?$SafeMap@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@V?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@@@QEBAPEBVStringKeyCI@@AEBV2@@Z
?Key@?$SafeMap_Iterator@VKey@Locale@@K@@QEBAAEBV0Locale@@XZ
?Key@?$SafeMap_Iterator@VStringKeyCI@@K@@QEBAAEBVStringKeyCI@@XZ
?Key@?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@QEBAAEBVStringKeyCI@@XZ
?LogError@CBaseConfigCache@@UEAAXKK@Z
?LogErrorCode@CErrorContext@@QEAAXXZ
?LogErrorCode@CRequestContext@@QEAAXXZ
?LogErrorMessage@CRequestContext@@QEAAXXZ
?LogNotificationEvent@CWSManGroupPolicyManager@@CAXK@Z
?LogReadErrors@CBaseConfigCache@@IEAA?AW4ErrorLogging@@W4ConfigChangeSources@@@Z
?LowerBound@?$SafeMap_Iterator@VKey@Locale@@K@@QEAAXAEBVKey@Locale@@@Z
?MakeUrlBinding@@YAHKPEAGPEAKPEBG222@Z
?MakeUrlBinding@@YAPEAGPEAVIRequestContext@@PEBG111@Z
?MapGeneric@CWSManSecurityUI@@UEAAJPEBU_GUID@@PEAEPEAK@Z
?Me@?$AutoCleanup@V?$AutoDelete@D@@PEAD@@AEAAAEAV?$AutoDelete@D@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@G@@PEAG@@AEAAAEAV?$AutoDelete@G@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@UIPRange@CWSManIPFilter@@@@PEAUIPRange@CWSManIPFilter@@@@AEAAAEAV?$AutoDelete@UIPRange@CWSManIPFilter@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@U_SID@@@@PEAU_SID@@@@AEAAAEAV?$AutoDelete@U_SID@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@U_WSMAN_STREAM_ID_SET@@@@PEAU_WSMAN_STREAM_ID_SET@@@@AEAAAEAV?$AutoDelete@U_WSMAN_STREAM_ID_SET@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@V?$Handle@VISubscription@@@@@@PEAV?$Handle@VISubscription@@@@@@AEAAAEAV?$AutoDelete@V?$Handle@VISubscription@@@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@V?$SafeMap_Iterator@PEAVCListenerConnect@@PEAV1@@@@@PEAV?$SafeMap_Iterator@PEAVCListenerConnect@@PEAV1@@@@@AEAAAEAV?$AutoDelete@V?$SafeMap_Iterator@PEAVCListenerConnect@@PEAV1@@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@V?$SafeMap_Iterator@PEAVCListenerReceive@@PEAV1@@@@@PEAV?$SafeMap_Iterator@PEAVCListenerReceive@@PEAV1@@@@@AEAAAEAV?$AutoDelete@V?$SafeMap_Iterator@PEAVCListenerReceive@@PEAV1@@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@V?$SafeMap_Iterator@PEAVCListenerSend@@PEAV1@@@@@PEAV?$SafeMap_Iterator@PEAVCListenerSend@@PEAV1@@@@@AEAAAEAV?$AutoDelete@V?$SafeMap_Iterator@PEAVCListenerSend@@PEAV1@@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@V?$SafeMap_Iterator@PEAVCListenerSignal@@PEAV1@@@@@PEAV?$SafeMap_Iterator@PEAVCListenerSignal@@PEAV1@@@@@AEAAAEAV?$AutoDelete@V?$SafeMap_Iterator@PEAVCListenerSignal@@PEAV1@@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@V?$SafeMap_Iterator@VGuidKey@@PEAVCListenerCommand@@@@@@PEAV?$SafeMap_Iterator@VGuidKey@@PEAVCListenerCommand@@@@@@AEAAAEAV?$AutoDelete@V?$SafeMap_Iterator@VGuidKey@@PEAVCListenerCommand@@@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@V?$SafeMap_Iterator@VStringKeyCI@@K@@@@PEAV?$SafeMap_Iterator@VStringKeyCI@@K@@@@AEAAAEAV?$AutoDelete@V?$SafeMap_Iterator@VStringKeyCI@@K@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@PEAV?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@AEAAAEAV?$AutoDelete@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@V?$SafeSet@PEAVCCertMapping@@@@@@PEAV?$SafeSet@PEAVCCertMapping@@@@@@AEAAAEAV?$AutoDelete@V?$SafeSet@PEAVCCertMapping@@@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@V?$SafeSet@PEAVCShellUriSettings@@@@@@PEAV?$SafeSet@PEAVCShellUriSettings@@@@@@AEAAAEAV?$AutoDelete@V?$SafeSet@PEAVCShellUriSettings@@@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@PEAV?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@AEAAAEAV?$AutoDelete@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@V?$SafeSet_Iterator@PEAVCollector@@@@@@PEAV?$SafeSet_Iterator@PEAVCollector@@@@@@AEAAAEAV?$AutoDelete@V?$SafeSet_Iterator@PEAVCollector@@@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@V?$SafeSet_Iterator@PEAVHostOperation@@@@@@PEAV?$SafeSet_Iterator@PEAVHostOperation@@@@@@AEAAAEAV?$AutoDelete@V?$SafeSet_Iterator@PEAVHostOperation@@@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@V?$SafeSet_Iterator@PEAVListenerSourceSubscription@@@@@@PEAV?$SafeSet_Iterator@PEAVListenerSourceSubscription@@@@@@AEAAAEAV?$AutoDelete@V?$SafeSet_Iterator@PEAVListenerSourceSubscription@@@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@V?$SimpleStack@VCListenerOperation@@@@@@PEAV?$SimpleStack@VCListenerOperation@@@@@@AEAAAEAV?$AutoDelete@V?$SimpleStack@VCListenerOperation@@@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@V?$SimpleStack@VShellHostEntry@@@@@@PEAV?$SimpleStack@VShellHostEntry@@@@@@AEAAAEAV?$AutoDelete@V?$SimpleStack@VShellHostEntry@@@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@V?$queue@PEAU_WSMAN_PUBLISHER_EVENT_STRUCT@@V?$deque@PEAU_WSMAN_PUBLISHER_EVENT_STRUCT@@V?$transport_allocator@PEAU_WSMAN_PUBLISHER_EVENT_STRUCT@@@@@std@@@std@@@@PEAV?$queue@PEAU_WSMAN_PUBLISHER_EVENT_STRUCT@@V?$deque@PEAU_WSMAN_PUBLISHER_EVENT_STRUCT@@V?$transport_allocator@PEAU_WSMAN_PUBLISHER_EVENT_STRUCT@@@@@std@@@std@@@@AEAAAEAV?$AutoDelete@V?$queue@PEAU_WSMAN_PUBLISHER_EVENT_STRUCT@@V?$deque@PEAU_WSMAN_PUBLISHER_EVENT_STRUCT@@V?$transport_allocator@PEAU_WSMAN_PUBLISHER_EVENT_STRUCT@@@@@std@@@std@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@V?$set@PEAVCListenerSettings@@VCListenerSettingsLessFunctor@CServiceConfigSettings@@V?$transport_allocator@PEAVCListenerSettings@@@@@std@@@@PEAV?$set@PEAVCListenerSettings@@VCListenerSettingsLessFunctor@CServiceConfigSettings@@V?$transport_allocator@PEAVCListenerSettings@@@@@std@@@@AEAAAEAV?$AutoDelete@V?$set@PEAVCListenerSettings@@VCListenerSettingsLessFunctor@CServiceConfigSettings@@V?$transport_allocator@PEAVCListenerSettings@@@@@std@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@V?$set@Usockaddr_storage@@VSockAddrLessFunctor@CListenerSettings@@V?$transport_allocator@Usockaddr_storage@@@@@std@@@@PEAV?$set@Usockaddr_storage@@VSockAddrLessFunctor@CListenerSettings@@V?$transport_allocator@Usockaddr_storage@@@@@std@@@@AEAAAEAV?$AutoDelete@V?$set@Usockaddr_storage@@VSockAddrLessFunctor@CListenerSettings@@V?$transport_allocator@Usockaddr_storage@@@@@std@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@V?$vector@PEAVCWSManRequest@@V?$transport_allocator@PEAVCWSManRequest@@@@@std@@@@PEAV?$vector@PEAVCWSManRequest@@V?$transport_allocator@PEAVCWSManRequest@@@@@std@@@@AEAAAEAV?$AutoDelete@V?$vector@PEAVCWSManRequest@@V?$transport_allocator@PEAVCWSManRequest@@@@@std@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@V?$vector@PEAVHandleImpl@Client@WSMan@@V?$transport_allocator@PEAVHandleImpl@Client@WSMan@@@@@std@@@@PEAV?$vector@PEAVHandleImpl@Client@WSMan@@V?$transport_allocator@PEAVHandleImpl@Client@WSMan@@@@@std@@@@AEAAAEAV?$AutoDelete@V?$vector@PEAVHandleImpl@Client@WSMan@@V?$transport_allocator@PEAVHandleImpl@Client@WSMan@@@@@std@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@V?$vector@PEAVIServiceConfigObserver@@V?$transport_allocator@PEAVIServiceConfigObserver@@@@@std@@@@PEAV?$vector@PEAVIServiceConfigObserver@@V?$transport_allocator@PEAVIServiceConfigObserver@@@@@std@@@@AEAAAEAV?$AutoDelete@V?$vector@PEAVIServiceConfigObserver@@V?$transport_allocator@PEAVIServiceConfigObserver@@@@@std@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@V?$vector@PEAVWSManHttpSenderConnection@@V?$transport_allocator@PEAVWSManHttpSenderConnection@@@@@std@@@@PEAV?$vector@PEAVWSManHttpSenderConnection@@V?$transport_allocator@PEAVWSManHttpSenderConnection@@@@@std@@@@AEAAAEAV?$AutoDelete@V?$vector@PEAVWSManHttpSenderConnection@@V?$transport_allocator@PEAVWSManHttpSenderConnection@@@@@std@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VAdminSid@CSecurity@@@@PEAVAdminSid@CSecurity@@@@AEAAAEAV?$AutoDelete@VAdminSid@CSecurity@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VBlockedRecord@@@@PEAVBlockedRecord@@@@AEAAAEAV?$AutoDelete@VBlockedRecord@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VCBaseConfigCache@@@@PEAVCBaseConfigCache@@@@AEAAAEAV?$AutoDelete@VCBaseConfigCache@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VCCertMapping@@@@PEAVCCertMapping@@@@AEAAAEAV?$AutoDelete@VCCertMapping@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VCConfigChangeSource@@@@PEAVCConfigChangeSource@@@@AEAAAEAV?$AutoDelete@VCConfigChangeSource@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VCListenerSettings@@@@PEAVCListenerSettings@@@@AEAAAEAV?$AutoDelete@VCListenerSettings@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VCObserverConfigChangeErrors@@@@PEAVCObserverConfigChangeErrors@@@@AEAAAEAV?$AutoDelete@VCObserverConfigChangeErrors@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VCServiceWatcher@CServiceConfigCache@@@@PEAVCServiceWatcher@CServiceConfigCache@@@@AEAAAEAV?$AutoDelete@VCServiceWatcher@CServiceConfigCache@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VCShellUriSettings@@@@PEAVCShellUriSettings@@@@AEAAAEAV?$AutoDelete@VCShellUriSettings@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VCWSManEPR@@@@PEAVCWSManEPR@@@@AEAAAEAV?$AutoDelete@VCWSManEPR@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VCWSManResource@@@@PEAVCWSManResource@@@@AEAAAEAV?$AutoDelete@VCWSManResource@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VCertHash@@@@PEAVCertHash@@@@AEAAAEAV?$AutoDelete@VCertHash@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VConfigUpdate@@@@PEAVConfigUpdate@@@@AEAAAEAV?$AutoDelete@VConfigUpdate@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VEnumSinkEx@@@@PEAVEnumSinkEx@@@@AEAAAEAV?$AutoDelete@VEnumSinkEx@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VEventHandler@WSMan@@@@PEAVEventHandler@WSMan@@@@AEAAAEAV?$AutoDelete@VEventHandler@WSMan@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VExpiredOperationIdRecord@@@@PEAVExpiredOperationIdRecord@@@@AEAAAEAV?$AutoDelete@VExpiredOperationIdRecord@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VGPApiManager@@@@PEAVGPApiManager@@@@AEAAAEAV?$AutoDelete@VGPApiManager@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VGeneralSinkEx@@@@PEAVGeneralSinkEx@@@@AEAAAEAV?$AutoDelete@VGeneralSinkEx@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VIChannelObserverFactory@@@@PEAVIChannelObserverFactory@@@@AEAAAEAV?$AutoDelete@VIChannelObserverFactory@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VIQueryDASHSMASHInterface@@@@PEAVIQueryDASHSMASHInterface@@@@AEAAAEAV?$AutoDelete@VIQueryDASHSMASHInterface@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VISpecification@@@@PEAVISpecification@@@@AEAAAEAV?$AutoDelete@VISpecification@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VInteractiveSid@CSecurity@@@@PEAVInteractiveSid@CSecurity@@@@AEAAAEAV?$AutoDelete@VInteractiveSid@CSecurity@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VIpHlpApiDllLoader@@@@PEAVIpHlpApiDllLoader@@@@AEAAAEAV?$AutoDelete@VIpHlpApiDllLoader@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VMachineName@@@@PEAVMachineName@@@@AEAAAEAV?$AutoDelete@VMachineName@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VMasterReceiveData@CListenerReceive@@@@PEAVMasterReceiveData@CListenerReceive@@@@AEAAAEAV?$AutoDelete@VMasterReceiveData@CListenerReceive@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VNetworkServiceSid@CSecurity@@@@PEAVNetworkServiceSid@CSecurity@@@@AEAAAEAV?$AutoDelete@VNetworkServiceSid@CSecurity@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VNtDsApiDllLoader@@@@PEAVNtDsApiDllLoader@@@@AEAAAEAV?$AutoDelete@VNtDsApiDllLoader@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VOptionValue@SessionOptions@Client@WSMan@@@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@AEAAAEAV?$AutoDelete@VOptionValue@SessionOptions@Client@WSMan@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VPacketCreator@@@@PEAVPacketCreator@@@@AEAAAEAV?$AutoDelete@VPacketCreator@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VPacketParser@@@@PEAVPacketParser@@@@AEAAAEAV?$AutoDelete@VPacketParser@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VResources@Locale@@@@PEAVResources@Locale@@@@AEAAAEAV?$AutoDelete@VResources@Locale@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VRunAsConfiguration@@@@PEAVRunAsConfiguration@@@@AEAAAEAV?$AutoDelete@VRunAsConfiguration@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VSecurityEntry@Catalog@@@@PEAVSecurityEntry@Catalog@@@@AEAAAEAV?$AutoDelete@VSecurityEntry@Catalog@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VSendPacketArgs@RobustConnectionBuffer@@@@PEAVSendPacketArgs@RobustConnectionBuffer@@@@AEAAAEAV?$AutoDelete@VSendPacketArgs@RobustConnectionBuffer@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VServiceSoapProcessor@@@@PEAVServiceSoapProcessor@@@@AEAAAEAV?$AutoDelete@VServiceSoapProcessor@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VShell32DllLoader@@@@PEAVShell32DllLoader@@@@AEAAAEAV?$AutoDelete@VShell32DllLoader@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VShlWApiDllLoader@@@@PEAVShlWApiDllLoader@@@@AEAAAEAV?$AutoDelete@VShlWApiDllLoader@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VSubscriptionEnumerator@@@@PEAVSubscriptionEnumerator@@@@AEAAAEAV?$AutoDelete@VSubscriptionEnumerator@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VSubscriptionManager@@@@PEAVSubscriptionManager@@@@AEAAAEAV?$AutoDelete@VSubscriptionManager@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VTSTRBUFFER@@@@PEAVTSTRBUFFER@@@@AEAAAEAV?$AutoDelete@VTSTRBUFFER@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VUniqueStringOverflow@@@@PEAVUniqueStringOverflow@@@@AEAAAEAV?$AutoDelete@VUniqueStringOverflow@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VUser32DllLoader@@@@PEAVUser32DllLoader@@@@AEAAAEAV?$AutoDelete@VUser32DllLoader@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VWSMANCONFIGTABLE_IDENTITY@@@@PEAVWSMANCONFIGTABLE_IDENTITY@@@@AEAAAEAV?$AutoDelete@VWSMANCONFIGTABLE_IDENTITY@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VWSManMemCryptManager@@@@PEAVWSManMemCryptManager@@@@AEAAAEAV?$AutoDelete@VWSManMemCryptManager@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VWmiEnumContext@@@@PEAVWmiEnumContext@@@@AEAAAEAV?$AutoDelete@VWmiEnumContext@@@@XZ
?Me@?$AutoCleanup@V?$AutoDelete@VXmlReader@@@@PEAVXmlReader@@@@AEAAAEAV?$AutoDelete@VXmlReader@@@@XZ
?Me@?$AutoCleanup@V?$AutoDeleteVector@$$CBG@@PEBG@@AEAAAEAV?$AutoDeleteVector@$$CBG@@XZ
?Me@?$AutoCleanup@V?$AutoDeleteVector@D@@PEAD@@AEAAAEAV?$AutoDeleteVector@D@@XZ
?Me@?$AutoCleanup@V?$AutoDeleteVector@E@@PEAE@@AEAAAEAV?$AutoDeleteVector@E@@XZ
?Me@?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@AEAAAEAV?$AutoDeleteVector@G@@XZ
?Me@?$AutoCleanup@V?$AutoDeleteVector@H@@PEAH@@AEAAAEAV?$AutoDeleteVector@H@@XZ
?Me@?$AutoCleanup@V?$AutoDeleteVector@PEAG@@PEAPEAG@@AEAAAEAV?$AutoDeleteVector@PEAG@@XZ
?Me@?$AutoCleanup@V?$AutoDeleteVector@PEBG@@PEAPEBG@@AEAAAEAV?$AutoDeleteVector@PEBG@@XZ
?Me@?$AutoCleanup@V?$AutoDeleteVector@U_CONFIG_UPDATE@@@@PEAU_CONFIG_UPDATE@@@@AEAAAEAV?$AutoDeleteVector@U_CONFIG_UPDATE@@@@XZ
?Me@?$AutoCleanup@V?$AutoDeleteVector@U_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@PEAU_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@AEAAAEAV?$AutoDeleteVector@U_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@XZ
?Me@?$AutoCleanup@V?$AutoDeleteVector@U_WINRS_RUN_COMMAND_ARG@@@@PEAU_WINRS_RUN_COMMAND_ARG@@@@AEAAAEAV?$AutoDeleteVector@U_WINRS_RUN_COMMAND_ARG@@@@XZ
?Me@?$AutoCleanup@V?$AutoDeleteVector@U_WSMAN_OPTION@@@@PEAU_WSMAN_OPTION@@@@AEAAAEAV?$AutoDeleteVector@U_WSMAN_OPTION@@@@XZ
?Me@?$AutoCleanup@V?$AutoDeleteVector@X@@PEAX@@AEAAAEAV?$AutoDeleteVector@X@@XZ
?Me@?$AutoCleanup@V?$AutoFree@E@@PEAE@@AEAAAEAV?$AutoFree@E@@XZ
?Me@?$AutoCleanup@V?$AutoLocklessItemRecycle@VPacket@@@@PEAVPacket@@@@AEAAAEAV?$AutoLocklessItemRecycle@VPacket@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@UIAppHostAdminManager@@@@PEAUIAppHostAdminManager@@@@AEAAAEAV?$AutoRelease@UIAppHostAdminManager@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@UIAppHostChildElementCollection@@@@PEAUIAppHostChildElementCollection@@@@AEAAAEAV?$AutoRelease@UIAppHostChildElementCollection@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@UIAppHostConfigException@@@@PEAUIAppHostConfigException@@@@AEAAAEAV?$AutoRelease@UIAppHostConfigException@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@UIAppHostElement@@@@PEAUIAppHostElement@@@@AEAAAEAV?$AutoRelease@UIAppHostElement@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@UIAppHostElementCollection@@@@PEAUIAppHostElementCollection@@@@AEAAAEAV?$AutoRelease@UIAppHostElementCollection@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@UIAppHostProperty@@@@PEAUIAppHostProperty@@@@AEAAAEAV?$AutoRelease@UIAppHostProperty@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@UIAppHostPropertyCollection@@@@PEAUIAppHostPropertyCollection@@@@AEAAAEAV?$AutoRelease@UIAppHostPropertyCollection@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@UIClientSecurity@@@@PEAUIClientSecurity@@@@AEAAAEAV?$AutoRelease@UIClientSecurity@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@UIEnumWbemClassObject@@@@PEAUIEnumWbemClassObject@@@@AEAAAEAV?$AutoRelease@UIEnumWbemClassObject@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@UIErrorInfo@@@@PEAUIErrorInfo@@@@AEAAAEAV?$AutoRelease@UIErrorInfo@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@UIUnknown@@@@PEAUIUnknown@@@@AEAAAEAV?$AutoRelease@UIUnknown@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@UIWbemClassObject@@@@PEAUIWbemClassObject@@@@AEAAAEAV?$AutoRelease@UIWbemClassObject@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@UIWbemContext@@@@PEAUIWbemContext@@@@AEAAAEAV?$AutoRelease@UIWbemContext@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@UIWbemLocator@@@@PEAUIWbemLocator@@@@AEAAAEAV?$AutoRelease@UIWbemLocator@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@UIWbemObjectTextSrc@@@@PEAUIWbemObjectTextSrc@@@@AEAAAEAV?$AutoRelease@UIWbemObjectTextSrc@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@UIWbemPath@@@@PEAUIWbemPath@@@@AEAAAEAV?$AutoRelease@UIWbemPath@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@UIWbemPathKeyList@@@@PEAUIWbemPathKeyList@@@@AEAAAEAV?$AutoRelease@UIWbemPathKeyList@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@UIWbemQualifierSet@@@@PEAUIWbemQualifierSet@@@@AEAAAEAV?$AutoRelease@UIWbemQualifierSet@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@UIWbemQuery@@@@PEAUIWbemQuery@@@@AEAAAEAV?$AutoRelease@UIWbemQuery@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@UIWbemServices@@@@PEAUIWbemServices@@@@AEAAAEAV?$AutoRelease@UIWbemServices@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VApplication@Client@WSMan@@@@PEAVApplication@Client@WSMan@@@@AEAAAEAV?$AutoRelease@VApplication@Client@WSMan@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VCBaseConfigCache@@@@PEAVCBaseConfigCache@@@@AEAAAEAV?$AutoRelease@VCBaseConfigCache@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VCClientConfigCache@@@@PEAVCClientConfigCache@@@@AEAAAEAV?$AutoRelease@VCClientConfigCache@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VCClientConfigSettings@@@@PEAVCClientConfigSettings@@@@AEAAAEAV?$AutoRelease@VCClientConfigSettings@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VCCommonConfigSettings@@@@PEAVCCommonConfigSettings@@@@AEAAAEAV?$AutoRelease@VCCommonConfigSettings@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VCConfigCacheMap@CBaseConfigCache@@@@PEAVCConfigCacheMap@CBaseConfigCache@@@@AEAAAEAV?$AutoRelease@VCConfigCacheMap@CBaseConfigCache@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VCConfigManager@@@@PEAVCConfigManager@@@@AEAAAEAV?$AutoRelease@VCConfigManager@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VCListenerCommand@@@@PEAVCListenerCommand@@@@AEAAAEAV?$AutoRelease@VCListenerCommand@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VCListenerMasterOperation@@@@PEAVCListenerMasterOperation@@@@AEAAAEAV?$AutoRelease@VCListenerMasterOperation@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VCListenerReceive@@@@PEAVCListenerReceive@@@@AEAAAEAV?$AutoRelease@VCListenerReceive@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VCListenerShell@@@@PEAVCListenerShell@@@@AEAAAEAV?$AutoRelease@VCListenerShell@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VCRemoteOperation@@@@PEAVCRemoteOperation@@@@AEAAAEAV?$AutoRelease@VCRemoteOperation@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VCRemoteSession@@@@PEAVCRemoteSession@@@@AEAAAEAV?$AutoRelease@VCRemoteSession@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VCRequestContext@@@@PEAVCRequestContext@@@@AEAAAEAV?$AutoRelease@VCRequestContext@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VCServiceCommonConfigSettings@@@@PEAVCServiceCommonConfigSettings@@@@AEAAAEAV?$AutoRelease@VCServiceCommonConfigSettings@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VCServiceConfigCache@@@@PEAVCServiceConfigCache@@@@AEAAAEAV?$AutoRelease@VCServiceConfigCache@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VCServiceConfigSettings@@@@PEAVCServiceConfigSettings@@@@AEAAAEAV?$AutoRelease@VCServiceConfigSettings@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VCWSManEPR@@@@PEAVCWSManEPR@@@@AEAAAEAV?$AutoRelease@VCWSManEPR@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VCWSManGroupPolicyCache@@@@PEAVCWSManGroupPolicyCache@@@@AEAAAEAV?$AutoRelease@VCWSManGroupPolicyCache@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VCWSManGroupPolicyManager@@@@PEAVCWSManGroupPolicyManager@@@@AEAAAEAV?$AutoRelease@VCWSManGroupPolicyManager@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VCWSManObject@@@@PEAVCWSManObject@@@@AEAAAEAV?$AutoRelease@VCWSManObject@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VCWSManResource@@@@PEAVCWSManResource@@@@AEAAAEAV?$AutoRelease@VCWSManResource@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VCWSManSession@@@@PEAVCWSManSession@@@@AEAAAEAV?$AutoRelease@VCWSManSession@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VCWinRSPluginConfigCache@@@@PEAVCWinRSPluginConfigCache@@@@AEAAAEAV?$AutoRelease@VCWinRSPluginConfigCache@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VCWinRSPluginConfigSettings@@@@PEAVCWinRSPluginConfigSettings@@@@AEAAAEAV?$AutoRelease@VCWinRSPluginConfigSettings@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VCommand@Client@WSMan@@@@PEAVCommand@Client@WSMan@@@@AEAAAEAV?$AutoRelease@VCommand@Client@WSMan@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VConfigNotification@@@@PEAVConfigNotification@@@@AEAAAEAV?$AutoRelease@VConfigNotification@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VConnectShellOperation@Client@WSMan@@@@PEAVConnectShellOperation@Client@WSMan@@@@AEAAAEAV?$AutoRelease@VConnectShellOperation@Client@WSMan@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VCreateShellOperation@Client@WSMan@@@@PEAVCreateShellOperation@Client@WSMan@@@@AEAAAEAV?$AutoRelease@VCreateShellOperation@Client@WSMan@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VDeleteShellOperation@Client@WSMan@@@@PEAVDeleteShellOperation@Client@WSMan@@@@AEAAAEAV?$AutoRelease@VDeleteShellOperation@Client@WSMan@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VDisconnectOperation@Client@WSMan@@@@PEAVDisconnectOperation@Client@WSMan@@@@AEAAAEAV?$AutoRelease@VDisconnectOperation@Client@WSMan@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VEnumSinkEx@@@@PEAVEnumSinkEx@@@@AEAAAEAV?$AutoRelease@VEnumSinkEx@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VGeneralSinkEx@@@@PEAVGeneralSinkEx@@@@AEAAAEAV?$AutoRelease@VGeneralSinkEx@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VHostMappingTable@@@@PEAVHostMappingTable@@@@AEAAAEAV?$AutoRelease@VHostMappingTable@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VIISConfigSettings@@@@PEAVIISConfigSettings@@@@AEAAAEAV?$AutoRelease@VIISConfigSettings@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VIPCSoapProcessor@@@@PEAVIPCSoapProcessor@@@@AEAAAEAV?$AutoRelease@VIPCSoapProcessor@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VIRequestContext@@@@PEAVIRequestContext@@@@AEAAAEAV?$AutoRelease@VIRequestContext@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VISubscription@@@@PEAVISubscription@@@@AEAAAEAV?$AutoRelease@VISubscription@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VInboundRequestDetails@@@@PEAVInboundRequestDetails@@@@AEAAAEAV?$AutoRelease@VInboundRequestDetails@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VProxyManager@Client@WSMan@@@@PEAVProxyManager@Client@WSMan@@@@AEAAAEAV?$AutoRelease@VProxyManager@Client@WSMan@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VProxySelection@Client@WSMan@@@@PEAVProxySelection@Client@WSMan@@@@AEAAAEAV?$AutoRelease@VProxySelection@Client@WSMan@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VPushSubscribeOperation@@@@PEAVPushSubscribeOperation@@@@AEAAAEAV?$AutoRelease@VPushSubscribeOperation@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VPushSubscription@@@@PEAVPushSubscription@@@@AEAAAEAV?$AutoRelease@VPushSubscription@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VReceiveOperation@Client@WSMan@@@@PEAVReceiveOperation@Client@WSMan@@@@AEAAAEAV?$AutoRelease@VReceiveOperation@Client@WSMan@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VReconnectOperation@Client@WSMan@@@@PEAVReconnectOperation@Client@WSMan@@@@AEAAAEAV?$AutoRelease@VReconnectOperation@Client@WSMan@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VSendOperation@Client@WSMan@@@@PEAVSendOperation@Client@WSMan@@@@AEAAAEAV?$AutoRelease@VSendOperation@Client@WSMan@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VShell@Client@WSMan@@@@PEAVShell@Client@WSMan@@@@AEAAAEAV?$AutoRelease@VShell@Client@WSMan@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VShellInfo@@@@PEAVShellInfo@@@@AEAAAEAV?$AutoRelease@VShellInfo@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VSignalOperation@Client@WSMan@@@@PEAVSignalOperation@Client@WSMan@@@@AEAAAEAV?$AutoRelease@VSignalOperation@Client@WSMan@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VUserRecord@@@@PEAVUserRecord@@@@AEAAAEAV?$AutoRelease@VUserRecord@@@@XZ
?Me@?$AutoCleanup@V?$AutoRelease@VWSManHttpListener@@@@PEAVWSManHttpListener@@@@AEAAAEAV?$AutoRelease@VWSManHttpListener@@@@XZ
?Me@?$AutoCleanup@V?$AutoReleaseEx@VHostMappingTableEntry@@@@PEAVHostMappingTableEntry@@@@AEAAAEAV?$AutoReleaseEx@VHostMappingTableEntry@@@@XZ
?Me@?$AutoCleanup@V?$AutoReleaseEx@VShell@Client@WSMan@@@@PEAVShell@Client@WSMan@@@@AEAAAEAV?$AutoReleaseEx@VShell@Client@WSMan@@@@XZ
?Me@?$AutoCleanup@VAutoBstr@@PEAG@@AEAAAEAVAutoBstr@@XZ
?Me@?$AutoCleanup@VAutoBstrNoAlloc@@PEAG@@AEAAAEAVAutoBstrNoAlloc@@XZ
?Me@?$AutoCleanup@VAutoCertContext@@PEBU_CERT_CONTEXT@@@@AEAAAEAVAutoCertContext@@XZ
?Me@?$AutoCleanup@VAutoChainContext@@PEBU_CERT_CHAIN_CONTEXT@@@@AEAAAEAVAutoChainContext@@XZ
?Me@?$AutoCleanup@VAutoCoTaskMemFree@@PEAX@@AEAAAEAVAutoCoTaskMemFree@@XZ
?Me@?$AutoCleanup@VAutoFwXmlCloseParser@@PEAX@@AEAAAEAVAutoFwXmlCloseParser@@XZ
?Me@?$AutoCleanup@VAutoHandle@@PEAX@@AEAAAEAVAutoHandle@@XZ
?Me@?$AutoCleanup@VAutoImpersonateUser@@PEAX@@AEAAAEAVAutoImpersonateUser@@XZ
?Me@?$AutoCleanup@VAutoLibrary@@PEAUHINSTANCE__@@@@AEAAAEAVAutoLibrary@@XZ
?Me@?$AutoCleanup@VAutoLocalFree@@PEAX@@AEAAAEAVAutoLocalFree@@XZ
?Me@?$AutoCleanup@VAutoMIClass@@PEAU_MI_Class@@@@AEAAAEAVAutoMIClass@@XZ
?Me@?$AutoCleanup@VAutoMIInstance@@PEAU_MI_Instance@@@@AEAAAEAVAutoMIInstance@@XZ
?Me@?$AutoCleanup@VAutoObject@@PEAUWSMAN_OBJECT@@@@AEAAAEAVAutoObject@@XZ
?Me@?$AutoCleanup@VAutoRegKey@@PEAUHKEY__@@@@AEAAAEAVAutoRegKey@@XZ
?Me@?$AutoCleanup@VAutoSecurityDescriptor@@PEAX@@AEAAAEAVAutoSecurityDescriptor@@XZ
?Me@?$AutoCleanup@VAutoWaitHandle@@PEAX@@AEAAAEAVAutoWaitHandle@@XZ
?NUM_BOMS@PacketFormatter@@0HB
?NUM_CHARSETS@PacketFormatter@@0HB
?Next@TSTRBUFFER@@QEBAPEBGPEBG@Z
?NextCertMapping@CConfigManager@@QEAAHXZ
?NextListener@CConfigManager@@QEAAHXZ
?NextRow@CConfigManager@@QEAAHXZ
?NextShellUri@CConfigManager@@QEAAHXZ
?NoSemantics@ExtendedSemantic@@2KB
?NotifyObservers@CWSManGroupPolicyManager@@UEAAHPEAVIRequestContext@@PEAVIWSManGroupPolicyCacheDataProvider@@@Z
?OnChange@CBaseConfigCache@@UEAAXW4ConfigChangeSources@@KW4ConfigChangeSeverityType@@@Z
?OpenRegKey@ConfigRegistry@@IEAAJPEAU_CONFIG_INFO@@KPEAVWSMANCONFIGTABLE_IDENTITY@@PEAVAutoRegKey@@PEAUHKEY__@@@Z
?OverrideMaxEnvelopeSize@PacketParser@@QEAAXK@Z
?OverrideTimeout@PacketParser@@QEAAXK@Z
?Parse@CWSManResource@@SAPEAV1@PEAVIRequestContext@@PEBG11PEAU_WSMAN_SELECTOR_SET@@PEAU_WSMAN_OPTION_SET@@H@Z
?Parse@CWSManResource@@SAPEAV1@PEAVIRequestContext@@PEBGH@Z
?Parse@XmlReader@@AEAAHPEAVIRequestContext@@@Z
?ParseAction@PacketParser@@AEAAHPEAVIRequestContext@@PEAU_FWXML_ELEMENT@@_N@Z
?ParseActivityId@PacketParser@@AEAAHPEAVIRequestContext@@PEAU_FWXML_ELEMENT@@H@Z
?ParseBookmark@PacketParser@@AEAAHPEAVIRequestContext@@PEAU_FWXML_ELEMENT@@H@Z
?ParseDataLocale@PacketParser@@AEAAHPEAVIRequestContext@@PEAU_FWXML_ELEMENT@@H@Z
?ParseEprElement@CWSManEPR@@SAPEAV1@PEAVIRequestContext@@PEAU_FWXML_ELEMENT@@@Z
?ParseEvent@SoapSemanticConverter@@QEAAPEAVSemanticMessage@@PEAU_FWXML_ELEMENT@@PEAKPEAVIRequestContext@@@Z
?ParseFaultTo@PacketParser@@AEAAHPEAVIRequestContext@@PEAU_FWXML_ELEMENT@@H@Z
?ParseFragment@PacketParser@@AEAAHPEAVIRequestContext@@PEAU_FWXML_ELEMENT@@H@Z
?ParseHeader@PacketParser@@AEAAHPEAVCRequestContext@@PEAU_FWXML_ELEMENT@@HPEAVCServiceCommonConfigSettings@@@Z
?ParseHeaders@CWSManResourceNoResourceUri@@QEAAHPEAVIRequestContext@@PEAU_FWXML_ELEMENT@@11@Z
?ParseHeaders@PacketParser@@AEAAHPEAVCRequestContext@@PEAVCServiceCommonConfigSettings@@@Z
?ParseLocale@PacketParser@@AEAAHPEAVIRequestContext@@PEAU_FWXML_ELEMENT@@H@Z
?ParseMachineID@PacketParser@@AEAAHPEAVIRequestContext@@PEAU_FWXML_ELEMENT@@@Z
?ParseMaxEnvelopeSize@PacketParser@@AEAAHPEAVIRequestContext@@PEAU_FWXML_ELEMENT@@HPEAVCServiceCommonConfigSettings@@@Z
?ParseMessageId@PacketParser@@AEAAHPEAVIRequestContext@@PEAU_FWXML_ELEMENT@@_N@Z
?ParseOperationId@PacketParser@@AEAAHPEAVIRequestContext@@PEAU_FWXML_ELEMENT@@H@Z
?ParseOptionSet@CWSManResourceNoResourceUri@@QEAAHPEAVIRequestContext@@PEAU_FWXML_ELEMENT@@@Z
?ParseOptions@PacketParser@@AEAAHPEAVIRequestContext@@PEAU_FWXML_ELEMENT@@H@Z
?ParsePacket@PacketParser@@QEAAHPEAVCRequestContext@@PEAVPacket@@PEAVCServiceCommonConfigSettings@@@Z
?ParsePacketInternal@PacketParser@@AEAAHPEAVCRequestContext@@PEAU_FWXML_ELEMENT@@PEAVCServiceCommonConfigSettings@@@Z
?ParseReplyTo@PacketParser@@AEAAHPEAVIRequestContext@@PEAU_FWXML_ELEMENT@@@Z
?ParseResourceLocator@CWSManResource@@SAPEAV1@PEAVIRequestContext@@PEAU_WSMAN_RESOURCE_LOCATOR@@@Z
?ParseResourceUri@PacketParser@@AEAAHPEAVIRequestContext@@PEAU_FWXML_ELEMENT@@H@Z
?ParseResponse@SoapSemanticConverter@@QEAA_NPEAU_FWXML_ELEMENT@@PEAKPEA_NPEAVIRequestContext@@@Z
?ParseRobustConnectionAckSequenceId@PacketParser@@AEAAKPEA_K@Z
?ParseRobustConnectionMessages@PacketParser@@QEAAKPEAW4PacketType@1@PEA_NPEA_K2@Z
?ParseSelectors@PacketParser@@AEAAHPEAVIRequestContext@@PEAU_FWXML_ELEMENT@@H@Z
?ParseSequenceId@PacketParser@@AEAAHPEAVIRequestContext@@PEAU_FWXML_ELEMENT@@@Z
?ParseSessionId@PacketParser@@AEAAHPEAVIRequestContext@@PEAU_FWXML_ELEMENT@@H@Z
?ParseShellCompression@PacketParser@@AEAAHPEAVIRequestContext@@PEAU_FWXML_ELEMENT@@H@Z
?ParseStream@PacketParser@@QEAAXPEAVCRequestContext@@PEAVITransportReceiver@@PEAVPacket@@PEAVCServiceCommonConfigSettings@@@Z
?ParseSubscriptionAgentPacket@PacketParser@@QEAAHPEAVCRequestContext@@PEAVPacket@@PEAVCServiceConfigSettings@@@Z
?ParseSubscriptionID@PacketParser@@AEAAHPEAVIRequestContext@@PEAU_FWXML_ELEMENT@@H@Z
?ParseTimeout@PacketParser@@AEAAHPEAVIRequestContext@@PEAU_FWXML_ELEMENT@@HPEAVCServiceCommonConfigSettings@@@Z
?ParseToAddress@PacketParser@@AEAAHPEAVCRequestContext@@PEAU_FWXML_ELEMENT@@@Z
?Passed@CErrorContext@@UEBAHXZ
?PolicyChanged@CWSManGroupPolicyManager@@AEAAXE@Z
?PostChange@CBaseConfigCache@@MEAAHPEAVIRequestContext@@PEAVCCommonConfigSettings@@1@Z
?PostChange@CServiceConfigCache@@EEAAHPEAVIRequestContext@@PEAVCCommonConfigSettings@@1@Z
?PostError@CBaseConfigCache@@MEAAXK@Z
?PostError@CServiceConfigCache@@EEAAXK@Z
?PrepareToCommitWithSize@BufferFormatter@@UEAAKK@Z
?PrepareToCommitWithSize@CircularBufferFormatter@@UEAAKK@Z
?ProcessContext@CErrorContext@@UEAAHHPEAKPEAU_WSMAN_FAULT_OBJECT@@@Z
?ProcessContext@CErrorContext@@UEAAHHPEAU_WSMAN_ERROR@@@Z
?ProcessContext@CRequestContext@@QEAAHHPEAU_WSMAN_ENUMERATOR_RESULT@@@Z
?ProcessContext@CRequestContext@@QEAAHHPEAU_WSMAN_EVENTS_RESULT@@@Z
?ProcessContext@CRequestContext@@QEAAHHPEAU_WSMAN_RESULT@@@Z
?ProcessContext@CRequestContext@@QEAAHHPEAU_WSMAN_STATUS@@@Z
?ProcessContext@CRequestContext@@UEAAHHPEAKPEAU_WSMAN_FAULT_OBJECT@@@Z
?ProcessContext@CRequestContext@@UEAAHHPEAU_WSMAN_ERROR@@@Z
?ProcessEPR@CWSManEPR@@AEAAHPEAVIRequestContext@@PEAU_FWXML_ELEMENT@@@Z
?ProcessFragmentDialect@CWSManResourceNoResourceUri@@IEAAHPEAVIRequestContext@@PEBGK@Z
?ProcessFragmentPath@CWSManResourceNoResourceUri@@IEAAHPEAVIRequestContext@@PEBGK@Z
?ProcessKey@CWSManResourceNoResourceUri@@IEAAHPEAVIRequestContext@@PEBG1@Z
?ProcessNestedEPR@CWSManResourceNoResourceUri@@IEAAHPEAVIRequestContext@@PEBGPEAU_FWXML_ELEMENT@@@Z
?ProcessOption@CWSManResourceNoResourceUri@@IEAAHPEAVIRequestContext@@PEBG11H@Z
?ProcessRefParameters@CWSManEPR@@AEAAHPEAVIRequestContext@@PEAU_FWXML_ELEMENT@@@Z
?ProcessRefProperties@CWSManEPR@@AEAAHPEAVIRequestContext@@PEAU_FWXML_ELEMENT@@@Z
?ProcessUri@CWSManResource@@QEAAHPEAVIRequestContext@@PEBGK@Z
?Progress@ExtendedSemantic@@2KB
?PropertySheetPageCallback@CWSManSecurityUI@@UEAAJPEAUHWND__@@IW4_SI_PAGE_TYPE@@@Z
?ProviderFailure@CErrorContext@@UEBAHXZ
?ProviderShutdownCleanup@CWinRSPluginConfigCache@@SAXXZ
?PutOverrideValue@?$PacketElement@K@PacketParser@@QEAAXK@Z
?PutOverrideValue@?$PacketElement@PEBG@PacketParser@@QEAAXPEBG@Z
?PutValue@?$PacketElement@K@PacketParser@@QEAAXKH@Z
?PutValue@?$PacketElement@PEAU_FWXML_ELEMENT@@@PacketParser@@QEAAXPEAU_FWXML_ELEMENT@@H@Z
?PutValue@?$PacketElement@PEBG@PacketParser@@QEAAXPEBGH@Z
?PutValue@?$PacketElement@_K@PacketParser@@QEAAX_KH@Z
?PutValue@Fragment@PacketParser@@QEAAXPEBG0H@Z
?PutValue@NotUnderstandSoapHeader@PacketParser@@QEAAXPEBG00@Z
?PutValue@ReferenceParameters@PacketParser@@QEAAKPEAU_FWXML_ELEMENT@@H@Z
?QueryInterface@CWSManSecurityUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?QueryPtr@RBUFFER@@QEBAPEAXXZ
?QueryRegValue@CConfigManager@@AEAAJPEAU_CONFIG_INFO@@PEAKKPEAE1@Z
?QueryRegValue@CWSManGroupPolicyManager@@AEAAJPEAVIRequestContext@@PEBU_WSMAN_POLICY_INFO@@PEAKKPEAE2@Z
?QuerySize@RBUFFER@@QEBAIXZ
?QueryStr@TSTRBUFFER@@QEBAPEBGXZ
?QuotaComplete@UserRecord@@UEAAXPEAU_WSMAN_AUTHZ_QUOTA@@KPEBG@Z
?ReAlloc@WSManMemory@@SAPEAXPEAX_KHW4_NitsFaultMode@@@Z
?ReadCertMappingRegistryKey@CConfigManager@@SAHPEAVIRequestContext@@PEAVCERTMAPPING_IDENTITY@@PEAG@Z
?ReadCredentialsFromCredmanStore@CConfigManager@@SAHPEAVIRequestContext@@PEAG1@Z
?ReadCurrentSettings@CClientConfigCache@@EEAAPEAVCCommonConfigSettings@@PEAVIRequestContext@@W4ErrorLogging@@@Z
?ReadCurrentSettings@CServiceConfigCache@@EEAAPEAVCCommonConfigSettings@@PEAVIRequestContext@@W4ErrorLogging@@@Z
?ReadCurrentSettings@CWinRSPluginConfigCache@@EEAAPEAVCCommonConfigSettings@@PEAVIRequestContext@@W4ErrorLogging@@@Z
?ReadDefaultSettings@CClientConfigCache@@EEAAPEAVCCommonConfigSettings@@PEAVIRequestContext@@@Z
?ReadDefaultSettings@CServiceConfigCache@@EEAAPEAVCCommonConfigSettings@@PEAVIRequestContext@@@Z
?ReadDefaultSettings@CWinRSPluginConfigCache@@EEAAPEAVCCommonConfigSettings@@PEAVIRequestContext@@@Z
?ReadShellUriRegistryKey@CConfigManager@@SAHPEAVIRequestContext@@PEAVSHELLURI_IDENTITY@@PEAG@Z
?ReadTableRegistryKey@CConfigManager@@SAHPEAVIRequestContext@@PEAVWSMANCONFIGTABLE_IDENTITY@@PEAG@Z
?ReallocStorage@RBUFFER@@IEAAHI@Z
?RecordAccessDenied@CErrorContext@@UEAAXXZ
?RecordAccessDenied@CRequestContext@@UEAAXXZ
?RecordAccessDeniedWithDetail@CErrorContext@@UEAAXKZZ
?RecordAccessDeniedWithDetail@CRequestContext@@UEAAXKZZ
?RecordFailure@CErrorContext@@UEAAXK@Z
?RecordFailure@CErrorContext@@UEAAXKKZZ
?RecordFailure@CErrorContext@@UEAAXPEAU_WSMAN_FAULT_OBJECT@@@Z
?RecordFailure@CErrorContext@@UEAAXW4_MI_Result@@KKZZ
?RecordFailure@CRequestContext@@AEAAXKKPEAPEAD0@Z
?RecordFailure@CRequestContext@@UEAAXK@Z
?RecordFailure@CRequestContext@@UEAAXKKZZ
?RecordFailure@CRequestContext@@UEAAXPEAU_WSMAN_FAULT_OBJECT@@@Z
?RecordFailure@CRequestContext@@UEAAXW4_MI_Result@@KKZZ
?RecordHresult@CErrorContext@@UEAAXKKZZ
?RecordHresult@CRequestContext@@UEAAXKKZZ
?RecordHtmlError@CRequestContext@@QEAAHKPEAU_FWXML_ELEMENT@@@Z
?RecordHtmlError@CRequestContext@@QEAAHKPEBGK@Z
?RecordMIFailure@IRequestContext@@QEAAXW4_MI_Result@@K@Z
?RecordOutOfMemory@CErrorContext@@UEAAXXZ
?RecordOutOfMemory@CRequestContext@@UEAAXXZ
?RecordProviderFailure@CErrorContext@@UEAAXPEAU_WSMAN_FAULT_OBJECT@@PEBG1@Z
?RecordProviderFailure@CRequestContext@@QEAAXKHPEBG00@Z
?RecordProviderFailure@CRequestContext@@UEAAXPEAU_WSMAN_FAULT_OBJECT@@PEBG1@Z
?RecordSoapError@CErrorContext@@UEAAHKPEBG@Z
?RecordSoapError@CRequestContext@@QEAAHKPEAU_FWXML_ELEMENT@@@Z
?RecordSoapError@CRequestContext@@UEAAHKPEBG@Z
?RecordText@CRequestContext@@AEAAHKPEBG_KK@Z
?RecordXml@CRequestContext@@AEAAHKPEAU_FWXML_ELEMENT@@K@Z
?Refresh@UserRecord@@QEAAXXZ
?RegisterChild@ChildLifeTimeManager@@QEAA_NXZ
?RegisterChunkBoundary@CircularBufferFormatter@@QEAAKXZ
?RegisterConfigChangeNotification@CConfigManager@@QEAAPEAVConfigNotification@@PEAX@Z
?RegisterForPolicyNotification@CWSManGroupPolicyManager@@AEAAHPEAVIRequestContext@@H@Z
?Release@?$SafeMap@PEAVCCertMapping@@UEmpty@@V?$SafeMap_Iterator@PEAVCCertMapping@@UEmpty@@@@@@UEBAXXZ
?Release@?$SafeMap@PEAVCCertMapping@@UEmpty@@V?$SafeSet_Iterator@PEAVCCertMapping@@@@@@UEBAXXZ
?Release@?$SafeMap@PEAVCListenerConnect@@PEAV1@V?$SafeMap_Iterator@PEAVCListenerConnect@@PEAV1@@@@@UEBAXXZ
?Release@?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@@@UEBAXXZ
?Release@?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@UEBAXXZ
?Release@?$SafeMap@PEAVCListenerReceive@@PEAV1@V?$SafeMap_Iterator@PEAVCListenerReceive@@PEAV1@@@@@UEBAXXZ
?Release@?$SafeMap@PEAVCListenerSend@@PEAV1@V?$SafeMap_Iterator@PEAVCListenerSend@@PEAV1@@@@@UEBAXXZ
?Release@?$SafeMap@PEAVCListenerSignal@@PEAV1@V?$SafeMap_Iterator@PEAVCListenerSignal@@PEAV1@@@@@UEBAXXZ
?Release@?$SafeMap@PEAVCShellUriSettings@@UEmpty@@V?$SafeSet_Iterator@PEAVCShellUriSettings@@@@@@UEBAXXZ
?Release@?$SafeMap@PEAVCollector@@UEmpty@@V?$SafeMap_Iterator@PEAVCollector@@UEmpty@@@@@@UEBAXXZ
?Release@?$SafeMap@PEAVCollector@@UEmpty@@V?$SafeSet_Iterator@PEAVCollector@@@@@@UEBAXXZ
?Release@?$SafeMap@PEAVHostOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVHostOperation@@UEmpty@@@@@@UEBAXXZ
?Release@?$SafeMap@PEAVHostOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVHostOperation@@@@@@UEBAXXZ
?Release@?$SafeMap@PEAVIOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVIOperation@@UEmpty@@@@@@UEBAXXZ
?Release@?$SafeMap@PEAVIOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVIOperation@@@@@@UEBAXXZ
?Release@?$SafeMap@PEAVListenerSourceSubscription@@UEmpty@@V?$SafeMap_Iterator@PEAVListenerSourceSubscription@@UEmpty@@@@@@UEBAXXZ
?Release@?$SafeMap@PEAVListenerSourceSubscription@@UEmpty@@V?$SafeSet_Iterator@PEAVListenerSourceSubscription@@@@@@UEBAXXZ
?Release@?$SafeMap@PEAVPushSubscription@@UEmpty@@V?$SafeMap_Iterator@PEAVPushSubscription@@UEmpty@@@@@@UEBAXXZ
?Release@?$SafeMap@PEAVPushSubscription@@UEmpty@@V?$SafeSet_Iterator@PEAVPushSubscription@@@@@@UEBAXXZ
?Release@?$SafeMap@PEAXUEmpty@@V?$SafeSet_Iterator@PEAX@@@@UEBAXXZ
?Release@?$SafeMap@UPluginKey@@KV?$SafeMap_Iterator@UPluginKey@@K@@@@UEBAXXZ
?Release@?$SafeMap@UUserKey@@PEAVBlockedRecord@@V?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@@@UEBAXXZ
?Release@?$SafeMap@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@V?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@@@UEBAXXZ
?Release@?$SafeMap@VGuidKey@@PEAVCListenerCommand@@V?$SafeMap_Iterator@VGuidKey@@PEAVCListenerCommand@@@@@@UEBAXXZ
?Release@?$SafeMap@VKey@CWmiPtrCache@@VMapping@2@V?$SafeMap_Iterator@VKey@CWmiPtrCache@@VMapping@2@@@@@UEBAXXZ
?Release@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEBAXXZ
?Release@?$SafeMap@VStringKey@@PEAVListenerEvents@@V?$SafeMap_Iterator@VStringKey@@PEAVListenerEvents@@@@@@UEBAXXZ
?Release@?$SafeMap@VStringKey@@PEAVListenerSourceSubscription@@V?$SafeMap_Iterator@VStringKey@@PEAVListenerSourceSubscription@@@@@@UEBAXXZ
?Release@?$SafeMap@VStringKey@@UOption@WinRM_OperationOptions@@V?$SafeMap_Iterator@VStringKey@@UOption@WinRM_OperationOptions@@@@@@UEBAXXZ
?Release@?$SafeMap@VStringKeyCI@@KV?$SafeMap_Iterator@VStringKeyCI@@K@@@@UEBAXXZ
?Release@?$SafeMap@VStringKeyCI@@PEAVIISEndpoint@@V?$SafeMap_Iterator@VStringKeyCI@@PEAVIISEndpoint@@@@@@UEBAXXZ
?Release@?$SafeMap@VStringKeyCI@@UEmpty@@V?$SafeMap_Iterator@VStringKeyCI@@UEmpty@@@@@@UEBAXXZ
?Release@?$SafeMap@VStringKeyCI@@UEmpty@@V?$SafeSet_Iterator@VStringKeyCI@@@@@@UEBAXXZ
?Release@?$SafeMap@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@V?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@@@UEBAXXZ
?Release@?$SafeMap@VStringKeyStore@@PEAVExpiredOperationIdRecord@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@@@UEBAXXZ
?Release@?$SafeMap@VStringKeyStore@@PEAVServerFullDuplexChannel@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@@@UEBAXXZ
?Release@?$SafeMap@VTokenCacheKey@ServiceSoapProcessor@@VTokenCacheMapping@2@V?$SafeMap_Iterator@VTokenCacheKey@ServiceSoapProcessor@@VTokenCacheMapping@2@@@@@UEBAXXZ
?Release@?$SafeMap@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@UEBAXXZ
?Release@?$SafeMap@_KPEAVSendPacketArgs@RobustConnectionBuffer@@V?$SafeMap_Iterator@_KPEAVSendPacketArgs@RobustConnectionBuffer@@@@@@UEBAXXZ
?Release@?$SafeMap_Iterator@PEAVCCertMapping@@UEmpty@@@@QEAAXXZ
?Release@?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@QEAAXXZ
?Release@?$SafeMap_Iterator@PEAVCShellUriSettings@@UEmpty@@@@QEAAXXZ
?Release@?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@QEAAXXZ
?Release@?$SafeMap_Iterator@VStringKeyCI@@K@@QEAAXXZ
?Release@?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@QEAAXXZ
?Release@?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@QEAAXXZ
?Release@?$SafeMap_Lock@PEAVCCertMapping@@UEmpty@@V?$SafeMap_Iterator@PEAVCCertMapping@@UEmpty@@@@@@QEAAXXZ
?Release@?$SafeMap_Lock@PEAVCListenerOperation@@UEmpty@@V?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@@@QEAAXXZ
?Release@?$SafeMap_Lock@PEAVCShellUriSettings@@UEmpty@@V?$SafeMap_Iterator@PEAVCShellUriSettings@@UEmpty@@@@@@QEAAXXZ
?Release@?$SafeMap_Lock@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@V?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@@@QEAAXXZ
?Release@?$SafeMap_Lock@VStringKeyCI@@KV?$SafeMap_Iterator@VStringKeyCI@@K@@@@QEAAXXZ
?Release@?$SafeMap_Lock@VStringKeyStore@@PEAVExpiredOperationIdRecord@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@@@QEAAXXZ
?Release@?$SafeMap_Lock@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@QEAAXXZ
?Release@CBaseConfigCache@@UEAAJP6AXPEAX@Z0@Z
?Release@CWSManCriticalSection@@QEAAXXZ
?Release@CWSManSecurityUI@@UEAAKXZ
?Release@ILifeTimeMgmt@@UEAAJP6AXPEAX@Z0@Z
?Release@UserRecord@@QEAAJXZ
?ReleaseExclusive@FastLock@@QEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@D@@PEAD@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@G@@PEAG@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@UIPRange@CWSManIPFilter@@@@PEAUIPRange@CWSManIPFilter@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@U_SID@@@@PEAU_SID@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@U_WSMAN_STREAM_ID_SET@@@@PEAU_WSMAN_STREAM_ID_SET@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@V?$Handle@VISubscription@@@@@@PEAV?$Handle@VISubscription@@@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@V?$SafeMap_Iterator@PEAVCListenerConnect@@PEAV1@@@@@PEAV?$SafeMap_Iterator@PEAVCListenerConnect@@PEAV1@@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@V?$SafeMap_Iterator@PEAVCListenerReceive@@PEAV1@@@@@PEAV?$SafeMap_Iterator@PEAVCListenerReceive@@PEAV1@@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@V?$SafeMap_Iterator@PEAVCListenerSend@@PEAV1@@@@@PEAV?$SafeMap_Iterator@PEAVCListenerSend@@PEAV1@@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@V?$SafeMap_Iterator@PEAVCListenerSignal@@PEAV1@@@@@PEAV?$SafeMap_Iterator@PEAVCListenerSignal@@PEAV1@@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@V?$SafeMap_Iterator@VGuidKey@@PEAVCListenerCommand@@@@@@PEAV?$SafeMap_Iterator@VGuidKey@@PEAVCListenerCommand@@@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@V?$SafeMap_Iterator@VStringKeyCI@@K@@@@PEAV?$SafeMap_Iterator@VStringKeyCI@@K@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@V?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@PEAV?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@V?$SafeSet@PEAVCCertMapping@@@@@@PEAV?$SafeSet@PEAVCCertMapping@@@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@V?$SafeSet@PEAVCShellUriSettings@@@@@@PEAV?$SafeSet@PEAVCShellUriSettings@@@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@PEAV?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@V?$SafeSet_Iterator@PEAVCollector@@@@@@PEAV?$SafeSet_Iterator@PEAVCollector@@@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@V?$SafeSet_Iterator@PEAVHostOperation@@@@@@PEAV?$SafeSet_Iterator@PEAVHostOperation@@@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@V?$SafeSet_Iterator@PEAVListenerSourceSubscription@@@@@@PEAV?$SafeSet_Iterator@PEAVListenerSourceSubscription@@@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@V?$SimpleStack@VCListenerOperation@@@@@@PEAV?$SimpleStack@VCListenerOperation@@@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@V?$SimpleStack@VShellHostEntry@@@@@@PEAV?$SimpleStack@VShellHostEntry@@@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@V?$queue@PEAU_WSMAN_PUBLISHER_EVENT_STRUCT@@V?$deque@PEAU_WSMAN_PUBLISHER_EVENT_STRUCT@@V?$transport_allocator@PEAU_WSMAN_PUBLISHER_EVENT_STRUCT@@@@@std@@@std@@@@PEAV?$queue@PEAU_WSMAN_PUBLISHER_EVENT_STRUCT@@V?$deque@PEAU_WSMAN_PUBLISHER_EVENT_STRUCT@@V?$transport_allocator@PEAU_WSMAN_PUBLISHER_EVENT_STRUCT@@@@@std@@@std@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@V?$set@PEAVCListenerSettings@@VCListenerSettingsLessFunctor@CServiceConfigSettings@@V?$transport_allocator@PEAVCListenerSettings@@@@@std@@@@PEAV?$set@PEAVCListenerSettings@@VCListenerSettingsLessFunctor@CServiceConfigSettings@@V?$transport_allocator@PEAVCListenerSettings@@@@@std@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@V?$set@Usockaddr_storage@@VSockAddrLessFunctor@CListenerSettings@@V?$transport_allocator@Usockaddr_storage@@@@@std@@@@PEAV?$set@Usockaddr_storage@@VSockAddrLessFunctor@CListenerSettings@@V?$transport_allocator@Usockaddr_storage@@@@@std@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@V?$vector@PEAVCWSManRequest@@V?$transport_allocator@PEAVCWSManRequest@@@@@std@@@@PEAV?$vector@PEAVCWSManRequest@@V?$transport_allocator@PEAVCWSManRequest@@@@@std@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@V?$vector@PEAVHandleImpl@Client@WSMan@@V?$transport_allocator@PEAVHandleImpl@Client@WSMan@@@@@std@@@@PEAV?$vector@PEAVHandleImpl@Client@WSMan@@V?$transport_allocator@PEAVHandleImpl@Client@WSMan@@@@@std@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@V?$vector@PEAVIServiceConfigObserver@@V?$transport_allocator@PEAVIServiceConfigObserver@@@@@std@@@@PEAV?$vector@PEAVIServiceConfigObserver@@V?$transport_allocator@PEAVIServiceConfigObserver@@@@@std@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@V?$vector@PEAVWSManHttpSenderConnection@@V?$transport_allocator@PEAVWSManHttpSenderConnection@@@@@std@@@@PEAV?$vector@PEAVWSManHttpSenderConnection@@V?