Windows.AI.Agents.zip
- SHA256 4dfba261e914d206c8417ea0fd93a8a760ffef744fabe799ae25f52b0deca527
Overview
overview
7Static
static
3WABSyncProvider.dll
windows10-2004-x64
7WFDSConMgr.dll
windows10-2004-x64
1WFDSConMgrSvc.dll
windows10-2004-x64
1WaaSAssessment.dll
windows10-2004-x64
1WaaSMedicPS.dll
windows10-2004-x64
1WaaSMedicSvc.dll
windows10-2004-x64
1WalletBack...xy.dll
windows10-2004-x64
1WalletProxy.dll
windows10-2004-x64
1WalletService.dll
windows10-2004-x64
1WcnApi.dll
windows10-2004-x64
1WcnEapAuthProxy.dll
windows10-2004-x64
1WcnEapPeerProxy.dll
windows10-2004-x64
1WcnNetsh.dll
windows10-2004-x64
1WebClnt.dll
windows10-2004-x64
1WebRuntimeManager.dll
windows10-2004-x64
1WebcamUi.dll
windows10-2004-x64
1Websocket.dll
windows10-2004-x64
1WerEnc.dll
windows10-2004-x64
1WfHC.dll
windows10-2004-x64
1WiFiCloudStore.dll
windows10-2004-x64
1WiFiConfigSP.dll
windows10-2004-x64
1WiFiDisplay.dll
windows10-2004-x64
1WiaExtensi...64.dll
windows10-2004-x64
1Win32Compa...SP.dll
windows10-2004-x64
1Win32_DeviceGuard.dll
windows10-2004-x64
1WinBioDataModel.dll
windows10-2004-x64
1WindowManagement.dll
windows10-2004-x64
1WindowMana...PI.dll
windows10-2004-x64
1Windows.AI.Agents.dll
windows10-2004-x64
1Windows.AI.Agents.dll
windows11-ltsc_2024-x64
1Windows.Ac...ol.dll
windows10-2004-x64
1vss_ps.dll
windows10-2004-x64
7Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
WABSyncProvider.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
WFDSConMgr.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
WFDSConMgrSvc.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
WaaSAssessment.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
WaaSMedicPS.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
WaaSMedicSvc.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
WalletBackgroundServiceProxy.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
WalletProxy.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
WalletService.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
WcnApi.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
WcnEapAuthProxy.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
WcnEapPeerProxy.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
WcnNetsh.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
WebClnt.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
WebRuntimeManager.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
WebcamUi.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
Websocket.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
WerEnc.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
WfHC.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
WiFiCloudStore.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
WiFiConfigSP.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
WiFiDisplay.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
WiaExtensionHost64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
Win32CompatibilityAppraiserCSP.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
Win32_DeviceGuard.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
WinBioDataModel.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
WindowManagement.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
WindowManagementAPI.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
Windows.AI.Agents.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
Windows.AI.Agents.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
Windows.AccountsControl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
vss_ps.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target Windows.AI.Agents.zip
- Size 17.9MB
- Sample260812-gnf4bazekf
- SHA256 4dfba261e914d206c8417ea0fd93a8a760ffef744fabe799ae25f52b0deca527
- MD5 08696e552700fddb4656e81305f95a5c
- SHA1 043f0755f4bf563d1110cfee27be18c9004369e9
- SHA512 7406dd3ff9b65979ec382e0916c8968b1e3c72a82819e09d3add272270db1429271a1e85c087d72e7ad2fa05f808ea62200592e82f35bbe474d3a4c70abdec28
- SSDEEP 393216:Sbxrt1Sny+2QsZ86YLT9XVWxMgl2XNX+vGsItkFbXRe6Rn2MwwNosUmn2:KtIy+/sZ86YuxVlyZ+espbheYn2JwNol
- TLSH T11E17333290B7440AC70647B3D687C810689C85AFD66238D6F4F6FFD338ED9BEA254646
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 84 IoCs
Checks for missing Authenticode signature.
resource unpack001/WABSyncProvider.dll unpack001/WFDSConMgr.dll unpack001/WFDSConMgrSvc.dll unpack001/WaaSAssessment.dll unpack001/WaaSMedicPS.dll unpack001/WaaSMedicSvc.dll unpack001/WalletBackgroundServiceProxy.dll unpack001/WalletProxy.dll unpack001/WalletService.dll unpack001/WcnApi.dll unpack001/WcnEapAuthProxy.dll unpack001/WcnEapPeerProxy.dll unpack001/WcnNetsh.dll unpack001/WebClnt.dll unpack001/WebRuntimeManager.dll unpack001/WebcamUi.dll unpack001/Websocket.dll unpack001/WfHC.dll unpack001/WiFiCloudStore.dll unpack001/WiFiConfigSP.dll unpack001/WiFiDisplay.dll unpack001/WiaExtensionHost64.dll unpack001/Win32CompatibilityAppraiserCSP.dll unpack001/Win32_DeviceGuard.dll unpack001/WinBioDataModel.dll unpack001/WindowManagement.dll unpack001/Windows.AI.Agents.dll unpack001/Windows.AccountsControl.dll unpack001/vss_ps.dll unpack001/vssapi.dll unpack001/vsstrace.dll unpack001/vulkan-1-999-0-0-0.dll unpack001/w32time.dll unpack001/w32topl.dll unpack001/wavemsp.dll unpack001/wbemcomn.dll unpack001/wbiosrvc.dll unpack001/wc_storage.dll unpack001/wci.dll unpack001/wcimage.dll unpack001/wcmapi.dll unpack001/wcmcsp.dll unpack001/wcmsvc.dll unpack001/wcncsvc.dll unpack001/wcnwiz.dll unpack001/wdc.dll unpack001/wdi.dll unpack001/wdigest.dll unpack001/webauthn.dll unpack001/webcheck.dll unpack001/webplatstorageserver.dll unpack001/wecapi.dll unpack001/wecsvc.dll unpack001/wephostsvc.dll unpack001/werconcpl.dll unpack001/wercplsupport.dll unpack001/werdiagcontroller.dll unpack001/wersvc.dll unpack001/werui.dll unpack001/wevtfwd.dll unpack001/wevtsvc.dll unpack001/wfapigp.dll unpack001/wfdprov.dll unpack001/whesvc.dll unpack001/whesvc_assets.dll unpack001/wiaaut.dll unpack001/wiadefui.dll unpack001/wiadss.dll unpack001/wiarpc.dll unpack001/wiascanprofiles.dll unpack001/wiaservc.dll unpack001/wiashext.dll unpack001/wiatrace.dll unpack001/wifidatacapabilityhandler.dll unpack001/wifinetworkmanager.dll unpack001/win32appinventorycsp.dll unpack001/win32spl.dll unpack001/winbio.dll unpack001/winbioext.dll unpack001/wincorlib.dll unpack001/wincredprovider.dll unpack001/wincredui.dll unpack001/windiag.dll unpack001/windlp.dll - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/vulkan-1.dll
File Explorer
-
Windows.AI.Agents.zip.zip 17.9MB
-
WABSyncProvider.dll.dll 84KB
-
WFDSConMgr.dll.dll 128KB
-
WFDSConMgrSvc.dll.dll 636KB
-
WaaSAssessment.dll.dll 184KB
-
WaaSMedicPS.dll.dll 56KB
-
WaaSMedicSvc.dll.dll 92KB
-
WalletBackgroundServiceProxy.dll.dll 76KB
-
WalletProxy.dll.dll 116KB
-
WalletService.dll.dll 472KB
-
WcnApi.dll.dll 172KB
-
WcnEapAuthProxy.dll.dll 60KB
-
WcnEapPeerProxy.dll.dll 60KB
-
WcnNetsh.dll.dll 68KB
-
WebClnt.dll.dll 248KB
-
WebRuntimeManager.dll.dll 2.4MB
-
WebcamUi.dll.dll 956KB
-
Websocket.dll.dll 68KB
-
WerEnc.dll.dll 53KB
-
WfHC.dll.dll 100KB
-
WiFiCloudStore.dll.dll 372KB
-
WiFiConfigSP.dll.dll 92KB
-
WiFiDisplay.dll.dll 404KB
-
WiaExtensionHost64.dll.dll 36KB
-
Win32CompatibilityAppraiserCSP.dll.dll 304KB
-
Win32_DeviceGuard.dll.dll 132KB
-
WinBioDataModel.dll.dll 576KB
-
WindowManagement.dll.dll 2.4MB
-
WindowManagementAPI.dll.dll 1.7MB
-
Windows.AI.Agents.dll.dll 67KB
-
Windows.AccountsControl.dll.dll 760KB
-
vss_ps.dll.dll 76KB
-
vssapi.dll.dll 1.5MB
-
vsstrace.dll.dll 96KB
-
vulkan-1-999-0-0-0.dll.dll 1.3MB
-
vulkan-1.dll.dll 1.4MB
-
w32time.dll.dll 728KB
-
w32topl.dll.dll 56KB
-
wavemsp.dll.dll 272KB
-
wbemcomn.dll.dll 484KB
-
wbiosrvc.dll.dll 1.1MB
-
wc_storage.dll.dll 328KB
-
wci.dll.dll 56KB
-
wcimage.dll.dll 160KB
-
wcmapi.dll.dll 184KB
-
wcmcsp.dll.dll 272KB
-
wcmsvc.dll.dll 1.3MB
-
wcncsvc.dll.dll 472KB
-
wcnwiz.dll.dll 340KB
-
wdc.dll.dll 816KB
-
wdi.dll.dll 116KB
-
wdigest.dll.dll 308KB
-
wdscore.dll.dll 321KB
-
webauthn.dll.dll 1.9MB
-
webcheck.dll.dll 300KB
-
webio.dll.dll 860KB
-
webplatstorageserver.dll.dll 1.2MB
-
webservices.dll.dll 1.4MB
-
webthreatdefsvc.dll.dll 189KB
-
webthreatdefusersvc.dll.dll 297KB
-
wecapi.dll.dll 96KB
-
wecsvc.dll.dll 256KB
-
wephostsvc.dll.dll 56KB
-
wer.dll.dll 973KB
-
werconcpl.dll.dll 784KB
-
wercplsupport.dll.dll 132KB
-
werdiagcontroller.dll.dll 72KB
-
weretw.dll.dll 247KB
-
wersvc.dll.dll 328KB
-
werui.dll.dll 240KB
-
wevtapi.dll.dll 360KB
-
wevtfwd.dll.dll 116KB
-
wevtsvc.dll.dll 1.2MB
-
wfapigp.dll.dll 56KB
-
wfdprov.dll.dll 68KB
-
whealogr.dll.dll 93KB
-
whesvc.dll.dll 224KB
-
whesvc_assets.dll.dll 364KB
-
whhelper.dll.dll 70KB
-
wiaaut.dll.dll 816KB
-
wiadefui.dll.dll 236KB
-
wiadss.dll.dll 212KB
-
wiarpc.dll.dll 140KB
-
wiascanprofiles.dll.dll 124KB
-
wiaservc.dll.dll 764KB
-
wiashext.dll.dll 116KB
-
wiatrace.dll.dll 44KB
-
wifidatacapabilityhandler.dll.dll 88KB
-
wifinetworkmanager.dll.dll 656KB
-
wimgapi.dll.dll 881KB
-
win32appinventorycsp.dll.dll 128KB
-
win32spl.dll.dll 1.4MB
-
win32u.dll.dll 166KB
-
winbio.dll.dll 236KB
-
winbioext.dll.dll 68KB
-
winbrand.dll.dll 223KB
-
wincorlib.dll.dll 372KB
-
wincredprovider.dll.dll 96KB
-
wincredui.dll.dll 268KB
-
windiag.dll.dll 924KB
-
windlp.dll.dll 820KB
WABSyncProvider.dll
- IMPHASH cb49cd827dc83383dc8f6c1a398f0fb4
- SHA256 610e27700fd37e912be20e218fcab29aee4a27b2861405b20ce264b967a3e55c
- MD5 a154c49aaa416340574126fb4488ae62
- SHA1 e80cae330e78bea6a2e6220e2dfe941fc8c92c46
- SHA512 5808b052e33f5025282e78ae71b93252b6f0a2786b2621733ce7cca8c53a38dd927f6d5288544fee5c48dbadeef368825ee8f5230c062dde8ba45f97b72d615e
- SSDEEP 768:K68xsanH13akT3/7Wt0aZYzgZTjkd1JiRGGMMuHzp+fwq3fbelXieCScOcfopslE:b8SqVWttegZjsFGKHzp+MB/0lv2nld
- TLSH T19F834B0976E8A1E8E165827C89578F16FA31F4112B2246DF13E0436D6F77FD26E38712
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4848
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WABSyncProvider.pdb
msvcrt
memcpy
memcmp
iswdigit
wcstok_s
memmove
__CxxFrameHandler3
?terminate@@YAXXZ
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
free
_callnewh
malloc
_vsnwprintf
_purecall
iswspace
memset
winsync
ord1
winsyncproviders
ord1
winsyncmetastore
ord1
ntdll
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
kernel32
CreateMutexExW
SystemTimeToFileTime
FileTimeToSystemTime
GetFileAttributesExW
DeleteFileW
CompareFileTime
WaitForSingleObject
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetLastError
GetNativeSystemInfo
DeleteCriticalSection
SetLastError
GetModuleHandleExW
ReleaseMutex
CloseHandle
LoadLibraryW
GetProcAddress
FreeLibrary
GetUserDefaultLCID
WideCharToMultiByte
GetModuleFileNameW
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
user32
LoadStringW
ole32
CoCreateGuid
StringFromGUID2
CoTaskMemAlloc
PropVariantCopy
PropVariantClear
CoTaskMemFree
CoCreateInstance
shlwapi
SHDeleteKeyW
ord219
SHRegGetValueW
advapi32
GetTraceEnableFlags
EventUnregister
RegCloseKey
EventRegister
RegCreateKeyExW
TraceMessage
GetTraceLoggerHandle
EventWriteTransfer
RegSetValueExW
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
shell32
SHCreateDirectoryExW
SHGetKnownFolderPath
propsys
PropVariantToString
PSCreateMemoryPropertyStore
PropVariantChangeType
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
44KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
588B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=19, id=260, version=33138,
count=4, id=259, version=33138,
count=92, id=1, productName=Unmarked objects,
count=27, id=257, version=33138,
count=6, id=261, version=33138,
count=1, id=256, version=33138,
count=12, id=264, version=33138,
count=1, id=255, version=33138,
count=1, id=258, version=33138,
WFDSConMgr.dll
- IMPHASH 79449e166cdb75d4aba7c60ef342c0bd
- SHA256 fb7334c4625ddbec74e3152ebb1155156ef757e19f60f7e80f736189267490f9
- MD5 a02f1cdfd393872afce903d6f53748ce
- SHA1 a12b1475005f67bdcae717f7def51e3d595d12d3
- SHA512 9b99e1444ce0e49a85a5c1056bfcfc2c83c2f92b7c1c0ce6e72a2b2154e7c8a239bcfd9ced78c3e796e8e207f5154d90fdd69ba5a5ceca8279921d0f9b067aa3
- SSDEEP 3072:/o8Ls92IzCUfdVPb6Bd0DoHCTgLAMGXHEOVzN7/+Z+T:g8Ls92IGUMZMHTzN7/Y
- TLSH T127D34C5EB26C14A5D476927DCAA20A05E7727839571243EF03A0D07E6F23FE42E39F61
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
6080
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WFDSConMgr.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o_free
_o_malloc
__C_specific_handler
_o__configure_narrow_argv
_o__cexit
_o__callnewh
__CxxFrameHandler4
__std_terminate
_CxxThrowException
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
wcsnlen
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleHandleW
GetProcAddress
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
AcquireSRWLockShared
DeleteCriticalSection
InitializeCriticalSectionEx
EnterCriticalSection
LeaveCriticalSection
CreateEventW
ReleaseSemaphore
WaitForSingleObject
OpenSemaphoreW
CreateMutexExW
ReleaseMutex
CreateSemaphoreExW
WaitForSingleObjectEx
ReleaseSRWLockShared
InitializeSRWLock
ReleaseSRWLockExclusive
rpcrt4
RpcBindingFromStringBindingW
Ndr64AsyncClientCall
NdrClientCall3
RpcBindingFree
RpcStringFreeW
RpcStringBindingComposeW
RpcExceptionFilter
RpcBindingSetAuthInfoExW
RpcAsyncCancelCall
RpcAsyncInitializeHandle
RpcAsyncCompleteCall
api-ms-win-service-management-l1-1-0
OpenServiceW
OpenSCManagerW
CloseServiceHandle
api-ms-win-service-winsvc-l1-1-0
QueryServiceStatus
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
CreateThreadpoolCleanupGroup
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolCleanupGroup
CreateThreadpoolWork
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
SetThreadpoolTimer
CloseThreadpoolWork
CloseThreadpoolCleanupGroupMembers
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-eventing-provider-l1-1-0
EventActivityIdControl
api-ms-win-core-com-l1-1-0
IIDFromString
WFDSConMgrCloseSessionContext
WFDSConMgrConfigureFirewallForInfraCast
WFDSConMgrConnect
WFDSConMgrConnectTransport
WFDSConMgrDisconnect
WFDSConMgrDisconnectTransport
WFDSConMgrFreeMemory
WFDSConMgrGetOpenSessionList
WFDSConMgrGetTransportBitmaskFromMultistring
WFDSConMgrIntCompleteInfracastConnection
WFDSConMgrIntGetInfracastBackchannelParams
WFDSConMgrIntGetRtspConnectionParams
WFDSConMgrNewDiscoveredEntryOverwritesOld
WFDSConMgrOpenSessionContext
WFDSConMgrOpenSessionContextForMacAddress
WFDSConMgrOpenSessionContextForNotification
WFDSConMgrQueryCorrelationId
WFDSConMgrQueryStatus
WFDSConMgrReadCeremonyData
WFDSConMgrSetAllowRemoteInput
WFDSConMgrWriteCeremonyData
Name
.text
Size
72KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
492B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=51, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=21, id=261, version=33145,
count=1172, id=1, productName=Unmarked objects,
count=2, id=257, version=33145,
count=1, id=256, version=33145,
count=21, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WFDSConMgrSvc.dll
- IMPHASH e61bfe8cddc1f781570d0f01fb929cbb
- SHA256 d5a4152f4c8c0c6872efb12a6ddb0a902ef8dc1f8e6d13d0115a920e721e15c8
- MD5 074e7424edbe4ca34961fcdd4a5d44f0
- SHA1 9fa1d80f7fe225c832daf658fa5921cc92f8f8ee
- SHA512 986b3f02f6739142741fe3983ea75b0fc5cab7267ec9d8187d6961e799fa610b2399beab3bc38d3402b51dadb2c7c734cb47d7f1b65fe944589275226adef69a
- SSDEEP 12288:ZJRaSCH8fr0AJmeUWoh+Ae833wMZXRce2PzrP:ZJRaSPDTJNxAe8nDRcewzL
- TLSH T150D4195EA7E80491E0F7C27DCB96470AEE72381A177296CF0261415D2F27FE85B39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
9712
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WFDSConMgrSvc.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsicmp
memmove
_o__wcsnicmp
_o__wtoi
_o_free
_o_malloc
_o_realloc
_o_terminate
_o_towupper
_o_wcscpy_s
_o_wcsncpy_s
__C_specific_handler
__current_exception
__current_exception_context
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
strchr
__std_type_info_compare
wcschr
_CxxThrowException
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
wcsnlen
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
GetTraceEnableFlags
TraceMessage
UnregisterTraceGuids
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
FreeLibrary
GetModuleFileNameA
GetModuleHandleW
DisableThreadLibraryCalls
GetModuleHandleExW
LoadLibraryExW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
OpenThreadToken
GetCurrentProcess
SetThreadToken
GetCurrentThread
TerminateProcess
GetCurrentProcessId
api-ms-win-core-sysinfo-l1-1-0
GetTickCount64
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
deviceassociation
DafStartWriteCeremonyData
DafStartReadCeremonyData
DafStartEnumCeremonies
DafCreateAssociationContext
DafSelectCeremony
DafStartRemoveAssociation
DafCloseAssociationContext
DafCreateChallengeContext
DafChallengeDevicePresence
DafCloseChallengeContext
DafStartFinalize
firewallapi
FWIndicateTupleInUse2
FWResetIndicatedTupleInUse
msvcp_win
_Wcscoll
??1_Lockit@std@@QEAA@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
??Bid@locale@std@@QEAA_KXZ
??0_Lockit@std@@QEAA@H@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Incref@facet@locale@std@@UEAAXXZ
_Wcsxfrm
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??0facet@locale@std@@IEAA@_K@Z
?id@?$ctype@G@std@@2V0locale@2@A
??1facet@locale@std@@MEAA@XZ
?tolower@?$ctype@G@std@@QEBAGG@Z
?id@?$collate@G@std@@2V0locale@2@A
??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?in@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
?is@?$ctype@G@std@@QEBA_NFG@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??0_Locinfo@std@@QEAA@PEBD@Z
?_Random_device@std@@YAIXZ
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ
?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks
SubmitThreadpoolWork
CreateThreadpoolWork
CloseThreadpoolCleanupGroup
CreateThreadpoolWait
SetThreadpoolWait
CreateThreadpoolCleanupGroup
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
CloseThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolCleanupGroupMembers
TrySubmitThreadpoolCallback
api-ms-win-core-synch-l1-1-0
CreateSemaphoreExW
ReleaseSemaphore
WaitForSingleObject
ReleaseMutex
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseSRWLockShared
ResetEvent
CreateMutexExW
SetEvent
AcquireSRWLockShared
DeleteCriticalSection
TryEnterCriticalSection
CreateEventW
AcquireSRWLockExclusive
LeaveCriticalSection
EnterCriticalSection
InitializeSRWLock
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventWriteTransfer
EventActivityIdControl
EventUnregister
EventRegister
api-ms-win-service-core-l1-1-0
RegisterServiceCtrlHandlerExW
SetServiceStatus
api-ms-win-core-threadpool-legacy-l1-1-0
UnregisterWaitEx
rpcrt4
RpcRevertToSelfEx
RpcServerSubscribeForNotification
NdrAsyncServerCall
NdrServerCallAll
Ndr64AsyncServerCallAll
NdrServerCall2
RpcBindingVectorFree
RpcAsyncAbortCall
RpcServerRegisterAuthInfoW
RpcServerRegisterIf3
RpcServerInqCallAttributesW
RpcAsyncCompleteCall
RpcServerInqBindings
RpcEpRegisterW
RpcImpersonateClient
RpcEpUnregister
RpcServerUseProtseqW
RpcServerUnsubscribeForNotification
RpcServerUnregisterIfEx
I_RpcBindingInqTransportType
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-devices-query-l1-1-1
DevCreateObjectQueryFromIdEx
DevCreateObjectQueryEx
api-ms-win-devices-query-l1-1-0
DevGetObjectProperties
DevSetObjectProperties
DevFreeObjectProperties
DevCloseObjectQuery
api-ms-win-core-file-l1-1-0
CreateFileW
api-ms-win-core-io-l1-1-0
CancelIoEx
DeviceIoControl
GetOverlappedResult
api-ms-win-devices-config-l1-1-1
CM_Get_Device_Interface_ListW
CM_Get_Device_Interface_List_SizeW
CM_Unregister_Notification
CM_MapCrToWin32Err
CM_Register_Notification
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegCloseKey
RegOpenCurrentUser
RegGetValueW
RegOpenKeyExW
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-security-base-l1-1-0
RevertToSelf
api-ms-win-dx-d3dkmt-l1-1-1
D3DKMTNetDispQueryMiracastDisplayDeviceSupport
D3DKMTNetDispStopMiracastDisplayDevice
D3DKMTNetDispQueryMiracastDisplayDeviceStatus
D3DKMTNetDispStartMiracastDisplayDeviceEx
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsCreateStringReference
WindowsCreateString
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
ntdll
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWithCompletionCallback
RtlAllocateWnfSerializationGroup
RtlSetIoCompletionCallback
NtQueryWnfStateData
RtlGetDeviceFamilyInfoEnum
RtlPublishWnfStateData
RtlGUIDFromString
ServiceMain
SvchostPushServiceGlobals
Name
.text
Size
436KB
Virtual Size
432KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
148KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
448B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=83, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=1346, id=1, productName=Unmarked objects,
count=6, id=257, version=33145,
count=29, id=261, version=33145,
count=1, id=256, version=33145,
count=56, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WaaSAssessment.dll
- IMPHASH 5363cf7e0dc22fd5b2f973ef8a5e13fc
- SHA256 1d660748ebaf20731829aa817c6deb2cc0dbec52319a5df65076d6585c8399e8
- MD5 ccb21a2f92dc226bca969ddaee70846d
- SHA1 74cb074b03b1902c4a452b73ed20d6e2ee407dca
- SHA512 0b4b7777ecd744b79edcb0fc0ec280ebef0f0147367ef87576cb7bbdc4d47a0de44d7fc7ff1f38642a65cbc16c53f7f7b1741eaf0005c56205d632ba80bb6ef5