$transport_allocator@PEAVWSManHttpSenderConnection@@@@@std@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VAdminSid@CSecurity@@@@PEAVAdminSid@CSecurity@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VBlockedRecord@@@@PEAVBlockedRecord@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VCBaseConfigCache@@@@PEAVCBaseConfigCache@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VCCertMapping@@@@PEAVCCertMapping@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VCConfigChangeSource@@@@PEAVCConfigChangeSource@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VCListenerSettings@@@@PEAVCListenerSettings@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VCObserverConfigChangeErrors@@@@PEAVCObserverConfigChangeErrors@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VCServiceWatcher@CServiceConfigCache@@@@PEAVCServiceWatcher@CServiceConfigCache@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VCShellUriSettings@@@@PEAVCShellUriSettings@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VCWSManEPR@@@@PEAVCWSManEPR@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VCWSManResource@@@@PEAVCWSManResource@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VCertHash@@@@PEAVCertHash@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VConfigUpdate@@@@PEAVConfigUpdate@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VEnumSinkEx@@@@PEAVEnumSinkEx@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VEventHandler@WSMan@@@@PEAVEventHandler@WSMan@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VExpiredOperationIdRecord@@@@PEAVExpiredOperationIdRecord@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VGPApiManager@@@@PEAVGPApiManager@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VGeneralSinkEx@@@@PEAVGeneralSinkEx@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VIChannelObserverFactory@@@@PEAVIChannelObserverFactory@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VIQueryDASHSMASHInterface@@@@PEAVIQueryDASHSMASHInterface@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VISpecification@@@@PEAVISpecification@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VInteractiveSid@CSecurity@@@@PEAVInteractiveSid@CSecurity@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VIpHlpApiDllLoader@@@@PEAVIpHlpApiDllLoader@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VMachineName@@@@PEAVMachineName@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VMasterReceiveData@CListenerReceive@@@@PEAVMasterReceiveData@CListenerReceive@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VNetworkServiceSid@CSecurity@@@@PEAVNetworkServiceSid@CSecurity@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VNtDsApiDllLoader@@@@PEAVNtDsApiDllLoader@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VOptionValue@SessionOptions@Client@WSMan@@@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VPacketCreator@@@@PEAVPacketCreator@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VPacketParser@@@@PEAVPacketParser@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VResources@Locale@@@@PEAVResources@Locale@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VRunAsConfiguration@@@@PEAVRunAsConfiguration@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VSecurityEntry@Catalog@@@@PEAVSecurityEntry@Catalog@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VSendPacketArgs@RobustConnectionBuffer@@@@PEAVSendPacketArgs@RobustConnectionBuffer@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VServiceSoapProcessor@@@@PEAVServiceSoapProcessor@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VShell32DllLoader@@@@PEAVShell32DllLoader@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VShlWApiDllLoader@@@@PEAVShlWApiDllLoader@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VSubscriptionEnumerator@@@@PEAVSubscriptionEnumerator@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VSubscriptionManager@@@@PEAVSubscriptionManager@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VTSTRBUFFER@@@@PEAVTSTRBUFFER@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VUniqueStringOverflow@@@@PEAVUniqueStringOverflow@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VUser32DllLoader@@@@PEAVUser32DllLoader@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VWSMANCONFIGTABLE_IDENTITY@@@@PEAVWSMANCONFIGTABLE_IDENTITY@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VWSManMemCryptManager@@@@PEAVWSManMemCryptManager@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VWmiEnumContext@@@@PEAVWmiEnumContext@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDelete@VXmlReader@@@@PEAVXmlReader@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDeleteVector@$$CBG@@PEBG@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDeleteVector@D@@PEAD@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDeleteVector@E@@PEAE@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDeleteVector@H@@PEAH@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDeleteVector@PEAG@@PEAPEAG@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDeleteVector@PEBG@@PEAPEBG@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDeleteVector@U_CONFIG_UPDATE@@@@PEAU_CONFIG_UPDATE@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDeleteVector@U_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@PEAU_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDeleteVector@U_WINRS_RUN_COMMAND_ARG@@@@PEAU_WINRS_RUN_COMMAND_ARG@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDeleteVector@U_WSMAN_OPTION@@@@PEAU_WSMAN_OPTION@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoDeleteVector@X@@PEAX@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoFree@E@@PEAE@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoLocklessItemRecycle@VPacket@@@@PEAVPacket@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@UIAppHostAdminManager@@@@PEAUIAppHostAdminManager@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@UIAppHostChildElementCollection@@@@PEAUIAppHostChildElementCollection@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@UIAppHostConfigException@@@@PEAUIAppHostConfigException@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@UIAppHostElement@@@@PEAUIAppHostElement@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@UIAppHostElementCollection@@@@PEAUIAppHostElementCollection@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@UIAppHostProperty@@@@PEAUIAppHostProperty@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@UIAppHostPropertyCollection@@@@PEAUIAppHostPropertyCollection@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@UIClientSecurity@@@@PEAUIClientSecurity@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@UIEnumWbemClassObject@@@@PEAUIEnumWbemClassObject@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@UIErrorInfo@@@@PEAUIErrorInfo@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@UIUnknown@@@@PEAUIUnknown@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@UIWbemClassObject@@@@PEAUIWbemClassObject@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@UIWbemContext@@@@PEAUIWbemContext@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@UIWbemLocator@@@@PEAUIWbemLocator@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@UIWbemObjectTextSrc@@@@PEAUIWbemObjectTextSrc@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@UIWbemPath@@@@PEAUIWbemPath@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@UIWbemPathKeyList@@@@PEAUIWbemPathKeyList@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@UIWbemQualifierSet@@@@PEAUIWbemQualifierSet@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@UIWbemQuery@@@@PEAUIWbemQuery@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@UIWbemServices@@@@PEAUIWbemServices@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VApplication@Client@WSMan@@@@PEAVApplication@Client@WSMan@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VCBaseConfigCache@@@@PEAVCBaseConfigCache@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VCClientConfigCache@@@@PEAVCClientConfigCache@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VCClientConfigSettings@@@@PEAVCClientConfigSettings@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VCCommonConfigSettings@@@@PEAVCCommonConfigSettings@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VCConfigCacheMap@CBaseConfigCache@@@@PEAVCConfigCacheMap@CBaseConfigCache@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VCConfigManager@@@@PEAVCConfigManager@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VCListenerCommand@@@@PEAVCListenerCommand@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VCListenerMasterOperation@@@@PEAVCListenerMasterOperation@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VCListenerReceive@@@@PEAVCListenerReceive@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VCListenerShell@@@@PEAVCListenerShell@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VCRemoteOperation@@@@PEAVCRemoteOperation@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VCRemoteSession@@@@PEAVCRemoteSession@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VCRequestContext@@@@PEAVCRequestContext@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VCServiceCommonConfigSettings@@@@PEAVCServiceCommonConfigSettings@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VCServiceConfigCache@@@@PEAVCServiceConfigCache@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VCServiceConfigSettings@@@@PEAVCServiceConfigSettings@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VCWSManEPR@@@@PEAVCWSManEPR@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VCWSManGroupPolicyCache@@@@PEAVCWSManGroupPolicyCache@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VCWSManGroupPolicyManager@@@@PEAVCWSManGroupPolicyManager@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VCWSManObject@@@@PEAVCWSManObject@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VCWSManResource@@@@PEAVCWSManResource@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VCWSManSession@@@@PEAVCWSManSession@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VCWinRSPluginConfigCache@@@@PEAVCWinRSPluginConfigCache@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VCWinRSPluginConfigSettings@@@@PEAVCWinRSPluginConfigSettings@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VCommand@Client@WSMan@@@@PEAVCommand@Client@WSMan@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VConfigNotification@@@@PEAVConfigNotification@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VConnectShellOperation@Client@WSMan@@@@PEAVConnectShellOperation@Client@WSMan@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VCreateShellOperation@Client@WSMan@@@@PEAVCreateShellOperation@Client@WSMan@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VDeleteShellOperation@Client@WSMan@@@@PEAVDeleteShellOperation@Client@WSMan@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VDisconnectOperation@Client@WSMan@@@@PEAVDisconnectOperation@Client@WSMan@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VEnumSinkEx@@@@PEAVEnumSinkEx@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VGeneralSinkEx@@@@PEAVGeneralSinkEx@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VHostMappingTable@@@@PEAVHostMappingTable@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VIISConfigSettings@@@@PEAVIISConfigSettings@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VIPCSoapProcessor@@@@PEAVIPCSoapProcessor@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VIRequestContext@@@@PEAVIRequestContext@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VISubscription@@@@PEAVISubscription@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VInboundRequestDetails@@@@PEAVInboundRequestDetails@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VProxyManager@Client@WSMan@@@@PEAVProxyManager@Client@WSMan@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VProxySelection@Client@WSMan@@@@PEAVProxySelection@Client@WSMan@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VPushSubscribeOperation@@@@PEAVPushSubscribeOperation@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VPushSubscription@@@@PEAVPushSubscription@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VReceiveOperation@Client@WSMan@@@@PEAVReceiveOperation@Client@WSMan@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VReconnectOperation@Client@WSMan@@@@PEAVReconnectOperation@Client@WSMan@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VSendOperation@Client@WSMan@@@@PEAVSendOperation@Client@WSMan@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VShell@Client@WSMan@@@@PEAVShell@Client@WSMan@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VShellInfo@@@@PEAVShellInfo@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VSignalOperation@Client@WSMan@@@@PEAVSignalOperation@Client@WSMan@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VUserRecord@@@@PEAVUserRecord@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoRelease@VWSManHttpListener@@@@PEAVWSManHttpListener@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoReleaseEx@VHostMappingTableEntry@@@@PEAVHostMappingTableEntry@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@V?$AutoReleaseEx@VShell@Client@WSMan@@@@PEAVShell@Client@WSMan@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoBstr@@PEAG@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoBstrNoAlloc@@PEAG@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoCertContext@@PEBU_CERT_CONTEXT@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoChainContext@@PEBU_CERT_CHAIN_CONTEXT@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoCoTaskMemFree@@PEAX@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoFwXmlCloseParser@@PEAX@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoHandle@@PEAX@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoImpersonateUser@@PEAX@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoLibrary@@PEAUHINSTANCE__@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoLocalFree@@PEAX@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoMIClass@@PEAU_MI_Class@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoMIInstance@@PEAU_MI_Instance@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoObject@@PEAUWSMAN_OBJECT@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoRegKey@@PEAUHKEY__@@@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoSecurityDescriptor@@PEAX@@AEAAXXZ
?ReleasePtr@?$AutoCleanup@VAutoWaitHandle@@PEAX@@AEAAXXZ
?ReleaseQuota@UserRecord@@QEAAXW4OperationType@@PEBVProvider@Catalog@@@Z
?ReleaseShared@FastLock@@QEAAXXZ
?Remove@?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@QEAA_NAEBQEAVCListenerOperation@@@Z
?Remove@?$SafeMap@UUserKey@@PEAVBlockedRecord@@V?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@@@QEAA_NAEBUUserKey@@@Z
?Remove@?$SafeMap@VStringKeyCI@@KV?$SafeMap_Iterator@VStringKeyCI@@K@@@@QEAA_NAEBVStringKeyCI@@@Z
?Remove@?$SafeMap@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@V?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@@@QEAA_NAEBVStringKeyCI@@@Z
?Remove@?$SafeMap@VStringKeyStore@@PEAVExpiredOperationIdRecord@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@@@QEAA_NAEBVStringKeyStore@@@Z
?Remove@?$SafeMap@VStringKeyStore@@PEAVServerFullDuplexChannel@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@@@QEAA_NAEBVStringKeyStore@@@Z
?Remove@?$SafeMap@_KPEAVSendPacketArgs@RobustConnectionBuffer@@V?$SafeMap_Iterator@_KPEAVSendPacketArgs@RobustConnectionBuffer@@@@@@QEAA_NAEB_K@Z
?RemoveAll@CBaseConfigCache@@KAXPEAVFastLock@@AEAV?$AutoRelease@VCConfigCacheMap@CBaseConfigCache@@@@@Z
?RemoveFromMap@CBaseConfigCache@@AEAAHXZ
?RemoveObserver@CServiceConfigCache@@AEAAHPEAVIServiceConfigObserver@@@Z
?ReportEventW@EventLog@@SAXGKGPEAPEBG@Z
?Reset@?$PacketElement@K@PacketParser@@QEAAX_N@Z
?Reset@?$PacketElement@PEAU_FWXML_ELEMENT@@@PacketParser@@QEAAX_N@Z
?Reset@?$PacketElement@PEBG@PacketParser@@QEAAX_N@Z
?Reset@?$PacketElement@_K@PacketParser@@QEAAX_N@Z
?Reset@?$SafeMap_Iterator@PEAVCCertMapping@@UEmpty@@@@QEAAXXZ
?Reset@?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@QEAAXXZ
?Reset@?$SafeMap_Iterator@PEAVCShellUriSettings@@UEmpty@@@@QEAAXXZ
?Reset@?$SafeMap_Iterator@PEAXUEmpty@@@@QEAAXXZ
?Reset@?$SafeMap_Iterator@UPluginKey@@K@@QEAAXXZ
?Reset@?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@QEAAXXZ
?Reset@?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@QEAAXXZ
?Reset@?$SafeMap_Iterator@VKey@Locale@@K@@QEAAXXZ
?Reset@?$SafeMap_Iterator@VStringKeyCI@@K@@QEAAXXZ
?Reset@?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@QEAAXXZ
?Reset@?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@QEAAXXZ
?Reset@?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@QEAAXXZ
?Reset@?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@QEAAXXZ
?Reset@?$SafeMap_Iterator@_KPEAVSendPacketArgs@RobustConnectionBuffer@@@@QEAAXXZ
?Reset@BufferFormatter@@UEAAXXZ
?Reset@CErrorContext@@UEAAXH@Z
?Reset@CRequestContext@@UEAAXH@Z
?Reset@CircularBufferFormatter@@UEAAXXZ
?Reset@Locale@@QEAAXXZ
?Reset@TSTRBUFFER@@QEAAXXZ
?Reset@UserRecord@@QEAAXXZ
?ResetProfileCount@UserRecord@@QEAAXXZ
?ResetRobustConnectionHeaders@PacketParser@@AEAAXXZ
?Resize@RBUFFER@@QEAAHI@Z
?Resize@RBUFFER@@QEAAHII@Z
?ResizeOptionList@CWSManResourceNoResourceUri@@IEAA_NIAEAVIRequestContext@@@Z
?RetrieveCertMappingIdentity@CConfigManager@@AEAAHPEAUHKEY__@@PEAVCERTMAPPING_IDENTITY@@@Z
?RetrieveListenerIdentity@CConfigManager@@AEAAHPEAUHKEY__@@PEAGPEAPEAGPEAVLISTENER_IDENTITY@@@Z
?RetrieveShellUriIdentity@CConfigManager@@AEAAHPEAUHKEY__@@PEAVSHELLURI_IDENTITY@@@Z
?RetrieveTableIdentity@CConfigManager@@AEAAHPEAUHKEY__@@PEAVWSMANCONFIGTABLE_IDENTITY@@@Z
?RevertToSelf@CSecurity@@SAHXZ
?RtlSecureZeroMemory@XmlReader@@QEAAXXZ
?SetBOM@PacketFormatter@@QEAA_NPEAVPacket@@@Z
?SetBOM@PacketFormatter@@QEAA_NPEBEK@Z
?SetCIM_Error@CErrorContext@@UEAAXXZ
?SetCIM_Error@CRequestContext@@UEAAXXZ
?SetCharset@PacketFormatter@@QEAAXW4Charset@1@@Z
?SetCharset@PacketFormatter@@QEAA_NPEBDK_NPEA_N@Z
?SetCharsetAndBom@PacketFormatter@@QEAAXW4Charset@1@0@Z
?SetConfigToUseDefaults@CErrorContext@@UEAAXH@Z
?SetErrorAction@ExtendedSemantic@@QEAAXW4_MI_OperationCallback_ResponseType@@W4_MI_CallbackMode@@@Z
?SetErrorState@CBaseConfigCache@@AEAAXPEAVCRequestContext@@K@Z
?SetExactCharSize@TSTRBUFFER@@QEAAJI@Z
?SetExtendedErrorString@CErrorContext@@UEAAXPEAG@Z
?SetExtendedErrorString@CRequestContext@@UEAAXPEAG@Z
?SetExtraLogInfo@CErrorContext@@QEAAXPEBG000@Z
?SetFault@CErrorContext@@UEAAXKKKPEBG@Z
?SetFault@CRequestContext@@EEAAXKKKPEBG@Z
?SetFinishValue@ConfigRegistry@@IEAAHPEAVIRequestContext@@@Z
?SetFormatterMode@BufferFormatter@@QEAAXW4Charset@PacketFormatter@@0@Z
?SetFragmentDialect@CWSManResourceNoResourceUri@@QEAAHPEBGPEAVIRequestContext@@@Z
?SetFragmentPath@CWSManResourceNoResourceUri@@QEAAHPEBGPEAVIRequestContext@@@Z
?SetGeneratingError@CErrorContext@@UEAAXXZ
?SetLocale@CRequestContext@@QEAA_NPEBGK@Z
?SetLocale@Locale@@QEAA_NKPEBGPEAVIRequestContext@@@Z
?SetMachineName@CRequestContext@@QEAAKPEBG@Z
?SetMachineName@CRequestContext@@QEAAKPEBG_K@Z
?SetMachineName@CRequestContext@@QEAAKXZ
?SetMaxEnvelopeSize@CircularBufferFormatter@@QEAAXK@Z
?SetOptionsMustUnderstandValue@CWSManResourceNoResourceUri@@QEAAXH@Z
?SetProfileHandle@UserRecord@@QEAAX_J@Z
?SetProviderFailure@CErrorContext@@UEAAXH@Z
?SetSecurity@CWSManSecurityUI@@UEAAJKPEAX@Z
?SetSize@TSTRBUFFER@@QEAAJII@Z
?SetSizeInUse@SBUFFER@@QEAAXI@Z
?SetThreadUILanguage@Locale@@QEAA_NPEAVIRequestContext@@@Z
?SetUpdateMode@BufferFormatter@@UEAAXW4Mode@1@@Z
?SetUpdateMode@CircularBufferFormatter@@UEAAXW4Mode@BufferFormatter@@@Z
?SetUri@CWSManResource@@QEAAHPEBGPEAVIRequestContext@@@Z
?SetValid@RBUFFER@@IEAAXH@Z
?SetXml@ReferenceParameters@PacketParser@@AEAAKAEAVBufferFormatter@@PEAU_FWXML_ELEMENT@@@Z
?Shutdown@CBaseConfigCache@@IEAAXXZ
?Shutdown@CConfigManager@@SAHXZ
?Shutdown@CWSManGroupPolicyManager@@SAHXZ
?Shutdown@ChildLifeTimeManager@@QEAAXXZ
?ShutdownLocaleMap@Locale@@SAXXZ
?Size@?$SafeMap@PEAVCListenerOperation@@UEmpty@@V?$SafeSet_Iterator@PEAVCListenerOperation@@@@@@QEBAHXZ
?Size@?$SafeMap@UUserKey@@PEAVBlockedRecord@@V?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@@@QEBAHXZ
?Size@?$SafeMap@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@V?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@@@QEBAHXZ
?Size@?$SafeMap@VStringKeyCI@@KV?$SafeMap_Iterator@VStringKeyCI@@K@@@@QEBAHXZ
?Size@?$SafeMap@VStringKeyCI@@UEmpty@@V?$SafeSet_Iterator@VStringKeyCI@@@@@@QEBAHXZ
?Size@?$SafeMap@VStringKeyStore@@PEAVExpiredOperationIdRecord@@V?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@@@QEBAHXZ
?SkipOrphans@?$SafeMap_Iterator@PEAVCCertMapping@@UEmpty@@@@IEAAXXZ
?SkipOrphans@?$SafeMap_Iterator@PEAVCListenerOperation@@UEmpty@@@@IEAAXXZ
?SkipOrphans@?$SafeMap_Iterator@PEAVCShellUriSettings@@UEmpty@@@@IEAAXXZ
?SkipOrphans@?$SafeMap_Iterator@PEAXUEmpty@@@@IEAAXXZ
?SkipOrphans@?$SafeMap_Iterator@UPluginKey@@K@@IEAAXXZ
?SkipOrphans@?$SafeMap_Iterator@UUserKey@@PEAVBlockedRecord@@@@IEAAXXZ
?SkipOrphans@?$SafeMap_Iterator@VCertThumbprintKey@@VCertThumbprintMappedSet@CServiceConfigSettings@@@@IEAAXXZ
?SkipOrphans@?$SafeMap_Iterator@VKey@Locale@@K@@IEAAXXZ
?SkipOrphans@?$SafeMap_Iterator@VStringKeyCI@@K@@IEAAXXZ
?SkipOrphans@?$SafeMap_Iterator@VStringKeyCI@@UUSER_CONTEXT_INFO@WSManHttpListener@@@@IEAAXXZ
?SkipOrphans@?$SafeMap_Iterator@VStringKeyStore@@PEAVExpiredOperationIdRecord@@@@IEAAXXZ
?SkipOrphans@?$SafeMap_Iterator@VStringKeyStore@@PEAVServerFullDuplexChannel@@@@IEAAXXZ
?SkipOrphans@?$SafeMap_Iterator@W4WSManSessionOption@@PEAVOptionValue@SessionOptions@Client@WSMan@@@@IEAAXXZ
?SkipOrphans@?$SafeMap_Iterator@_KPEAVSendPacketArgs@RobustConnectionBuffer@@@@IEAAXXZ
?Storage@?$AutoCleanup@V?$AutoDelete@G@@PEAG@@QEAAPEAPEAGXZ
?Storage@?$AutoCleanup@V?$AutoDelete@UIPRange@CWSManIPFilter@@@@PEAUIPRange@CWSManIPFilter@@@@QEAAPEAPEAUIPRange@CWSManIPFilter@@XZ
?Storage@?$AutoCleanup@V?$AutoDelete@VEnumSinkEx@@@@PEAVEnumSinkEx@@@@QEAAPEAPEAVEnumSinkEx@@XZ
?Storage@?$AutoCleanup@V?$AutoDelete@VGeneralSinkEx@@@@PEAVGeneralSinkEx@@@@QEAAPEAPEAVGeneralSinkEx@@XZ
?Storage@?$AutoCleanup@V?$AutoDelete@VIQueryDASHSMASHInterface@@@@PEAVIQueryDASHSMASHInterface@@@@QEAAPEAPEAVIQueryDASHSMASHInterface@@XZ
?Storage@?$AutoCleanup@V?$AutoDelete@VISpecification@@@@PEAVISpecification@@@@QEAAPEAPEAVISpecification@@XZ
?Storage@?$AutoCleanup@V?$AutoDelete@VPacketCreator@@@@PEAVPacketCreator@@@@QEAAPEAPEAVPacketCreator@@XZ
?Storage@?$AutoCleanup@V?$AutoDelete@VTSTRBUFFER@@@@PEAVTSTRBUFFER@@@@QEAAPEAPEAVTSTRBUFFER@@XZ
?Storage@?$AutoCleanup@V?$AutoDelete@VWmiEnumContext@@@@PEAVWmiEnumContext@@@@QEAAPEAPEAVWmiEnumContext@@XZ
?Storage@?$AutoCleanup@V?$AutoDelete@VXmlReader@@@@PEAVXmlReader@@@@QEAAPEAPEAVXmlReader@@XZ
?Storage@?$AutoCleanup@V?$AutoDeleteVector@$$CBG@@PEBG@@QEAAPEAPEBGXZ
?Storage@?$AutoCleanup@V?$AutoDeleteVector@E@@PEAE@@QEAAPEAPEAEXZ
?Storage@?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@QEAAPEAPEAGXZ
?Storage@?$AutoCleanup@V?$AutoDeleteVector@PEAG@@PEAPEAG@@QEAAPEAPEAPEAGXZ
?Storage@?$AutoCleanup@V?$AutoDeleteVector@PEBG@@PEAPEBG@@QEAAPEAPEAPEBGXZ
?Storage@?$AutoCleanup@V?$AutoDeleteVector@U_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@PEAU_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@@@QEAAPEAPEAU_WINRS_CREATE_SHELL_ENVIRONMENT_VARIABLE@@XZ
?Storage@?$AutoCleanup@V?$AutoDeleteVector@U_WINRS_RUN_COMMAND_ARG@@@@PEAU_WINRS_RUN_COMMAND_ARG@@@@QEAAPEAPEAU_WINRS_RUN_COMMAND_ARG@@XZ
?Storage@?$AutoCleanup@V?$AutoDeleteVector@X@@PEAX@@QEAAPEAPEAXXZ
?Storage@?$AutoCleanup@V?$AutoFree@E@@PEAE@@QEAAPEAPEAEXZ
?Storage@?$AutoCleanup@V?$AutoLocklessItemRecycle@VPacket@@@@PEAVPacket@@@@QEAAPEAPEAVPacket@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIAppHostAdminManager@@@@PEAUIAppHostAdminManager@@@@QEAAPEAPEAUIAppHostAdminManager@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIAppHostChildElementCollection@@@@PEAUIAppHostChildElementCollection@@@@QEAAPEAPEAUIAppHostChildElementCollection@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIAppHostConfigException@@@@PEAUIAppHostConfigException@@@@QEAAPEAPEAUIAppHostConfigException@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIAppHostElement@@@@PEAUIAppHostElement@@@@QEAAPEAPEAUIAppHostElement@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIAppHostElementCollection@@@@PEAUIAppHostElementCollection@@@@QEAAPEAPEAUIAppHostElementCollection@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIAppHostProperty@@@@PEAUIAppHostProperty@@@@QEAAPEAPEAUIAppHostProperty@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIAppHostPropertyCollection@@@@PEAUIAppHostPropertyCollection@@@@QEAAPEAPEAUIAppHostPropertyCollection@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIClientSecurity@@@@PEAUIClientSecurity@@@@QEAAPEAPEAUIClientSecurity@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIEnumWbemClassObject@@@@PEAUIEnumWbemClassObject@@@@QEAAPEAPEAUIEnumWbemClassObject@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIErrorInfo@@@@PEAUIErrorInfo@@@@QEAAPEAPEAUIErrorInfo@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIUnknown@@@@PEAUIUnknown@@@@QEAAPEAPEAUIUnknown@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIWbemClassObject@@@@PEAUIWbemClassObject@@@@QEAAPEAPEAUIWbemClassObject@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIWbemContext@@@@PEAUIWbemContext@@@@QEAAPEAPEAUIWbemContext@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIWbemLocator@@@@PEAUIWbemLocator@@@@QEAAPEAPEAUIWbemLocator@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIWbemObjectTextSrc@@@@PEAUIWbemObjectTextSrc@@@@QEAAPEAPEAUIWbemObjectTextSrc@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIWbemPath@@@@PEAUIWbemPath@@@@QEAAPEAPEAUIWbemPath@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIWbemPathKeyList@@@@PEAUIWbemPathKeyList@@@@QEAAPEAPEAUIWbemPathKeyList@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIWbemQualifierSet@@@@PEAUIWbemQualifierSet@@@@QEAAPEAPEAUIWbemQualifierSet@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIWbemQuery@@@@PEAUIWbemQuery@@@@QEAAPEAPEAUIWbemQuery@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIWbemServices@@@@PEAUIWbemServices@@@@QEAAPEAPEAUIWbemServices@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@VCWSManEPR@@@@PEAVCWSManEPR@@@@QEAAPEAPEAVCWSManEPR@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@VCWinRSPluginConfigCache@@@@PEAVCWinRSPluginConfigCache@@@@QEAAPEAPEAVCWinRSPluginConfigCache@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@VCommand@Client@WSMan@@@@PEAVCommand@Client@WSMan@@@@QEAAPEAPEAVCommand@Client@WSMan@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@VEnumSinkEx@@@@PEAVEnumSinkEx@@@@QEAAPEAPEAVEnumSinkEx@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@VGeneralSinkEx@@@@PEAVGeneralSinkEx@@@@QEAAPEAPEAVGeneralSinkEx@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@VIRequestContext@@@@PEAVIRequestContext@@@@QEAAPEAPEAVIRequestContext@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@VReceiveOperation@Client@WSMan@@@@PEAVReceiveOperation@Client@WSMan@@@@QEAAPEAPEAVReceiveOperation@Client@WSMan@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@VSendOperation@Client@WSMan@@@@PEAVSendOperation@Client@WSMan@@@@QEAAPEAPEAVSendOperation@Client@WSMan@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@VShell@Client@WSMan@@@@PEAVShell@Client@WSMan@@@@QEAAPEAPEAVShell@Client@WSMan@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@VSignalOperation@Client@WSMan@@@@PEAVSignalOperation@Client@WSMan@@@@QEAAPEAPEAVSignalOperation@Client@WSMan@@XZ
?Storage@?$AutoCleanup@VAutoBstr@@PEAG@@QEAAPEAPEAGXZ
?Storage@?$AutoCleanup@VAutoBstrNoAlloc@@PEAG@@QEAAPEAPEAGXZ
?Storage@?$AutoCleanup@VAutoCertContext@@PEBU_CERT_CONTEXT@@@@QEAAPEAPEBU_CERT_CONTEXT@@XZ
?Storage@?$AutoCleanup@VAutoChainContext@@PEBU_CERT_CHAIN_CONTEXT@@@@QEAAPEAPEBU_CERT_CHAIN_CONTEXT@@XZ
?Storage@?$AutoCleanup@VAutoHandle@@PEAX@@QEAAPEAPEAXXZ
?Storage@?$AutoCleanup@VAutoImpersonateUser@@PEAX@@QEAAPEAPEAXXZ
?Storage@?$AutoCleanup@VAutoLocalFree@@PEAX@@QEAAPEAPEAXXZ
?Storage@?$AutoCleanup@VAutoMIClass@@PEAU_MI_Class@@@@QEAAPEAPEAU_MI_Class@@XZ
?Storage@?$AutoCleanup@VAutoMIInstance@@PEAU_MI_Instance@@@@QEAAPEAPEAU_MI_Instance@@XZ
?Storage@?$AutoCleanup@VAutoRegKey@@PEAUHKEY__@@@@QEAAPEAPEAUHKEY__@@XZ
?Storage@?$AutoCleanup@VAutoSecurityDescriptor@@PEAX@@QEAAPEAPEAXXZ
?Storage@?$AutoCleanup@VAutoWaitHandle@@PEAX@@QEAAPEAPEAXXZ
?StoreData@CWSManResource@@AEAAHPEAVIRequestContext@@PEBG11PEAU_WSMAN_SELECTOR_SET@@PEAU_WSMAN_OPTION_SET@@@Z
?StoreData@CWSManResource@@QEAAHPEAVIRequestContext@@PEBG@Z
?StoreDataFromResourceLocator@CWSManResource@@AEAAHPEAVIRequestContext@@PEAU_WSMAN_RESOURCE_LOCATOR@@@Z
?StoreExpansion@CResourceAlias@@AEAAXPEBGPEAU_ALIAS_INFORMATION@@@Z
?StreamingOutput@ExtendedSemantic@@2KB
?StringConcatenate@CWSManResourceNoResourceUri@@IEAAHAEAPEAGAEAKKPEAG@Z
?StringToDword@@YAHPEBDPEAK@Z
?StringToDword@@YAHPEBGPEAK@Z
?Subscribe@CWSManGroupPolicyManager@@UEAAHPEAVIRequestContext@@PEAVIWSManGroupPolicyObserver@@H@Z
?TruncateAt@TSTRBUFFER@@QEAAXI@Z
?TryAcquire@CWSManCriticalSection@@QEAAHXZ
?UnSubscribe@CWSManGroupPolicyManager@@UEAAHPEAVIRequestContext@@PEAVIWSManGroupPolicyObserver@@@Z
?UnregisterChild@ChildLifeTimeManager@@QEAAXXZ
?UnregisterPolicyNotification@CWSManGroupPolicyManager@@AEAAHXZ
?Up@?$LoaderSerializer@VSubscriptionManager@@$01@@AEAAJXZ
?UpdateCredentialsInCredmanStore@CConfigManager@@SAHPEAVIRequestContext@@PEAG1@Z
?UpdateKey@CWSManResourceNoResourceUri@@QEAAHPEAVIRequestContext@@PEBG1@Z
?Uri@CResourceAlias@@QEAAPEBGXZ
?UseClientToken@UserRecord@@QEAA_NXZ
?UseDefaultConfig@CErrorContext@@UEBAHXZ
?UsingDefaultLCID@Locale@@QEAA_NXZ
?Validate@Locale@@SA_NPEAU_WSMAN_DATA@@@Z
?Validate@Locale@@SA_NPEBG@Z
?ValidateCBTHardeningLevel@ConfigRegistry@@IEAAHPEAVIRequestContext@@PEBG@Z
?ValidateCertificateHash@ConfigRegistry@@IEAAHPEAVIRequestContext@@PEBG111@Z
?ValidateHeaders@PacketParser@@QEAAHPEAVIRequestContext@@K@Z
?ValidateHostnameAndCertificateCN@ConfigRegistry@@IEAAHPEAVIRequestContext@@PEBG1@Z
?ValidateIPFilter@ConfigRegistry@@IEAAHPEAVIRequestContext@@W4ConfigSetting@@PEBG@Z
?ValidateInt@CWSManGroupPolicyManager@@AEAAHPEAVIRequestContext@@PEBU_WSMAN_POLICY_INFO@@K@Z
?ValidateInt@ConfigRegistry@@IEAAHPEAVIRequestContext@@PEAU_CONFIG_INFO@@KPEBG@Z
?ValidateString@CWSManGroupPolicyManager@@AEAAHPEAVIRequestContext@@PEBU_WSMAN_POLICY_INFO@@PEBG@Z
?ValidateString@ConfigRegistry@@IEAAHPEAVIRequestContext@@PEAU_CONFIG_INFO@@PEBG@Z
?ValidateTrustedHosts@ConfigRegistry@@IEAAHPEAVIRequestContext@@PEBG@Z
?ValidateUrlPrefix@ConfigRegistry@@IEAAHPEAVIRequestContext@@PEBG@Z
?Verbose@ExtendedSemantic@@2KB
?VerifyState@RBUFFER@@IEBAXXZ
?WaitForAllChildrenToUnregister@ChildLifeTimeManager@@QEAAXK@Z
?WaitForConditionVar@CWSManCriticalSectionWithConditionVar@@QEAAKK@Z
?WaitForMore@PacketParser@@UEAA_NXZ
?WakeAllWaitingForConditionVar@CWSManCriticalSectionWithConditionVar@@QEAAXXZ
?WakeAllWaitingOnNoOfChildren@ChildLifeTimeManager@@AEAAXXZ
?Warning@EventLog@@SAXK@Z
?Warning@EventLog@@SAXKGPEAPEBG@Z
?Warning@EventLog@@SAXKPEBG@Z
?Warning@ExtendedSemantic@@2KB
?WatchForChanges@CServiceConfigCache@@QEAAPEAVCServiceWatcher@1@PEAVIRequestContext@@PEAVIServiceConfigObserver@@@Z
?Write@EventHandler@WSMan@@SAXAEBU_EVENT_DESCRIPTOR@@KPEAU_EVENT_DATA_DESCRIPTOR@@@Z
?WriteCredentialsToCredmanStore@CConfigManager@@SAHPEAVIRequestContext@@PEAG1H@Z
?WriteSoapA@EventHandler@WSMan@@SAXAEBU_EVENT_DESCRIPTOR@@PEBDK@Z
?WriteSoapMessageA@EventHandler@WSMan@@AEAAXAEBU_EVENT_DESCRIPTOR@@PEBDK@Z
?WriteSoapMessageW@EventHandler@WSMan@@AEAAXAEBU_EVENT_DESCRIPTOR@@PEBGK@Z
?WriteSoapMessageW_BE@EventHandler@WSMan@@AEAAXAEBU_EVENT_DESCRIPTOR@@PEBGK@Z
?WriteSoapW@EventHandler@WSMan@@SAXAEBU_EVENT_DESCRIPTOR@@PEBGK@Z
?WriteSoapW_BE@EventHandler@WSMan@@SAXAEBU_EVENT_DESCRIPTOR@@PEBGK@Z
?_PolicyChangedCallback@CWSManGroupPolicyManager@@CAXPEAXE@Z
?back@?$SimpleQueue@T_LARGE_INTEGER@@@@QEBA?BT_LARGE_INTEGER@@XZ
?empty@?$SimpleQueue@T_LARGE_INTEGER@@@@QEBA_NXZ
?front@?$SimpleQueue@T_LARGE_INTEGER@@@@QEBA?BT_LARGE_INTEGER@@XZ
?g_Resources@Locale@@0V?$Loader@VResources@Locale@@$0A@@@A
?getBufSync@BufferFormatter@@UEAAPEAVCWSManCriticalSection@@XZ
?isValid@?$SafeSet@PEAVCListenerOperation@@@@QEBA_NXZ
?m_migContext@ConfigRegistry@@2PEAVWSManMigrationContext@@EA
?pop@?$SimpleQueue@T_LARGE_INTEGER@@@@QEAAXXZ
?push@?$SimpleQueue@T_LARGE_INTEGER@@@@QEAAKT_LARGE_INTEGER@@@Z
?s_cacheMap@CClientConfigCache@@0V?$AutoRelease@VCConfigCacheMap@CBaseConfigCache@@@@A
?s_cacheMap@CServiceConfigCache@@0V?$AutoRelease@VCConfigCacheMap@CBaseConfigCache@@@@A
?s_cacheMap@CWinRSPluginConfigCache@@0V?$AutoRelease@VCConfigCacheMap@CBaseConfigCache@@@@A
?s_config@CConfigManager@@0V?$AutoRelease@VCConfigManager@@@@A
?s_lock@CConfigManager@@0VFastLock@@A
?s_lock@CWSManGroupPolicyManager@@0VFastLock@@A
?s_mapLock@CClientConfigCache@@0VFastLock@@A
?s_mapLock@CServiceConfigCache@@0VFastLock@@A
?s_mapLock@CWinRSPluginConfigCache@@0VFastLock@@A
?s_policyManager@CWSManGroupPolicyManager@@0V?$AutoRelease@VCWSManGroupPolicyManager@@@@A
ClearSubKeys
CreateProvHost
EnableAllPrivileges
EnumServiceUserResources
FwGetParsedDocument
FwGetRootElement
FwIsXmlEscapedProperly
FwXmlAddAttributeToAttributeList
FwXmlCloseParser
FwXmlCompareAttributeName
FwXmlCompareAttributeNameEx
FwXmlCompareElementName
FwXmlCompareElementNameEx
FwXmlCompareElementNameLen
FwXmlCompareElementNameSpace
FwXmlCompareName
FwXmlCreateXmlFromElement
FwXmlDecodeXmlEscapes
FwXmlEncodeXmlEscapes
FwXmlFindAttribute
FwXmlFindAttributeEx
FwXmlFindChildElement
FwXmlFindChildElementEx
FwXmlGetAttribute
FwXmlGetAttributeNameEx
FwXmlGetAttributeNamespacePrefix
FwXmlGetAttributeValue
FwXmlGetAttributeValueDWord
FwXmlGetBooleanValue
FwXmlGetBuffer
FwXmlGetChild
FwXmlGetElementName
FwXmlGetElementNameEx
FwXmlGetElementNamespacePrefix
FwXmlGetElementNamespaceUrl
FwXmlGetEntryNameEx
FwXmlGetNamespaceForPrefix
FwXmlGetNormalizedString
FwXmlGetReferenceXmlFromElement
FwXmlGetRemainder
FwXmlGetSimpleContent
FwXmlGetSimpleContentEx
FwXmlGetSimpleContentEx2
FwXmlHasText
FwXmlIsEmpty
FwXmlIsMustUnderstand
FwXmlIsNull
FwXmlIsSimpleContent
FwXmlIsSimpleContentOrEmpty
FwXmlIsTrueValue
FwXmlNumAttributes
FwXmlNumChildren
FwXmlNumChildrenWithName
FwXmlNumConsecutiveChildrenWithName
FwXmlParsePrefixedXML
FwXmlParseStream
FwXmlParseText
FwXmlParserCreate
FwXmlUpdatePrefixes
GetServiceCatalog
GetServiceSecurity
HandleMigration
IsStringNullOrEmpty
MI_Application_InitializeV1
MoveSettingsToMigrationKey
PrintHandleTrace
PrintReleaseTrace
PrintUnregisterWaitTrace
RegisterModule
RemoveHttpsBinding
RemoveHttpsCertificate
RemovePluginXmlNewAttrForThresholdOrGreater
RestoreAllPrivileges
SafeStringToUI64
ServiceMain
SetServiceSecurity
StartSoapProcessor
StopSoapProcessor
StringCchEndsWithCI
StringCchEquals
StringCchEqualsCI
StringCchStartsWith
StringCchStartsWithCI
StringIsBlank
StringTrimWhitespace
SubscriptionsProvEnumerate
SvchostPushServiceGlobals
UninstallMigration
UpdateHttpsBinding
UpdateHttpsCertificate
WSManAckEvents
WSManAddSubscriptionManagerInternal
WSManCloseCommand
WSManCloseEnumerationHandle
WSManCloseEnumeratorHandle
WSManCloseObjectHandle
WSManCloseOperation
WSManClosePublisherHandle
WSManCloseSession
WSManCloseSessionHandle
WSManCloseShell
WSManCloseSubscriptionHandle
WSManConnectShell
WSManConnectShellCommand
WSManConstructError
WSManCreateEnumeratorInternal
WSManCreateInternal
WSManCreateInternalEx
WSManCreatePullSubscription
WSManCreatePushSubscription
WSManCreateSession
WSManCreateSessionInternal
WSManCreateShell
WSManCreateShellEx
WSManDecodeObject
WSManDeinitialize
WSManDeleteInternal
WSManDeleteInternalEx
WSManDeliverEndSubscriptionNotification
WSManDeliverEvent
WSManDisconnectShell
WSManEncodeObject
WSManEncodeObjectEx
WSManEncodeObjectInternal
WSManEnumerateInternal
WSManEnumerateInternalEx
WSManEnumeratorAddEvent
WSManEnumeratorAddObject
WSManEnumeratorBatchPolicyViolated
WSManEnumeratorNextObject
WSManEnumeratorObjectCount
WSManError
WSManGetErrorMessage
WSManGetInternal
WSManGetInternalEx
WSManGetSessionOptionAsDword
WSManGetSessionOptionAsString
WSManIdentifyInternal
WSManInitialize
WSManInvokeInternal
WSManInvokeInternalEx
WSManMemoryOperation
WSManPluginAuthzOperationComplete
WSManPluginAuthzQueryQuotaComplete
WSManPluginAuthzUserComplete
WSManPluginFreeRequestDetails
WSManPluginGetConfiguration
WSManPluginGetOperationParameters
WSManPluginInteractiveCallback
WSManPluginObjectAndBookmarkResult
WSManPluginObjectAndEprResult
WSManPluginObjectResult
WSManPluginOperationComplete
WSManPluginReceiveResult
WSManPluginReportCompletion
WSManPluginReportContext
WSManPluginShutdown
WSManPluginStartup
WSManPostThreadMessageW
WSManProvCreate
WSManProvDelete
WSManProvEnumerate
WSManProvGet
WSManProvInvoke
WSManProvPut
WSManPull
WSManPullEvents
WSManPutInternal
WSManPutInternalEx
WSManReceiveShellOutput
WSManReconnectShell
WSManReconnectShellCommand
WSManRemoveSubscriptionManagerInternal
WSManRunShellCommand
WSManRunShellCommandEx
WSManSendShellInput
WSManSetSessionOption
WSManSignalShell
WrapperCoSetProxyBlanket
mi_clientFT_V1
Name
.text
Size
1.8MB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
744KB
Virtual Size
741KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
64KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=78, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=476, id=1, productName=Unmarked objects,
count=7, id=257, version=33145,
count=11, id=261, version=33145,
count=24, id=260, version=33145,
count=1, id=256, version=33145,
count=198, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WsmWmiPl.dll
- IMPHASH cf7e5c3ad323ec0530a02671142b558e
- SHA256 0bad4e1351f0f9a7753d4fef30399d8cc19ab9ee27b0b4ae9bed6579e923322c
- MD5 84c012752944bef23f509c2d52061900
- SHA1 dbc7276ae40fd694f252484375c728ead1ad55e0
- SHA512 877a07d8cfac8aba76214e352def61629a3df6d05f2ae799164bde8046a379ddb94f1d7945c3f10691215bf43fa66751000509fe7c64a29357b44d59c1c2c057
- SSDEEP 6144:4gO6pDCOKWl3kwXd77sNQCbpIPG6152uNar1hTm7r:RjpDiWlU0svAG6152Sar1h6
- TLSH T16E64E61CA6BB2169E6B3C278C4435242D6B371315703AADF29E1C139BE57ED8BA74F01
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
8016
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WsmWmiPl.pdb
msvcrt
?terminate@@YAXXZ
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
memmove
memcpy
__CxxFrameHandler3
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
iswalnum
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_errno
wcstoul
wcscpy_s
wcstok_s
_wcsicoll
_HUGE
_purecall
wcstod
wcsncmp
_fpclass
wcsstr
towlower
iswdigit
_vsnwprintf
_wtoi
wcschr
_wcslwr
wcsrchr
_wcsicmp
_ultow_s
_itow_s
??1type_info@@UEAA@XZ
_lock
_unlock
__dllonexit
_onexit
memset
iswalpha
iswspace
__CxxFrameHandler4
wcscmp
api-ms-win-core-synch-l1-1-0
SetEvent
DeleteCriticalSection
EnterCriticalSection
WaitForMultipleObjectsEx
CreateEventW
ResetEvent
InitializeCriticalSectionEx
LeaveCriticalSection
WaitForSingleObject
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
GetTraceLoggerHandle
RegisterTraceGuidsW
GetTraceEnableLevel
UnregisterTraceGuids
GetTraceEnableFlags
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
CreateThread
oleaut32
GetErrorInfo
SysStringLen
SafeArrayDestroy
SafeArrayPutElement
SafeArrayCreate
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetDim
VariantCopy
VariantClear
VarCmp
VariantInit
SysFreeString
SysAllocString
api-ms-win-core-libraryloader-l1-1-0
LoadLibraryExW
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
miutils
WMIEventToCIMIndication
RtlInitializeCachedFastLock
?GetNoneCachedWmiClass@WMISchema@@UEAAJPEBGPEAUIWbemServices@@AEAV?$CComPtr@UIWbemClassObject@@@ATL@@PEAUIConversionContext@@@Z
RtlInterlockedWakeAll
RtlInterlockedCompareWait
MI_Hash
RtlDeleteCachedFastLock
RtlQueueAcquireCachedFastLockShared
RtlTryAcquireCachedFastLockShared
RtlReleaseCachedFastLockShared
RtlQueueAcquireCachedFastLockExclusive
RtlReleaseCachedFastLockExclusive
IsLifeCycleIndicationQuery
??1WMISchema@@UEAA@XZ
??0WMISchema@@QEAA@XZ
wsmsvc
??1?$AutoRelease@UIWbemQuery@@@@QEAA@XZ
??0?$AutoRelease@UIWbemQuery@@@@QEAA@PEAUIWbemQuery@@@Z
??C?$AutoCleanup@V?$AutoRelease@UIWbemQuery@@@@PEAUIWbemQuery@@@@QEAAPEAUIWbemQuery@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIWbemQuery@@@@PEAUIWbemQuery@@@@QEAAPEAPEAUIWbemQuery@@XZ
WSManDeliverEndSubscriptionNotification
WSManDeliverEvent
WSManClosePublisherHandle
??0?$AutoRelease@UIEnumWbemClassObject@@@@QEAA@PEAUIEnumWbemClassObject@@@Z
??C?$AutoCleanup@V?$AutoRelease@UIEnumWbemClassObject@@@@PEAUIEnumWbemClassObject@@@@QEAAPEAUIEnumWbemClassObject@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIEnumWbemClassObject@@@@PEAUIEnumWbemClassObject@@@@QEAAPEAPEAUIEnumWbemClassObject@@XZ
WSManCloseObjectHandle
WSManEnumeratorAddEvent
??B?$AutoCleanup@V?$AutoRelease@UIUnknown@@@@PEAUIUnknown@@@@QEAAPEAUIUnknown@@XZ
FwXmlIsSimpleContentOrEmpty
??0ExtendedSemantic@@QEAA@K@Z
?Storage@?$AutoCleanup@VAutoHandle@@PEAX@@QEAAPEAPEAXXZ
??7?$AutoCleanup@VAutoHandle@@PEAX@@QEBA_NXZ
WSManPluginInteractiveCallback
?CreateAnEvent@SoapSemanticConverter@@QEAAKKPEAVSemanticMessage@@AEAVBufferFormatter@@PEAVIRequestContext@@@Z
??1SoapSemanticConverter@@QEAA@XZ
??0SoapSemanticConverter@@QEAA@XZ
?DuplicateCurrentToken@CSecurity@@SAHPEAPEAXKPEAU_SECURITY_ATTRIBUTES@@W4_SECURITY_IMPERSONATION_LEVEL@@W4_TOKEN_TYPE@@H@Z
?ImpersonateUserOrSelf@CSecurity@@SAHW4CallSiteId@@PEAX@Z
StringCchEndsWithCI
StringTrimWhitespace
?ParseHeaders@CWSManResourceNoResourceUri@@QEAAHPEAVIRequestContext@@PEAU_FWXML_ELEMENT@@11@Z
??1CWSManResourceNoResourceUri@@UEAA@XZ
??0CWSManResourceNoResourceUri@@QEAA@H@Z
?GetErrorCode@CErrorContext@@UEBAKXZ
??7?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@QEBA_NXZ
WSManEncodeObject
??4AutoBstrNoAlloc@@QEAAAEAV0@PEAG@Z
StringIsBlank
??4?$AutoRelease@UIWbemClassObject@@@@QEAAAEAV0@PEAUIWbemClassObject@@@Z
??7?$AutoCleanup@V?$AutoRelease@UIWbemClassObject@@@@PEAUIWbemClassObject@@@@QEBA_NXZ
??1?$AutoRelease@UIWbemObjectTextSrc@@@@QEAA@XZ
??0?$AutoRelease@UIWbemObjectTextSrc@@@@QEAA@XZ
??C?$AutoCleanup@V?$AutoRelease@UIWbemObjectTextSrc@@@@PEAUIWbemObjectTextSrc@@@@QEAAPEAUIWbemObjectTextSrc@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIWbemObjectTextSrc@@@@PEAUIWbemObjectTextSrc@@@@QEAAPEAPEAUIWbemObjectTextSrc@@XZ
?Storage@?$AutoCleanup@VAutoBstr@@PEAG@@QEAAPEAPEAGXZ
??1?$AutoRelease@UIUnknown@@@@QEAA@XZ
??1?$AutoDelete@VIQueryDASHSMASHInterface@@@@QEAA@XZ
??1?$AutoDelete@VISpecification@@@@QEAA@XZ
??4?$AutoDelete@VISpecification@@@@QEAAAEAV0@PEAVISpecification@@@Z
??0?$AutoDelete@VISpecification@@@@QEAA@PEAVISpecification@@@Z
??0?$AutoDelete@VISpecification@@@@QEAA@XZ
??B?$AutoCleanup@V?$AutoDelete@VISpecification@@@@PEAVISpecification@@@@QEAAPEAVISpecification@@XZ
WSManPluginOperationComplete
??1CErrorContext@@UEAA@XZ
??0CErrorContext@@QEAA@_N@Z
?Free@WSManMemory@@SAXPEAXH@Z
?Alloc@WSManMemory@@SAPEAX_KHW4_NitsFaultMode@@@Z
?CompleteWithErrorContext@CRequestContext@@QEAAXPEAU_WSMAN_PLUGIN_REQUEST@@@Z
??1CRequestContext@@UEAA@XZ
??0CRequestContext@@QEAA@XZ
WSManPluginObjectResult
??1CWSManCriticalSection@@QEAA@XZ
WSManError
??B?$AutoCleanup@V?$AutoDelete@VWmiEnumContext@@@@PEAVWmiEnumContext@@@@QEAAPEAVWmiEnumContext@@XZ
??C?$AutoCleanup@V?$AutoDelete@VWmiEnumContext@@@@PEAVWmiEnumContext@@@@QEAAPEAVWmiEnumContext@@XZ
??0?$AutoDelete@VWmiEnumContext@@@@QEAA@XZ
??1?$AutoDelete@VWmiEnumContext@@@@QEAA@XZ
??1TSTRBUFFER@@QEAA@XZ
??1?$AutoRelease@UIWbemServices@@@@QEAA@XZ
??1?$AutoDeleteVector@G@@QEAA@XZ
?GetWsmanData@TSTRBUFFER@@QEAAXPEAU_WSMAN_DATA@@@Z
?Reset@TSTRBUFFER@@QEAAXXZ
??0TSTRBUFFER@@QEAA@XZ
?GetSpaceUsed@BufferFormatter@@UEBAK_N@Z
?GetBuffer@BufferFormatter@@UEAAPEAEXZ
?Reset@BufferFormatter@@UEAAXXZ
??1BufferFormatter@@UEAA@XZ
??0BufferFormatter@@QEAA@XZ
?Acquire@CWSManCriticalSection@@QEAAXXZ
?Release@CWSManCriticalSection@@QEAAXXZ
??0AutoBstrNoAlloc@@QEAA@XZ
StringCchEqualsCI
StringCchEquals
?SetUpdateMode@BufferFormatter@@UEAAXW4Mode@1@@Z
?GrowBuffer@BufferFormatter@@UEAAKXZ
?GetError@BufferFormatter@@QEBAKXZ
StringCchStartsWithCI
??0AutoBstr@@QEAA@XZ
StringCchStartsWith
FwXmlCompareElementName
FwXmlGetElementNameEx
FwXmlNumChildren
FwXmlCloseParser
??0AutoBstr@@QEAA@PEAG@Z
?AllocBstr@WSManMemory@@SAPEAGPEBGHH@Z
FwXmlGetChild
SafeStringToUI64
?ParseEprElement@CWSManEPR@@SAPEAV1@PEAVIRequestContext@@PEAU_FWXML_ELEMENT@@@Z
?GetUri@CWSManResource@@QEAAPEBGXZ
?GetKeyCount@CWSManResourceNoResourceUri@@QEAAKXZ
?GetKeys@CWSManResourceNoResourceUri@@QEAAPEAU_WSMAN_KEY@@XZ
?Parse@CWSManResource@@SAPEAV1@PEAVIRequestContext@@PEBGH@Z
FwXmlNumConsecutiveChildrenWithName
FwXmlNumChildrenWithName
FwXmlCompareName
FwXmlGetAttributeValue
?RecordMIFailure@IRequestContext@@QEAAXW4_MI_Result@@K@Z
??4AutoBstr@@QEAAAEAV0@PEAG@Z
FwXmlGetElementName
FwXmlHasText
FwXmlIsSimpleContent
FwXmlGetSimpleContentEx
FwXmlIsNull
FwXmlIsEmpty
?AppendXmlStartElem@TSTRBUFFER@@QEAAJPEBGHKPEAU_XML_ATTRIB@@@Z
?AppendXmlStartElemWithPrefix@TSTRBUFFER@@QEAAJPEBG0HKPEAU_XML_ATTRIB@@@Z
?AppendXmlEndElem@TSTRBUFFER@@QEAAJPEBG@Z
?AppendXmlEndElemWithPrefix@TSTRBUFFER@@QEAAJPEBG0@Z
?AppendEscapeXmlContent@TSTRBUFFER@@QEAAJPEBG_N@Z
?AppendXmlStartElemWithNamespaces@TSTRBUFFER@@QEAAJPEBGKPEAU_XML_NAMESPACE_PREFIX@@HKPEAU_XML_ATTRIB@@@Z
?AppendXmlStartElemWithNamespacesAndPrefixes@TSTRBUFFER@@QEAAJPEBG0KPEAU_XML_NAMESPACE_PREFIX@@HKPEAU_XML_ATTRIB@@@Z
FwXmlParserCreate
FwXmlParseText
FwXmlGetEntryNameEx
?StringToDword@@YAHPEBGPEAK@Z
??0?$AutoDeleteVector@E@@QEAA@XZ
??1?$AutoDeleteVector@E@@QEAA@XZ
??B?$AutoCleanup@V?$AutoDeleteVector@E@@PEAE@@QEAAPEAEXZ
RestoreAllPrivileges
EnableAllPrivileges
?SetLocale@CRequestContext@@QEAA_NPEBGK@Z
??B?$AutoCleanup@VAutoBstr@@PEAG@@QEAAPEAGXZ
??B?$AutoCleanup@VAutoBstrNoAlloc@@PEAG@@QEAAPEAGXZ
?Storage@?$AutoCleanup@VAutoBstrNoAlloc@@PEAG@@QEAAPEAPEAGXZ
?Storage@?$AutoCleanup@V?$AutoDeleteVector@E@@PEAE@@QEAAPEAPEAEXZ
??4?$AutoDeleteVector@E@@QEAAAEAV0@PEAE@Z
??B?$AutoCleanup@V?$AutoDelete@G@@PEAG@@QEAAPEAGXZ
??0?$AutoDelete@G@@QEAA@XZ
??4?$AutoDelete@G@@QEAAAEAV0@PEAG@Z
??B?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@QEAAPEAGXZ
??0?$AutoDeleteVector@G@@QEAA@XZ
??4?$AutoDeleteVector@G@@QEAAAEAV0@PEAG@Z
?Detach@?$AutoCleanup@V?$AutoRelease@UIWbemClassObject@@@@PEAUIWbemClassObject@@@@QEAAPEAUIWbemClassObject@@XZ
??B?$AutoCleanup@V?$AutoRelease@UIWbemClassObject@@@@PEAUIWbemClassObject@@@@QEAAPEAUIWbemClassObject@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIWbemClassObject@@@@PEAUIWbemClassObject@@@@QEAAPEAPEAUIWbemClassObject@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIWbemClassObject@@@@PEAUIWbemClassObject@@@@QEAAPEAUIWbemClassObject@@XZ
??0?$AutoRelease@UIWbemClassObject@@@@QEAA@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIWbemServices@@@@PEAUIWbemServices@@@@QEAAPEAPEAUIWbemServices@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIWbemServices@@@@PEAUIWbemServices@@@@QEAAPEAUIWbemServices@@XZ
??0?$AutoRelease@UIWbemServices@@@@QEAA@XZ
??4?$AutoRelease@UIWbemServices@@@@QEAAAEAV0@PEAUIWbemServices@@@Z
?Detach@?$AutoCleanup@V?$AutoRelease@UIWbemContext@@@@PEAUIWbemContext@@@@QEAAPEAUIWbemContext@@XZ
??B?$AutoCleanup@V?$AutoRelease@UIWbemContext@@@@PEAUIWbemContext@@@@QEAAPEAUIWbemContext@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIWbemContext@@@@PEAUIWbemContext@@@@QEAAPEAPEAUIWbemContext@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIWbemContext@@@@PEAUIWbemContext@@@@QEAAPEAUIWbemContext@@XZ
??0?$AutoRelease@UIWbemContext@@@@QEAA@XZ
??0?$AutoRelease@UIWbemContext@@@@QEAA@PEAUIWbemContext@@@Z
??7?$AutoCleanup@V?$AutoDelete@VTSTRBUFFER@@@@PEAVTSTRBUFFER@@@@QEBA_NXZ
??B?$AutoCleanup@V?$AutoDelete@VTSTRBUFFER@@@@PEAVTSTRBUFFER@@@@QEAAPEAVTSTRBUFFER@@XZ
??C?$AutoCleanup@V?$AutoDelete@VTSTRBUFFER@@@@PEAVTSTRBUFFER@@@@QEAAPEAVTSTRBUFFER@@XZ
??0?$AutoDelete@VTSTRBUFFER@@@@QEAA@PEAVTSTRBUFFER@@@Z
??4?$AutoDelete@VTSTRBUFFER@@@@QEAAAEAV0@PEAVTSTRBUFFER@@@Z
??B?$AutoCleanup@V?$AutoDeleteVector@PEAG@@PEAPEAG@@QEAAPEAPEAGXZ
??0?$AutoDeleteVector@PEAG@@QEAA@PEAPEAG@Z
??B?$AutoCleanup@V?$AutoRelease@UIWbemQualifierSet@@@@PEAUIWbemQualifierSet@@@@QEAAPEAUIWbemQualifierSet@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIWbemQualifierSet@@@@PEAUIWbemQualifierSet@@@@QEAAPEAPEAUIWbemQualifierSet@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIWbemQualifierSet@@@@PEAUIWbemQualifierSet@@@@QEAAPEAUIWbemQualifierSet@@XZ
??0?$AutoRelease@UIWbemQualifierSet@@@@QEAA@XZ
?Detach@?$AutoCleanup@V?$AutoRelease@UIUnknown@@@@PEAUIUnknown@@@@QEAAPEAUIUnknown@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIUnknown@@@@PEAUIUnknown@@@@QEAAPEAPEAUIUnknown@@XZ
??0?$AutoRelease@UIUnknown@@@@QEAA@XZ
??B?$AutoCleanup@V?$AutoRelease@VCWSManEPR@@@@PEAVCWSManEPR@@@@QEAAPEAVCWSManEPR@@XZ
??C?$AutoCleanup@V?$AutoRelease@VCWSManEPR@@@@PEAVCWSManEPR@@@@QEAAPEAVCWSManEPR@@XZ
??0?$AutoRelease@VCWSManEPR@@@@QEAA@PEAVCWSManEPR@@@Z
??B?$AutoCleanup@V?$AutoDelete@VCWSManResource@@@@PEAVCWSManResource@@@@QEAAPEAVCWSManResource@@XZ
??C?$AutoCleanup@V?$AutoDelete@VCWSManResource@@@@PEAVCWSManResource@@@@QEAAPEAVCWSManResource@@XZ
??0?$AutoDelete@VCWSManResource@@@@QEAA@PEAVCWSManResource@@@Z
??B?$AutoCleanup@V?$AutoRelease@UIWbemPath@@@@PEAUIWbemPath@@@@QEAAPEAUIWbemPath@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIWbemPath@@@@PEAUIWbemPath@@@@QEAAPEAPEAUIWbemPath@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIWbemPath@@@@PEAUIWbemPath@@@@QEAAPEAUIWbemPath@@XZ
??0?$AutoRelease@UIWbemPath@@@@QEAA@PEAUIWbemPath@@@Z
??B?$AutoCleanup@V?$AutoRelease@UIWbemPathKeyList@@@@PEAUIWbemPathKeyList@@@@QEAAPEAUIWbemPathKeyList@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIWbemPathKeyList@@@@PEAUIWbemPathKeyList@@@@QEAAPEAPEAUIWbemPathKeyList@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIWbemPathKeyList@@@@PEAUIWbemPathKeyList@@@@QEAAPEAUIWbemPathKeyList@@XZ
??0?$AutoRelease@UIWbemPathKeyList@@@@QEAA@PEAUIWbemPathKeyList@@@Z
??B?$AutoCleanup@V?$AutoRelease@UIErrorInfo@@@@PEAUIErrorInfo@@@@QEAAPEAUIErrorInfo@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIErrorInfo@@@@PEAUIErrorInfo@@@@QEAAPEAPEAUIErrorInfo@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIErrorInfo@@@@PEAUIErrorInfo@@@@QEAAPEAUIErrorInfo@@XZ
??0?$AutoRelease@UIErrorInfo@@@@QEAA@XZ
??1?$AutoRelease@UIErrorInfo@@@@QEAA@XZ
??1?$AutoRelease@UIWbemContext@@@@QEAA@XZ
??1?$AutoRelease@UIWbemPathKeyList@@@@QEAA@XZ
??1?$AutoRelease@UIWbemPath@@@@QEAA@XZ
??1?$AutoDelete@VCWSManResource@@@@QEAA@XZ
??1?$AutoRelease@VCWSManEPR@@@@QEAA@XZ
?Detach@?$AutoCleanup@V?$AutoDelete@VISpecification@@@@PEAVISpecification@@@@QEAAPEAVISpecification@@XZ
??1?$AutoRelease@UIWbemQualifierSet@@@@QEAA@XZ
??1?$AutoDeleteVector@PEAG@@QEAA@XZ
??1?$AutoDelete@G@@QEAA@XZ
??1AutoBstr@@QEAA@XZ
??1AutoBstrNoAlloc@@QEAA@XZ
??1?$AutoDelete@VTSTRBUFFER@@@@QEAA@XZ
??1?$AutoRelease@UIWbemClassObject@@@@QEAA@XZ
?GetStrPtr@TSTRBUFFER@@QEAAPEAGXZ
?SetSize@TSTRBUFFER@@QEAAJII@Z
?AllocSysString@TSTRBUFFER@@QEBAJPEAPEAG@Z
?GetCharInUse@TSTRBUFFER@@QEBAIXZ
?QueryStr@TSTRBUFFER@@QEBAPEBGXZ
?AppendChar@TSTRBUFFER@@QEAAJG@Z
?Append@TSTRBUFFER@@QEAAJPEBGII@Z
?Append@TSTRBUFFER@@QEAAJPEBG@Z
?GetSizeInUse@SBUFFER@@QEBAIXZ
?Resize@RBUFFER@@QEAAHI@Z
?QuerySize@RBUFFER@@QEBAIXZ
??0CWSManCriticalSection@@QEAA@XZ
?IsValid@CWSManCriticalSection@@QEBAHXZ
??0AutoHandle@@QEAA@PEAX@Z
?GetToken@CSecurity@@SAPEAXXZ
??0AutoLocalFree@@QEAA@XZ
?ExtractSidFromToken@CSecurity@@SAHPEAVIRequestContext@@PEAXAEAVAutoLocalFree@@@Z
WrapperCoSetProxyBlanket
??B?$AutoCleanup@VAutoHandle@@PEAX@@QEAAPEAXXZ
??B?$AutoCleanup@VAutoLocalFree@@PEAX@@QEAAPEAXXZ
??B?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@QEBAQEAGXZ
?Detach@?$AutoCleanup@V?$AutoRelease@UIWbemServices@@@@PEAUIWbemServices@@@@QEAAPEAUIWbemServices@@XZ
??B?$AutoCleanup@V?$AutoRelease@UIWbemServices@@@@PEAUIWbemServices@@@@QEAAPEAUIWbemServices@@XZ
??B?$AutoCleanup@V?$AutoRelease@UIWbemServices@@@@PEAUIWbemServices@@@@QEBAQEAUIWbemServices@@XZ
??0?$AutoRelease@UIWbemServices@@@@QEAA@PEAUIWbemServices@@@Z
??B?$AutoCleanup@V?$AutoRelease@UIWbemLocator@@@@PEAUIWbemLocator@@@@QEAAPEAUIWbemLocator@@XZ
?Storage@?$AutoCleanup@V?$AutoRelease@UIWbemLocator@@@@PEAUIWbemLocator@@@@QEAAPEAPEAUIWbemLocator@@XZ
??C?$AutoCleanup@V?$AutoRelease@UIWbemLocator@@@@PEAUIWbemLocator@@@@QEAAPEAUIWbemLocator@@XZ
??0?$AutoRelease@UIWbemLocator@@@@QEAA@XZ
??0?$AutoRelease@UIClientSecurity@@@@QEAA@XZ
??1?$AutoRelease@UIClientSecurity@@@@QEAA@XZ
??1?$AutoRelease@UIWbemLocator@@@@QEAA@XZ
??1AutoLocalFree@@QEAA@XZ
??1AutoHandle@@QEAA@XZ
?AppendXmlStartFragment@TSTRBUFFER@@QEAAJXZ
?AppendXmlEndFragment@TSTRBUFFER@@QEAAJXZ
??0?$AutoRelease@UIWbemClassObject@@@@QEAA@PEAUIWbemClassObject@@@Z
??B?$AutoCleanup@V?$AutoRelease@UIEnumWbemClassObject@@@@PEAUIEnumWbemClassObject@@@@QEAAPEAUIEnumWbemClassObject@@XZ
??0?$AutoRelease@UIEnumWbemClassObject@@@@QEAA@XZ
??4?$AutoDelete@VWmiEnumContext@@@@QEAAAEAV0@PEAVWmiEnumContext@@@Z
??B?$AutoCleanup@V?$AutoRelease@VEnumSinkEx@@@@PEAVEnumSinkEx@@@@QEAAPEAVEnumSinkEx@@XZ
??C?$AutoCleanup@V?$AutoRelease@VEnumSinkEx@@@@PEAVEnumSinkEx@@@@QEAAPEAVEnumSinkEx@@XZ
??0?$AutoRelease@VEnumSinkEx@@@@QEAA@PEAVEnumSinkEx@@@Z
??1?$AutoRelease@VEnumSinkEx@@@@QEAA@XZ
??1?$AutoRelease@UIEnumWbemClassObject@@@@QEAA@XZ
?AppendXmlEndItem@TSTRBUFFER@@QEAAJXZ
?AppendXmlStartItem@TSTRBUFFER@@QEAAJXZ
??B?$AutoCleanup@V?$AutoRelease@VGeneralSinkEx@@@@PEAVGeneralSinkEx@@@@QEAAPEAVGeneralSinkEx@@XZ
??C?$AutoCleanup@V?$AutoRelease@VGeneralSinkEx@@@@PEAVGeneralSinkEx@@@@QEAAPEAVGeneralSinkEx@@XZ
??0?$AutoRelease@VGeneralSinkEx@@@@QEAA@PEAVGeneralSinkEx@@@Z
??1?$AutoRelease@VGeneralSinkEx@@@@QEAA@XZ
?CopyString@@YAPEAGPEBGAEBHAEAVIRequestContext@@@Z
??0AutoHandle@@QEAA@XZ
??0AutoLibrary@@QEAA@PEAUHINSTANCE__@@@Z
??1AutoLibrary@@QEAA@XZ
??4AutoHandle@@QEAAAEAV0@PEAX@Z
?IsEventEnabled@EventHandler@WSMan@@SA_NAEBU_EVENT_DESCRIPTOR@@@Z
?ReAlloc@WSManMemory@@SAPEAXPEAX_KHW4_NitsFaultMode@@@Z
?FormatDataDescriptor@EventHandler@WSMan@@SAXAEAU_EVENT_DATA_DESCRIPTOR@@AEAJ@Z
?Write@EventHandler@WSMan@@SAXAEBU_EVENT_DESCRIPTOR@@KPEAU_EVENT_DATA_DESCRIPTOR@@@Z
??B?$AutoCleanup@VAutoLibrary@@PEAUHINSTANCE__@@@@QEAAPEAUHINSTANCE__@@XZ
??B?$AutoCleanup@V?$AutoDelete@VIQueryDASHSMASHInterface@@@@PEAVIQueryDASHSMASHInterface@@@@QEAAPEAVIQueryDASHSMASHInterface@@XZ
??C?$AutoCleanup@V?$AutoDelete@VIQueryDASHSMASHInterface@@@@PEAVIQueryDASHSMASHInterface@@@@QEAAPEAVIQueryDASHSMASHInterface@@XZ
??0?$AutoDelete@VIQueryDASHSMASHInterface@@@@QEAA@XZ
??4?$AutoDelete@VIQueryDASHSMASHInterface@@@@QEAAAEAV0@PEAVIQueryDASHSMASHInterface@@@Z
?Detach@?$AutoCleanup@V?$AutoDeleteVector@G@@PEAG@@QEAAPEAGXZ
??0?$AutoDeleteVector@G@@QEAA@PEAG@Z
crypt32
CryptStringToBinaryW
api-ms-win-core-kernel32-legacy-l1-1-0
GetComputerNameW
api-ms-win-security-base-l1-1-0
RevertToSelf
api-ms-win-core-heap-obsolete-l1-1-0
LocalFree
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
??0?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@XZ
??0?$SafeMap_Iterator@VKey@Locale@@K@@QEAA@AEAV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@_N@Z
??0?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@AEBV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@_N@Z
??1?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@XZ
??1?$SafeMap_Iterator@VKey@Locale@@K@@QEAA@XZ
??1?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA@XZ
??1CWSManCriticalSectionWithConditionVar@@QEAA@XZ
??_7?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@6B@
?Acquire@?$SafeMap@VKey@CWmiPtrCache@@VMapping@2@V?$SafeMap_Iterator@VKey@CWmiPtrCache@@VMapping@2@@@@@UEBAXXZ
?Acquire@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEBAXXZ
?Acquire@?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAAXXZ
?Acquired@?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAA_NXZ
?AsReference@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEAAAEAV1@XZ
?Data@?$SafeMap_Iterator@VKey@Locale@@K@@IEBAAEAV?$STLMap@VKey@Locale@@K@@XZ
?DeInitialize@?$SafeMap@VKey@CWmiPtrCache@@VMapping@2@V?$SafeMap_Iterator@VKey@CWmiPtrCache@@VMapping@2@@@@@UEAA_NAEAVIRequestContext@@@Z
?DeInitialize@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEAA_NAEAVIRequestContext@@@Z
?GetInitError@CWSManCriticalSection@@QEBAKXZ
?GetMap@?$SafeMap_Iterator@VKey@Locale@@K@@QEBAAEAV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@XZ
?GetMap@?$SafeMap_Lock@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@QEBAAEBV?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@XZ
?Initialize@?$SafeMap@VKey@CWmiPtrCache@@VMapping@2@V?$SafeMap_Iterator@VKey@CWmiPtrCache@@VMapping@2@@@@@UEAA_NAEAVIRequestContext@@@Z
?Initialize@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEAA_NAEAVIRequestContext@@@Z
?IsValid@?$SafeMap_Iterator@VKey@CWmiPtrCache@@VMapping@2@@@QEBA_NXZ
?IsValid@?$SafeMap_Iterator@VKey@Locale@@K@@QEBA_NXZ
?Release@?$SafeMap@VKey@CWmiPtrCache@@VMapping@2@V?$SafeMap_Iterator@VKey@CWmiPtrCache@@VMapping@2@@@@@UEBAXXZ
?Release@?$SafeMap@VKey@Locale@@KV?$SafeMap_Iterator@VKey@Locale@@K@@@@UEBAXXZ
?Reset@?$SafeMap_Iterator@VKey@Locale@@K@@QEAAXXZ
?SkipOrphans@?$SafeMap_Iterator@VKey@Locale@@K@@IEAAXXZ
WSManPluginShutdown
WSManPluginStartup
WSManProvCreate
WSManProvDelete
WSManProvEnumerate
WSManProvGet
WSManProvIdentify
WSManProvInvoke
WSManProvPullEvents
WSManProvPut
WSManProvSubscribe
WSManProvUnsubscribe
Name
.text
Size
220KB
Virtual Size
216KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
76KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=36, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=405, id=1, productName=Unmarked objects,
count=7, id=257, version=33145,
count=8, id=261, version=33145,
count=18, id=260, version=33145,
count=1, id=256, version=33145,
count=32, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WudfSMCClassExt.dll
- IMPHASH 9e6a87008bb74f3a9e5d7d50b81bc2c0
- SHA256 0917be7b1e9cddb1b08899f16ba69bf73093255a3c61325f66daa1e6a70cd0c7
- MD5 f5229b7ad6f0a31960f1dadd811a9e3a
- SHA1 31d9d283efe8110b929d077c6062004f1376a349
- SHA512 dcb43e4e6f096251929c1e674329f32e61867f6521ba11c29a7f8996d6dd96a37190053d10f81a61e6144d8a796d236191ef0b3c641b3b28bd0d0aeedb56a0b9
- SSDEEP 1536:H+p6qYAmObmvgDfvsJ3KldzvMYd0G2x4m:S6qdPgCdDM8wx4m
- TLSH T16D730916ABDD4469E4B792B4AE774A69F231B8265B01C1EF5220431C2F73FD08F71B26
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4832
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WudfSMCClassExt.pdb
msvcrt
_initterm
_amsg_exit
_XcptFilter
memcpy
free
_callnewh
__C_specific_handler
malloc
memset
api-ms-win-eventing-classicprovider-l1-1-0
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
UnregisterTraceGuids
TraceMessage
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
DllCanUnloadNow
DllGetClassObject
Microsoft_WDF_UMDF_Version
Name
.text
Size
32KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
268B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=14, id=260, version=33145,
count=4, id=259, version=33145,
count=38, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=2, id=261, version=33145,
count=1, id=256, version=33145,
count=9, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WwaApi.dll
- IMPHASH 389e84e4ca41117e1b9fda12212cec99
- SHA256 9e07088e6ca261f0f2c1cfca1efefb840af2f075543d53b0644dcfc583459d23
- MD5 622abeb326c10dec2304e5b24b3853f7
- SHA1 08e05d8254406551ee736e8a525f03f0569a2259
- SHA512 0ca0b9cdd88e936953856af27a43d66c7d2f8c81cf474330432de6462e281a6f37222db7193a483c5e54a2a5ed5ed5dff70856bf3367182f454a660c548481df
- SSDEEP 6144:litozzAHFkSd207MI5hCcs3lSzpJa2NuQPJune/g01DpVLbV4z:0tozsSSd207MInCcJz7pV3ez
- TLSH T13BB4E7AA2B6C0652D476B13CC5279A09E7F17C915792E7CB02E402AFEE3FFD45835620
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
28336
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WwaApi.pdb
msvcrt
memcmp
memmove_s
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
free
malloc
_purecall
memcpy_s
_vsnwprintf
memset
api-ms-win-core-com-l1-1-0
CoMarshalInterface
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoGetApartmentType
CoWaitForMultipleHandles
CoCreateInstance
CreateStreamOnHGlobal
CoReleaseMarshalData