- SSDEEP 3072:50kMX8Xrq+6Xc2gewc1TUmxF9w6R4z+C7sK0YF66I0T:9m8Xrq+6Xc2sqUmz9wKuL70Ys6I
- TLSH T19F042A1E33F91099F2B6D27C85660515FA737422272196EF02A0C1BD9F27BD8B939F21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
9280
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WaaSAssessment.pdb
msvcp110_win
?_Xbad_alloc@std@@YAXXZ
msvcrt
memcpy
memcmp
_CxxThrowException
__CxxFrameHandler3
_wtol
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
realloc
_errno
_initterm
_amsg_exit
_XcptFilter
_callnewh
memmove_s
wcsncpy_s
malloc
free
_purecall
wcscat_s
wcscpy_s
memcpy_s
memset
__C_specific_handler
__CxxFrameHandler4
??3@YAXPEAX@Z
??_V@YAXPEAX@Z
_vsnwprintf
??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBV0@@Z
_wtoi
wcsncmp
wcsstr
_wcsupr_s
strncpy_s
_set_errno
strtol
strchr
strrchr
sprintf_s
swscanf_s
wcstok_s
_wtoi64
ntdll
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlPublishWnfStateData
RtlCaptureContext
oleaut32
SysFreeString
SysStringLen
VarUI4FromStr
UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi
SysAllocString
api-ms-win-core-libraryloader-l1-2-0
LoadResource
GetModuleFileNameW
GetModuleHandleExW
GetModuleFileNameA
SizeofResource
FindResourceExW
DisableThreadLibraryCalls
FreeLibrary
GetProcAddress
GetModuleHandleW
LoadLibraryExW
api-ms-win-core-synch-l1-1-0
CreateEventExW
EnterCriticalSection
LeaveCriticalSection
AcquireSRWLockShared
InitializeCriticalSection
CreateMutexExW
ReleaseSRWLockShared
WaitForSingleObjectEx
CreateSemaphoreExW
ReleaseSemaphore
OpenSemaphoreW
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
WaitForSingleObject
ReleaseMutex
AcquireSRWLockExclusive
DeleteCriticalSection
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoWaitForMultipleHandles
StringFromGUID2
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegQueryInfoKeyW
RegCloseKey
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegGetValueW
RegDeleteValueW
RegEnumValueW
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
Sleep
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
GetVersionExW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringA
OutputDebugStringW
DebugBreak
api-ms-win-core-file-l1-1-0
CompareFileTime
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventRegister
EventSetInformation
EventUnregister
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsDeleteString
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
api-ms-win-core-sysinfo-l1-2-0
GetProductInfo
rpcrt4
UuidCreate
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
112KB
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
572B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=62, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=15, id=260, version=33145,
count=165, id=1, productName=Unmarked objects,
count=7, id=257, version=33145,
count=11, id=261, version=33145,
count=1, id=256, version=33145,
count=18, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WaaSMedicPS.dll
- IMPHASH 15746c3ebeaa0cf72ef0ee55b29b1d77
- SHA256 48f777cfab5e308fb85c67c9c6ef53571060568b3210d1cfb5beb0cb527cb49a
- MD5 082411104f59d6454b066411821517da
- SHA1 ade38b02db934aefb8ae7e77257904c16333507d
- SHA512 6c6b73201054663fca1e2190b53c7b2752e56190eba3f257357ce1f80365a1d85c88067c6898c87c75206e3f81517cbd5eb1a9b3cc1ac3f2c01da66c5e21a6c8
- SSDEEP 384:s/efnWNlqboKftTL3gRD+iA/po5e27gc3xWYIWCQd6X7QqkE8quNe:s2y48C/po5e2f3dcw
- TLSH T1E4438289F704DA65D82D4631886B8FAA3735EE590F5243C73225730E1DB63C1AF32AD6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4752
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WaaSMedicPS.pdb
msvcrt
__C_specific_handler
free
malloc
_initterm
_amsg_exit
_XcptFilter
rpcrt4
NdrDllGetClassObject
NdrStubForwardingFunction
IUnknown_Release_Proxy
IUnknown_QueryInterface_Proxy
IUnknown_AddRef_Proxy
NdrOleAllocate
NdrStubCall3
NdrOleFree
NdrDllCanUnloadNow
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
oleaut32
VARIANT_UserUnmarshal64
VARIANT_UserMarshal
BSTR_UserUnmarshal
VARIANT_UserSize
VARIANT_UserUnmarshal
VARIANT_UserFree
BSTR_UserMarshal64
BSTR_UserUnmarshal64
BSTR_UserFree
VARIANT_UserMarshal64
BSTR_UserSize64
VARIANT_UserFree64
BSTR_UserFree64
BSTR_UserMarshal
VARIANT_UserSize64
BSTR_UserSize
api-ms-win-core-winrt-string-l1-1-0
HSTRING_UserSize
HSTRING_UserSize64
HSTRING_UserUnmarshal
HSTRING_UserMarshal64
HSTRING_UserMarshal
HSTRING_UserFree64
HSTRING_UserFree
HSTRING_UserUnmarshal64
api-ms-win-core-com-midlproxystub-l1-1-0
ObjectStublessClient8
ObjectStublessClient7
NdrProxyForwardingFunction3
NdrProxyForwardingFunction4
NdrProxyForwardingFunction6
ObjectStublessClient9
NdrProxyForwardingFunction5
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33145,
count=4, id=259, version=33145,
count=68, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=1, id=256, version=33145,
count=4, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WaaSMedicSvc.dll
- IMPHASH 1c4703cf6c9ff9044b89050580410e20
- SHA256 574e6ae25a2efdb0e03013e8346b81cdcebe4021623ff9e92a2a1937b48a5f69
- MD5 f3fdc6eb4085f15cd4e03d4db4dda59a
- SHA1 832ebe1e7b537a70759bfc2b11dd44681806607d
- SHA512 a92fae892ded2d71427c2ea4a47598349222ad28cab24253732b4cbd1ee2e555ec2b6b7ceed75a73a1ecc918d08df8e085ef6ba297a50654552cb98e2231ce34
- SSDEEP 1536:c2ayZgTNM1VbIuhX/zHM8KijOWsW9SHSX/bUZNH+/Cg1z:c2ayZ6ut6W90qz4H+6g1z
- TLSH T1D6935C6D75A810F6E5B5D17D89830A0AE7B2B415472247DF03A081BE1F63FE46C3EBA1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
8496
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WaasMedicSvc.pdb
msvcp_win
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__callnewh
_o_abort
_o_free
_o_malloc
__C_specific_handler
_CxxThrowException
_o____lc_codepage_func
__std_terminate
__CxxFrameHandler4
_o__cexit
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
GetModuleFileNameW
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleExW
GetProcAddress
GetModuleHandleW
LoadLibraryExW
api-ms-win-core-synch-l1-1-0
SetEvent
CreateMutexExW
ResetEvent
DeleteCriticalSection
WaitForSingleObjectEx
CreateEventW
ReleaseMutex
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
LeaveCriticalSection
ReleaseSemaphore
CreateSemaphoreExW
EnterCriticalSection
OpenSemaphoreW
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageA
FormatMessageW
GetLocaleInfoEx
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoTaskMemAlloc
api-ms-win-core-wow64-l1-1-1
IsWow64Process2
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-psapi-l1-1-0
K32GetModuleFileNameExW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-file-l1-1-0
CreateFileW
GetFileAttributesExW
FindFirstFileW
FindClose
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
DllMain
GeneralizeForImaging
ServiceMain
SvchostPushServiceGlobals
Name
.text
Size
48KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
308B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=58, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=1170, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=23, id=261, version=33145,
count=1, id=256, version=33145,
count=3, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WalletBackgroundServiceProxy.dll
- IMPHASH 686d06fb0a370705d7ac711903478e52
- SHA256 93b64dd33a43989651e5fb3e7fce56189d41d17e2eedd035014790b4836e576e
- MD5 32acb20b3c02041c29bacbad00786a50
- SHA1 256e909bb991ed114320f83ea2662043d31ff4a4
- SHA512 2a06ea856adc78c516eca136ef9f0ee2ed22144a1c9795ee8a7af87b113759f9a925e34f7f5cfa860d6bbf0986658311f1e0fc4bd37baf74fe150a82f7824237
- SSDEEP 1536:QVzNz71AnW+JhKYKLA2c+1IPfUxb5RueEx1rAr:CzNv1A7ALA2c+Eibr61q
- TLSH T1C1733A5D737830E9F562917CC9564A18E6B1B025232166FF03E0C2BDAF67BE86039F91
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5360
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WalletBackgroundServiceProxy.pdb
msvcp110_win
?_Xbad_alloc@std@@YAXXZ
msvcrt
memcmp
_XcptFilter
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
free
_amsg_exit
memset
_callnewh
malloc
memmove_s
_purecall
memcpy_s
_vsnwprintf
??3@YAXPEAX@Z
ntdll
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetProcAddress
GetModuleFileNameA
DisableThreadLibraryCalls
GetModuleHandleExW
api-ms-win-core-synch-l1-1-0
WaitForSingleObject
ReleaseMutex
CreateMutexExW
LeaveCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseSemaphore
EnterCriticalSection
AcquireSRWLockShared
DeleteCriticalSection
WaitForSingleObjectEx
OpenSemaphoreW
InitializeCriticalSectionEx
CreateSemaphoreExW
ReleaseSRWLockShared
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-com-l1-1-0
CoCreateInstance
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-processthreads-l1-1-1
SetProcessMitigationPolicy
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
40KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=30, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33145,
count=5, id=259, version=33145,
count=72, id=1, productName=Unmarked objects,
count=7, id=257, version=33145,
count=3, id=261, version=33145,
count=1, id=256, version=33145,
count=4, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WalletProxy.dll
- IMPHASH d3623e891a08dd10585f2bc62654bb44
- SHA256 6c866bd67360ea94f7b85072d13717586935ec1e4bf814827154b73e0e6c84df
- MD5 881c5444354247c6e4e249bf46ff68b8
- SHA1 c35549c1fc93a299810e9fc910b9c2b3099cd84f
- SHA512 4a7db6ecff7b2fccbe610c7e2070631f3290562e53f7b569e6dd21e3e38d24e15db60626fe07c56f1d57546423182f76e51d398886a8431554ef9633b6c7657b
- SSDEEP 1536:9QWhEUDTYHu1I3i7gpt8m1NbsSoSq09W+jIL7DD:9QNbUSq09W+jIL7/
- TLSH T1AEC3308BFA548CBBC8AD423A445B0F247336DB74678243C706A4522EADB33C65F759C9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4752
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WalletProxy.pdb
msvcrt
_initterm
malloc
_XcptFilter
__C_specific_handler
free
_amsg_exit
rpcrt4
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrOleFree
NdrOleAllocate
oleaut32
BSTR_UserMarshal64
VARIANT_UserMarshal64
VARIANT_UserSize64
LPSAFEARRAY_UserSize64
BSTR_UserSize64
BSTR_UserFree64
LPSAFEARRAY_UserMarshal
LPSAFEARRAY_UserUnmarshal64
BSTR_UserMarshal
BSTR_UserUnmarshal
VARIANT_UserUnmarshal64
VARIANT_UserFree64
VARIANT_UserMarshal
VARIANT_UserSize
VARIANT_UserUnmarshal
LPSAFEARRAY_UserMarshal64
LPSAFEARRAY_UserFree64
BSTR_UserSize
BSTR_UserFree
LPSAFEARRAY_UserSize
BSTR_UserUnmarshal64
LPSAFEARRAY_UserFree
LPSAFEARRAY_UserUnmarshal
VARIANT_UserFree
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
84KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33136,
count=4, id=259, version=33136,
count=55, id=1, productName=Unmarked objects,
count=5, id=257, version=33136,
count=1, id=256, version=33136,
count=34, id=264, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
WalletService.dll
- IMPHASH b294ed1f931ef639454a7d4064646e33
- SHA256 7c7de5341b80b172490d2ffe5a5591d6cf272df0b33ab7c4d63b7a40605ab9bd
- MD5 937ca5fae402cf5ed870104e3db64fba
- SHA1 75642ab8c102c1eec824c74350c10d000fb4d0d1
- SHA512 7147de660737804992bbd967c4b2f57b4c3b84b7ccba83b0d657f5bf89584e2cc37842651743f71febb65f653faef62ea9fe62aea622285a5362590fdfcce4d2
- SSDEEP 12288:ibSKP0mihcMiNWibkdl6hMYxcha/wqpYjrMEVB:RSsObkdsx/wuY/MEVB
- TLSH T12DA43A5E76E407E7C57A823CC6C34205F2B2B4212B539BCB1264C27E6E27BE46E39745
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
9472
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
walletservice.pdb
msvcp110_win
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Winerror_map@std@@YAPEBDH@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Xbad_alloc@std@@YAXXZ
msvcrt
memset
memmove
memcpy
memcmp
floor
ceil
_CxxThrowException
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
realloc
_errno
__CxxFrameHandler3
wcscpy_s
wcschr
swscanf_s
_wtof
_wtol
wcstol
_vsnwprintf_s
_vscwprintf
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
__CxxFrameHandler4
_wcsnicmp
wcstok_s
_wtoi
wcsncpy_s
wcsncmp
strncat_s
sqrt
_vsnprintf
wcsnlen
mbstowcs_s
??3@YAXPEAX@Z
??_V@YAXPEAX@Z
_purecall
_vsnwprintf
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
free
_amsg_exit
_XcptFilter
_callnewh
malloc
_wcsicmp
memmove_s
bsearch_s
memcpy_s
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
WinSqmIncrementDWORD
NtQueryWnfStateData
RtlUnsubscribeWnfStateChangeNotification
RtlGetVersion
WinSqmStartSession
WinSqmEndSession
WinSqmAddToStreamEx
oleaut32
SafeArrayDestroy
SafeArrayLock
SafeArrayRedim
SysAllocStringLen
SafeArrayGetLBound
SysAllocStringByteLen
SysAllocString
VariantClear
SysStringByteLen
SafeArrayUnlock
VarUI4FromStr
VariantInit
SafeArrayCreate
SafeArrayGetVartype
SafeArrayCopy
SysFreeString
SafeArrayGetUBound
SysStringLen
api-ms-win-core-localization-l1-2-0
GetLocaleInfoW
FormatMessageW
GetLocaleInfoEx
api-ms-win-core-libraryloader-l1-2-0
LoadResource
GetModuleHandleExW
FindResourceExW
GetModuleFileNameA
GetProcAddress
LoadStringW
SizeofResource
DisableThreadLibraryCalls
FreeLibrary
GetModuleHandleW
LoadLibraryExW
GetModuleFileNameW
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-synch-l1-1-0
ReleaseSemaphore
SetEvent
ReleaseSRWLockShared
CreateEventW
CreateMutexExW
CreateSemaphoreExW
LeaveCriticalSection
OpenSemaphoreW
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSectionEx
EnterCriticalSection
AcquireSRWLockShared
AcquireSRWLockExclusive
WaitForSingleObjectEx
ReleaseMutex
ReleaseSRWLockExclusive
InitializeCriticalSection
api-ms-win-core-processthreads-l1-1-0
OpenThreadToken
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
RaiseException
UnhandledExceptionFilter
GetLastError
SetLastError
SetUnhandledExceptionFilter
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolWait
CreateThreadpoolWait
SetThreadpoolTimer
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolTimer
WaitForThreadpoolWorkCallbacks
CreateThreadpoolTimer
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
WaitForThreadpoolTimerCallbacks
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegSetValueExW
RegGetValueW
RegQueryValueExW
RegCreateKeyExW
RegEnumKeyExW
RegDeleteValueW
RegCloseKey
RegQueryInfoKeyW
api-ms-win-core-processthreads-l1-1-1
SetProcessMitigationPolicy
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTime
GetSystemTimeAsFileTime
api-ms-win-core-synch-l1-2-0
SleepConditionVariableSRW
InitOnceBeginInitialize
InitOnceComplete
WakeAllConditionVariable
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
combase
ord69
ord67
ord68
ord66
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventSetInformation
EventRegister
EventWriteTransfer
EventActivityIdControl
api-ms-win-service-core-l1-1-0
SetServiceStatus
RegisterServiceCtrlHandlerExW
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
CompareStringW
api-ms-win-core-file-l1-1-0
GetFinalPathNameByHandleW
ReadFile
GetFileAttributesW
DeleteFileW
WriteFile
CreateDirectoryW
FileTimeToLocalFileTime
FindFirstFileW
SetFileAttributesW
FindNextFileW
SetFilePointer
CompareFileTime
CreateFileW
FindClose
api-ms-win-core-path-l1-1-0
PathCchSkipRoot
PathCchRemoveBackslash
PathCchAddBackslash
PathCchStripPrefix
PathAllocCanonicalize
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsCreateStringReference
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
SystemTimeToFileTime
bcrypt
BCryptDestroyKey
BCryptOpenAlgorithmProvider
BCryptImportKey
BCryptExportKey
BCryptCloseAlgorithmProvider
BCryptGenerateSymmetricKey
BCryptGenRandom
BCryptDecrypt
BCryptEncrypt
BCryptGetProperty
api-ms-win-security-base-l1-1-0
GetLengthSid
EqualSid
SetSecurityDescriptorDacl
GetAce
GetTokenInformation
InitializeSecurityDescriptor
InitializeAcl
GetAclInformation
GetSecurityDescriptorDacl
AddAccessAllowedAceEx
GetFileSecurityW
CreateWellKnownSid
ImpersonateLoggedOnUser
SetFileSecurityW
RevertToSelf
rpcrt4
RpcImpersonateClient
I_RpcBindingInqLocalClientPID
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-localization-l2-1-0
GetCurrencyFormatW
GetNumberFormatEx
api-ms-win-core-localization-l1-2-1
EnumSystemLocalesEx
api-ms-win-core-datetime-l1-1-1
GetTimeFormatEx
GetDateFormatEx
api-ms-win-core-localization-l1-2-2
LCIDToLocaleName
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-threadpool-legacy-l1-1-0
UnregisterWaitEx
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFindExtensionW
api-ms-win-core-kernel32-legacy-l1-1-0
MoveFileW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
lstrcmpW
api-ms-win-core-shlwapi-obsolete-l1-1-0
StrTrimW
api-ms-win-core-localization-obsolete-l1-2-0
GetUserDefaultUILanguage
api-ms-win-core-url-l1-1-0
UrlEscapeW
userdatalanguageutil
IsMatchingPrefix
bcp47langs
Bcp47GetDistance
api-ms-win-security-capability-l1-1-0
RpcClientCapabilityCheck
dsclient
DSCreateSharedFileToken
DSRemoveSharingToken
DSOpenSharedFile
DSCopyFromSharedFile
DSGetSharedFileName
DSFreeString
esent
JetGetColumnInfoA
JetGetTableColumnInfoA
JetSetSystemParameterA
JetRetrieveColumn
JetCreateInstanceA
JetAttachDatabaseA
JetResetSessionContext
JetSetSessionContext
JetConvertDDLA
JetUpdate
JetAddColumnA
JetCreateIndex2A
JetDeleteIndexA
JetSetIndexRange
JetGotoBookmark
JetSeek
JetMakeKey
JetMove
JetSetCurrentIndexA
JetPrepareUpdate
JetSetColumns
JetDeleteTableA
JetInit
JetTerm2
JetBeginSessionA
JetSetColumn
JetEndSession
JetDelete
JetCreateDatabaseA
JetCreateTableColumnIndexA
JetBeginTransaction
JetCommitTransaction
JetOpenTableA
JetRollback
JetOpenDatabaseA
JetCloseTable
JetCloseDatabase
xmllite
CreateXmlReader
d2d1
ord1
d3d11
D3D11CreateDevice
dwrite
DWriteCreateFactory
DefaultDisplayNameCallback
ServiceMain
SvchostPushServiceGlobals
Name
.text
Size
280KB
Virtual Size
276KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
144KB
Virtual Size
143KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
376B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=102, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=21, id=260, version=33145,
count=376, id=1, productName=Unmarked objects,
count=25, id=257, version=33145,
count=13, id=261, version=33145,
count=1, id=256, version=33145,
count=77, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WcnApi.dll
- IMPHASH 2f6d58f62e0d8cd52a65c4f4ab3689e1
- SHA256 7144c616981ce83a568f7ef5711cb0e2b931433c12c4d1bb16c0c8f9ce55875d
- MD5 46de3f2a26a230803c233601df83599b
- SHA1 f79f00d2828687f95b85ad0a47ab9e8183a4903d
- SHA512 3af724ae695bf8d0032fce75a3772bebad1296d82448ab53c20c60aa55e1b7986cb0f71f8ac5942e17ae4513eed6f131cdd959a001d418b9b4e229c3c45bf8e4
- SSDEEP 3072:us4SHi/RZ1f0FQB/tq60Y7WY3MWRF+ewNXYchKxnQi/9l:us4Ai5Tf6QFtq6jWY3B3rwNoIKx
- TLSH T19C04171FB65C0067E07A9138C9874A1AF372B46A430257CB02A0C37D5F67BE96F76B85
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
6000
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WcnApi.pdb
msvcrt
__dllonexit
_unlock
_lock
_initterm
_onexit
_amsg_exit
_XcptFilter
memmove
memcpy
__CxxFrameHandler3
_CxxThrowException
?what@exception@@UEBAPEBDXZ
memset
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??3@YAXPEAX@Z
??0exception@@QEAA@AEBQEBDH@Z
memcpy_s
_vsnwprintf
??0exception@@QEAA@AEBQEBD@Z
?terminate@@YAXXZ
??0exception@@QEAA@XZ
??1type_info@@UEAA@XZ
_callnewh
malloc
free
_purecall
??_V@YAXPEAX@Z
__C_specific_handler
memcmp
__CxxFrameHandler4
wcsncmp
wcscmp
api-ms-win-core-synch-l1-1-0
CreateEventW
WaitForSingleObjectEx
WaitForMultipleObjectsEx
ReleaseSemaphore
ReleaseSRWLockShared
InitializeSRWLock
ReleaseSRWLockExclusive
SetEvent
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
OpenSemaphoreW
ReleaseMutex
CreateMutexExW
ResetEvent
CreateSemaphoreExW
DeleteCriticalSection
WaitForSingleObject
AcquireSRWLockShared
SleepEx
InitializeCriticalSectionEx
AcquireSRWLockExclusive
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleHandleW
GetProcAddress
FreeLibrary
GetModuleFileNameA
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
SetLastError
rpcrt4
RpcBindingFromStringBindingW
RpcAsyncCancelCall
RpcStringBindingComposeW
RpcBindingSetAuthInfoExW
RpcStringFreeW
RpcEpResolveBinding
NdrDllGetClassObject
RpcAsyncCompleteCall
RpcSmDestroyClientContext
NdrOleFree
NdrOleAllocate
RpcExceptionFilter
Ndr64AsyncClientCall
NdrClientCall3
RpcBindingFree
RpcAsyncInitializeHandle
RpcMgmtInqServerPrincNameW
NdrDllCanUnloadNow
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
CreateThread
GetCurrentProcess
GetCurrentThread
TerminateProcess
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
ntdll
EtwTraceMessage
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwUnregisterTraceGuids
api-ms-win-core-heap-l2-1-0
GlobalAlloc
GlobalFree
LocalFree
LocalAlloc
api-ms-win-security-base-l1-1-0
CreateWellKnownSid
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolCleanupGroup
SubmitThreadpoolWork
CreateThreadpoolWork
CloseThreadpoolTimer
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolCleanupGroup
CloseThreadpoolWork
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
88KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
52KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
200B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=54, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=183, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=15, id=261, version=33145,
count=17, id=260, version=33145,
count=1, id=256, version=33145,
count=23, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WcnEapAuthProxy.dll
- IMPHASH 73af81d399590dc49f0721b1caccfa84