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
SetRestrictedErrorInfo
GetRestrictedErrorInfo
RoTransformError
RoOriginateErrorW
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate
IsErrorPropagationEnabled
api-ms-win-core-winrt-string-l1-1-0
HSTRING_UserUnmarshal
HSTRING_UserMarshal64
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsCreateString
WindowsCreateStringReference
HSTRING_UserFree
HSTRING_UserUnmarshal64
WindowsCompareStringOrdinal
HSTRING_UserSize64
WindowsDeleteString
WindowsDuplicateString
HSTRING_UserFree64
HSTRING_UserMarshal
HSTRING_UserSize
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
TraceMessage
GetTraceEnableLevel
api-ms-win-core-misc-l1-1-0
Sleep
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
OpenProcessToken
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
CreateEventExW
SetEvent
InitializeSRWLock
AcquireSRWLockShared
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
ReleaseMutex
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
SetLastError
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
GetModuleHandleW
GetProcAddress
GetModuleHandleExW
LoadStringW
FreeLibrary
GetModuleFileNameA
api-ms-win-downlevel-advapi32-l1-1-0
GetTokenInformation
api-ms-win-downlevel-kernel32-l1-1-0
QueueUserWorkItem
api-ms-win-downlevel-shlwapi-l2-1-0
SHGetThreadRef
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolQueueTask
ntdll
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlIsCriticalSectionLocked
RtlDeleteCriticalSection
rpcrt4
NdrStubForwardingFunction
NdrOleAllocate
NdrOleFree
NdrDllUnregisterProxy
NdrDllRegisterProxy
NdrDllCanUnloadNow
NdrDllGetClassObject
urlmon
CreateUri
oleaut32
SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo
Name
.text
Size
300KB
Virtual Size
299KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
164KB
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
24KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
24KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=56, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=17, id=260, version=33145,
count=3, id=261, version=33145,
count=145, id=1, productName=Unmarked objects,
count=11, id=257, version=33145,
count=1, id=256, version=33145,
count=36, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WwaExt.dll
- IMPHASH e475d06892b37cbd260c5eba22445fa7
- SHA256 b546a6fb7da15741791fe4415f7b73ab8400d353ef970c6e7e9ef9b932cffa16
- MD5 d0ba100af6859a1ddc980eb75507661e
- SHA1 9f5b3e515928f03454f365748a9d0c6caab60a41
- SHA512 80353023599b13bc066f987c6f6b442748ff59f15f73006e903983f342b387f6633bd0f317004d452d819b7e1dc66d99ea404ac5c1031df7c54e6e65d0d64b1c
- SSDEEP 768:/4cQQrG4dcqcqiqKu+oBcnKeJOUKdfRtL8motYdWfSTlHR08ObLzp:bdcqcqi5ceJY/y1tYYOlx7ObLl
- TLSH T116534D0AA7B810A9F57A917CCA830A1DD370B434532166DF636482AE1F73FE4753DB61
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
9584
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WwaExt.pdb
msvcrt
__C_specific_handler
_vsnwprintf
_initterm
_amsg_exit
_XcptFilter
_lock
__dllonexit
_onexit
free
malloc
_purecall
memcpy_s
_unlock
memset
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
FreeLibrary
LoadLibraryExW
GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExW
api-ms-win-core-synch-l1-1-0
CreateMutexExW
WaitForSingleObjectEx
WaitForSingleObject
CreateSemaphoreExW
ReleaseMutex
OpenSemaphoreW
ReleaseSemaphore
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetLastError
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-eventing-classicprovider-l1-1-0
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
ntdll
RtlIsCriticalSectionLocked
RtlDeleteCriticalSection
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
combase
ord90
ord157
CheckAllowDiagnosticsMode
DetermineCurrentDisplayRotationAngle
DllMain
ExtensionModulePreActivate
GetExtensionHostModuleCount
GetExtensionHostModuleFactory
GetExtensionWebModuleCount
GetExtensionWebModuleFactory
GetExtensionWebMultiThreadedModuleCount
GetExtensionWebMultiThreadedModuleFactory
ProcessDisplayRotation
SetPhoneWerParameters
StaticExtensionInitialization
StaticExtensionUnInitialization
WWABehaviorEnabled
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
64B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
320B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=54, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=16, id=260, version=33145,
count=5, id=259, version=33145,
count=1, id=261, version=33145,
count=128, id=1, productName=Unmarked objects,
count=9, id=257, version=33145,
count=1, id=256, version=33145,
count=28, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WwanPrfl.dll
- IMPHASH 27ffa8dbfdc73028af8afac597ddcb2c
- SHA256 4288693f7bb0ee80b6610d98c8632ee835627717d0a6cb89267f710201e9e02f
- MD5 b2430da65924b261f3f7a36e55dea2ce
- SHA1 105ab32f444fc230819c9e9b4e269739eb9a8303
- SHA512 4e3531e5c7596bb3fc6ebf6513a9e9018e6527b24f5b2f583116e618decd33630e19ac26c40462b46e61e7ff37349ad14efdaca9073bd3db463dd36d23b0c25e
- SSDEEP 3072:5CzYAZmeKIP4PzHZP/ke4uTInqElXfVLm5mK25nELh+:5uY4meKxPrZP94uTjunEL
- TLSH T1B3E3D71A33F50095F9B2927899760929F673B831531057EF4390416F0F77EE8AE7AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5664
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WwanPrfl.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wtoi
_o_free
_o_iswalnum
_o_iswdigit
_o_malloc
_o_memcpy_s
__C_specific_handler
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_CxxThrowException
__CxxFrameHandler3
__std_terminate
__CxxFrameHandler4
_o___stdio_common_vswprintf
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
RaiseException
GetLastError
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetProcAddress
GetModuleFileNameA
GetModuleHandleExW
DisableThreadLibraryCalls
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
LeaveCriticalSection
CreateSemaphoreExW
CreateMutexExW
OpenSemaphoreW
AcquireSRWLockExclusive
DeleteCriticalSection
InitializeCriticalSectionEx
WaitForSingleObject
WaitForSingleObjectEx
ReleaseMutex
ReleaseSemaphore
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
profapi
ord104
api-ms-win-core-com-l1-1-0
StringFromGUID2
CoCreateInstance
IIDFromString
crypt32
CryptProtectData
CryptUnprotectData
api-ms-win-core-heap-l2-1-0
LocalFree
oleaut32
SysAllocString
SysFreeString
VariantInit
VariantClear
VariantChangeType
SysStringLen
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
ntdll
RtlIpv6StringToAddressW
RtlIpv4StringToAddressW
RtlIpv4AddressToStringW
RtlIpv6AddressToStringW
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpW
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
WwanProfileCleanup
WwanProfileCopyProfile
WwanProfileDecryptPassword
WwanProfileDeinit
WwanProfileGenerateFile
WwanProfileGenerateXml
WwanProfileGetPath
WwanProfileGetRootPath
WwanProfileInit
WwanProfileLoadFile
WwanProfileLoadXml
WwanValidateApn
Name
.text
Size
80KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
376B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=53, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1146, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=24, id=261, version=33145,
count=1, id=256, version=33145,
count=9, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WwanRadioManager.dll
- IMPHASH a6cfb8a42311adb3ba213c9e77b5885e
- SHA256 4e0701290561e217ce5bf7bfb1b7cd52f3a1aae6011bce6dd8aec27782266e05
- MD5 e894e56f8b26f2ab03c23b5fb4d13ff5
- SHA1 83c72f0f28abfea93db3686aa574df3d3f9e3edc
- SHA512 64c8d6f0218f133385862ee5152c0f7558d436cff9b18ed95e807abfa58788d83dda8f383ba5ace008732cb363842e95391e52b8bb3bcc8d212f2a7583309fd7
- SSDEEP 1536:Wf7j7FAsH77Xamwm6hXO/4gK09GCMx73fv4Ip248k4d0I3Cq+rzYMNE:Wfe0qzY/4FkMbE4pQ3C7r1NE
- TLSH T105C3286EB6A810A6E276907CC5830B19D371B02D271257DF03B0827E5F27FE85E39B95
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
31568
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WwanRadioManager.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
memmove
_o_calloc
_o_free
_o_malloc
_CxxThrowException
__CxxFrameHandler3
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___stdio_common_vswprintf
__C_specific_handler
__std_terminate
__CxxFrameHandler4
__C_specific_handler_noexcept
memcpy
api-ms-win-crt-string-l1-1-0
memset
ntdll
RtlCaptureContext
EtwUnregisterTraceGuids
EtwTraceMessage
EtwGetTraceEnableFlags
RtlLookupFunctionEntry
EtwGetTraceLoggerHandle
EtwRegisterTraceGuidsW
NtQueryWnfStateData
RtlVirtualUnwind
EtwGetTraceEnableLevel
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetModuleHandleExA
GetProcAddress
GetModuleHandleW
GetModuleFileNameA
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateEventW
SetEvent
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
ResetEvent
LeaveCriticalSection
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
HeapDestroy
HeapReAlloc
HeapSize
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
CreateThread
GetCurrentProcessId
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
64KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
232B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
600B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=51, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1171, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=29, id=261, version=33145,
count=1, id=256, version=33145,
count=11, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
XAudio2_8.dll
- SHA256 34aae77da39898479dcff029f59a9f69788b52f7cab2f75929531b1273799f69
- MD5 57d363f6f8579c7db1ea03152ec1bbd0
- SHA1 4700877e2c3a927815e629adce2a9899673d022a
- SHA512 b7d344af251bb2dd022502ac3ba749a7ec4ff9b6c36c357205d085f05d1ef5202d243fb96ad14325134a9dd7584bd7c7979f2087e8f3ed07aea1de91db159bac
- SSDEEP 24:eFGSTSYHCbC2+giEOrtqCLDKqBwGDsmIZW0rlAVYNut4yU35WWdPPYPNC:ivRzrtqJr4lIZWQlAouxK5WwHg
- TLSH T1A2423E001BF84AB9F5E35BB5ABB31E9203767A28CD62C3196CA8401C1923640AA75F33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
xaudio2_8.pdb
CreateAudioReverb
CreateAudioVolumeMeter
CreateFX
X3DAudioCalculate
X3DAudioInitialize
XAudio2Create
XAudio2CreateWithVersionInfo
Name
.rdata
Size
4KB
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
XAudio2_9.dll
- IMPHASH 07addeab534bef47d4ab4b9d8c87851b
- SHA256 27a4b53cdabb0bdf10fd299dd297f9c30145232e9285a54f5c9bb660bb8676f0
- MD5 5adc018fcd21bb972f008a4ec4679f75
- SHA1 78aeefb94bf39fea583ead5c9741a4beb02aba6f
- SHA512 d637bbd4561a13cd1eac6a1fdc5b40ebd38bfaf22040ffbf204643d706142d2772fa9c68b6d0ba0c1b724fa50f5ed1bfa9e674d0ff31f34222fd32b64079b38b
- SSDEEP 12288:YqNW9fgvDaq2h1egNsDZyos92nB4sURR6qtiIuk/:YgWGOq2jegNyB4sUzWW
- TLSH T11AC47D27B6F448A5E1AB92389157B72FF372B41423528BC703A04259AFB77D01B763B1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
225680
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
XAudio2_9.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_clearfp
_control87
_initterm
api-ms-win-crt-private-l1-1-0
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o_acosf
_o_atan2
_o_atan2f
_o_cos
_o_cosf
_o_exp
_o_floor
_o_floorf
_o_free
_o_log
_o_malloc
_o_pow
_o_powf
_o_sin
_o_sinf
_o_sqrt
_o_sqrtf
_o_tanf
_o_wcscpy_s
_CxxThrowException
memmove
_o__configure_narrow_argv
_o__cexit
_o__callnewh
memcmp
memcpy
_o__aligned_malloc
_o__aligned_free
_o__crt_atexit
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__C_specific_handler
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetModuleFileNameA
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-1-0
SetEvent
CreateEventW
InitializeCriticalSection
SetWaitableTimer
TryEnterCriticalSection
ReleaseSemaphore
CreateWaitableTimerExW
ResetEvent
DeleteCriticalSection
WaitForMultipleObjectsEx
CancelWaitableTimer
EnterCriticalSection
CreateEventExA
WaitForSingleObjectEx
LeaveCriticalSection
CreateEventA
WaitForSingleObject
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringA
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-heap-l1-1-0
HeapFree
HeapSize
HeapCreate
GetProcessHeap
HeapAlloc
HeapDestroy
api-ms-win-core-com-l1-1-0
CoCreateGuid
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
StringFromGUID2
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
RaiseException
api-ms-win-core-synch-l1-2-0
InitializeConditionVariable
SleepConditionVariableCS
WakeAllConditionVariable
api-ms-win-core-processthreads-l1-1-0
GetThreadPriority
TerminateProcess
SetThreadPriority
GetCurrentProcess
CreateThread
ResumeThread
GetCurrentThreadId
GetCurrentProcessId
GetCurrentThread
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer
api-ms-win-core-processtopology-obsolete-l1-1-0
SetThreadAffinityMask
GetProcessAffinityMask
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemInfo
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
mmdevapi
ord17
avrt
AvRevertMmThreadCharacteristics
AvSetMmThreadCharacteristicsA
AvSetMmThreadPriority
api-ms-win-core-synch-l1-2-1
CreateSemaphoreW
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-registry-l1-1-0
RegOpenKeyExA
RegCloseKey
RegOpenKeyExW
RegQueryValueExA
RegQueryValueExW
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
CreateAudioReverb
CreateAudioReverbV2_8
CreateAudioVolumeMeter
CreateFX
X3DAudioCalculate
X3DAudioInitialize
XAudio2Create
XAudio2CreateV2_9
XAudio2CreateWithSharedContexts
XAudio2CreateWithVersionInfo
Name
.text
Size
384KB
Virtual Size
380KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.no_bbt
Size
4KB
Virtual Size
879B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
140KB
Virtual Size
136KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=33145,
count=53, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1177, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=11, id=260, version=33145,
count=6, id=259, version=33145,
count=21, id=261, version=33145,
count=1, id=256, version=33145,
count=109, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
XInput1_4.dll
- IMPHASH ca278125d1ea6d7e816c93f9a735d3fc
- SHA256 3dcf5e1e93fa1916dcc7f072ead810539095d80a32b14b67493c38effd75eabb
- MD5 4d5123f353b41d853f79b58011a39099
- SHA1 4ab5ba0b52ff49d609e0f6bad76fa5e74ca22a02
- SHA512 6dadc2c3771c5612d3d737062fcd7f2be6665a0b8f58a7daa8c5241e17a63f7d6e9a654a691dede5a8fc80ae065101106a163ba47f5e424f9ca5986a05384f5c
- SSDEEP 1536:g17o4fXhjMhfkPUXJcE4hMypahkiJS2Yba1Y1Mx+nO164ntg4yOX:gxo4ZAcCl46yCkiJ4MEn06Mi4yO
- TLSH T1C9B3392D726430A9E86A917CC5564255E7B1B428276127FF03B0C0BDEF67FE02E39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5600
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
XInput1_4.pdb
msvcrt
_onexit
_lock
_initterm
_unlock
free
_amsg_exit
_XcptFilter
_wcsnicmp
wcsstr
memcpy
malloc
__C_specific_handler
memmove_s
_purecall
_vsnwprintf
memcpy_s
__dllonexit
memcmp
memset
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
LoadLibraryExA
GetModuleFileNameA
GetModuleHandleExW
GetProcAddress
FreeLibrary
GetModuleHandleW
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
CreateMutexExW
CreateSemaphoreExW
EnterCriticalSection
ReleaseSemaphore
InitializeCriticalSection
ReleaseSRWLockShared
WaitForSingleObject
ReleaseMutex
SetEvent
OpenSemaphoreW
CreateEventW
ResetEvent
WaitForSingleObjectEx
AcquireSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
DeleteCriticalSection
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetLastError
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
CreateThread
GetCurrentProcess
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-eventing-classicprovider-l1-1-0
UnregisterTraceGuids
TraceMessage
GetTraceEnableLevel
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceLoggerHandle
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
GetSystemInfo
GetVersionExW
api-ms-win-core-quirks-l1-1-0
QuirkIsEnabled
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceExecuteOnce
api-ms-win-core-io-l1-1-0
GetOverlappedResult
DeviceIoControl
api-ms-win-core-com-l1-1-0
CoCreateInstance
api-ms-win-core-file-l1-1-0
CreateFileW
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventSetInformation
EventRegister
EventUnregister
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-devices-query-l1-1-0
DevCloseObjectQuery
DevCreateObjectQuery
api-ms-win-rtcore-ntuser-private-l1-1-4
ord2597
devobj
DevObjCreateDeviceInfoList
DevObjGetClassDevs
DevObjEnumDeviceInfo
DevObjEnumDeviceInterfaces
DevObjGetDeviceInterfaceDetail
DevObjGetDeviceProperty
DevObjDestroyDeviceInfoList
api-ms-win-downlevel-kernel32-l1-1-0
QueueUserWorkItem
api-ms-win-core-memory-l1-1-0
VirtualProtect
VirtualQuery
DllMain
XInputEnable
XInputGetAudioDeviceIds
XInputGetBatteryInformation
XInputGetCapabilities
XInputGetKeystroke
XInputGetState
XInputSetState
Name
.text
Size
64KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=48, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33145,
count=5, id=259, version=33145,
count=109, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=1, id=256, version=33145,
count=15, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
XInput9_1_0.dll
- IMPHASH 63d93368171f55b978aaeadef4dc5439
- SHA256 bab5e6e06df32cd7db46d0e94c0ecd9afcbf04798115de4588670d46a3c1a469
- MD5 8b57564f2a664294ca227a6367e6a72c
- SHA1 b6818ec9e5a12f8fd057c25763db77a72dbc671c
- SHA512 8b06e21a9562486511f29469dcce5493567777e072f4f8c8d3a0364e96ef281aed12decc9665ec44b734ed3997489f86503149583b0d66783bbb53d74b6e47f0
- SSDEEP 192:xS9JnD0DIUk5NFj4JffzroscCMT3NId6WTnW:YXD0kndkJffAsvo5WTnW
- TLSH T1A1F2D88AFBAC3ABDF079C27985A731062135B91617525BDF0330421D6E6ABD14A34FA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4752
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
XInput9_1_0.pdb
msvcrt
__C_specific_handler
_XcptFilter
_initterm
malloc
free
_amsg_exit
kernel32
Sleep
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
FreeLibrary
LoadLibraryExW
GetProcAddress
QueryPerformanceCounter
GetCurrentProcessId
DllMain
XInputGetCapabilities
XInputGetDSoundAudioDeviceGuids
XInputGetState
XInputSetState
Name
.text
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
360B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
132B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33136,
count=4, id=259, version=33136,
count=26, id=1, productName=Unmarked objects,
count=3, id=257, version=33136,
count=1, id=256, version=33136,
count=4, id=264, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
XInputUap.dll
- IMPHASH 72e6bee33e2bc11e671e657634fe88fb
- SHA256 8ae18f3fce83a133399efd20e19239d4d7fc0300329d98176148049456edb6f0
- MD5 17378df2abeb00d39bc4775e69ef446f
- SHA1 6db213d94fd25f69601ca2cf20adffaa623a4316
- SHA512 0e1000c94747f453bb75816b8124ce4c24dbaa63a4a9758f342ebb21dc8c7f70d343dd4a714dc6bf79a4a06cf2271fe7da8b038616ec9e9f7d84dced56c56e91
- SSDEEP 1536:JO8YBoEWA2Opv/h4AJsmaHqi4SuMX6Qm+KDpFPk0nCTmAEw:JO82WA2ClJsSSvXG+aHVnym4
- TLSH T10CA33A1F62A825EAE166513DC5174E19D3B0B021239227FF03E0C1BD9F67BD46D39BA2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5856
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
XInputUap.pdb
msvcrt
free
_initterm
__C_specific_handler
_XcptFilter
memmove_s
_purecall
??3@YAXPEAX@Z
malloc
_lock
_unlock
memcpy_s
__dllonexit
_onexit
__CxxFrameHandler3
memcmp
_vsnwprintf
_amsg_exit
_callnewh
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_CxxThrowException
memcpy
memmove
??1type_info@@UEAA@XZ
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetProcAddress
GetModuleHandleW
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
api-ms-win-core-synch-l1-1-0
OpenSemaphoreW
WaitForSingleObjectEx
EnterCriticalSection
ReleaseSRWLockShared
ReleaseSemaphore
AcquireSRWLockExclusive
InitializeSRWLock
CreateMutexExW
AcquireSRWLockShared
DeleteCriticalSection
ReleaseSRWLockExclusive
ReleaseMutex
WaitForSingleObject
LeaveCriticalSection
InitializeCriticalSectionEx
CreateSemaphoreExW
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
RaiseException
GetLastError
SetLastError
SetUnhandledExceptionFilter
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventRegister
EventWriteTransfer
EventUnregister
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetTickCount64
GetSystemTimeAsFileTime
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsCreateStringReference
api-ms-win-core-com-l1-1-0
CoCreateFreeThreadedMarshaler
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-winrt-error-l1-1-0
SetRestrictedErrorInfo
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
DllMain
XInputEnable
XInputGetAudioDeviceIds
XInputGetBatteryInformation
XInputGetCapabilities
XInputGetKeystroke
XInputGetState
XInputSetState
Name
.text
Size
52KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
700B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=38, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=14, id=260, version=33145,
count=5, id=259, version=33145,
count=92, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=6, id=261, version=33145,
count=1, id=256, version=33145,
count=7, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
XamlTileRender.dll
- IMPHASH af027dd52f9e34289533fb33d8c6aa7f
- SHA256 8f1f096b3710d8443a84a5644ecdd2b0b518dcb587d3b7b590d6095297392df9
- MD5 76bb9cb92e7e4baeb8873ea717fadf05
- SHA1 37d4ba5e0278c7853ae2a8d237cf4ee871c72ab7
- SHA512 6bf8e2364a922368df77938bd2a9b1cd1fb3d7ab5013e65c37f4e2098b1f01f0f6952f810301404fbb0fb9bf06fc09bdc401ddb0213e9917dcd1c0756164a1d4
- SSDEEP 6144:1UA9nl/MhMjJrGepgNtmp2vzFDnVPVoRjxnfHh:1UA9nl/IMjJDpgDmp2vz/WtH
- TLSH T1FF54081F66E80DE5E2B6F17C85835A0AF2713467572386CF039141AE1F2BEE89D39721
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
58928
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
XamlTileRender.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o__wtoi
_o_abort
_o_free
_o_iswspace
_o_malloc
_o_towlower
_o_wcstoul
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__crt_atexit
_o__configure_narrow_argv
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
wcscmp
memset
shcore
ord265
SHTaskPoolQueueTask
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetModuleHandleW
GetModuleFileNameA
FreeLibrary
GetProcAddress
LoadLibraryExW
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
Sleep
InitOnceExecuteOnce
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockExclusive
LeaveCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockShared
WaitForSingleObjectEx
WaitForSingleObject
OpenSemaphoreW
ReleaseSemaphore
InitializeSRWLock
EnterCriticalSection
CreateSemaphoreExW
AcquireSRWLockShared
InitializeCriticalSectionEx
DeleteCriticalSection
ReleaseMutex
CreateMutexExW
InitializeCriticalSection
CreateEventW
InitializeCriticalSectionAndSpinCount
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
RaiseException
SetUnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsDuplicateString
WindowsCreateStringReference
WindowsCreateString
WindowsGetStringRawBuffer
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
SetRestrictedErrorInfo
RoOriginateError
RoOriginateErrorW
GetRestrictedErrorInfo
RoFailFastWithErrorContext
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetLocaleInfoEx
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
CompareStringW
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-com-l1-1-0
PropVariantClear
CoGetApartmentType
CoTaskMemFree
CoCreateFreeThreadedMarshaler
CoGetObjectContext
CoTaskMemAlloc
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoActivateInstance
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedPushEntrySList
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventRegister
EventWriteTransfer
EventUnregister
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
TrySubmitThreadpoolCallback
SetThreadpoolTimer
CloseThreadpoolTimer
CreateThreadpoolTimer
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
SetEnvironmentVariableW
api-ms-win-core-winrt-error-l1-1-1
RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
RoOriginateLanguageException
IsErrorPropagationEnabled
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
msvcp_win
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
_Thrd_yield
oleaut32
GetErrorInfo
SetErrorInfo
SysStringLen
SysFreeString
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
204KB
Virtual Size
200KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
52KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=63, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=1198, id=1, productName=Unmarked objects,
count=4, id=257, version=33145,
count=27, id=261, version=33145,
count=1, id=256, version=33145,
count=12, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
XblAuthManager.dll
- IMPHASH e82426ab52ea9da2a39e4670dfed4fec
- SHA256 e7aee20af196513e9c428228ed5964aa1ac9f3e2a54b5b89c6b5d1615712c7d5
- MD5 637ac895e030b860cb11337b68a82d65
- SHA1 6ed41ab76248917d9db617c33e72ebeaddfaa09e
- SHA512 78f512f7147956ae0bca440eeb40c107920dec7754b276c56468e8e5286ebda9bcc8d0e9351bb5b5b358924558c7901b3f6014c4256290b143f59401906d20a2
- SSDEEP 12288:yzuNtXmJzkzNnPS7UumcjG83M9n+Fjhf00paRPOi9GVak47G2pFlIJE:yqcJyPK0cjiYfPaRGi9GV67G2pFloE
- TLSH T17A356B2EABEE01BAC1FAC17CC553542BE7B1742153315ACF079182AD1F17BE1A93AB11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
28608
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
XblAuthManager.pdb
msvcp_win
??0_Lockit@std@@QEAA@H@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??1_Lockit@std@@QEAA@XZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?is@?$ctype@G@std@@QEBA_NFG@Z
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?id@?$ctype@G@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?id@?$collate@G@std@@2V0locale@2@A
_Wcsxfrm
_Wcscoll
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
??1_Locinfo@std@@QEAA@XZ
?tolower@?$ctype@G@std@@QEBAGG@Z
?_Xbad_alloc@std@@YAXXZ
??0_Locinfo@std@@QEAA@PEBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__mkgmtime64
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__wcsicmp
_o__wcsnicmp
_o__wcstoui64
_o__wctime64_s
memmove
_o__wtoi64
_o_abort
_o_free
_o_iswdigit
_o_iswspace
_o_malloc
_o_memcpy_s
_o_realloc
_o_strncpy_s
_o_strtol
_o_terminate
_o_towlower
_o_towupper
_o_wcstol
_o_wcstombs_s
_o_wcstoul
__C_specific_handler
__CxxFrameHandler3
__current_exception
__current_exception_context
_CxxThrowException
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__i64tow_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
strrchr
strchr
wcsstr
wcschr
wcsrchr
_o___std_exception_copy
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
wcscmp
wcsncmp
memset
wcsnlen
api-ms-win-core-com-l1-1-0
CoResumeClassObjects
CoDecrementMTAUsage
CoCreateInstance
CoInitializeSecurity
CoRegisterClassObject
CoGetCallContext
CoGetStandardMarshal
StringFromGUID2
CoRevertToSelf
CoDisconnectContext
CoImpersonateClient
CoCreateGuid
CoRevokeClassObject
CoReleaseServerProcess
CoCreateFreeThreadedMarshaler
CoAddRefServerProcess
CoWaitForMultipleHandles
CoTaskMemAlloc
CoTaskMemFree
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
LoadLibraryExW
GetModuleFileNameW
FreeLibrary
GetModuleFileNameA
GetModuleHandleExW
DisableThreadLibraryCalls
GetProcAddress
api-ms-win-power-setting-l1-1-0
PowerSettingRegisterNotification
PowerSettingUnregisterNotification
api-ms-win-security-base-l1-1-0
CreateWellKnownSid
MakeAbsoluteSD
DuplicateTokenEx
ImpersonateLoggedOnUser
DuplicateToken
RevertToSelf
GetTokenInformation
IsValidSid
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
AdjustTokenPrivileges
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceExecuteOnce
Sleep
InitOnceComplete
api-ms-win-core-synch-l1-1-0
CreateSemaphoreExW
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
LeaveCriticalSection
InitializeCriticalSection
InitializeCriticalSectionEx
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
WaitForMultipleObjectsEx
CreateEventW
ReleaseSRWLockShared
ReleaseMutex
InitializeSRWLock
OpenSemaphoreW
WaitForSingleObjectEx
CreateEventExW
AcquireSRWLockExclusive
ReleaseSemaphore
ResetEvent
SetEvent
ReleaseSRWLockExclusive
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
RaiseException
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCompareStringOrdinal
WindowsCreateStringReference
WindowsDuplicateString
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsCreateString
WindowsGetStringLen
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventRegister
EventSetInformation
EventUnregister
EventActivityIdControl
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolWait
WaitForThreadpoolTimerCallbacks
CloseThreadpoolWait
CreateThreadpoolTimer
CreateThreadpoolWait
WaitForThreadpoolWaitCallbacks
SetThreadpoolTimer
CloseThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
OpenProcessToken
OpenThread
OpenThreadToken
GetCurrentProcess
TerminateProcess
SetThreadToken
GetCurrentProcessId
GetProcessIdOfThread
GetCurrentThreadId
GetCurrentThread
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoUninitialize
RoGetActivationFactory
RoInitialize
RoRevokeActivationFactories
RoRegisterActivationFactories
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
RoTransformError
RoOriginateError
api-ms-win-core-localization-l1-2-0
GetThreadPreferredUILanguages
FormatMessageW
GetUserDefaultLocaleName
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-service-core-l1-1-0
RegisterServiceCtrlHandlerExW
SetServiceStatus
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-sysinfo-l1-1-0
GetVersionExW
GetSystemTime
GetTickCount
GetTickCount64
GetSystemTimeAsFileTime
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedPushEntrySList
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
OpenProcess
IsProcessorFeaturePresent
combase
ord66
ord68
ord69
ord67
appxalluserstore
FamilyMonikerStringToSid
wininet
InternetQueryOptionW
InternetSetOptionW
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-core-registry-l1-1-0
RegEnumKeyExW
RegDeleteKeyExW
RegSetValueExW
RegDeleteValueW
RegCloseKey
RegDeleteTreeW
RegOpenCurrentUser
RegGetValueW
RegCreateKeyExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumValueW
RegQueryValueExW
rpcrt4
NdrMesTypeDecode3
MesBufferHandleReset
MesEncodeFixedBufferHandleCreate
I_RpcBindingInqLocalClientPID
RpcStringFreeW
MesDecodeBufferHandleCreate
RpcBindingFree
RpcBindingSetAuthInfoExW
NdrMesTypeEncode3
NdrMesTypeAlignSize3
NdrMesTypeFree3
RpcAsyncInitializeHandle
RpcSsDestroyClientContext
RpcStringBindingComposeW
MesHandleFree
RpcAsyncCompleteCall
Ndr64AsyncClientCall
UuidCreate
RpcAsyncCancelCall
RpcBindingFromStringBindingW
ntdll
RtlIpv6StringToAddressExW
NtQueryInformationToken
RtlGetVersion
RtlGetDeviceFamilyInfoEnum
RtlQueryWnfStateData
DbgPrintEx
RtlFreeSid
RtlIpv4AddressToStringW
RtlUnsubscribeWnfStateChangeNotification
RtlPublishWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlIpv4StringToAddressExW
api-ms-win-core-threadpool-legacy-l1-1-0
CreateTimerQueueTimer
QueueUserWorkItem
DeleteTimerQueueTimer
ChangeTimerQueueTimer
crypt32
CertAddCertificateContextToStore
CertOpenStore
CertCompareCertificate
CertDuplicateCertificateContext
CryptUnprotectMemory
CertCloseStore
CertEnumCertificatesInStore
CertDeleteCertificateFromStore
CryptProtectMemory
CryptUnprotectData
CryptProtectData
CertFreeCertificateContext
CertAddEncodedCertificateToStore
CryptQueryObject
CertGetCertificateContextProperty
winhttp
WinHttpCrackUrl
WinHttpCloseHandle
WinHttpOpen
WinHttpSetDefaultProxyConfiguration
WinHttpOpenRequest
WinHttpSetTimeouts
WinHttpConnect
WinHttpSetOption
WinHttpSetStatusCallback
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryOption
WinHttpReadData
WinHttpQueryHeaders
api-ms-win-security-capability-l1-1-0
CapabilityCheck
api-ms-win-core-psapi-l1-1-0
K32GetModuleFileNameExW
oleaut32
SetErrorInfo
GetErrorInfo
SysStringLen
SysFreeString
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
bcrypt
BCryptImportKeyPair
BCryptGenerateKeyPair
BCryptSignHash
BCryptExportKey
BCryptGetProperty
BCryptCreateHash
BCryptDestroyHash
BCryptHashData
BCryptOpenAlgorithmProvider
BCryptFinishHash
BCryptDestroyKey
BCryptCloseAlgorithmProvider
BCryptFinalizeKeyPair
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
RegDeleteKeyValueW
api-ms-win-security-lsalookup-l2-1-0
LookupPrivilegeValueW
LookupAccountNameW
api-ms-win-core-shutdown-l1-1-0
InitiateSystemShutdownExW
iphlpapi
GetAdaptersAddresses
ws2_32
InetPtonW
WSAGetLastError
htonl
api-ms-win-core-file-l1-1-0
FindNextFileW
FindClose
GetFileSize
CreateFileW
WriteFile
GetFileAttributesW
ReadFile
DeleteFileW
GetFileSizeEx
GetFileAttributesExW
FindFirstFileW
CreateDirectoryW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-service-management-l2-1-0
QueryServiceConfigW
QueryServiceStatusEx
api-ms-win-service-management-l1-1-0
StartServiceW
CloseServiceHandle
OpenSCManagerW
OpenServiceW
api-ms-win-service-winsvc-l1-1-0
ControlService
QueryServiceStatus
api-ms-win-core-memory-l1-1-0
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
api-ms-win-core-io-l1-1-0
CancelIoEx
GetOverlappedResult
api-ms-win-core-file-l2-1-0
ReadDirectoryChangesW
userenv
ExpandEnvironmentStringsForUserW
GetProfileType
api-ms-win-security-credentials-l1-1-0
CredUnprotectW
CredReadW
CredFree
CredDeleteW
CredWriteW
CredIsProtectedW
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
ncrypt
NCryptStreamOpenToProtect
NCryptStreamUpdate
NCryptStreamClose
NCryptCloseProtectionDescriptor
NCryptStreamOpenToUnprotect
NCryptCreateProtectionDescriptor
sspicli
LsaCallAuthenticationPackage
LsaConnectUntrusted
LsaDeregisterLogonProcess
LogonUserExExW
LsaLookupAuthenticationPackage
LsaRegisterLogonProcess
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-appmodel-identity-l1-2-0
AppContainerDeriveSidFromMoniker
api-ms-win-appmodel-runtime-l1-1-0
GetPackagesByPackageFamily
GetPackageFamilyName
urlmon
CreateUri
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-version-l1-1-0
VerQueryValueW
GetFileVersionInfoSizeExW
GetFileVersionInfoExW
api-ms-win-security-provider-l1-1-0
SetNamedSecurityInfoW
api-ms-win-core-kernel32-legacy-l1-1-0
GetComputerNameW
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
ServiceMain
Name
.text
Size
784KB
Virtual Size
780KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
188KB
Virtual Size
185KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
36KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
464B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=146, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=15, id=260, version=33145,
count=1527, id=1, productName=Unmarked objects,
count=11, id=257, version=33145,
count=35, id=261, version=33145,
count=7, id=259, version=33145,
count=1, id=256, version=33145,
count=71, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
XblAuthManagerProxy.dll
- IMPHASH c84e11374a1a90a1f76fe59384685df9
- SHA256 6ff08436d29ecc8780d429d5be553626b457225fee5c6a36b4a977c33a66f4a7
- MD5 f2fbd8cff0f4b593554c354f15d37dda
- SHA1 b897d45cb99e0073212f2e70aa27450fb8a8517c
- SHA512 214235bfa67a489fb0cb1b091260367255e108f7d724a62138d92798f6f7db3fb40759010547c74f0c10f0fb3c90a0c6edaa6e6d0e0e3370c865158a900e057c
- SSDEEP 1536:R6mtNKIN/Hq/hXAS7+3Pw6Kr5bZ3ZA8zEG6GAvHOqmEp:R6udN62p/JS5bVZA8zl6GAPTmE
- TLSH T1CBD3830B729145BBC4BE917940474A25E3B6ED21A3E247DB0180433D8EA77D4BF7AB9C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5664
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
XblAuthManagerProxy.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o_malloc
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__cexit
_o__callnewh
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
memcmp
_o___stdio_common_vswprintf
memcpy
api-ms-win-crt-string-l1-1-0
memset
ntdll
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
rpcrt4
NdrDllGetClassObject
NdrOleAllocate
NdrDllCanUnloadNow
NdrOleFree
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
api-ms-win-core-winrt-string-l1-1-0
HSTRING_UserFree64
HSTRING_UserSize64
HSTRING_UserMarshal
HSTRING_UserSize
HSTRING_UserFree
HSTRING_UserMarshal64
HSTRING_UserUnmarshal64
HSTRING_UserUnmarshal
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
api-ms-win-core-synch-l1-1-0
ReleaseSemaphore
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseMutex
LeaveCriticalSection
CreateSemaphoreExW
CreateMutexExW
OpenSemaphoreW
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSectionEx
EnterCriticalSection
WaitForSingleObjectEx
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
DisableThreadLibraryCalls
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-errorhandling-l1-1-0
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoGetStandardMarshal
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
api-ms-win-core-registry-l1-1-0
RegGetValueW
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
64KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=55, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1156, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=25, id=261, version=33145,
count=1, id=256, version=33145,
count=13, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
XblAuthTokenBrokerExt.dll
- IMPHASH b01ac661998c1182503f9822d14be80a
- SHA256 85835e6a490188c83a15f4b812f993855a81aa0942f01bbafd68b15d6edcfee6
- MD5 b1ea23f2fce5d7ea9f727d1e61923fb7
- SHA1 3d4ff42681dc30a9ef8e994c55a0171bd0c063fa
- SHA512 683bac534f00781eaffcc3a3b027eb9b7bd092985109410b4ba3387e7a5f194950dda22e291c29cc5ac1b87323035eb30cb8a3a0da9060e3a622dee57a885615
- SSDEEP 1536:cwWobV8UZsELCg2ehk1Fg260Ybzmq09V2rZMoncTAxCxJN2PEk2HKKc4sAWMr5/p:c2fsEWeWg2gH0vgETTEOXwMylUs3Bq
- TLSH T1E1B3286D22E811B5E276E17CC9E3090AD3B1B865232257EF0391416D0F77FE86D39B62
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
6576
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
XblAuthTokenBrokerExt.pdb
api-ms-win-crt-string-l1-1-0
memset
wcsnlen
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__cexit
_o__wcsicmp
_o_free
_o_malloc
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__callnewh
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__configure_narrow_argv
_o__crt_atexit
_o___stdio_common_vswprintf
wcschr
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringLen
WindowsDeleteString
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsGetStringRawBuffer
WindowsCreateString
WindowsCreateStringReference
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
OpenProcessToken
GetCurrentProcess
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleHandleW
GetModuleFileNameA
DisableThreadLibraryCalls
GetModuleHandleExW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
SetLastError
UnhandledExceptionFilter
RaiseException
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-synch-l1-1-0
CreateEventW
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
ReleaseSemaphore
DeleteCriticalSection
InitializeCriticalSectionEx
EnterCriticalSection
SetEvent
ReleaseMutex
ReleaseSRWLockShared
CreateSemaphoreExW
CreateMutexExW
ReleaseSRWLockExclusive
OpenSemaphoreW
WaitForSingleObject
AcquireSRWLockShared
AcquireSRWLockExclusive
WaitForSingleObjectEx
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
RoOriginateErrorW
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceExecuteOnce
InitOnceComplete
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegSetValueExW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
60KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
580B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=67, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=1185, id=1, productName=Unmarked objects,
count=2, id=257, version=33145,
count=27, id=261, version=33145,
count=1, id=256, version=33145,
count=8, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
XblGameSave.dll
- IMPHASH 58a15e5c0bd5d954c5894fb4b618180d
- SHA256 9d2eacbc8fd2e43fdd2b680804a7aca3da5f22fc98ef9436601d5aa8c159bfd3
- MD5 af3cd06b343e24ef99545b97377515a4
- SHA1 3f489e8fc5aa87d6fddcef95e9705835b1222dd4
- SHA512 f297e29ced4942e3d02307b8558dfc321a7a5e97c393ca00e33d4935b46dd3592f63bd93b873c1904f81a21a3420f9a92710f6a394b351fd53b5a8108fe35a0d
- SSDEEP 12288:BrM0gqLsvbHniF1GDa+lDMdwPtXGOgoJ5Y/GX+1NcK1G0F:S0gqLsvekDPlwaT1Y/GXKNcK1G
- TLSH T1F1054C5E95FC01A6E0FAD27DC997890BE6B27C114372DBCF0162426E0E17FE8563A721
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
15232
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
XblGameSave.pdb
msvcp_win
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??1_Locinfo@std@@QEAA@XZ
??1_Lockit@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??0_Lockit@std@@QEAA@H@Z
??1facet@locale@std@@MEAA@XZ
?_Xbad_function_call@std@@YAXXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$ctype@G@std@@2V0locale@2@A
?_Xbad_alloc@std@@YAXXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
_Wcscoll
?id@?$collate@G@std@@2V0locale@2@A
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?is@?$ctype@G@std@@QEBA_NFG@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?tolower@?$ctype@G@std@@QEBAGG@Z
??Bid@locale@std@@QEAA_KXZ
_Wcsxfrm
??0facet@locale@std@@IEAA@_K@Z
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__ultow_s
_o__wcsicmp
memmove
_o__wcstoui64
_o__wtoi
_o__wtoi64
_o_free
_o_malloc
_o_realloc
_o_tolower
_o_towupper
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__execute_onexit_table
_o__callnewh
_o__errno
_o___stdio_common_vswscanf
wcschr
wcsstr
__std_type_info_compare
strchr
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
memcpy
api-ms-win-crt-string-l1-1-0
wcsncmp
memset
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-processthreads-l1-1-0
OpenThreadToken
TerminateProcess
GetCurrentThreadId
GetCurrentThread
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
GetModuleHandleW
GetModuleFileNameA
GetModuleHandleExW
GetProcAddress
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-errorhandling-l1-1-0
SetLastError
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
RaiseException
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionEx
ReleaseSemaphore
ResetEvent
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
ReleaseMutex
CreateSemaphoreExW
WaitForSingleObjectEx
AcquireSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
WaitForSingleObject
CreateMutexExW
ReleaseSRWLockExclusive
InitializeCriticalSectionAndSpinCount
CreateEventW
OpenSemaphoreW
SetEvent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-com-l1-1-0
CoEnableCallCancellation
CoTaskMemAlloc
CoUninitialize
CoCancelCall
CoFreeUnusedLibraries
CoAddRefServerProcess
CoRevokeClassObject
CoDisableCallCancellation
CoDisconnectContext
CoDecrementMTAUsage
CoInitializeEx
CoResumeClassObjects
CoReleaseServerProcess
CoImpersonateClient
CoCreateInstance
CoRevertToSelf
CoCreateGuid
CoRegisterClassObject
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoSetProxyBlanket
CoSwitchCallContext
CoInitializeSecurity
StringFromGUID2
api-ms-win-core-winrt-l1-1-0
RoUninitialize
RoGetActivationFactory
RoActivateInstance
RoRevokeActivationFactories
RoRegisterActivationFactories
RoInitialize
api-ms-win-core-winrt-string-l1-1-0
WindowsDuplicateString
WindowsGetStringLen
WindowsCompareStringOrdinal
WindowsDeleteString
WindowsIsStringEmpty
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsCreateString
WindowsStringHasEmbeddedNull
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventUnregister
EventSetInformation
EventWriteTransfer
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
RoOriginateError
RoTransformError
api-ms-win-service-core-l1-1-0
SetServiceStatus
RegisterServiceCtrlHandlerExW
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceExecuteOnce
api-ms-win-security-sddl-l1-1-0
ConvertStringSidToSidW
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-security-base-l1-1-0
MakeAbsoluteSD
RevertToSelf
ImpersonateLoggedOnUser
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTime
GetTickCount64
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegGetValueW
RegCreateKeyExW
RegDeleteValueW
RegOpenKeyExW
RegDeleteKeyExW
RegEnumKeyExW
RegDeleteTreeW
RegEnumValueW
RegQueryInfoKeyW
RegSetValueExW
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolWork
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
CloseThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait
CloseThreadpoolTimer
CloseThreadpoolWork
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-power-setting-l1-1-0
PowerSettingRegisterNotification
PowerSettingUnregisterNotification
api-ms-win-service-management-l1-1-0
OpenSCManagerW
OpenServiceW
CloseServiceHandle
api-ms-win-service-management-l2-1-0
ChangeServiceConfigW
oleaut32
VariantInit
api-ms-win-security-lsalookup-l2-1-0
LookupAccountSidW
api-ms-win-core-heap-l2-1-0
LocalFree
rpcrt4
RpcServerUnregisterIf
RpcEpUnregister
RpcEpRegisterW
RpcServerInqBindings
RpcServerUseProtseqW
UuidCompare
UuidFromStringW
RpcImpersonateClient
RpcRevertToSelfEx
RpcServerRegisterIf3
NdrServerCallAll
NdrServerCall2
RpcBindingVectorFree
api-ms-win-core-file-l1-1-0
SetFilePointerEx
ReadFile
GetFileSizeEx
CreateDirectoryW
GetFileInformationByHandle
CreateFileW
GetFileAttributesW
FindFirstFileW
FindClose
WriteFile
SetEndOfFile
FindNextFileW
CompareFileTime
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
SystemTimeToFileTime
api-ms-win-core-threadpool-legacy-l1-1-0
CreateTimerQueueTimer
DeleteTimerQueueTimer
ntdll
NtFlushBuffersFileEx
NtSetInformationFile
RtlDosPathNameToNtPathName_U
NtQueryInformationToken
DbgPrintEx
NtQueryWnfStateData
RtlUnsubscribeWnfStateChangeNotification
RtlCapabilityCheck
RtlInitUnicodeString
RtlIsMultiSessionSku
RtlSubscribeWnfStateChangeNotification
combase
ord66
ord68
ord67
ord69
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
ServiceMain
Name
.text
Size
556KB
Virtual Size
555KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
184KB
Virtual Size
183KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
40KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=86, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33145,
count=5, id=259, version=33145,
count=1319, id=1, productName=Unmarked objects,
count=7, id=257, version=33145,
count=32, id=261, version=33145,
count=1, id=256, version=33145,
count=71, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
XblGameSaveExt.dll
- IMPHASH a901123a3bf7f950aca1530cb04aa3c8
- SHA256 5556996b9931f4b78a398551e5963de3590a05276be14b77e8aeef297a09b31c
- MD5 b151cd12ebcd749435779894734f2448
- SHA1 956a97579c952c43b38dcf2e7b90a972857abe51
- SHA512 52c140266e82e76fd00848bc3d17d5e6853dac42e14b68d82c09e57526dd7928f2c0a06be05745fb41e482c7e2a6af6c4c3c35cf539d3ca232cb7a351ea62ce8
- SSDEEP 3072:OheeqL/gyuriJam4xctuEsF2DQRvGSSfur+7pa6GzJ5BVSKn:+eFITiJam4OLlD4SGrXR5Vl
- TLSH T1E2145C5D72FA60A5D9BBD17CC6520A49F6B27435132122EF02D0C2B99F677E8B53CB10
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
10592
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
XblGameSaveExt.pdb
msvcrt
malloc
_unlock
__CxxFrameHandler3
_initterm
free
__dllonexit
memcmp
_lock
_amsg_exit
_XcptFilter
_onexit
_vsnwprintf
_wcsicmp
wcstombs_s
??_V@YAXPEAX@Z
_purecall
wcsncmp
qsort_s
wcschr
_vsnprintf
_wcsnicmp
wcstoul
swscanf_s
_callnewh
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_CxxThrowException
memcpy
memmove
??1type_info@@UEAA@XZ
??3@YAXPEAX@Z
memcpy_s
__C_specific_handler
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetProcAddress
GetModuleFileNameA
GetModuleHandleExW
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
InitializeSRWLock
ReleaseMutex
WaitForSingleObject
AcquireSRWLockExclusive
OpenSemaphoreW
ReleaseSemaphore
InitializeCriticalSection
CreateMutexExW
CreateSemaphoreExW
OpenEventW
DeleteCriticalSection
ReleaseSRWLockShared
CancelWaitableTimer
LeaveCriticalSection
AcquireSRWLockShared
SetEvent
CreateEventW
ReleaseSRWLockExclusive
WaitForSingleObjectEx
SetWaitableTimer
CreateWaitableTimerExW
api-ms-win-core-heap-l1-1-0
HeapReAlloc
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
GetLastError
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
QueueUserAPC
ResumeThread
CreateThread
GetCurrentThreadId
GetThreadPriority
TerminateProcess
GetCurrentProcessId
GetCurrentThread
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsCreateString
WindowsDeleteString
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetTickCount64
GetSystemTimeAsFileTime
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventSetInformation
EventRegister
EventWriteTransfer
api-ms-win-core-com-l1-1-0
CoInitializeEx
CoUninitialize
CoWaitForMultipleHandles
CoCreateInstance
CoTaskMemFree
CoGetCallContext
CoGetMalloc
CoCreateGuid
CoTaskMemAlloc
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegCloseKey
RegOpenKeyExW
dnsapi
DnsRecordListUnmapV4MappedAAAAInPlace
DnsFree
DnsQueryEx
winhttp
WinHttpQueryHeaders
WinHttpCrackUrl
WinHttpSetStatusCallback
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpConnect
WinHttpSetOption
WinHttpOpen
WinHttpSetTimeouts
WinHttpCreateUrl
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpWriteData
WinHttpQueryOption
WinHttpReadData
api-ms-win-core-file-l1-1-0
GetFileSizeEx
CreateFileW
DeleteFileW
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
crypt32
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertFreeCertificateContext
CertGetCertificateContextProperty
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
api-ms-win-core-path-l1-1-0
PathCchAddExtension
PathCchAppend
rpcrt4
UuidCreateSequential
api-ms-win-core-threadpool-legacy-l1-1-0
UnregisterWaitEx
api-ms-win-core-kernel32-legacy-l1-1-0
RegisterWaitForSingleObject
api-ms-win-mm-time-l1-1-0
timeEndPeriod
timeBeginPeriod
ntdll
RtlIpv4StringToAddressExW
NtQueryObject
RtlIpv6StringToAddressExW
RtlGetDeviceFamilyInfoEnum
RtlGetLastWin32Error
RtlIpv4AddressToStringExW
RtlIpv6AddressToStringExW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
XblGameSave_GetUserStorageRoot
XblGameSave_NTMSCreateInstance
XblGameSave_NTMSServerStart
XblGameSave_NTMSServerStop
Name
.text
Size
128KB
Virtual Size
125KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
724B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=72, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=16, id=260, version=33145,
count=5, id=259, version=33145,
count=183, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=9, id=261, version=33145,
count=1, id=256, version=33145,
count=47, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
XblGameSaveProxy.dll
- IMPHASH 24916cb31b749c026374ec112a5f952e
- SHA256 6e8d1b34292aeb750e4629e98c59a0c30f130224791d136537061978d808d1e1
- MD5 fb3ab879093295bebc82bbff57a44449
- SHA1 eceeac052e4a01b61ece837585fd8497f66b1fc7
- SHA512 0fee845677a71e24bd06699c26df6574cfc140e2adc5d338d641b7a688a728ec1ef2187ef3725d269a0ab511022488453ac77aacb8edb0010277929c3899be43
- SSDEEP 384:thWA2K4h9polCQLmzHwv3BE8Hkpcly6L6smE4w1KrdEQVFWo0Waw/ddOweV:PMNFNQaHY3ZHkpcly6L6Tp2KWQVRa
- TLSH T154538259FE2448E2C439827A4A6F0F86E23DDB0083135BDB02AD205E5DF67DE8B756C5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5440
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
XblGameSaveProxy.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
memcmp
__C_specific_handler
_o___std_type_info_destroy_list
api-ms-win-crt-string-l1-1-0
memset
rpcrt4
NdrDllRegisterProxy
CStdStubBuffer_Invoke
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_Connect
CStdStubBuffer_QueryInterface
NdrOleFree
CStdStubBuffer_AddRef
NdrDllUnregisterProxy
NdrOleAllocate
NdrDllGetClassObject
NdrDllCanUnloadNow
IUnknown_Release_Proxy
NdrCStdStubBuffer_Release
CStdStubBuffer_CountRefs
api-ms-win-core-winrt-string-l1-1-0
HSTRING_UserMarshal64
HSTRING_UserUnmarshal
HSTRING_UserSize64
HSTRING_UserFree64
HSTRING_UserMarshal
HSTRING_UserSize
HSTRING_UserUnmarshal64
HSTRING_UserFree
api-ms-win-core-com-midlproxystub-l1-1-0
ObjectStublessClient6
ObjectStublessClient3
ObjectStublessClient4
CStdAsyncStubBuffer_Release
ObjectStublessClient5
ObjectStublessClient10
ObjectStublessClient9
ObjectStublessClient8
CStdAsyncStubBuffer_Disconnect
CStdAsyncStubBuffer_Invoke
CStdAsyncStubBuffer_AddRef
CStdAsyncStubBuffer_Connect
ObjectStublessClient13
ObjectStublessClient7
ObjectStublessClient11
ObjectStublessClient12
CStdAsyncStubBuffer_QueryInterface
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo
Name
.text
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
492B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=31, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1129, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33140,
count=4, id=259, version=33140,
count=11, id=261, version=33140,
count=1, id=256, version=33140,
count=6, id=264, version=33140,
count=1, id=253, version=33140,
count=1, id=255, version=33140,
count=1, id=258, version=33140,
XboxGipRadioManager.dll
- IMPHASH 8138cb9329847a4c5f97e8e3346083c0
- SHA256 bca003d882918f8ba6e29bff76742e439b103f34fd629736b7d47d1524e33215
- MD5 0cef7cf692128b55a218254d79edbeac
- SHA1 7540f82e3ea3b4c8e040cf5ed763de291bc8c805
- SHA512 5e94ee6aa3deaaa4873af65f6021334a2227b09f1e85e60aea221c5255a9ccddd2d64a053deed72228b9467bbe3f7d451037d478459466290a37140f2076efe0
- SSDEEP 1536:67Aa0vBZ12XLRhOOv3Z2ujkWC/5O0G7bhNmnUtU766r3nIS:6kpGXT/Iujko3hVl6r4S
- TLSH T119930A6EAAFC20BAE175A1BD85570A09E772F021231253DF03A0827E5F27FD49E35B51
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5344
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
XboxGipRadioManager.pdb
msvcrt
_CxxThrowException
_onexit
__dllonexit
_unlock
_lock
realloc
_errno
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_callnewh
vswprintf_s
_vscwprintf
memmove_s
wprintf
calloc
_resetstkoflw
_purecall
wcscat_s
wcscpy_s
memcpy_s
free
malloc
wcsncpy_s
__C_specific_handler
__CxxFrameHandler4
memset
ntdll
RtlLookupFunctionEntry
RtlCaptureContext
EtwUnregisterTraceGuids
RtlVirtualUnwind
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwTraceMessage
EtwRegisterTraceGuidsW
kernel32
SizeofResource
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
Sleep
HeapDestroy
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
WaitForSingleObject
CreateThread
CreateEventW
SetEvent
LockResource
DelayLoadFailureHook
ResolveDelayLoadedAPI
DeviceIoControl
OutputDebugStringA
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryExW
GetModuleHandleW
lstrcmpiW
LeaveCriticalSection
RaiseException
EnterCriticalSection
MultiByteToWideChar
CreateFileW
LoadResource
FindResourceExW
GetModuleFileNameW
InitializeCriticalSection
DeleteCriticalSection
CloseHandle
TerminateProcess
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
48KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
576B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=19, id=260, version=33145,
count=124, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=11, id=261, version=33145,
count=1, id=256, version=33145,
count=14, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
XboxNetApiSvc.dll
- IMPHASH a3f5be791b8bd3e8f47a5746eb5ab039
- SHA256 a0b443e87619d22d9c6d3340ad00bc780572a50e554904ce5cd134816bc6dabd
- MD5 ce4353b90e791202e4329621fb463f7a
- SHA1 0508c72c01afe43464ae412165be901c6b0d8e74
- SHA512 f725c3f6bb32ce6f25888ea2889121411369ff55e80481d3afdde711ada530a4cce84e3d6ea24d9f33d970d9d146e87ded5859c0d82bda45a3c790362de8a6a1
- SSDEEP 24576:5s6II9tvAZJV9yOXDHGk61pMIdNHpdR2q6:KI9tSrIsHGkcpMIdNt2q6
- TLSH T167454919B2A804E5D9BB837D8117336AE6B131291F2467CF25F081146F1FBF15A3AF29
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
20560
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
XboxNetApiSvc.pdb
msvcrt
memcmp
_wcsicmp
_wcstoui64
strtoul
swprintf_s
wcscpy_s
_vsnprintf_s
vswprintf_s
_ultow_s
wcschr
_vsnwprintf
__CxxFrameHandler4
memcpy_s
memmove_s
realloc
memcpy
memmove
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
_purecall
_snwprintf_s
memset
powrprof
PowerSettingRegisterNotification
PowerSettingUnregisterNotification
ntdll
RtlInitUnicodeString
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlCreateServiceSid
api-ms-win-core-com-l1-1-0
CoAddRefServerProcess
CoCreateFreeThreadedMarshaler
CoReleaseServerProcess
CoTaskMemAlloc
CoCreateInstance
CoInitializeEx
CoWaitForMultipleHandles
CoTaskMemFree
CoUninitialize
CoRevokeClassObject
CoResumeClassObjects
CoDisconnectContext
CoRegisterClassObject
CoCreateGuid
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceExecuteOnce
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsCreateStringReference
WindowsCompareStringOrdinal
WindowsDuplicateString
WindowsStringHasEmbeddedNull
WindowsDeleteString
WindowsIsStringEmpty
WindowsGetStringRawBuffer
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-winrt-l1-1-0
RoRegisterActivationFactories
RoInitialize
RoGetActivationFactory
RoUninitialize
RoActivateInstance
RoRevokeActivationFactories
api-ms-win-core-winrt-error-l1-1-0
RoSetErrorReportingFlags
RoTransformError
GetRestrictedErrorInfo
RoOriginateError
SetRestrictedErrorInfo
RoOriginateErrorW
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
WaitForMultipleObjectsEx
CreateWaitableTimerExW
InitializeSRWLock
DeleteCriticalSection
InitializeCriticalSection
WaitForSingleObject
SetWaitableTimer
CreateEventW
LeaveCriticalSection
AcquireSRWLockShared
ResetEvent
ReleaseSRWLockShared
EnterCriticalSection
SetEvent
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
DisableThreadLibraryCalls
LoadStringW
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-service-core-l1-1-0
RegisterServiceCtrlHandlerExW
SetServiceStatus
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
GetLastError
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
api-ms-win-security-base-l1-1-0
GetTokenInformation
CopySid
EqualSid
CreateWellKnownSid
GetLengthSid
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
CreateThread
OpenProcessToken
GetExitCodeThread
GetCurrentThread
OpenThreadToken
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetVersionExW
GetSystemTimeAsFileTime
GetComputerNameExW
GetTickCount64
iphlpapi
NotifyUnicastIpAddressChange
NotifyRouteChange2
CancelMibChangeNotify2
InitializeIpForwardEntry
GetBestRoute2
FreeMibTable
GetAdaptersAddresses
GetIpForwardTable2
GetIpNetEntry2
DeleteIpNetEntry2
NotifyIpInterfaceChange
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-file-l1-1-0
CreateFileW
ReadFile
GetFileAttributesW
ws2_32
WSASocketW
WSAStartup
setsockopt
freeaddrinfo
bind
getsockname
closesocket
getaddrinfo
WSACleanup
WSAGetOverlappedResult
WSASendTo
WSARecvFrom
ntohs
GetNameInfoW
GetAddrInfoW
FreeAddrInfoW
WSAGetLastError
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegDeleteValueW
RegGetValueW
RegQueryValueExW
rpcrt4
RpcBindingUnbind
RpcBindingBind
NdrClientCall3
RpcServerInqCallAttributesW
RpcBindingCreateW
RpcBindingFree
api-ms-win-core-winrt-error-l1-1-1
IsErrorPropagationEnabled
RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
winhttp
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpConnect
WinHttpReadData
WinHttpQueryOption
WinHttpOpen
WinHttpCloseHandle
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
crypt32
CertCloseStore
CertIsRDNAttrsInCertificateName
CryptDecodeObject
CryptBinaryToStringW
CertOpenStore
PFXIsPFXBlob
PFXImportCertStore
CertEnumCertificatesInStore
CertCreateCertificateContext
CertAddCertificateContextToStore
CertFreeCertificateChain
CertFreeCertificateContext
CertFreeCertificateChainEngine
CertDeleteCertificateFromStore
CertCreateCertificateChainEngine
CertFindCertificateInStore
CertVerifyTimeValidity
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertStrToNameW
CryptStringToBinaryW
CryptSignAndEncodeCertificate
CertGetCertificateContextProperty
CryptExportPublicKeyInfo
CertGetEnhancedKeyUsage
CryptAcquireCertificatePrivateKey
CryptFindCertificateKeyProvInfo
CertGetNameStringW
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-service-management-l1-1-0
CloseServiceHandle
OpenSCManagerW
OpenServiceW
api-ms-win-service-core-l1-1-1
EnumServicesStatusExW
api-ms-win-service-management-l2-1-0
QueryServiceConfig2W
QueryServiceStatusEx
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventSetInformation
EventUnregister
EventRegister
api-ms-win-core-timezone-l1-1-0
GetTimeZoneInformation
oleaut32
SysFreeString
SysAllocString
VariantClear
VariantInit
VariantChangeType
api-ms-win-core-winrt-robuffer-l1-1-0
RoGetBufferMarshaler
nsi
NsiGetAllParameters
winnsi
NsiRpcDeregisterChangeNotification
NsiRpcRegisterChangeNotification
NsiDisconnectFromServer
NsiConnectToServer
api-ms-win-downlevel-kernel32-l2-1-0
MulDiv
api-ms-win-appmodel-runtime-l1-1-0
GetApplicationUserModelId
GetPackageFullName
api-ms-win-appmodel-runtime-l1-1-1
GetStagedPackagePathByFullName
ncrypt
NCryptDeleteKey
NCryptExportKey
NCryptSetProperty
NCryptCreatePersistedKey
NCryptOpenStorageProvider
NCryptFinalizeKey
NCryptFreeObject
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
fwpuclnt
FwppGetMD5HashBytes
IkeextSaEnum2
IkeextSaCreateEnumHandle0
FwpmEngineOpen0
FwpmProviderGetByKey0
FwpmProviderAdd0
FwpmProviderDeleteByKey0
FwpmEngineClose0
FwpmFreeMemory0
IkeextSaDestroyEnumHandle0
FwpmTransactionCommit0
FwpmTransactionAbort0
FwpmProviderContextAdd2
FwpmProviderContextDeleteByKey0
FwpmProviderContextGetById2
FwpmFilterAdd0
FwpmTransactionBegin0
IPsecSaContextDeleteById0
IPsecSaContextGetById1
IPsecSaContextCreateEnumHandle0
IPsecSaContextEnum1
IPsecSaContextDestroyEnumHandle0
IPsecSaInitiateAsync0
FwpmFilterDeleteById0
api-ms-win-security-cryptoapi-l1-1-0
CryptDestroyKey
CryptExportKey
CryptAcquireContextA
CryptGetProvParam
CryptReleaseContext
firewallapi
FWDeleteCryptoSet
FWEnumProducts
FWAddCryptoSet
FWDeleteAuthenticationSet
FWSetAuthenticationSet
FWDeleteSecurityRealm
FWFreeProducts
FWAddAuthenticationSet
FWOpenPolicyStore
FWAddSecurityRealm
FWClosePolicyStore
FWRevertTransaction
FWGetGlobalConfig
FWAddFirewallRule
FWDeleteFirewallRule
FWGetConfig
ServiceMain
Name
.text
Size
992KB
Virtual Size
990KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
156KB
Virtual Size
153KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
32KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=88, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=21, id=260, version=33145,
count=4, id=259, version=33145,
count=387, id=1, productName=Unmarked objects,
count=17, id=257, version=33145,
count=5, id=261, version=33145,
count=1, id=256, version=33145,
count=99, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
XpsDocumentTargetPrint.dll
- IMPHASH f0f6422b2def0dcb2114b01a7cd947ac
- SHA256 718ebe2aef89865b03c6b6c2da6f5ce8eddb1e6c00898e6a147c569119dfac66
- MD5 e528fc1471dc63beb7819b2a2740be3d
- SHA1 d519d70f5eed7139c694c9dca5dd3e3aaaa1dfb4
- SHA512 7349e5b5131d07fbf979fb952e1335397eb714169dc33ad1d21a614a760fcd2392d88f351f9cdfdac03eb8396bd3dfa5935802bd4431c72fb4ea3a801d57fb54
- SSDEEP 3072:wNQNCxqJaHopyL8b8HU7Tf3gTEcHLh+CeiKjK6ds7kq5DW2x//DBnT38pRLwnGOQ:myCxqUHo4NUfkE6Lw/eD59HANK1+9
- TLSH T192846C6EE6AC04B5E1B6D13CC5D3460BE6B23859036296CF02B4467D2F27FE86D39B11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
10176
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
xpsdocumenttargetprint.pdb
msvcrt
__CxxFrameHandler4
swprintf_s
strncmp
_callnewh
_unlock
time
wcscpy_s
memcmp
_CxxThrowException
malloc
memcpy
__CxxFrameHandler3
_XcptFilter
_amsg_exit
_initterm
__C_specific_handler
?terminate@@YAXXZ
_lock
rand
srand
memmove_s
free
_vsnprintf
??1bad_cast@@UEAA@XZ
??0bad_cast@@QEAA@PEBD@Z
??0bad_cast@@QEAA@AEBV0@@Z
strcspn
localeconv
sprintf_s
_strtoi64
_strtoui64
_errno
__pctype_func
___lc_handle_func
___lc_codepage_func
__mb_cur_max
setlocale
__uncaught_exception
__crtGetStringTypeW
__crtLCMapStringW
isupper
__crtLCMapStringA
___mb_cur_max_func
islower
isspace
tolower
memchr
abort
isalnum
isdigit
_wcsicmp
??1type_info@@UEAA@XZ
_onexit
??0exception@@QEAA@AEBQEBDH@Z
__dllonexit
??0exception@@QEAA@AEBQEBD@Z
?what@exception@@UEBAPEBDXZ
_purecall
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
memcpy_s
_vsnwprintf
wcsrchr
memset
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
GetModuleFileNameA
GetProcAddress
LoadLibraryExW
GetModuleHandleW
GetModuleHandleExW
api-ms-win-core-synch-l1-1-0
ReleaseSemaphore
ReleaseSRWLockExclusive
EnterCriticalSection
WaitForSingleObject
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
ReleaseMutex
WaitForSingleObjectEx
InitializeCriticalSectionEx
ReleaseSRWLockShared
OpenSemaphoreW
CreateEventW
InitializeCriticalSection
LeaveCriticalSection
CreateSemaphoreExW
InitializeCriticalSectionAndSpinCount
SetEvent
AcquireSRWLockExclusive
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-eventing-provider-l1-1-0
EventEnabled
EventWrite
EventUnregister
EventWriteTransfer
EventRegister
EventActivityIdControl
EventSetInformation
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceLoggerHandle
TraceMessage
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetProcessTimes
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
OutputDebugStringA
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
CompareStringW
api-ms-win-core-synch-l1-2-0
InitOnceComplete
Sleep
InitOnceBeginInitialize
InitOnceExecuteOnce
api-ms-win-core-com-l1-1-0
StringFromCLSID
CoCreateInstanceEx
CreateStreamOnHGlobal
CoSetProxyBlanket
CoInitializeEx
CoUninitialize
CoCreateGuid
CoGetMalloc
CoTaskMemFree
CoCreateFreeThreadedMarshaler
CoCreateInstance
CoTaskMemAlloc
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsCreateStringReference
WindowsGetStringRawBuffer
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolWork
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolWork
FreeLibraryWhenCallbackReturns
SetThreadpoolTimer
SubmitThreadpoolWork
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
GlobalAlloc
LocalReAlloc
GlobalFree
oleaut32
SysStringLen
VariantInit
SysFreeString
VariantClear
SysAllocString
SysAllocStringLen
SetErrorInfo
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
rpcrt4
NdrDllUnregisterProxy
NdrDllRegisterProxy
IUnknown_AddRef_Proxy
NdrStubForwardingFunction
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrOleFree
RpcServerInqCallAttributesW
NdrStubCall3
RpcStringFreeW
UuidToStringW
UuidCreateSequential
IUnknown_Release_Proxy
NdrOleAllocate
IUnknown_QueryInterface_Proxy
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-file-l1-1-0
GetFileAttributesW
DeleteFileW
CreateDirectoryW
WriteFile
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-core-file-l1-2-3
GetTempPath2W
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-version-l1-1-1
GetFileVersionInfoSizeW
GetFileVersionInfoW
api-ms-win-core-version-l1-1-0
VerQueryValueW
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
ntdll
WinSqmIncrementDWORD
NtQueryInformationToken
WinSqmIsOptedIn
RtlNtStatusToDosError
RtlGetAppContainerSidType
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
RtlReleaseSRWLockShared
RtlAcquireSRWLockShared
RtlInitializeSRWLock
api-ms-win-core-shlwapi-obsolete-l1-1-0
StrRChrW
api-ms-win-shcore-stream-l1-1-0
SHCreateStreamOnFileW
api-ms-win-shlwapi-ie-l1-1-0
PathIsDirectoryW
xpsservices
ord9
ord8
combase
ord35
ord32
ord34
ord6
ord33
ippcommon
GetModernPrinterType
api-ms-win-core-sysinfo-l1-2-0
VerSetConditionMask
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-kernel32-legacy-l1-1-1
VerifyVersionInfoW
xmllite
CreateXmlReader
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
Name
.text
Size
268KB
Virtual Size
266KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
72KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
208B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=86, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=23, id=260, version=33145,
count=263, id=1, productName=Unmarked objects,
count=15, id=257, version=33145,
count=50, id=261, version=33145,
count=1, id=256, version=33145,
count=71, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
XpsGdiConverter.dll
- IMPHASH 61fdb6bd2ddffe33ff2bbf275770dbfa
- SHA256 fbf0119c05f9392eb7acbf0e85f60fdbc03843a41fea7cc1f693a7ab8c5932ea
- MD5 bcd71e109faa5710909f3dc1a0ee20b4
- SHA1 064bf2718b1bdd68e471165ca40ed48e5305ccd2
- SHA512 a8c87f6435bc7420a37e3bed933b9f962017e5a106f6abaa2dfa7c9fb35cf37289cea3e257366b0444875fe11c20063e98e7fb3a3252de90f22b8657c09fd415
- SSDEEP 6144:HNU4mr2aoyvvAprUYpMCrmiwVX6fqwN7VZnarFBZcRo00AZdC:Hy4K2aVtCr0VXVwNKrFBZcS37
- TLSH T1FE848D2E95DC21F2D539E0BCC6A3870BE6B13C48437645CF07AA42ED1E37EE8653A651
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
33312
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
XpsGdiConverter.pdb
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
api-ms-win-crt-string-l1-1-0
memset
wcsnlen
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_acosf
_o_asinf
_o_atan
_o_ceil
_o_ceilf
_o_cos
_o_floor
_o_floorf
_o_fmodf
_o_free
_o_malloc
_o_powf
_o_rand
_o_sin
_o_sqrt
_o_sqrtf
_o_srand
__CxxFrameHandler4
__std_terminate
__std_type_info_compare
__C_specific_handler
_o__errno
_CxxThrowException
__CxxFrameHandler3
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__execute_onexit_table
memcmp
memcpy
kernel32
GetSystemInfo
RaiseException
LoadLibraryExA
InitializeCriticalSectionAndSpinCount
VirtualQuery
QueryPerformanceFrequency
VerifyVersionInfoW
VerSetConditionMask
ResetEvent
CreateEventW
VirtualProtect
DisableThreadLibraryCalls
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
DeleteCriticalSection
AcquireSRWLockShared
CreateThreadpoolTimer
ReleaseSRWLockShared
SetThreadpoolTimer
AcquireSRWLockExclusive
CloseThreadpoolTimer
ReleaseSRWLockExclusive
WaitForThreadpoolTimerCallbacks
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetSystemDefaultLCID
GetTickCount64
FreeLibrary
LoadLibraryW
InitOnceComplete
InitOnceBeginInitialize
IsDebuggerPresent
DebugBreak
WideCharToMultiByte
GetModuleHandleW
GetProcessHeap
GetCurrentProcessId
CreateMutexExW
GetProcAddress
HeapAlloc
CloseHandle
OpenSemaphoreW
WaitForSingleObjectEx
OutputDebugStringW
GetLastError
FormatMessageW
ReleaseMutex
GetCurrentThreadId
WaitForSingleObject
GetModuleHandleExW
ReleaseSemaphore
SetLastError
HeapFree
CreateSemaphoreExW
GetModuleFileNameA
SetEvent
user32
FillRect
gdi32
CreateFontIndirectW
RemoveFontMemResourceEx
DeleteObject
GetTextColor
SetTextColor
GetTextAlign
GetTextFaceW
SelectObject
AddFontMemResourceEx
SetWorldTransform
EndPage
StartDocW
CreateSolidBrush
SetMiterLimit
ExtCreatePen
GetMiterLimit
GetPolyFillMode
FillPath
BeginPath
PolyDraw
SelectClipPath
SetPolyFillMode
CreateRectRgn
EndPath
LineTo
SelectClipRgn
MoveToEx
GetTextMetricsW
ExtTextOutW
SaveDC
ModifyWorldTransform
StartPage
CreateDIBSection
CreateCompatibleDC
SetGraphicsMode
AbortDoc
EndDoc
GdiFlush
ResetDCW
StretchDIBits
CreateDCW
GetStockObject
GetDeviceCaps
DeleteDC
ExtEscape
SetBkMode
SetStretchBltMode
RestoreDC
SetTextAlign
ole32
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
oleaut32
VariantInit
SysFreeString
shlwapi
PathIsRelativeW
shell32
SHGetKnownFolderPath
prntvpt
ord4
ord2
ord8
ord1
ord10
advapi32
RegQueryInfoKeyW
RegEnumValueW
EventWrite
RegQueryValueExW
EventWriteTransfer
EventSetInformation
EventEnabled
EventRegister
TraceMessage
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
EventUnregister
RegCloseKey
RegOpenKeyExW
d3d11
D3D11CreateDevice
d2d1
ord5
ord1
dwrite
DWriteCreateFactory
Name
.text
Size
292KB
Virtual Size
289KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
52KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
344B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
988B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=1271, id=1, productName=Unmarked objects,
count=27, id=257, version=33145,
count=29, id=261, version=33145,
count=1, id=256, version=33145,
count=41, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
XpsPrint.dll
- IMPHASH 38fe7966e7c85b2e314d4518da16981d
- SHA256 cf6492bf971f3e1d14b01d44a6ae25d6fdad7b54994d40c643bb9addd520da18
- MD5 b9740ad398083d893d6372117a1ad0cd
- SHA1 34323a6142a1146fd6995a1b0e728f1a3d6e728a
- SHA512 6bb2db18b4e7c57bc44a15b187f568f6e315d1cf27b1a2f45a29044554d274055f1ef6c99777ab782f84447e8eac6c4b393f8287c66a62111642229a338f0bbe
- SSDEEP 24576:l63RghS+tIhE0pQPSqjmbFlpX4oX+YlPAJi:83RKS+tIC0pQalbF/lPAJ
- TLSH T15D454B1AA3AC00E5D5F9E1BCC197590EE6B1B815D336BACF052506AC5F23BF4C63AB11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
13904
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
xpsprint.pdb
msvcp_win
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z
?_Xout_of_range@std@@YAXPEBD@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?setbase@std@@YA?AU?$_Smanip@H@1@H@Z
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAH@Z
?unsetf@ios_base@std@@QEAAXH@Z
?setf@ios_base@std@@QEAAHHH@Z
?setf@ios_base@std@@QEAAHH@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?classic@locale@std@@SAAEBV12@XZ
_Tolower
_Toupper
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
??1ctype_base@std@@UEAA@XZ
??0ctype_base@std@@QEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@M@Z
??Bid@locale@std@@QEAA_KXZ
?_Getctype@_Locinfo@std@@QEBA?AU_Ctypevec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Incref@facet@locale@std@@UEAAXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?pubseekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAI@Z
?tellg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?eof@ios_base@std@@QEBA_NXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@N@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAG@Z
?uncaught_exception@std@@YA_NXZ
?_Xlength_error@std@@YAXPEBD@Z
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WXZ
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?_Xbad_alloc@std@@YAXXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
api-ms-win-crt-string-l1-1-0
memset
strncmp
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__free_locale
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsicmp
memmove
_o__wcstod_l
_o__wtof
_o_ceilf
_o_free
_o_isspace
_o_malloc
_o_wcscpy_s
_o_wcstod
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o___stdio_common_vswprintf_s
_o__execute_onexit_table
_o__crt_atexit
_o__create_locale
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o__configure_narrow_argv
_o__cexit
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__callnewh
__std_terminate
__CxxFrameHandler4
_o__errno
wcsrchr
memchr
memcmp
memcpy
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleHandleExW
FreeLibraryAndExitThread
GetModuleFileNameA
FreeLibrary
GetProcAddress
LoadLibraryExW
api-ms-win-core-synch-l1-1-0
WaitForSingleObject
ReleaseSemaphore
SetEvent
CreateSemaphoreExW
WaitForSingleObjectEx
ResetEvent
ReleaseMutex
InitializeCriticalSection
DeleteCriticalSection
AcquireSRWLockShared
OpenSemaphoreW
ReleaseSRWLockShared
CreateMutexExW
AcquireSRWLockExclusive
CreateEventW
ReleaseSRWLockExclusive
EnterCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventEnabled
EventWrite
EventRegister
EventSetInformation
EventUnregister
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThread
CreateThread
GetProcessTimes
SetThreadToken
OpenThreadToken
TerminateProcess
ExitProcess
GetCurrentThreadId
GetCurrentProcess
TlsSetValue
ResumeThread
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
CompareStringW
WideCharToMultiByte
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
api-ms-win-core-com-l1-1-0
CoInitializeEx
CoGetMalloc
CoTaskMemAlloc
CoSetProxyBlanket
CoCreateInstanceEx
CoTaskMemFree
CreateStreamOnHGlobal
CoCreateInstance
CoUninitialize
StringFromCLSID
CoCreateGuid
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
api-ms-win-core-heap-l2-1-0
LocalReAlloc
GlobalFree
LocalAlloc
LocalFree
GlobalAlloc
oleaut32
SysAllocStringLen
VariantClear
SysStringLen
SetErrorInfo
VariantInit
SysFreeString
SysAllocString
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-file-l1-2-3
GetTempPath2W
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
api-ms-win-core-file-l1-1-0
SetFilePointerEx
ReadFile
FlushFileBuffers
SetEndOfFile
CreateDirectoryW
DeleteFileW
WriteFile
SetFilePointer
FindNextFileW
CreateFileW
GetFileAttributesW
FindClose
FindFirstFileW
api-ms-win-security-base-l1-1-0
GetTokenInformation
rpcrt4
RpcStringFreeW
RpcServerInqCallAttributesW
UuidToStringW
UuidCreateSequential
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-version-l1-1-1
GetFileVersionInfoW
GetFileVersionInfoSizeW
api-ms-win-core-version-l1-1-0
VerQueryValueW
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetTickCount64
GetSystemTimeAsFileTime
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
ntdll
RtlInitializeSRWLock
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
WinSqmIncrementDWORD
WinSqmIsOptedIn
NtQueryInformationToken
RtlNtStatusToDosError
RtlGetAppContainerSidType
RtlReleaseSRWLockShared
RtlAcquireSRWLockShared
api-ms-win-core-shlwapi-obsolete-l1-1-0
StrRChrW
api-ms-win-shcore-stream-l1-1-0
SHCreateStreamOnFileW
api-ms-win-shlwapi-ie-l1-1-0
PathIsDirectoryW
xpsservices
ord8
ord9
winspool.drv
GetPrintExecutionData
ord361
ord362
api-ms-win-crt-math-l1-1-0
_finite
_isnan
api-ms-win-core-sysinfo-l1-2-0
VerSetConditionMask
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-kernel32-legacy-l1-1-1
VerifyVersionInfoW
urlmon
CreateUri
xmllite
CreateXmlReader
api-ms-win-core-kernel32-legacy-l1-1-0
RegisterWaitForSingleObject
api-ms-win-core-threadpool-legacy-l1-1-0
UnregisterWaitEx
CreateTimerQueueTimer
CreateTimerQueue
QueueUserWorkItem
DeleteTimerQueueEx
DeleteTimerQueueTimer
StartXpsPrintJob
StartXpsPrintJob1
Name
.text
Size
900KB
Virtual Size
896KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
164KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
52KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=98, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=17, id=260, version=33145,
count=5, id=259, version=33145,
count=1423, id=1, productName=Unmarked objects,
count=17, id=257, version=33145,
count=32, id=261, version=33145,
count=1, id=256, version=33145,
count=125, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
XpsRasterService.dll
- IMPHASH 5b44495fd46fb2a07410c3ee7c0dd35b
- SHA256 9ee5556de110d8fb406dd5695b05938706a8830debb8915681ec746e2ac8dce2
- MD5 b171d213d90a63f5ce4a2290643030c4
- SHA1 be362e77dd1d3268fe6fbf8fd4977810c58d9902
- SHA512 fda0394618af0711bffe853382231ad3c4c106b65c3d3f0d1906e0fb069fdc29c1e286849db126908f29e29132f67f8fc3b1bef6c360f30d7fb8ba7a4fc670bb
- SSDEEP 24576:lEMP74gywjiec9+7c21heU9OfbKh+y/O4bVn/pf6Z3Iht:v4RwGevTd96y/zAZ3Iht
- TLSH T1C5558C5520955CE7D0FBB0FB815A860BE1287D194F005ADF0AB87188FAF7AD3DE39219
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
12624
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
XpsRasterService.pdb
msvcp_win
_Mtx_unlock
?_Throw_C_error@std@@YAXH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_lock
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
_clearfp
api-ms-win-crt-private-l1-1-0
_o__fdclass
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o_atan
_o_atan2f
_o_ceilf
_o_cos
_o_cosf
_o_floorf
_o_free
_o_malloc
_o_powf
_o_roundf
_o_sin
_o_sinf
_o_sqrt
_o_sqrtf
_o_wcstol
__std_type_info_compare
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__execute_onexit_table
_o__dclass
_o__crt_atexit
_o__controlfp_s
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o__errno
_o__aligned_free
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
memcpy
memmove
memcmp
__std_terminate
__CxxFrameHandler4
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceExecuteOnce
api-ms-win-core-com-l1-1-0
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoCreateInstance
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventRegister
EventWrite
EventEnabled
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-eventing-classicprovider-l1-1-0
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
TraceMessage
api-ms-win-core-synch-l1-1-0
WaitForSingleObject
ReleaseMutex
WaitForSingleObjectEx
ReleaseSemaphore
DeleteCriticalSection
EnterCriticalSection
CreateMutexExW
InitializeCriticalSectionAndSpinCount
SetEvent
CreateEventW
OpenSemaphoreW
ReleaseSRWLockExclusive
LeaveCriticalSection
AcquireSRWLockShared
CreateSemaphoreExW
ResetEvent
AcquireSRWLockExclusive
ReleaseSRWLockShared
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA
GetProcAddress
FreeLibrary
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
oleaut32
SysFreeString
VariantInit
VariantClear
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentThread
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-winrt-string-l1-1-0
WindowsCompareStringOrdinal
WindowsDeleteString
WindowsCreateString
WindowsGetStringLen
WindowsGetStringRawBuffer
WindowsDuplicateString
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GlobalMemoryStatusEx
rpcrt4
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
NdrDllCanUnloadNow
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_QueryInterface
NdrDllGetClassObject
NdrOleFree
CStdStubBuffer_AddRef
NdrCStdStubBuffer_Release
CStdStubBuffer_Invoke
IUnknown_AddRef_Proxy
CStdStubBuffer_CountRefs
IUnknown_Release_Proxy
CStdStubBuffer_IsIIDSupported
NdrOleAllocate
CStdStubBuffer_Connect
api-ms-win-core-com-midlproxystub-l1-1-0
ObjectStublessClient3
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
GetThreadContext
IsProcessorFeaturePresent
api-ms-win-shcore-stream-winrt-l1-1-0
CreateRandomAccessStreamOnFile
CreateStreamOverRandomAccessStream
CreateRandomAccessStreamOverStream
api-ms-win-shcore-stream-l1-1-0
SHCreateMemStream
IStream_Copy
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolQueueTask
SHTaskPoolGetUniqueContext
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-file-l1-1-0
WriteFile
GetTempFileNameW
DeleteFileW
CreateFileW
api-ms-win-core-file-l1-2-3
GetTempPath2W
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoGetActivationFactory
cabinet
ord43
ord45
ord40
api-ms-win-core-sysinfo-l1-2-0
VerSetConditionMask
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
api-ms-win-core-kernel32-legacy-l1-1-1
VerifyVersionInfoW
ntdll
WinSqmIncrementDWORD
WinSqmIsOptedIn
WinSqmAddToStream
d3d11
D3D11CreateDevice
d2d1
ord1
ord5
dwrite
DWriteCreateFactory
windows.data.pdf
PdfCreateRenderer
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpW
DllCanUnloadNow
DllGetClassObject
DrvPopulateFilterServices
Name
.text
Size
776KB
Virtual Size
775KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
428KB
Virtual Size
425KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
24KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=78, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=1218, id=1, productName=Unmarked objects,
count=13, id=257, version=33145,
count=30, id=261, version=33145,
count=96, id=261, version=31942,
count=1, id=256, version=33145,
count=24, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
XpsToPclmConverter.dll
- IMPHASH 7572741800e02cd38e840156039d6500
- SHA256 3f00f42bfcb74ea2904ae394e651a526d729165bd72dcecefa14816614ac1e9a
- MD5 4b3f5dd880b23a33083e0e198e704f43
- SHA1 079c673439867f6b8d233a05a92bbdc62761a29e
- SHA512 5cb9b314ed403a9943aca13157e1a3da3aa74ec24ec9d73efd5313870c15f5c3c85cbb5edcc95f5c889b5b43430f7a9e16bd00979dbe381729a71f4be3faaacb
- SSDEEP 3072:l22RDxeb3/yrIzRRQGbd7gwy7kqe7DDGyda67jh+gxJG7zxLosbj:l7RDxer/yrIvQGNycLGCnjNJcxLRb
- TLSH T1EB244B5A769801F2E1B391BDC9C38A0AF3B27465477253CF4291837D1F27BD86A39B60
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5616
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
XpsToPCLmConverter.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__itoa_s
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_abort
_o_free
_o_iswspace
_o_malloc
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
__CxxFrameHandler3
_o___std_type_info_destroy_list
_CxxThrowException
_o___std_exception_destroy
_o___std_exception_copy
_o___stdio_common_vswprintf
__std_terminate
__CxxFrameHandler4
__RTDynamicCast
memchr
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
strnlen
memset
ntdll
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetProcAddress
GetModuleFileNameA
DisableThreadLibraryCalls
GetModuleHandleExW
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
InitializeCriticalSectionEx
ReleaseSemaphore
EnterCriticalSection
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseMutex
WaitForSingleObject
CreateSemaphoreExW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
msvcp_win
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?flags@ios_base@std@@QEBAHXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?good@ios_base@std@@QEBA_NXZ
?uncaught_exception@std@@YA_NXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?width@ios_base@std@@QEBA_JXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?width@ios_base@std@@QEAA_J_J@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?setf@ios_base@std@@QEAAHHH@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Xlength_error@std@@YAXPEBD@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
windowscodecs
WICConvertBitmapSource
api-ms-win-core-com-l1-1-0
CoCreateFreeThreadedMarshaler
oleaut32
SysFreeString
SysStringLen
SetErrorInfo
CreateXpsToPCLmConverter
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
120KB
Virtual Size
118KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=47, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=14, id=260, version=33145,
count=5, id=259, version=33145,
count=1183, id=1, productName=Unmarked objects,
count=4, id=257, version=33145,
count=25, id=261, version=33145,
count=1, id=256, version=33145,
count=18, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
XpsToPwgrConverter.dll
- IMPHASH 1c14d6dd849167ba57a7f2bde7735f3a
- SHA256 cf1a22f1ad77d83589c31636ae31b6bb078f3e6bcdfed847c055b001db3bbd7e
- MD5 2e747ba206f7f6b0aac8ab687caebaf8
- SHA1 a8114f7f078ec15a93baebc1f3fad2371c57e06e
- SHA512 d54a15b5ef531d8c20ccb174f623ac2be4350e2c849d42d4b0f37bbfc53b2b9ce2f1d30caed680a41c5d923630855054bc23960caa9788c62cc2965473c66af4
- SSDEEP 3072:fJW4Q5HoBUmtb+8AFtZy/NZjAv4ZV9qO:f84oHoimt4vYV9q
- TLSH T13BC3396E76AC10E5E572D03CC9934E1AD3B2B065232257DF03A081BE5F27BE46C39B65
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5936
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
XpsToPwgrConverter.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_abort
_o_free
_o_iswspace
_o_malloc
__C_specific_handler
__CxxFrameHandler3
_o___std_type_info_destroy_list
_CxxThrowException
_o___std_exception_destroy
_o___std_exception_copy
_o___stdio_common_vswprintf
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
ntdll
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
GetModuleHandleW
GetModuleFileNameA
GetProcAddress
GetModuleHandleExW
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
InitializeCriticalSectionEx
ReleaseSemaphore
EnterCriticalSection
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseMutex
WaitForSingleObject
CreateSemaphoreExW
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
windowscodecs
WICConvertBitmapSource
oleaut32
SysFreeString
SetErrorInfo
SysStringLen
api-ms-win-core-com-l1-1-0
CoCreateFreeThreadedMarshaler
CreateXpsToPwgrConverter
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
68KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
468B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=49, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=1141, id=1, productName=Unmarked objects,
count=4, id=257, version=33145,
count=26, id=261, version=33145,
count=1, id=256, version=33145,
count=12, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
XpsToTiffConverter.dll
- IMPHASH 75b9ff4c398d1162e06f08a3d8c21fb7
- SHA256 f748527ee7fa04663e61fcd909bd70752b1bb4d9c7feb26f3d9f9aae25f497b2
- MD5 94b2ae4908bc84006273261f9eeb2d48
- SHA1 1fbae7e04a7a7249f6469742871030543f39c0cf
- SHA512 959feeba09aba7f2497083c0a92145c1170b1673d060f443be6f7690583a52ed02aaf40469e8ed7b7b87772d5c31930d34662a35957fa47993f9e707ab1b24c8
- SSDEEP 3072:dCiLQV43R+143nmnbnMF5HlxiK+arocj:0iLEeY+yOyaroc
- TLSH T18AA34A5E76A820F6E172C03DC9934A09E3B1B065632257EF039082BE5F63BE55D39B91
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5728
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
XpsToTiffConverter.pdb
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_abort
_o_free
_o_iswspace
_o_malloc
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___stdio_common_vswprintf
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
ntdll
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
DisableThreadLibraryCalls
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
InitializeCriticalSectionEx
ReleaseSemaphore
EnterCriticalSection
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseMutex
WaitForSingleObject
CreateSemaphoreExW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
oleaut32
SysFreeString
VariantInit
SysStringLen
SetErrorInfo
VariantClear
GetErrorInfo
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
windowscodecs
WICConvertBitmapSource
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoCreateFreeThreadedMarshaler
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
CreateXpsToTiffConverter
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
56KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
428B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=48, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=1138, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=25, id=261, version=33145,
count=1, id=256, version=33145,
count=6, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wsecedit.dll
- IMPHASH 62d848a3744d6e2f3139d4da52048541
- SHA256 03a59073d9f8334fcf4783f25eab45cbad911867b6cdf196937c4e8249e3e03b
- MD5 41432f8fdce2c50a58efa3640d4dab67
- SHA1 666cc1a9c23873a7539ec83c0981c557b7f27787
- SHA512 f75b2cefcdbf42c286dab4fe092b7966a972a9d74e262be1430cff4847b3150b3135010efa1260b0a49e25a1675a05dc21865231d4274dbf8e29dfaab2966740
- SSDEEP 12288:cr/ThnJuy9Jk0aCT+U5umTbcMT7O3IZNCzWJounspDFJ9B:crbhnJR9JJaCTrcg7hCzusNv
- TLSH T13EF4E44EB6B90065D46AC1B9892B4E89D672F4305393A3CF1560C2BEEF1BFD45A34F21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
9968
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wsecedit.pdb
mfc42u
ord6351
ord337
ord3531
ord3911
ord1056
ord4523
ord3419
ord3397
ord4602
ord2902
ord4485
ord6738
ord655
ord1059
ord4582
ord1749
ord2393
ord4424
ord6102
ord2586
ord4741
ord3743
ord1774
ord6801
ord2425
ord2024
ord4543
ord2592
ord4746
ord3805
ord3774
ord310
ord826
ord4027
ord2922
ord5980
ord2898
ord567
ord1005
ord6543
ord6223
ord3872
ord3754
ord1043
ord629
ord599
ord6734
ord4481
ord2909
ord372
ord2518
ord3598
ord1035
ord3867
ord996
ord3894
ord1441
ord371
ord877
ord5602
ord3440
ord5807
ord1977
ord5905
ord464
ord5880
ord1658
ord4328
ord3256
ord6823
ord5912
ord4548
ord1949
ord663
ord1066
ord2753
ord4550
ord1123
ord6054
ord5066
ord3180
ord4599
ord3920
ord3652
ord1443
ord1830
ord4553
ord5226
ord5244
ord4720
ord5426
ord4968
ord5123
ord5083
ord4967
ord4996
ord5487
ord6531
ord6533
ord4131
ord4127
ord4130
ord3953
ord6612
ord4257
ord4262
ord6395
ord1124
ord2422
ord2023
ord4542
ord2589
ord4743
ord3751
ord832
ord2593
ord4747
ord3501
ord3806
ord912
ord6385
ord408
ord904
ord2106
ord4722
ord4699
ord1906
ord551
ord999
ord549
ord3517
ord3868
ord336
ord851
ord1646
ord6577
ord6238
ord2776
ord2461
ord613
ord1036
ord2133
ord6379
ord6455
ord6457
ord5990
ord1082
ord288
ord812
ord1544
ord1586
ord1555
ord1583
ord1585
ord355
ord1477
ord1553
ord1416
ord1491
ord1577
ord2329
ord1033
ord3892
ord3535
ord5712
ord1778
ord6440
ord2371
ord6418
ord6767
ord2384
ord2328
ord6226
ord6614
ord2094
ord4721
ord5245
ord5702
ord624
ord5229
ord3761
ord4217
ord6328
ord6147
ord5077
ord4557
ord339
ord2857
ord2801
ord621
ord1286
ord2845
ord2784
ord2859
ord6813
ord4836
ord2559
ord2515
ord6071
ord4191
ord1388
ord5615
ord2412
ord3468
ord5722
ord5724
ord4368
ord5065
ord5730
ord5711
ord6053
ord3534
ord4983
ord4770
ord3916
ord1426
ord2752
ord4214
ord1063
ord659
ord5584
ord5585
ord5583
ord5304
ord5114
ord5382
ord5352
ord5246
ord5709
ord5227
ord5687
ord5406
ord6437
ord4365
ord1777
ord4752
ord5663
ord2399
ord5586
ord6812
ord4694
ord4017
ord4789
ord2670
ord2060
ord6814
ord3933
ord5484
ord1736
ord5683
ord2140
ord5699
ord3049
ord3243
ord3362
ord4815
ord3231
ord3366
ord3052
ord3166
ord3046
ord4082
ord4083
ord4077
ord3164
ord4371
ord4988
ord4771
ord2049
ord5804
ord6821
ord4161
ord2459
ord2121
ord2876
ord6184
ord5815
ord6832
ord6880
ord1287
ord5979
ord2979
ord6050
ord2846
ord6632
ord4436
ord1442
ord1284
ord1264
ord2474
ord1657
ord1067
ord665
ord1259
ord1262
ord2411
ord6708
ord6705
ord6216
ord5887
ord1003
ord561
ord6021
ord2783
ord2676
ord1677
ord2975
ord2781
ord1498
ord2517
ord2457
ord1405
ord1463
ord1647
ord1537
ord2178
ord1479
ord1122
ord2629
ord3740
ord3790
ord3830
ord286
ord2906
ord1574
ord2427
ord2408
ord1499
ord2856
ord4521
ord287
ord4473
ord867
ord911
ord822
ord3177
ord2661
ord852
ord1126
ord620
ord626
ord1040
ord5725
msvcrt
_wcslwr
malloc
_wtol
free
_wfindfirst
_findclose
wcsncpy_s
vswprintf_s
_wsetlocale
_snwprintf_s
_wchdir
_wfindnext
wcstoul
_vsnwprintf
memcpy_s
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
swprintf_s
memmove_s
wcschr
_callnewh
__CxxFrameHandler3
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
?what@exception@@UEBAPEBDXZ
_CxxThrowException
memcpy
memmove
_XcptFilter
_amsg_exit
?terminate@@YAXXZ
_lock
_unlock
__C_specific_handler
__CxxFrameHandler4
??0exception@@QEAA@AEBV0@@Z
_wcsnicmp
__dllonexit
_onexit
??1type_info@@UEAA@XZ
memcmp
__RTDynamicCast
wcscat_s
wcscpy_s
_wcsicmp
wcsnlen
_purecall
_initterm
_wtoi
memset
atl
ord21
ord16
ord32
ord15
kernel32
LoadResource
SizeofResource
FindResourceW
GetUserDefaultLangID
HeapFree
GetProcessHeap
HeapAlloc
GetCurrentProcess
GetCurrentThread
CreateFileW
ExpandEnvironmentStringsW
GetThreadUILanguage
GetTempFileNameW
GetTempPath2W
MultiByteToWideChar
SetFilePointer
ReadFile
WriteFile
CloseHandle
OutputDebugStringW
LockResource
LoadLibraryExW
GetFileAttributesW
GlobalUnlock
GlobalLock
GetWindowsDirectoryW
GetSystemWindowsDirectoryW
CompareStringW
LocalUnlock
LocalLock
lstrlenW
LocalAlloc
InitializeCriticalSection
FreeLibrary
FindClose
FindFirstFileW
FormatMessageW
SetCurrentDirectoryW
DeleteFileW
GlobalAlloc
DeleteCriticalSection
GlobalFree
lstrcmpiW
LeaveCriticalSection
EnterCriticalSection
lstrcmpW
LocalFree
GetProcAddress
LoadLibraryW
GetLastError
QueryActCtxW
DeactivateActCtx
FindActCtxSectionStringW
GetModuleFileNameW
OutputDebugStringA
GetModuleHandleExW
SetLastError
ActivateActCtx
CreateActCtxW
CreateDirectoryW
TryEnterCriticalSection
CreateThread
GetExitCodeThread
LocalReAlloc
GetConsoleOutputCP
WritePrivateProfileSectionW
WritePrivateProfileStringW
TlsSetValue
CreateEventW
SetEvent
Sleep
WaitForSingleObject
WideCharToMultiByte
CreateProcessW
CopyFileW
GetVersionExW
GetCurrentThreadId
GetModuleFileNameA
DebugBreak
IsDebuggerPresent
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
ReleaseSemaphore
ReleaseMutex
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
WaitForSingleObjectEx
InitializeCriticalSectionEx
OpenSemaphoreW
CreateThreadpoolTimer
GetCurrentProcessId
CreateMutexExW
CreateSemaphoreExW
GetTickCount
FreeLibraryAndExitThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
WakeAllConditionVariable
SleepConditionVariableSRW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetModuleHandleW
DelayLoadFailureHook
ReleaseActCtx
ResolveDelayLoadedAPI
user32
RedrawWindow
CreateWindowExW
IsWindowVisible
GetDlgItem
GetParent
DispatchMessageW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjects
LoadIconW
EnableWindow
SendMessageW
SetWindowTextW
CloseClipboard
IsClipboardFormatAvailable
OpenClipboard
LoadImageW
PostThreadMessageW
RegisterClipboardFormatW
MessageBoxW
LoadStringW
SetClipboardData
EmptyClipboard
SetCursor
SendDlgItemMessageW
DrawFocusRect
GetSysColor
GetWindowRect
FrameRect
InflateRect
SetScrollRange
MoveWindow
DestroyWindow
SetWindowLongPtrW
SetWindowPos
GetSystemMetrics
GetClientRect
SetScrollInfo
ChildWindowFromPointEx
GetWindowLongW
ScrollWindow
SetScrollPos
GetScrollInfo
DefWindowProcW
SetFocus
GetFocus
GetWindowLongPtrW
GetDlgCtrlID
MapWindowPoints
GetMessagePos
IsWindowEnabled
MapDialogRect
RegisterClassW
LoadCursorW
ShowWindow
BringWindowToTop
ReleaseDC
GetDC
PostMessageW
DestroyIcon
GetSysColorBrush
DrawTextW
SystemParametersInfoW
GetWindow
IsWindow
WinHelpW
PtInRect
oleaut32
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
VariantInit
VariantClear
SafeArrayUnaccessData
SafeArrayAccessData
SysAllocString
SysFreeString
ole32
CoUninitialize
CoCreateInstance
CoInitialize
CoSetProxyBlanket
CoTaskMemFree
CreateStreamOnHGlobal
ReleaseStgMedium
CoTaskMemAlloc
StringFromCLSID
advapi32
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyExW
RegSetValueExW
IsTextUnicode
RegQueryValueExW
LookupPrivilegeDisplayNameW
GetSecurityDescriptorControl
GetSecurityDescriptorLength
MakeSelfRelativeSD
RegQueryInfoKeyW
OpenThreadToken
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
LookupAccountNameW
ConvertSidToStringSidW
CreateWellKnownSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
IsValidSecurityDescriptor
LookupAccountSidW
LsaOpenPolicy
LsaQueryInformationPolicy
GetLengthSid
CopySid
LsaFreeMemory
AddAccessAllowedAce
MakeAbsoluteSD
ConvertSecurityDescriptorToStringSecurityDescriptorW
GetAce
GetSecurityDescriptorGroup
SetSecurityDescriptorGroup
InitializeAcl
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
InitializeSecurityDescriptor
GetSecurityDescriptorSacl
GetSecurityDescriptorOwner
GetSecurityDescriptorDacl
MapGenericMask
LsaLookupSids
GetSidSubAuthority
GetSidIdentifierAuthority
GetSidSubAuthorityCount
IsValidSid
LsaClose
gdi32
SetTextColor
SetBkColor
SetMapMode
GetTextColor
GetBkColor
CreateFontIndirectW
DeleteObject
GetTextExtentPoint32W
SelectObject
SetBkMode
shell32
ShellExecuteExW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetMalloc
SHGetSpecialFolderLocation
SHGetFolderPathW
shlwapi
ord439
ord487
StrToIntW
scecli
SceLookupPrivRightName
SceCreateDirectory
SceWriteSecurityProfileInfo
SceAddToNameStatusList
SceOpenProfile
SceSvcConvertTextToSD
SceAnalyzeSystem
SceConfigureSystem
SceGetScpProfileDescription
SceGetServerProductType
SceUpdateObjectInfo
SceAddToNameList
SceSvcGetInformationTemplate
SceSvcQueryInfo
SceSvcFree
SceGetObjectChildren
SceSvcUpdateInfo
SceSvcSetInformationTemplate
SceCompareNameList
SceEnumerateServices
SceCompareSecurityDescriptors
SceGetObjectSecurity
SceCopyBaseProfile
SceAppendSecurityProfileInfo
SceFreeProfileMemory
SceGetSecurityProfileInfo
SceCloseProfile
SceStartTransaction
SceCommitTransaction
SceRollbackTransaction
SceFreeMemory
SceUpdateSecurityProfile
netutils
NetApiBufferFree
logoncli
DsGetDcNameW
setupapi
SetupFindNextLine
SetupGetLineTextW
SetupFindFirstLineW
SetupOpenInfFileW
SetupCloseInfFile
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
DllCanUnloadNow
DllGetClassObject
InvokeCAPEACLEditor
TranslateAceMasksAndCondition
Name
.text
Size
416KB
Virtual Size
415KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
212KB
Virtual Size
208KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
52KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=20, id=260, version=33145,
count=33, id=257, version=33145,
count=723, id=1, productName=Unmarked objects,
count=1, id=256, version=33145,
count=85, id=264, version=33145,
count=15, id=261, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wsepno.dll
- IMPHASH da8233deb74715b36448633cebaf36ed
- SHA256 b155ac2d7a348b09afa7d3034d138c493afbd93df5a78bbc8ea92e7f6bd0a5f1
- MD5 3d83750f4e2fecd991c134dde847a6e6
- SHA1 32421fbd6762ed2cafafec469cfad4cdc7734586
- SHA512 e2f35dabb79963c065453f2eb3d5194718e34b0e5ab044c7fbbf8f49d5905bad11e18564cdcf6d3517859987ee43faea584075ad75f15448edb6615aa546eebc
- SSDEEP 1536:ghPsAwrhsZ4vzlRbN34JvNFL5iGK8oyUxr7AaHqbPeMzJLqmCsa:yqs81NoZ0R8oLxrWeMtLqmRa
- TLSH T1F6A35C1D26F820A9E176C17DC9A24A19E3B2B031635297FF03A181BD5F23FE46D39B51
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5824
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wsepno.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__cexit
_o_abort
_o_free
_o_iswspace
_o_malloc
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o___stdio_common_vswprintf
_o__callnewh
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
wcsstr
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
wcscmp
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExA
GetModuleHandleW
GetModuleFileNameA
GetModuleHandleExW
DisableThreadLibraryCalls
GetProcAddress
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringW
CompareStringOrdinal
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockExclusive
CreateMutexExW
AcquireSRWLockExclusive
AcquireSRWLockShared
CreateSemaphoreExW
LeaveCriticalSection
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSectionEx
EnterCriticalSection
WaitForSingleObjectEx
ReleaseMutex
ReleaseSemaphore
ReleaseSRWLockShared
OpenSemaphoreW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
api-ms-win-core-sysinfo-l1-2-0
VerSetConditionMask
api-ms-win-core-kernel32-legacy-l1-1-1
VerifyVersionInfoW
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoCreateInstance
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegGetValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-eventlog-legacy-l1-1-0
RegisterEventSourceW
DeregisterEventSource
ReportEventW
api-ms-win-security-lsalookup-l2-1-0
LookupAccountSidW
api-ms-win-security-base-l1-1-0
CopySid
IsValidSid
GetLengthSid
oleaut32
SysFreeString
SetErrorInfo
SysStringLen
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
efswrt
CdplIsSupported
ntdll
RtlGetPersistedStateLocation
RtlIsStateSeparationEnabled
RtlNtStatusToDosError
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
api-ms-win-core-datetime-l1-1-0
GetTimeFormatW
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
52KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
308B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=70, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=1171, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=26, id=261, version=33145,
count=1, id=256, version=33145,
count=1, id=253, version=33145,
count=11, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wshbth.dll
- IMPHASH f2ac61bda79b89b388814309db6fcb9b
- SHA256 68a7a030b352bee8c30374e5f7bb286a0d5d822ec2d178ef4023f71a12c3c587
- MD5 6da9e9f6588c3554763cac7d91d8c41e
- SHA1 dc9872d15a413cc4ff4143e6f9fc0ed967b55b9f
- SHA512 6d5d752fb317a6f493c9688aa51a3dcd4e1e13d3c51b41e70478ceada2a8d41e8e9dcd6431644456e8b52fdc759ceb5f9e7413196c5aa05493a43da16c9df518
- SSDEEP 1536:UQd5Q8Zrt9p9E5Y/FdjjUPnUj1q4Ld/uhs7X:Rw85t9p9B/TcPnUj1nKEX
- TLSH T1EB932916A65520B6D82AC27A85B72F26F772F8255B3143DF4160813C9F16BE08F3DF89
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5056
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wshbth.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
memmove
_o__wcsicmp
_o___std_type_info_destroy_list
_o___stdio_common_vswprintf
__C_specific_handler
memcpy
api-ms-win-crt-string-l1-1-0
memset
ntdll
NtDeviceIoControlFile
EtwGetTraceEnableFlags
EtwUnregisterTraceGuids
EtwTraceMessage
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwRegisterTraceGuidsW
RtlCompareMemory
RtlGetLastNtStatus
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlInitUnicodeString
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-synch-l1-1-0
WaitForMultipleObjectsEx
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
CreateEventW
EnterCriticalSection
DeleteCriticalSection
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-security-base-l1-1-0
FreeSid
AllocateAndInitializeSid
rpcrt4
RpcBindingFromStringBindingW
RpcStringFreeW
RpcBindingSetAuthInfoExW
RpcStringBindingComposeW
NdrClientCall3
RpcBindingFree
api-ms-win-core-file-l1-1-0
CreateFileW
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
TerminateProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
NSPStartup
WSHAddressToString
WSHEnumProtocols
WSHGetBroadcastSockaddr
WSHGetProviderGuid
WSHGetSockaddrType
WSHGetSocketInformation
WSHGetWSAProtocolInfo
WSHGetWildcardSockaddr
WSHGetWinsockMapping
WSHIoctl
WSHJoinLeaf
WSHNotify
WSHOpenSocket
WSHOpenSocket2
WSHSetSocketInformation
WSHStringToAddress
Name
.text
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
PAGE
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
64B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
536B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=45, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1131, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=4, id=259, version=33145,
count=13, id=261, version=33145,
count=1, id=256, version=33145,
count=15, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wshcon.dll
- IMPHASH 22cb281caf6adb813ffa4471b38821fa
- SHA256 b1a3d15be39b2ff5807dcf0d8924c69eb6d0a2d6d0ed235543ef6b612672abf6
- MD5 47ec5194a6617184df61de8675ce1dd6
- SHA1 278937d6b606d853e914a869211f90d86a61a488
- SHA512 f28ed1675e0d04fdea366ac689e1e2b45bd02f07ef2d5320bdc79371d78a90135ef3918efcbedfc051e33d6141c80726293254b0ba9eefa72ab9ddc0d5a28469
- SSDEEP 384:j+Uo7ujIWzeEN43s5sIM2vfgQFww2D5lYM5c4cymtQbVhE4agDRG+JAWAyE8/kWL:6EO3QbMsfF21lYMcumt6OrgR3JNXMh2
- TLSH T11D23D55AB3F064D9E26582388C470E55E5767D202B0266EF13A0B2BE5F3B7C49B34F91
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4832
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wshcon.pdb
msvcrt
free
_vsnprintf
sprintf_s
malloc
wcscpy_s
wcscat_s
_callnewh
memmove
__C_specific_handler
_initterm
_amsg_exit
strcpy_s
_XcptFilter
strcmp
kernel32
WideCharToMultiByte
FreeLibrary
GetProcAddress
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetModuleFileNameA
GetFullPathNameA
Sleep
RtlCaptureContext
GetCurrentProcess
GetModuleHandleA
RtlLookupFunctionEntry
MultiByteToWideChar
GetLastError
SetUnhandledExceptionFilter
LoadLibraryExW
UnhandledExceptionFilter
RtlVirtualUnwind
ole32
CoGetMalloc
CoCreateInstanceEx
StringFromCLSID
CreateFileMoniker
oleaut32
VariantChangeType
SysAllocStringLen
LoadTypeLibEx
SysAllocString
SysStringLen
VariantClear
UnRegisterTypeLi
LoadRegTypeLi
SysFreeString
advapi32
RegCreateKeyA
RegCloseKey
RegSetValueExA
RegSetValueA
RegDeleteKeyA
RegQueryValueA
RegOpenKeyA
DLLGetDocumentation
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
16KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
708B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
204B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=16, id=260, version=33145,
count=5, id=259, version=33145,
count=60, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=2, id=261, version=33145,
count=1, id=256, version=33145,
count=5, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wshelper.dll
- IMPHASH 95bd6dab3a95273e005c7685e2e92025
- SHA256 2f8c9cc924e0b0eb34e33fdaeb28fe81d405a99a00a86c1f0d501d4d35720eee
- MD5 e7560ae72404d74ac5a558b8ed43d86e
- SHA1 9259e1fff7241e2568cfacef76d46d3e70ea3628
- SHA512 7af62f052d2ffbb5670e409c6614626e52035c6dfe30a601a6f382223fc0a5e11c97f0a43402dd2f1467f2dc5ea6089c94f54792b834b262df97f636bbca511f
- SSDEEP 384:ndvczohf93P62Rufu0I0+ZW7nvfd5BootcaOsUo9fNc53cXhvqjPsHYa1W8bW:boPfu0I0vbd5BPUkfNc5sqjPs4al
- TLSH T17A13F90D62BE349DF87602B884A71A259672743027225AFF45F0D5BC4F3ABD1EA38F51
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4752
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wshelper.pdb
msvcrt
wcstok
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
wcsstr
fprintf
wcstoul
__iob_func
wprintf
memset
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
ws2_32
WSAEnumNameSpaceProvidersW
WSCGetProviderPath32
WSCGetProviderPath
WSCDeinstallProvider
WSCEnumNameSpaceProviders32
WSCEnumProtocols32
WSAStartup
WahWriteLSPEvent
WSCEnumProtocols
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
api-ms-win-core-com-l1-1-0
StringFromCLSID
CoTaskMemFree
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegQueryValueExW
RegEnumKeyExA
RegSetValueExW
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegOpenKeyExW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
netsh.exe
PrintMessageFromModule
RegisterContext
RegisterHelper
MakeString
FreeString
MatchEnumTag
MatchToken
PrintError
wevtapi
EvtFormatMessage