- SHA256 4adeeda98d2b7948f2767078fe82a93208985283b8fa4490cf1196992b79473c
- MD5 72da7ee8504da3d7a8e4e3dfd2849d94
- SHA1 6c12e4f85ef45050d22cb707271cdc5721a072fd
- SHA512 1224eeb0bfbdafe8234a7faa8adb0de370c88145f0f4ea6813bc9d475c63aeab85b5074b11115a388b5cf5751b1b942bb76f74fa94a800d0873e51afce59afd3
- SSDEEP 768:hsCYLuDL5rpLfDe3Gi2MtbKUT1l0Nu9swdz7mC:H8ML5rpktbB1+w9rdz77
- TLSH T1B753074DB288006AE465417CD9270E1BD3B2F079436257DF11B8C2AD1FA3BE55B3AF92
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4848
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WcnEapAuthProxy.pdb
msvcrt
_CxxThrowException
memcpy
memmove
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
__CxxFrameHandler3
_initterm
malloc
free
_amsg_exit
_XcptFilter
__C_specific_handler
??3@YAXPEAX@Z
memcmp
__CxxFrameHandler4
??_V@YAXPEAX@Z
_callnewh
_purecall
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
memset
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
rpcrt4
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcAsyncCancelCall
RpcAsyncCompleteCall
RpcExceptionFilter
RpcAsyncInitializeHandle
UuidCreate
RpcBindingSetAuthInfoExW
Ndr64AsyncClientCall
NdrClientCall3
RpcBindingFree
RpcMgmtInqServerPrincNameW
RpcEpResolveBinding
RpcStringFreeW
RpcSmDestroyClientContext
api-ms-win-core-synch-l1-1-0
WaitForSingleObjectEx
ResetEvent
ReleaseSRWLockExclusive
CreateEventW
AcquireSRWLockExclusive
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolWait
SetThreadpoolTimer
CreateThreadpoolTimer
CreateThreadpoolCleanupGroup
SetThreadpoolWait
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolCleanupGroup
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
ntdll
EtwEventRegister
EtwEventUnregister
EtwEventWriteTransfer
EtwTraceMessage
EtwGetTraceEnableFlags
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
api-ms-win-core-heap-obsolete-l1-1-0
LocalAlloc
LocalFree
api-ms-win-security-base-l1-1-0
CreateWellKnownSid
WcnEapPluginGetInfo
Name
.text
Size
20KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
668B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=28, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=4, id=259, version=33145,
count=15, id=260, version=33145,
count=87, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=9, id=261, version=33145,
count=1, id=256, version=33145,
count=9, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WcnEapPeerProxy.dll
- IMPHASH d4da6b742df8ab9a7bd07ceeb087f11b
- SHA256 27f95df0244099873746a8c19da35b52143d67d0b3838b345ffb413134e9afa4
- MD5 aeb44b5ca4321e4713d2e43d34301245
- SHA1 d34cccb260f1769850a5d9a2f45d9bf8ec1a5592
- SHA512 c00754c1ac6c5ac7a07acbb7e1cf3f1b8c9127f1de54edddac21d13df36ed91f64872fc228338dfc1145297b5c9ef16c6bea2701ca0118776b41872f64d68eaf
- SSDEEP 384:dq3KilFhLGeShgvuTgrgIACyBiz55QmR4OWo1aZFcGEcEIl2R7SgIAVKpHcYIob/:dqjc2PkZxAW+aXi+l09NwdcYGfb
- TLSH T118530A08B75914AAE47A417CC6630F0FA772F068436157DF12B882AD0F73BE51B79B92
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7232
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WcnEapPeerProxy.pdb
msvcrt
__CxxFrameHandler4
_amsg_exit
_XcptFilter
memmove
memcpy
__CxxFrameHandler3
??1type_info@@UEAA@XZ
_lock
_unlock
__dllonexit
_initterm
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
free
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??_V@YAXPEAX@Z
??0exception@@QEAA@AEBQEBD@Z
_purecall
_callnewh
malloc
__C_specific_handler
??3@YAXPEAX@Z
_onexit
memset
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
rpcrt4
RpcStringFreeW
RpcBindingSetAuthInfoExW
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcEpResolveBinding
RpcMgmtInqServerPrincNameW
RpcBindingFree
NdrClientCall3
UuidCreate
RpcSmDestroyClientContext
RpcExceptionFilter
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
ntdll
EtwEventUnregister
EtwEventWriteTransfer
EtwTraceMessage
EtwEventRegister
EtwGetTraceEnableFlags
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-security-base-l1-1-0
CreateWellKnownSid
EapPeerFreeErrorMemory
EapPeerFreeMemory
EapPeerGetInfo
EapPeerGetMethodProperties
Name
.text
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
656B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=4, id=259, version=33145,
count=14, id=260, version=33145,
count=66, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=9, id=261, version=33145,
count=1, id=256, version=33145,
count=7, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WcnNetsh.dll
- IMPHASH ff444c7c5bc9654de55ffcd9a6e1b2f1
- SHA256 bcbe3ee6199c4a86cf73c25b525c397c255debe9f93cdc1c1d1526c26531651f
- MD5 bb5fa8cd1be8d6f754b3f6f26356a453
- SHA1 e9bdc0dbde91d59a8666528808c88d44d3147211
- SHA512 2d16b44f6f77b10f3e30efd00d325a5051cb897273dd6ab887b348a18a170c59de025be54a3f8c353184fc518fca2b63e07d06b57fe9ee93049c8d9943f3d7c2
- SSDEEP 768:mocdcXx+WY+F+k7q60EWnokdXS49qKl0HSPvUUA7k1mMX:m+XkWYj9pu49v+HOvk7k1me
- TLSH T1DD63080D77985499E066827C89630F5EE772F0348B1217CF22A4827D4F67BD89F72B85
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5936
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wcnnetsh.pdb
msvcrt
memmove
memcpy
__CxxFrameHandler3
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_unlock
_callnewh
malloc
free
_vsnwprintf
_purecall
??3@YAXPEAX@Z
_XcptFilter
_amsg_exit
_lock
_initterm
?terminate@@YAXXZ
__dllonexit
__C_specific_handler
__CxxFrameHandler4
??1type_info@@UEAA@XZ
_onexit
memset
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
EtwTraceMessage
kernel32
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeCriticalSectionEx
Sleep
WideCharToMultiByte
CloseHandle
SetEvent
CreateEventW
DeleteCriticalSection
RaiseException
DisableThreadLibraryCalls
GetLastError
InitializeCriticalSection
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
netsh.exe
RegisterContext
RegisterHelper
PrintMessage
PrintMessageFromModule
PrintError
PreprocessCommand
user32
LoadStringW
oleaut32
SysAllocString
SysFreeString
wlanapi
WlanEnumInterfaces
WlanCloseHandle
WlanFreeMemory
WlanStringToSsid
WlanOpenHandle
api-ms-win-core-com-l1-1-0
StringFromGUID2
CoInitializeEx
CoUninitialize
CoCreateInstance
IIDFromString
CoWaitForMultipleHandles
GetResourceString
InitHelperDll
Name
.text
Size
24KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
736B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=4, id=259, version=33136,
count=109, id=1, productName=Unmarked objects,
count=17, id=257, version=33136,
count=14, id=261, version=33136,
count=18, id=260, version=33136,
count=1, id=256, version=33136,
count=14, id=264, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
WebClnt.dll
- IMPHASH 7bcdf582f81745c52ae2a5a4fb000434
- SHA256 0f96529271222f63eebd8e87c0b241d8ea9d9e6682b27964f70de3710850df20
- MD5 3b9ee99159fe6f93ae074b06920b4c21
- SHA1 8a7618c5f1a78329af600d900b51c072edc481a7
- SHA512 cc1eb753828531ff1660c1f43012524a04dcb45c04c847a333eec569c172f372d36838ed00908dc5d4b2b1dc4635a3e712a8c3a6b52b9827dbcb049a7026ce84
- SSDEEP 3072:Ic5LqcFJcaDUA+IAt/SsHFjDD5F8Xnjd3RqeEfox+gUQ1iMgxr3LbrpsV:IKdJcaDQ/Sohw3jdIeEAxzwMg9
- TLSH T18744F82DE3B938A9E86A9274445353154E31B03D3F2199DF12E0C9386F07AF56B78F98
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4832
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WebClnt.pdb
msvcrt
__C_specific_handler
memset
wcstok
_initterm
_amsg_exit
_XcptFilter
free
_callnewh
malloc
_wtoi64
wcspbrk
swscanf
tolower
wcstombs
strtoul
_wtoi
wcsstr
_vsnprintf
wcscspn
_wcsnicmp
time
wcschr
_wcsupr
iswctype
_wcsicmp
_vsnwprintf
memcpy
wcscmp
ntdll
RtlLookupFunctionEntry
RtlCaptureContext
RtlTimeFieldsToTime
EtwUnregisterTraceGuids
EtwGetTraceEnableFlags
NtQueryInformationProcess
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwRegisterTraceGuidsW
RtlFreeHeap
NtQueryInformationFile
RtlDosPathNameToNtPathName_U
RtlInitializeResource
RtlDeleteResource
NtOpenFile
RtlVirtualUnwind
NtCreateFile
RtlIntegerToUnicodeString
RtlNtStatusToDosError
NtFsControlFile
RtlAcquireResourceExclusive
NtClose
NtOpenProcessToken
NtDuplicateToken
NtAdjustPrivilegesToken
NtSetInformationThread
RtlReleaseResource
NtQueryInformationToken
RtlInitUnicodeString
EtwTraceMessage
RtlAppendUnicodeStringToString
RtlMapSecurityErrorToNtStatus
RtlCopyLuid
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-core-file-l1-1-0
CreateFileW
WriteFile
ReadFile
DefineDosDeviceW
QueryDosDeviceW
SetFilePointer
GetFileInformationByHandle
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegOpenKeyExW
RegGetValueW
RegDisablePredefinedCacheEx
RegQueryValueExW
api-ms-win-core-processthreads-l1-1-0
GetExitCodeProcess
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
SetThreadToken
GetCurrentThread
CreateProcessAsUserW
GetCurrentThreadId
CreateThread
OpenThreadToken
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
WaitForSingleObject
CreateEventW
SetEvent
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-sysinfo-l1-1-0
GetSystemDirectoryW
GetSystemTime
GetVersionExW
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolThreadMaximum
SetThreadpoolThreadMinimum
TrySubmitThreadpoolCallback
CreateThreadpool
CreateThreadpoolCleanupGroup
CloseThreadpool
CloseThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
api-ms-win-security-base-l1-1-0
DuplicateTokenEx
SetFileSecurityW
RevertToSelf
ImpersonateLoggedOnUser
api-ms-win-service-core-l1-1-0
SetServiceStatus
api-ms-win-service-winsvc-l1-1-0
RegisterServiceCtrlHandlerW
rpcrt4
RpcServerRegisterIfEx
RpcStringBindingParseW
RpcBindingServerFromClient
UuidCreate
RpcImpersonateClient
RpcStringFreeW
NdrServerCallAll
NdrServerCall2
RpcBindingFree
RpcRevertToSelf
RpcServerUseProtseqEpW
RpcBindingToStringBindingW
I_RpcBindingIsClientLocal
RpcServerUnregisterIf
davhlpr
DavUrlDecodeToNtPath
DavRemoveDummyShareFromFileName
DavParseUncServerName
DavUrlDecodeUtf8
DavUrlEncodeNtPath
DavRemoveDummyShareFromFileNameEx
oleaut32
SysFreeString
kernel32
LocalFree
LocalLock
LocalAlloc
GlobalFree
LocalReAlloc
DosPathToSessionPathW
LocalUnlock
LocalSize
lstrlenW
IdnToAscii
FileTimeToSystemTime
SystemTimeToFileTime
UnregisterWait
lstrcmpW
LoadLibraryW
GetProcAddress
CreateDirectoryW
FindFirstFileW
FindNextFileW
CreateWaitableTimerW
WaitForMultipleObjects
FindClose
SetWaitableTimerEx
DeleteFileW
DelayLoadFailureHook
ResolveDelayLoadedAPI
GetTempPath2W
DavClose
DavInit
ServiceMain
SvchostPushServiceGlobals
Name
.text
Size
192KB
Virtual Size
190KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
552B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
692B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=32, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=17, id=260, version=33138,
count=4, id=259, version=33138,
count=235, id=1, productName=Unmarked objects,
count=13, id=257, version=33138,
count=2, id=261, version=33138,
count=1, id=256, version=33138,
count=32, id=264, version=33138,
count=1, id=255, version=33138,
count=1, id=258, version=33138,
WebRuntimeManager.dll
- IMPHASH 80d18f4a96209c3d38180ec3e293b840
- SHA256 bad7e0b7ff2a768853ab15ddc54478c1c43d7793d74b1dd8dc8a5f6866888738
- MD5 3bc9790af6358580857bd77c74f9b781
- SHA1 ac2171aafa9a234b7ec814a18221a30af4dee2a2
- SHA512 34e08a329363babff5ebf2923631a578818373e947460788698418e590a18831729bbe2416a72dc539fdaa926fc462e5e4666fd7b921da5edeed453f398d6a3a
- SSDEEP 24576:BPbu6CZMWxcO78eryAWC+7JkiC3ZeZDaG1glOpeZyEXsKi07:9bvCZUO23C+1kiSEZtKA0Z/8Ki
- TLSH T1ACC54B6E6AE804A4D27DE27CC857460AE6B17C2117B1D7CF016462AE4F37FE41A3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
321520
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WebRuntimeManager.pdb
msvcp_win
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?_Xbad_alloc@std@@YAXXZ
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Incref@facet@locale@std@@UEAAXXZ
?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
api-ms-win-crt-string-l1-1-0
wcsncmp
wcscmp
wcsnlen
memset
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_wassert
_initterm
api-ms-win-crt-private-l1-1-0
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsicmp
_o__wcsnicmp
_o__wcstoui64
_o__wtof
_o__wtoi
memmove
_o_ceil
_o_ceilf
_o_free
_o_isalpha
_o_isdigit
_o_isxdigit
_o_malloc
_o_memcpy_s
_o_realloc
_o_strtol
_o_terminate
_o_wcscat_s
_o_wcscpy_s
_o_wcstod
_o_wcstol
__C_specific_handler
__current_exception
__current_exception_context
_o__itow_s
_o__itow
_o__execute_onexit_table
_o__errno
wcschr
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__i64tow_s
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
memcpy
_CxxThrowException
__std_terminate
__CxxFrameHandler4
memcmp
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleFileNameA
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetModuleHandleExW
GetModuleHandleExA
LoadLibraryExW
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceComplete
InitOnceExecuteOnce
InitOnceBeginInitialize
api-ms-win-core-synch-l1-1-0
ResetEvent
OpenEventW
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseSRWLockShared
CreateMutexExW
SetWaitableTimer
AcquireSRWLockShared
DeleteCriticalSection
WaitForMultipleObjectsEx
LeaveCriticalSection
CreateEventW
EnterCriticalSection
ReleaseMutex
InitializeCriticalSectionAndSpinCount
CancelWaitableTimer
CreateEventExW
WaitForSingleObject
InitializeCriticalSectionEx
InitializeCriticalSection
SetEvent
InitializeSRWLock
ReleaseSRWLockExclusive
TryEnterCriticalSection
ReleaseSemaphore
CreateSemaphoreExW
TryAcquireSRWLockExclusive
api-ms-win-core-heap-l1-1-0
HeapFree
HeapSetInformation
HeapAlloc
HeapReAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetLastError
GetLastError
SetErrorMode
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-eventing-provider-l1-1-0
EventWriteEx
EventRegister
EventWriteTransfer
EventUnregister
EventSetInformation
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-processthreads-l1-1-0
InitializeProcThreadAttributeList
OpenThreadToken
OpenProcessToken
GetCurrentProcess
GetProcessIdOfThread
SetPriorityClass
CreateThread
SuspendThread
GetCurrentProcessId
OpenThread
UpdateProcThreadAttribute
TerminateProcess
GetCurrentThread
GetExitCodeProcess
GetThreadPriority
SetThreadPriority
CreateProcessAsUserW
GetCurrentThreadId
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
RoOriginateErrorW
RoOriginateError
SetRestrictedErrorInfo
GetRestrictedErrorInfo
api-ms-win-core-localization-l1-2-0
FormatMessageW
LocaleNameToLCID
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
WideCharToMultiByte
oleaut32
SafeArrayGetLBound
SafeArrayGetUBound
VariantInit
SafeArrayDestroy
LPSAFEARRAY_UserSize64
VARIANT_UserUnmarshal64
VARIANT_UserFree64
LPSAFEARRAY_UserMarshal
LPSAFEARRAY_UserUnmarshal64
VARIANT_UserMarshal
LPSAFEARRAY_UserMarshal64
SafeArrayUnaccessData
LPSAFEARRAY_UserFree64
VARIANT_UserUnmarshal
VARIANT_UserFree
LPSAFEARRAY_UserUnmarshal
LPSAFEARRAY_UserFree
LPSAFEARRAY_UserSize
VARIANT_UserMarshal64
VariantClear
VariantCopy
BSTR_UserSize
BSTR_UserFree
SafeArrayCopy
VarBstrCmp
BSTR_UserMarshal64
BSTR_UserSize64
SafeArrayCreate
SafeArrayAccessData
SysAllocString
VARIANT_UserSize
VARIANT_UserSize64
SysAllocStringLen
SysStringLen
SysAllocStringByteLen
SysStringByteLen
BSTR_UserUnmarshal64
BSTR_UserUnmarshal
SysFreeString
BSTR_UserFree64
BSTR_UserMarshal
api-ms-win-core-winrt-error-l1-1-1
RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
api-ms-win-core-file-l1-1-0
FindNextFileW
GetFileAttributesW
FindFirstFileW
FindClose
CompareFileTime
SetFileAttributesW
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoActivateInstance
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
api-ms-win-security-base-l1-1-0
GetLengthSid
GetKernelObjectSecurity
GetAce
GetSecurityDescriptorSacl
IsValidSid
GetTokenInformation
CopySid
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolWait
CreateThreadpoolWait
SetThreadpoolWait
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolWork
CreateThreadpoolWork
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
TrySubmitThreadpoolCallback
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount64
GetTickCount
GetSystemDirectoryW
api-ms-win-core-registry-l1-1-0
RegEnumValueW
RegEnumKeyExW
RegDeleteTreeW
RegQueryValueExW
RegQueryInfoKeyW
RegDeleteValueW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegGetValueW
RegSetValueExW
api-ms-win-core-path-l1-1-0
PathCchAppend
PathCchCombine
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
rpcrt4
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
NdrOleFree
CStdStubBuffer_AddRef
NdrCStdStubBuffer2_Release
NdrCStdStubBuffer_Release
RpcImpersonateClient
RpcRevertToSelf
RpcServerInqCallAttributesW
RpcServerInqBindingHandle
I_RpcBindingInqLocalClientPID
NdrDllGetClassObject
RpcBindingFree
IUnknown_Release_Proxy
CStdStubBuffer_CountRefs
UuidCreate
CStdStubBuffer_QueryInterface
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Connect
CStdStubBuffer_IsIIDSupported
NdrStubForwardingFunction
I_RpcExceptionFilter
RpcRaiseException
NdrGetUserMarshalInfo
NdrStubCall3
NdrClientCall3
RpcBindingCreateW
RpcBindingBind
CStdStubBuffer_Invoke
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
iertutil
ord870
ord67
ord65
ord652
ord398
ord594
CreateIUriBuilder
CreateUri
ord651
ord661
ord79
ord596
ord76
ord89
ord78
ord230
ord68
ord63
ord70
ord64
ord654
ord650
ord61
ord798
ord854
ord855
ord852
ord850
ord790
ord99
ord37
ord57
ord597
ord795
ord140
ord300
ord144
ord794
ord797
ord792
ord85
ord74
ord81
ord793
ord134
ord791
ord796
api-ms-win-downlevel-shlwapi-l1-1-0
StrStrIW
StrCmpCW
QISearch
StrChrW
StrCmpICW
api-ms-win-core-kernel32-legacy-l1-1-0
RaiseFailFastException
RegisterWaitForSingleObject
GetComputerNameW
ntdll
NtQueryInformationToken
NtCompareTokens
NtQueryWnfStateData
NtUpdateWnfStateData
NtQueryInformationProcess
RtlNtStatusToDosError
NtQuerySystemInformation
RtlIpv6AddressToStringExW
RtlIpv4AddressToStringExW
RtlGetDeviceFamilyInfoEnum
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
api-ms-win-crt-math-l1-1-0
_finite
api-ms-win-core-file-l1-2-0
CreateFile2
api-ms-win-core-namespace-l1-1-0
ClosePrivateNamespace
DeleteBoundaryDescriptor
OpenPrivateNamespaceW
CreateBoundaryDescriptorW
api-ms-win-core-debug-l1-1-1
CheckRemoteDebuggerPresent
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalReAlloc
LocalFree
api-ms-win-core-threadpool-legacy-l1-1-0
UnregisterWaitEx
api-ms-win-core-psapi-l1-1-0
K32GetProcessMemoryInfo
api-ms-win-core-synch-l1-2-1
CreateWaitableTimerW
WaitForMultipleObjects
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-downlevel-advapi32-l1-1-0
AddAccessAllowedAceEx
api-ms-win-core-processenvironment-l1-1-0
SearchPathW
ExpandEnvironmentStringsW
kernelbase
__chkstk
GlobalAlloc
GlobalFree
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-url-l1-1-0
PathCreateFromUrlW
api-ms-win-core-heap-obsolete-l1-1-0
GlobalFlags
GlobalSize
GlobalLock
GlobalUnlock
api-ms-win-core-com-midlproxystub-l1-1-0
NdrProxyForwardingFunction4
NdrProxyForwardingFunction6
NdrProxyForwardingFunction11
NdrProxyForwardingFunction5
NdrProxyForwardingFunction10
NdrProxyForwardingFunction9
NdrProxyForwardingFunction7
ObjectStublessClient4
ObjectStublessClient10
ObjectStublessClient9
ObjectStublessClient8
ObjectStublessClient29
ObjectStublessClient21
ObjectStublessClient20
ObjectStublessClient28
ObjectStublessClient6
ObjectStublessClient18
NdrProxyForwardingFunction3
ObjectStublessClient5
ObjectStublessClient30
ObjectStublessClient13
ObjectStublessClient7
ObjectStublessClient27
ObjectStublessClient3
ObjectStublessClient11
ObjectStublessClient14
ObjectStublessClient22
ObjectStublessClient12
ObjectStublessClient31
ObjectStublessClient15
ObjectStublessClient23
ObjectStublessClient16
ObjectStublessClient19
ObjectStublessClient26
ObjectStublessClient17
NdrProxyForwardingFunction8
ObjectStublessClient24
ObjectStublessClient25
CreateMessagePortEventDispatcher
CreateServiceWorkerClientMessageDispatcher
CreateWebRuntimeFactory
CreateWebRuntimeNotificationFromEventArg
DllGetActivationFactory
EnsureServiceWorkerManagerComponent
Name
.text
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
664KB
Virtual Size
663KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
104KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
96KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
48KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=112, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=34, id=260, version=33145,
count=4, id=259, version=33145,
count=13, id=257, version=33145,
count=25, id=261, version=33145,
count=1888, id=1, productName=Unmarked objects,
count=1, id=256, version=33145,
count=446, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=151,
count=1, id=258, version=33145,
WebcamUi.dll
- IMPHASH f7d55258de32001abb16e9ed185c45fa
- SHA256 5e3c9add48a13f3f86b783d11020e0a5b5d0d5af9db9761697d8f6bfb8e94b76
- MD5 f0ab1870dfc475feac2827b152b90f6a
- SHA1 130967ebfdb9c9bf2277e7462bbd7d5a79eb7ad1
- SHA512 532c8350df987763b9e329f15edc815ba7b07bb68aae2553f41466727e70c86f80044e15d8a790db3a030c89ea4f2f19a97f73cae9bc63d17fbf15016117efc5
- SSDEEP 12288:hTnqLogkbQZFWJqSC9gaTd0c0IKNuUOaHrTsnyMij/8:FneogPvfSC6acXa0s7S/
- TLSH T182253A2EA7F80055D5BAA33C84831719EE71741C3F2196CF0164823DAF27BE55E39B6A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
6800