EvtClose
EvtCreateRenderContext
EvtOpenPublisherMetadata
EvtQuery
EvtNext
EvtRender
api-ms-win-core-registry-l2-1-0
RegDeleteKeyA
RegCopyTreeA
mswsock
MigrateWinsockConfiguration
InitHelperDll
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
552B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
184B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=28, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=261, version=33140,
count=1, productName=Unmarked objects (old),
count=14, id=260, version=33140,
count=4, id=259, version=33140,
count=74, id=1, productName=Unmarked objects,
count=7, id=257, version=33140,
count=1, id=256, version=33140,
count=6, id=264, version=33140,
count=1, id=255, version=33140,
count=1, id=258, version=33140,
wshext.dll
- IMPHASH feb90c0b28ac298106d70dfe7ebc1fe7
- SHA256 762e48b4bedb91a07389da0f055b36f65198c60f8f55f3efed4043be6a29157c
- MD5 06f73a7f6497fbf2f8e62763508cb678
- SHA1 fc17a3debf0bcc67f6c9d4a6c8b1a142bcfb5124
- SHA512 00fc0aec0e14ee98e596a480bce162f4ce2c3b73cbb6d682cea23c4ef23dae14fdea66db7124fffbb24b79fb9d3ce0490cc2811bdafed8af18e9162a2ad12bb0
- SSDEEP 1536:zOlcWBr2TpLOECYpNcnPO9Lu+AIm8E8CzaxW0TfuTFVO0AugqPGrUHC+NxEdJegi:zOUFOE5N4Hr8CokvC+Nh
- TLSH T14FB3072A32B930E9E5659238881646569772BC302B2167FF06E0EA3D5F77BC47E34F41
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
14000
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wshext.pdb
msvcrt
_itow_s
memset
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_vsnwprintf
_wcsnicmp
_callnewh
wcsncmp
wcsrchr
wcsstr
_wcsicmp
wcscpy_s
malloc
strcpy_s
_vsnprintf
sprintf_s
strcat_s
_stricmp
free
realloc
memcmp
memcpy
strcmp
user32
GetWindowRect
SetDlgItemTextA
CheckDlgButton
GetFocus
WinHelpA
BringWindowToTop
FindWindowW
GetDesktopWindow
SetWindowLongPtrA
LoadStringW
FindWindowA
GetWindowLongPtrA
SetForegroundWindow
MessageBoxA
IsDlgButtonChecked
SetFocus
GetDlgItemInt
GetDlgItem
SetDlgItemInt
EnableWindow
LoadStringA
DefWindowProcA
SendMessageA
GetParent
CharNextA
kernel32
MapViewOfFile
CreateFileMappingW
LoadResource
FindResourceExW
LCIDToLocaleName
UnmapViewOfFile
GetVersionExW
GetUserDefaultUILanguage
GetLocaleInfoEx
GetSystemDefaultUILanguage
SearchPathW
DelayLoadFailureHook
ResolveDelayLoadedAPI
GetPrivateProfileStringA
GetPrivateProfileIntA
WritePrivateProfileStringA
GetPrivateProfileIntW
WritePrivateProfileStringW
GetFullPathNameA
GetFullPathNameW
DeleteCriticalSection
GetUserDefaultLCID
GetLocaleInfoA
GetLocaleInfoW
GetLastError
GetWindowsDirectoryA
InitializeCriticalSection
GetModuleFileNameA
GetModuleHandleA
MultiByteToWideChar
GetFileAttributesA
GetPrivateProfileStringW
GetACP
GetFileAttributesW
FindClose
FindFirstFileA
FindFirstFileW
GetModuleFileNameW
FreeLibrary
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
WideCharToMultiByte
QueryPerformanceCounter
SetEnvironmentVariableA
TerminateProcess
SetUnhandledExceptionFilter
lstrcmpiA
UnhandledExceptionFilter
RtlVirtualUnwind
ReadFile
WriteFile
LoadLibraryExA
SetFilePointer
CreateFileW
GetTempPath2A
CreateFileA
GetSystemDirectoryA
CloseHandle
GetProcAddress
GetFileSize
RtlLookupFunctionEntry
GetTempFileNameA
LoadLibraryExW
FlushFileBuffers
SetLastError
GetCurrentProcess
SetEndOfFile
DuplicateHandle
GetVersionExA
Sleep
RtlCaptureContext
CreateIndirectData
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetSignedDataMsg
IsFileSupportedName
PutSignedDataMsg
RemoveSignedDataMsg
VerifyIndirectData
Name
.text
Size
56KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
528B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
612B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=21, id=260, version=33140,
count=5, id=259, version=33140,
count=201, id=1, productName=Unmarked objects,
count=3, id=257, version=33140,
count=2, id=261, version=33140,
count=1, id=256, version=33140,
count=31, id=264, version=33140,
count=1, id=255, version=33140,
count=1, id=258, version=33140,
wshhyperv.dll
- IMPHASH 9203bd76c41ac8bf92d2fdccd53f5694
- SHA256 0e01bd8386df69fda8774fe09aab974fa7c295a3cc3f57f6744dda3a44a6e152
- MD5 9cbb98852429c70d4d952910164c1827
- SHA1 d9e50181baf9bd52d3ca3435790da709b63d01eb
- SHA512 1d856330a1d0f124454056946cca4d8356c777b29cc480b25df7fb13d0ff147ab96c411322d998745b6b294ff5f5ea8974e44c5c40e2c43247173b58ea1d971a
- SSDEEP 192:JkAaGs6kx/QF2EqDWsNWJZ0XhBNhDBQABJ89Bm+0U8X01k9z3Arq:JkA3RkxYFJSWsNWydDBRJ89Bmo8R9zYq
- TLSH T18F036CC197681545F96AAAB402ACCB473C3E37D38B4051DB0691F54D1CA73CEAF30BA9
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
82:4f:56:ff:da:9a:b7:71:11:06:99:a5:67:d4:b2:59:6a:d8:e4:b2:ee:18:74:e4:c5:e2:1a:f0:d5:c5:32:64
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 1, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:179E-4BB0-8246,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:e0:d4:fc:1f:13:15:1f:7e:5d:00:01:00:00:01:e0
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 12, 2023 - Jan 10, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
4112
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wshhyperv.pdb
ntdll
RtlInitUnicodeString
LdrDisableThreadCalloutsForDll
NtTerminateProcess
_wcsicmp
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnhandledExceptionFilter
memmove
RtlCaptureContext
RtlGUIDFromString
memset
api-ms-win-core-com-l1-1-0
StringFromGUID2
WSHAddressToString
WSHEnumProtocols
WSHGetBroadcastSockaddr
WSHGetProviderGuid
WSHGetSockaddrType
WSHGetSocketInformation
WSHGetWSAProtocolInfo
WSHGetWildcardSockaddr
WSHGetWinsockMapping
WSHIoctl
WSHJoinLeaf
WSHNotify
WSHOpenSocket
WSHOpenSocket2
WSHSetSocketInformation
WSHStringToAddress
Name
.text
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=33136,
count=12, id=1, productName=Unmarked objects,
count=5, id=260, version=33136,
count=3, id=259, version=33136,
count=1, id=256, version=33136,
count=2, id=264, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
wship6.dll
- IMPHASH 7950d3e450c85468259854df6349eee2
- SHA256 9699e5dd5edabcbf24269b2462c56ae00c40afa89e397cb47dd1f35583b7fa39
- MD5 f25e0069791895862346e7d426821a9e
- SHA1 75f073682de8e600071ded10c6fe5d6dbce2da8a
- SHA512 16670ce160ecd23ed29d0c7fd2c6a34c4474bca2bf1ffa1ccbf8e8d2537d6fa8113003cc3a038f8b180d71262a005471ddbcc2a73a417d24db2943da6d904db8
- SSDEEP 96:VUHW/uVc0CEvUJ58TyJCAW6qwsTHpYUni5heytma0rqe208XEW9qWwj:VU2/2ZK/VJ46qwYpYUiNep2zUW9qWy
- TLSH T1ACE20A45BBA56665F1B8833D05A74F05BDBAB910632383EF47E0D22D1E22FC07836B65
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4112
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wship6.pdb
ntdll
RtlUnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlIpv6StringToAddressExW
RtlCaptureContext
RtlAllocateHeap
_wcsicmp
RtlIpv4AddressToStringExW
RtlInitUnicodeString
RtlIntegerToUnicodeString
RtlIpv6AddressToStringExW
NtTerminateProcess
RtlAppendUnicodeStringToString
LdrDisableThreadCalloutsForDll
memmove
ws2_32
ntohs
WSAGetLastError
setsockopt
WSHAddressToString
WSHEnumProtocols
WSHGetProviderGuid
WSHGetSockaddrType
WSHGetSocketInformation
WSHGetWSAProtocolInfo
WSHGetWildcardSockaddr
WSHGetWinsockMapping
WSHIoctl
WSHJoinLeaf
WSHNotify
WSHOpenSocket
WSHOpenSocket2
WSHSetSocketInformation
WSHStringToAddress
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
216B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=257, version=33136,
count=19, id=1, productName=Unmarked objects,
count=6, id=260, version=33136,
count=3, id=259, version=33136,
count=2, id=264, version=33136,
count=1, id=256, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
wshqos.dll
- IMPHASH e8e689a920a4a06980235834765ce039
- SHA256 b6ab795fc5ff3e36960a0db15bb31f77eb56aa5e057244fffed0249866ab2706
- MD5 edcad20a2d78340c74250d4a744b9fec
- SHA1 557f6be6f3c24f0332c6b5d04084090d4bfb5411
- SHA512 716c5a47efb62c30a55d5b01b22b41bcf1c813b7bc99f96dd7e2ba2dfdcdbc07d0a34daab33f2bdfcfcafae3773aa3ebe17e2afeeb96cd1bebd25701fe954b9f
- SSDEEP 384:e9ni4Jfxs/wTKxcQWrpcdILEEEmNYWJwWLE:YiKsYTQW1Limd
- TLSH T1A6030849B3B65658E132133984A75A0BA57570242723A7FF4770D63C0E6BBC4AE35F82
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
6608
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wshqos.pdb
msvcrt
_initterm
malloc
free
__C_specific_handler
_amsg_exit
_XcptFilter
memcpy
_wcsicmp
memmove
memset
ntdll
RtlFreeHeap
ShipAssert
RtlAllocateHeap
ws2_32
WSAGetLastError
WSAIoctl
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionAndSpinCount
SetEvent
DeleteCriticalSection
api-ms-win-core-errorhandling-l1-1-0
GetLastError
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
LoadLibraryExW
GetProcAddress
FreeLibrary
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
WSHAddressToString
WSHEnumProtocols
WSHGetProviderGuid
WSHGetSockaddrType
WSHGetSocketInformation
WSHGetWSAProtocolInfo
WSHGetWildcardSockaddr
WSHGetWinsockMapping
WSHIoctl
WSHJoinLeaf
WSHNotify
WSHOpenSocket
WSHOpenSocket2
WSHSetSocketInformation
WSHStringToAddress
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
588B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33145,
count=4, id=259, version=33145,
count=40, id=1, productName=Unmarked objects,
count=7, id=257, version=33145,
count=1, id=256, version=33145,
count=2, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wshrm.dll
- IMPHASH 1b5ff7212a1b98059799b6f461ab1c25
- SHA256 0b3e987970666ffb6aa63ae5175385d76f85d787b2112288c5181fc1200aeae8
- MD5 20b0e35274668332defdcf13d6c2d8a3
- SHA1 3714f967fa94f939f4ed316dbb4826998ef2d89a
- SHA512 ee11b16abd6e84e44a2452d0c165457e7caa47af627fc094ab4ddc1981f2d229746c671c6699435e702a2fc7a437b178e523c3fad406aadfa9a8d04f9db80baf
- SSDEEP 384:y1NQeAicSrc7LxlV25WDbBayFT6mJqnFkT5OafyJi2LNEUZWtiW:yjcscRD2WImJqFI5df72Lg
- TLSH T14E132A05F3B821AAF87B877E45CB0B19A573B961531147EF43A0963D0E17BE09A3CB52
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4752
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wshrm.pdb
msvcrt
_initterm
memmove
malloc
memset
free
_amsg_exit
_XcptFilter
swprintf_s
iswxdigit
iswdigit
_wcsicmp
iswlower
memcpy
__C_specific_handler
ntdll
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlFreeHeap
RtlIpv4StringToAddressW
RtlCaptureContext
NtDelayExecution
RtlInitUnicodeString
RtlAllocateHeap
NtDeviceIoControlFile
kernel32
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
DisableThreadLibraryCalls
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
ws2_32
ntohs
htons
WSHAddressToString
WSHEnumProtocols
WSHGetBroadcastSockaddr
WSHGetProviderGuid
WSHGetSockaddrType
WSHGetSocketInformation
WSHGetWSAProtocolInfo
WSHGetWildcardSockaddr
WSHGetWinsockMapping
WSHIoctl
WSHJoinLeaf
WSHNotify
WSHOpenSocket
WSHOpenSocket2
WSHSetSocketInformation
WSHStringToAddress
Name
.text
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
132B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=14, id=260, version=33145,
count=4, id=259, version=33145,
count=40, id=1, productName=Unmarked objects,
count=9, id=257, version=33145,
count=1, id=256, version=33145,
count=2, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wshunix.dll
- IMPHASH ac15118e193d479b15c8f0e6a02437af
- SHA256 535ddfcd2f030413e164e675933464dd727bf5a69e39b4667c6db5dedcbc579c
- MD5 d1dd299f51144956db30ce342d3d30a7
- SHA1 f11353166d4cdad1a748ffee6a2ff5309be85682
- SHA512 15a23f205ad4ca32d7cd78b4cdd7048d2cc60937f0fb93f33120b10193a12bdd7a5504046df08c33979119986d9d598921f1649ae7ebb2fa2f27ec94a76ebebc
- SSDEEP 384:FvkYdcUMSLPhdfphrWcmXWu5dDBRJcgytHNsAR9zygsX:Jpczcjr5mJ5d1Pc9ts89zz
- TLSH T14D135A825A686046F476A27502E6DA437D3EB3D25B1052EF02D4F2390C973D5BB38F6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
3c:0c:ba:19:cb:74:07:30:f2:4a:ae:b0:74:97:3f:99:a9:b6:f0:c8:28:65:2d:59:3e:b2:92:14:fc:82:e8:3b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 1, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:FC41-4BD4-D220,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:e2:99:99:95:f1:dc:e3:20:eb:00:01:00:00:01:e2
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 12, 2023 - Jan 10, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
4112
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wshunix.pdb
ntdll
RtlAllocateHeap
_wcsicmp
RtlDosPathNameToNtPathName_U_WithStatus
RtlInitUnicodeString
RtlDeleteResource
RtlAcquireResourceShared
RtlUTF8ToUnicodeN
RtlReleaseResource
RtlInitializeResource
RtlAcquireResourceExclusive
RtlFreeHeap
LdrDisableThreadCalloutsForDll
NtTerminateProcess
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnhandledExceptionFilter
memmove
memcpy
memset
WSHAddressToString
WSHEnumProtocols
WSHGetBroadcastSockaddr
WSHGetProviderGuid
WSHGetSockaddrType
WSHGetSocketInformation
WSHGetWSAProtocolInfo
WSHGetWildcardSockaddr
WSHGetWinsockMapping
WSHIoctl
WSHJoinLeaf
WSHNotify
WSHOpenSocket
WSHOpenSocket2
WSHSetSocketInformation
WSHStringToAddress
Name
.text
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
204B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=257, version=33136,
count=20, id=1, productName=Unmarked objects,
count=5, id=260, version=33136,
count=3, id=259, version=33136,
count=1, id=256, version=33136,
count=2, id=264, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
wslapi.dll
- IMPHASH d2747ecef5bcfed9d4963d3b5b89bd22
- SHA256 8aa7e23bb9e63e6df89ff5dd7245ac3050a67f595b2e96bfa9d0f9d4bc9fdde5
- MD5 2ba47d75045d216b7523158157794567
- SHA1 6be00a0dde54dcf8c41a1fe05460ab37c595ffc2
- SHA512 1042132aa5a39a38893005d6ae629a8535bbaa7ca30c5404a082bddefaf7f39f7ff01db2490851401c77a16d383f48addc94f1bfca438d5a149816543f621ce2
- SSDEEP 1536:VqKvTOiS00EhX/zhY4G2JE1xi+dizeGYNE5mZ7wHpqV2BdWJNLZyZcFczrwQY5:VqIKJWtzhYw/5mBwJqwB4LZyWFcDY5
- TLSH T184B34C7E76A810B6E176D07DC9C34A1AD372783553622BDF01A082AD1F27BE81D3DB91
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7520
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wslapi.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__errno
_o_abort
_o_free
_o_iswspace
_o_malloc
_o_terminate
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o__beginthreadex
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
memcpy
memmove
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetModuleHandleExW
GetProcAddress
FreeLibrary
GetModuleHandleW
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionAndSpinCount
AcquireSRWLockExclusive
DeleteCriticalSection
LeaveCriticalSection
CreateEventW
ResetEvent
CreateSemaphoreExW
EnterCriticalSection
CreateEventExW
TryAcquireSRWLockExclusive
SetEvent
ReleaseMutex
OpenSemaphoreW
WaitForSingleObject
ReleaseSemaphore
InitializeSRWLock
ReleaseSRWLockExclusive
CreateMutexExW
InitializeCriticalSectionEx
WaitForSingleObjectEx
AcquireSRWLockShared
ReleaseSRWLockShared
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError
RaiseException
api-ms-win-core-processthreads-l1-1-0
GetCurrentThread
InitializeProcThreadAttributeList
GetExitCodeProcess
GetCurrentProcess
GetCurrentThreadId
TerminateProcess
CreateProcessW
GetCurrentProcessId
UpdateProcThreadAttribute
CreateThread
DeleteProcThreadAttributeList
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-handle-l1-1-0
SetHandleInformation
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-synch-l1-2-0
WakeAllConditionVariable
InitOnceExecuteOnce
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-core-com-l1-1-0
CoInitializeSecurity
CoTaskMemAlloc
CoTaskMemFree
CoInitializeEx
CoCreateInstance
CoUninitialize
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-path-l1-1-0
PathCchRemoveFileSpec
PathAllocCombine
api-ms-win-core-file-l1-1-0
CreateFileW
api-ms-win-core-processenvironment-l1-1-0
GetStdHandle
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-core-winrt-l1-1-0
RoInitialize
RoGetActivationFactory
RoUninitialize
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsDeleteString
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemDirectoryW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-appmodel-runtime-l1-1-0
GetCurrentPackagePath
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventUnregister
EventWriteTransfer
EventSetInformation
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
oleaut32
SetErrorInfo
SysStringLen
SysFreeString
DllCanUnloadNow
DllGetClassObject
DllMain
WslConfigureDistribution
WslGetDistributionConfiguration
WslIsDistributionRegistered
WslLaunch
WslLaunchInteractive
WslRegisterDistribution
WslUnregisterDistribution
Name
.text
Size
52KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
568B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=75, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1192, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=26, id=261, version=33145,
count=7, id=259, version=33145,
count=1, id=256, version=33145,
count=25, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wsmplpxy.dll
- IMPHASH 1dc582e5667fefd226fe664605dd53ea
- SHA256 efe7e579ae07e9e3294c7e70e14cf6dd09b9d3a629b113e7f75e4b9b2095ead8
- MD5 b433081e952440dc64ac9d755fbfed16
- SHA1 514778b0316fb95e8be181f7a8e72f3ae7f9ad4c
- SHA512 5e76dd26b61aada3c02996afefc9c6b0fb73976e6c0415eb132c090e3c7f395ce2dd5cf6533e3c2c12408a012209a265f6259f20d9993225861a895ca9b5154b
- SSDEEP 384:yP6tO0EPN66wZyrv1d5VzopRZByfkuR+4Ws9W:yIomuYW
- TLSH T178F2D78AB7254DADF836827A48570F25633AF60043628BDB0230524D1D7E3C2AF35FD4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4752
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wsmplpxy.pdb
msvcrt
__C_specific_handler
malloc
_amsg_exit
_initterm
free
_XcptFilter
oleaut32
BSTR_UserMarshal64
BSTR_UserFree64
BSTR_UserMarshal
BSTR_UserUnmarshal
BSTR_UserUnmarshal64
BSTR_UserFree
BSTR_UserSize
BSTR_UserSize64
rpcrt4
NdrOleAllocate
NdrDllCanUnloadNow
NdrDllUnregisterProxy
NdrDllRegisterProxy
NdrOleFree
NdrDllGetClassObject
api-ms-win-core-libraryloader-l1-1-0
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
356B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33145,
count=4, id=259, version=33145,
count=39, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=1, id=256, version=33145,
count=4, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wsnmp32.dll
- IMPHASH 9d783ed7dd8a61952077d1567781a817
- SHA256 ed8cb33c920e643628cac35e37f24009f6ba99b285f13033637e5a5b292f10bb
- MD5 b34a71b5ba7a7edb42021e8dca4fe7b3
- SHA1 e2bd27a08475db431303daf2dbe3b05a54e9c30f
- SHA512 01549b701b305006068440b8f5368bd82eed74a64eaaf844362eddff69d7a214bf57c4331371408c8d143f747dbcb9a51ef796e15c875dde414199022198aad8
- SSDEEP 1536:gQuCbBr2LIDsZ41sWGRzx1+tsDzLRO8ulecLGY9iAbYqsPweq:EkS41GV6WzLRONleyJGweq
- TLSH T16AA3066DB6E830BCD89681B8C56A0286D3717035132063FF22E4C6799F37AD69E35F46
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
42944
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wsnmp32.pdb
msvcrt
_amsg_exit
free
malloc
_initterm
_XcptFilter
_beginthreadex
memcpy
memcmp
_errno
strtoul
_strupr
_ultoa
_endthreadex
__C_specific_handler
atol
strtok
strchr
atoi
memset
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-security-base-l1-1-0
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
InitializeAcl
GetLengthSid
AddAccessAllowedAce
SetSecurityDescriptorDacl
kernel32
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetOverlappedResult
GetQueuedCompletionStatus
ReadFile
DeleteCriticalSection
DisableThreadLibraryCalls
InitializeCriticalSection
GetPrivateProfileStringA
lstrlenA
CreateIoCompletionPort
CreateEventA
GetCurrentProcessId
ResetEvent
DelayLoadFailureHook
ResolveDelayLoadedAPI
CloseHandle
GetVersionExA
SetEvent
CreateFileA
GetLastError
Sleep
PostQueuedCompletionStatus
WaitForSingleObject
GlobalAlloc
GlobalFree
SetNamedPipeHandleState
WaitNamedPipeA
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjectsEx
GetTickCount
ws2_32
WSACloseEvent
WSACreateEvent
WSAEventSelect
WSAWaitForMultipleEvents
recvfrom
WSAEnumNetworkEvents
ioctlsocket
WSAStringToAddressA
getaddrinfo
freeaddrinfo
getnameinfo
WSACleanup
select
WSAIoctl
closesocket
WSASetLastError
WSASendMsg
WSAStartup
WSAAddressToStringA
socket
ntohs
htons
sendto
setsockopt
WSAGetLastError
bind
iphlpapi
GetBestInterfaceEx
GetAdaptersAddresses
SnmpCancelMsg
SnmpCleanup
SnmpCleanupEx
SnmpClose
SnmpContextToStr
SnmpConveyAgentAddress
SnmpCountVbl
SnmpCreatePdu
SnmpCreateSession
SnmpCreateVbl
SnmpDecodeMsg
SnmpDeleteVb
SnmpDuplicatePdu
SnmpDuplicateVbl
SnmpEncodeMsg
SnmpEntityToStr
SnmpFreeContext
SnmpFreeDescriptor
SnmpFreeEntity
SnmpFreePdu
SnmpFreeVbl
SnmpGetLastError
SnmpGetPduData
SnmpGetRetransmitMode
SnmpGetRetry
SnmpGetTimeout
SnmpGetTranslateMode
SnmpGetVb
SnmpGetVendorInfo
SnmpListen
SnmpListenEx
SnmpOidCompare
SnmpOidCopy
SnmpOidToStr
SnmpOpen
SnmpRecvMsg
SnmpRegister
SnmpSendMsg
SnmpSetAgentAddress
SnmpSetPduData
SnmpSetPort
SnmpSetRetransmitMode
SnmpSetRetry
SnmpSetTimeout
SnmpSetTranslateMode
SnmpSetVb
SnmpStartup
SnmpStartupEx
SnmpStrToContext
SnmpStrToEntity
SnmpStrToOid
Name
.text
Size
56KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=15, id=260, version=33138,
count=5, id=259, version=33138,
count=108, id=1, productName=Unmarked objects,
count=11, id=257, version=33138,
count=1, id=256, version=33138,
count=12, id=264, version=33138,
count=1, id=255, version=33138,
count=1, id=258, version=33138,
wsock32.dll
- IMPHASH 1eee9874b961db9adf8fdc44142368ec
- SHA256 7c6658e8ddb19e10679c13050bc7febc33d190b162b653ebafb0da6e7d292519
- MD5 1acb04f4c2e31c78121cb1be86c4b7af
- SHA1 93077b30d144f33110855c2a1f451d1d11e1bfb1
- SHA512 590b675ac9da54b88668d6296f6cb8f29471e3589221ef972925ba7006d9117f65c42f7bd277b942eeab93cdbc165cd4c0a025c5e9333b17e3d5ffefc73547bf
- SSDEEP 192:GPymZjft5hlaApWIsaRI/UUX2d2booofXXNQp6W9KzW/E:MymZD/OUWIlFUX62+vdQYWMzW/E
- TLSH T1A503B549B2606E7CF432297C08574A056928B52583235FFBAA20559B3CB77F1FC38B67
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5472
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wsock32.pdb
msvcrt
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
ws2_32
getsockopt
WSARecvFrom
setsockopt
WSARecv
api-ms-win-core-errorhandling-l1-1-0
SetLastError
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
AcceptEx
EnumProtocolsA
EnumProtocolsW
GetAcceptExSockaddrs
GetAddressByNameA
GetAddressByNameW
GetNameByTypeA
GetNameByTypeW
GetServiceA
GetServiceW
GetTypeByNameA
GetTypeByNameW
MigrateWinsockConfiguration
NPLoadNameSpaces
SetServiceA
SetServiceW
TransmitFile
WEP
WSAAsyncGetHostByAddr
WSAAsyncGetHostByName
WSAAsyncGetProtoByName
WSAAsyncGetProtoByNumber
WSAAsyncGetServByName
WSAAsyncGetServByPort
WSAAsyncSelect
WSACancelAsyncRequest
WSACancelBlockingCall
WSACleanup
WSAGetLastError
WSAIsBlocking
WSARecvEx
WSASetBlockingHook
WSASetLastError
WSAStartup
WSAUnhookBlockingHook
WSApSetPostRoutine
__WSAFDIsSet
accept
bind
closesocket
connect
dn_expand
gethostbyaddr
gethostbyname
gethostname
getnetbyname
getpeername
getprotobyname
getprotobynumber
getservbyname
getservbyport
getsockname
getsockopt
htonl
htons
inet_addr
inet_network
inet_ntoa
ioctlsocket
listen
ntohl
ntohs
rcmd
recv
recvfrom
rexec
rresvport
s_perror
select
send
sendto
sethostname
setsockopt
shutdown
socket
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
276B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=4, id=259, version=33136,
count=13, id=260, version=33136,
count=28, id=1, productName=Unmarked objects,
count=5, id=257, version=33136,
count=1, id=256, version=33136,
count=2, id=264, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
wsp_fs.dll
- IMPHASH cf7b3928cf7d0cbf7c35541298afa12b
- SHA256 597fa169c5c0cf99b73f4f04158f8b15dbb609f07f1c8b556a57c876fed7a061
- MD5 6b060e9a3e19bfd391348729131b461b
- SHA1 3d1d914a86de442010ef83a1ceb706fe4cf4ec9d
- SHA512 856b92fe9ce1ccb630997922ec230df6705ad92ae1ccec8485ed6af2a0aa048682c6f22cc0877c94b2b9a5bed9e296943f6d88fe7287ac70710cc3c6dffa25a7
- SSDEEP 24576:H1G2IXcGeCobFRWq30kye9+jND3LlgViHjGmgYwfzj:VtIcGeCobFRWq30kye9gvYiIV
- TLSH T1AA85D506A7EC0255E1FAF778C8B70619DAB27C669B31D3CF6951214E0E23FC18971B26
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
f8:ba:bb:eb:09:34:04:7e:05:d2:0d:28:b5:54:61:b7:78:d6:88:93:a4:46:65:a8:b2:39:8a:a3:d2:7e:c5:2c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:F002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:20:24:e1:e6:e0:17:b9:b4:8e:00:01:00:00:02:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
11376
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wsp_fs.pdb
msvcp_win
?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z
?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z
?pbase@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
_Wcsxfrm
_Wcscoll
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?is@?$ctype@_W@std@@QEBA_NF_W@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??1_Locinfo@std@@QEAA@XZ
??1_Lockit@std@@QEAA@XZ
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??0_Locinfo@std@@QEAA@PEBD@Z
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$ctype@_W@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?tolower@?$ctype@_W@std@@QEBA_W_W@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?id@?$collate@_W@std@@2V0locale@2@A
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ
?width@ios_base@std@@QEBA_JXZ
?good@ios_base@std@@QEBA_NXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?flags@ios_base@std@@QEBAHXZ
?uncaught_exception@std@@YA_NXZ
?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WXZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?width@ios_base@std@@QEAA_J_J@Z
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
?_Xbad_function_call@std@@YAXXZ
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W0@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__ultow
_o__wcsnicmp
_o__wtoi64
_o__wtol
_o_free
memmove
_o_malloc
_o_realloc
_o_toupper
_o_towupper
_o_wcscpy_s
_o_wcstok
_o_wcstok_s
__C_specific_handler
_CxxThrowException
strchr
wcschr
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
__RTtypeid
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o__initialize_narrow_environment
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
__RTDynamicCast
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
wcsnlen
memset
ntdll
RtlEnumerateGenericTableWithoutSplayingAvl
RtlIpv6StringToAddressExW
RtlIpv4StringToAddressExW
RtlInsertElementGenericTableAvl
NtQuerySystemInformation
RtlNtStatusToDosError
RtlLookupElementGenericTableAvl
RtlRemoveVectoredExceptionHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlInitializeGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlCaptureContext
RtlEnumerateGenericTableAvl
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleHandleW
GetModuleFileNameA
LoadStringW
LoadLibraryExW
FreeLibrary
api-ms-win-core-synch-l1-1-0
CreateSemaphoreExW
EnterCriticalSection
ReleaseSemaphore
LeaveCriticalSection
AcquireSRWLockShared
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
ReleaseSRWLockShared
InitializeCriticalSection
InitializeCriticalSectionEx
WaitForSingleObject
ReleaseMutex
ResetEvent
SetEvent
CreateEventW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
InitializeSRWLock
CreateMutexExW
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
CloseThreadpoolCleanupGroupMembers
SetThreadpoolTimer
WaitForThreadpoolWorkCallbacks
SubmitThreadpoolWork
CreateThreadpoolWork
CloseThreadpoolTimer
CloseThreadpoolWork
CreateThreadpoolCleanupGroup
CloseThreadpoolCleanupGroup
WaitForThreadpoolTimerCallbacks
api-ms-win-core-processthreads-l1-1-0
GetCurrentThread
GetCurrentProcessId
SetThreadToken
TlsAlloc
TlsSetValue
TlsGetValue
TlsFree
OpenThreadToken
GetCurrentThreadId
OpenProcessToken
TerminateProcess
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
FormatMessageA
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
CompareStringW
CompareStringOrdinal
api-ms-win-core-sysinfo-l1-1-0
GetTickCount64
GetTickCount
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetComputerNameExW
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventWriteTransfer
EventSetInformation
EventRegister
EventActivityIdControl
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-core-interlocked-l1-1-0
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-security-base-l1-1-0
IsValidAcl
GetAce
ImpersonateLoggedOnUser
GetTokenInformation
DuplicateToken
GetAclInformation
AddAce
InitializeAcl
MakeAbsoluteSD
GetLengthSid
AddAccessAllowedAceEx
AddAccessDeniedAceEx
DeleteAce
FreeSid
IsValidSid
EqualSid
DuplicateTokenEx
CopySid
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
ConvertStringSidToSidW
api-ms-win-security-lsalookup-l2-1-0
LookupAccountSidW
LookupAccountNameW
api-ms-win-security-provider-l1-1-0
GetSecurityInfo
GetNamedSecurityInfoW
SetNamedSecurityInfoW
netapi32
DsGetDcNameW
NetApiBufferFree
clusapi
CloseClusterGroup
CloseClusterResource
CloseClusterNode
CloseClusterNetwork
CloseClusterNetInterface
RemoveClusterResourceDependencyEx
GetClusterFromResource
CloseCluster
GetClusterNodeKey
OpenClusterNode
ClusterGetEnumCount
ClusterOpenEnumEx
ClusterEnumEx
ClusterCloseEnum
OpenClusterResource
ClusterEnum
ClusterOpenEnum
OpenCluster
ClusterResourceControl
ClusterRegCloseKey
GetClusterResourceKey
GetClusterKey
ClusterGetEnumCountEx
ClusterNodeOpenEnumEx
ClusterNodeEnumEx
ClusterNodeGetEnumCountEx
ClusterResourceTypeOpenEnum
ClusterResourceTypeEnum
ClusterResourceTypeGetEnumCount
ClusterResourceOpenEnum
ClusterResourceEnum
ClusterResourceGetEnumCount
ClusterNetworkOpenEnum
ClusterNetworkEnum
ClusterNetworkGetEnumCount
ClusterGroupOpenEnum
ClusterGroupEnum
ClusterGroupGetEnumCount
ClusterGroupOpenEnumEx
ClusterGroupEnumEx
ClusterGroupGetEnumCountEx
ClusterResourceOpenEnumEx
ClusterResourceEnumEx
ClusterResourceGetEnumCountEx
ClusterResourceCloseEnumEx
ClusterGroupCloseEnumEx
ClusterGroupCloseEnum
ClusterResourceCloseEnum
ClusterNetworkCloseEnum
ClusterResourceTypeCloseEnum
ClusterNodeCloseEnumEx
ClusterCloseEnumEx
CloseClusterNotifyPort
OpenClusterEx
AddClusterNode
GetClusterInformation
GetClusterQuorumResource
ClusterControlEx
AddResourceToClusterSharedVolumes
RemoveResourceFromClusterSharedVolumes
SetClusterQuorumResourceEx
ClusterGetMaximumAccessForToken
SetClusterNameEx
CreateClusterGroupEx
CreateClusterResourceTypeEx
DestroyCluster
CCHlpGetClusterServiceSecret
CCHlpAddNodeUpdateCluster
ClusterUpgradeFunctionalLevel
OpenClusterResourceEx
ClusterResourceControlEx
SetClusterResourceNameEx
GetClusterResourceState
DeleteClusterResourceEx
OfflineClusterResourceEx2
OnlineClusterResourceEx2
ChangeClusterResourceGroupEx2
AddClusterResourceDependencyEx
GetClusterResourceDependencyExpression
SetClusterResourceDependencyExpression
RestartClusterResourceEx
FailClusterResourceEx
AddClusterResourceNodeEx
RemoveClusterResourceNodeEx
OpenClusterGroupEx
ClusterGroupControlEx
GetClusterGroupState
DestroyClusterGroupEx
OfflineClusterGroupEx2
OnlineClusterGroupEx2
MoveClusterGroupEx2
CancelClusterGroupOperation
SetClusterGroupNameEx
SetClusterGroupNodeListEx
CreateClusterResource
OpenClusterNodeEx
ClusterNodeControlEx
GetClusterNodeState
PauseClusterNodeEx2
ResumeClusterNodeEx2
EvictClusterNodeEx2
OpenClusterNetworkEx
SetClusterNetworkNameEx
ClusterNetworkControlEx
GetClusterNetworkState
OpenClusterNetInterfaceEx
ClusterNetInterfaceControlEx
GetClusterNetInterfaceState
ClusterResourceTypeControlEx
DeleteClusterResourceTypeEx
GetNodeClusterState
CCHlpGetDNSHostLabel
CreateCluster
CCHlpConfigureNode
CCHlpCreateClusterNameInAD
CreateClusterNotifyPortV2
ClusterRegSetValue
ClusterRegQueryValue
GetClusterNotifyV2
RegisterClusterResourceTypeNotifyV2
GetNotifyEventHandle
mispace
WspUnpackObjectId
WspGetRemoteInstance
WspPackObjectId
WspFreeString
WspGetSubsystemFilter
WspReferencesOfRemoteInstance
WspInvokeRemoteMethod
WspIsRemoteInstance
WspProviderEnter
WspEnumerateRemoteInstances
WspProviderExit
ws2_32
WSAGetLastError
htons
GetAddrInfoW
ntohs
WSAAddressToStringW
FreeAddrInfoW
WSAStringToAddressW
api-ms-win-core-synch-l1-2-0
InitOnceInitialize
Sleep
api-ms-win-core-file-l1-1-0
CreateDirectoryW
GetFileAttributesW
CreateFileW
FindFirstVolumeW
FindNextFileW
FindFirstFileW
FindClose
FindVolumeClose
GetDiskFreeSpaceExW
GetVolumeInformationW
GetDriveTypeW
GetVolumePathNameW
FindNextVolumeW
RemoveDirectoryW
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoInitializeEx
CoUninitialize
CoCreateInstanceEx
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
crypt32
CryptProtectMemory
CryptUnprotectMemory
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
dsrole
DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation
api-ms-win-core-file-l1-2-0
GetVolumeNameForVolumeMountPointW
GetVolumePathNamesForVolumeNameW
iphlpapi
IcmpCreateFile
Icmp6CreateFile
IcmpCloseHandle
IcmpSendEcho
Icmp6SendEcho2
oleaut32
SysFreeString
SysAllocString
dnsapi
DnsFlushResolverCacheEntry_W
api-ms-win-core-threadpool-legacy-l1-1-0
DeleteTimerQueueTimer
DeleteTimerQueueEx
api-ms-win-core-heap-obsolete-l1-1-0
LocalSize
cryptsp
CryptGenRandom
CryptAcquireContextW
CryptReleaseContext
sscore
SsCoreUninitialize
ntdsapi
DsBindWithCredW
DsUnBindW
mi
mi_clientFT_V1
MI_Application_InitializeV1
wldap32
ord97
ord140
ord224
ord79
ord142
ord203
ord73
ord88
ord18
ord14
ord145
ord26
ord41
ord13
api-ms-win-security-activedirectoryclient-l1-1-0
DsFreeNameResultW
DsCrackNamesW
DsFreePasswordCredentials
resutils
ResUtilGetResourceName
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
GetProviderClassID
MI_Main
PreShutdown
SetShutdownCallback
SmpUnload
Name
.text
Size
684KB
Virtual Size
682KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
772KB
Virtual Size
768KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
120KB
Virtual Size
123KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
52KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
56KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=118, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=14, id=260, version=33145,
count=5, id=259, version=33145,
count=1707, id=1, productName=Unmarked objects,
count=23, id=257, version=33145,
count=26, id=261, version=33145,
count=1, id=256, version=33145,
count=208, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wsp_health.dll
- IMPHASH dbe2c315fdd820f850f70518e224d2a4
- SHA256 22de3670c41da41dfe8ea3454b5eb9fb4ebbabde94ab006a99b8d4ac332f1729
- MD5 6742a37204745c42b16a89c989f71ddf
- SHA1 a08d6dd9cdc0355c38a8950581c9523d3a373b94
- SHA512 da3e04a4a76e79f79b15c926404b6728fd4f0b560c161fed6cd8a51fad4a5f7da87b8f1005673d0f2557dea3239efae822d57ca267901efd6310df23230cfc3f
- SSDEEP 24576:ib8cugGYo8fJu1DMA+1hIK4/BYqhZ7A+xysraZ/jjs:O1LGYo8fJKgH1hIK4/BYqhZrxysQM
- TLSH T14865E816A7EC8265E9F6BB38C8BB0618DAB27C569F31C3CF1195100E4E67BC4C975722
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
4b:09:fe:75:e5:83:34:0e:ff:5c:c5:4b:ad:17:e5:00:90:86:5f:37:7f:ae:b5:0e:be:47:70:f9:7f:26:6c:25
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:431A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1d:4b:c0:92:87:38:85:7e:39:00:01:00:00:02:1d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
11408
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wsp_health.pdb
msvcp_win
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?__ExceptionPtrCurrentException@@YAXPEAX@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
_Wcsxfrm
_Wcscoll
?_Incref@facet@locale@std@@UEAAXXZ
?is@?$ctype@_W@std@@QEBA_NF_W@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??1_Locinfo@std@@QEAA@XZ
??1_Lockit@std@@QEAA@XZ
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??0_Locinfo@std@@QEAA@PEBD@Z
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$ctype@_W@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?tolower@?$ctype@_W@std@@QEBA_W_W@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?id@?$collate@_W@std@@2V0locale@2@A
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?pbase@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ
?width@ios_base@std@@QEBA_JXZ
?good@ios_base@std@@QEBA_NXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?flags@ios_base@std@@QEBAHXZ
?uncaught_exception@std@@YA_NXZ
?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ
?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WXZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?width@ios_base@std@@QEAA_J_J@Z
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
?_Xbad_function_call@std@@YAXXZ
?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W0@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__ultow
_o__ultow_s
_o__wcsnicmp
_o__execute_onexit_table
_o__wtoi64
_o_floor
memmove
_o_free
_o_malloc
_o_realloc
_o_toupper
_o_towlower
_o_towupper
_o_wcscpy_s
_o_wcstok
_o_wcstok_s
_o_wcstoul
__C_specific_handler
_CxxThrowException
_o__errno
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
strchr
wcschr
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
__RTtypeid
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
__RTDynamicCast
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
wcsnlen
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
LoadStringW
GetProcAddress
GetModuleHandleW
DisableThreadLibraryCalls
FreeLibrary
GetModuleHandleExW
LoadLibraryExW
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
ResetEvent
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
CreateEventW
ReleaseSemaphore
ReleaseMutex
AcquireSRWLockShared
CreateMutexExW
InitializeSRWLock
LeaveCriticalSection
ReleaseSRWLockShared
InitializeCriticalSectionEx
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
CreateSemaphoreExW
ReleaseSRWLockExclusive
DeleteCriticalSection
WaitForSingleObject
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
SetLastError
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolCleanupGroup
CreateThreadpoolCleanupGroup
CloseThreadpoolWork
CreateThreadpoolWork
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolCleanupGroupMembers
api-ms-win-core-processthreads-l1-1-0
GetCurrentThread
GetCurrentProcess
TerminateProcess
SetThreadToken
OpenProcessToken
OpenThreadToken
TlsFree
TlsAlloc
TlsSetValue
TlsGetValue
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
FormatMessageW
FormatMessageA
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringW
CompareStringOrdinal
MultiByteToWideChar
api-ms-win-core-sysinfo-l1-1-0
GetTickCount64
GetComputerNameExW
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-eventing-provider-l1-1-0
EventActivityIdControl
EventUnregister
EventWriteTransfer
EventSetInformation
EventRegister
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InterlockedPopEntrySList
InitializeSListHead
InterlockedPushEntrySList
ntdll
NtQuerySystemInformation
RtlNtStatusToDosError
RtlIpv4StringToAddressExW
RtlIpv6StringToAddressExW
RtlInitializeGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlInsertElementGenericTableAvl
RtlEnumerateGenericTableWithoutSplayingAvl
RtlEnumerateGenericTableAvl
RtlRemoveVectoredExceptionHandler
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-security-base-l1-1-0
GetLengthSid
IsValidSid
CopySid
GetTokenInformation
DuplicateToken
DuplicateTokenEx
ImpersonateLoggedOnUser
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
api-ms-win-security-lsalookup-l2-1-0
LookupAccountSidW
api-ms-win-security-provider-l1-1-0
GetSecurityInfo
mispace
WspIsRemoteInstance
WspCheckMinimumSubsystemVersion
WspProviderExit
WspPackObjectId
WspUnpackObjectId
WspProviderEnter
WspEnumerateRemoteInstances
WspReferencesOfRemoteInstance
WspGetRemoteInstance
WspGetClassName
WspInvokeRemoteMethod
WspFreeString
WspGetSubsystemFilter
api-ms-win-core-synch-l1-2-0
InitOnceInitialize
Sleep
api-ms-win-core-file-l1-1-0
FileTimeToLocalFileTime
CreateFileW
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-com-l1-1-0
CoInitializeEx
CoCreateInstance
CoCreateInstanceEx
CoUninitialize
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
crypt32
CryptUnprotectMemory
CryptProtectMemory
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
oleaut32
SysAllocString
SysFreeString
clusapi
CreateClusterResourceTypeEx
CreateClusterGroupEx
SetClusterNameEx
ClusterGetMaximumAccessForToken
SetClusterQuorumResourceEx
RemoveResourceFromClusterSharedVolumes
AddResourceToClusterSharedVolumes
ClusterControlEx
GetClusterQuorumResource
GetClusterInformation
AddClusterNode
OpenClusterEx
CloseClusterNotifyPort
ClusterCloseEnumEx
ClusterNodeCloseEnumEx
ClusterResourceTypeCloseEnum
ClusterNetworkCloseEnum
ClusterResourceCloseEnum
ClusterGroupCloseEnum
ClusterGroupCloseEnumEx
ClusterResourceCloseEnumEx
ClusterResourceGetEnumCountEx
ClusterResourceEnumEx
ClusterResourceOpenEnumEx
ClusterGroupGetEnumCountEx
ClusterGroupEnumEx
ClusterGroupOpenEnumEx
ClusterGroupGetEnumCount
ClusterGroupEnum
ClusterGroupOpenEnum
ClusterNetworkGetEnumCount
ClusterNetworkEnum
ClusterNetworkOpenEnum
ClusterResourceGetEnumCount
ClusterResourceEnum
ClusterResourceOpenEnum
ClusterResourceTypeGetEnumCount
ClusterResourceTypeEnum
ClusterResourceTypeOpenEnum
ClusterNodeGetEnumCountEx
ClusterNodeEnumEx
ClusterNodeOpenEnumEx
ClusterGetEnumCountEx
ClusterEnumEx
ClusterOpenEnumEx
CloseCluster
CloseClusterResource
CloseClusterGroup
CloseClusterNode
CloseClusterNetwork
CloseClusterNetInterface
DestroyCluster
GetClusterResourceState
DeleteClusterResourceEx
OfflineClusterResourceEx2
OnlineClusterResourceEx2
ChangeClusterResourceGroupEx2
AddClusterResourceDependencyEx
RemoveClusterResourceDependencyEx
GetClusterResourceDependencyExpression
SetClusterResourceDependencyExpression
RestartClusterResourceEx
FailClusterResourceEx
AddClusterResourceNodeEx
RemoveClusterResourceNodeEx
OpenClusterGroupEx
ClusterGroupControlEx
GetClusterGroupState
DestroyClusterGroupEx
OfflineClusterGroupEx2
OnlineClusterGroupEx2
MoveClusterGroupEx2
CancelClusterGroupOperation
SetClusterGroupNameEx
SetClusterGroupNodeListEx
CreateClusterResource
OpenClusterNodeEx
ClusterNodeControlEx
GetClusterNodeState
PauseClusterNodeEx2
ResumeClusterNodeEx2
EvictClusterNodeEx2
OpenClusterNetworkEx
SetClusterNetworkNameEx
ClusterNetworkControlEx
GetClusterNetworkState
OpenClusterNetInterfaceEx
ClusterNetInterfaceControlEx
GetClusterNetInterfaceState
ClusterResourceTypeControlEx
DeleteClusterResourceTypeEx
GetNodeClusterState
CCHlpGetDNSHostLabel
CreateCluster
CCHlpConfigureNode
CCHlpCreateClusterNameInAD
CreateClusterNotifyPortV2
GetNotifyEventHandle
RegisterClusterResourceTypeNotifyV2
GetClusterNotifyV2
ClusterRegQueryValue
ClusterRegSetValue
GetClusterKey
GetClusterResourceKey
ClusterRegCloseKey
CCHlpGetClusterServiceSecret
CCHlpAddNodeUpdateCluster
ClusterUpgradeFunctionalLevel
OpenClusterResourceEx
SetClusterResourceNameEx
OpenClusterResource
GetClusterFromResource
ClusterEnum
ClusterOpenEnum
ClusterGetEnumCount
OpenClusterNode
GetClusterNodeKey
ClusterCloseEnum
ClusterResourceControlEx
api-ms-win-core-threadpool-legacy-l1-1-0
DeleteTimerQueueEx
DeleteTimerQueueTimer
api-ms-win-core-heap-obsolete-l1-1-0
LocalSize
cryptsp
CryptGenRandom
CryptAcquireContextW
CryptReleaseContext
sscore
SsCoreUninitialize
ws2_32
WSAGetLastError
WSAStringToAddressW
WSAAddressToStringW
htons
resutils
ResUtilGetResourceName
mi
mi_clientFT_V1
MI_Application_InitializeV1
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
GetProviderClassID
MI_Main
PreShutdown
SetShutdownCallback
SmpUnload
Name
.text
Size
564KB
Virtual Size
563KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
696KB
Virtual Size
695KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
104KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
56KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=122, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=14, id=260, version=33145,
count=5, id=259, version=33145,
count=1656, id=1, productName=Unmarked objects,
count=19, id=257, version=33145,
count=27, id=261, version=33145,
count=1, id=256, version=33145,
count=214, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wsp_sr.dll
- IMPHASH a3390d017548819a1855f89e5cdafcbd
- SHA256 95d72dc00cd208bc91eec381d32bc738f0141cf6c63263e6183ac08620459d95
- MD5 6b642c0911bea1cc4688063870499067
- SHA1 f4ab0da83e35d6cc54c0a0a19c79bb21770c76d4
- SHA512 e1e05b3e1e857de97efba0bc4d3060d088b30eed0cae4539f7ba728885b3bed842c2fca5eaedbc85b1a2ca5b1a66979bc6a3ee5cc86cce25b3aba6d96a8737be
- SSDEEP 6144:Uc+VHwuRvuQRGjYcPeY/4Bs5OhXenw7jNOcnkpDkezTyV0pxCenQ68TEgnjAaEOp:JluHrdRob4ztjAaEY5
- TLSH T12F150F42AAE84119F1F6BF7499B706249BB6BC565B31D3CF01E1102E9E76FC0C9B0726
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
2f:05:4f:09:1d:f2:ae:fd:5c:69:e8:73:7c:ef:90:b7:41:ce:9a:a8:6e:f0:a2:c3:55:4d:ff:9c:6e:25:2c:94
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 28, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:19:da:dd:aa:8b:dc:44:b2:92:00:00:00:00:05:19
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 19, 2025 - Jun 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:521A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:17:71:fb:2e:a5:af:01:1d:ea:00:01:00:00:02:17
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
5280
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wsp_sr.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o__wcstoui64
_o_free
_o_malloc
_o_toupper
_o_wcstoul
__C_specific_handler
_o___stdio_common_vswprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
memcpy
_CxxThrowException
wcsstr
__std_terminate
__CxxFrameHandler4
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetComputerNameExW
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleHandleW
LoadLibraryExW
FreeLibrary
DisableThreadLibraryCalls
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
CreateThread
GetCurrentThreadId
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
mispace
WspIsRemoteInstance
WspProviderEnter
WspReferencesOfRemoteInstance
WspUnpackObjectId
WspFreeString
WspPackObjectId
WspGetSubsystemFilter
WspProviderExit
WspEnumerateRemoteInstances
WspInvokeRemoteMethod
WspGetRemoteInstance
msvcp_win
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?_Xbad_function_call@std@@YAXXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z
?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z
?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W0@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?pbase@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?_Xout_of_range@std@@YAXPEBD@Z
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WXZ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?__ExceptionPtrRethrow@@YAXPEBX@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
?__ExceptionPtrToBool@@YA_NPEBX@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ
?uncaught_exception@std@@YA_NXZ
?_Xlength_error@std@@YAXPEBD@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
api-ms-win-core-synch-l1-1-0
SetEvent
EnterCriticalSection
CreateEventW
ReleaseSRWLockShared
AcquireSRWLockShared
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
ResetEvent
WaitForSingleObjectEx
WaitForSingleObject
AcquireSRWLockExclusive
InitializeSRWLock
ReleaseSRWLockExclusive
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-eventing-controller-l1-1-0
ControlTraceW
StopTraceW
StartTraceW
EnableTraceEx2
api-ms-win-eventing-consumer-l1-1-0
OpenTraceW
CloseTrace
ProcessTrace
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-localization-l1-2-0
FormatMessageA
ntdll
RtlInitUnicodeString
RtlFreeUnicodeString
RtlStringFromGUID
RtlGUIDFromString
mi
MI_Application_InitializeV1
mi_clientFT_V1
clusapi
GetNodeClusterState
CreateClusterNotifyPortV2
CloseClusterNotifyPort
GetClusterInformation
OpenCluster
GetClusterNotifyV2
RegisterClusterResourceTypeNotifyV2
CloseCluster
tdh
TdhGetEventMapInformation
TdhGetProperty
TdhGetPropertySize
TdhFormatProperty
TdhGetEventInformation
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
GetProviderClassID
MI_Main
PreShutdown
SetShutdownCallback
SmpUnload
Name
.text
Size
176KB
Virtual Size
174KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
548KB
Virtual Size
544KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
72KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
52KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=41, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=4, id=259, version=33145,
count=21, id=261, version=33145,
count=1203, id=1, productName=Unmarked objects,
count=12, id=257, version=33145,
count=1, id=256, version=33145,
count=76, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wsplib.dll
- IMPHASH 9c0eddcfea3aaf6677639d4dd0bbc89f
- SHA256 a00f037068fec3cc2bd2e6d0acc14fd7d96c6db7a7811073d6ef7c0c50e3988f
- MD5 93aaac9dee174739fcbb9929c132bfbd
- SHA1 fad77b3eb99ac1d81ca1b763ae9e99a4bc1368ce
- SHA512 f9c52a76e360b83e127fed346336da43efa04cd94c991c585f074f95cd4e073d608f51e083e442452b2df4ab0a7367cb65f1c60b22aff61fa9e908fbd237079b
- SSDEEP 768:e59nzpvNS6YcjlHMTciruMrJYLT3NqR5xT0Gd5OfyAT5njvJuk4q:eDJfBicukP3U9T0I5OfyATFjvJukD
- TLSH T19463E70ABBA81664F1B7473CE8A32E05C53EF8559722C7DB12A0425D1E13FDA4978F72
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5056
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wsplib.pdb
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-string-l1-1-0
memset
strncmp
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o___std_exception_copy
_o___std_exception_destroy
_o___std_type_info_destroy_list
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__itoa_s
_o__seh_filter_dll
memcpy
_o__stricmp
_o__strnicmp
_o__wcsicmp
_o_atoi
_o_free
_o_malloc
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
wcschr
strrchr
strchr
strstr
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapReAlloc
GetProcessHeap
HeapFree
api-ms-win-core-registry-l1-1-0
RegGetValueW
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
DecodeWspHeaders
FreeWspHeaders
Name
.text
Size
24KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
716B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=35, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1105, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=4, id=259, version=33145,
count=21, id=261, version=33145,
count=1, id=256, version=33145,
count=15, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wtdccm.dll
- IMPHASH f410b292c4099e91703919940588316e
- SHA256 ae3eb25f01be452d800869de7d6dc7025851d04268067a90918c8135769399c6
- MD5 f05d9a07e4df87760468081d478ea682
- SHA1 322de765bd61979cefa6a66847d1ae7b47b8c2f3
- SHA512 8ec11621f8f14e488b24cf23aafa1eda18c237b744446d5e036dd89db7b41f8a6c1b0856c50ffa350c118bf9b2ed610dd121b80eb89e8882af426c081732ef55
- SSDEEP 1536:eTR+xCowFJhX9pKh+wLaBiGKRNhmDX9c3g44ZxHzP4Jzp:eTswDHpKwwL9x29XPZxHzAJ9
- TLSH T1CC735CADB6A820C6E47AD07CC5A28A16E9B1B071631157FF03D0C1792F13BD8A53DB99
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
19:cc:ce:97:4b:c2:5f:aa:78:0b:6e:71:32:eb:21:2c:e5:27:6f:6b:44:4a:51:72:a5:11:e3:38:10:8e:f9:4e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 21, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:19:da:dd:aa:8b:dc:44:b2:92:00:00:00:00:05:19
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 19, 2025 - Jun 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:591A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:14:8d:cd:23:44:ee:06:df:72:00:01:00:00:02:14
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
6976
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wtdccm.pdb
msvcp_win
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_unlock
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_lock
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__register_onexit_function
_o__seh_filter_dll
memcpy
_o_free
_o___stdio_common_vswprintf
__std_terminate
__C_specific_handler
__CxxFrameHandler4
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_CxxThrowException
memcmp
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleHandleW
GetProcAddress
GetModuleHandleExA
GetModuleFileNameA
rpcrt4
RpcBindingBind
RpcBindingFree
RpcBindingCreateW
RpcAsyncInitializeHandle
RpcAsyncCompleteCall
Ndr64AsyncClientCall
RpcExceptionFilter
ntdll
RtlSubscribeWnfStateChangeNotification
RtlFreeUnicodeString
RtlUnsubscribeWnfStateChangeNotification
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion
NtQueryInformationThread
RtlCreateUnicodeString
api-ms-win-core-synch-l1-1-0
OpenSemaphoreW
WaitForSingleObjectEx
CreateMutexExW
CreateEventW
ReleaseMutex
AcquireSRWLockShared
WaitForSingleObject
AcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSemaphore
CreateSemaphoreExW
InitializeSRWLock
TryAcquireSRWLockExclusive
ReleaseSRWLockExclusive
api-ms-win-core-heap-l1-1-0
HeapFree
HeapSize
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-heap-obsolete-l1-1-0
GlobalSize
GlobalUnlock
GlobalLock
api-ms-win-core-realtime-l1-1-1
QueryUnbiasedInterruptTimePrecise
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventUnregister
EventWriteTransfer
EventRegister
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
ext-ms-win-ntuser-window-l1-1-0
GetWindowThreadProcessId
GetForegroundWindow
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
WtdProcessString
Name
.text
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
220B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=48, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=18, id=261, version=33145,
count=1153, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=1, id=256, version=33145,
count=4, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=258, version=33145,
wtdhost.dll
- IMPHASH 52874d71d5995032301ae8d6f0d5a309
- SHA256 d3f3c891d5309e034088d494d074e94958b23d3c212218971b46016f0e1f1fdd
- MD5 d8f3376f7d948c19e7d7c742e0b617ae
- SHA1 f990c3a5e09874a689428fc1640499f4135bb39f
- SHA512 05a882f1ef04e878ff73c40a3739d74bd306eb525d3f52b81244888d1e3be7caa71aebb17113bc192a6c179f6f8f731b276fc2d92d296ed2b590ded7a228a043
- SSDEEP 768:QhdbLJRaqXQSZFPBYIKAbK7ZEJR94d1PufK9zP:QzRAGDZvYIKAbK7+JR94LPFzP
- TLSH T1E4337D9D6B38148ADD7A853484A6DB4A7C71B2A21B2106FF43D0E06D0D133E5F638B9D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ea:e2:86:d4:08:9d:69:0a:60:b7:9a:90:f8:5b:c9:3b:1b:12:de:93:13:75:1e:2f:d7:5e:af:61:1f:66:38:d2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 28, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:7F00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:f0:2a:7c:1d:59:3b:e6:1f:ad:00:01:00:00:01:f0
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
5392
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wtdhost.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
__C_specific_handler
_o___std_type_info_destroy_list
api-ms-win-crt-string-l1-1-0
memset
ntdll
RtlLookupFunctionEntry
RtlAllocateHeap
NtQueryInformationProcess
RtlFreeHeap
RtlNtStatusToDosError
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventRegister
EventWriteTransfer
EventSetInformation
api-ms-win-core-synch-l1-1-0
CreateEventW
SetEvent
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
WaitForSingleObject
EnterCriticalSection
ResetEvent
api-ms-win-core-synch-l1-2-0
WakeConditionVariable
InitializeConditionVariable
SleepConditionVariableCS
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
DisableThreadLibraryCalls
GetModuleHandleExA
api-ms-win-core-io-l1-1-0
DeviceIoControl
GetOverlappedResult
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-file-l1-1-0
CreateFileW
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
api-ms-win-core-realtime-l1-1-1
QueryUnbiasedInterruptTimePrecise
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
WtdhAllocateEvent
WtdhDisableSensors
WtdhEnableSensors
WtdhFreeEventIoPacket
WtdhGetProcessId
WtdhRegister
WtdhUnregister
WtdhWaitForSensorEvent
Name
.text
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
648B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33138,
count=39, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1113, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33138,
count=4, id=259, version=33138,
count=12, id=261, version=33138,
count=1, id=256, version=33138,
count=6, id=264, version=33138,
count=1, id=253, version=33138,
count=1, id=255, version=33138,
count=1, id=258, version=33138,
wtdsensor.dll
- IMPHASH ef3d325789d09b1db970ea6ae8664a51
- SHA256 37fe61ee2153fb4de3f587cbea7dd4b5c91df9f3eb3557fbdd7de40796cb38ff
- MD5 9fc5691edc9b8b9d2f192aea0dbce6ee
- SHA1 a9a5c6318a66c359bbad926c8c6f99e176c2c2e6
- SHA512 c1c2ad49f28b5d903732e60e3f3968d45c82da7a075065d3cb06767c48875cfff7137dc3d5e037913ac9d0f7d1090ef98a09372eb8e21cad04cfb64d6169b281
- SSDEEP 768:G7IZNElVBZql0ImfQ4SB5Z9C01PokXC4dC9zZjB00:GE7SvwUfZSB5Z9CEPhC4dezJB00
- TLSH T1A4338EA55B681093FD7A9138D1E2CE1B7D34B2A2171145FF06E1906C0C27BD1EA3CF99
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
f7:0c:ed:53:9c:01:4e:a8:57:dc:b0:29:0d:8e:67:6a:52:f5:c4:c1:f6:b3:3b:e9:a7:94:5f:7e:d1:ac:d3:cc
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 3, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A400-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:ec:e0:2b:a4:82:d0:91:52:80:00:01:00:00:01:ec
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
5392
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wtdsensor.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
__C_specific_handler
_o___std_type_info_destroy_list
api-ms-win-crt-string-l1-1-0
memset
ntdll
RtlLookupFunctionEntry
RtlVirtualUnwind
NtQueryInformationProcess
RtlNtStatusToDosError
RtlCaptureContext
RtlFreeHeap
RtlAllocateHeap
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventSetInformation
EventUnregister
EventWriteTransfer
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
DeleteCriticalSection
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleHandleExA
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-2-0
WakeConditionVariable
SleepConditionVariableCS
InitializeConditionVariable
api-ms-win-core-io-l1-1-0
DeviceIoControl
CancelIoEx
api-ms-win-core-file-l1-1-0
CreateFileW
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
WtdsAllocateEvent
WtdsFreeEvent
WtdsGetEventData
WtdsGetProcessId
WtdsRegisterSensor
WtdsSendEvent
WtdsUnregisterSensor
Name
.text
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
612B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33138,
count=35, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1107, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33138,
count=4, id=259, version=33138,
count=12, id=261, version=33138,
count=1, id=256, version=33138,
count=6, id=264, version=33138,
count=1, id=253, version=33138,
count=1, id=255, version=33138,
count=1, id=258, version=33138,
wtsapi32.dll
- IMPHASH 04bb14cc61f2801fe254c954c25a4746
- SHA256 879e94c533004386f1f4441a2c108705d6fa1011418598b7c0e3719114d5404c
- MD5 5df6b51e8361337ab7ba350ea3a32879
- SHA1 8868f6ad8029e20187b7b51d46e607a264e5e1c5
- SHA512 384608ddb604d453507f00ddc396ad330d4a1c221c9555fccce5d905a408ceb3436a2a68b3231a5f73945cad4caaf4b8a945e19f090795d2818354ce33d2872e
- SSDEEP 3072:WtmCnB7ttpfAU2VQUACx/TPM78Um8tYNpOjkiQcThRjNq9uoQ+0f:WtmCnB7tPfv2VQUAcT0VshdcThRnoQP
- TLSH T1E404387D76A900AAD57A9138C592860AFBB3702123111BDF02D0C27D9F17BE87E3DB56
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
f1:71:6a:b7:c8:a2:82:ec:65:aa:3a:90:c9:f3:57:e1:81:51:18:81:f9:6d:3c:49:65:21:e1:2e:e0:a5:3c:de
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:521A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:17:71:fb:2e:a5:af:01:1d:ea:00:01:00:00:02:17
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
26112
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wtsapi32.pdb
msvcrt
_onexit
__CxxFrameHandler3
__C_specific_handler
_initterm
__dllonexit
_unlock
wcsncmp
memcpy
_callnewh
__RTDynamicCast
??1type_info@@UEAA@XZ
memcmp
malloc
_amsg_exit
_XcptFilter
free
memmove_s
memcpy_s
_purecall
_vsnwprintf
_wcsupr
swscanf
_lock
memset
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
OpenProcessToken
GetCurrentThread
GetCurrentProcess
OpenThreadToken
TerminateProcess
GetCurrentProcessId
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventActivityIdControl
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
LocalReAlloc
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetModuleFileNameA
GetProcAddress
GetModuleHandleW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-file-l1-1-0
ReadFile
WriteFile
api-ms-win-core-io-l1-1-1
CancelIo
api-ms-win-core-synch-l1-1-0
CreateSemaphoreExW
ReleaseMutex
ReleaseSRWLockExclusive
EnterCriticalSection
AcquireSRWLockShared
ReleaseSemaphore
WaitForSingleObject
InitializeCriticalSectionEx
DeleteCriticalSection
CreateMutexExW
LeaveCriticalSection
ReleaseSRWLockShared
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
api-ms-win-core-io-l1-1-0
GetOverlappedResult
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-synch-l1-2-0
Sleep
WakeAllConditionVariable
SleepConditionVariableSRW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-heap-obsolete-l1-1-0
LocalSize
ntdll
RtlNtStatusToDosError
RtlMultiByteToUnicodeN
RtlUnicodeToMultiByteSize
RtlUnicodeToMultiByteN
RtlAdjustPrivilege
NtDeviceIoControlFile
NtWaitForSingleObject
kernel32
RaiseException
MultiByteToWideChar
sspicli
LsaGetLogonSessionData
LsaConnectUntrusted
LsaCallAuthenticationPackage
LsaDeregisterLogonProcess
LsaLookupAuthenticationPackage
LsaFreeReturnBuffer
LsaLogonUser
api-ms-win-core-com-l1-1-0
StringFromGUID2
api-ms-win-core-winrt-l1-1-0
RoInitialize
RoActivateInstance
RoUninitialize
RoGetActivationFactory
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsCreateStringReference
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
crypt32
CryptStringToBinaryW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
IsInteractiveUserSession
QueryActiveSession
QueryUserToken
RegisterUsertokenForNoWinlogon
WTSActiveSessionExists
WTSCloseServer
WTSCloudAuthClose
WTSCloudAuthConvertAssertionToSerializedUserCredential
WTSCloudAuthDuplicateSerializedUserCredential
WTSCloudAuthGetServerNonce
WTSCloudAuthNetworkLogonWithSerializedCredential
WTSCloudAuthOpen
WTSConnectSessionA
WTSConnectSessionW
WTSCreateListenerA
WTSCreateListenerW
WTSDisconnectSession
WTSEnableChildSessions
WTSEnumerateListenersA
WTSEnumerateListenersW
WTSEnumerateProcessesA
WTSEnumerateProcessesExA
WTSEnumerateProcessesExW
WTSEnumerateProcessesW
WTSEnumerateServersA
WTSEnumerateServersW
WTSEnumerateSessionsA
WTSEnumerateSessionsExA
WTSEnumerateSessionsExW
WTSEnumerateSessionsW
WTSFreeMemory
WTSFreeMemoryExA
WTSFreeMemoryExW
WTSGetChildSessionId
WTSGetListenerSecurityA
WTSGetListenerSecurityW
WTSIsChildSessionsEnabled
WTSLogoffSession
WTSOpenServerA
WTSOpenServerExA
WTSOpenServerExW
WTSOpenServerW
WTSQueryListenerConfigA
WTSQueryListenerConfigW
WTSQuerySessionInformationA
WTSQuerySessionInformationW
WTSQueryUserConfigA
WTSQueryUserConfigW
WTSQueryUserToken
WTSRegisterSessionNotification
WTSRegisterSessionNotificationEx
WTSSendMessageA
WTSSendMessageW
WTSSetListenerSecurityA
WTSSetListenerSecurityW
WTSSetRenderHint
WTSSetSessionInformationA
WTSSetSessionInformationW
WTSSetUserConfigA
WTSSetUserConfigW
WTSShutdownSystem
WTSStartRemoteControlSessionA
WTSStartRemoteControlSessionW
WTSStopRemoteControlSession
WTSTerminateProcess
WTSUnRegisterSessionNotification
WTSUnRegisterSessionNotificationEx
WTSVirtualChannelClose
WTSVirtualChannelOpen
WTSVirtualChannelOpenEx
WTSVirtualChannelPurgeInput
WTSVirtualChannelPurgeOutput
WTSVirtualChannelQuery
WTSVirtualChannelRead
WTSVirtualChannelWrite
WTSWaitSystemEvent
Name
.text
Size
100KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
592B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
608B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=68, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=17, id=260, version=33145,
count=244, id=1, productName=Unmarked objects,
count=7, id=257, version=33145,
count=7, id=261, version=33145,
count=1, id=256, version=33145,
count=19, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wuapi.dll
- IMPHASH 61678bc08e9d899092c0cee0298f60f9
- SHA256 f9cad41620c2086bed04d9b045172dfd33c1f143be7785b4bbb2ecbd4f471279
- MD5 a8de9280b5ba386a289e6308fe97db91
- SHA1 3f5a14ee23c4646379de3ba8e02c10a7ac33ecf9
- SHA512 d5e81b9ccc7ff3bbb2bfd746b0b7e2c06c9d527839fa10a42ad6f30ca7e1a1b1be0b6a6fecb073f9aa5211f320414493f67ab13109f26d179ab8d106efeba000
- SSDEEP 3072:HepK88wLWnBTWuNosGYnTQrBV6r/NNNHO3KF0GMh0fDG2n3FSsafULuWG9PYMrIg:+A87LWEuNNDTQPeFSNULhGZI3PtS
- TLSH T185344A96B78592B7D02E013EC84743A66B71B0151F13A7CB03A4426D5F73BE4BE3A3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
0f:08:40:cb:aa:33:9e:ad:03:bb:a5:31:cd:b9:9d:e0:ee:3c:98:e6:1b:8a:32:57:46:7b:a2:14:f3:0d:f0:d2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A935-03E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:27:d5:c0:83:c3:b1:2e:57:2d:00:01:00:00:02:27
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
66912
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wuapi.pdb
api-ms-win-core-libraryloader-l1-2-0
LoadResource
LoadLibraryExW
GetModuleHandleW
GetProcAddress
DisableThreadLibraryCalls
GetModuleHandleExW
GetModuleFileNameW
FreeLibrary
GetModuleFileNameA
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionAndSpinCount
CreateEventW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
CreateMutexExW
OpenSemaphoreW
CreateSemaphoreExW
ReleaseSemaphore
WaitForSingleObject
ReleaseMutex
EnterCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
LeaveCriticalSection
WaitForSingleObjectEx
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
FormatMessageW
FormatMessageA
GetLocaleInfoEx
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoTaskMemFree
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-file-l1-1-0
FindFirstFileW
CreateFileW
GetFileAttributesExW
FindClose
GetFileSizeEx
api-ms-win-core-wow64-l1-1-1
IsWow64Process2
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventUnregister
EventWriteTransfer
EventRegister
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-crt-runtime-l1-1-0
_invoke_watson
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__free_base
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o_abort
_o_free
_o_malloc
_o_mbstowcs_s
_o_terminate
_o_wcscpy_s
_o___stdio_common_vswprintf
_o__execute_onexit_table
_o__errno
_o___std_exception_destroy
_o___std_exception_copy
_o____lc_codepage_func
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__calloc_base
_o__callnewh
api-ms-win-core-featurestaging-l1-1-0
SubscribeFeatureStateChangeNotification
RecordFeatureUsage
UnsubscribeFeatureStateChangeNotification
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemDirectoryW
api-ms-win-core-sysinfo-l1-2-0
GetNativeSystemInfo
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlPcToFileHeader
RtlUnwindEx
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InterlockedFlushSList
InitializeSListHead
api-ms-win-core-fibers-l1-1-0
FlsSetValue
FlsFree
FlsGetValue
FlsAlloc
api-ms-win-core-util-l1-1-0
EncodePointer
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-core-memory-l1-1-0
UnmapViewOfFile
CreateFileMappingW
MapViewOfFileEx
api-ms-win-core-version-l1-1-0
GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeExW
api-ms-win-core-libraryloader-l1-2-1
FindResourceW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
89KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
84KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=260, version=35222,
count=9, id=259, version=35222,
count=39, id=261, version=35222,
count=1, id=253, version=35222,
count=109, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1263, id=1, productName=Unmarked objects,
count=37, id=265, version=35222,
count=1, id=256, version=35222,
count=1, id=255, version=35222,
count=1, id=258, version=35222,
wuaueng.dll
- IMPHASH 0f26cbe7dde36e00f9bffe800b9149c1
- SHA256 d331429c997c142d4f08dbd1bd325fc35a15d99452c8ddd0a708c442a820b662
- MD5 3c4af65ee68f3fe2049746de7e9f5b3d
- SHA1 d339425cd42fec3c2faf44a5442526914cd0a021
- SHA512 02510d33dc3df3ed81e6c77c3138c401fbdfd71c6cde2a3bbd903dcf9f5829e1817fadef7e15c389c68a158c2f4e86dec7224587b663dfe985cb2f1537712c34
- SSDEEP 3072:QJpK5aeL1rRxKxyfZ+Bre9Rd2K0ajwnuZ9ys/h2RIaHPlCg67:QA5aeLdHOAZYRM2R5Pa
- TLSH T153044A137BEC106AF1FB9279A9B70605BB7278265B01C7DF2160429D4E63FD4AE35322
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
6f:c0:b5:bc:aa:ce:79:e9:16:7a:70:a2:4f:86:c9:91:54:0d:ea:b3:9a:e7:82:d1:00:15:a7:9d:45:5f:eb:65
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9600-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:26:35:b4:3e:67:43:93:f6:1f:00:01:00:00:02:26
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
66848
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wuaueng.pdb
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleHandleExW
GetModuleFileNameA
GetModuleHandleW
FreeLibrary
DisableThreadLibraryCalls
LoadResource
LoadLibraryExW
GetModuleFileNameW
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionAndSpinCount
ReleaseMutex
WaitForSingleObject
ReleaseSemaphore
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
ReleaseSRWLockShared
CreateEventW
AcquireSRWLockShared
CreateSemaphoreExW
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
EnterCriticalSection
DeleteCriticalSection
LeaveCriticalSection
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
SetLastError
UnhandledExceptionFilter
RaiseException
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
FormatMessageW
FormatMessageA
GetLocaleInfoEx
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventWriteTransfer
EventUnregister
EventSetInformation
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoTaskMemFree
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-file-l1-1-0
CreateFileW
GetFileAttributesExW
GetFileSizeEx
FindClose
FindFirstFileW
api-ms-win-core-wow64-l1-1-1
IsWow64Process2
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-crt-runtime-l1-1-0
_initterm
_invoke_watson
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__free_base
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o_abort
_o_free
_o_malloc
_o_mbstowcs_s
_o_terminate
_o_wcscpy_s
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__calloc_base
_o__callnewh
_o___stdio_common_vswprintf
_o____lc_codepage_func
_o___std_exception_destroy
_o___std_exception_copy
api-ms-win-core-featurestaging-l1-1-0
RecordFeatureUsage
SubscribeFeatureStateChangeNotification
UnsubscribeFeatureStateChangeNotification
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemDirectoryW
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
api-ms-win-core-sysinfo-l1-2-0
GetNativeSystemInfo
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlPcToFileHeader
RtlUnwindEx
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedFlushSList
api-ms-win-core-fibers-l1-1-0
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
api-ms-win-core-util-l1-1-0
EncodePointer
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-core-memory-l1-1-0
MapViewOfFileEx
CreateFileMappingW
UnmapViewOfFile
api-ms-win-core-version-l1-1-0
VerQueryValueW
GetFileVersionInfoSizeExW
GetFileVersionInfoExW
api-ms-win-core-libraryloader-l1-2-1
FindResourceW
DllMain
GeneralizeForImaging
WUServiceMain
Name
.text
Size
89KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
504B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=260, version=35222,
count=9, id=259, version=35222,
count=39, id=261, version=35222,
count=1, id=253, version=35222,
count=109, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1263, id=1, productName=Unmarked objects,
count=37, id=265, version=35222,
count=1, id=256, version=35222,
count=1, id=255, version=35222,
count=1, id=258, version=35222,
wuceffects.dll
- IMPHASH 0397d28b06a093e81398f9a22892cfb2
- SHA256 162636a31d72565df07ec9add3880f3557070c84f5aea98edcc3caabfb60a1fd
- MD5 01e19ec961b5aa9ef5ad68cbd7d4c2c2
- SHA1 0eebe6245f25295bdee7d68bcd1812c19bbe0810
- SHA512 18dcd3cf8c4c3f7ac5a832fc345f7f085e3d95ec3204d123236863c21f1c1aa7accc079d2acfa67b4a44c930a3e5b904b39b5f2747f83e8fd76cdcedfda03869
- SSDEEP 6144:WbpAG3s6wImInIc0IEmA25XH0Bvww5TLFfYZ:Wppwb6IckmA25opF1m
- TLSH T12A645D4F66990D93E937D03DCE43860BE3717862432192CB667C025B5F27BD8AD39BA1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
94112
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wuceffects.pdb
msvcp_win
?_Xbad_function_call@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__create_locale
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__itoa_s
_o__ltoa_s
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o__wcsicmp_l
_o_abort
_o_ceilf
_o_cos
_o_cosf
_o_iswspace
_o_powf
_o_sinf
_o_sqrtf
_o_terminate
__current_exception
__current_exception_context
__C_specific_handler
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o__configure_narrow_argv
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__cexit
__std_terminate
__CxxFrameHandler4
_CxxThrowException
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
strcmp
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetModuleHandleW
FreeLibrary
LoadResource
LockResource
SizeofResource
GetProcAddress
GetModuleHandleExW
LoadLibraryExW
api-ms-win-core-synch-l1-1-0
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockShared
CreateMutexExW
AcquireSRWLockShared
DeleteCriticalSection
ReleaseMutex
CreateEventW
WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection
ResetEvent
ReleaseSemaphore
EnterCriticalSection
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
CreateSemaphoreExW
SetEvent
ReleaseSRWLockExclusive
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
RaiseException
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
RoOriginateError
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsSubstringWithSpecifiedLength
WindowsGetStringRawBuffer
WindowsDuplicateString
WindowsDeleteString
WindowsCreateStringReference
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoTaskMemFree
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
RtlCaptureStackBackTrace
api-ms-win-core-errorhandling-l1-1-3
TerminateProcessOnMemoryExhaustion
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-kernel32-legacy-l1-1-0
FindResourceA
ntdll
NtQuerySystemInformation
api-ms-win-core-interlocked-l1-1-0
InterlockedPushEntrySList
InitializeSListHead
oleaut32
SysStringLen
SetErrorInfo
SysFreeString
GetErrorInfo
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
CompileEffectDescription
CreateAcrylicBrush
CreateCrossfadeEffectFactory
CreateCustomBrush
CreateEffectDescription
CreateMicaBrush
CrossFadeToNewBrush
DeserializeEffectDescription
SerializeEffectDescription
Name
.text
Size
192KB
Virtual Size
191KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
64KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
40KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=58, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=1180, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=25, id=261, version=33145,
count=1, id=256, version=33145,
count=65, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wudriver.dll
- IMPHASH eebc576754bd45cf3c037105830939a5
- SHA256 1d0215debf32f190046fb1d47fa884085ab36b47ab49a65841bc304a4813e5ef
- MD5 6668939fa11d309101be66d71c1ba248
- SHA1 f3e0e820886691c386938ee800086f1708852592
- SHA512 0b1d33fcdb1f4a2b67ada8f19b2d6cafb7f750cec99bca28a02902dc7283384b7bb8cb589ab83701aa2ce0c30f3586f13e8258afd84ae649c41672996fb7ebc0
- SSDEEP 1536:JP7355WuDn6GePVahSK6apM+Ap6dGlLPTwWZYj+Wf7nKz/3NNFjgtxn2v2j1PDTf:JP733n6igBq1AkKLP8sy7Kr+ns2hPDL
- TLSH T1EAD3D61F21F824A4EE66E27848961A19E6717423131257FF92D0C07A0F7BEECAD39F51
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
8464
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wudriver.pdb
api-ms-win-crt-string-l1-1-0
memset
wcsncmp
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__cexit
_o_free
_o_malloc
_o_qsort
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
_o__callnewh
_o__crt_atexit
_o__configure_narrow_argv
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
_CxxThrowException
memcmp
memcpy
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
GetModuleHandleW
GetProcAddress
GetModuleHandleExW
GetModuleFileNameA
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
CreateSemaphoreExW
CreateEventW
SetEvent
ReleaseSemaphore
ResetEvent
InitializeCriticalSectionEx
ReleaseSRWLockShared
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
WaitForSingleObject
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseMutex
ReleaseSRWLockExclusive
LeaveCriticalSection
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventRegister
EventWriteTransfer
EventUnregister
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringW
oleaut32
SysStringLen
SysFreeString
VariantTimeToSystemTime
VariantInit
SysAllocString
api-ms-win-core-sysinfo-l1-2-0
GetNativeSystemInfo
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegOpenCurrentUser
RegQueryValueExW
RegOpenKeyExW
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-com-l1-1-0
CoCreateGuid
CoUninitialize
CoInitializeEx
CoCreateInstance
StringFromGUID2
api-ms-win-core-file-l1-1-0
FindClose
GetFileAttributesW
FindFirstFileW
SetFileAttributesW
WriteFile
DeleteFileW
RemoveDirectoryW
FindNextFileW
GetFullPathNameW
SetFileInformationByHandle
CreateFileW
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
api-ms-win-core-path-l1-1-0
PathAllocCombine
PathCchAppend
api-ms-win-core-file-l1-2-3
GetTempPath2W
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
user32
MsgWaitForMultipleObjects
PeekMessageW
TranslateMessage
DispatchMessageW
shlwapi
PathIsUNCW
PathIsRelativeW
PathStripToRootW
StrRChrW
StrChrW
PathIsRootW
shell32
SHCreateDirectoryExW
CancelCDMOperation
CloseCDMContext
DetFilesDownloaded
DownloadIsInternetAvailable
DownloadUpdatedFiles
FindMatchingDriver
LogDriverNotFound
OpenCDMContext
OpenCDMContextEx
QueryDetectionFiles
Name
.text
Size
80KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
292B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=257, version=33145,
count=59, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1177, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=24, id=261, version=33145,
count=1, id=256, version=33145,
count=5, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wups.dll
- IMPHASH 0dadab02b97ecb4c88b80d519753618a
- SHA256 d59201c8a27006091db357c9d51c98d245255157596a0d1f8eaf75e05fa47a06
- MD5 8c384612b6308cd90f941e309cf02cef
- SHA1 c6647adc24e3eecb42dc0754f19ab57eb021aac4
- SHA512 78180b43c4f992524e8ccb179a8714fbaff537c1ea0d3ee40801e0a8703314e70caff1793c2ac02d46d6b0f85dccd793ebff9e0275ce8aa06beeda65cf736fa3
- SSDEEP 3072:W1pKgfFQR8dPZlEmg7Y164BGGNtttyO3KsW08GOMNcI1MBGhSsa+hEP/Ux:yAgdQoZimWKxhSchE4
- TLSH T12FE36C2677A920B6D17E913DCA930B09FBB2B40617518BCF4260825D1F97BE8BD3D316
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
8b:4e:56:1e:c2:fb:1d:ca:f7:bc:da:14:bc:44:b5:64:56:2e:41:9e:8e:ce:46:7f:f7:ab:c9:f9:e7:c5:6e:ea
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:651A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:15:18:03:d3:81:07:26:7c:53:00:01:00:00:02:15
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
67072
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wups.pdb
api-ms-win-core-libraryloader-l1-2-0
LoadResource
FreeLibrary
GetModuleHandleW
GetProcAddress
GetModuleFileNameW
DisableThreadLibraryCalls
GetModuleHandleExW
LoadLibraryExW
GetModuleFileNameA
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionEx
DeleteCriticalSection
OpenSemaphoreW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObjectEx
ReleaseMutex
CreateSemaphoreExW
ReleaseSemaphore
AcquireSRWLockShared
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
WaitForSingleObject
CreateEventW
CreateMutexExW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
RaiseException
GetLastError
UnhandledExceptionFilter
SetLastError
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
FormatMessageA
GetLocaleInfoEx
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoTaskMemFree
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-file-l1-1-0
FindFirstFileW
GetFileSizeEx
CreateFileW
FindClose
GetFileAttributesExW
api-ms-win-core-wow64-l1-1-1
IsWow64Process2
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventUnregister
EventWriteTransfer
EventRegister
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-crt-runtime-l1-1-0
_invoke_watson
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__free_base
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o_abort
_o_free
_o_malloc
_o_mbstowcs_s
_o_terminate
_o_wcscpy_s
_o__execute_onexit_table
_o___stdio_common_vswprintf
_o__errno
_o___std_exception_destroy
_o___std_exception_copy
_o__crt_atexit
_o__configure_narrow_argv
_o____lc_codepage_func
_o__cexit
_o__calloc_base
_o__callnewh
api-ms-win-core-featurestaging-l1-1-0
RecordFeatureUsage
SubscribeFeatureStateChangeNotification
UnsubscribeFeatureStateChangeNotification
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemDirectoryW
api-ms-win-core-sysinfo-l1-2-0
GetNativeSystemInfo
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
api-ms-win-core-rtlsupport-l1-1-0
RtlUnwindEx
RtlPcToFileHeader
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedFlushSList
api-ms-win-core-fibers-l1-1-0
FlsFree
FlsSetValue
FlsAlloc
FlsGetValue
api-ms-win-core-util-l1-1-0
EncodePointer
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-core-memory-l1-1-0
UnmapViewOfFile
MapViewOfFileEx
CreateFileMappingW
api-ms-win-core-version-l1-1-0
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW
api-ms-win-core-libraryloader-l1-2-1
FindResourceW
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
Name
.text
Size
89KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
992B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=260, version=35222,
count=9, id=259, version=35222,
count=39, id=261, version=35222,
count=1, id=253, version=35222,
count=109, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1263, id=1, productName=Unmarked objects,
count=37, id=265, version=35222,
count=1, id=256, version=35222,
count=1, id=255, version=35222,
count=1, id=258, version=35222,
wups2.dll
- IMPHASH 0dadab02b97ecb4c88b80d519753618a
- SHA256 69a924f8a02a822c111d9b45551ba8248e662dd9ef428544b4fe760e1af96388
- MD5 c153a415c4b490a358d31cc5c7810fa3
- SHA1 805aaf9f7009251094090cfc7835bbffd3d05244
- SHA512 786811fd5616907c1ee11cc4161ab0120cf51c6464b2318ad8531ceefb94c35e9e42671e5cfc0969ea35fbc4c012faa7feb6b1055dff002ac2038b712c977d75
- SSDEEP 3072:r1pKgfFQR8dPZlEmg7Y164BGGNtttyO3KUW08GOMzoI1MIGhSsa+hEZVPW:RAgdQoZimWKuhSchE6
- TLSH T197E36C2677A920BAD17E913DC9930B09FBB2B40617518BCF4260825D1F97BE8BD3D316
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c5:1a:f5:77:c4:ed:63:1e:d8:15:6b:56:3b:23:e5:d2:9a:b8:49:f2:8f:b9:ec:71:21:a5:ef:4b:5c:0b:15:12
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:401A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:19:5e:b2:d8:54:75:f4:b1:8d:00:01:00:00:02:19
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
67072
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wups2.pdb
api-ms-win-core-libraryloader-l1-2-0
LoadResource
FreeLibrary
GetModuleHandleW
GetProcAddress
GetModuleFileNameW
DisableThreadLibraryCalls
GetModuleHandleExW
LoadLibraryExW
GetModuleFileNameA
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionEx
DeleteCriticalSection
OpenSemaphoreW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObjectEx
ReleaseMutex
CreateSemaphoreExW
ReleaseSemaphore
AcquireSRWLockShared
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
WaitForSingleObject
CreateEventW
CreateMutexExW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
RaiseException
GetLastError
UnhandledExceptionFilter
SetLastError
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
FormatMessageA
GetLocaleInfoEx
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoTaskMemFree
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-file-l1-1-0
FindFirstFileW
GetFileSizeEx
CreateFileW
FindClose
GetFileAttributesExW
api-ms-win-core-wow64-l1-1-1
IsWow64Process2
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventUnregister
EventWriteTransfer
EventRegister
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-crt-runtime-l1-1-0
_invoke_watson
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__free_base
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o_abort
_o_free
_o_malloc
_o_mbstowcs_s
_o_terminate
_o_wcscpy_s
_o__execute_onexit_table
_o___stdio_common_vswprintf
_o__errno
_o___std_exception_destroy
_o___std_exception_copy
_o__crt_atexit
_o__configure_narrow_argv
_o____lc_codepage_func
_o__cexit
_o__calloc_base
_o__callnewh
api-ms-win-core-featurestaging-l1-1-0
RecordFeatureUsage
SubscribeFeatureStateChangeNotification
UnsubscribeFeatureStateChangeNotification
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemDirectoryW
api-ms-win-core-sysinfo-l1-2-0
GetNativeSystemInfo
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
api-ms-win-core-rtlsupport-l1-1-0
RtlUnwindEx
RtlPcToFileHeader
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedFlushSList
api-ms-win-core-fibers-l1-1-0
FlsFree
FlsSetValue
FlsAlloc
FlsGetValue
api-ms-win-core-util-l1-1-0
EncodePointer
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-core-memory-l1-1-0
UnmapViewOfFile
MapViewOfFileEx
CreateFileMappingW
api-ms-win-core-version-l1-1-0
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW
api-ms-win-core-libraryloader-l1-2-1
FindResourceW
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
Name
.text
Size
89KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
992B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=260, version=35222,
count=9, id=259, version=35222,
count=39, id=261, version=35222,
count=1, id=253, version=35222,
count=109, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1263, id=1, productName=Unmarked objects,
count=37, id=265, version=35222,
count=1, id=256, version=35222,
count=1, id=255, version=35222,
count=1, id=258, version=35222,
wusys.dll
- IMPHASH 5a5bb9f45b5f754816d12fd40dbf7869
- SHA256 c012dff6d363407b6d1d17cb242d336d784f2bed63eb50e19da1e1fb50a45a4a
- MD5 a2e0427414174d9c2102b8da3f3a6868
- SHA1 bb59333586d67304af9ad6a4d96b56eeb7f333f9
- SHA512 cb327bb7fcea4ad24de883922c1d34872e2f365e2c85a5851ce0c826d86c453f995a95564f5a7728bd3a1cd607fb6d9c7a42904158e0131bbf6535351fc7230c
- SSDEEP 6144:s24DWiC2VZb7uwYqOOCEPz2hrCWTTHSM3VaPPC:B4DWN2x3YqOOz4eWOnC
- TLSH T12A645A4E53E905E5E676907CC4878A06E67174761322A6DF02D080BD6F23FE87A7DF22
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c0:1c:f1:16:31:2e:df:fd:98:fc:3c:61:eb:2c:6f:63:07:09:c0:17:e1:01:32:78:d5:a2:f4:5a:da:19:1d:d9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:591A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:14:8d:cd:23:44:ee:06:df:72:00:01:00:00:02:14
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
9504
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wusys.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o_free
_o_malloc
_o_realloc
_o_terminate
_o_wcstoul
__C_specific_handler
__current_exception
__current_exception_context
_o__execute_onexit_table
_o__errno
_o___stdio_common_vswprintf
_o__crt_atexit
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__configure_narrow_argv
__CxxFrameHandler3
_CxxThrowException
__std_terminate
_o__cexit
__CxxFrameHandler4
memcmp
_o__callnewh
memcpy
api-ms-win-crt-string-l1-1-0
memset
wcscmp
wcsncmp
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleHandleW
LoadLibraryExW
GetProcAddress
GetModuleFileNameA
FreeLibrary
GetModuleHandleA
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
InitOnceExecuteOnce
api-ms-win-core-synch-l1-1-0
ReleaseMutex
ReleaseSRWLockExclusive
InitializeSRWLock
CreateSemaphoreExW
WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObjectEx
ReleaseSemaphore
OpenSemaphoreW
ReleaseSRWLockShared
SetEvent
CreateMutexExW
AcquireSRWLockShared
CreateEventExW
DeleteCriticalSection
AcquireSRWLockExclusive
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetErrorMode
GetLastError
SetLastError
SetErrorMode
RaiseException
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventSetInformation
EventRegister
EventWriteTransfer
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
OpenThreadToken
GetCurrentProcessId
GetCurrentThread
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
OpenProcessToken
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringW
CompareStringOrdinal
api-ms-win-core-sysinfo-l1-1-0
GetSystemWindowsDirectoryW
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
ntdll
NtSetTimer2
NtCreateTimer2
NtSetInformationProcess
DbgPrintEx
NtQuerySystemInformation
RtlInitUnicodeString
NtSetInformationThread
NtPowerInformation
NtQuerySecurityPolicy
RtlIsMultiSessionSku
RtlRaiseStatus
RtlFreeHeap
RtlGetDeviceFamilyInfoEnum
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsCreateString
WindowsDeleteString
WindowsDuplicateString
WindowsCompareStringOrdinal
WindowsCreateStringReference
api-ms-win-core-com-l1-1-0
CoTaskMemFree
StringFromGUID2
CoCreateGuid
CoGetApartmentType
CoGetMalloc
CoCreateInstance
CoWaitForMultipleHandles
CoTaskMemAlloc
CoSetProxyBlanket
CoCreateFreeThreadedMarshaler
CoQueryProxyBlanket
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoGetActivationFactory
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
oleaut32
SysAllocString
SysFreeString
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
api-ms-win-security-base-l1-1-0
ImpersonateLoggedOnUser
RevertToSelf
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
RoTransformError
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegGetValueW
RegCloseKey
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-file-l1-1-0
CreateDirectoryW
GetFileAttributesW
RemoveDirectoryW
DeleteFileW
api-ms-win-core-file-l2-1-2
CopyFileW
api-ms-win-core-file-l1-2-0
GetTempPathW
Name
.text
Size
228KB
Virtual Size
224KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
48KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=79, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=15, id=260, version=33145,
count=5, id=259, version=33145,
count=1270, id=1, productName=Unmarked objects,
count=2, id=257, version=33145,
count=25, id=261, version=33145,
count=1, id=256, version=33145,
count=40, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wvc.dll
- IMPHASH e3c2b548a997261bb8c800a507b6545d
- SHA256 a48031338d4b9372c8e20517facaf330378471cdf38168988b6c0eb04236710f
- MD5 5262457bab7a692159968e1520b4a59b
- SHA1 bafb1231a071c59b052d8edfabf724ef6bf0d427
- SHA512 4c53586102c14c2c61e887e7879ad19ef01259c521d06bab1a4ec7fb88e1f9808984088f09703e4f45c0e8bd5169e46ed608614ec12cdd9a7ca7e8be9f81f80f
- SSDEEP 6144:tcQyWXMVs6Zmz8X9S38sOXtIDJJX9PKA2HtnNwoOI4GkOoiO:hyWXM1L036ID7Vp
- TLSH T1B5C45B56FBA884A3C155913C8967870AE772B0980F61E3CB3694C3BE6F73BD41D39660
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4896
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wvc.pdb
mfc42u
ord624
ord1284
ord1262
ord1126
ord1287
ord1286
ord4473
ord626
ord1040
msvcrt
wcsncmp
_wtol
sin
pow
memset
memmove
memcmp
log
floor
cos
ceil
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
wcsstr
_clearfp
wcstod
_vsnwprintf
_wtoi
wcsrchr
?name@type_info@@QEBAPEBDXZ
_wcsicmp
malloc
free
_purecall
realloc
__C_specific_handler
__CxxFrameHandler4
_CxxThrowException
atan2
sqrt
atl
ord45
ord44
ord43
ord27
ord30
ord21
ord22
ord16
ord15
ord32
ord23
ord18
ord26
ord58
ord31
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
CloseHandle
CreateFileW
WriteFile
GetNumberFormatW
GetCurrencyFormatW
GetLocaleInfoW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
Sleep
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
DecodePointer
EncodePointer
LoadLibraryExA
GetCurrentProcess
VirtualFree
LocalFree
FileTimeToSystemTime
GetModuleFileNameW
GetModuleHandleW
GetVersionExW
MulDiv
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
GetCurrentThreadId
VirtualQuery
GlobalUnlock
DeleteCriticalSection
GlobalLock
GetProcAddress
GetSystemInfo
GlobalAlloc
InitializeCriticalSection
LeaveCriticalSection
VirtualAlloc
EnterCriticalSection
VirtualProtect
RtlVirtualUnwind
GetTimeFormatW
SetLastError
SystemTimeToFileTime
GetDateFormatW
ole32
CreateDataAdviseHolder
OleRegGetMiscStatus
CreateOleAdviseHolder
CoGetMalloc
OleRegGetUserType
OleRegEnumVerbs
CoTaskMemFree
oleaut32
VarDateFromStr
SystemTimeToVariantTime
LHashValOfNameSys
VariantClear
SysStringLen
OleCreatePropertyFrame
SysFreeString
LoadRegTypeLi
SetErrorInfo
CreateErrorInfo
VariantInit
VariantChangeType
SysAllocString
VariantCopy
SafeArrayCreateVector
SafeArrayUnaccessData
VariantTimeToSystemTime
VariantChangeTypeEx
SafeArrayCopy
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayDestroy
VariantCopyInd
SysAllocStringLen
SafeArrayCreate
SafeArrayPutElement
SafeArrayAccessData
user32
SetWindowPos
EqualRect
SetWindowLongPtrW
SetWindowRgn
UnionRect
GetWindowLongPtrW
ShowWindow
IsWindow
GetFocus
DestroyAcceleratorTable
IsChild
IntersectRect
SetFocus
PtInRect
InvalidateRect
DestroyWindow
CallWindowProcW
GetKeyState
DefWindowProcW
GetDC
ReleaseDC
LoadStringW
SystemParametersInfoW
GetSysColor
InvalidateRgn
IsRectEmpty
SetRectEmpty
CopyRect
DestroyCaret
EnableWindow
EndPaint
GetClientRect
BeginPaint
GetUpdateRgn
SetTimer
ScreenToClient
GetWindowRect
KillTimer
TrackPopupMenuEx
DestroyMenu
GetSubMenu
LoadMenuW
FillRect
ClientToScreen
SetRect
OffsetRect
CreateWindowExW
advapi32
RegCloseKey
RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
TraceEvent
RegOpenKeyExW
RegQueryValueExW
gdi32
GdiFlush
CreateDIBSection
BitBlt
GetRgnBox
CreateCompatibleDC
CreateCompatibleBitmap
DPtoLP
PtVisible
CreateRectRgn
PatBlt
MoveToEx
LineTo
Polygon
SetBkColor
CreateSolidBrush
Polyline
Ellipse
Arc
ExtTextOutW
CombineRgn
LPtoDP
SetBkMode
RestoreDC
SetViewportOrgEx
DeleteDC
GetDeviceCaps
SetWindowExtEx
CreateRectRgnIndirect
SetWindowOrgEx
CloseMetaFile
SaveDC
GetObjectType
SelectPalette
RealizePalette
SelectObject
GetStockObject
SetTextColor
GetTextFaceW
GetTextMetricsW
GetOutlineTextMetricsW
GetTextExtentExPointW
GetCharWidthW
DeleteMetaFile
GetMapMode
SetMapMode
Escape
GetClipBox
IntersectClipRect
SelectClipRgn
SetViewportExtEx
SetTextAlign
GetWindowOrgEx
DeleteObject
CreateBrushIndirect
ExtCreatePen
CreatePenIndirect
CreateFontIndirectW
SetRectRgn
CreateMetaFileW
msimg32
AlphaBlend
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
Name
.text
Size
288KB
Virtual Size
287KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
124KB
Virtual Size
121KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
32KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
76KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=24, id=260, version=33145,
count=21, id=257, version=33145,
count=281, id=1, productName=Unmarked objects,
count=8, id=261, version=33145,
count=1, id=256, version=33145,
count=111, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wwancfg.dll
- IMPHASH 8d9708a4dc2d89dddc2183ba9aaacb2d
- SHA256 e4e22a1893b99e14bb56a1b51576038ec32a9b2282467ffc6bc5c0a523a620ef
- MD5 ef8f2bbc45ffeee13c4ba1d91516df76
- SHA1 4e8d45e691ac65a8aa5c6a3b65f18d4fd35d5ddf
- SHA512 e559b1084c86adf891007b867b0fe88f11f8204249fbbacccf59492263d623f1e340de417277e1a39a236b8f5aa911c1242b2f6c46132e9c4cb892adbc4cc8dc
- SSDEEP 3072:1JP+tbF02Rztkkg5uQ/sOcXGMpChOhD38breFC3OP38V:1st3RzGkdQ0OciigeAePM
- TLSH T1DC343B1D22A918B5DD77D1B8CA871655E2B378315721E2CF02E0917E8F27BE8763AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
6464
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wwancfg.pdb
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
api-ms-win-crt-string-l1-1-0
wcsncmp
memset
strnlen
wcsnlen
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__free_locale
_o__i64toa_s
_o__i64tow_s
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
__std_terminate
_o__ui64toa_s
_o__ui64tow_s
memcmp
_o__wcsicmp
_o__wcstod_l
_o__wtoi
_o_abort
_o_free
_o_iswspace
_o_malloc
_o_mbrtowc
_o_terminate
_o_toupper
_o_wcscat_s
_o_wcsncpy_s
_o_wcstok
__C_specific_handler
__current_exception
__current_exception_context
_CxxThrowException
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___pctype_func
memmove
memcpy
__CxxFrameHandler4
_o__crt_atexit
_o__create_locale
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnwprintf_s
wcsstr
ntdll
RtlIpv4AddressToStringW
RtlIpv6AddressToStringW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetModuleHandleExW
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleW
LoadStringW
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-processthreads-l1-1-0
CreateProcessW
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetExitCodeProcess
api-ms-win-core-localization-l1-2-0
FormatMessageA
FormatMessageW
GetLocaleInfoEx
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockShared
EnterCriticalSection
AcquireSRWLockExclusive
InitializeCriticalSectionEx
InitializeCriticalSectionAndSpinCount
CreateMutexExW
ReleaseSRWLockShared
WaitForSingleObject
ResetEvent
DeleteCriticalSection
ReleaseSemaphore
WaitForMultipleObjectsEx
CreateEventW
SetEvent
OpenSemaphoreW
ReleaseMutex
WaitForSingleObjectEx
CreateSemaphoreExW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
SetLastError
UnhandledExceptionFilter
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventSetInformation
EventRegister
EventUnregister
api-ms-win-core-com-l1-1-0
CoUninitialize
StringFromCLSID
StringFromGUID2
CoTaskMemFree
CLSIDFromString
CoInitializeEx
CoCreateInstance
api-ms-win-core-registry-l1-1-0
RegGetValueW
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
GetTickCount64
api-ms-win-core-file-l1-1-0
FileTimeToLocalFileTime
CreateFileW
SetFileInformationByHandle
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
api-ms-win-core-datetime-l1-1-0
GetTimeFormatW
GetDateFormatW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-eventing-controller-l1-1-0
StartTraceW
EnableTraceEx2
ControlTraceW
api-ms-win-eventing-legacy-l1-1-0
EnableTrace
api-ms-win-core-realtime-l1-1-0
QueryUnbiasedInterruptTime
api-ms-win-core-synch-l1-2-0
WakeByAddressSingle
WaitOnAddress
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
netsh.exe
RegisterContext
RegisterHelper
PrintMessageFromModule
MatchTagsInCmdLine
MatchEnumTag
wwapi
WwanOpenHandle
WwanDisconnect
WwanConnect
WwanConnectAdditionalPdpContext
WwanRegisterNotification
WwanCloseHandle
WwanGetProfileState
WwanQueryInterface
WwanQueryInterfaceEx
WwanSetInterface
WwanScan
WwanEnumerateInterfaces
WwanGetDMConfigProfileList
WwanGetDMConfigProfile
WwanGetProfileList
WwanGetProfileListByPurpose
WwanGetProfile
WwanDeleteDMConfigProfile
WwanDeleteProfile
WwanSetDMConfigProfile
WwanFreeMemory
WwanSetProfile
WwanAllocateMemory
wwanprfl
WwanProfileDeinit
WwanProfileInit
WwanProfileLoadXml
WwanProfileCleanup
luiapi
LuiCloseHandle
LuiRegisterForLpaNotifications
LuiOpenHandle
mobilenetworking
GetPersistentRegPath
api-ms-win-service-management-l2-1-0
QueryServiceStatusEx
api-ms-win-service-management-l1-1-0
CloseServiceHandle
OpenServiceW
OpenSCManagerW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-heap-l2-1-0
LocalFree
GetResourceString
InitHelperDll
Name
.text
Size
160KB
Virtual Size
156KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=68, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=11, id=260, version=33145,
count=1268, id=1, productName=Unmarked objects,
count=15, id=257, version=33145,
count=32, id=261, version=33145,
count=7, id=259, version=33145,
count=1, id=256, version=33145,
count=12, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wwanprotdim.dll
- IMPHASH ec42c6e0e96918a780c62afad84fa4d6
- SHA256 acb8ec444e51130f2cc58c766d62e27a757cebf0728bd2063aaa7e73b9481bcd
- MD5 b39b69999b0c1bb893d6a8df1632e8de
- SHA1 fd37d0833c0d035b96ef1258f121e5e3d369f1de
- SHA512 2a98ac4fe335acf893fa8ac9582db736b4dd4d9fabe863157710ba37cc6a9dca80c6274f54bd8f4e61c8996bb596406705a0133093b5f5c605d5b1d97c940109
- SSDEEP 6144:gzavHi00R6mX+TE3/EzckC/dcFtTFTyfIsufAYfJvAqdOdxDfEgWC:+SHIRNX8
- TLSH T19994ED132BEC5918F4F75B70ABB682266732FDA85B21D2DF1055121E4C62BC18F72B36
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5312
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wwanprotdim.pdb
msvcrt
malloc
free
_amsg_exit
__C_specific_handler
_vsnwprintf
_XcptFilter
memcpy_s
memcpy
memcmp
wcsnlen
_initterm
sprintf_s
memset
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventUnregister
EventWriteTransfer
EventSetInformation
rpcrt4
RpcStringFreeW
UuidFromStringW
UuidToStringW
api-ms-win-core-string-l2-1-0
CharUpperBuffW
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
api-ms-win-core-synch-l1-1-0
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
LeaveCriticalSection
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleHandleExA
DisableThreadLibraryCalls
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
CreateThread
GetThreadId
GetCurrentThreadId
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-file-l1-1-0
CreateFileW
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
ntdll
NtDeviceIoControlFile
RtlNtStatusToDosError
DimInitialize
Name
.text
Size
64KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
300KB
Virtual Size
296KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
172B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=28, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33145,
count=4, id=259, version=33145,
count=54, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=1, id=256, version=33145,
count=7, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wwansvc.dll
- IMPHASH 129713e060b93e4d08b4e8f6262803fa
- SHA256 b1e043c88c16eab18b0bbecae9a32d7086be69c7bdbcb87be84baece22629413
- MD5 c34ed63d4965d8ecd053ae5ffc964c56
- SHA1 8fe77a9a0d800a4d3a4bf3a66c53e838be3e449e
- SHA512 d9bf1231cdfa4af9df5352c777f51fc2e273d8a906ed19439aee2d8d460fd2c4542da73ce4ce801053dced3c6d5008308e1389f22369dcbe53c6af41a3a09fc7
- SSDEEP 24576:RcVbARt5p2/cGJd+YupKUHZ5XW7WqUUdUPkpq:65ARt5TGJOh55edMkw
- TLSH T14D75C2162BF80198F5F7AA78EEB68516CA72BC656B31C2DF0150815E1D73FD08939B32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
29888
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wwansvc.pdb
msvcp_win
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?uncaught_exceptions@std@@YAHXZ
?id@?$ctype@G@std@@2V0locale@2@A
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG0@Z
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??Bid@locale@std@@QEAA_KXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?widen@?$ctype@G@std@@QEBAGD@Z
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
?setf@ios_base@std@@QEAAHH@Z
?setf@ios_base@std@@QEAAHHH@Z
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGXZ
?_Xlength_error@std@@YAXPEBD@Z
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
api-ms-win-crt-string-l1-1-0
strncmp
wcsnlen
wcscmp
wcsncmp
memset
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsdup
_o__wcsicmp
_o__wcsnicmp
memmove
_o_calloc
_o_ceilf
_o_free
_o_isalpha
_o_iswalnum
_o_iswspace
_o_malloc
_o_qsort
_o_terminate
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstol
_o_wmemcpy_s
__C_specific_handler
__current_exception
__current_exception_context
__CxxFrameHandler3
_CxxThrowException
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
wcschr
__std_type_info_compare
wcsstr
__std_terminate
__CxxFrameHandler4
__C_specific_handler_noexcept
memchr
memcmp
memcpy
ntdll
RtlPublishWnfStateData
RtlWaitForWnfMetaNotification
RtlVirtualUnwind
RtlTestAndPublishWnfStateData
NtQueryKey
RtlDeriveCapabilitySidsFromName
RtlLookupFunctionEntry
RtlCaptureContext
RtlQueryPackageIdentity
NtQueryWnfStateData
RtlInitUnicodeString
NtCreateWnfStateName
WinSqmIsOptedIn
RtlNtStatusToDosErrorNoTeb
RtlQueryWnfStateData
RtlUnsubscribeWnfNotificationWithCompletionCallback
RtlSubscribeWnfStateChangeNotification
NtPowerInformation
RtlNtStatusToDosError
RtlStringFromGUID
RtlIpv6AddressToStringW
NtDeviceIoControlFile
RtlIpv4AddressToStringW
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
DisableThreadLibraryCalls
GetModuleFileNameA
LoadLibraryExW
GetModuleHandleExA
LoadStringW
FreeLibrary
GetProcAddress
GetModuleHandleExW
oleaut32
SysFreeString
SysAllocString
VariantClear
SysStringLen
SysAllocStringLen
VarBstrCat
SysStringByteLen
SysAllocStringByteLen
SysReAllocStringLen
VariantInit
api-ms-win-core-synch-l1-1-0
InitializeSRWLock
TryAcquireSRWLockExclusive
CreateSemaphoreExW
EnterCriticalSection
ReleaseSemaphore
ResetEvent
LeaveCriticalSection
InitializeCriticalSectionEx
WaitForSingleObject
ReleaseMutex
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSection
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseSRWLockShared
InitializeCriticalSectionAndSpinCount
SetEvent
CreateEventW
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
GetLastError
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolWait
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
CreateThreadpoolCleanupGroup
TrySubmitThreadpoolCallback
CallbackMayRunLong
WaitForThreadpoolWaitCallbacks
api-ms-win-core-processthreads-l1-1-0
CreateThread
GetCurrentProcessId
OpenProcessToken
TerminateProcess
GetCurrentThreadId
GetCurrentThread
GetCurrentProcess
OpenThreadToken
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
CompareStringEx
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventWrite
EventUnregister
EventWriteTransfer
EventSetInformation
api-ms-win-service-core-l1-1-0
SetServiceStatus
RegisterServiceCtrlHandlerExW
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoCreateGuid
CoCreateInstance
CoTaskMemFree
CLSIDFromString
StringFromGUID2
PropVariantClear
CoDecrementMTAUsage
CoInitializeEx
CoIncrementMTAUsage
CoUninitialize
IIDFromString
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteTreeW
RegGetValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegDeleteKeyExW
RegNotifyChangeKeyValue
api-ms-win-core-threadpool-legacy-l1-1-0
UnregisterWaitEx
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceExecuteOnce
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
RegDeleteKeyValueW
api-ms-win-core-sysinfo-l1-1-0
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
GetSystemDirectoryW
GetTickCount64
GetVersionExW
GetSystemWindowsDirectoryW
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-file-l1-1-0
CreateDirectoryW
GetFileAttributesW
DeleteFileW
GetFileAttributesExW
SetFileAttributesW
CreateFileW
GetFullPathNameW
ReadFile
WriteFile
api-ms-win-core-io-l1-1-0
DeviceIoControl
GetOverlappedResult
devobj
DevObjOpenDevRegKey
DevObjGetDeviceInterfaceDetail
DevObjEnumDeviceInterfaces
DevObjGetDeviceInstanceId
DevObjGetDeviceRegistryProperty
DevObjDestroyDeviceInfoList
DevObjGetClassDevs
DevObjCreateDeviceInfoList
DevObjGetDeviceProperty
DevObjOpenDeviceInfo
DevObjEnumDeviceInfo
iphlpapi
GetAdaptersAddresses
GetIfEntry2
ConvertInterfaceGuidToLuid
SetInterfaceDnsSettings
rpcrt4
RpcBindingFromStringBindingW
RpcStringFreeW
UuidToStringW
RpcStringBindingComposeW
RpcBindingSetAuthInfoExW
RpcBindingFree
RpcServerInqBindingHandle
RpcServerUnsubscribeForNotification
RpcServerSubscribeForNotification
RpcAsyncAbortCall
NdrClientCall3
I_RpcOpenClientProcess
RpcServerInqBindings
RpcExceptionFilter
UuidFromStringW
RpcEpRegisterW
RpcEpUnregister
RpcServerRegisterAuthInfoW
NdrServerCall2
RpcServerListen
Ndr64AsyncServerCallAll
RpcAsyncCompleteCall
RpcServerRegisterIf3
RpcServerUseProtseqW
NdrServerCallAll
RpcServerUnregisterIfEx
I_RpcExceptionFilter
RpcBindingSetOption
RpcMgmtInqServerPrincNameW
RpcBindingSetAuthInfoW
RpcImpersonateClient
RpcRevertToSelfEx
UuidCreate
UuidHash
RpcBindingVectorFree
NdrAsyncServerCall
api-ms-win-devices-query-l1-1-0
DevCloseObjectQuery
DevFreeObjectProperties
DevGetObjectProperties
api-ms-win-core-shlwapi-obsolete-l1-1-0
StrStrIW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-devices-swdevice-l1-1-0
SwMemFree
SwDeviceInterfaceRegister
SwDeviceCreate
SwDeviceClose
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
FileTimeToSystemTime
winhttp
WinHttpCreateUrl
WinHttpCrackUrl
ws2_32
closesocket
WSACleanup
WSAGetLastError
WSAAddressToStringW
ntohl
WSAStartup
WSAEnumNetworkEvents
WSAIoctl
socket
WSAEventSelect
api-ms-win-core-version-l1-1-1
GetFileVersionInfoSizeW
GetFileVersionInfoW
api-ms-win-core-version-l1-1-0
VerQueryValueW
api-ms-win-oobe-notification-l1-1-0
OOBEComplete
api-ms-win-core-sysinfo-l1-2-3