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WebcamUi.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__seh_filter_dll
_o__wcsicmp
_o_calloc
memmove
_o_free
_o_malloc
_o_memcpy_s
_o_qsort
_o_rand_s
_o_srand
_o_strncpy_s
_o_wmemcpy_s
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__register_onexit_function
_o__recalloc
_o__purecall
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
wcsrchr
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
memcpy
api-ms-win-crt-string-l1-1-0
memset
wcscspn
strnlen
gdi32
GetObjectW
StretchDIBits
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
GdiAlphaBlend
DeleteDC
GetStockObject
CreatePen
Rectangle
CreateDIBSection
DeleteObject
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
WinSqmIsOptedIn
WinSqmAddToStreamEx
WinSqmIncrementDWORD
kernel32
GetProcessId
TlsGetValue
TlsSetValue
FreeLibrary
GetModuleHandleExA
ResolveDelayLoadedAPI
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateIoCompletionPort
lstrcmpW
GetTickCount64
GetTempPath2W
CreateEventExW
SubmitThreadpoolWork
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks
CreateThreadpoolWork
GetCurrentThread
SetThreadPriority
GlobalAlloc
GlobalUnlock
GlobalSize
GlobalLock
SetEvent
ResetEvent
WaitForSingleObject
CloseHandle
CreateEventW
DeleteFileW
GlobalFree
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
OpenSemaphoreW
CompareStringOrdinal
HeapAlloc
HeapFree
GetProcessHeap
LocalAlloc
LocalReAlloc
LocalFree
FindResourceExW
LoadResource
LockResource
SizeofResource
GetLocaleInfoEx
GetUserPreferredUILanguages
DebugBreak
GetProcAddress
FormatMessageW
GetModuleHandleExW
GetModuleFileNameA
RaiseException
GetLastError
TerminateProcess
GetCurrentProcess
GetModuleHandleW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
InitializeSRWLock
AcquireSRWLockShared
ReleaseSRWLockShared
EncodePointer
InitOnceExecuteOnce
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
DecodePointer
DelayLoadFailureHook
HeapSize
HeapReAlloc
HeapDestroy
CreateMutexExW
WaitForSingleObjectEx
ReleaseMutex
ReleaseSemaphore
SetLastError
CreateSemaphoreExW
OutputDebugStringW
GetDurationFormatEx
ole32
CreateStreamOnHGlobal
CoWaitForMultipleHandles
CoReleaseMarshalData
RoGetAgileReference
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
GetHGlobalFromStream
StringFromGUID2
StringFromCLSID
IIDFromString
HWND_UserUnmarshal
HWND_UserFree
HWND_UserFree64
HWND_UserSize64
HWND_UserSize
HWND_UserMarshal
HWND_UserMarshal64
HWND_UserUnmarshal64
PropVariantClear
rpcrt4
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrOleFree
NdrOleAllocate
shell32
SHCreateItemFromParsingName
shlwapi
ord16
ord219
PathFindFileNameW
ord12
PathCombineW
SHStrDupW
SHCreateStreamOnFileW
api-ms-win-shcore-scaling-l1-1-1
ord244
user32
LoadCursorW
KillTimer
SetTimer
SetWindowPos
SetFocus
GetKeyState
CreateWindowExW
IsWindow
PostMessageW
SendMessageW
GetMonitorInfoW
MonitorFromWindow
LoadStringW
GetWindowRect
UnregisterClassA
IsRectEmpty
OffsetRect
CopyRect
SetRect
PtInRect
GetCursorPos
SetCursorPos
GetAncestor
DefWindowProcW
RegisterClassExW
IsWindowVisible
GetDC
ReleaseDC
SetWindowCompositionAttribute
GetWindow
GetPropW
EnumWindows
RemovePropW
SetPropW
DestroyWindow
dui70
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUHBITMAP__@@EI_N11@Z
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z
??0DUIFactory@DirectUI@@QEAA@PEAUHWND__@@@Z
??1DUIFactory@DirectUI@@QEAA@XZ
?LoadFromResource@DUIFactory@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG1PEAVElement@2@PEAKPEAPEAV42@1@Z
StrToID
?DestroyAll@Element@DirectUI@@QEAAJ_N@Z
?Destroy@Element@DirectUI@@QEAAJ_N@Z
?GetAdjacent@Element@DirectUI@@UEAAPEAV12@PEAV12@HPEBUNavReference@2@K@Z
?SetKeyFocus@Element@DirectUI@@UEAAXXZ
?SetToggleValue@TouchSwitch@DirectUI@@QEAAXH@Z
?GetSelectionIndex@TouchSelect@DirectUI@@QEAAHXZ
?GetSelection@TouchSelect@DirectUI@@QEAAPEAVElement@2@XZ
?RemoveAll@TouchSelect@DirectUI@@QEAAXXZ
?OnMessage@NativeHWNDHost@DirectUI@@UEAAJI_K_JPEA_J@Z
?Initialize@NativeHWNDHost@DirectUI@@QEAAJPEBG0PEAUHWND__@@PEAUHICON__@@HHHHHHPEAUHINSTANCE__@@I@Z
DUIStopPVLAnimation
DuiCreateObject
?SetPressed@TouchButton@DirectUI@@QEAAJ_N@Z
?GetClassInfoPtr@ModernProgressBar@DirectUI@@SAPEAUIClassInfo@2@XZ
?SetPosition@ModernProgressBar@DirectUI@@QEAAJH@Z
?GetClassInfoPtr@ModernProgressRing@DirectUI@@SAPEAUIClassInfo@2@XZ
?RemoveListener@Element@DirectUI@@QEAAXPEAUIElementListener@2@@Z
?TriggeredAnimationComplete@PVLAnimation@DirectUI@@SA?AVUID@@XZ
?_OnUIStateChanged@TouchHWNDElement@DirectUI@@MEAAXGG@Z
?GetWindowClassNameAndStyle@HWNDElement@DirectUI@@UEAAXPEAPEBGPEAI@Z
?IsMSAAEnabled@TouchHWNDElement@DirectUI@@UEAA_NXZ
?CanSetFocus@HWNDElement@DirectUI@@UEAA_NXZ
?OnCompositionChanged@HWNDElement@DirectUI@@UEAAXXZ
?OnWmSettingChanged@HWNDElement@DirectUI@@UEAAX_K_J@Z
?OnWmThemeChanged@HWNDElement@DirectUI@@UEAAX_K_J@Z
?OnGetDlgCode@HWNDElement@DirectUI@@UEAAXPEAUtagMSG@@PEA_J@Z
?OnNoChildWithShortcutFound@HWNDElement@DirectUI@@UEAAXPEAUKeyboardEvent@2@@Z
?OnImmersiveColorSchemeChanged@HWNDElement@DirectUI@@UEAAXXZ
?OnThemeChanged@HWNDElement@DirectUI@@UEAAXPEAUThemeChangedEvent@2@@Z
?GetAccessibleImpl@HWNDElement@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
?GetClassInfoW@TouchHWNDElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ
?RemoveTooltip@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z
?ActivateTooltip@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@K@Z
?UpdateTooltip@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z
?MessageCallback@TouchHWNDElement@DirectUI@@UEAAIPEAUtagGMSG@@@Z
?OnDestroy@TouchHWNDElement@DirectUI@@UEAAXXZ
?OnKeyFocusMoved@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@0@Z
?OnInput@TouchHWNDElement@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?OnGroupChanged@HWNDElement@DirectUI@@UEAAXH_N@Z
?OnPropertyChanged@TouchHWNDElement@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
??1TouchHWNDElement@DirectUI@@UEAA@XZ
??0TouchHWNDElement@DirectUI@@QEAA@XZ
?OnEvent@TouchHWNDElement@DirectUI@@UEAAXPEAUEvent@2@@Z
?ScaleChanged@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ
?ThemeChange@HWNDElement@DirectUI@@SA?AVUID@@XZ
?WndProc@TouchHWNDElement@DirectUI@@UEAA_JPEAUHWND__@@I_K_J@Z
?GetParser@DUIFactory@DirectUI@@QEAAPEAVDUIXmlParser@2@XZ
?SetParseErrorCallback@DUIXmlParser@DirectUI@@QEAAXP6AXPEBG0HPEAX@Z1@Z
?CreateParser@DUIFactory@DirectUI@@QEAAJXZ
?GetHWND@HWNDElement@DirectUI@@UEAAPEAUHWND__@@XZ
?Initialize@TouchHWNDElement@DirectUI@@QEAAJPEAUHWND__@@_NIPEAVElement@2@PEAK@Z
?FireRightClickEvent@TouchButton@DirectUI@@UEAAXIPEAUtagPOINT@@@Z
?FireClickEvent@TouchButton@DirectUI@@UEAAXIIW4ClickDevice@12@PEAUtagPOINT@@@Z
?GetForegroundColorRef@TouchButton@DirectUI@@UEAAJPEAK@Z
?DefaultAction@TouchButton@DirectUI@@UEAAJXZ
?OnUnHosted@TouchButton@DirectUI@@UEAAXPEAVElement@2@@Z
?OnHosted@TouchButton@DirectUI@@UEAAXPEAVElement@2@@Z
?GetImmersiveFocusRectOffsets@TouchButton@DirectUI@@UEAAXPEAUtagRECT@@@Z
?GetContentSize@RichText@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?Paint@RichText@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z
?OnEvent@TouchButton@DirectUI@@UEAAXPEAUEvent@2@@Z
?OnInput@TouchButton@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?Register@TouchButton@DirectUI@@SAJXZ
?SetTooltip@Element@DirectUI@@QEAAJ_N@Z
?HeightProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?SetFont@Element@DirectUI@@QEAAJPEBG@Z
?AccDescProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?ForegroundProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?IsEqual@Value@DirectUI@@QEAA_NPEAV12@@Z
?AccValueProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?SetFontSizeRuns@RichText@DirectUI@@QEAAJPEBG@Z
?SetFontColorRuns@RichText@DirectUI@@QEAAJPEBG@Z
?GetPressed@TouchButton@DirectUI@@QEAA_NXZ
?GetString@Value@DirectUI@@QEAAPEBGXZ
?OnPropertyChanged@TouchButton@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?EnabledProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?PressedProp@TouchButton@DirectUI@@SAPEBUPropertyInfo@2@XZ
?SetContentAlign@Element@DirectUI@@QEAAJH@Z
?GetContentAlign@Element@DirectUI@@QEAAHXZ
?KeyWithinProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?Initialize@TouchButton@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z
??1TouchButton@DirectUI@@UEAA@XZ
??0TouchButton@DirectUI@@QEAA@XZ
?Destroy@DUIXmlParser@DirectUI@@QEAAXXZ
?CreateElement@DUIXmlParser@DirectUI@@QEAAJPEBGPEAVElement@2@1PEAKPEAPEAV32@@Z
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@0@Z
?Create@DUIXmlParser@DirectUI@@SAJPEAPEAV12@P6APEAVValue@2@PEBGPEAX@Z2P6AX11H2@Z2@Z
?GetBoolTrue@Value@DirectUI@@SAPEAV12@XZ
?GetIntMinusOne@Value@DirectUI@@SAPEAV12@XZ
?GetStringNull@Value@DirectUI@@SAPEAV12@XZ
?_Fill@Element@DirectUI@@IEAAXPEAUHDC__@@KHHHH_N@Z
?GetRect@Value@DirectUI@@QEAAPEBUtagRECT@@XZ
?PaddingProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?GetValue@Element@DirectUI@@QEAAPEAVValue@2@P6APEBUPropertyInfo@2@XZHPEAUUpdateCache@2@@Z
?HasPadding@Element@DirectUI@@QEAA_NXZ
?GetBoolFalse@Value@DirectUI@@SAPEAV12@XZ
?GetColorTrans@Value@DirectUI@@SAPEAV12@XZ
ARGBColorFromEnumI
?GetFill@Value@DirectUI@@QEAAPEBUFill@2@XZ
?SetCursorHandle@Element@DirectUI@@QEAAJPEAUHICON__@@@Z
?MouseWithinProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?GetIntZero@Value@DirectUI@@SAPEAV12@XZ
?GetInt@Value@DirectUI@@QEAAHXZ
?GetY@Element@DirectUI@@QEAAHXZ
?GetX@Element@DirectUI@@QEAAHXZ
?GetLocation@Element@DirectUI@@QEAAPEBUtagPOINT@@PEAPEAVValue@2@@Z
?GetActive@Element@DirectUI@@QEAAHXZ
?GetClassInfoPtr@Viewer@DirectUI@@SAPEAUIClassInfo@2@XZ
?GetClassInfoPtr@TouchButton@DirectUI@@SAPEAUIClassInfo@2@XZ
?GetVisible@Element@DirectUI@@QEAA_NXZ
?SetY@Element@DirectUI@@QEAAJH@Z
?SetX@Element@DirectUI@@QEAAJH@Z
?Add@Element@DirectUI@@QEAAJPEAV12@@Z
?SetActive@Element@DirectUI@@QEAAJH@Z
?SetSuppressSetContact@TouchScrollViewer@DirectUI@@QEAAJ_N@Z
?SetHeight@Element@DirectUI@@QEAAJH@Z
?SetWidth@Element@DirectUI@@QEAAJH@Z
?SetMargin@Element@DirectUI@@QEAAJHHHH@Z
?SetXOffset@BaseScrollViewer@DirectUI@@QEAAJH@Z
?ReleaseSnapshot@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ
?SnapshotTransformElement@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ
?GetHeight@Element@DirectUI@@QEAAHXZ
?GetWidth@Element@DirectUI@@QEAAHXZ
?GetKeyWithin@Element@DirectUI@@QEAA_NXZ
?GetMouseWithin@Element@DirectUI@@QEAA_NXZ
?OnEvent@Element@DirectUI@@UEAAXPEAUEvent@2@@Z
?GetID@Element@DirectUI@@QEAAGXZ
?MultipleClick@TouchButton@DirectUI@@SA?AVUID@@XZ
?SemanticChange@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ
?ManipulationCompleted@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ
?SetSnapMode@TouchScrollViewer@DirectUI@@QEAAJH@Z
?GetSnapMode@TouchScrollViewer@DirectUI@@QEAAHXZ
?GetVisibleRect@TouchScrollViewer@DirectUI@@QEAAXPEAUtagRECT@@@Z
?ManipulationDelta@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ
?ManipulationStarted@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ
?ManipulationStarting@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ
?GetXOffset@BaseScrollViewer@DirectUI@@QEAAHXZ
?Scroll@BaseScrollBar@DirectUI@@SA?AVUID@@XZ
?VisibleProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?SetSnapIntervalX@TouchScrollViewer@DirectUI@@QEAAJM@Z
?ZoomToRect@TouchScrollViewer@DirectUI@@QEAAJPEBUtagRECT@@_N@Z
?UpdateContentSize@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ
?ExtentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?GetChildren@Element@DirectUI@@QEAAPEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@PEAPEAVValue@2@@Z
?NewChildElementsAdded@TouchScrollViewer@DirectUI@@QEAAXXZ
?Remove@Element@DirectUI@@QEAAJPEAV12@@Z
?Insert@Element@DirectUI@@QEAAJPEAV12@I@Z
?StartDefer@Element@DirectUI@@QEAAXPEAK@Z
?GetParent@Element@DirectUI@@QEAAPEAV12@XZ
?SetDirection@Element@DirectUI@@QEAAJH@Z
?SetManipulationVerticalAlignment@TouchScrollViewer@DirectUI@@QEAAJH@Z
?AddListener@Element@DirectUI@@QEAAJPEAUIElementListener@2@@Z
?IsFirstElement@HWNDElement@DirectUI@@QEAA_NPEAVElement@2@@Z
?IsLastElement@HWNDElement@DirectUI@@QEAA_NPEAVElement@2@@Z
?GetEnabled@Element@DirectUI@@QEAA_NXZ
?GetKeyFocusedElement@HWNDElement@DirectUI@@SAPEAVElement@2@XZ
?GetElement@NativeHWNDHost@DirectUI@@QEAAPEAVElement@2@XZ
?ToggleUIState@HWNDElement@DirectUI@@QEAAX_N0@Z
?FireEvent@Element@DirectUI@@QEAAXPEAUEvent@2@_N1@Z
?KeyboardNavigate@Element@DirectUI@@SA?AVUID@@XZ
?CreateHostWindow@NativeHWNDHost@DirectUI@@UEAAPEAUHWND__@@KPEBG0KHHHHPEAU3@PEAUHMENU__@@PEAUHINSTANCE__@@PEAX@Z
??1NativeHWNDHost@DirectUI@@UEAA@XZ
??0NativeHWNDHost@DirectUI@@QEAA@XZ
?Destroy@NativeHWNDHost@DirectUI@@QEAAXXZ
?GetClassInfoW@Element@DirectUI@@UEAAPEAUIClassInfo@2@XZ
?EndDefer@Element@DirectUI@@QEAAXK@Z
?SetVisible@Element@DirectUI@@QEAAJ_N@Z
?SetAccessible@Element@DirectUI@@QEAAJ_N@Z
?Host@NativeHWNDHost@DirectUI@@QEAAXPEAVElement@2@@Z
?SetWrapKeyboardNavigate@HWNDElement@DirectUI@@QEAAJ_N@Z
?ShowWindow@NativeHWNDHost@DirectUI@@QEAAXH@Z
RegisterPVLBehaviorFactory
?BroadcastEvent@Element@DirectUI@@QEAAXPEAUEvent@2@@Z
?GetHWND@NativeHWNDHost@DirectUI@@QEAAPEAUHWND__@@XZ
?Destroy@Layout@DirectUI@@QEAAXXZ
?SetLayout@Element@DirectUI@@QEAAJPEAVLayout@2@@Z
?Create@FillLayout@DirectUI@@SAJPEAPEAVLayout@2@@Z
?DestroyWindow@NativeHWNDHost@DirectUI@@QEAAXXZ
?GetDisplayNode@Element@DirectUI@@QEAAPEAUHGADGET__@@XZ
?GetBool@Value@DirectUI@@QEAA_NXZ
?GetSize@Value@DirectUI@@QEAAPEBUtagSIZE@@XZ
?GetExtent@Element@DirectUI@@QEAAPEBUtagSIZE@@PEAPEAVValue@2@@Z
?SetContentString@Element@DirectUI@@QEAAJPEBG@Z
?CustomProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?CreateBool@Value@DirectUI@@SAPEAV12@_N@Z
?CreateInt@Value@DirectUI@@SAPEAV12@HW4DynamicScaleValue@@@Z
?MapElementPoint@Element@DirectUI@@QEAAXPEAV12@PEBUtagPOINT@@PEAU3@@Z
?RemoveLocalValue@Element@DirectUI@@QEAAJPEBUPropertyInfo@2@@Z
?GetImage@Value@DirectUI@@QEAAPEAX_NM@Z
?GetGraphic@Value@DirectUI@@QEAAPEAUGraphic@2@XZ
?ContentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?SetValue@Element@DirectUI@@QEAAJPEBUPropertyInfo@2@HPEAVValue@2@@Z
?BackgroundProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?GetType@Value@DirectUI@@QEBAHXZ
?GetValue@Element@DirectUI@@QEAAPEAVValue@2@PEBUPropertyInfo@2@HPEAUUpdateCache@2@@Z
?SetValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@@Z
?Release@Value@DirectUI@@QEAAXXZ
?GetRoot@Element@DirectUI@@QEAAPEAV12@XZ
UnInitThread
UnInitProcessPriv
InitThread
InitProcessPriv
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UEBAXXZ
?GetChildren@ClassInfoBase@DirectUI@@UEBAHXZ
?RemoveChild@ClassInfoBase@DirectUI@@UEAAXXZ
?AddChild@ClassInfoBase@DirectUI@@UEAAXXZ
?IsGlobal@ClassInfoBase@DirectUI@@UEBA_NXZ
?GetModule@ClassInfoBase@DirectUI@@UEBAPEAUHINSTANCE__@@XZ
?IsSubclassOf@ClassInfoBase@DirectUI@@UEBA_NPEAUIClassInfo@2@@Z
?IsValidProperty@ClassInfoBase@DirectUI@@UEBA_NPEBUPropertyInfo@2@@Z
?GetName@ClassInfoBase@DirectUI@@UEBAPEBGXZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UEBAIXZ
?GetPICount@ClassInfoBase@DirectUI@@UEBAIXZ
?GetByClassIndex@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?Release@ClassInfoBase@DirectUI@@UEAAHXZ
?AddRef@ClassInfoBase@DirectUI@@UEAAXXZ
?GetUiaFocusDelegate@Element@DirectUI@@UEAAPEAV12@XZ
?HandleUiaEventListener@Element@DirectUI@@UEAAXPEAUEvent@2@@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@@Z
?HandleUiaPropertyListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?HandleUiaDestroyListener@Element@DirectUI@@UEAAXXZ
?GetElementProviderImpl@Element@DirectUI@@UEAAJPEAVInvokeHelper@2@PEAPEAVElementProvider@2@@Z
?GetUIAElementProvider@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?DefaultAction@Element@DirectUI@@UEAAJXZ
?GetAccessibleImpl@Element@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
?GetKeyFocused@Element@DirectUI@@UEAA_NXZ
?RemoveTooltip@Element@DirectUI@@MEAAXPEAV12@@Z
?ActivateTooltip@Element@DirectUI@@MEAAXPEAV12@K@Z
?UpdateTooltip@Element@DirectUI@@MEAAXPEAV12@@Z
?OnUnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
?OnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MEAAXHH@Z
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UEAAXPEAUtagRECT@@@Z
?QueryInterface@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?MessageCallback@Element@DirectUI@@UEAAIPEAUtagGMSG@@@Z
?RemoveBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
?AddBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
?EnsureVisible@Element@DirectUI@@UEAA_NHHHH@Z
?Remove@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?Insert@Element@DirectUI@@UEAAJPEAPEAV12@II@Z
?Add@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?GetContentSize@Element@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?Paint@Element@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z
?OnDestroy@Element@DirectUI@@UEAAXXZ
?OnMouseFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?OnKeyFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?OnInput@Element@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?OnGroupChanged@Element@DirectUI@@UEAAXH_N@Z
?OnPropertyChanged@Element@DirectUI@@UEAAXPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanged@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?GetContentStringAsDisplayed@Element@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z
?IsContentProtected@Element@DirectUI@@UEAA_NXZ
?GetDirection@Element@DirectUI@@QEAAHXZ
?IsRTL@Element@DirectUI@@QEAA_NXZ
?IsRTLReading@Element@DirectUI@@UEAA_NXZ
?GetClassInfoPtr@TouchSelect@DirectUI@@SAPEAUIClassInfo@2@XZ
?GetClassInfoPtr@TouchSwitch@DirectUI@@SAPEAUIClassInfo@2@XZ
?GetClassInfoPtr@TouchSlider@DirectUI@@SAPEAUIClassInfo@2@XZ
?GetClassInfoPtr@TouchScrollViewer@DirectUI@@SAPEAUIClassInfo@2@XZ
?GetClassInfoPtr@RichText@DirectUI@@SAPEAUIClassInfo@2@XZ
??1ClassInfoBase@DirectUI@@UEAA@XZ
??0ClassInfoBase@DirectUI@@QEAA@XZ
?GetClassInfoPtr@Element@DirectUI@@SAPEAUIClassInfo@2@XZ
?Initialize@ClassInfoBase@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG_NPEBQEBUPropertyInfo@2@I@Z
?Register@ClassInfoBase@DirectUI@@QEAAJXZ
?ClassExist@ClassInfoBase@DirectUI@@SA_NPEAPEAUIClassInfo@2@PEBQEBUPropertyInfo@2@IPEAU32@PEAUHINSTANCE__@@PEBG_N@Z
??1CritSecLock@DirectUI@@QEAA@XZ
?GetFactoryLock@Element@DirectUI@@SAPEAU_RTL_CRITICAL_SECTION@@XZ
??0CritSecLock@DirectUI@@QEAA@PEAU_RTL_CRITICAL_SECTION@@@Z
?Register@Element@DirectUI@@SAJXZ
?GetLayoutPos@Element@DirectUI@@QEAAHXZ
?SetSelectionIndex@TouchSelect@DirectUI@@QEAAJH@Z
?SetThumbValue@TouchSlider@DirectUI@@QEAAXH_N@Z
?SetToggleValue@TouchSwitch@DirectUI@@QEAAXH_N@Z
?SetEnabled@Element@DirectUI@@QEAAJ_N@Z
?SetLayoutPos@Element@DirectUI@@QEAAJH@Z
?SetStepCount@TouchSlider@DirectUI@@QEAAXH@Z
?SetFireContinuousSliderEvent@TouchSlider@DirectUI@@QEAAX_N@Z
?SetIsContinuous@TouchSlider@DirectUI@@QEAAJ_N@Z
?SetRangeMax@TouchSlider@DirectUI@@QEAAXH@Z
?SetRangeMin@TouchSlider@DirectUI@@QEAAXH@Z
?AddString@TouchSelect@DirectUI@@QEAAJPEBG@Z
?SetOnOffText@TouchSwitch@DirectUI@@QEAAXPEBG0@Z
?IsDescendent@Element@DirectUI@@QEAA_NPEAV12@@Z
?SelectionChange@TouchSelect@DirectUI@@SA?AVUID@@XZ
?SliderUpdated@TouchSlider@DirectUI@@SA?AVUID@@XZ
?Click@TouchButton@DirectUI@@SA?AVUID@@XZ
?Click@Button@DirectUI@@SA?AVUID@@XZ
?Initialize@Element@DirectUI@@QEAAJIPEAV12@PEAK@Z
??1Element@DirectUI@@UEAA@XZ
??0Element@DirectUI@@QEAA@XZ
api-ms-win-crt-time-l1-1-0
_time64
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
588KB
Virtual Size
587KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
124KB
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
768B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
188KB
Virtual Size
186KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=257, version=33145,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1748, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=14, id=260, version=33145,
count=5, id=259, version=33145,
count=25, id=261, version=33145,
count=1, id=256, version=33145,
count=98, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
Websocket.dll
- IMPHASH 7ba43803f155bc8a658954a0c1f6c962
- SHA256 61ede2a204ad579e732e128c416b529a972c46f89a5d8ffa14ec1d5771a76be3
- MD5 4a6aecd13e79f866fbe0fc1dcd56e8cf
- SHA1 586508a591b9d7b6139041b70689f9b03c7520af
- SHA512 95615be95a87b7d47f1b1add1ce4a0f64756a7665a70034fc7521925a257eb72374661bc8e35b0eacb1ad10afa29fc96c1b56cdc2c3286e4c26368ccdaf1fb9c
- SSDEEP 768:srL3JTtKUus1/J0yBUHlTybuKs+FJbWjAlTao+/PDJaPPE1jCqH1Z+E3hyxpom2J:spV1My7ugJb0nU0jf1Z+Exyx2m2J
- TLSH T18763494A7BA864E4E0FA427CD59B8A4EE371F411271193DF03A0436D1F33BE1693A7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5136
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
websocket.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__purecall
_o__seh_filter_dll
memmove
_o_free
_o_malloc
__C_specific_handler
_o___std_type_info_destroy_list
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
LoadStringW
DisableThreadLibraryCalls
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventRegister
EventUnregister
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
RaiseException
SetUnhandledExceptionFilter
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
api-ms-win-core-synch-l1-1-0
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
bcrypt
BCryptHashData
BCryptGenRandom
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptDestroyHash
BCryptCreateHash
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
ntdll
WinSqmIncrementDWORD
WinSqmIsOptedIn
RtlReportException
NtQuerySystemInformation
WebSocketAbortHandle
WebSocketBeginClientHandshake
WebSocketBeginServerHandshake
WebSocketCompleteAction
WebSocketCreateClientHandle
WebSocketCreateServerHandle
WebSocketDeleteHandle
WebSocketEndClientHandshake
WebSocketEndServerHandshake
WebSocketGetAction
WebSocketGetGlobalProperty
WebSocketReceive
WebSocketSend
Name
.text
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33140,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1113, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33140,
count=4, id=259, version=33140,
count=15, id=261, version=33140,
count=1, id=256, version=33140,
count=24, id=264, version=33140,
count=1, id=253, version=33140,
count=1, id=255, version=33140,
count=1, id=258, version=33140,
WerEnc.dll
- IMPHASH 4996c344c278f478f06def0fd0e8a354
- SHA256 a49fe664e1a231230e24523587c1039fd8561db3a11eccce1d561f4f111b06c5
- MD5 ba9fca7bb1b7c76f28f53c80e842d163
- SHA1 80420a824657efa4b20691d2fa83de93216428b3
- SHA512 e0bb35e9adf717e82b0d82f023c9e359d6bed0875a9483c518dd869efe811bbacd269d54bf9006e2b3b95078fdee725bb4205f998d5e73284bda7742271bd536
- SSDEEP 384:FbZv0GblmYKQx8tbsLkOWz+YBquCUdjdW6ZWURdn/vDBRJcdlKR9zlo91:FbpWeStbiyzxBQUdT3Rd/v1PIs9z291
- TLSH T1D0438E995B5858C7FDB75138C592CB07B939FAA1670006CF03A2915D1E33BF4EA34E89
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
df:f7:74:77:ea:9e:52:ad:3c:a0:56:07:b8:6d:38:50:4e:ca:91:8a:be:87:66:16:55:42:c2:c9:af:cb:98:82
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A935-03E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:27:d5:c0:83:c3:b1:2e:57:2d:00:01:00:00:02:27
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
5056
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WerEnc.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o___std_exception_copy
_o___std_exception_destroy
_o___std_type_info_destroy_list
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
_o_free
_o_malloc
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
__std_terminate
__CxxFrameHandler4
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-file-l1-1-0
WriteFile
ReadFile
GetFileSizeEx
SetFilePointerEx
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
bcrypt
BCryptGenRandom
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptImportKey
BCryptEncrypt
BCryptDestroyKey
BCryptImportKeyPair
BCryptSetProperty
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
EncryptDumpFile
EncryptDumpStream
Name
.text
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
780B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=29, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1102, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=11, id=260, version=33145,
count=4, id=259, version=33145,
count=22, id=261, version=33145,
count=1, id=256, version=33145,
count=3, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WfHC.dll
- IMPHASH cc98c6ebdd5915c1a5305c7429a8dcc4
- SHA256 b876ab1fb2d7c638d8b8896ecdaa9337fb624bc4a90f831bc0608838c64e0f69
- MD5 80d21501e25bb0fdd04c0f512947ad18
- SHA1 5a03d715f1f81520e2931c08031f0579c4c092bb
- SHA512 6d3c09ef80a9ce2f054cb03f103752586cd849c265cdd8d7d826112a9ebb022f48d252be61c0a0effb93598ad7ef61769634161f65199f02b450752fa1d43687
- SSDEEP 1536:jBMCO2oN6ihxvqVsdrdMmOubHbvyIYQesBbQ9l+nbmCqS6skIpk:jBMCOXHhYVsnMmFHmQe+QL+nXqbskL
- TLSH T122A3080B77A8209AE166D1BD86134A1AE3B1BC24231257EF12E0F2BD5E37BD51E35F41
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7744
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wfhc.pdb
msvcrt
_onexit
??1type_info@@UEAA@XZ
wcsnlen
memcpy_s
_vscwprintf
vswprintf_s
wcsstr
_unlock
_lock
__dllonexit
?terminate@@YAXXZ
_initterm
_amsg_exit
memmove
memcpy
__CxxFrameHandler3
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_callnewh
malloc
memmove_s
free
_purecall
_vsnwprintf
wcsncmp
??3@YAXPEAX@Z
__C_specific_handler
??_V@YAXPEAX@Z
__CxxFrameHandler4
_XcptFilter
memset
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-com-l1-1-0
CoUninitialize
CoTaskMemFree
CoInitializeEx
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
GetLastError
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
LoadStringW
FindResourceExW
LoadResource
LockResource
GetModuleHandleW
GetModuleHandleExA
SizeofResource
api-ms-win-core-synch-l1-1-0
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ws2_32
ntohs
htons
api-ms-win-security-base-l1-1-0
IsValidSid
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFindFileNameW
api-ms-win-core-string-l1-1-0
CompareStringW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
firewallapi
FWFreeFirewallRules
FWClosePolicyStore
FWAddFirewallRule
FWDeleteFirewallRule
FWSetFirewallRule
FWOpenPolicyStore
FWGetGlobalConfig
FwAlloc
FWQueryFirewallRules
FwFree
fwbase
FwStringCopy
ext-ms-win-shell-shlwapi-l1-1-0
AssocQueryStringW
api-ms-win-core-string-l2-1-1
SHLoadIndirectString
rpcrt4
RpcStringFreeW
UuidToStringW
UuidCreate
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-heap-l1-1-0
HeapReAlloc
GetProcessHeap
HeapDestroy
HeapAlloc
HeapFree
HeapSize
fwpuclnt
FwpmFreeMemory0
FwpmEngineClose0
FwpmEngineOpen0
FwpmFilterGetById0
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
52KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=52, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=18, id=260, version=33145,
count=128, id=1, productName=Unmarked objects,
count=11, id=257, version=33145,
count=11, id=261, version=33145,
count=1, id=256, version=33145,
count=22, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WiFiCloudStore.dll
- IMPHASH da8615c50468a724ab0d742b1bfc25e4
- SHA256 49ff652910891a887341cb70e063f98d154196ff0250d328a4c8452fd26e5c0b
- MD5 03225bee73fa0b4229e972e30aaaa398
- SHA1 c8f216ebc01fb5d3f62af20006e1d83ed2fd7511
- SHA512 7a9179210c0b70a55c34961444c5f02cdd430eca3024d00f1602ffcfe502c81b26f7de8abdca8950a49c3f8d9448e9b5b23e5a0bb09235554d9f7876b7ff4b84
- SSDEEP 6144:fZi9ZmNIHc5DULzMVjVeye1VlgDYLIhhfq+rYGI/fY:BijmNIHc5D8zMVxeyevRMYGYY
- TLSH T171845D2DA6EC04E4E17BD07DD6934A0BF6B1386A036256CB06D482791F3BFE8653DB11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
188112
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WiFiCloudStore.pdb
msvcp_win
?setf@ios_base@std@@QEAAHHH@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?good@ios_base@std@@QEBA_NXZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?flags@ios_base@std@@QEBAHXZ
?uncaught_exception@std@@YA_NXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGXZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?width@ios_base@std@@QEAA_J_J@Z
?width@ios_base@std@@QEBA_JXZ
?_Xout_of_range@std@@YAXPEBD@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG0@Z
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@I@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEAI@Z
?_Xbad_function_call@std@@YAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?is@?$ctype@G@std@@QEBA_NFG@Z
??1_Locinfo@std@@QEAA@XZ
??1_Lockit@std@@QEAA@XZ
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??0_Locinfo@std@@QEAA@PEBD@Z
??0_Lockit@std@@QEAA@H@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$ctype@G@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?id@?$collate@G@std@@2V0locale@2@A
_Wcsxfrm
_Wcscoll
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?tolower@?$ctype@G@std@@QEBAGG@Z
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_ceilf
_o_free
_o_malloc
_o_realloc
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__configure_narrow_argv
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__cexit
_o__callnewh
_o__crt_atexit
_o___stdio_common_vswprintf
__std_terminate
__CxxFrameHandler4
_o___stdio_common_vsprintf
__std_type_info_compare
strchr
_o___stdio_common_vsnprintf_s
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
wcscmp
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
FreeLibrary
GetModuleHandleW
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleExW
api-ms-win-core-synch-l1-2-0
InitOnceComplete
Sleep
InitOnceExecuteOnce
InitOnceBeginInitialize
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockExclusive
ReleaseMutex
WaitForSingleObject
OpenSemaphoreW
ReleaseSemaphore
ReleaseSRWLockShared
CreateMutexExW
InitializeCriticalSectionEx
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
AcquireSRWLockShared
CreateSemaphoreExW
AcquireSRWLockExclusive
WaitForSingleObjectEx
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
SetLastError
RaiseException
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsDeleteString
api-ms-win-core-winrt-error-l1-1-0
SetRestrictedErrorInfo
RoOriginateError
GetRestrictedErrorInfo
RoFailFastWithErrorContext
RoOriginateErrorW
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
WideCharToMultiByte
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
FreeLibraryWhenCallbackReturns
WaitForThreadpoolTimerCallbacks
api-ms-win-eventing-provider-l1-1-0
EventActivityIdControl
EventUnregister
EventSetInformation
EventWriteTransfer
EventRegister
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-com-l1-1-0
CoUninitialize
CoCreateGuid
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
CoSetProxyBlanket
CoCreateInstance
StringFromGUID2
CoInitializeEx
CoTaskMemFree
CLSIDFromString
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount64
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-security-base-l1-1-0
EqualSid
CheckTokenMembership
IsWellKnownSid
GetTokenInformation
ntdll
RtlGetDeviceFamilyInfoEnum
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-file-l1-1-0
CompareFileTime
api-ms-win-core-registry-l1-1-0
RegDeleteValueW
RegGetValueW
RegQueryInfoKeyW
RegEnumValueW
RegSetValueExW
RegCreateKeyExW
RegEnumKeyExW
RegCloseKey
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
TriggerCloudSyncOnCostChange
Name
.text
Size
268KB
Virtual Size
264KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
64KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
232B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
980B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=66, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=11, id=260, version=33145,
count=5, id=259, version=33145,
count=1286, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=29, id=261, version=33145,
count=1, id=256, version=33145,
count=19, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WiFiConfigSP.dll
- IMPHASH b4a19a5ae743f1e440cb301a641ca9c4
- SHA256 83f65ec0aad38778de830aa379c23018369438ca55f021772ff523544d1089d8
- MD5 1f98a5bd17f1f7195f520991c705e044
- SHA1 fe2dbf5061403ce2122ffda6084111672ea035ff
- SHA512 39580cf53110050726cca42dcfa1a9ff3d0f8c15d97b3e5b5d4300206b526a3a271d81d9baf746759ea68ecbf50fb00385a4e0755669ef7e1ead7fa469a753f1
- SSDEEP 1536:NsvIdSjet3huGKst8CQz9C5JRjXULD1Fj68hcL7P9hiPmoCKrXb:FdD5Kst7kC5DjE1Ad2Pmoj/
- TLSH T16C932A4EA6B42098D4768678C6520616EB717839372287EF02B0D1B96F57BF01F3CF99
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5088
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WiFiConfigSP.pdb
msvcrt
_wtoi
wcscpy_s
wcschr
_wcsicmp
malloc
_XcptFilter
_amsg_exit
__dllonexit
_unlock
_callnewh
wcsnlen
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
memcpy
??1type_info@@UEAA@XZ
wcsncmp
?terminate@@YAXXZ
free
__CxxFrameHandler4
_CxxThrowException
memcpy_s
_vsnwprintf
_lock
_onexit
__C_specific_handler
wcsstr
_initterm
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
GetModuleFileNameA
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-1-0
OpenSemaphoreW
CreateSemaphoreExW
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx
CreateMutexExW
WaitForSingleObject
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventWriteTransfer
EventRegister
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage
GetTraceLoggerHandle
GetTraceEnableFlags
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
oleaut32
SysStringLen
SysAllocString
SysFreeString
winhttp
WinHttpConnectionDeleteProxyInfo
WinHttpConnectionSetProxyInfo
WinHttpConnectionFreeProxyInfo
WinHttpConnectionGetProxyInfo
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegSetValueExW
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
wlanapi
WlanSetProfileMetadata
WlanGetProfileMetadata
WlanSetProfileEapXmlUserData
WlanCloseHandle
WlanEnumInterfaces
WlanDeleteProfile
WlanOpenHandle
WlanGetProfile
WlanPrivateSetProfile
WlanGetProfileList
WlanFreeMemory
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
DllCanUnloadNow
DllGetClassObject
DllMain
Name
.text
Size
48KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
268B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=46, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=14, id=260, version=33145,
count=5, id=259, version=33145,
count=113, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=5, id=261, version=33145,
count=1, id=256, version=33145,
count=6, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WiFiDisplay.dll
- IMPHASH e009d63335a1173317d90122b0a08227
- SHA256 3dd19d85fb0cdf89524cbc5993386bb36924b56d4242d4bccf64d6dacb12b9c7
- MD5 13fcd1143915de015125cde74b365f07
- SHA1 b3e71394b17e2d53642e6ccdb54a713ddd595178
- SHA512 72035a4328599c350678f7bae562f1cb1d145d957f31863fbc3e679fd78302b5808ae4c8a7797c83d3835ae87132ac19f0a0319a693b86c9ba77975e91d4aaae
- SSDEEP 12288:5GeeSMoUnJuvfx0whwAKXi5/L8H2IPoDi89tmV:tMo0Y/4pPsi89tm
- TLSH T154943B2DE2F914A5E4F6C67C84521719E671386E1F319ADB02A48178AF03FF4AD34F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
8512
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WiFiDisplay.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o_isdigit
_o_malloc
_o_terminate
_o_wcscpy_s
_o_wcsncpy_s
__C_specific_handler
__CxxFrameHandler3
__current_exception
__current_exception_context
_o__execute_onexit_table
_CxxThrowException
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o__atoi64
_o___stdio_common_vswprintf
__std_terminate
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
wcscmp
wcspbrk
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleW
LoadLibraryExW
GetModuleHandleExA
FreeLibrary
GetProcAddress
api-ms-win-core-synch-l1-1-0
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
AcquireSRWLockShared
CreateEventW
ReleaseSRWLockShared
InitializeCriticalSectionAndSpinCount
ResetEvent
ReleaseMutex
DeleteCriticalSection
WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection
ReleaseSRWLockExclusive
ReleaseSemaphore
EnterCriticalSection
CreateMutexExW
SetEvent
CreateSemaphoreExW
CreateEventExW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-threadpool-l1-2-0
StartThreadpoolIo
CreateThreadpoolIo
CancelThreadpoolIo
SubmitThreadpoolWork
CreateThreadpoolWork
CloseThreadpool
SetThreadpoolTimer
SetThreadpoolThreadMaximum
CreateThreadpool
CloseThreadpoolCleanupGroup
WaitForThreadpoolTimerCallbacks
CreateThreadpoolCleanupGroup
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
SetThreadpoolThreadMinimum
CreateThreadpoolTimer
CloseThreadpoolCleanupGroupMembers
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
CreateThread
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-eventing-classicprovider-l1-1-0
RegisterTraceGuidsW
GetTraceEnableFlags
UnregisterTraceGuids
TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount64
GetComputerNameExW
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
ntdll
NtQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlGetDeviceFamilyInfoEnum
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
RegGetValueW
RegNotifyChangeKeyValue
devobj
DevObjDestroyDeviceInfoList
DevObjOpenDeviceInfo
DevObjCreateDeviceInfoList
DevObjOpenDevRegKey
api-ms-win-core-file-l1-1-0
CreateFileW
ReadFile
SetFilePointer
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventSetInformation
EventUnregister
EventActivityIdControl
EventWriteTransfer
ws2_32
send
connect
WSAIoctl
getsockname
recv
listen
bind
setsockopt
WSAGetLastError
socket
WSACleanup
WSAStartup
getpeername
WSAAddressToStringW
htons
ntohs
shutdown
InetPtonW
closesocket
sspicli
DeleteSecurityContext
EncryptMessage
DecryptMessage
ImportSecurityContextW
InitializeSecurityContextW
QueryContextAttributesW
AcquireCredentialsHandleW
AcceptSecurityContext
FreeCredentialsHandle
ExportSecurityContext
FreeContextBuffer
api-ms-win-devices-query-l1-1-1
DevCreateObjectQueryEx
api-ms-win-devices-query-l1-1-0
DevCloseObjectQuery
DevFreeObjects
DevGetObjects
api-ms-win-devices-config-l1-1-1
CM_Unregister_Notification
CM_Register_Notification
dnsapi
DnsServiceRegister
DnsServiceConstructInstance
DnsServiceFreeInstance
DnsServiceDeRegister
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-com-l1-1-0
CoCreateGuid
mswsock
AcceptEx
rpcrt4
UuidFromStringW
api-ms-win-dx-d3dkmt-l1-1-1
D3DKMTNetDispQueryMiracastDisplayDeviceSupport
iphlpapi
GetIfEntry2Ex
ConvertInterfaceLuidToGuid
GetAdaptersAddresses
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
CloseMiracastSession
CreateDAFProviderMiracastHelper
CreateInfraCastSourceConnector
CreateWiFiDisplayEtwProvider
IsMiracastSupportedByWlan
MiracastFreeMemory
MiracastIeDecode
MiracastIeEncode
MiracastQueryParameters
MiracastRegisterDatarateCallback
MiracastUnregisterDatarateCallback
OpenMiracastSession
VsIeProviderGetFunctionTable
WFDDisplaySinkCloseSession
WFDDisplaySinkDeInit
WFDDisplaySinkInit
WFDDisplaySinkQueryCapabilities
WFDDisplaySinkSetPersistedGroupIDList
WFDDisplaySinkSetProperty
WFDDisplaySinkStart
WFDDisplaySinkStartEx
WFDDisplaySinkStop
Name
.text
Size
304KB
Virtual Size
303KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
60KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
528B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
796B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=85, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=1304, id=1, productName=Unmarked objects,
count=2, id=257, version=33145,
count=29, id=261, version=33145,
count=1, id=256, version=33145,
count=61, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WiaExtensionHost64.dll
- IMPHASH 38976a45dfdc1e4d311686fba8b589b1
- SHA256 e95abd61fad5cb1401dbffada81efa24f1ff395aa531f2cf09dd0686b297d6c1
- MD5 50dec13414ebcd7ff13992235b490e5c
- SHA1 aa1019a2db9312c8c743d11d189e5c02971ba35f
- SHA512 c3fe7328aeb610c73ba6253617d3720634fcb7abd9803eef96d32697038fedb37045a920fdb3fca2b458568a9997fdbe2ae3fcfc7c63d6de93bc4adbfb7960e1
- SSDEEP 192:t9BpZu1wBMAPeQBaBs4ci9IzlgfSvnE4PnsU8yLxQVWab4tW0:VpZM0mQQBs4B6zn/CU82KWaMtW
- TLSH T1CAF2FA84BBA60DA9F876C63C99D38B49A178FA11472287CF4391069D1D33FD16638FD2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5120
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WiaExtensionHost64.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___std_type_info_destroy_list
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
_o_free
_o_malloc
__C_specific_handler
api-ms-win-crt-string-l1-1-0
memset
kernel32
IsProcessorFeaturePresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetCurrentProcess
UnhandledExceptionFilter
TerminateProcess
SetUnhandledExceptionFilter
IsDebuggerPresent
ole32
CoCreateInstance
CoInitializeEx
CoUninitialize
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
564B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=33145,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1087, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=11, id=260, version=33145,
count=4, id=259, version=33145,
count=15, id=261, version=33145,
count=1, id=256, version=33145,
count=3, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
Win32CompatibilityAppraiserCSP.dll
- IMPHASH c03c736afcb1006c957f1108fba4ab6f
- SHA256 a34d718d64fb6875737ed9da392c49d0182d2c930dcfedb0c43057682ae682e3
- MD5 11aa4d3eb374828da92380bf6daa94d2
- SHA1 29e78a380bf6f61db7ab8d72458b3c53ceee90e4
- SHA512 33e8cb071d3f51cc60e45b54d80efd2e200eac861c78ee3ffde145f9a3c1dab72df182c351e036e75481d3b3732b8c97d566e6399f59406dff21659f06bfd035
- SSDEEP 6144:mIS/EcZL53a0ZPg1tbrf9VwO4mVNP1hg1UkynXbPif1:mZZL53Ng1tbD9q1SbP
- TLSH T1D6643A6D62E614A5F677C23CC9538512F2B2B4351721A2CF02A4C07E6E77FE4A638F91
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
22848
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win32CompatibilityAppraiserCSP.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsicmp
_o__wcslwr
_o__wcsnicmp
memmove
_o__wtof
_o__wtoi
_o_free
_o_iswspace
_o_malloc
_o_memcpy_s
_o_strcpy_s
_o_wcscat_s
_o_wcscpy_s
_o_wcstoul
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
wcschr
wcsrchr
wcsstr
strchr
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
wcscmp
memset
strncmp
api-ms-win-core-com-l1-1-0
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc
CoInitializeEx
oleaut32
SysFreeString
VariantInit
SysAllocString
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventRegister
EventWriteTransfer
EventSetInformation
ntdll
ZwQuerySystemInformation
ZwUnmapViewOfSection
ZwMapViewOfSection
RtlVerifyVersionInfo
RtlMultiByteToUnicodeN
RtlGetNativeSystemInformation
RtlUpcaseUnicodeChar
RtlAnsiStringToUnicodeString
RtlxAnsiStringToUnicodeSize
LdrResSearchResource
EtwEventRegister
RtlInitAnsiString
RtlEnterCriticalSection
EtwEventWrite
EtwEventUnregister
RtlGUIDFromString
ZwCreateSection