GetOsManufacturingMode
api-ms-win-core-string-l2-1-1
SHLoadIndirectString
api-ms-win-power-setting-l1-1-0
PowerSettingUnregisterNotification
PowerSettingRegisterNotification
api-ms-win-security-accesshlpr-l1-1-0
FreeTransientObjectSecurityDescriptor
QueryTransientObjectSecurityDescriptor
api-ms-win-security-base-l1-1-0
AllocateAndInitializeSid
GetTokenInformation
EqualSid
FreeSid
CheckTokenMembership
CreateWellKnownSid
api-ms-win-eventing-controller-l1-1-0
ControlTraceW
api-ms-win-core-file-l2-1-2
CopyFileW
api-ms-win-devices-config-l1-1-1
CM_Setup_DevNode
CM_Query_And_Remove_SubTreeW
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolQueueTask
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
wmi
WmiNotificationRegistrationW
wwanprfl
WwanProfileGenerateXml
WwanProfileDecryptPassword
WwanProfileCopyProfile
WwanProfileLoadXml
WwanProfileGenerateFile
WwanProfileLoadFile
WwanProfileGetRootPath
WwanProfileInit
WwanProfileGetPath
WwanProfileDeinit
WwanProfileCleanup
umpdc
Pdcv2ActivationClientDeactivate
Pdcv2ActivationClientUnregister
Pdcv2ActivationClientRegister
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-registry-l2-1-0
RegDeleteKeyW
api-ms-win-core-kernel32-legacy-l1-1-0
RegisterWaitForSingleObject
MoveFileW
api-ms-win-core-file-l2-1-0
ReplaceFileW
api-ms-win-security-sddl-l1-1-0
ConvertStringSidToSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-security-capability-l1-1-0
RpcClientCapabilityCheck
api-ms-win-security-base-l1-2-0
CheckTokenCapability
bcrypt
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptFinishHash
BCryptCreateHash
BCryptDestroyHash
BCryptHashData
BCryptCloseAlgorithmProvider
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceEnableFlags
TraceMessage
GetTraceLoggerHandle
api-ms-win-service-private-l1-1-0
SubscribeServiceChangeNotifications
WaitServiceState
UnsubscribeServiceChangeNotifications
api-ms-win-service-management-l1-1-0
StartServiceW
OpenServiceW
OpenSCManagerW
CloseServiceHandle
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
SvchostPushServiceGlobals
WwanSvcMain
Name
.text
Size
832KB
Virtual Size
829KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
528KB
Virtual Size
526KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
40KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
472B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
92KB
Virtual Size
91KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=142, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=16, id=260, version=33145,
count=5, id=259, version=33145,
count=1561, id=1, productName=Unmarked objects,
count=11, id=257, version=33145,
count=32, id=261, version=33145,
count=1, id=256, version=33145,
count=122, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wwapi.dll
- IMPHASH 8d85abc23ce9e604974c4fa54cdcfd83
- SHA256 edc5836670173ec7484cb5484b71ae3cc745209759714e4a58d8221aebb69c4e
- MD5 6c0043c2d503afb9c571d1502311f1cf
- SHA1 847a53926e6ab17878612646034b8c7d8b2d26f2
- SHA512 e9b3668908174e4350041a2386055df97437ba2eb89bc2d4155622b7d50cd848d6237af1c9b95e9d9aa582f3c4013a4436bbddda3739ea17a7dbff71a6623619
- SSDEEP 3072:6AKOt1KjvAGuWtI2+HRYeshWJVw2RI+es1sXO76fyFk:661KjIGVtvIYeshptXO+Gk
- TLSH T17C14601667D91015F8F78775DE778A267B32FD641320C2DF2080A2289C62BC19F79B7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e9:7e:a7:92:4a:4e:63:93:d5:8e:2e:f2:95:14:4a:f8:8b:77:c4:2b:53:96:0a:44:b6:48:fc:fc:ff:54:f1:b0
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 18, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:DC00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:24:3b:84:21:b0:2c:ac:64:22:00:01:00:00:02:24
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
25504
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wwapi.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
_o_free
_o_malloc
_CxxThrowException
__CxxFrameHandler3
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__C_specific_handler
api-ms-win-crt-string-l1-1-0
memset
ntdll
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventSetInformation
EventUnregister
EventWriteTransfer
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
SetEvent
CreateEventW
EnterCriticalSection
DeleteCriticalSection
WaitForSingleObjectEx
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
rpcrt4
RpcSsDestroyClientContext
RpcMgmtInqServerPrincNameW
RpcAsyncCompleteCall
RpcBindingSetAuthInfoW
I_RpcExceptionFilter
RpcBindingFree
RpcAsyncInitializeHandle
RpcAsyncGetCallStatus
RpcAsyncCancelCall
RpcEpResolveBinding
NdrClientCall3
Ndr64AsyncClientCall
RpcStringBindingComposeW
RpcStringFreeW
RpcBindingFromStringBindingW
RpcBindingSetOption
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
CreateThread
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
Wwan2CloseDeviceServiceCommandSession
Wwan2CloseDeviceServiceDataSession
Wwan2CloseHandle
Wwan2EnumerateDeviceServices
Wwan2OpenDeviceServiceCommandSession
Wwan2OpenDeviceServiceDataSession
Wwan2OpenHandle
Wwan2QueryDeviceServiceSupportedCommands
Wwan2QueryInterfaces
Wwan2RegisterNotification
Wwan2SendDeviceServiceCommand
Wwan2SubscribePowerStateEvents
Wwan2WriteDeviceServiceData
WwanAcquireOnDemandConnection
WwanActivateNotification
WwanAllocateMemory
WwanAuthChallenge
WwanCloseHandle
WwanConnect
WwanConnectAdditionalPdpContext
WwanConnectByActivityId
WwanConvertToInterfaceObject
WwanDeleteDMConfigProfile
WwanDeleteProfile
WwanDisconnect
WwanEnumerateInterfaces
WwanFreeMemory
WwanGetDMConfigBinary
WwanGetDMConfigProfile
WwanGetDMConfigProfileList
WwanGetInfGuidAndProfileByProfileIndex
WwanGetInterfaceGuid
WwanGetProfile
WwanGetProfileHomeProviderName
WwanGetProfileIndex
WwanGetProfileIstream
WwanGetProfileList
WwanGetProfileListByPurpose
WwanGetProfileMetaData
WwanGetProfileState
WwanGetTrafficDescriptorList
WwanModemLogging
WwanOpenHandle
WwanQueryIPv6eHRPDControl
WwanQueryInterface
WwanQueryInterfaceEx
WwanRegister
WwanRegisterNotification
WwanReleaseOnDemandConnection
WwanScan
WwanSearchProfile
WwanSetDMConfigBinary
WwanSetDMConfigProfile
WwanSetIPv6eHRPDControl
WwanSetInterface
WwanSetNetworkQuietMode
WwanSetProfile
WwanSetProfileMetaData
WwanSetSmsConfiguration
WwanSmsDelete
WwanSmsRead
WwanSmsSend
WwanUiccCloseChannel
WwanUiccOpenChannel
WwanUiccSendApdu
WwanUiccSetTerminalCapability
WwanUssdRequest
Name
.text
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
36KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
88KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=35, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1126, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=4, id=259, version=33145,
count=21, id=261, version=33145,
count=1, id=256, version=33145,
count=8, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
xboxgipsvc.dll
- IMPHASH 6da78fd45b51c0a03349a8142642c07a
- SHA256 4437e01701f44d1cd4f30be0977e384019c93b8522163f90b87f732a7d68ba19
- MD5 b236eb726082b520eda6cfd8c238c0c8
- SHA1 4412fdc1eef546d9abad58530de36ff51b44ae49
- SHA512 44fcd53d2704bbd6fbe06847e4281112d904533d50d523b7340275c69e70caa96f322805a197c70d929e4c82ba08657cdb6670d84bf824e3671347193a6638c2
- SSDEEP 3072:It70FvEXkFoc3B1E7btV2XHXuQUyDT1EmkAh:It0dEX1c3B12EnDumkA
- TLSH T1B6D34B6E36A910A6D575A17D84830F4AD371F821171257EF03A0C2BE5F63FE8AD3AB50
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5776
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
XboxGipSvc.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__crt_atexit
_o_abort
_o_ceilf
_o_free
_o_malloc
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
_o__cexit
_o__callnewh
_CxxThrowException
__CxxFrameHandler3
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__configure_narrow_argv
__std_terminate
__CxxFrameHandler4
memcpy
api-ms-win-crt-string-l1-1-0
memset
wcsnlen
ntdll
RtlCaptureContext
RtlQueryWnfStateData
RtlNtStatusToDosError
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceBeginInitialize
InitOnceComplete
WakeByAddressAll
WaitOnAddress
InitOnceExecuteOnce
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-eventing-classicprovider-l1-1-0
RegisterTraceGuidsW
GetTraceEnableLevel
TraceMessage
UnregisterTraceGuids
GetTraceEnableFlags
GetTraceLoggerHandle
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError
api-ms-win-core-synch-l1-1-0
CreateEventW
WaitForSingleObject
CreateSemaphoreExW
AcquireSRWLockShared
ReleaseSRWLockShared
ReleaseSemaphore
DeleteCriticalSection
ReleaseSRWLockExclusive
ReleaseMutex
CreateEventExW
CreateMutexExW
WaitForSingleObjectEx
InitializeCriticalSectionEx
EnterCriticalSection
InitializeSRWLock
ResetEvent
LeaveCriticalSection
AcquireSRWLockExclusive
InitializeCriticalSection
OpenSemaphoreW
SetEvent
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
GetProcAddress
GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExW
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
RoOriginateError
RoTransformError
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
CreateThread
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-com-l1-1-0
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
CoCreateInstance
CoResumeClassObjects
CoRegisterClassObject
CoDecrementMTAUsage
CoRevokeClassObject
CoInitializeSecurity
CoAddRefServerProcess
CoDisconnectContext
CoReleaseServerProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-winrt-l1-1-0
RoRevokeActivationFactories
RoRegisterActivationFactories
RoInitialize
RoUninitialize
api-ms-win-service-core-l1-1-1
QueryServiceDynamicInformation
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-service-core-l1-1-0
RegisterServiceCtrlHandlerExW
SetServiceStatus
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsDeleteString
WindowsIsStringEmpty
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-security-base-l1-1-0
MakeAbsoluteSD
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-registry-l1-1-0
RegEnumValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
api-ms-win-core-io-l1-1-0
GetOverlappedResult
DeviceIoControl
api-ms-win-service-management-l1-1-0
CloseServiceHandle
OpenServiceW
OpenSCManagerW
api-ms-win-service-management-l2-1-0
NotifyServiceStatusChangeW
QueryServiceStatusEx
api-ms-win-core-file-l1-1-0
CreateFileW
api-ms-win-devices-swdevice-l1-1-0
SwDeviceCreate
SwDeviceClose
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-devices-config-l1-1-1
CM_Get_Device_Interface_ListW
CM_Get_Device_Interface_List_SizeW
CM_Register_Notification
CM_Unregister_Notification
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
wlanapi
WlanEnumInterfaces
WlanCloseHandle
WlanOpenHandle
WlanFreeMemory
WlanQueryInterface
WlanRegisterNotification
ext-ms-win-setupapi-classinstallers-l1-1-0
SetupDiGetDevicePropertyW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
combase
ord66
ord69
ord67
ord68
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
rpcrt4
NdrDllCanUnloadNow
NdrOleAllocate
NdrOleFree
NdrStubForwardingFunction
NdrDllGetClassObject
DllCanUnloadNow
DllGetClassObject
ServiceMain
Name
.text
Size
72KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=77, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33145,
count=1219, id=1, productName=Unmarked objects,
count=10, id=257, version=33145,
count=29, id=261, version=33145,
count=7, id=259, version=33145,
count=1, id=256, version=33145,
count=13, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
xboxgipsynthetic.dll
- IMPHASH 9e1648edf6f07a92399d98f654f9e94d
- SHA256 105611a936f3887530054be98716dd2e2e3cded238c69dd6b6539191318c3404
- MD5 32eaa59781436d097d5033bec37fe293
- SHA1 85fc6e7ba41840fa974d060aff11a87a5c55fb11
- SHA512 5d27b192213d2609d90821a37d2d8c45cb9cb4bb0a38f734320ff17a9e868af33e46190667239dcfbbb2e9939fbebe51e82ff86d5727dcf6c9a94a3a7cb427aa
- SSDEEP 3072:0w3mottuAM5dZ1jI0/qbIbzEPZ3GOYTqFD0S/xa:06maM5dZ10qzEFGzTqV0S/
- TLSH T109C33A2A75A814BDE53E8139DA864659E37170622BB14BEF0390C27E5F93FD06C3CB25
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5392
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
XboxgipSynthetic.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__callnewh
_o__cexit
_o_free
_o_malloc
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__CxxFrameHandler3
_CxxThrowException
_o___stdio_common_vswprintf
__CxxFrameHandler4
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA
GetProcAddress
api-ms-win-core-synch-l1-1-0
WaitForSingleObjectEx
ReleaseMutex
WaitForSingleObject
ReleaseSemaphore
OpenSemaphoreW
CreateMutexExW
CreateSemaphoreExW
SetEvent
ResetEvent
CreateEventExW
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
RaiseException
GetLastError
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
TerminateThread
SetThreadPriority
GetCurrentProcess
CreateThread
GetCurrentThread
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
msvcp_win
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-core-io-l1-1-0
GetQueuedCompletionStatus
CreateIoCompletionPort
PostQueuedCompletionStatus
CancelIoEx
GetOverlappedResult
DeviceIoControl
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolCleanupGroupMembers
CreateThreadpoolCleanupGroup
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolThreadMinimum
CloseThreadpool
SetThreadpoolThreadMaximum
CreateThreadpool
CloseThreadpoolCleanupGroup
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-file-l1-1-0
CreateFileW
api-ms-win-core-synch-l1-2-0
WaitOnAddress
Sleep
WakeByAddressSingle
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
ntdll
RtlGetDeviceFamilyInfoEnum
DllMain
SyntheticController_AddAudioHeadset
SyntheticController_Connect
SyntheticController_CreateController
SyntheticController_Disconnect
SyntheticController_GetDeviceId
SyntheticController_RegisterReportCallback
SyntheticController_RemoveAudioHeadset
SyntheticController_RemoveController
SyntheticController_SendAudio
SyntheticController_SendReport
SyntheticController_SetControllerFwVersion
SyntheticController_SetTargetProcess
SyntheticController_UnregisterReportCallback
Name
.text
Size
80KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
308B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=49, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=1144, id=1, productName=Unmarked objects,
count=4, id=257, version=33145,
count=28, id=261, version=33145,
count=1, id=256, version=33145,
count=10, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=258, version=33145,
xmlfilter.dll
- IMPHASH fbc4d8be175312aa303be65a850cdf75
- SHA256 a1cf110e7efcbc61dda27b2447cc30c20be839d7d6b1c39dab55252e9b15c192
- MD5 9ec2698f5f1c737c343ad403091b214b
- SHA1 45c7da5b17609a243c219b03c08684b54364ccf9
- SHA512 1248f6d9018cd8cb2e34a2c66ff4570ec0302d2f2a27d570044620f4e0cfbdef796eb3b5936fb7ed552dc4940cfaf0176770155955d42e932ab6c99f1edbd31c
- SSDEEP 3072:SYUJ5sq7nkLNEnmiJuNdHoQi6jU4ozaeXzZG/Cx0rt8D7dMtkBVy/6IUej5vwg4O:gJ5zb+mnsvVi6jU4ozaeXzZG/20rt8D8
- TLSH T11EF32A5D32FC10A6E576C17C99A24609E772B4B11321A3EF02D081BE5F63FD4AD39B61
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ca:03:67:c7:b4:4e:12:85:2f:d1:c2:4d:98:d1:31:5b:88:3d:20:fe:ec:ed:bf:c7:d1:d9:3a:2a:d4:1c:8d:a0
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3303-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:21:33:c0:35:fb:d2:0f:21:a4:00:01:00:00:02:21
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
8336
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
XmlFilter.pdb
msvcp_win
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsnicmp
_o_abort
_o_free
_o_iswspace
_o_malloc
_o_realloc
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
__CxxFrameHandler3
_CxxThrowException
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__C_specific_handler
__std_terminate
__CxxFrameHandler4
__C_specific_handler_noexcept
memcmp
memcpy
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
oleaut32
RegisterTypeLi
SysAllocString
SysFreeString
VariantClear
SetErrorInfo
LoadTypeLi
SysStringLen
VarUI4FromStr
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
RaiseException
GetLastError
SetLastError
UnhandledExceptionFilter
api-ms-win-core-synch-l1-1-0
CreateMutexExW
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx
InitializeCriticalSection
AcquireSRWLockExclusive
AcquireSRWLockShared
InitializeCriticalSectionEx
OpenSemaphoreW
ReleaseSRWLockExclusive
ReleaseSRWLockShared
WaitForSingleObject
SetEvent
CreateEventExW
CreateSemaphoreExW
EnterCriticalSection
DeleteCriticalSection
LeaveCriticalSection
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoCreateInstance
StringFromGUID2
CoTaskMemRealloc
CoTaskMemAlloc
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetModuleFileNameA
FindResourceExW
SizeofResource
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
LoadLibraryExW
FreeLibrary
DisableThreadLibraryCalls
LoadResource
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-localization-l1-2-0
GetLocaleInfoEx
FormatMessageW
FormatMessageA
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventUnregister
EventWriteTransfer
EventSetInformation
api-ms-win-core-file-l1-1-0
GetFileAttributesW
api-ms-win-shcore-stream-l1-1-0
SHCreateStreamOnFileEx
api-ms-win-core-threadpool-legacy-l1-1-0
QueueUserWorkItem
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-registry-l1-1-0
RegDeleteValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
84KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
36KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
664B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=68, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33145,
count=5, id=259, version=33145,
count=1192, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=27, id=261, version=33145,
count=1, id=256, version=33145,
count=1, id=253, version=33145,
count=19, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
xmllite.dll
- IMPHASH 110a4191567f04eae4038be066daa410
- SHA256 266767e1f254840a57d218d85f8ca45cba41dc3d021142063bd5b36ac4de9765
- MD5 569b479a451befedbc1592e1761826f2
- SHA1 6d9192e3844022be6ea14107e124c5bbd4427f07
- SHA512 144b5ee8da6444719a96a69fdc20fe78ecf6ab79aae3e0097ac0f4ec16bf17b2724afd17e82859b13a8caf374fa07724e20d320e9306cb7c19f2c346018a5989
- SSDEEP 6144:HKiKgCwciTtGuiaH46tIdD/r/XWZb0HkOiVH34FFhOuV8e8H:HygCwco7/tIZ/r/X3Dz8e8H
- TLSH T11B543A4676941CA1D6E7813CC687862AE7FF78552361C6CB039442CA7F277E16A3E323
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
57:0d:0f:d9:5f:43:ef:e7:cf:1c:6f:d9:22:5e:a8:27:fb:8e:43:91:1b:1d:aa:59:08:83:39:29:ae:0a:c4:0a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6B05-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:11:45:18:39:9b:43:cf:fc:6c:00:01:00:00:02:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
116672
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB paths
XmlLite.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o_malloc
_o_memcpy_s
__C_specific_handler
_o___std_type_info_destroy_list
_o___stdio_common_vswprintf
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
memmove_s
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA
DisableThreadLibraryCalls
GetProcAddress
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetCPInfo
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-synch-l1-1-0
CreateMutexExW
OpenSemaphoreW
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSectionEx
EnterCriticalSection
WaitForSingleObjectEx
ReleaseMutex
ReleaseSemaphore
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
LeaveCriticalSection
CreateSemaphoreExW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
CreateXmlReader
CreateXmlReaderInputWithEncodingCodePage
CreateXmlReaderInputWithEncodingName
CreateXmlWriter
CreateXmlWriterOutputWithEncodingCodePage
CreateXmlWriterOutputWithEncodingName
Name
.text
Size
196KB
Virtual Size
194KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
36KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1123, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=15, id=261, version=33145,
count=1, id=256, version=33145,
count=43, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
xmlprovi.dll
- IMPHASH 2665de60808ec54954d65002a0065ce7
- SHA256 b6e667c6c5754119e27cdcd17f53954443908ef30690248b417a2511a37834a9
- MD5 b91d99be28ec3f1b3192f0b7c1580302
- SHA1 c54b1dbb5f606c07fdd106cd83a7eb64a766c5fb
- SHA512 49501b55e7dd78c5ac596b746238337806c533d9bce7d1cc6a2095dcf074b9b8fb530cb0744c31f2b993f1d82bc56329a45fff01ff86f8d9e6cc76bfd52305f7
- SSDEEP 384:G8+1EbnqaHiKUnVfvE56ImDOZBggZxd7NGe/aHzDTL+RbNlj0el2RvJS/qqbOvSV:o+MOBDkTuBl0BSSRq5
- TLSH T11E333A4E7B6828A5F0B6817DC5630E09D1B5F4B5439233DFA2B0C2AE4F6BBD41631B91
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7264
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
xmlprovi.pdb
ntdll
__C_specific_handler
wcschr
msvcrt
malloc
??3@YAXPEAX@Z
??_V@YAXPEAX@Z
__CxxFrameHandler4
_onexit
_purecall
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
free
_amsg_exit
_XcptFilter
memmove
memcpy
__CxxFrameHandler3
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
??1type_info@@UEAA@XZ
_callnewh
atl
ord16
ord30
ord22
ord18
ord15
ord21
ord23
ord32
kernel32
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
lstrlenA
MultiByteToWideChar
lstrlenW
InitializeCriticalSection
DisableThreadLibraryCalls
DeleteCriticalSection
rtutils
TraceDeregisterW
TracePrintfA
TraceRegisterExW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
16KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
588B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33145,
count=4, id=259, version=33145,
count=8, id=261, version=33145,
count=13, id=257, version=33145,
count=59, id=1, productName=Unmarked objects,
count=1, id=256, version=33145,
count=6, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
xolehlp.dll
- IMPHASH 89ffff4fba2fe4f89fc28c03b71f0273
- SHA256 d4e08a3797c16c05d168c7e24ab10828eea070f490a6f153a789a6e5397b0e22
- MD5 2d722545351d5dfe154ae69598f97681
- SHA1 8142ec18965bb646ede5df6e1a48f244afce81f1
- SHA512 72435dcaf4eec96241ff293246fc36411ff9c54bdc01d9068654d5071d4ea1d1d86f37db3c48390f7642298881e3cab8091c64e810020c33684f0a0b30c0e5de
- SSDEEP 1536:g1iqxYZ3wz4Fe1xA3fDuYAt6DtyuiUUyeggbygX:glxzzo3fiYAcYutXgbZX
- TLSH T1AC93E60962F82094F6B796B89A760104DB76B8315B31A7EF0690C53D5F26FE49E38F12
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5808
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
xolehlp.pdb
ntdll
RtlNtStatusToDosError
RtlReportException
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlFindExportedRoutineByName
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExA
RegOpenKeyExA
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
DisableThreadLibraryCalls
LockResource
LoadLibraryExW
FreeLibrary
LoadLibraryExA
LoadStringW
GetProcAddress
FindResourceExW
GetModuleFileNameW
LoadResource
GetModuleHandleA
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoTaskMemFree
CoGetObjectContext
CoCreateInstance
StringFromGUID2
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFindFileNameA
msvcrt
strchr
free
malloc
_callnewh
_amsg_exit
_initterm
__C_specific_handler
_lock
_unlock
memset
__dllonexit
_onexit
memcmp
_local_unwind
mbstowcs
_CxxThrowException
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_wfopen
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??1exception@@UEAA@XZ
_ultow
memcpy
_XcptFilter
_vsnprintf
fopen
fflush
fclose
fprintf
fwprintf
__CxxFrameHandler4
_vsnwprintf
_wcsicmp
_stricmp
wcsrchr
_purecall
_waccess
wcscpy_s
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
TlsGetValue
GetCurrentProcess
OpenProcessToken
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
CreateProcessW
TlsFree
TlsAlloc
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetComputerNameExW
GetTickCount
GetLocalTime
GetSystemWindowsDirectoryA
api-ms-win-core-processenvironment-l1-1-0
GetCommandLineA
ExpandEnvironmentStringsW
api-ms-win-core-file-l1-1-0
FindFirstFileW
FindNextFileW
GetFullPathNameW
CreateDirectoryW
FindClose
SetFileAttributesW
CreateFileW
DeleteFileW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-synch-l1-1-0
CreateEventA
WaitForSingleObject
WaitForSingleObjectEx
SetEvent
DeleteCriticalSection
LeaveCriticalSection
ResetEvent
EnterCriticalSection
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-core-version-l1-1-0
VerQueryValueW
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
kernel32
UnregisterWaitEx
QueueUserWorkItem
DtcGetTransactionManager
DtcGetTransactionManagerC
DtcGetTransactionManagerEx
DtcGetTransactionManagerExA
DtcGetTransactionManagerExW
FreezeLocalTransactionManagers
GetDtcLocaleResourceHandle
ThawLocalTransactionManagers
Name
.text
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
360B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=17, id=260, version=33145,
count=60, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=257, version=33145,
count=229, id=1, productName=Unmarked objects,
count=1, id=256, version=33145,
count=47, id=264, version=33145,
count=4, id=261, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
xpspushlayer.dll
- IMPHASH 0d022d2893a723825eb92c09052e0896
- SHA256 9b37153a27b3b6ed5d9cca60e4df4eaf333350fa44368c308bdeafd02f9401a0
- MD5 65337c8f13d89527c1069280be8b8cbe
- SHA1 62f15fe6382baa846f8df18c5882ef4cb87b648b
- SHA512 c84bf4215d9ebc45211153e3da2b902646289ad3e986f2f9cf8374de629eb512179ca5853b1ebfea089fa00cf629cde1e5480d335df8b771251ea0b0e1db2649
- SSDEEP 6144:XhrnOrWOI6Zvw89kMDXokY+22tQvnqmt:XhrOrWXGw89Mkg22
- TLSH T100640A2E65AC0DB6F2B2E17EC5934A0EE67174434363E2CF4652025E5E27BE88E3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5600
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
XpsPushLayer.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsdup
_o_abort
_o_calloc
_o_free
_o_isspace
_o_localeconv
_o_malloc
_o_setlocale
_o_strtod
_o_strtof
_o_terminate
_o_tolower
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__cexit
_o__calloc_base
_o__callnewh
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___pctype_func
_o____mb_cur_max_func
_o____lc_locale_name_func
_o____lc_codepage_func
__CxxFrameHandler4
memchr
memcpy
__uncaught_exception
api-ms-win-crt-string-l1-1-0
memset
wcsnlen
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleW
DisableThreadLibraryCalls
GetProcAddress
api-ms-win-core-synch-l1-1-0
ReleaseMutex
ReleaseSRWLockExclusive
LeaveCriticalSection
AcquireSRWLockExclusive
CreateMutexExW
WaitForSingleObject
EnterCriticalSection
ReleaseSemaphore
OpenSemaphoreW
WaitForSingleObjectEx
InitializeCriticalSectionEx
DeleteCriticalSection
CreateSemaphoreExW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
SetLastError
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
TerminateProcess
api-ms-win-core-localization-l1-2-0
LCMapStringEx
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
oleaut32
GetErrorInfo
SysFreeString
SetErrorInfo
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoCreateFreeThreadedMarshaler
CoCreateInstance
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
opcservices
ord14
xpsservices
ord4
ord5
ord6
ord3
api-ms-win-crt-locale-l1-1-0
_lock_locales
_unlock_locales
DllCanUnloadNow
Name
.text
Size
200KB
Virtual Size
198KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
64KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=33145,
count=57, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1158, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=26, id=261, version=33145,
count=1, id=256, version=33145,
count=93, id=264, version=33145,
count=2, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
xpsservices.dll
- IMPHASH baa420aeba55af5022f070876192d9f2
- SHA256 79ec6b75a6059dbdab1ea7c5b13036350167556b677e3549b722bfe66db83ccc
- MD5 c29e86f68bec3bde53f5e2258cf9aeaf
- SHA1 c8ff971bd8eec8e012a535446b1743fbfbd88d59
- SHA512 18d61b61beba82458f5de676555ab4252e65811232e58eebaa080c7a5240f7628701259c4e44c3deb1187119d403b5437e94cc0e20baedd53cf68befc24f3be4
- SSDEEP 49152:rk0d6kaUgT5SdDj3KI/Psm2AuWoOCbymLl+EP:9d6/RIfDUh
- TLSH T1D2B54C1A65AC01D0E2F5F1BCC55B990FE8B17812D336A6CF452506991F3BBF8C93AB12
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
807488
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
xpsservices.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__free_locale
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__itow_s
_o__ldclass
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o___stdio_common_vsprintf_s
memmove
_o__wcsdup
_o__wcsicmp
_o__wcstod_l
_o__wtoi
_o_abort
_o_calloc
_o_ceilf
_o_free
_o_frexp
_o_isdigit
_o_isspace
_o_localeconv
_o_malloc
_o_setlocale
_o_strtod
_o_strtof
_o_terminate
_o_tolower
_o_wcstod
__C_specific_handler
__current_exception
__current_exception_context
_o__dclass
_o__crt_atexit
_o__create_locale
_o__execute_onexit_table
_o__configure_narrow_argv
_o__errno
_o__cexit
_o__calloc_base
_o__callnewh
_o___std_type_info_destroy_list
_o___std_exception_destroy
__uncaught_exception
__CxxFrameHandler3
_CxxThrowException
_o___std_exception_copy
_o___pctype_func
wcsrchr
_o____mb_cur_max_func
_o____lc_locale_name_func
_o____lc_codepage_func
__CxxFrameHandler4
_o___stdio_common_vswprintf
memchr
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
strcspn
wcsnlen
wcsncmp
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GetModuleFileNameA
api-ms-win-core-synch-l1-1-0
CreateMutexExW
ReleaseSRWLockShared
AcquireSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
ReleaseMutex
DeleteCriticalSection
WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection
CreateEventW
ReleaseSemaphore
EnterCriticalSection
SetEvent
CreateSemaphoreExW
InitializeCriticalSectionAndSpinCount
ResetEvent
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
CreateThread
api-ms-win-core-localization-l1-2-0
LCMapStringEx
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventWriteTransfer
EventUnregister
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-crt-math-l1-1-0
_finite
_isnan
api-ms-win-crt-locale-l1-1-0
_lock_locales
_unlock_locales
oleaut32
SysStringLen
SysAllocStringLen
VariantClear
VariantInit
GetErrorInfo
SysFreeString
SetErrorInfo
SysAllocString
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoUninitialize
CoInitializeEx
CoTaskMemFree
CLSIDFromString
CoCreateGuid
CreateStreamOnHGlobal
CoCreateInstance
StringFromGUID2
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-version-l1-1-0
GetFileVersionInfoSizeExW
GetFileVersionInfoExW
VerQueryValueW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
ntdll
WinSqmIsOptedIn
WinSqmAddToStream
WinSqmIncrementDWORD
opcservices
ord3
ord4
ord2
ord1
ord14
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
SystemTimeToFileTime
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
xmllite
CreateXmlWriter
api-ms-win-core-fibers-l2-1-0
CreateFiber
ConvertThreadToFiber
SwitchToFiber
DeleteFiber
urlmon
CreateUri
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
380KB
Virtual Size
376KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
112KB
Virtual Size
109KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=257, version=33145,
count=75, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1211, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=15, id=260, version=33145,
count=5, id=259, version=33145,
count=31, id=261, version=33145,
count=1, id=256, version=33145,
count=218, id=264, version=33145,
count=2, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
xwizards.dll
- IMPHASH 5404f86df808691916b94f71633f7b83
- SHA256 3378d9a98498e0c70f0edabac4adf6cedcab4f493f719ca2118fd4f4d19d0afe
- MD5 2d81f82749ac7e7aefc7445d6cafcdf8
- SHA1 47cc4a775cda69da831fb8da68963aa80999fcad
- SHA512 fefb1a1522f6d7d93bfd652c4b2c4f2b8e2e5e7dd1d0997974a613051af65ed9411daa87e57b85ff67beb82837c18cd1d493ee4d8ea8d24e5e0b94475ab1d59b
- SSDEEP 6144:JKv0UR+psJpxLR2Uw18f6cIe4xCAiDnQ05+gEfxAAHw6zrD68wV:oshsJpV3za05+DAAHwgD68w
- TLSH T15DA4072EF3A444E1E529523C884346999B72BC295B72D7C722A1B32D3FF77E04D31A58
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7440
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
xwizards.pdb
msvcrt
_wcstoui64
?terminate@@YAXXZ
_lock
_unlock
wcstod
_initterm
_wcstoi64
__dllonexit
_onexit
wcstol
toupper
__RTDynamicCast
wcstoul
iswdigit
_vsnprintf
towlower
_vsnwprintf
??0exception@@QEAA@AEBQEBDH@Z
??1type_info@@UEAA@XZ
??0exception@@QEAA@AEBQEBD@Z
_errno
_callnewh
wcsncpy_s
malloc
free
_purecall
_wcsicmp
memcpy_s
??_V@YAXPEAX@Z
__C_specific_handler
sscanf_s
iswxdigit
memcmp
??0exception@@QEAA@AEBV0@@Z
?what@exception@@UEBAPEBDXZ
_CxxThrowException
__CxxFrameHandler3
memcpy
memmove
_XcptFilter
realloc
_amsg_exit
??3@YAXPEAX@Z
__CxxFrameHandler4
??1exception@@UEAA@XZ
memset
rpcrt4
IUnknown_AddRef_Proxy
NdrStubForwardingFunction
NdrOleFree
IUnknown_Release_Proxy
NdrOleAllocate
NdrDllGetClassObject
IUnknown_QueryInterface_Proxy
NdrStubCall3
NdrDllCanUnloadNow
api-ms-win-core-com-midlproxystub-l1-1-0
ObjectStublessClient8
NdrProxyForwardingFunction5
ObjectStublessClient10
NdrProxyForwardingFunction9
NdrProxyForwardingFunction4
ObjectStublessClient13
ObjectStublessClient7
NdrProxyForwardingFunction3
ObjectStublessClient11
NdrProxyForwardingFunction7
NdrProxyForwardingFunction6
ObjectStublessClient12
ObjectStublessClient14
NdrProxyForwardingFunction8
ObjectStublessClient9
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
DisableThreadLibraryCalls
SizeofResource
FindResourceExW
GetModuleFileNameW
LoadResource
GetProcAddress
GetModuleHandleW
FreeLibrary
api-ms-win-core-file-l1-1-0
CreateFileW
FindNextFileW
GetFullPathNameW
WriteFile
FindFirstFileW
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegEnumKeyExW
RegQueryValueExW
RegOpenKeyExW
RegQueryInfoKeyW
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
EnterCriticalSection
OpenMutexW
DeleteCriticalSection
WaitForSingleObject
ReleaseMutex
LeaveCriticalSection
ReleaseSemaphore
CreateMutexW
api-ms-win-core-com-l1-1-0
CLSIDFromString
CoTaskMemAlloc
CoFreeUnusedLibrariesEx
CoTaskMemRealloc
StringFromCLSID
StringFromGUID2
CoCreateInstance
CoInitializeEx
CoUninitialize
CoTaskMemFree
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventUnregister
EventRegister
api-ms-win-eventing-classicprovider-l1-1-0
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceLoggerHandle
GetTraceEnableFlags
UnregisterTraceGuids
TraceMessage
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
CompareStringW
WideCharToMultiByte
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetLastError
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
TlsGetValue
CreateProcessW
TlsSetValue
TlsFree
GetCurrentProcess
TerminateProcess
TlsAlloc
GetCurrentProcessId
GetCurrentThreadId
GetThreadId
GetExitCodeProcess
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetVersionExW
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
api-ms-win-shcore-obsolete-l1-1-0
CommandLineToArgvW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
shlwapi
PathFileExistsW
ord615
PathUnExpandEnvStringsW
user32
SetWindowLongPtrW
GetParent
MessageBoxW
SetProcessDPIAware
ReplyMessage
GetWindowLongPtrW
MsgWaitForMultipleObjectsEx
SetForegroundWindow
SetPropW
FindWindowW
IsWindow
EnumChildWindows
GetPropW
ShowWindowAsync
TranslateMessage
PeekMessageW
DispatchMessageW
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
ntdll
NtOpenThreadToken
NtClose
NtOpenProcessToken
NtQueryInformationToken
api-ms-win-core-memory-l1-1-0
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-atoms-l1-1-0
GlobalGetAtomNameA
GlobalGetAtomNameW
GlobalAddAtomA
api-ms-win-core-synch-l1-2-1
CreateSemaphoreW
DllCanUnloadNow
DllGetClassObject
ProcessXMLFileA
ProcessXMLFileW
ResetRegistrationA
ResetRegistrationW
RunPropertySheetA
RunPropertySheetW
RunWizardA
RunWizardW
XWProcessXMLFile
XWRegisterHost
XWRegisterPageWithPage
XWRegisterPageWithTask
XWRegisterTaskWithHost
XWUnregisterHost
XWUnregisterHostTaskLink
XWUnregisterPage
XWUnregisterPagesLink
XWUnregisterTask
XWUnregisterTaskPageLink
Name
.text
Size
212KB
Virtual Size
208KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
80KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
112KB
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=74, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=19, id=260, version=33145,
count=246, id=1, productName=Unmarked objects,
count=9, id=257, version=33145,
count=10, id=261, version=33145,
count=1, id=256, version=33145,
count=63, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
xwreg.dll
- IMPHASH d2a155feedaa1b5d79f34a460d7ddad7
- SHA256 78bc03ce0c1207f9e83fc49654880e331cfa1a5f08fe31592e6b1fc1d5f46c93
- MD5 772ce6a8165e14fa55ecba5f8d82e513
- SHA1 8a78e559185c883aef834f237a80806b896f9811
- SHA512 88f8881af2924b03fa0d06190f1dc1c82bdb85e90293f50cd4c16eef13effa522d9793b80a73464af6659fddde5075f12f3d98ecf66e6f80edf6971445522902
- SSDEEP 3072:YCLFfug9OlrE3xsb3KOCx+x/ltuZnUXd+5:bLcg0lQB43KOQsuZnUXd8
- TLSH T191E3292AF79410B6C076823D8A620764DB72B8355F2197DF32AC826D2F377D19E31B49
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7440
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
xwreg.pdb
msvcrt
tolower
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
??1type_info@@UEAA@XZ
towlower
_vsnwprintf
_errno
_vsnprintf
realloc
_callnewh
iswxdigit
_CxxThrowException
__CxxFrameHandler3
??3@YAXPEAX@Z
wcsncpy_s
malloc
memcpy
memmove
?terminate@@YAXXZ
free
_XcptFilter
_onexit
_purecall
_lock
memcpy_s
??_V@YAXPEAX@Z
_unlock
__C_specific_handler
_amsg_exit
__dllonexit
__CxxFrameHandler4
_initterm
memset
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
FreeLibrary
GetModuleFileNameW
LoadResource
FindResourceExW
GetModuleHandleW
GetProcAddress
SizeofResource
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-1-0
ReleaseSemaphore
OpenMutexW
LeaveCriticalSection
CreateMutexW
DeleteCriticalSection
InitializeCriticalSection
ReleaseMutex
EnterCriticalSection
api-ms-win-core-com-l1-1-0
CLSIDFromString
StringFromGUID2
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegRestoreKeyW
RegDeleteValueW
RegEnumKeyExW
RegQueryValueExW
RegCloseKey
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
api-ms-win-core-errorhandling-l1-1-0
GetLastError
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-0
OpenProcessToken
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-file-l1-2-0
GetTempPathW
api-ms-win-core-file-l1-1-0
SetFilePointer
GetFullPathNameW
ReadFile
FlushFileBuffers
GetTempFileNameW
WriteFile
DeleteFileW
api-ms-win-security-base-l1-1-0
AllocateAndInitializeSid
FreeSid
CheckTokenMembership
AdjustTokenPrivileges
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-registry-l2-1-0
RegSaveKeyW
RegDeleteKeyW
user32
TranslateMessage
DispatchMessageW
PeekMessageW
MsgWaitForMultipleObjectsEx
api-ms-win-core-synch-l1-2-1
CreateSemaphoreW
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFileExistsW
PathUnExpandEnvStringsW
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
76KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
36KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1012B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=66, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33138,
count=17, id=260, version=33138,
count=172, id=1, productName=Unmarked objects,
count=7, id=257, version=33138,
count=10, id=261, version=33138,
count=1, id=256, version=33138,
count=21, id=264, version=33138,
count=1, id=255, version=33138,
count=1, id=258, version=33138,
xwtpdui.dll
- IMPHASH 59685d6a41e1a77022493b448bfa676c
- SHA256 8387f1a8368308f9818153ea9c284732202b64c5c25ac2425eadda78ccab2f17
- MD5 6857f4e534a6cf01dde7e871b9eadabb
- SHA1 0c8598a60e5b7d887d48a9ff44ee67ab73f026bd
- SHA512 2735b7a801939f58952b3fc7ecb19b8db05262e7e3a1d99992a20323c3757daf5917dd56b03f0e31bf9ec98bc17d64718b1516985a387c3b32329b9aad1998ca
- SSDEEP 6144:4tkZVH0Fe3ShdzBgHH545AFx1kvq/8yX:zZp0Fe3ShZgvFn5X
- TLSH T1B154171DB3BA0C95DDAA9138850B4648EA72B0315716E2DB31ECC33D9F27BD53A38E15
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7872
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
xwtpdui.pdb
msvcrt
_errno
_initterm
_vsnwprintf
_wcsicmp
_amsg_exit
_XcptFilter
__CxxFrameHandler4
__C_specific_handler
??_V@YAXPEAX@Z
towlower
tolower
realloc
memcpy_s
_purecall
free
malloc
wcsncpy_s
_callnewh
?terminate@@YAXXZ
_lock
_unlock
__dllonexit
_onexit
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1type_info@@UEAA@XZ
??3@YAXPEAX@Z
__RTDynamicCast
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_CxxThrowException
__CxxFrameHandler3
memcpy
memmove
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameW
GetModuleHandleA
LoadLibraryExW
LockResource
FreeLibrary
GetModuleHandleW
DisableThreadLibraryCalls
GetProcAddress
SizeofResource
GetModuleFileNameA
LoadResource
FindResourceExW
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
OpenMutexW
CreateMutexW
EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
ReleaseMutex
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoCreateGuid
StringFromGUID2
CLSIDFromString
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
api-ms-win-core-registry-l1-1-0
RegEnumKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegCreateKeyExW
RegDeleteValueW
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventUnregister
EventWriteTransfer
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
UnregisterTraceGuids
api-ms-win-core-string-l2-1-0
CharUpperW
CharNextW
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
RaiseException
SetLastError
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
DebugBreak
api-ms-win-core-kernel32-legacy-l1-1-0
MulDiv
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
lstrcmpiA
gdi32
DeleteObject
GetStockObject
GetTextMetricsW
CreateFontIndirectW
SelectObject
GetObjectW
user32
DestroyWindow
CreateWindowExW
UnregisterClassW
RegisterClassExW
LoadCursorW
SetWindowLongW
GetMessageExtraInfo
GetWindow
ShowWindow
GetDlgCtrlID
IsWindowEnabled
GetDlgItem
CreateDialogIndirectParamW
InvalidateRect
GetNextDlgTabItem
GetWindowLongW
GetMessageW
AdjustWindowRectEx
GetKeyState
CallWindowProcW
PostMessageW
GetWindowRect
GetFocus
GetDC
SetWindowPos
SetMessageExtraInfo
MessageBoxW
GetPropW
MonitorFromWindow
SetWindowLongPtrW
SendMessageW
RemovePropW
MessageBeep
NotifyWinEvent
GetWindowLongPtrW
GetWindowPlacement
LoadStringW
IsWindow
OffsetRect
DispatchMessageW
IsDialogMessageW
GetMonitorInfoW
EnumPropsA
PeekMessageW
EnumPropsExW
IsChild
EnumPropsW
MoveWindow
SetFocus
SetPropW
TranslateMessage
GetClassNameW
MapDialogRect
GetClientRect
IsZoomed
SetRect
PostQuitMessage
GetDesktopWindow
SystemParametersInfoW
EnumPropsExA
RegisterWindowMessageW
LoadImageW
ReleaseDC
EnableWindow
GetWindowTextW
DefWindowProcW
GetSystemMetrics
GetParent
FindWindowExW
dui70
?Paint@Element@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z
?GetWidth@Element@DirectUI@@QEAAHXZ
?GetHeight@Element@DirectUI@@QEAAHXZ
?SetHeight@Element@DirectUI@@QEAAJH@Z
?CreateXBaby@XProvider@DirectUI@@UEAAJPEAVIXElementCP@2@PEAUHWND__@@PEAVElement@2@PEAKPEAPEAUIXBaby@2@@Z
??0XProvider@DirectUI@@QEAA@XZ
??1XProvider@DirectUI@@UEAA@XZ
DisableAnimations
EnableAnimations
?SyncRect@HWNDHost@DirectUI@@IEAAXI_N@Z
?GetChildren@Element@DirectUI@@QEAAPEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@PEAPEAVValue@2@@Z
?GetClass@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z
?SetVisited@TouchHyperLink@DirectUI@@QEAAJ_N@Z
?GetNotificationSinkHWND@XElement@DirectUI@@UEAAPEAUHWND__@@XZ
?GetCreationFlags@XElement@DirectUI@@UEAAIXZ
??0XElement@DirectUI@@QEAA@XZ
??1XElement@DirectUI@@UEAA@XZ
?OnInput@XElement@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?OnMessage@XElement@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnSysChar@XElement@DirectUI@@UEAA_NG@Z
?OnSinkThemeChanged@XElement@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnEvent@XElement@DirectUI@@UEAAXPEAUEvent@2@@Z
?CreateHWND@XElement@DirectUI@@UEAAPEAUHWND__@@PEAU3@@Z
?SetKeyFocus@XElement@DirectUI@@UEAAXXZ
?GetClassInfoPtr@XElement@DirectUI@@SAPEAUIClassInfo@2@XZ
?Register@XElement@DirectUI@@SAJXZ
?SetProvider@XElement@DirectUI@@QEAAJPEAUIUnknown@@@Z
ElementFromGadget
?GetElementNull@Value@DirectUI@@SAPEAV12@XZ
?ParentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
??1CritSecLock@DirectUI@@QEAA@XZ
?UpdateTooltip@Element@DirectUI@@MEAAXPEAV12@@Z
?ActivateTooltip@Element@DirectUI@@MEAAXPEAV12@K@Z
?RemoveTooltip@Element@DirectUI@@MEAAXPEAV12@@Z
?SetActive@Element@DirectUI@@QEAAJH@Z
?SetID@Element@DirectUI@@QEAAJPEBG@Z
?GetHWND@HWNDHost@DirectUI@@UEAAPEAUHWND__@@XZ
??0ClassInfoBase@DirectUI@@QEAA@XZ
??1ClassInfoBase@DirectUI@@UEAA@XZ
?Initialize@ClassInfoBase@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG_NPEBQEBUPropertyInfo@2@I@Z
?Register@ClassInfoBase@DirectUI@@QEAAJXZ
?ClassExist@ClassInfoBase@DirectUI@@SA_NPEAPEAUIClassInfo@2@PEBQEBUPropertyInfo@2@IPEAU32@PEAUHINSTANCE__@@PEBG_N@Z
?AddRef@ClassInfoBase@DirectUI@@UEAAXXZ
?Release@ClassInfoBase@DirectUI@@UEAAHXZ
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?GetByClassIndex@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?GetPICount@ClassInfoBase@DirectUI@@UEBAIXZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UEBAIXZ
?GetName@ClassInfoBase@DirectUI@@UEBAPEBGXZ
?IsValidProperty@ClassInfoBase@DirectUI@@UEBA_NPEBUPropertyInfo@2@@Z
?IsSubclassOf@ClassInfoBase@DirectUI@@UEBA_NPEAUIClassInfo@2@@Z
?GetModule@ClassInfoBase@DirectUI@@UEBAPEAUHINSTANCE__@@XZ
?IsGlobal@ClassInfoBase@DirectUI@@UEBA_NXZ
?AddChild@ClassInfoBase@DirectUI@@UEAAXXZ
?RemoveChild@ClassInfoBase@DirectUI@@UEAAXXZ
?GetChildren@ClassInfoBase@DirectUI@@UEBAHXZ
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UEBAXXZ
?OnPropertyChanged@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?OnGroupChanged@Element@DirectUI@@UEAAXH_N@Z
?GetFactoryLock@Element@DirectUI@@SAPEAU_RTL_CRITICAL_SECTION@@XZ
?KeyFocusedProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?OnPropertyChanged@HWNDHost@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?OnInput@HWNDHost@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?OnEvent@HWNDHost@DirectUI@@UEAAXPEAUEvent@2@@Z
?OnDestroy@HWNDHost@DirectUI@@UEAAXXZ
?OnNotify@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnSysChar@HWNDHost@DirectUI@@UEAA_NG@Z
?OnSinkThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnCtrlThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnWindowStyleChanged@HWNDHost@DirectUI@@UEAAX_KPEBUtagSTYLESTRUCT@@@Z
?OnAdjustWindowSize@HWNDHost@DirectUI@@UEAAHHHI@Z
?MessageCallback@HWNDHost@DirectUI@@UEAAIPEAUtagGMSG@@@Z
?Paint@HWNDHost@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z
?GetKeyFocused@HWNDHost@DirectUI@@UEAA_NXZ
?SetKeyFocus@HWNDHost@DirectUI@@UEAAXXZ
?SetWindowDirection@HWNDHost@DirectUI@@UEAAXPEAUHWND__@@@Z
?GetClassInfoPtr@HWNDHost@DirectUI@@SAPEAUIClassInfo@2@XZ
?Register@HWNDHost@DirectUI@@SAJXZ
?GetAccessibleImpl@HWNDHost@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
??0HWNDHost@DirectUI@@QEAA@XZ
?Initialize@HWNDHost@DirectUI@@QEAAJIIPEAVElement@2@PEAK@Z
??1HWNDHost@DirectUI@@UEAA@XZ
?OnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z
?OnUnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z
?EraseBkgnd@HWNDHost@DirectUI@@MEAA_NPEAUHDC__@@PEA_J@Z
?Release@Value@DirectUI@@QEAAXXZ
?IsRTLReading@Element@DirectUI@@UEAA_NXZ
?IsContentProtected@Element@DirectUI@@UEAA_NXZ
?QueryInterface@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?GetBorderThickness@Element@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z
?GetPadding@Element@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z
?GetFontFace@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z
?GetFontSize@Element@DirectUI@@QEAAHXZ
?GetFontWeight@Element@DirectUI@@QEAAHXZ
?GetFontStyle@Element@DirectUI@@QEAAHXZ
?GetFontQuality@Element@DirectUI@@QEAAHXZ
?GetContentAlign@Element@DirectUI@@QEAAHXZ
?GetKeyFocused@Element@DirectUI@@UEAA_NXZ
?SetVisible@Element@DirectUI@@QEAAJ_N@Z
?SetWidth@Element@DirectUI@@QEAAJH@Z
?SetLayoutPos@Element@DirectUI@@QEAAJH@Z
?SetForegroundColor@Element@DirectUI@@QEAAJK@Z
?SetContentString@Element@DirectUI@@QEAAJPEBG@Z
?SetFontFace@Element@DirectUI@@QEAAJPEBG@Z
?SetFontSize@Element@DirectUI@@QEAAJH@Z
?SetFontWeight@Element@DirectUI@@QEAAJH@Z
?SetFontStyle@Element@DirectUI@@QEAAJH@Z
?SetFontQuality@Element@DirectUI@@QEAAJH@Z
?SetContentAlign@Element@DirectUI@@QEAAJH@Z
?SetClass@Element@DirectUI@@QEAAJPEBG@Z
?SetSelected@Element@DirectUI@@QEAAJ_N@Z
?SetAccessible@Element@DirectUI@@QEAAJ_N@Z
?SetAccRole@Element@DirectUI@@QEAAJH@Z
?SetAccName@Element@DirectUI@@QEAAJPEBG@Z
?SetAccDesc@Element@DirectUI@@QEAAJPEBG@Z
?SetEnabled@Element@DirectUI@@QEAAJ_N@Z
?SetLayout@Element@DirectUI@@QEAAJPEAVLayout@2@@Z
?CanSetFocus@HWNDElement@DirectUI@@UEAA_NXZ
?IsMSAAEnabled@HWNDElement@DirectUI@@UEAA_NXZ
?GetHWND@HWNDElement@DirectUI@@UEAAPEAUHWND__@@XZ
?GetClassInfoW@HWNDElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ
?ShowWindow@NativeHWNDHost@DirectUI@@QEAAXH@Z
?DestroyWindow@NativeHWNDHost@DirectUI@@QEAAXXZ
?UpdateTooltip@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z
?ActivateTooltip@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@K@Z
?RemoveTooltip@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z
?GetClassInfoW@TouchHWNDElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ
??0IXProviderCP@DirectUI@@QEAA@XZ
?StartNavigate@Browser@DirectUI@@SA?AVUID@@XZ
CreateDUIWrapperTouchEx
?GetClassInfoPtr@TouchCommandButton@DirectUI@@SAPEAUIClassInfo@2@XZ
UnInitThread
CreateDUIWrapperEx
?SetLightDismissIHM@TouchHWNDElement@DirectUI@@QEAAJ_N@Z
?Initialize@TouchHWNDElement@DirectUI@@QEAAJPEAUHWND__@@_NIPEAVElement@2@PEAK@Z
?MessageCallback@TouchHWNDElement@DirectUI@@UEAAIPEAUtagGMSG@@@Z
?OnInput@TouchHWNDElement@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?OnEvent@TouchHWNDElement@DirectUI@@UEAAXPEAUEvent@2@@Z
?OnKeyFocusMoved@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@0@Z
?OnPropertyChanged@TouchHWNDElement@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?WndProc@TouchHWNDElement@DirectUI@@UEAA_JPEAUHWND__@@I_K_J@Z
?IsMSAAEnabled@TouchHWNDElement@DirectUI@@UEAA_NXZ
?OnDestroy@TouchHWNDElement@DirectUI@@UEAAXXZ
??0TouchHWNDElement@DirectUI@@QEAA@XZ
??1TouchHWNDElement@DirectUI@@UEAA@XZ
?_OnUIStateChanged@TouchHWNDElement@DirectUI@@MEAAXGG@Z
?Create@FillLayout@DirectUI@@SAJPEAPEAVLayout@2@@Z
?GetClassInfoPtr@TouchHyperLink@DirectUI@@SAPEAUIClassInfo@2@XZ
?Create@DUIXmlParser@DirectUI@@SAJPEAPEAV12@P6APEAVValue@2@PEBGPEAX@Z2P6AX11H2@Z2@Z
?Destroy@DUIXmlParser@DirectUI@@QEAAXXZ
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJPEBGPEAUHINSTANCE__@@1@Z
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@0@Z
?CreateElement@DUIXmlParser@DirectUI@@QEAAJPEBGPEAVElement@2@1PEAKPEAPEAV32@@Z
?GetUnset@Value@DirectUI@@SAPEAV12@XZ
GetFontCache
?GetCount@Pages@DirectUI@@QEAAIXZ
?GetPage@Pages@DirectUI@@QEAAPEAVElement@2@I@Z
UnInitProcessPriv
?Destroy@Element@DirectUI@@QEAAJ_N@Z
?DestroyAll@Element@DirectUI@@QEAAJ_N@Z
?GetValue@Element@DirectUI@@QEAAPEAVValue@2@P6APEBUPropertyInfo@2@XZHPEAUUpdateCache@2@@Z
?GetValue@Element@DirectUI@@QEAAPEAVValue@2@PEBUPropertyInfo@2@HPEAUUpdateCache@2@@Z
?SetValue@Element@DirectUI@@QEAAJPEBUPropertyInfo@2@HPEAVValue@2@@Z
?RemoveLocalValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZ@Z
?StartDefer@Element@DirectUI@@QEAAXPEAK@Z
?EndDefer@Element@DirectUI@@QEAAXK@Z
?GetContentStringAsDisplayed@Element@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanged@Element@DirectUI@@UEAAXPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnKeyFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?OnMouseFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?FireEvent@Element@DirectUI@@QEAAXPEAUEvent@2@_N1@Z
?GetContentSize@Element@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?Add@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?Add@Element@DirectUI@@QEAAJPEAV12@@Z
?Insert@Element@DirectUI@@UEAAJPEAPEAV12@II@Z
?Remove@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z
?IsDescendent@Element@DirectUI@@QEAA_NPEAV12@@Z
?GetAdjacent@Element@DirectUI@@UEAAPEAV12@PEAV12@HPEBUNavReference@2@K@Z
RegisterPVLBehaviorFactory
?s_uButtonFocusChangeMsg@XElement@DirectUI@@2IB
?_OnUIStateChanged@HWNDElement@DirectUI@@MEAAXGG@Z
?Initialize@HWNDElement@DirectUI@@QEAAJPEAUHWND__@@_NIPEAVElement@2@PEAK@Z
??1HWNDElement@DirectUI@@UEAA@XZ
??0HWNDElement@DirectUI@@QEAA@XZ
?GetAccessibleImpl@HWNDElement@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
?GetClassInfoPtr@HWNDElement@DirectUI@@SAPEAUIClassInfo@2@XZ
?FindShortcut@HWNDElement@DirectUI@@SA_NGPEAVElement@2@PEAPEAV32@PEAH2H@Z
?GetKeyFocusedElement@HWNDElement@DirectUI@@SAPEAVElement@2@XZ
?GetWindowClassNameAndStyle@HWNDElement@DirectUI@@UEAAXPEAPEBGPEAI@Z
?WndProc@HWNDElement@DirectUI@@UEAA_JPEAUHWND__@@I_K_J@Z
?CreateStyleParser@HWNDElement@DirectUI@@UEAAJPEAPEAVDUIXmlParser@2@@Z
?RemoveTooltip@HWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z
?ActivateTooltip@HWNDElement@DirectUI@@UEAAXPEAVElement@2@K@Z
?UpdateTooltip@HWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z
?OnCompositionChanged@HWNDElement@DirectUI@@UEAAXXZ
?OnWmSettingChanged@HWNDElement@DirectUI@@UEAAX_K_J@Z
?OnWmThemeChanged@HWNDElement@DirectUI@@UEAAX_K_J@Z
?OnGetDlgCode@HWNDElement@DirectUI@@UEAAXPEAUtagMSG@@PEA_J@Z
?OnNoChildWithShortcutFound@HWNDElement@DirectUI@@UEAAXPEAUKeyboardEvent@2@@Z
?OnInput@HWNDElement@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?OnImmersiveColorSchemeChanged@HWNDElement@DirectUI@@UEAAXXZ
?OnThemeChanged@HWNDElement@DirectUI@@UEAAXPEAUThemeChangedEvent@2@@Z
?OnEvent@HWNDElement@DirectUI@@UEAAXPEAUEvent@2@@Z
?OnDestroy@HWNDElement@DirectUI@@UEAAXXZ
?OnGroupChanged@HWNDElement@DirectUI@@UEAAXH_N@Z
?OnPropertyChanged@HWNDElement@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?GetType@DCSurface@DirectUI@@UEBA?AW4EType@Surface@2@XZ
??1DCSurface@DirectUI@@UEAA@XZ
??0DCSurface@DirectUI@@QEAA@PEAUHDC__@@@Z
InitProcessPriv
?Click@Button@DirectUI@@SA?AVUID@@XZ
InitThread
?CreateHostWindow@NativeHWNDHost@DirectUI@@UEAAPEAUHWND__@@KPEBG0KHHHHPEAU3@PEAUHMENU__@@PEAUHINSTANCE__@@PEAX@Z
??1NativeHWNDHost@DirectUI@@UEAA@XZ