ZwQueryInformationFile
ZwCreateFile
RtlAllocateAndInitializeSid
RtlEqualString
RtlInitUnicodeString
RtlAppendUnicodeToString
RtlAppendUnicodeStringToString
ZwQueryValueKey
RtlInitUnicodeStringEx
ZwEnumerateKey
LdrGetDllHandle
RtlInitString
LdrGetProcedureAddress
RtlDosPathNameToRelativeNtPathName_U_WithStatus
NtCreateFile
NtQueryInformationFile
NtClose
ZwOpenKey
RtlFreeUnicodeString
RtlAllocateHeap
WinSqmIsOptedInEx
RtlDeleteCriticalSection
RtlDosPathNameToNtPathName_U_WithStatus
ZwClose
RtlFreeSid
RtlLeaveCriticalSection
RtlFreeHeap
RtlNtStatusToDosError
RtlInitializeCriticalSection
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
GetModuleHandleW
FreeLibrary
GetModuleFileNameW
DisableThreadLibraryCalls
GetProcAddress
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-kernel32-legacy-l1-1-1
VerifyVersionInfoW
api-ms-win-core-sysinfo-l1-2-0
VerSetConditionMask
api-ms-win-core-registry-l1-1-0
RegEnumValueW
RegCloseKey
RegGetValueW
RegQueryInfoKeyW
RegOpenKeyExW
RegSetValueExW
RegDeleteTreeW
RegCreateKeyExW
rpcrt4
UuidCreate
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
kernel32
HeapReAlloc
GetSystemDirectoryW
GetFileAttributesW
GetTickCount
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SetLastError
ExpandEnvironmentStringsW
SetThreadpoolTimer
SetEvent
GetSystemTime
GetPrivateProfileSectionW
WaitNamedPipeW
GetLocalTime
GetModuleHandleExA
CreateFileW
OutputDebugStringA
WriteFile
SetNamedPipeHandleState
DebugBreak
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
OutputDebugStringW
FormatMessageW
InitializeCriticalSectionEx
GetModuleHandleExW
CreateSemaphoreExW
GetModuleFileNameA
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
CreateMutexW
WaitForSingleObject
WTSGetActiveConsoleSessionId
GlobalFree
ExitProcess
ReleaseMutex
EnterCriticalSection
LeaveCriticalSection
CreateEventW
CreateSemaphoreW
OpenWaitableTimerW
CreateWaitableTimerW
LocalFree
WaitForMultipleObjects
ReleaseSemaphore
SetWaitableTimer
CloseHandle
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
ext-ms-win-wevtapi-eventlog-l1-1-2
EvtNext
EvtQuery
ext-ms-win-wevtapi-eventlog-l1-1-0
EvtRender
EvtCreateRenderContext
EvtClose
ext-ms-win-session-wtsapi32-l1-1-0
WTSFreeMemory
WTSQueryUserToken
WTSEnumerateSessionsW
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFileExistsW
winhttp
WinHttpCloseHandle
WinHttpGetDefaultProxyConfiguration
WinHttpSetOption
WinHttpOpen
WinHttpGetIEProxyConfigForCurrentUser
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpQueryAuthSchemes
WinHttpGetProxyForUrl
WinHttpSetCredentials
WinHttpConnect
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpReadData
api-ms-win-core-version-l1-1-0
VerQueryValueW
api-ms-win-core-version-l1-1-1
GetFileVersionInfoW
GetFileVersionInfoSizeW
api-ms-win-core-path-l1-1-0
PathCchAppend
api-ms-win-security-base-l1-1-0
SetSecurityDescriptorDacl
RevertToSelf
InitializeSecurityDescriptor
ImpersonateLoggedOnUser
api-ms-win-security-provider-l1-1-0
SetEntriesInAclW
api-ms-win-security-credentials-l1-1-0
CredReadW
CredFree
xmllite
CreateXmlWriter
api-ms-win-shcore-stream-l1-1-0
IStream_Size
SHCreateMemStream
api-ms-win-service-management-l1-1-0
OpenSCManagerW
CloseServiceHandle
OpenServiceW
api-ms-win-service-management-l2-1-0
QueryServiceStatusEx
QueryServiceConfigW
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionAndSpinCount
ResetEvent
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
208KB
Virtual Size
207KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
64KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=99, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=1481, id=1, productName=Unmarked objects,
count=6, id=257, version=33145,
count=36, id=261, version=33145,
count=1, id=256, version=33145,
count=115, id=264, version=33145,
count=2, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
Win32_DeviceGuard.dll
- IMPHASH a44261e9380c63cbd3605e954a4c0744
- SHA256 5b1e142ff7d9de0d43292399e70b4d698d9b2337deb26d461716a438e40e07cc
- MD5 7d97c7c7c8f4b63b251c79a48f0e982f
- SHA1 50adfbe2b2e97b28e74a846ba46c55e18b685451
- SHA512 0be52a24de573ef30bcf5adcbff62a30ec51fc3dfa7415ef5a117b6cc6421ee4fcf2a08e017534d19de716a63f2cc80bf3668c6727f493b4f64bbe5cf48be657
- SSDEEP 1536:xDTV6nM37KxZzDK6eo4AxLmMbxKsOP97mm/lKXZAhOj+:xo9ZzDK6GN0KsTVXSh
- TLSH T185D3821BEB50985BC8768632C96B0F727BB7EB54138203CF4514822E2DA73CB1F75999
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4752
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win32_DeviceGuard.pdb
msvcrt
swprintf_s
_initterm
_amsg_exit
_XcptFilter
malloc
free
__C_specific_handler
_wcsnicmp
memcpy
memset
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetTickCount
GetComputerNameExW
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
FreeLibrary
LoadLibraryExW
DisableThreadLibraryCalls
api-ms-win-core-sysinfo-l1-2-0
GetSystemFirmwareTable
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-firmware-l1-1-0
GetFirmwareEnvironmentVariableExW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
ntdll
NtOpenThreadToken
NtClose
NtQuerySystemInformationEx
RtlAllocateHeap
NtAdjustPrivilegesToken
RtlFreeHeap
NtQuerySystemInformation
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
GetProviderClassID
MI_Main
Name
.text
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
84KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
780B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=28, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33145,
count=4, id=259, version=33145,
count=74, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=1, id=256, version=33145,
count=14, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WinBioDataModel.dll
- IMPHASH 293646bb73924a2b03ffa17f65052d35
- SHA256 357bd94630bb71f2fbd528da6db3eef575fab9d99b1a96614e8da00373f4a70d
- MD5 3f7f635dc7d19b3277fd9f040e0943a9
- SHA1 27f413ac04045bae95dcf6308333803990130a2d
- SHA512 cf7afb54bebe58c416e35f6e701abf261093640764cea9edb61ecd7e3daf45d9caadf6ea3ae45aa057e2e637b04885836a61d5435e9e2bde2231b2d8a088c170
- SSDEEP 6144:gSuD9Me410gfxT7Z8oPOwEghmTyUsTiRO2Ql+prdyvzkVd2G/GDqrySrYCR91nR:AMe410gfxTMwDm/RO2QOdcz2djkq/9
- TLSH T17EC44A6F6AFC0396E07AD13CC5534A1DE7B278604362E6CF015442AE9E2BFD4593EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
15312
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
winbiodatamodel.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__get_errno
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
memmove
_o__wcsicmp
_o_floorf
_o_free
_o_malloc
_o_realloc
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_CxxThrowException
__CxxFrameHandler3
wcschr
wcsrchr
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
wcscspn
api-ms-win-core-libraryloader-l1-2-0
LoadResource
GetModuleHandleExW
GetModuleHandleExA
LockResource
FindResourceExW
GetProcAddress
FreeLibrary
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleW
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockShared
InitializeCriticalSection
AcquireSRWLockShared
SetEvent
CreateEventExW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ResetEvent
WaitForSingleObjectEx
DeleteCriticalSection
ReleaseSemaphore
InitializeCriticalSectionAndSpinCount
CreateEventW
LeaveCriticalSection
OpenSemaphoreW
EnterCriticalSection
WaitForSingleObject
InitializeCriticalSectionEx
InitializeSRWLock
CreateMutexExW
ReleaseMutex
CreateSemaphoreExW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
RaiseException
GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
GetCurrentThread
OpenProcessToken
OpenThreadToken
GetProcessId
TerminateProcess
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringOrdinal
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventRegister
EventActivityIdControl
EventUnregister
EventWriteTransfer
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
GetRestrictedErrorInfo
RoOriginateErrorW
RoTransformError
SetRestrictedErrorInfo
RoFailFastWithErrorContext
oleaut32
SysFreeString
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-core-winrt-string-l1-1-0
WindowsDuplicateString
WindowsSubstringWithSpecifiedLength
WindowsReplaceString
WindowsDeleteString
WindowsCreateString
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount64
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
OpenProcess
IsProcessorFeaturePresent
api-ms-win-core-com-l1-1-0
CoTaskMemRealloc
CoGetCallerTID
CoGetInterfaceAndReleaseStream
CreateStreamOnHGlobal
PropVariantClear
CoTaskMemAlloc
CoMarshalInterface
CoGetMalloc
CoCreateInstance
CoWaitForMultipleHandles
CoReleaseMarshalData
CoTaskMemFree
CoGetCallContext
CoCreateFreeThreadedMarshaler
api-ms-win-security-base-l1-1-0
IsValidSid
EqualSid
GetTokenInformation
DuplicateTokenEx
CopySid
GetLengthSid
rpcrt4
I_RpcBindingInqLocalClientPID
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoActivateInstance
api-ms-win-core-winrt-error-l1-1-1
RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
LocalReAlloc
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
ConvertStringSidToSidW
api-ms-win-core-registry-l2-1-0
RegOpenKeyW
api-ms-win-power-base-l1-1-0
GetPwrCapabilities
api-ms-win-core-sysinfo-l2-1-0
GetUserNameW
api-ms-win-core-threadpool-legacy-l1-1-0
CreateTimerQueueTimer
DeleteTimerQueueTimer
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-rtcore-ntuser-window-l1-1-0
GetWindowThreadProcessId
ntdll
NtQueryWnfStateData
RtlUnsubscribeWnfStateChangeNotification
RtlSubscribeWnfStateChangeNotification
RtlPublishWnfStateData
RtlFreeHeap
NtQueryInformationToken
RtlCompareUnicodeString
RtlNtStatusToDosErrorNoTeb
RtlAllocateHeap
RtlInitUnicodeString
RtlIsMultiSessionSku
twinapi.appcore
ord3
ord2
msvcp_win
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-security-capability-l1-1-0
CapabilityCheck
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
384KB
Virtual Size
381KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
132KB
Virtual Size
129KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
504B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=89, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=16, id=260, version=33145,
count=5, id=259, version=33145,
count=1293, id=1, productName=Unmarked objects,
count=6, id=257, version=33145,
count=30, id=261, version=33145,
count=1, id=256, version=33145,
count=41, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WindowManagement.dll
- IMPHASH 23a84723e0a8310c8fc1f875afc04bcb
- SHA256 930bd57e6fb571cb88831c5622200eeed884c909241f2f842e1ec30b90719d56
- MD5 732ebc24b6da0e20c6c16927fd124f59
- SHA1 da07464e70603f6be831c8ba53bd4b4065454b4d
- SHA512 ebed57439dbf102977476020ef45bf983143634a51a18a2764dfb1774e09f330a20592df08a64cd617762c418c0153e83d1d2a4fbc53487f20a2427d3e9c752c
- SSDEEP 49152:dMGbeRDtQkmd4MrfkevuPe8eaFj2tBrI1wloWMr:kZOnx1X63
- TLSH T1F1C5391F16EC41C9E27AE23CC15B4B0EF2B234571332AACF0595566A9F17BE4897E720
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
801808
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WindowManagement.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsicmp
memmove
_o_ceilf
_o_free
_o_malloc
_o_realloc
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
__CxxFrameHandler3
_CxxThrowException
_o___stdio_common_vswprintf
_o__cexit
_o__callnewh
_o__crt_atexit
_o__execute_onexit_table
_o__errno
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__configure_narrow_argv
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
wcschr
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleHandleExW
FreeLibrary
GetModuleHandleW
GetModuleFileNameA
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceExecuteOnce
InitOnceComplete
WakeByAddressAll
InitOnceBeginInitialize
WaitOnAddress
api-ms-win-core-synch-l1-1-0
CreateSemaphoreExW
EnterCriticalSection
ReleaseSemaphore
LeaveCriticalSection
InitializeCriticalSectionEx
WaitForSingleObject
ReleaseMutex
ReleaseSRWLockExclusive
InitializeCriticalSectionAndSpinCount
AcquireSRWLockExclusive
WaitForSingleObjectEx
CreateEventExW
OpenSemaphoreW
InitializeCriticalSection
InitializeSRWLock
CreateMutexExW
AcquireSRWLockShared
DeleteCriticalSection
ReleaseSRWLockShared
SetEvent
ResetEvent
CreateEventW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
GetLastError
SetLastError
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolWork
SetThreadpoolTimer
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SubmitThreadpoolWork
api-ms-win-core-processthreads-l1-1-0
OpenProcessToken
OpenThreadToken
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetCurrentThread
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringOrdinal
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
GetRestrictedErrorInfo
RoTransformError
SetRestrictedErrorInfo
RoOriginateError
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-winrt-string-l1-1-0
WindowsTrimStringStart
WindowsGetStringLen
WindowsCompareStringOrdinal
WindowsDuplicateString
WindowsCreateStringReference
WindowsCreateString
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsDeleteString
api-ms-win-core-com-l1-1-0
CoGetApartmentType
CoIncrementMTAUsage
CoDecrementMTAUsage
CoWaitForMultipleHandles
CoReleaseMarshalData
CoGetCallContext
CoGetInterfaceAndReleaseStream
CreateStreamOnHGlobal
CoRevertToSelf
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
CoMarshalInterface
CoImpersonateClient
CoTaskMemRealloc
CoGetMalloc
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoRegisterActivationFactories
RoInitialize
RoGetActivationFactory
RoUninitialize
api-ms-win-core-registry-l1-1-0
RegGetValueW
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount64
ntdll
NtQueryInformationProcess
RtlGetDeviceFamilyInfoEnum
RtlInitUnicodeString
NtQueryInformationToken
RtlAllocateHeap
RtlNtStatusToDosErrorNoTeb
RtlCompareUnicodeString
RtlAcquireSRWLockExclusive
RtlWakeAllConditionVariable
RtlFreeHeap
RtlNtStatusToDosError
RtlIsMultiSessionSku
RtlSleepConditionVariableSRW
RtlAcquireSRWLockShared
RtlReleaseSRWLockExclusive
api-ms-win-shcore-thread-l1-1-0
SHCreateThread
api-ms-win-core-winrt-error-l1-1-1
IsErrorPropagationEnabled
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureStackBackTrace
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
twinapi.appcore
ord2
rmclient
HamCreateActivityForProcess
HamStartActivityAsync
HamStopActivity
HamTerminateActivityHostEx
HamCloseActivity
HamQueryActivityPendDiagnostics
HamPendDiagnosticsToWaitTimeout
HamInitializeActivityDynamicProperties
HamUpdateActivityProperties
HamConnectToServer
HamDisconnectFromServer
HamPopulateActivityPropertiesByClass
msvcp_win
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?width@ios_base@std@@QEAA_J_J@Z
?widen@?$ctype@G@std@@QEBAGD@Z
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGXZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@_N@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@H@Z
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
??Bid@locale@std@@QEAA_KXZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@M@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@I@Z
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
?id@?$ctype@G@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?uncaught_exception@std@@YA_NXZ
?flags@ios_base@std@@QEBAHXZ
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?good@ios_base@std@@QEBA_NXZ
?width@ios_base@std@@QEBA_JXZ
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG0@Z
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
combase
ord168
coremessaging
CoreUICallSend
MsgRelease
CoreUICreate
MsgBlobCreateShared
CoreUICallReceive
CoreUICallCreateConversationHost
MsgStringCreateShared
coreuicomponents
CoreUIFactoryCreate
api-ms-win-security-capability-l1-1-0
CapabilityCheck
api-ms-win-security-base-l1-1-0
GetTokenInformation
DuplicateTokenEx
AllocateLocallyUniqueId
rpcrt4
I_RpcBindingInqLocalClientPID
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolQueueTask
SHTaskPoolAllowThreadReuse
SHTaskPoolGetUniqueContext
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-ntuser-rectangle-l1-1-0
IsRectEmpty
api-ms-win-rtcore-ntuser-window-l1-1-0
GetWindowLongW
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-appmodel-runtime-l1-1-0
GetApplicationUserModelId
api-ms-win-ro-typeresolution-l1-1-1
RoCreatePropertySetSerializer
api-ms-win-appmodel-runtime-l1-1-1
ParseApplicationUserModelId
GetApplicationUserModelIdFromToken
FindPackagesByPackageFamily
api-ms-win-core-quirks-l1-1-0
QuirkIsEnabledForPackage
api-ms-win-ntuser-sysparams-l1-1-0
GetMonitorInfoW
EnumDisplayMonitors
EnumDisplayDevicesW
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
1.8MB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
440KB
Virtual Size
439KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
108KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
44KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=101, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33145,
count=5, id=259, version=33145,
count=1348, id=1, productName=Unmarked objects,
count=12, id=257, version=33145,
count=33, id=261, version=33145,
count=1, id=256, version=33145,
count=119, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WindowManagementAPI.dll
- IMPHASH a64bc0fdd54ec8f7452f9f7bd575bace
- SHA256 2551800153fe8a54312e13f63fdd7e2ffaee994c6733b6cbcb17e1739f13ee1e
- MD5 f531a0e0aa96e41c6de18d8336c19606
- SHA1 49d23777801e3196816c11abd783f2af3e1468e1
- SHA512 2d7051329bab0b690f3d32c2fa9e3fa9556c8b7e2851466e673f54976191176670cc76679bc2ca3ac36deaabf154df259ccc4657137230a2f628d14fcb1173f4
- SSDEEP 24576:rZbOfcxfw0WupJKWvZaMDPV34S8vh098adEZk4qE/f8:rZnaw8MDZ4Sco8adP4qik
- TLSH T1DF853A5E1AEC00D9E2B9E23DC1574A0DE2F138525372ABCF0155166FDE2BBE4497AB30
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
25:7d:d2:46:09:3b:e8:0c:27:44:0f:a5:c8:69:4a:17:00:9b:11:6f:5e:12:b0:ed:1a:0c:72:49:37:a2:53:21
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:401A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:19:5e:b2:d8:54:75:f4:b1:8d:00:01:00:00:02:19
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
480672
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WindowManagementAPI.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__free_base
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__malloc_base
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_ceilf
_o_free
_o_malloc
_o_realloc
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
__CxxFrameHandler3
_CxxThrowException
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetModuleHandleW
GetModuleFileNameA
GetProcAddress
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionAndSpinCount
ReleaseSemaphore
CreateSemaphoreExW
CreateMutexExW
OpenSemaphoreW
InitializeSRWLock
WaitForSingleObject
ReleaseMutex
CreateEventW
SetEvent
ResetEvent
WaitForSingleObjectEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ReleaseSRWLockShared
AcquireSRWLockShared
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
api-ms-win-core-processthreads-l1-1-0
OpenProcessToken
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-winrt-error-l1-1-0
GetRestrictedErrorInfo
SetRestrictedErrorInfo
RoOriginateError
RoOriginateErrorW
RoTransformError
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
WakeByAddressAll
WaitOnAddress
InitOnceExecuteOnce
InitOnceComplete
api-ms-win-core-winrt-string-l1-1-0
WindowsIsStringEmpty
WindowsCompareStringOrdinal
WindowsCreateString
WindowsCreateStringReference
WindowsDuplicateString
WindowsStringHasEmbeddedNull
WindowsGetStringRawBuffer
WindowsDeleteString
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-registry-l1-1-0
RegGetValueW
ntdll
RtlNtStatusToDosError
NtQueryInformationProcess
RtlGetDeviceFamilyInfoEnum
RtlCaptureStackBackTrace
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-com-l1-1-0
CoGetApartmentType
CoCreateFreeThreadedMarshaler
CoCreateInstance
CoGetInterfaceAndReleaseStream
CoMarshalInterface
CreateStreamOnHGlobal
CoTaskMemAlloc
CoReleaseMarshalData
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoGetActivationFactory
api-ms-win-core-winrt-error-l1-1-1
IsErrorPropagationEnabled
RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-ro-typeresolution-l1-1-1
RoCreateNonAgilePropertySet
RoCreatePropertySetSerializer
api-ms-win-core-largeinteger-l1-1-0
MulDiv
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
CreateAndSetCoreAppModel
CreateWindowInformation
CreateWindowLayout
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
352KB
Virtual Size
349KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
80KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
568B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
40KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=73, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33145,
count=5, id=259, version=33145,
count=1241, id=1, productName=Unmarked objects,
count=2, id=257, version=33145,
count=34, id=261, version=33145,
count=1, id=256, version=33145,
count=100, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
Windows.AI.Agents.dll
- IMPHASH f97d46dee4b73593187f515b8f1bd96a
- SHA256 d43ded9f8a318755ea12909529abffce57e9fa202e61009953944275528f5beb
- MD5 6c9fe886a7364ec68e11edd94a1c8112
- SHA1 8404365dc3286fdc0324fdd21ab8eaff8f93b775