?Initialize@NativeHWNDHost@DirectUI@@QEAAJPEBG0PEAUHWND__@@PEAUHICON__@@HHHHHHPEAUHINSTANCE__@@I@Z
??0NativeHWNDHost@DirectUI@@QEAA@XZ
?Host@NativeHWNDHost@DirectUI@@QEAAXPEAVElement@2@@Z
?Destroy@NativeHWNDHost@DirectUI@@QEAAXXZ
?GetClassInfoPtr@CCPushButton@DirectUI@@SAPEAUIClassInfo@2@XZ
?GetClassInfoPtr@TouchButton@DirectUI@@SAPEAUIClassInfo@2@XZ
?Click@TouchButton@DirectUI@@SA?AVUID@@XZ
StrToID
?GetUiaFocusDelegate@Element@DirectUI@@UEAAPEAV12@XZ
?HandleUiaEventListener@Element@DirectUI@@UEAAXPEAUEvent@2@@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@@Z
?HandleUiaPropertyListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?HandleUiaDestroyListener@Element@DirectUI@@UEAAXXZ
?GetElementProviderImpl@Element@DirectUI@@UEAAJPEAVInvokeHelper@2@PEAPEAVElementProvider@2@@Z
?GetUIAElementProvider@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?DefaultAction@Element@DirectUI@@UEAAJXZ
?KeyWithinProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?ActiveProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?BackgroundProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?ForegroundProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?DesiredSizeProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?WidthProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?VisibleProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?KeyboardNavigate@Element@DirectUI@@SA?AVUID@@XZ
?GetRoot@Element@DirectUI@@QEAAPEAV12@XZ
?OnUnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
?OnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MEAAXHH@Z
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UEAAXPEAUtagRECT@@@Z
?_UpdateDesiredSize@Element@DirectUI@@QEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?MessageCallback@Element@DirectUI@@UEAAIPEAUtagGMSG@@@Z
?RemoveBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
?AddBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
?RemoveListener@Element@DirectUI@@QEAAXPEAUIElementListener@2@@Z
?AddListener@Element@DirectUI@@QEAAJPEAUIElementListener@2@@Z
?SetKeyFocus@Element@DirectUI@@UEAAXXZ
?EnsureVisible@Element@DirectUI@@UEAA_NHHHH@Z
duser
GetGadgetFocus
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-libraryloader-l1-2-1
FindResourceW
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-atoms-l1-1-0
GlobalAddAtomW
GlobalDeleteAtom
GlobalGetAtomNameW
api-ms-win-core-sidebyside-l1-1-0
ActivateActCtx
CreateActCtxW
ReleaseActCtx
DeactivateActCtx
api-ms-win-core-file-l1-1-0
GetFullPathNameW
api-ms-win-core-memory-l1-1-0
WriteProcessMemory
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFileExistsW
PathUnExpandEnvStringsW
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
156KB
Virtual Size
153KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
64KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
160B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
24KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=68, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33138,
count=23, id=260, version=33138,
count=552, id=1, productName=Unmarked objects,
count=13, id=257, version=33138,
count=10, id=261, version=33138,
count=1, id=256, version=33138,
count=24, id=264, version=33138,
count=1, id=255, version=33138,
count=1, id=258, version=33138,
xwtpw32.dll
- IMPHASH 8457450187728081e6cd8405961ab839
- SHA256 a01e42b253ddc619c5969901a52088c28aa2a8502309034af8d9b141a9e29c2a
- MD5 1a9d836a6bd1faada9e4aa6e8ba5c705
- SHA1 5c232dfc70634ed07b825d0f4cfa3af9b5f414fc
- SHA512 517a3f5895482e9098b65f767692b5d92dad4ce835b8efd20769acd99dae38af8a40ff84764de372e67bf65637fe472019d690bfb58e0a38917ef3555aa9992f
- SSDEEP 3072:KjORy/lPpJW5KnjFMnjyAxr4HYFlg2FI4u+SVTNBvi/2YoOvS:K1/lPpJW4u+Ar7gOuXJvi/2Yd
- TLSH T152F3281EB2A850AAC065813889934659DB72B4382F1257EF23E0C37D6F337D47E35E69
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7680
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
xwtpw32.pdb
msvcrt
_amsg_exit
__C_specific_handler
__CxxFrameHandler4
_vsnwprintf
towlower
tolower
memmove
memcpy
_initterm
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
??_V@YAXPEAX@Z
memcpy_s
_purecall
_errno
realloc
??3@YAXPEAX@Z
?terminate@@YAXXZ
_lock
_unlock
__RTDynamicCast
free
malloc
??1type_info@@UEAA@XZ
_onexit
wcsncpy_s
__CxxFrameHandler3
__dllonexit
_callnewh
_XcptFilter
memset
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
GetModuleHandleA
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadResource
FindResourceExW
GetModuleFileNameW
GetModuleFileNameA
DisableThreadLibraryCalls
SizeofResource
api-ms-win-core-processthreads-l1-1-0
TlsGetValue
TlsAlloc
TlsSetValue
GetCurrentProcessId
TlsFree
GetCurrentProcess
GetCurrentThreadId
TerminateProcess
api-ms-win-core-synch-l1-1-0
CreateMutexW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
ReleaseMutex
InitializeCriticalSection
api-ms-win-core-com-l1-1-0
CoCreateGuid
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CLSIDFromString
StringFromGUID2
api-ms-win-core-registry-l1-1-0
RegDeleteValueW
RegOpenKeyExW
RegCreateKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegCloseKey
RegSetValueExW
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventWriteTransfer
EventUnregister
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableFlags
UnregisterTraceGuids
GetTraceLoggerHandle
RegisterTraceGuidsW
TraceMessage
GetTraceEnableLevel
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
SetLastError
GetLastError
RaiseException
UnhandledExceptionFilter
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
DebugBreak
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiA
lstrcmpiW
gdi32
GetObjectW
CreateFontIndirectW
DeleteObject
user32
LoadStringW
CallWindowProcW
PostMessageW
GetWindowRect
GetFocus
DestroyWindow
SetWindowPos
MessageBoxW
GetPropW
SetWindowLongPtrW
SendMessageW
RemovePropW
GetSystemMetrics
MessageBeep
GetWindowLongPtrW
IsWindow
EnumPropsA
PeekMessageW
EnumPropsExW
EnumPropsW
PostQuitMessage
EnumPropsExA
GetParent
LoadImageW
GetWindowTextW
FindWindowExW
SetPropW
dui70
?Create@DUIXmlParser@DirectUI@@SAJPEAPEAV12@P6APEAVValue@2@PEBGPEAX@Z2P6AX11H2@Z2@Z
InitThread
?AddListener@Element@DirectUI@@QEAAJPEAUIElementListener@2@@Z
?Destroy@Element@DirectUI@@QEAAJ_N@Z
?SetAccessible@Element@DirectUI@@QEAAJ_N@Z
??0IXProviderCP@DirectUI@@QEAA@XZ
UnInitThread
CreateDUIWrapperEx
InitProcessPriv
?Destroy@DUIXmlParser@DirectUI@@QEAAXXZ
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@0@Z
?CreateElement@DUIXmlParser@DirectUI@@QEAAJPEBGPEAVElement@2@1PEAKPEAPEAV32@@Z
UnInitProcessPriv
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapReAlloc
HeapAlloc
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-libraryloader-l1-2-1
FindResourceW
LoadLibraryW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-atoms-l1-1-0
GlobalGetAtomNameW
GlobalAddAtomW
GlobalDeleteAtom
api-ms-win-core-sidebyside-l1-1-0
DeactivateActCtx
ReleaseActCtx
CreateActCtxW
ActivateActCtx
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-file-l1-1-0
GetFullPathNameW
api-ms-win-core-memory-l1-1-0
WriteProcessMemory
api-ms-win-core-shlwapi-legacy-l1-1-0
PathUnExpandEnvStringsW
PathFileExistsW
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
84KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
20KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=68, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33138,
count=23, id=260, version=33138,
count=236, id=1, productName=Unmarked objects,
count=11, id=257, version=33138,
count=10, id=261, version=33138,
count=1, id=256, version=33138,
count=21, id=264, version=33138,
count=1, id=255, version=33138,
count=1, id=258, version=33138,
ze_loader.dll
- IMPHASH 29b57bf2548b89ebc933ecd551bbecf9
- SHA256 0584e7611ede9c32718aefe63e1dfa22b1ecf6ac1154123459234abb184ec37a
- MD5 8198793d3adfedd297f12121af221b46
- SHA1 fd2590c26646cc8bf1b33a8cebf55a2af1e73459
- SHA512 e52ca9654f6525c5280474e1b39d60ccd458da44e51f30a9c8e1678f33149af4a9c2e321a7c7c7b9cd4965754b369e131c5f4e367cbdc04217d6e2e41644e8d0
- SSDEEP 6144:cv5zzSlDvDHMK08h6RHc1XiohS3e+kNJ:flDvDt0Pc1yob
- TLSH T18F844B1AB2A50866E9B2A239C9738506E7F2BC410714C7EF1374465B2FB77D0A63B770
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
41:fa:42:c5:d8:4f:ad:37:d3:d3:42:3c:25:d9:af:0a:8a:0a:94:ce:60:d4:61:fe:a9:0d:07:b0:c5:47:7c:f6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 6, 2023
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
41:fa:42:c5:d8:4f:ad:37:d3:d3:42:3c:25:d9:af:0a:8a:0a:94:ce:60:d4:61:fe:a9:0d:07:b0:c5:47:7c:f6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 8, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c4:50:21:ba:6e:d8:5a:72:ad:00:00:00:00:00:c4
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 17, 2021 - Jun 16, 2022
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:897A-E356-1701,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:60:07:20:f0:92:48:da:be:eb:00:00:00:00:01:60
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 14, 2021 - Apr 11, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 10, 2022 - Mar 8, 2023
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:FC41-4BD4-D220,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:b9:f6:00:0d:65:54:4f:bc:03:00:01:00:00:01:b9
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 20, 2022 - Dec 14, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
128336
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\project\build\bin\Release\ze_loader.pdb
cfgmgr32
CM_Open_DevNode_Key
CM_Locate_DevNodeW
CM_Get_DevNode_Status
CM_Get_Device_ID_List_SizeW
CM_Get_Device_ID_ListW
kernel32
WriteConsoleW
CreateFileW
GetEnvironmentVariableA
GetProcAddress
FreeLibrary
LoadLibraryExA
InitOnceBeginInitialize
InitOnceComplete
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetModuleHandleW
EncodePointer
DecodePointer
MultiByteToWideChar
WideCharToMultiByte
LCMapStringEx
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
SetFilePointerEx
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetStdHandle
HeapSize
CloseHandle
ole32
StringFromGUID2
advapi32
RegOpenKeyA
RegQueryValueExA
RegCloseKey
zeCommandListAppendBarrier
zeCommandListAppendEventReset
zeCommandListAppendImageCopy
zeCommandListAppendImageCopyFromMemory
zeCommandListAppendImageCopyFromMemoryExt
zeCommandListAppendImageCopyRegion
zeCommandListAppendImageCopyToMemory
zeCommandListAppendImageCopyToMemoryExt
zeCommandListAppendLaunchCooperativeKernel
zeCommandListAppendLaunchKernel
zeCommandListAppendLaunchKernelIndirect
zeCommandListAppendLaunchMultipleKernelsIndirect
zeCommandListAppendMemAdvise
zeCommandListAppendMemoryCopy
zeCommandListAppendMemoryCopyFromContext
zeCommandListAppendMemoryCopyRegion
zeCommandListAppendMemoryFill
zeCommandListAppendMemoryPrefetch
zeCommandListAppendMemoryRangesBarrier
zeCommandListAppendQueryKernelTimestamps
zeCommandListAppendSignalEvent
zeCommandListAppendWaitOnEvents
zeCommandListAppendWriteGlobalTimestamp
zeCommandListClose
zeCommandListCreate
zeCommandListCreateImmediate
zeCommandListDestroy
zeCommandListReset
zeCommandQueueCreate
zeCommandQueueDestroy
zeCommandQueueExecuteCommandLists
zeCommandQueueSynchronize
zeContextCreate
zeContextCreateEx
zeContextDestroy
zeContextEvictImage
zeContextEvictMemory
zeContextGetStatus
zeContextMakeImageResident
zeContextMakeMemoryResident
zeContextSystemBarrier
zeDeviceCanAccessPeer
zeDeviceGet
zeDeviceGetCacheProperties
zeDeviceGetCommandQueueGroupProperties
zeDeviceGetComputeProperties
zeDeviceGetExternalMemoryProperties
zeDeviceGetGlobalTimestamps
zeDeviceGetImageProperties
zeDeviceGetMemoryAccessProperties
zeDeviceGetMemoryProperties
zeDeviceGetModuleProperties
zeDeviceGetP2PProperties
zeDeviceGetProperties
zeDeviceGetStatus
zeDeviceGetSubDevices
zeDevicePciGetPropertiesExt
zeDeviceReserveCacheExt
zeDeviceSetCacheAdviceExt
zeDriverGet
zeDriverGetApiVersion
zeDriverGetExtensionFunctionAddress
zeDriverGetExtensionProperties
zeDriverGetIpcProperties
zeDriverGetProperties
zeEventCreate
zeEventDestroy
zeEventHostReset
zeEventHostSignal
zeEventHostSynchronize
zeEventPoolCloseIpcHandle
zeEventPoolCreate
zeEventPoolDestroy
zeEventPoolGetIpcHandle
zeEventPoolOpenIpcHandle
zeEventQueryKernelTimestamp
zeEventQueryStatus
zeEventQueryTimestampsExp
zeFenceCreate
zeFenceDestroy
zeFenceHostSynchronize
zeFenceQueryStatus
zeFenceReset
zeGetCommandListProcAddrTable
zeGetCommandQueueProcAddrTable
zeGetContextProcAddrTable
zeGetDeviceProcAddrTable
zeGetDriverProcAddrTable
zeGetEventExpProcAddrTable
zeGetEventPoolProcAddrTable
zeGetEventProcAddrTable
zeGetFenceProcAddrTable
zeGetGlobalProcAddrTable
zeGetImageExpProcAddrTable
zeGetImageProcAddrTable
zeGetKernelExpProcAddrTable
zeGetKernelProcAddrTable
zeGetMemProcAddrTable
zeGetModuleBuildLogProcAddrTable
zeGetModuleProcAddrTable
zeGetPhysicalMemProcAddrTable
zeGetSamplerProcAddrTable
zeGetVirtualMemProcAddrTable
zeImageCreate
zeImageDestroy
zeImageGetAllocPropertiesExt
zeImageGetMemoryPropertiesExp
zeImageGetProperties
zeImageViewCreateExp
zeInit
zeKernelCreate
zeKernelDestroy
zeKernelGetIndirectAccess
zeKernelGetName
zeKernelGetProperties
zeKernelGetSourceAttributes
zeKernelSchedulingHintExp
zeKernelSetArgumentValue
zeKernelSetCacheConfig
zeKernelSetGlobalOffsetExp
zeKernelSetGroupSize
zeKernelSetIndirectAccess
zeKernelSuggestGroupSize
zeKernelSuggestMaxCooperativeGroupCount
zeLoaderGetTracingHandle
zeLoaderInit
zeMemAllocDevice
zeMemAllocHost
zeMemAllocShared
zeMemCloseIpcHandle
zeMemFree
zeMemFreeExt
zeMemGetAddressRange
zeMemGetAllocProperties
zeMemGetIpcHandle
zeMemOpenIpcHandle
zeModuleBuildLogDestroy
zeModuleBuildLogGetString
zeModuleCreate
zeModuleDestroy
zeModuleDynamicLink
zeModuleGetFunctionPointer
zeModuleGetGlobalPointer
zeModuleGetKernelNames
zeModuleGetNativeBinary
zeModuleGetProperties
zeModuleInspectLinkageExt
zePhysicalMemCreate
zePhysicalMemDestroy
zeSamplerCreate
zeSamplerDestroy
zeVirtualMemFree
zeVirtualMemGetAccessAttribute
zeVirtualMemMap
zeVirtualMemQueryPageSize
zeVirtualMemReserve
zeVirtualMemSetAccessAttribute
zeVirtualMemUnmap
zelGetTracerApiProcAddrTable
zelLoaderDriverCheck
zelLoaderGetVersions
zelLoaderGetVersionsInternal
zelLoaderTranslateHandle
zelLoaderTranslateHandleInternal
zelTracerCommandListAppendBarrierRegisterCallback
zelTracerCommandListAppendEventResetRegisterCallback
zelTracerCommandListAppendImageCopyFromMemoryExtRegisterCallback
zelTracerCommandListAppendImageCopyFromMemoryRegisterCallback
zelTracerCommandListAppendImageCopyRegionRegisterCallback
zelTracerCommandListAppendImageCopyRegisterCallback
zelTracerCommandListAppendImageCopyToMemoryExtRegisterCallback
zelTracerCommandListAppendImageCopyToMemoryRegisterCallback
zelTracerCommandListAppendLaunchCooperativeKernelRegisterCallback
zelTracerCommandListAppendLaunchKernelIndirectRegisterCallback
zelTracerCommandListAppendLaunchKernelRegisterCallback
zelTracerCommandListAppendLaunchMultipleKernelsIndirectRegisterCallback
zelTracerCommandListAppendMemAdviseRegisterCallback
zelTracerCommandListAppendMemoryCopyFromContextRegisterCallback
zelTracerCommandListAppendMemoryCopyRegionRegisterCallback
zelTracerCommandListAppendMemoryCopyRegisterCallback
zelTracerCommandListAppendMemoryFillRegisterCallback
zelTracerCommandListAppendMemoryPrefetchRegisterCallback
zelTracerCommandListAppendMemoryRangesBarrierRegisterCallback
zelTracerCommandListAppendQueryKernelTimestampsRegisterCallback
zelTracerCommandListAppendSignalEventRegisterCallback
zelTracerCommandListAppendWaitOnEventsRegisterCallback
zelTracerCommandListAppendWriteGlobalTimestampRegisterCallback
zelTracerCommandListCloseRegisterCallback
zelTracerCommandListCreateImmediateRegisterCallback
zelTracerCommandListCreateRegisterCallback
zelTracerCommandListDestroyRegisterCallback
zelTracerCommandListResetRegisterCallback
zelTracerCommandQueueCreateRegisterCallback
zelTracerCommandQueueDestroyRegisterCallback
zelTracerCommandQueueExecuteCommandListsRegisterCallback
zelTracerCommandQueueSynchronizeRegisterCallback
zelTracerContextCreateExRegisterCallback
zelTracerContextCreateRegisterCallback
zelTracerContextDestroyRegisterCallback
zelTracerContextEvictImageRegisterCallback
zelTracerContextEvictMemoryRegisterCallback
zelTracerContextGetStatusRegisterCallback
zelTracerContextMakeImageResidentRegisterCallback
zelTracerContextMakeMemoryResidentRegisterCallback
zelTracerContextSystemBarrierRegisterCallback
zelTracerCreate
zelTracerDestroy
zelTracerDeviceCanAccessPeerRegisterCallback
zelTracerDeviceGetCachePropertiesRegisterCallback
zelTracerDeviceGetCommandQueueGroupPropertiesRegisterCallback
zelTracerDeviceGetComputePropertiesRegisterCallback
zelTracerDeviceGetExternalMemoryPropertiesRegisterCallback
zelTracerDeviceGetGlobalTimestampsRegisterCallback
zelTracerDeviceGetImagePropertiesRegisterCallback
zelTracerDeviceGetMemoryAccessPropertiesRegisterCallback
zelTracerDeviceGetMemoryPropertiesRegisterCallback
zelTracerDeviceGetModulePropertiesRegisterCallback
zelTracerDeviceGetP2PPropertiesRegisterCallback
zelTracerDeviceGetPropertiesRegisterCallback
zelTracerDeviceGetRegisterCallback
zelTracerDeviceGetStatusRegisterCallback
zelTracerDeviceGetSubDevicesRegisterCallback
zelTracerDevicePciGetPropertiesExtRegisterCallback
zelTracerDeviceReserveCacheExtRegisterCallback
zelTracerDeviceSetCacheAdviceExtRegisterCallback
zelTracerDriverGetApiVersionRegisterCallback
zelTracerDriverGetExtensionFunctionAddressRegisterCallback
zelTracerDriverGetExtensionPropertiesRegisterCallback
zelTracerDriverGetIpcPropertiesRegisterCallback
zelTracerDriverGetPropertiesRegisterCallback
zelTracerDriverGetRegisterCallback
zelTracerEventCreateRegisterCallback
zelTracerEventDestroyRegisterCallback
zelTracerEventHostResetRegisterCallback
zelTracerEventHostSignalRegisterCallback
zelTracerEventHostSynchronizeRegisterCallback
zelTracerEventPoolCloseIpcHandleRegisterCallback
zelTracerEventPoolCreateRegisterCallback
zelTracerEventPoolDestroyRegisterCallback
zelTracerEventPoolGetIpcHandleRegisterCallback
zelTracerEventPoolOpenIpcHandleRegisterCallback
zelTracerEventQueryKernelTimestampRegisterCallback
zelTracerEventQueryStatusRegisterCallback
zelTracerEventQueryTimestampsExpRegisterCallback
zelTracerFenceCreateRegisterCallback
zelTracerFenceDestroyRegisterCallback
zelTracerFenceHostSynchronizeRegisterCallback
zelTracerFenceQueryStatusRegisterCallback
zelTracerFenceResetRegisterCallback
zelTracerImageCreateRegisterCallback
zelTracerImageDestroyRegisterCallback
zelTracerImageGetAllocPropertiesExtRegisterCallback
zelTracerImageGetMemoryPropertiesExpRegisterCallback
zelTracerImageGetPropertiesRegisterCallback
zelTracerImageViewCreateExpRegisterCallback
zelTracerInitRegisterCallback
zelTracerKernelCreateRegisterCallback
zelTracerKernelDestroyRegisterCallback
zelTracerKernelGetIndirectAccessRegisterCallback
zelTracerKernelGetNameRegisterCallback
zelTracerKernelGetPropertiesRegisterCallback
zelTracerKernelGetSourceAttributesRegisterCallback
zelTracerKernelSchedulingHintExpRegisterCallback
zelTracerKernelSetArgumentValueRegisterCallback
zelTracerKernelSetCacheConfigRegisterCallback
zelTracerKernelSetGlobalOffsetExpRegisterCallback
zelTracerKernelSetGroupSizeRegisterCallback
zelTracerKernelSetIndirectAccessRegisterCallback
zelTracerKernelSuggestGroupSizeRegisterCallback
zelTracerKernelSuggestMaxCooperativeGroupCountRegisterCallback
zelTracerMemAllocDeviceRegisterCallback
zelTracerMemAllocHostRegisterCallback
zelTracerMemAllocSharedRegisterCallback
zelTracerMemCloseIpcHandleRegisterCallback
zelTracerMemFreeExtRegisterCallback
zelTracerMemFreeRegisterCallback
zelTracerMemGetAddressRangeRegisterCallback
zelTracerMemGetAllocPropertiesRegisterCallback
zelTracerMemGetIpcHandleRegisterCallback
zelTracerMemOpenIpcHandleRegisterCallback
zelTracerModuleBuildLogDestroyRegisterCallback
zelTracerModuleBuildLogGetStringRegisterCallback
zelTracerModuleCreateRegisterCallback
zelTracerModuleDestroyRegisterCallback
zelTracerModuleDynamicLinkRegisterCallback
zelTracerModuleGetFunctionPointerRegisterCallback
zelTracerModuleGetGlobalPointerRegisterCallback
zelTracerModuleGetKernelNamesRegisterCallback
zelTracerModuleGetNativeBinaryRegisterCallback
zelTracerModuleGetPropertiesRegisterCallback
zelTracerModuleInspectLinkageExtRegisterCallback
zelTracerPhysicalMemCreateRegisterCallback
zelTracerPhysicalMemDestroyRegisterCallback
zelTracerSamplerCreateRegisterCallback
zelTracerSamplerDestroyRegisterCallback
zelTracerSetEnabled
zelTracerSetEpilogues
zelTracerSetPrologues
zelTracerVirtualMemFreeRegisterCallback
zelTracerVirtualMemGetAccessAttributeRegisterCallback
zelTracerVirtualMemMapRegisterCallback
zelTracerVirtualMemQueryPageSizeRegisterCallback
zelTracerVirtualMemReserveRegisterCallback
zelTracerVirtualMemSetAccessAttributeRegisterCallback
zelTracerVirtualMemUnmapRegisterCallback
zesDeviceEnumDiagnosticTestSuites
zesDeviceEnumEngineGroups
zesDeviceEnumFabricPorts
zesDeviceEnumFans
zesDeviceEnumFirmwares
zesDeviceEnumFrequencyDomains
zesDeviceEnumLeds
zesDeviceEnumMemoryModules
zesDeviceEnumPerformanceFactorDomains
zesDeviceEnumPowerDomains
zesDeviceEnumPsus
zesDeviceEnumRasErrorSets
zesDeviceEnumSchedulers
zesDeviceEnumStandbyDomains
zesDeviceEnumTemperatureSensors
zesDeviceEventRegister
zesDeviceGetCardPowerDomain
zesDeviceGetProperties
zesDeviceGetState
zesDevicePciGetBars
zesDevicePciGetProperties
zesDevicePciGetState
zesDevicePciGetStats
zesDeviceProcessesGetState
zesDeviceReset
zesDiagnosticsGetProperties
zesDiagnosticsGetTests
zesDiagnosticsRunTests
zesDriverEventListen
zesDriverEventListenEx
zesEngineGetActivity
zesEngineGetProperties
zesFabricPortGetConfig
zesFabricPortGetLinkType
zesFabricPortGetProperties
zesFabricPortGetState
zesFabricPortGetThroughput
zesFabricPortSetConfig
zesFanGetConfig
zesFanGetProperties
zesFanGetState
zesFanSetDefaultMode
zesFanSetFixedSpeedMode
zesFanSetSpeedTableMode
zesFirmwareFlash
zesFirmwareGetProperties
zesFrequencyGetAvailableClocks
zesFrequencyGetProperties
zesFrequencyGetRange
zesFrequencyGetState
zesFrequencyGetThrottleTime
zesFrequencyOcGetCapabilities
zesFrequencyOcGetFrequencyTarget
zesFrequencyOcGetIccMax
zesFrequencyOcGetMode
zesFrequencyOcGetTjMax
zesFrequencyOcGetVoltageTarget
zesFrequencyOcSetFrequencyTarget
zesFrequencyOcSetIccMax
zesFrequencyOcSetMode
zesFrequencyOcSetTjMax
zesFrequencyOcSetVoltageTarget
zesFrequencySetRange
zesGetDeviceProcAddrTable
zesGetDiagnosticsProcAddrTable
zesGetDriverProcAddrTable
zesGetEngineProcAddrTable
zesGetFabricPortProcAddrTable
zesGetFanProcAddrTable
zesGetFirmwareProcAddrTable
zesGetFrequencyProcAddrTable
zesGetLedProcAddrTable
zesGetMemoryProcAddrTable
zesGetPerformanceFactorProcAddrTable
zesGetPowerProcAddrTable
zesGetPsuProcAddrTable
zesGetRasProcAddrTable
zesGetSchedulerProcAddrTable
zesGetStandbyProcAddrTable
zesGetTemperatureProcAddrTable
zesLedGetProperties
zesLedGetState
zesLedSetColor
zesLedSetState
zesMemoryGetBandwidth
zesMemoryGetProperties
zesMemoryGetState
zesPerformanceFactorGetConfig
zesPerformanceFactorGetProperties
zesPerformanceFactorSetConfig
zesPowerGetEnergyCounter
zesPowerGetEnergyThreshold
zesPowerGetLimits
zesPowerGetProperties
zesPowerSetEnergyThreshold
zesPowerSetLimits
zesPsuGetProperties
zesPsuGetState
zesRasGetConfig
zesRasGetProperties
zesRasGetState
zesRasSetConfig
zesSchedulerGetCurrentMode
zesSchedulerGetProperties
zesSchedulerGetTimeoutModeProperties
zesSchedulerGetTimesliceModeProperties
zesSchedulerSetComputeUnitDebugMode
zesSchedulerSetExclusiveMode
zesSchedulerSetTimeoutMode
zesSchedulerSetTimesliceMode
zesStandbyGetMode
zesStandbyGetProperties
zesStandbySetMode
zesTemperatureGetConfig
zesTemperatureGetProperties
zesTemperatureGetState
zesTemperatureSetConfig
zetCommandListAppendMetricMemoryBarrier
zetCommandListAppendMetricQueryBegin
zetCommandListAppendMetricQueryEnd
zetCommandListAppendMetricStreamerMarker
zetContextActivateMetricGroups
zetDebugAcknowledgeEvent
zetDebugAttach
zetDebugDetach
zetDebugGetRegisterSetProperties
zetDebugInterrupt
zetDebugReadEvent
zetDebugReadMemory
zetDebugReadRegisters
zetDebugResume
zetDebugWriteMemory
zetDebugWriteRegisters
zetDeviceGetDebugProperties
zetGetCommandListProcAddrTable
zetGetContextProcAddrTable
zetGetDebugProcAddrTable
zetGetDeviceProcAddrTable
zetGetKernelProcAddrTable
zetGetMetricGroupExpProcAddrTable
zetGetMetricGroupProcAddrTable
zetGetMetricProcAddrTable
zetGetMetricQueryPoolProcAddrTable
zetGetMetricQueryProcAddrTable
zetGetMetricStreamerProcAddrTable
zetGetModuleProcAddrTable
zetGetTracerExpProcAddrTable
zetKernelGetProfileInfo
zetMetricGet
zetMetricGetProperties
zetMetricGroupCalculateMetricValues
zetMetricGroupCalculateMultipleMetricValuesExp
zetMetricGroupGet
zetMetricGroupGetProperties
zetMetricQueryCreate
zetMetricQueryDestroy
zetMetricQueryGetData
zetMetricQueryPoolCreate
zetMetricQueryPoolDestroy
zetMetricQueryReset
zetMetricStreamerClose
zetMetricStreamerOpen
zetMetricStreamerReadData
zetModuleGetDebugInfo
zetTracerExpCreate
zetTracerExpDestroy
zetTracerExpSetEnabled
zetTracerExpSetEpilogues
zetTracerExpSetPrologues
Name
.text
Size
224KB
Virtual Size
223KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
109KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
384B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=27412,
count=154, id=261, version=27412,
count=14, id=260, version=30034,
count=10, id=259, version=30034,
count=72, id=261, version=30034,
count=2, id=253, version=28518,
count=21, id=260, version=27412,
count=9, id=257, version=27412,
count=139, id=1, productName=Unmarked objects,
count=19, id=261, productName=VS2019 v16.11.6 build 30137, version=30137,
count=1, id=256, productName=VS2019 v16.11.6 build 30137, version=30137,
count=1, id=255, productName=VS2019 v16.11.6 build 30137, version=30137,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.11.6 build 30137, version=30137,
ze_tracing_layer.dll
- IMPHASH cc740e021649bf1a632f8d7a9220fadb
- SHA256 12dbedd805e0cc4b4979b23e510b27e28b92737793b7c5890b4229ea856b4962
- MD5 82e87fbcae83f7d6b568dc7911fd1336
- SHA1 bde0c9328135c09e5c39b7efdbbce927248e029f
- SHA512 782a1b28a8f4a391d5c491e330af226f7ff0740490e4a1e36172316e81ded0aab7d2c0171ea42602bc77678ac27dba3d1aec501ace8ab130dbaea8b0b1ba1890
- SSDEEP 6144:3feMUZABKSEqoPKqtVlJVYoYrMBdw+9xoh8svidLx:v7CZPKGlJVYEdT9xoILx
- TLSH T129A47D3162A4047DD537A1398A47BD42FBB1780B031196EB13A8D5FA2F6B3D06A3F791
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
9c:01:82:e0:94:92:e3:f9:41:eb:e3:8c:b1:07:36:8a:fe:d1:72:6f:c7:ef:85:32:d0:f9:2e:ad:9e:0a:71:91
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 6, 2023
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
9c:01:82:e0:94:92:e3:f9:41:eb:e3:8c:b1:07:36:8a:fe:d1:72:6f:c7:ef:85:32:d0:f9:2e:ad:9e:0a:71:91
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 8, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c4:50:21:ba:6e:d8:5a:72:ad:00:00:00:00:00:c4
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 17, 2021 - Jun 16, 2022
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:86DF-4BBC-9335,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:8c:01:97:62:47:36:76:66:3b:00:01:00:00:01:8c
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 28, 2021 - Jan 26, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 10, 2022 - Mar 8, 2023
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:7880-E390-8014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:a8:55:f0:61:a9:cc:30:18:5c:00:01:00:00:01:a8
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 2, 2022 - May 11, 2023
Minor OS version
0
Major OS version
6
Entry point
207024
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\project\build\bin\Release\ze_tracing_layer.pdb
kernel32
QueryPerformanceCounter
QueryPerformanceFrequency
CloseHandle
Sleep
GetCurrentThreadId
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
WideCharToMultiByte
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringEx
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
InitializeSListHead
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
HeapAlloc
HeapFree
GetStdHandle
GetFileType
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
ReadFile
ReadConsoleW
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
HeapSize
CreateFileW
WriteConsoleW
RtlUnwind
zeGetCommandListProcAddrTable
zeGetCommandQueueProcAddrTable
zeGetContextProcAddrTable
zeGetDeviceProcAddrTable
zeGetDriverProcAddrTable
zeGetEventExpProcAddrTable
zeGetEventPoolProcAddrTable
zeGetEventProcAddrTable
zeGetFenceProcAddrTable
zeGetGlobalProcAddrTable
zeGetImageExpProcAddrTable
zeGetImageProcAddrTable
zeGetKernelExpProcAddrTable
zeGetKernelProcAddrTable
zeGetMemProcAddrTable
zeGetModuleBuildLogProcAddrTable
zeGetModuleProcAddrTable
zeGetPhysicalMemProcAddrTable
zeGetSamplerProcAddrTable
zeGetVirtualMemProcAddrTable
zelGetTracerApiProcAddrTable
zelLoaderGetVersion
zelTracerCommandListAppendBarrierRegisterCallback
zelTracerCommandListAppendEventResetRegisterCallback
zelTracerCommandListAppendImageCopyFromMemoryExtRegisterCallback
zelTracerCommandListAppendImageCopyFromMemoryRegisterCallback
zelTracerCommandListAppendImageCopyRegionRegisterCallback
zelTracerCommandListAppendImageCopyRegisterCallback
zelTracerCommandListAppendImageCopyToMemoryExtRegisterCallback
zelTracerCommandListAppendImageCopyToMemoryRegisterCallback
zelTracerCommandListAppendLaunchCooperativeKernelRegisterCallback
zelTracerCommandListAppendLaunchKernelIndirectRegisterCallback
zelTracerCommandListAppendLaunchKernelRegisterCallback
zelTracerCommandListAppendLaunchMultipleKernelsIndirectRegisterCallback
zelTracerCommandListAppendMemAdviseRegisterCallback
zelTracerCommandListAppendMemoryCopyFromContextRegisterCallback
zelTracerCommandListAppendMemoryCopyRegionRegisterCallback
zelTracerCommandListAppendMemoryCopyRegisterCallback
zelTracerCommandListAppendMemoryFillRegisterCallback
zelTracerCommandListAppendMemoryPrefetchRegisterCallback
zelTracerCommandListAppendMemoryRangesBarrierRegisterCallback
zelTracerCommandListAppendQueryKernelTimestampsRegisterCallback
zelTracerCommandListAppendSignalEventRegisterCallback
zelTracerCommandListAppendWaitOnEventsRegisterCallback
zelTracerCommandListAppendWriteGlobalTimestampRegisterCallback
zelTracerCommandListCloseRegisterCallback
zelTracerCommandListCreateImmediateRegisterCallback
zelTracerCommandListCreateRegisterCallback
zelTracerCommandListDestroyRegisterCallback
zelTracerCommandListResetRegisterCallback
zelTracerCommandQueueCreateRegisterCallback
zelTracerCommandQueueDestroyRegisterCallback
zelTracerCommandQueueExecuteCommandListsRegisterCallback
zelTracerCommandQueueSynchronizeRegisterCallback
zelTracerContextCreateExRegisterCallback
zelTracerContextCreateRegisterCallback
zelTracerContextDestroyRegisterCallback
zelTracerContextEvictImageRegisterCallback
zelTracerContextEvictMemoryRegisterCallback
zelTracerContextGetStatusRegisterCallback
zelTracerContextMakeImageResidentRegisterCallback
zelTracerContextMakeMemoryResidentRegisterCallback
zelTracerContextSystemBarrierRegisterCallback
zelTracerCreate
zelTracerDestroy
zelTracerDeviceCanAccessPeerRegisterCallback
zelTracerDeviceGetCachePropertiesRegisterCallback
zelTracerDeviceGetCommandQueueGroupPropertiesRegisterCallback
zelTracerDeviceGetComputePropertiesRegisterCallback
zelTracerDeviceGetExternalMemoryPropertiesRegisterCallback
zelTracerDeviceGetGlobalTimestampsRegisterCallback
zelTracerDeviceGetImagePropertiesRegisterCallback
zelTracerDeviceGetMemoryAccessPropertiesRegisterCallback
zelTracerDeviceGetMemoryPropertiesRegisterCallback
zelTracerDeviceGetModulePropertiesRegisterCallback
zelTracerDeviceGetP2PPropertiesRegisterCallback
zelTracerDeviceGetPropertiesRegisterCallback
zelTracerDeviceGetRegisterCallback
zelTracerDeviceGetStatusRegisterCallback
zelTracerDeviceGetSubDevicesRegisterCallback
zelTracerDevicePciGetPropertiesExtRegisterCallback
zelTracerDeviceReserveCacheExtRegisterCallback
zelTracerDeviceSetCacheAdviceExtRegisterCallback
zelTracerDriverGetApiVersionRegisterCallback
zelTracerDriverGetExtensionFunctionAddressRegisterCallback
zelTracerDriverGetExtensionPropertiesRegisterCallback
zelTracerDriverGetIpcPropertiesRegisterCallback
zelTracerDriverGetPropertiesRegisterCallback
zelTracerDriverGetRegisterCallback
zelTracerEventCreateRegisterCallback
zelTracerEventDestroyRegisterCallback
zelTracerEventHostResetRegisterCallback
zelTracerEventHostSignalRegisterCallback
zelTracerEventHostSynchronizeRegisterCallback
zelTracerEventPoolCloseIpcHandleRegisterCallback
zelTracerEventPoolCreateRegisterCallback
zelTracerEventPoolDestroyRegisterCallback
zelTracerEventPoolGetIpcHandleRegisterCallback
zelTracerEventPoolOpenIpcHandleRegisterCallback
zelTracerEventQueryKernelTimestampRegisterCallback
zelTracerEventQueryStatusRegisterCallback
zelTracerEventQueryTimestampsExpRegisterCallback
zelTracerFenceCreateRegisterCallback
zelTracerFenceDestroyRegisterCallback
zelTracerFenceHostSynchronizeRegisterCallback
zelTracerFenceQueryStatusRegisterCallback
zelTracerFenceResetRegisterCallback
zelTracerImageCreateRegisterCallback
zelTracerImageDestroyRegisterCallback
zelTracerImageGetAllocPropertiesExtRegisterCallback
zelTracerImageGetMemoryPropertiesExpRegisterCallback
zelTracerImageGetPropertiesRegisterCallback
zelTracerImageViewCreateExpRegisterCallback
zelTracerInitRegisterCallback
zelTracerKernelCreateRegisterCallback
zelTracerKernelDestroyRegisterCallback
zelTracerKernelGetIndirectAccessRegisterCallback
zelTracerKernelGetNameRegisterCallback
zelTracerKernelGetPropertiesRegisterCallback
zelTracerKernelGetSourceAttributesRegisterCallback
zelTracerKernelSchedulingHintExpRegisterCallback
zelTracerKernelSetArgumentValueRegisterCallback
zelTracerKernelSetCacheConfigRegisterCallback
zelTracerKernelSetGlobalOffsetExpRegisterCallback
zelTracerKernelSetGroupSizeRegisterCallback
zelTracerKernelSetIndirectAccessRegisterCallback
zelTracerKernelSuggestGroupSizeRegisterCallback
zelTracerKernelSuggestMaxCooperativeGroupCountRegisterCallback
zelTracerMemAllocDeviceRegisterCallback
zelTracerMemAllocHostRegisterCallback
zelTracerMemAllocSharedRegisterCallback
zelTracerMemCloseIpcHandleRegisterCallback
zelTracerMemFreeExtRegisterCallback
zelTracerMemFreeRegisterCallback
zelTracerMemGetAddressRangeRegisterCallback
zelTracerMemGetAllocPropertiesRegisterCallback
zelTracerMemGetIpcHandleRegisterCallback
zelTracerMemOpenIpcHandleRegisterCallback
zelTracerModuleBuildLogDestroyRegisterCallback
zelTracerModuleBuildLogGetStringRegisterCallback
zelTracerModuleCreateRegisterCallback
zelTracerModuleDestroyRegisterCallback
zelTracerModuleDynamicLinkRegisterCallback
zelTracerModuleGetFunctionPointerRegisterCallback
zelTracerModuleGetGlobalPointerRegisterCallback
zelTracerModuleGetKernelNamesRegisterCallback
zelTracerModuleGetNativeBinaryRegisterCallback
zelTracerModuleGetPropertiesRegisterCallback
zelTracerModuleInspectLinkageExtRegisterCallback
zelTracerPhysicalMemCreateRegisterCallback
zelTracerPhysicalMemDestroyRegisterCallback
zelTracerSamplerCreateRegisterCallback
zelTracerSamplerDestroyRegisterCallback
zelTracerSetEnabled
zelTracerSetEpilogues
zelTracerSetPrologues
zelTracerVirtualMemFreeRegisterCallback
zelTracerVirtualMemGetAccessAttributeRegisterCallback
zelTracerVirtualMemMapRegisterCallback
zelTracerVirtualMemQueryPageSizeRegisterCallback
zelTracerVirtualMemReserveRegisterCallback
zelTracerVirtualMemSetAccessAttributeRegisterCallback
zelTracerVirtualMemUnmapRegisterCallback
Name
.text
Size
329KB
Virtual Size
329KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
92KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
384B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=27412,
count=19, id=260, version=27412,
count=164, id=261, version=27412,
count=14, id=260, version=30034,
count=10, id=259, version=30034,
count=79, id=261, version=30034,
count=3, id=257, version=27412,
count=135, id=1, productName=Unmarked objects,
count=6, id=261, productName=VS2019 v16.11.6 build 30137, version=30137,
count=1, id=256, productName=VS2019 v16.11.6 build 30137, version=30137,
count=1, id=255, productName=VS2019 v16.11.6 build 30137, version=30137,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.11.6 build 30137, version=30137,
ze_validation_layer.dll
- IMPHASH ee97861aae9ec5766031c542c399e52b
- SHA256 200d1c1639940444574ef478b30384cf0550eae814d011b80d42cc7756d3ede5
- MD5 7eb34fde2c0e4c1c5f33c36cf1ac332e
- SHA1 e6a58a9393b49522b3dd3db0a15891d20dd7df00
- SHA512 00e8d3c7b65d4a73200af206938de744642fc542865354e174b5f1e8a7ab63ebad0fddacc2801c9c10f752542fa1046d08e890552cdfbece333ba9bb51cb572d
- SSDEEP 3072:RVoS0l61elAXn1aTEVC+pvmbSYJJMP/GmXo7lP+Y:votuelOaTEVCQmO3XnY
- TLSH T1C8E3292766F9409FF6A1523481BB4B42B7B6B452131A5BFF0220524D1FD3BD4AC7AAF0
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
14:6f:77:e8:db:95:08:fc:d5:5a:82:12:a6:3e:cf:a6:05:a8:7b:b6:7f:02:65:f7:b5:37:8c:c8:a8:c7:07:b3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 6, 2023
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
14:6f:77:e8:db:95:08:fc:d5:5a:82:12:a6:3e:cf:a6:05:a8:7b:b6:7f:02:65:f7:b5:37:8c:c8:a8:c7:07:b3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 8, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c4:50:21:ba:6e:d8:5a:72:ad:00:00:00:00:00:c4
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 17, 2021 - Jun 16, 2022
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:86DF-4BBC-9335,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:8c:01:97:62:47:36:76:66:3b:00:01:00:00:01:8c
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 28, 2021 - Jan 26, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 10, 2022 - Mar 8, 2023
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:7880-E390-8014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:a8:55:f0:61:a9:cc:30:18:5c:00:01:00:00:01:a8
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 2, 2022 - May 11, 2023
Minor OS version
0
Major OS version
6
Entry point
36512
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\project\build\bin\Release\ze_validation_layer.pdb
kernel32
GetEnvironmentVariableA
WriteConsoleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
zeGetCommandListProcAddrTable
zeGetCommandQueueProcAddrTable
zeGetContextProcAddrTable
zeGetDeviceProcAddrTable
zeGetDriverProcAddrTable
zeGetEventExpProcAddrTable
zeGetEventPoolProcAddrTable
zeGetEventProcAddrTable
zeGetFenceProcAddrTable
zeGetGlobalProcAddrTable
zeGetImageExpProcAddrTable
zeGetImageProcAddrTable
zeGetKernelExpProcAddrTable
zeGetKernelProcAddrTable
zeGetMemProcAddrTable
zeGetModuleBuildLogProcAddrTable
zeGetModuleProcAddrTable
zeGetPhysicalMemProcAddrTable
zeGetSamplerProcAddrTable
zeGetVirtualMemProcAddrTable
zelLoaderGetVersion
zesGetDeviceProcAddrTable
zesGetDiagnosticsProcAddrTable
zesGetDriverProcAddrTable
zesGetEngineProcAddrTable
zesGetFabricPortProcAddrTable
zesGetFanProcAddrTable
zesGetFirmwareProcAddrTable
zesGetFrequencyProcAddrTable
zesGetLedProcAddrTable
zesGetMemoryProcAddrTable
zesGetPerformanceFactorProcAddrTable
zesGetPowerProcAddrTable
zesGetPsuProcAddrTable
zesGetRasProcAddrTable
zesGetSchedulerProcAddrTable
zesGetStandbyProcAddrTable
zesGetTemperatureProcAddrTable
zetGetCommandListProcAddrTable
zetGetContextProcAddrTable
zetGetDebugProcAddrTable
zetGetDeviceProcAddrTable
zetGetKernelProcAddrTable
zetGetMetricGroupExpProcAddrTable
zetGetMetricGroupProcAddrTable
zetGetMetricProcAddrTable
zetGetMetricQueryPoolProcAddrTable
zetGetMetricQueryProcAddrTable
zetGetMetricStreamerProcAddrTable
zetGetModuleProcAddrTable
zetGetTracerExpProcAddrTable
Name
.text
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
384B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=260, version=27412,
count=6, id=259, version=27412,
count=133, id=261, version=27412,
count=30, id=261, version=30034,
count=14, id=260, version=30034,
count=9, id=259, version=30034,
count=3, id=257, version=27412,
count=85, id=1, productName=Unmarked objects,
count=4, id=261, productName=VS2019 v16.11.6 build 30137, version=30137,
count=1, id=256, productName=VS2019 v16.11.6 build 30137, version=30137,
count=1, id=255, productName=VS2019 v16.11.6 build 30137, version=30137,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.11.6 build 30137, version=30137,
zipcontainer.dll
- IMPHASH c006ed01753cceae850bb163312eb850
- SHA256 446677b69d24d02d467544be6a92eba127987ce5ea9b780b2f31fe6153934ab6
- MD5 5b7532ae42fafc46d5e5aa0897b52d11
- SHA1 2b399f0f54f3f139eb6df68684a98d75971e2f0e
- SHA512 a49cbc3dfd5921d1c32ebef3f02025ff40623536151a9e88982c3f835534ed22ffa69e983ee72acad22a995a56379fe7e2499f2e07ee777e5d07208ad644cae3
- SSDEEP 3072:MqW04stXpEtEeCBxO6eMnOMAnHIq1vQELq:9W04stX+ye6xWfMi1jL
- TLSH T139C35A556AB400F1D7B291B9C9930AAEE371B054239017DF834492AE2F17BF42F393E6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4928
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ZipContainer.pdb
msvcrt
_lock
_initterm
_amsg_exit
_XcptFilter
_callnewh
__CxxFrameHandler3
free
memset
_onexit
_wcsicmp
_vsnwprintf
__dllonexit
__C_specific_handler
malloc
_unlock
memcpy
memmove
api-ms-win-core-file-l1-1-0
SetEndOfFile
SetFilePointer
CreateDirectoryW
CreateFileW
WriteFile
ReadFile
DeleteFileW
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
api-ms-win-core-synch-l1-1-0
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
api-ms-win-core-file-l1-2-0
GetTempPathW
api-ms-win-core-com-l1-1-0
CoCreateGuid
StringFromGUID2
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateFileStream
ZipContainerCreateArchiveOnFile
ZipContainerInitialize
ZipContainerUninitialize
Name
.text
Size
64KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
476B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=28, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=4, id=259, version=33145,
count=24, id=260, version=33145,
count=57, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=7, id=261, version=33145,
count=1, id=256, version=33145,
count=10, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
zipfldr.dll
- IMPHASH 6ca47055a988ec38670063fff87021c1
- SHA256 cc1af30b69536e2e3302342ed97bf3b4741361014bbaa61a1e1e0ae101c78357
- MD5 2661a083540d999f23aeb71e51091797
- SHA1 69c3a22e494bf08eed917cc70c8b52045343bb42
- SHA512 18183928e943e588a15317b813f6a891a85573a1106f6631e24617775aa838cfc0c3dc57d88402db4294cc5a9f7fc06051487e3479e8a6c49de42e202f38d24f
- SSDEEP 12288:7CotwJQHJokSck2VZyUwRicQ6KcLGNGiyzPB:7CoOJ//cKUP6KcL7RPB
- TLSH T169D45C5D67ED11E9D17AD13CC983461AE6B2343113215ACB06A0C2BE9F2BFE8673DB11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
219408
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
zipfldr.pdb
api-ms-win-crt-string-l1-1-0
wcsncmp
strcmp
strncmp
memset
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__mktime32
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o_abort
_o_calloc
_o_ceilf
memmove
_o_free
_o_iswspace
_o_malloc
_o_qsort
_o_wcscpy_s
__C_specific_handler
__CxxFrameHandler3
_o__localtime32
_o__ismbstrail
wcsrchr
wcsstr
__std_terminate
__CxxFrameHandler4
wcschr
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__gmtime32
_o__getdrive
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__access
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_CxxThrowException
memcmp
memcpy
propsys
VariantToStringArrayAlloc
VariantCompare
VariantToPropVariant
PSCreatePropertyChangeArray
PSFormatForDisplay
PropVariantToVariant
PSCreateSimplePropertyChange
InitVariantFromFileTime
VariantToBuffer
PropVariantGetElementCount
PSCreateMemoryPropertyStore
InitVariantFromStrRet
InitVariantFromBuffer
shell32
ord256
SHBindToFolderIDListParentEx
SHCreateItemFromParsingName
SHBindToFolderIDListParent
ord781
ord19
ord16
SHGetFileInfoW
SHGetPathFromIDListW
ord17
ord75
SHGetKnownFolderPath
SHGetSpecialFolderPathW
ord239
SHChangeNotify
SHGetNameFromIDList
AssocCreateForClasses
SHGetStockIconInfo
SHCreateShellItemArrayFromDataObject
ExtractIconExW
ord73
ord744
SHGetSpecialFolderLocation
ShellExecuteExW
DragQueryFileW
SHParseDisplayName
ord155
SHCreateItemFromIDList
ord743
ord18
ord760
ord28
SHGetItemFromDataObject
SHAddToRecentDocs
ord853
ord21
ord67
SHBindToParent
SHChangeNotifySuspendResume
SHCreateDataObject
ord190
SHFileOperationW
SHGetIDListFromObject
SHBindToObject
ord165
ord25
ord152
ord714
SHGetFolderPathEx
ShellExecuteW
SHCreateItemWithParent
shlwapi
ord215
ord158
ord157
PathIsUNCW
ord500
ord503
ord172
PathFindFileNameW
ord16
PathCombineW
PathStripToRootW
PathSkipRootW
PathRemoveFileSpecW
PathStripPathW
PathFileExistsW
ord446
ord218
ord199
ord501
StrCmpNIW
ord174
ord186
PathRemoveBackslashW
PathAddBackslashW
SHAutoComplete
ord516
StrTrimW
PathIsRelativeW
PathIsDirectoryW
ord517
PathRemoveBlanksW
ord176
SHCreateStreamOnFileW
ord540
PathRemoveExtensionW
ord346
PathCompactPathW
ord619
StrChrW
ord476
ord502
StrCmpIW
PathIsPrefixW
StrDupW
ord456
PathCanonicalizeW
AssocCreate
ord231
ord216
PathMatchSpecExA
PathIsSameRootW
PathFindExtensionA
ord354
StrFormatKBSizeW
ord388
PathFindExtensionW
ord219
PathGetDriveNumberW
ord485
StrRetToBufW
SHStrDupW
ord217
PathAppendW
archiveint
archive_write_add_filter
archive_read_has_encrypted_entries
archive_error_string
archive_errno
archive_read_next_header
archive_read_open_filename_w
archive_read_support_filter_all
archive_read_support_format_raw
archive_read_support_format_all
archive_read_free
archive_read_data_block
archive_entry_birthtime
archive_entry_birthtime_nsec
archive_entry_birthtime_is_set
archive_entry_atime
archive_entry_atime_nsec
archive_entry_atime_is_set
archive_entry_mtime_is_set
archive_write_free
archive_entry_free
archive_entry_linkresolver_free
archive_write_data
archive_write_header
archive_entry_set_fflags
archive_entry_set_mode
archive_entry_set_rdev
archive_entry_set_gid
archive_entry_set_uid
archive_entry_set_size
archive_entry_set_nlink
archive_entry_set_ino64
archive_entry_set_dev
archive_entry_set_ctime
archive_entry_set_birthtime
archive_entry_set_mtime
archive_entry_set_atime
archive_read_new
archive_entry_set_symlink_type
archive_entry_copy_sourcepath_w
archive_entry_copy_pathname_w
archive_entry_clear
archive_entry_sourcepath_w
archive_entry_linkify
archive_entry_linkresolver_set_strategy
archive_entry_linkresolver_new
archive_entry_new2
archive_write_open
archive_write_set_bytes_in_last_block
archive_write_set_bytes_per_block
archive_write_set_option
archive_entry_copy_symlink_w
archive_write_set_options
archive_write_set_format
archive_write_new
archive_entry_hardlink_w
archive_set_error
archive_write_fail
archive_read_set_format_option
archive_entry_size
archive_entry_mtime
archive_entry_mtime_nsec
archive_format
archive_entry_mode
archive_entry_pathname_w
archive_entry_symlink_w
archive_entry_symlink_type
archive_entry_filetype
archive_entry_fflags
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
FindStringOrdinal
DisableThreadLibraryCalls
FindResourceExW
LockResource
GetModuleFileNameW
GetProcAddress
GetModuleHandleExA
GetModuleHandleW
LoadStringW
GetModuleHandleExW
LoadLibraryExW
FreeResource
SizeofResource
LoadResource
GetModuleFileNameA
api-ms-win-core-synch-l1-1-0
WaitForSingleObjectEx
CreateMutexExW
ReleaseSRWLockExclusive
ReleaseMutex
AcquireSRWLockExclusive
CreateEventW
AcquireSRWLockShared
ReleaseSRWLockShared
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
SetEvent
CreateEventExW
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
OpenSemaphoreW
ResetEvent
InitializeCriticalSection
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetProcessId
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
IsDBCSLeadByte
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-heap-l2-1-0
GlobalAlloc
LocalFree
LocalAlloc
GlobalFree
api-ms-win-core-com-l1-1-0
CoCreateFreeThreadedMarshaler
CoGetCallContext
CoTaskMemRealloc
CoTaskMemFree
CoUnmarshalInterface
CoUninitialize
CoInitializeEx
CoGetInterfaceAndReleaseStream
CoReleaseMarshalData
CoCreateInstance
PropVariantClear
CoMarshalInterThreadInterfaceInStream
CoTaskMemAlloc
api-ms-win-core-string-l1-1-0
CompareStringW
MultiByteToWideChar
WideCharToMultiByte
CompareStringOrdinal
api-ms-win-eventing-provider-l1-1-0
EventActivityIdControl
EventWriteTransfer
EventUnregister
EventRegister
EventSetInformation
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-path-l1-1-0
PathCchAppendEx
PathCchAppend
PathCchRemoveFileSpec
PathCchCanonicalizeEx
PathAllocCombine
PathCchSkipRoot
PathCchCombine
api-ms-win-core-file-l1-1-0
GetDriveTypeW
SetFileInformationByHandle
GetFullPathNameW
SetFileAttributesW
WriteFile
GetDriveTypeA
RemoveDirectoryW
FileTimeToLocalFileTime
CompareFileTime
GetFileTime
GetFileInformationByHandle
ReadFile
CreateFileA
FindNextFileA
LocalFileTimeToFileTime
GetFileAttributesExA
GetFileAttributesExW
GetFinalPathNameByHandleW
CreateDirectoryW
FindFirstFileExW
GetDiskFreeSpaceExW
GetFileSizeEx
FindFirstFileA
CreateFileW
FindFirstFileW
DeleteFileW
GetFileAttributesW
FindNextFileW
SetFilePointer
GetVolumeInformationW
SetFileTime
FindClose
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
FindResourceW
api-ms-win-core-string-l2-1-0
CharLowerW
CharUpperW
CharNextW
CharUpperBuffW
api-ms-win-security-credentials-l1-1-0
CredFree
CredWriteW
CredReadW
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
api-ms-win-core-file-l1-2-3
GetTempPath2W
api-ms-win-core-file-l1-2-0
GetTempPathW
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegGetValueA
api-ms-win-core-processenvironment-l1-1-0
SetCurrentDirectoryW
GetCurrentDirectoryW
oleaut32
SysStringLen
SysFreeString
SysAllocString
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreate
VariantInit
VariantClear
SetErrorInfo
api-ms-win-core-file-l2-1-0
CreateSymbolicLinkW
GetFileInformationByHandleEx
ReplaceFileW
CreateHardLinkW
rpcrt4
UuidToStringW
UuidCreate
RpcStringFreeW
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-file-l2-1-4
GetFileInformationByName
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolQueueTask
gdi32
GetStockObject
kernel32
FileTimeToDosDateTime
lstrlenA
GlobalReAlloc
GlobalHandle
MulDiv
DosDateTimeToFileTime
GlobalUnlock
GlobalSize
GlobalLock
lstrcmpW
lstrlenW
lstrcmpiW
lstrcmpiA
ActivateActCtx
DeactivateActCtx
CreateActCtxW
ReleaseActCtx
lstrcmpA
ntdll
RtlFreeUnicodeString
RtlpEnsureBufferSize
RtlNtPathNameToDosPathName
RtlGetLastNtStatus
RtlIsPartialPlaceholder
WinSqmAddToStream
ole32
CoAllowSetForegroundWindow
CreateBindCtx
ReleaseStgMedium
OleSetClipboard
OleGetClipboard
user32
CreateWindowExW
CharUpperBuffA
CharPrevA
CharToOemBuffA
CharLowerA
CharNextA
DispatchMessageA
PeekMessageA
GetWindowTextLengthW
GetDesktopWindow
DialogBoxParamW
RemoveMenu
GetSubMenu
DestroyMenu
SendMessageW
GetParent
SetWindowLongPtrW
GetWindowLongPtrW
DestroyWindow
TrackPopupMenu
GetForegroundWindow
RegisterClassW
DefWindowProcW
GetAsyncKeyState
SetForegroundWindow
GetWindowRect
GetDlgItemTextW
GetClassNameW
GetWindowLongW
SetMenuDefaultItem
GetWindow
CheckDlgButton
OemToCharBuffA
CharToOemA
LoadMenuW
InsertMenuW
SetWindowTextW
RegisterClipboardFormatW
SendDlgItemMessageW
DestroyIcon
ShowCursor
PostMessageW
EnableWindow
GetDlgItem
SetDlgItemTextW
GetWindowTextW
IsDlgButtonChecked
SetFocus
SetThreadDpiAwarenessContext
PeekMessageW
TranslateMessage
DispatchMessageW
DeleteMenu
EndDialog
SetCursor
LoadCursorW
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
api-ms-win-crt-time-l1-1-0
_time32
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-sysinfo-l1-2-0
GetSystemTimePreciseAsFileTime
DllCanUnloadNow
DllGetClassObject
RouteTheCall
Name
.text
Size
460KB
Virtual Size
458KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
96KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=89, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=21, id=260, version=33145,
count=5, id=259, version=33145,
count=1598, id=1, productName=Unmarked objects,
count=20, id=257, version=33145,
count=25, id=261, version=33145,
count=1, id=256, version=33145,
count=87, id=264, version=33145,
count=5, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
ztrace_maps.dll
- IMPHASH f4ce4a99f4aa4a7ca7fe6c5acbc36e55
- SHA256 a0d77484ce51037be9e16d3f0edbdc46756e9f57ec51950a14338cebe6c61aea
- MD5 095621a692c9430999aeaa7500e34547
- SHA1 89ddb328ee5ab4c7645cd65c9a9d7c02285c3f57
- SHA512 4fdde8f906c8d01adcd7615edd457f706128f0ad0e69e7f4ea39be8a2afd83079c8b1589786ebad0c34b1163d82ceebb56a4d8e63ec6313b2454d809090f0a29
- SSDEEP 768:shCezbTkVmI3WM79AY2ApgYs08m1+e8C:sTT0qY2ApgMUC
- TLSH T16C33295A67590496F8BB833AC0B34B18B272F9205B7287CF1660921D1E33BD4FD36796
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5856
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ztrace_maps.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___stdio_common_vsprintf
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__register_onexit_function
_o__seh_filter_dll
_o___std_type_info_destroy_list
_o_free
_o_malloc
_CxxThrowException
_o___std_exception_destroy
_o___std_exception_copy
__C_specific_handler
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventUnregister
EventWriteTransfer
EventSetInformation
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringA
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
ZTraceClose
ZTraceEnabledHelper
ZTraceHelper
ZTraceHelperNoThis
ZTraceHelperV
ZTraceHelperVC
ZTraceInit
ZTraceReportIgnore
ZTraceReportIgnoreC
ZTraceReportIgnoreNoThis
ZTraceReportOrigination
ZTraceReportOriginationC
ZTraceReportOriginationNoThis
ZTraceReportPropagation
ZTraceReportPropagationC
ZTraceReportPropagationNoThis
ZTraceTestCopyTrace
ZTraceTestForceClose
ZTraceTestInit
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
192B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=31, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1100, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33138,
count=4, id=259, version=33138,
count=17, id=261, version=33138,
count=1, id=256, version=33138,
count=4, id=264, version=33138,
count=1, id=253, version=33138,
count=1, id=255, version=33138,
count=1, id=258, version=33138,