- SHA512 cd036512387b57a13e1bc00e3fc97e9179e0e62135da1527f0f716a068ea2015d9a8620054412977e14f2527b25b4dc58659ffe43f654716cd5b725f85060815
- SSDEEP 1536:VRrsY7CJELNhHUIb+7zfpCeeWR4kt+dH2bIrBHS53+v:YY7dLNhHZyPp6W6ktrbn+v
- TLSH T13F636C5576EA01FAE03A813DC4D31E0AE672F8515B215BCF0764835E2F23BD1AA7E391
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
6464
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Windows.AI.Agents.pdb
kernel32
FormatMessageW
GetCurrentThreadId
GetProcessHeap
HeapAlloc
GetModuleHandleW
HeapFree
GetModuleHandleExW
GetModuleFileNameA
DebugBreak
GetLastError
WideCharToMultiByte
IsDebuggerPresent
OutputDebugStringW
GetProcAddress
SetLastError
CloseHandle
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx
WaitForSingleObject
OpenSemaphoreW
GetCurrentProcessId
CreateMutexExW
CreateSemaphoreExW
MultiByteToWideChar
RtlPcToFileHeader
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
RaiseException
EncodePointer
InterlockedFlushSList
RtlUnwindEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
api-ms-win-core-featurestaging-l1-1-0
UnsubscribeFeatureStateChangeNotification
SubscribeFeatureStateChangeNotification
RecordFeatureUsage
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_cexit
terminate
_initialize_narrow_environment
_crt_atexit
_configure_narrow_argv
_seh_filter_dll
_execute_onexit_table
_invalid_parameter_noinfo
_errno
_initterm
_initialize_onexit_table
abort
_register_onexit_function
api-ms-win-crt-string-l1-1-0
iswspace
wcsncmp
strcpy_s
api-ms-win-crt-heap-l1-1-0
calloc
malloc
free
api-ms-win-core-com-l1-1-0
CoCreateInstance
oleaut32
SysFreeString
SetErrorInfo
GetErrorInfo
SysStringLen
api-ms-win-core-winrt-error-l1-1-0
RoCaptureErrorContext
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
DllCanUnloadNow
DllGetActivationFactory
Name
.text
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
960B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
388B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=259, version=34321,
count=10, id=260, version=34321,
count=33, id=261, version=34321,
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=33140,
count=99, id=1, productName=Unmarked objects,
count=2, id=265, version=34444,
count=1, id=256, version=34444,
count=1, id=255, version=34444,
count=1, id=258, version=34444,
Windows.AccountsControl.dll
- IMPHASH 8accb03c41b01957354ae620d51f16e4
- SHA256 1b9cc446bec0eaa5b52d92d7851d28e25c36fd3b6e6b576f02ed07534c2f899f
- MD5 61962306a058e359d7897994c39a6ee0
- SHA1 bc104acebc5cb50b7522ef253508ff7610dccc78
- SHA512 0b1dc2cb4b2e6d2d1328b17f82279997c278802bd301dacfccedb3a5400ab141f14a86c67e59250cec81c30471703d2963ea3b156def396451d2b74a4c588704
- SSDEEP 12288:aPFCtUI56PdfHwPib/kBmLaVgkGgXmE1m7Ai:jeI5gPwabhLZktXmEo
- TLSH T1DFF42B5E2BE8059EE179A23DC1534A1AF7B27C155762D7CF0150526E8E3BFE04E3AB20
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
13888
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Windows.AccountsControl.pdb
xmllite
CreateXmlReader
ntdll
RtlCreateAcl
RtlGetAce
RtlAddAce
RtlLengthSid
RtlSetDaclSecurityDescriptor
NtQuerySecurityObject
RtlCreateSecurityDescriptor
NtSetSecurityObject
RtlGetDeviceFamilyInfoEnum
RtlIsMultiSessionSku
RtlAddAccessAllowedAce
RtlIsMultiUsersInSessionSku
RtlGetDaclSecurityDescriptor
RtlQueryInformationAcl
rpcrt4
I_RpcBindingInqLocalClientPID
NdrOleAllocate
NdrOleFree
NdrDllCanUnloadNow
NdrDllGetClassObject
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
FindResourceExW
DisableThreadLibraryCalls
LockResource
FreeLibrary
GetProcAddress
GetModuleHandleExA
GetModuleHandleExW
GetModuleHandleW
LoadStringW
GetModuleFileNameA
LoadResource
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
InitOnceComplete
Sleep
InitOnceBeginInitialize
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
WaitForSingleObject
ReleaseSRWLockExclusive
CreateSemaphoreExW
ReleaseSemaphore
LeaveCriticalSection
AcquireSRWLockExclusive
WaitForSingleObjectEx
CreateEventW
SetEvent
AcquireSRWLockShared
OpenSemaphoreW
ReleaseSRWLockShared
InitializeSRWLock
InitializeCriticalSectionEx
ReleaseMutex
DeleteCriticalSection
CreateEventExW
CreateMutexExW
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
api-ms-win-core-winrt-string-l1-1-0
WindowsStringHasEmbeddedNull
WindowsCreateString
WindowsCreateStringReference
WindowsDeleteString
HSTRING_UserUnmarshal64
HSTRING_UserUnmarshal
WindowsIsStringEmpty
HSTRING_UserFree
WindowsSubstringWithSpecifiedLength
HSTRING_UserFree64
HSTRING_UserMarshal
HSTRING_UserSize
WindowsGetStringRawBuffer
WindowsCompareStringOrdinal
HSTRING_UserMarshal64
WindowsDuplicateString
WindowsGetStringLen
HSTRING_UserSize64
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventRegister
EventWriteTransfer
EventSetInformation
EventActivityIdControl
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-processthreads-l1-1-0
GetProcessId
GetCurrentThread
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
OpenThreadToken
OpenProcessToken
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
RoOriginateErrorW
SetRestrictedErrorInfo
GetRestrictedErrorInfo
RoOriginateError
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoTaskMemRealloc
CoWaitForMultipleHandles
CoCreateFreeThreadedMarshaler
CoGetApartmentType
CoTaskMemAlloc
CoGetInterfaceAndReleaseStream
CoMarshalInterface
CreateStreamOnHGlobal
CoGetMalloc
CoReleaseMarshalData
CoGetCallerTID
CoTaskMemFree
CoGetCallContext
CoSwitchCallContext
api-ms-win-core-registry-l1-1-0
RegQueryInfoKeyW
RegCloseKey
RegOpenKeyExW
RegEnumKeyExW
RegGetValueW
RegQueryValueExW
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
WideCharToMultiByte
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoGetActivationFactory
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
RoReportFailedDelegate
api-ms-win-security-base-l1-1-0
GetTokenInformation
RevertToSelf
GetLengthSid
CopySid
DuplicateTokenEx
CreateWellKnownSid
GetAce
EqualSid
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolAllowThreadReuse
SHTaskPoolQueueTask
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-storage-exports-external-l1-1-0
STORAGE_CStorageItem_GetValidatedStorageItem
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-rtcore-ntuser-window-l1-1-0
GetAncestor
AllowSetForegroundWindow
api-ms-win-shcore-scaling-l1-1-1
ord244
api-ms-win-appmodel-runtime-l1-1-1
GetPackageFullNameFromToken
api-ms-win-security-base-l1-2-0
CheckTokenMembershipEx
api-ms-win-core-winrt-robuffer-l1-1-0
RoGetBufferMarshaler
crypt32
CertCreateCertificateContext
CertFindCertificateInStore
CertFreeCertificateContext
CertCompareIntegerBlob
CertOpenStore
CertAddCertificateContextToStore
CertSaveStore
CertCloseStore
CertAddSerializedElementToStore
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFileExistsW
api-ms-win-shcore-stream-l1-1-0
SHCreateStreamOnFileEx
shcore
ord265
msvcrt
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
memmove
memcpy
__CxxFrameHandler3
_CxxThrowException
_callnewh
wcscspn
wcstok_s
towupper
_wtoi
_wcsicmp
realloc
_amsg_exit
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
free
malloc
memmove_s
__CxxFrameHandler4
_purecall
??3@YAXPEAX@Z
memcpy_s
_initterm
__C_specific_handler
_unlock
_XcptFilter
memcmp
_vsnwprintf
_lock
memset
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_onexit
__dllonexit
swprintf_s
??_V@YAXPEAX@Z
wcscmp
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
combase
ord157
ord148
ord90
userdatatypehelperutil
FormatPoomIdToString
api-ms-win-appmodel-runtime-l1-1-0
GetPackageFamilyName
GetPackageFullName
GetPackagesByPackageFamily
api-ms-win-security-capability-l1-1-0
CapabilityCheck
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
GetProxyDllInfo
Name
.text
Size
436KB
Virtual Size
432KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
256KB
Virtual Size
255KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=13, id=261, version=33145,
count=19, id=260, version=33145,
count=94, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=257, version=33145,
count=274, id=1, productName=Unmarked objects,
count=1, id=256, version=33145,
count=68, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vss_ps.dll
- IMPHASH bf283de5ce73098559237a17d626494a
- SHA256 36ca3bb48d8e679200647967f86a4f94306748d2a6ea852616e2559dc8e7b118
- MD5 e3adc7c7ef6bb577c169655ff459597e
- SHA1 3e26eee5a2adeccb1bc904c182f5d87f1d244b3c
- SHA512 e143c6fa33320c0af58e4fce811b3db19a669fed3b198292f56cbba4e9fefb05775ec78bd9d1e1dce81299b14a709a5b345b1cdc3cfaa0621e3151a12cf46763
- SSDEEP 384:KKjImXcdEVi9MJ2nBrngTyaEREaM4VFsDxeNV7FGwW/uWLWcqB5Z1:KKTIN1NPVFlVQIWm
- TLSH T12673829DFA144875C438523284AB0E25A369DE059BD347CF01A8122F5EFB3D1AF76EC9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4336
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vss_ps.pdb
api-ms-win-core-crt-l2-1-0
_initterm
_initterm_e
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-crt-l1-1-0
__C_specific_handler
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
228B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
328B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=17, id=260, version=33136,
count=4, id=259, version=33136,
count=25, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=65, id=1, productName=Unmarked objects,
count=1, id=256, version=33136,
count=9, id=264, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
vssapi.dll
- IMPHASH bfe9f205148fb8c1d435f9f70682a4dd
- SHA256 f86f945ccc528f11a0531b244bde4e9dd85beda7b75b851126b7347ace5ef8f0
- MD5 9a0175f0a665e4dce0ec58a7b7987b5e
- SHA1 963a7c2e98faa8a494810aa90d0a60b619179a68
- SHA512 23256df119fd017847c88687fdb4f38c91318630fd079b94bcd4d2c4bc175df801b5bac7952295a1b0fd3a6c1c3ffdee0beef9dafe6330ab5c60a992ff623122
- SSDEEP 24576:ay82uiO3bKlk4u72Pivsmg3pVbYDU8OhSbJDY81Fz3mO:182uiO3bMrdMrcEDUnhSJDlK
- TLSH T16475E605A7EA0148F8F2DAB9C97694299E337C509B34E6DF0A54896D1F73FD1C930B22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
338464
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vssapi.pdb
msvcrt
wcspbrk
wcsrchr
wcsncmp
_wcsdup
wcschr
_beginthreadex
_errno
memmove_s
towlower
_wtoi64
_wtoi
wcstoul
iswdigit
tolower
_vsnprintf
wcstok
memcmp
memset
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
memmove
memcpy
??0exception@@QEAA@AEBQEBD@Z
__CxxFrameHandler3
_CxxThrowException
__CxxFrameHandler4
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
_callnewh
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
memcpy_s
malloc
towupper
_wcsnicmp
free
_purecall
wcscat_s
swscanf
qsort
wcsstr
realloc
_wcsicmp
_vsnwprintf
__C_specific_handler
wcscmp
ntdll
RtlIpv4StringToAddressW
RtlIpv6StringToAddressW
NtQuerySystemInformation
EtwRegisterTraceGuidsW
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwGetTraceEnableFlags
NtQueryVolumeInformationFile
NtCreateFile
RtlNtStatusToDosError
NtQueryInformationFile
NtFsControlFile
NtClose
RtlAdjustPrivilege
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject
NtOpenDirectoryObject
NtQueryDirectoryObject
RtlInitUnicodeString
EtwTraceMessage
RtlUnlockBootStatusData
RtlGetSetBootStatusData
EtwUnregisterTraceGuids
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
LoadLibraryExW
GetModuleFileNameA
GetModuleHandleW
LoadResource
FindResourceExW
FreeResource
GetModuleHandleExW
SizeofResource
LoadStringW
GetModuleFileNameW
LockResource
GetProcAddress
api-ms-win-core-memory-l1-1-0
VirtualAlloc
VirtualQuery
VirtualProtect
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegQueryValueExW
RegEnumKeyExW
RegCloseKey
RegLoadKeyW
RegUnLoadKeyW
RegOpenKeyExW
RegEnumValueW
RegDeleteValueW
RegQueryInfoKeyW
RegSetValueExW
api-ms-win-core-synch-l1-1-0
ReleaseSemaphore
DeleteCriticalSection
ReleaseSRWLockShared
InitializeCriticalSectionAndSpinCount
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
WaitForSingleObject
ReleaseMutex
CreateSemaphoreExW
EnterCriticalSection
AcquireSRWLockShared
AcquireSRWLockExclusive
SetEvent
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObjectEx
OpenSemaphoreW
CreateEventW
CreateMutexExW
CreateMutexW
ResetEvent
api-ms-win-core-string-obsolete-l1-1-0
lstrcpynW
lstrcmpiW
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-file-l1-1-0
SetFilePointer
GetVolumeInformationW
GetFullPathNameW
SetFilePointerEx
GetDriveTypeW
CreateDirectoryW
GetFileAttributesW
GetLogicalDrives
FindClose
DeleteFileW
FindNextFileW
FindFirstFileW
ReadFile
CreateFileW
WriteFile
GetVolumePathNameW
api-ms-win-core-string-l2-1-0
CharNextW
CharPrevW
api-ms-win-core-file-l1-2-0
GetVolumeNameForVolumeMountPointW
GetVolumePathNamesForVolumeNameW
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-errorhandling-l1-1-0
SetErrorMode
GetLastError
UnhandledExceptionFilter
RaiseException
SetLastError
SetUnhandledExceptionFilter
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-sysinfo-l1-1-0
GetSystemWindowsDirectoryW
GetTickCount64
GetComputerNameExW
GetSystemTimeAsFileTime
GetVersionExW
GetWindowsDirectoryW
GetTickCount
GetSystemTime
GetSystemInfo
api-ms-win-core-heap-l1-1-0
HeapDestroy
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-heap-l2-1-0
GlobalFree
GlobalAlloc
LocalFree
LocalAlloc
api-ms-win-core-processthreads-l1-1-0
CreateThread
GetCurrentThread
SetThreadToken
OpenProcessToken
TlsGetValue
TlsSetValue
GetCurrentProcess
TerminateProcess
ResumeThread
GetCurrentProcessId
GetCurrentThreadId
OpenThreadToken
TlsAlloc
api-ms-win-core-synch-l1-2-0
InitOnceComplete
Sleep
InitOnceBeginInitialize
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
vsstrace
ord7
ord2
ord1
ord4
ord11
ord10
ord3
ord6
ord8
ord9
ord5
api-ms-win-security-base-l1-1-0
GetSidSubAuthorityCount
GetTokenInformation
DuplicateToken
AddAccessAllowedAceEx
RevertToSelf
IsValidSid
EqualSid
AddAccessDeniedAceEx
InitializeAcl
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
PrivilegeCheck
EqualDomainSid
CreateWellKnownSid
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
GetLengthSid
CopySid
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
GetAclInformation
GetAce
AddAce
api-ms-win-core-processenvironment-l1-1-0
GetCommandLineW
ExpandEnvironmentStringsW
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventRegister
EventWriteTransfer
EventSetInformation
EventActivityIdControl
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
api-ms-win-core-toolhelp-l1-1-0
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
api-ms-win-core-heap-obsolete-l1-1-0
GlobalLock
GlobalUnlock
api-ms-win-core-file-l2-1-0
CopyFileExW
api-ms-win-core-kernel32-legacy-l1-1-1
SetVolumeMountPointW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
??0CVssJetWriter@@QEAA@XZ
??0CVssWriter@@QEAA@XZ
??1CVssJetWriter@@UEAA@XZ
??1CVssWriter@@UEAA@XZ
?AreComponentsSelected@CVssJetWriter@@IEBA_NXZ
?AreComponentsSelected@CVssWriter@@IEBA_NXZ
?CreateVssBackupComponents@@YAJPEAPEAVIVssBackupComponents@@@Z
?CreateVssExamineWriterMetadata@@YAJPEAGPEAPEAVIVssExamineWriterMetadata@@@Z
?GetBackupType@CVssJetWriter@@IEBA?AW4_VSS_BACKUP_TYPE@@XZ
?GetBackupType@CVssWriter@@IEBA?AW4_VSS_BACKUP_TYPE@@XZ
?GetContext@CVssJetWriter@@IEBAJXZ
?GetContext@CVssWriter@@IEBAJXZ
?GetCurrentLevel@CVssJetWriter@@IEBA?AW4_VSS_APPLICATION_LEVEL@@XZ
?GetCurrentLevel@CVssWriter@@IEBA?AW4_VSS_APPLICATION_LEVEL@@XZ
?GetCurrentSnapshotSetId@CVssJetWriter@@IEBA?AU_GUID@@XZ
?GetCurrentSnapshotSetId@CVssWriter@@IEBA?AU_GUID@@XZ
?GetCurrentVolumeArray@CVssJetWriter@@IEBAPEAPEBGXZ
?GetCurrentVolumeArray@CVssWriter@@IEBAPEAPEBGXZ
?GetCurrentVolumeCount@CVssJetWriter@@IEBAIXZ
?GetCurrentVolumeCount@CVssWriter@@IEBAIXZ
?GetRestoreType@CVssJetWriter@@IEBA?AW4_VSS_RESTORE_TYPE@@XZ
?GetRestoreType@CVssWriter@@IEBA?AW4_VSS_RESTORE_TYPE@@XZ
?GetSnapshotDeviceName@CVssJetWriter@@IEBAJPEBGPEAPEBG@Z
?GetSnapshotDeviceName@CVssWriter@@IEBAJPEBGPEAPEBG@Z
?Initialize@CVssJetWriter@@QEAAJU_GUID@@PEBG_N211K@Z
?Initialize@CVssWriter@@QEAAJU_GUID@@PEBGW4VSS_USAGE_TYPE@@W4VSS_SOURCE_TYPE@@W4_VSS_APPLICATION_LEVEL@@KW4VSS_ALTERNATE_WRITER_STATE@@_N1@Z
?InstallAlternateWriter@CVssWriter@@QEAAJU_GUID@@0@Z
?IsBootableSystemStateBackedUp@CVssJetWriter@@IEBA_NXZ
?IsBootableSystemStateBackedUp@CVssWriter@@IEBA_NXZ
?IsPartialFileSupportEnabled@CVssJetWriter@@IEBA_NXZ
?IsPartialFileSupportEnabled@CVssWriter@@IEBA_NXZ
?IsPathAffected@CVssJetWriter@@IEBA_NPEBG@Z
?IsPathAffected@CVssWriter@@IEBA_NPEBG@Z
?OnAbortBegin@CVssJetWriter@@UEAAXXZ
?OnAbortEnd@CVssJetWriter@@UEAAXXZ
?OnBackOffIOOnVolume@CVssWriter@@UEAA_NPEAGU_GUID@@1@Z
?OnBackupComplete@CVssWriter@@UEAA_NPEAVIVssWriterComponents@@@Z
?OnBackupCompleteBegin@CVssJetWriter@@UEAA_NPEAVIVssWriterComponents@@@Z
?OnBackupCompleteEnd@CVssJetWriter@@UEAA_NPEAVIVssWriterComponents@@_N@Z
?OnBackupShutdown@CVssWriter@@UEAA_NU_GUID@@@Z
?OnContinueIOOnVolume@CVssWriter@@UEAA_NPEAGU_GUID@@1@Z
?OnFreezeBegin@CVssJetWriter@@UEAA_NXZ
?OnFreezeEnd@CVssJetWriter@@UEAA_N_N@Z
?OnIdentify@CVssJetWriter@@UEAA_NPEAVIVssCreateWriterMetadata@@@Z
?OnIdentify@CVssWriter@@UEAA_NPEAVIVssCreateWriterMetadata@@@Z
?OnPostRestore@CVssWriter@@UEAA_NPEAVIVssWriterComponents@@@Z
?OnPostRestoreBegin@CVssJetWriter@@UEAA_NPEAVIVssWriterComponents@@@Z
?OnPostRestoreEnd@CVssJetWriter@@UEAA_NPEAVIVssWriterComponents@@_N@Z
?OnPostSnapshot@CVssJetWriter@@UEAA_NPEAVIVssWriterComponents@@@Z
?OnPostSnapshot@CVssWriter@@UEAA_NPEAVIVssWriterComponents@@@Z
?OnPreRestore@CVssWriter@@UEAA_NPEAVIVssWriterComponents@@@Z
?OnPreRestoreBegin@CVssJetWriter@@UEAA_NPEAVIVssWriterComponents@@@Z
?OnPreRestoreEnd@CVssJetWriter@@UEAA_NPEAVIVssWriterComponents@@_N@Z
?OnPrepareBackup@CVssWriter@@UEAA_NPEAVIVssWriterComponents@@@Z
?OnPrepareBackupBegin@CVssJetWriter@@UEAA_NPEAVIVssWriterComponents@@@Z
?OnPrepareBackupEnd@CVssJetWriter@@UEAA_NPEAVIVssWriterComponents@@_N@Z
?OnPrepareSnapshotBegin@CVssJetWriter@@UEAA_NXZ
?OnPrepareSnapshotEnd@CVssJetWriter@@UEAA_N_N@Z
?OnThawBegin@CVssJetWriter@@UEAA_NXZ
?OnThawEnd@CVssJetWriter@@UEAA_N_N@Z
?OnVSSApplicationStartup@CVssWriter@@UEAA_NXZ
?OnVSSShutdown@CVssWriter@@UEAA_NXZ
?SetWriterFailure@CVssJetWriter@@IEAAJJ@Z
?SetWriterFailure@CVssWriter@@IEAAJJ@Z
?Subscribe@CVssWriter@@QEAAJK@Z
?Uninitialize@CVssJetWriter@@QEAAXXZ
?Unsubscribe@CVssWriter@@QEAAJXZ
CreateVssBackupComponentsInternal
CreateVssExamineWriterMetadataInternal
CreateVssExpressWriterInternal
CreateVssSnapshotSetDescription
CreateWriter
CreateWriterEx
DllCanUnloadNow
DllGetClassObject
GetProviderMgmtInterface
GetProviderMgmtInterfaceInternal
IsVolumeSnapshotted
IsVolumeSnapshottedInternal
LoadVssSnapshotSetDescription
ShouldBlockRevert
ShouldBlockRevertInternal
VssFreeSnapshotProperties
VssFreeSnapshotPropertiesInternal
Name
.text
Size
992KB
Virtual Size
988KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
344KB
Virtual Size
343KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
40KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
720B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
136KB
Virtual Size
133KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=82, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=27, id=260, version=33145,
count=5, id=259, version=33145,
count=386, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=1, id=256, version=33145,
count=68, id=264, version=33145,
count=14, id=261, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vsstrace.dll
- IMPHASH 92dc641a668b9e933d2ac1b8f634e065
- SHA256 38ba2afc31df5d6d7cfc26ed4d67d40e36ed8ec3f74c9f1848be0839383d26d4
- MD5 2c4b5621f84b8fb8ff6f397aec3e35eb
- SHA1 17635e0f986704faad745a0c7f4ef2897a7c4544
- SHA512 b7632c556cd03580e5f3b5a396f009c67ec05b34fe0e86c8e9b1c6e8540cb6dd9e09128f81a621328234694e7013fd4637d71a5e1bc6074572f496b32a202d11
- SSDEEP 1536:fMe/c/QSJ2l8/FqvnUVMnTJ9+GSH4l5sTZAnEWwe:firJ2i/FqvnfV9+glSZ0EWwe
- TLSH T133A30819A7ED20A8F5B691BDCA73490AD7B2B8104B3193DF4290C25E1F33BD45E357A2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
10272
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vsstrace.pdb
msvcrt
wcschr
_vsnwprintf
__CxxFrameHandler4
_wcsnicmp
?what@exception@@UEBAPEBDXZ
_vsnprintf
??1exception@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
memmove
memcpy
??0exception@@QEAA@AEBQEBD@Z
_wcsicmp
wprintf
_purecall
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
malloc
free
_callnewh
memset
api-ms-win-core-synch-l1-1-0
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
ntdll
EtwUnregisterTraceGuids
EtwGetTraceEnableFlags
NtQuerySystemInformation
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwRegisterTraceGuidsW
EtwLogTraceEvent
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
OpenThreadToken
TlsGetValue
GetCurrentThread
TlsSetValue
TlsAlloc
OpenProcessToken
TlsFree
api-ms-win-core-processenvironment-l1-1-0
GetCommandLineW
GetCommandLineA
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
api-ms-win-core-libraryloader-l1-2-0
LoadStringW
GetProcAddress
LoadLibraryExW
FreeLibrary
GetModuleHandleW
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
GetSystemTime
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegQueryInfoKeyW
RegEnumValueW
RegQueryValueExW
RegOpenKeyExW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-core-localization-l1-2-0
FormatMessageW
AssertFail
VssGetTracingContextPerThread
VssGetTracingModuleInfo
VssGetTracingSequenceNumber
VssIsKernelDebuggerAttached
VssIsTracingEnabled
VssIsTracingEnabledOnFunction
VssIsTracingEnabledOnModule
VssIsTracingEnabledPerThread
VssSetDebugReport
VssSetTracingContextPerThread
VssTraceBinary
VssTraceInitialize
VssTraceMessage
VssTraceUninitialize
Name
.text
Size
40KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
616B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=44, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=15, id=260, version=33145,
count=5, id=259, version=33145,
count=135, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=1, id=256, version=33145,
count=7, id=264, version=33145,
count=11, id=261, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vulkan-1-999-0-0-0.dll
- IMPHASH 72f42b54a9e868d6a697c6ae47997a9f
- SHA256 c9a110cc5ea3bf8cd8684ccb7ad1b914be2202754924f9dd8ffaadf1f3b66def
- MD5 0f5aefa973e0476ffee9b8db55c2e8f6
- SHA1 e8b01902dc3c7fce3f35e6e2e9f4f9a66f4f9851
- SHA512 43d43a1413b3c42b8e2d43f383d846a4daf459a140d8df2337f43bfcfff959383a8d52dcae61522b75869e067e1e9957dc98fedfa4cffc9217efe7a19f3b727d
- SSDEEP 12288:W6VsEdcTMfUtHubsknobZTYEaDNyVJGjz/qNrreDSlo2r3l6xCjqJ2D0Z3wtzY+N:WzEdp6OTeV6xVJ1Z3Sk+o+zH4bbWqU9
- TLSH T1FE557D7AEFA41145D3FB8138CA528B86DA73F85043609BDF01A542E91F037DD4A7EB92
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
54864
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\j\msdk\build\Vulkan-Loader\repo\build\loader\RelWithDebInfo\vulkan-1.pdb
cfgmgr32
CM_Open_DevNode_Key
CM_Locate_DevNodeW
CM_Get_Sibling
CM_Get_DevNode_Status
CM_Get_DevNode_Registry_PropertyW
CM_Get_Device_ID_List_SizeW
CM_Get_Device_ID_ListW
CM_Get_Device_IDW
CM_Get_Child
kernel32
FreeLibrary
GetProcAddress
LoadLibraryExA
LoadLibraryA
OutputDebugStringA
GetSystemDirectoryA
IsWow64Process
GetModuleHandleA
GetModuleHandleExA
WideCharToMultiByte
DeleteCriticalSection
InitializeCriticalSection
GetLastError
GetCurrentProcess
CloseHandle
GetEnvironmentVariableA
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ReadFile
FindClose
FindFirstFileExW
FindNextFileW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
HeapReAlloc
GetCurrentThread
GetStdHandle
GetFileType
SetConsoleCtrlHandler
GetConsoleMode
ReadConsoleW
SetFilePointerEx
MultiByteToWideChar
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileAttributesExW
GetTimeZoneInformation
GetFileSizeEx
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
GetStringTypeW
SetStdHandle
RaiseException
FlushFileBuffers
WriteFile
GetConsoleOutputCP
CreateFileW
HeapSize
SetEndOfFile
OutputDebugStringW
WriteConsoleW
RtlPcToFileHeader
EncodePointer
advapi32
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
RegCloseKey
RegEnumValueA
RegOpenKeyExA
RegQueryValueExA
OpenProcessToken
vkAcquireNextImage2KHR
vkAcquireNextImageKHR
vkAllocateCommandBuffers
vkAllocateDescriptorSets
vkAllocateMemory
vkBeginCommandBuffer
vkBindBufferMemory
vkBindBufferMemory2
vkBindImageMemory
vkBindImageMemory2
vkCmdBeginQuery
vkCmdBeginRenderPass
vkCmdBeginRenderPass2
vkCmdBindDescriptorSets
vkCmdBindIndexBuffer
vkCmdBindPipeline
vkCmdBindVertexBuffers
vkCmdBlitImage
vkCmdClearAttachments
vkCmdClearColorImage
vkCmdClearDepthStencilImage
vkCmdCopyBuffer
vkCmdCopyBufferToImage
vkCmdCopyImage
vkCmdCopyImageToBuffer
vkCmdCopyQueryPoolResults
vkCmdDispatch
vkCmdDispatchBase
vkCmdDispatchIndirect
vkCmdDraw
vkCmdDrawIndexed
vkCmdDrawIndexedIndirect
vkCmdDrawIndexedIndirectCount
vkCmdDrawIndirect
vkCmdDrawIndirectCount
vkCmdEndQuery
vkCmdEndRenderPass
vkCmdEndRenderPass2
vkCmdExecuteCommands
vkCmdFillBuffer
vkCmdNextSubpass
vkCmdNextSubpass2
vkCmdPipelineBarrier
vkCmdPushConstants
vkCmdResetEvent
vkCmdResetQueryPool
vkCmdResolveImage
vkCmdSetBlendConstants
vkCmdSetDepthBias
vkCmdSetDepthBounds
vkCmdSetDeviceMask
vkCmdSetEvent
vkCmdSetLineWidth
vkCmdSetScissor
vkCmdSetStencilCompareMask
vkCmdSetStencilReference
vkCmdSetStencilWriteMask
vkCmdSetViewport
vkCmdUpdateBuffer
vkCmdWaitEvents
vkCmdWriteTimestamp
vkCreateBuffer
vkCreateBufferView
vkCreateCommandPool
vkCreateComputePipelines
vkCreateDescriptorPool
vkCreateDescriptorSetLayout
vkCreateDescriptorUpdateTemplate
vkCreateDevice
vkCreateDisplayModeKHR
vkCreateDisplayPlaneSurfaceKHR
vkCreateEvent
vkCreateFence
vkCreateFramebuffer
vkCreateGraphicsPipelines
vkCreateImage
vkCreateImageView
vkCreateInstance
vkCreatePipelineCache
vkCreatePipelineLayout
vkCreateQueryPool
vkCreateRenderPass
vkCreateRenderPass2
vkCreateSampler
vkCreateSamplerYcbcrConversion
vkCreateSemaphore
vkCreateShaderModule
vkCreateSharedSwapchainsKHR
vkCreateSwapchainKHR
vkCreateWin32SurfaceKHR
vkDestroyBuffer
vkDestroyBufferView
vkDestroyCommandPool
vkDestroyDescriptorPool
vkDestroyDescriptorSetLayout
vkDestroyDescriptorUpdateTemplate
vkDestroyDevice
vkDestroyEvent
vkDestroyFence
vkDestroyFramebuffer
vkDestroyImage
vkDestroyImageView
vkDestroyInstance
vkDestroyPipeline
vkDestroyPipelineCache
vkDestroyPipelineLayout
vkDestroyQueryPool
vkDestroyRenderPass
vkDestroySampler
vkDestroySamplerYcbcrConversion
vkDestroySemaphore
vkDestroyShaderModule
vkDestroySurfaceKHR
vkDestroySwapchainKHR
vkDeviceWaitIdle
vkEndCommandBuffer
vkEnumerateDeviceExtensionProperties
vkEnumerateDeviceLayerProperties
vkEnumerateInstanceExtensionProperties
vkEnumerateInstanceLayerProperties
vkEnumerateInstanceVersion
vkEnumeratePhysicalDeviceGroups
vkEnumeratePhysicalDevices
vkFlushMappedMemoryRanges
vkFreeCommandBuffers
vkFreeDescriptorSets
vkFreeMemory
vkGetBufferDeviceAddress
vkGetBufferMemoryRequirements
vkGetBufferMemoryRequirements2
vkGetBufferOpaqueCaptureAddress
vkGetDescriptorSetLayoutSupport
vkGetDeviceGroupPeerMemoryFeatures
vkGetDeviceGroupPresentCapabilitiesKHR
vkGetDeviceGroupSurfacePresentModesKHR
vkGetDeviceMemoryCommitment
vkGetDeviceMemoryOpaqueCaptureAddress
vkGetDeviceProcAddr
vkGetDeviceQueue
vkGetDeviceQueue2
vkGetDisplayModeProperties2KHR
vkGetDisplayModePropertiesKHR
vkGetDisplayPlaneCapabilities2KHR
vkGetDisplayPlaneCapabilitiesKHR
vkGetDisplayPlaneSupportedDisplaysKHR
vkGetEventStatus
vkGetFenceStatus
vkGetImageMemoryRequirements
vkGetImageMemoryRequirements2
vkGetImageSparseMemoryRequirements
vkGetImageSparseMemoryRequirements2
vkGetImageSubresourceLayout
vkGetInstanceProcAddr
vkGetPhysicalDeviceDisplayPlaneProperties2KHR
vkGetPhysicalDeviceDisplayPlanePropertiesKHR
vkGetPhysicalDeviceDisplayProperties2KHR
vkGetPhysicalDeviceDisplayPropertiesKHR
vkGetPhysicalDeviceExternalBufferProperties
vkGetPhysicalDeviceExternalFenceProperties
vkGetPhysicalDeviceExternalSemaphoreProperties
vkGetPhysicalDeviceFeatures
vkGetPhysicalDeviceFeatures2
vkGetPhysicalDeviceFormatProperties
vkGetPhysicalDeviceFormatProperties2
vkGetPhysicalDeviceImageFormatProperties
vkGetPhysicalDeviceImageFormatProperties2
vkGetPhysicalDeviceMemoryProperties
vkGetPhysicalDeviceMemoryProperties2
vkGetPhysicalDevicePresentRectanglesKHR
vkGetPhysicalDeviceProperties
vkGetPhysicalDeviceProperties2
vkGetPhysicalDeviceQueueFamilyProperties
vkGetPhysicalDeviceQueueFamilyProperties2
vkGetPhysicalDeviceSparseImageFormatProperties
vkGetPhysicalDeviceSparseImageFormatProperties2
vkGetPhysicalDeviceSurfaceCapabilities2KHR
vkGetPhysicalDeviceSurfaceCapabilitiesKHR
vkGetPhysicalDeviceSurfaceFormats2KHR
vkGetPhysicalDeviceSurfaceFormatsKHR
vkGetPhysicalDeviceSurfacePresentModesKHR
vkGetPhysicalDeviceSurfaceSupportKHR
vkGetPhysicalDeviceWin32PresentationSupportKHR
vkGetPipelineCacheData
vkGetQueryPoolResults
vkGetRenderAreaGranularity
vkGetSemaphoreCounterValue
vkGetSwapchainImagesKHR
vkInvalidateMappedMemoryRanges
vkMapMemory
vkMergePipelineCaches
vkQueueBindSparse
vkQueuePresentKHR
vkQueueSubmit
vkQueueWaitIdle
vkResetCommandBuffer
vkResetCommandPool
vkResetDescriptorPool
vkResetEvent
vkResetFences
vkResetQueryPool
vkSetEvent
vkSignalSemaphore
vkTrimCommandPool
vkUnmapMemory
vkUpdateDescriptorSetWithTemplate
vkUpdateDescriptorSets
vkWaitForFences
vkWaitSemaphores
Name
.text
Size
891KB
Virtual Size
890KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
215KB
Virtual Size
214KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.cfguard
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.00cfg
Size
512B
Virtual Size
337B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gxfg
Size
98KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gehcont
Size
512B
Virtual Size
288B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=167, id=261, version=28900,
count=12, id=259, version=28900,
count=14, id=260, version=28900,
count=8, id=259, version=24123,
count=26, id=261, version=24123,
count=18, id=260, version=24123,
count=7, id=257, version=28900,
count=119, id=1, productName=Unmarked objects,
count=16, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=259, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
vulkan-1.dll
- IMPHASH 841d7e318a6a83806d246df28ec1893e
- SHA256 591d4c316a0a39f96792979ce5ebb1bb380f0015c30707ba7ac611b35ae01cfc
- MD5 246801b013f6ea40332fcdc273d70452
- SHA1 5fd091c5605084b726313eaee25992e405a14331
- SHA512 eee1e45072c5f9e36b09b4438e217f0aad92a0fa9bc5e330903d07c6614061c201085f636b058bb94cfe3a973ff9899157cf42e333c3ec5a36f49dd099b2c8b7
- SSDEEP 24576:MCuUQMdSi4B/kuXprzJ7FLgXvDreKNlCgDkw7n6g3v0TAE7i+nTN:MCuU4FBDXNzJSeKNlCgDkw7n6g3v0TAi
- TLSH T1B4657D62CB581255D2BBC13CC9918F4BD5F1F840532087CB01AA47E8AF57FE959BEBA0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
5a:a3:3f:3b:4e:87:7e:87:20:01:34:f2:2c:37:74:da:74:3d:68:38:5b:80:b7:b4:1f:46:7d:2a:af:c5:42:df
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Azure Code Sign
Chains
Nov 1, 2025
CN=Microsoft Azure Code Sign
CN=AME CS CA 01,0.9.2342.19200300.100.1.25=#1303414d45,0.9.2342.19200300.100.1.25=#130347424c
Subject
CN=Microsoft Azure Code Sign
Serial Number
36:00:00:02:0d:e2:84:0f:49:ee:db:2d:fc:00:02:00:00:02:0d
Issuer
CN=AME CS CA 01,0.9.2342.19200300.100.1.25=#1303414d45,0.9.2342.19200300.100.1.25=#130347424c
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 23, 2025 - Apr 26, 2026
Subject
CN=AME CS CA 01,0.9.2342.19200300.100.1.25=#1303414d45,0.9.2342.19200300.100.1.25=#130347424c
Serial Number
1f:00:00:00:51:ea:8f:f6:9c:73:0c:a8:3b:00:00:00:00:00:51
Issuer
CN=ameroot,0.9.2342.19200300.100.1.25=#1303414d45,0.9.2342.19200300.100.1.25=#130347424c
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageOCSPSigning, ExtKeyUsageCodeSigning
Timespan
May 21, 2021 - May 21, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3703-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:0a:47:b2:14:d9:ee:b2:b3:0f:00:01:00:00:02:0a
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
5008
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\__w\1\Vulkan-Loader\build\loader\RelWithDebInfo\vulkan-1.pdb
cfgmgr32
CM_Get_Sibling
CM_Get_DevNode_Status
CM_Get_DevNode_Registry_PropertyW
CM_Get_Device_ID_List_SizeW
CM_Get_Device_ID_ListW
CM_Get_Device_IDW
CM_Open_DevNode_Key
CM_Locate_DevNodeW
CM_Get_Child
kernel32
WideCharToMultiByte
GetLastError
DeleteCriticalSection
InitOnceExecuteOnce
GetEnvironmentVariableW
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
LoadLibraryW
OutputDebugStringA
InitializeCriticalSection
GetSystemDirectoryW
IsWow64Process
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleExA
LoadLibraryExA
WriteConsoleW
LeaveCriticalSection
EnterCriticalSection
MultiByteToWideChar
CloseHandle
ReadFile
GetFileSize
CreateFileW
GetCurrentProcess
FreeLibrary
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetFileAttributesExW
FindClose
FindFirstFileExW
FindNextFileW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
HeapReAlloc
GetCurrentThread
GetStdHandle
GetFileType
SetConsoleCtrlHandler
GetTempPathW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
IsThreadAFiber
InitializeCriticalSectionEx
VirtualProtect
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileSizeEx
SetFilePointerEx
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
GetStringTypeW
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
GetTimeZoneInformation
HeapSize
ReadConsoleW
OutputDebugStringW
RtlUnwind
advapi32
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
RegCloseKey
RegEnumValueA
RegOpenKeyExA
RegQueryValueExA
OpenProcessToken
vkAcquireNextImage2KHR
vkAcquireNextImageKHR
vkAllocateCommandBuffers
vkAllocateDescriptorSets
vkAllocateMemory
vkBeginCommandBuffer
vkBindBufferMemory
vkBindBufferMemory2
vkBindImageMemory
vkBindImageMemory2
vkCmdBeginQuery
vkCmdBeginRenderPass
vkCmdBeginRenderPass2
vkCmdBeginRendering
vkCmdBindDescriptorSets
vkCmdBindIndexBuffer
vkCmdBindPipeline
vkCmdBindVertexBuffers
vkCmdBindVertexBuffers2
vkCmdBlitImage
vkCmdBlitImage2
vkCmdClearAttachments
vkCmdClearColorImage
vkCmdClearDepthStencilImage
vkCmdCopyBuffer
vkCmdCopyBuffer2
vkCmdCopyBufferToImage
vkCmdCopyBufferToImage2
vkCmdCopyImage
vkCmdCopyImage2
vkCmdCopyImageToBuffer
vkCmdCopyImageToBuffer2
vkCmdCopyQueryPoolResults
vkCmdDispatch
vkCmdDispatchBase
vkCmdDispatchIndirect
vkCmdDraw
vkCmdDrawIndexed
vkCmdDrawIndexedIndirect
vkCmdDrawIndexedIndirectCount
vkCmdDrawIndirect
vkCmdDrawIndirectCount
vkCmdEndQuery
vkCmdEndRenderPass
vkCmdEndRenderPass2
vkCmdEndRendering
vkCmdExecuteCommands
vkCmdFillBuffer
vkCmdNextSubpass
vkCmdNextSubpass2
vkCmdPipelineBarrier
vkCmdPipelineBarrier2
vkCmdPushConstants
vkCmdResetEvent
vkCmdResetEvent2
vkCmdResetQueryPool
vkCmdResolveImage
vkCmdResolveImage2
vkCmdSetBlendConstants
vkCmdSetCullMode
vkCmdSetDepthBias
vkCmdSetDepthBiasEnable
vkCmdSetDepthBounds
vkCmdSetDepthBoundsTestEnable
vkCmdSetDepthCompareOp
vkCmdSetDepthTestEnable
vkCmdSetDepthWriteEnable
vkCmdSetDeviceMask
vkCmdSetEvent
vkCmdSetEvent2
vkCmdSetFrontFace
vkCmdSetLineWidth
vkCmdSetPrimitiveRestartEnable
vkCmdSetPrimitiveTopology
vkCmdSetRasterizerDiscardEnable
vkCmdSetScissor
vkCmdSetScissorWithCount
vkCmdSetStencilCompareMask
vkCmdSetStencilOp
vkCmdSetStencilReference
vkCmdSetStencilTestEnable
vkCmdSetStencilWriteMask
vkCmdSetViewport
vkCmdSetViewportWithCount
vkCmdUpdateBuffer
vkCmdWaitEvents
vkCmdWaitEvents2
vkCmdWriteTimestamp
vkCmdWriteTimestamp2
vkCreateBuffer
vkCreateBufferView
vkCreateCommandPool
vkCreateComputePipelines
vkCreateDescriptorPool
vkCreateDescriptorSetLayout
vkCreateDescriptorUpdateTemplate
vkCreateDevice
vkCreateDisplayModeKHR
vkCreateDisplayPlaneSurfaceKHR
vkCreateEvent
vkCreateFence
vkCreateFramebuffer
vkCreateGraphicsPipelines
vkCreateHeadlessSurfaceEXT
vkCreateImage
vkCreateImageView
vkCreateInstance
vkCreatePipelineCache
vkCreatePipelineLayout
vkCreatePrivateDataSlot
vkCreateQueryPool
vkCreateRenderPass
vkCreateRenderPass2
vkCreateSampler
vkCreateSamplerYcbcrConversion
vkCreateSemaphore
vkCreateShaderModule
vkCreateSharedSwapchainsKHR
vkCreateSwapchainKHR
vkCreateWin32SurfaceKHR
vkDestroyBuffer
vkDestroyBufferView
vkDestroyCommandPool
vkDestroyDescriptorPool
vkDestroyDescriptorSetLayout
vkDestroyDescriptorUpdateTemplate
vkDestroyDevice
vkDestroyEvent
vkDestroyFence
vkDestroyFramebuffer
vkDestroyImage
vkDestroyImageView
vkDestroyInstance
vkDestroyPipeline
vkDestroyPipelineCache
vkDestroyPipelineLayout
vkDestroyPrivateDataSlot
vkDestroyQueryPool
vkDestroyRenderPass
vkDestroySampler
vkDestroySamplerYcbcrConversion
vkDestroySemaphore
vkDestroyShaderModule
vkDestroySurfaceKHR
vkDestroySwapchainKHR
vkDeviceWaitIdle
vkEndCommandBuffer
vkEnumerateDeviceExtensionProperties
vkEnumerateDeviceLayerProperties
vkEnumerateInstanceExtensionProperties
vkEnumerateInstanceLayerProperties
vkEnumerateInstanceVersion
vkEnumeratePhysicalDeviceGroups
vkEnumeratePhysicalDevices
vkFlushMappedMemoryRanges
vkFreeCommandBuffers
vkFreeDescriptorSets
vkFreeMemory
vkGetBufferDeviceAddress
vkGetBufferMemoryRequirements
vkGetBufferMemoryRequirements2
vkGetBufferOpaqueCaptureAddress
vkGetDescriptorSetLayoutSupport
vkGetDeviceBufferMemoryRequirements
vkGetDeviceGroupPeerMemoryFeatures
vkGetDeviceGroupPresentCapabilitiesKHR
vkGetDeviceGroupSurfacePresentModesKHR
vkGetDeviceImageMemoryRequirements
vkGetDeviceImageSparseMemoryRequirements
vkGetDeviceMemoryCommitment
vkGetDeviceMemoryOpaqueCaptureAddress
vkGetDeviceProcAddr
vkGetDeviceQueue
vkGetDeviceQueue2
vkGetDisplayModeProperties2KHR
vkGetDisplayModePropertiesKHR
vkGetDisplayPlaneCapabilities2KHR
vkGetDisplayPlaneCapabilitiesKHR
vkGetDisplayPlaneSupportedDisplaysKHR
vkGetEventStatus
vkGetFenceStatus
vkGetImageMemoryRequirements
vkGetImageMemoryRequirements2
vkGetImageSparseMemoryRequirements
vkGetImageSparseMemoryRequirements2
vkGetImageSubresourceLayout
vkGetInstanceProcAddr
vkGetPhysicalDeviceDisplayPlaneProperties2KHR
vkGetPhysicalDeviceDisplayPlanePropertiesKHR
vkGetPhysicalDeviceDisplayProperties2KHR
vkGetPhysicalDeviceDisplayPropertiesKHR
vkGetPhysicalDeviceExternalBufferProperties
vkGetPhysicalDeviceExternalFenceProperties
vkGetPhysicalDeviceExternalSemaphoreProperties
vkGetPhysicalDeviceFeatures
vkGetPhysicalDeviceFeatures2
vkGetPhysicalDeviceFormatProperties
vkGetPhysicalDeviceFormatProperties2
vkGetPhysicalDeviceImageFormatProperties
vkGetPhysicalDeviceImageFormatProperties2
vkGetPhysicalDeviceMemoryProperties
vkGetPhysicalDeviceMemoryProperties2
vkGetPhysicalDevicePresentRectanglesKHR
vkGetPhysicalDeviceProperties
vkGetPhysicalDeviceProperties2
vkGetPhysicalDeviceQueueFamilyProperties
vkGetPhysicalDeviceQueueFamilyProperties2
vkGetPhysicalDeviceSparseImageFormatProperties
vkGetPhysicalDeviceSparseImageFormatProperties2
vkGetPhysicalDeviceSurfaceCapabilities2KHR
vkGetPhysicalDeviceSurfaceCapabilitiesKHR
vkGetPhysicalDeviceSurfaceFormats2KHR
vkGetPhysicalDeviceSurfaceFormatsKHR
vkGetPhysicalDeviceSurfacePresentModesKHR
vkGetPhysicalDeviceSurfaceSupportKHR
vkGetPhysicalDeviceToolProperties
vkGetPhysicalDeviceWin32PresentationSupportKHR
vkGetPipelineCacheData
vkGetPrivateData
vkGetQueryPoolResults
vkGetRenderAreaGranularity
vkGetSemaphoreCounterValue
vkGetSwapchainImagesKHR
vkInvalidateMappedMemoryRanges
vkMapMemory
vkMergePipelineCaches
vkQueueBindSparse
vkQueuePresentKHR
vkQueueSubmit
vkQueueSubmit2
vkQueueWaitIdle
vkResetCommandBuffer
vkResetCommandPool
vkResetDescriptorPool
vkResetEvent
vkResetFences
vkResetQueryPool
vkSetEvent
vkSetPrivateData
vkSignalSemaphore
vkTrimCommandPool
vkUnmapMemory
vkUpdateDescriptorSetWithTemplate
vkUpdateDescriptorSets
vkWaitForFences
vkWaitSemaphores
Name
.text
Size
984KB
Virtual Size
983KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
322KB
Virtual Size
322KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.00cfg
Size
512B
Virtual Size
373B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
1024B
Virtual Size
563B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=152, id=261, version=33140,
count=19, id=260, version=33140,
count=8, id=259, version=33140,
count=9, id=259, version=35207,
count=15, id=260, version=35207,
count=32, id=261, version=35207,
count=7, id=257, version=33140,
count=125, id=1, productName=Unmarked objects,
count=15, id=260, version=35216,
count=1, id=256, version=35216,
count=1, id=255, version=35216,
count=1, id=151,
count=1, id=258, version=35216,
w32time.dll
- IMPHASH 8c8f3203ec1b683b41e167f1bbadb396
- SHA256 dbcc03f4f27ce4955141e181a2dd569f398404e4dadb2e16942446db6983b589
- MD5 ff00cd6ec6ab9e80f64d0f27ed7f3703
- SHA1 484da5c47d4639f1308f94d075bb2d124a3634d5
- SHA512 5d4af534c1c78def17ddc9a5594126739b6b6070a4c1c8d25ca22cf6e1c82affc82fa44944812979fd62b362a7f93f1411f190515f468fac9f8f68e5a5b6b201
- SSDEEP 12288:o8m3+R4XGd0iceGKAtdJIG7+tWwNl6JqKdrLSXLA:wORLc+si8wr6J9uX
- TLSH T1E0F4181AABFC0058F1F7A67589768215EA72B8665B31D2CF0190817D2E37FD09E35B32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
233200
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
w32time.pdb
msvcp_win
?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-string-l1-1-0
wcscspn
memset
wcscmp
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__ultow
_o__wcsicmp
_o__wcsnicmp
memmove
_o_abort
_o_ceil
_o_floor
_o_free
_o_iswspace
_o_log
_o_malloc
_o_qsort
_o_sqrt
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstoul
_CxxThrowException
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
wcsstr
wcschr
__C_specific_handler
_set_se_translator
__CxxFrameHandler4
_local_unwind
memcmp
memcpy
rpcrt4
NdrServerCall2
RpcImpersonateClient
RpcStringFreeW
RpcBindingFromStringBindingW
RpcServerInqCallAttributesW
NdrServerCallAll
RpcServerUseProtseqEpW
RpcBindingSetAuthInfoW
RpcServerRegisterIfEx
RpcServerInqDefaultPrincNameW
RpcServerRegisterAuthInfoW
RpcServerUnregisterIf
RpcStringBindingComposeW
RpcBindingFree
RpcRevertToSelf
RpcMgmtInqServerPrincNameW
NdrClientCall3
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-sysinfo-l1-1-0
GetTickCount64
GetSystemTimeAdjustment
GetSystemInfo
GetTickCount
GetSystemTime
GetSystemTimeAsFileTime
api-ms-win-core-synch-l1-1-0
ReleaseMutex
CreateMutexExW
InitializeCriticalSection
LeaveCriticalSection
ReleaseSemaphore
CreateEventW
ResetEvent
WaitForMultipleObjectsEx
TryEnterCriticalSection
DeleteCriticalSection
CreateSemaphoreExW
OpenSemaphoreW
AcquireSRWLockExclusive
ReleaseSRWLockShared
WaitForSingleObject
InitializeCriticalSectionEx
EnterCriticalSection
WaitForSingleObjectEx
ReleaseSRWLockExclusive
AcquireSRWLockShared
SetEvent
api-ms-win-core-errorhandling-l1-1-0
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-processthreads-l1-1-0
OpenProcessToken
GetCurrentThreadId
SetThreadPriority
GetCurrentProcess
GetCurrentThread
TerminateProcess
CreateThread
GetExitCodeThread
OpenThreadToken
SetThreadStackGuarantee
GetCurrentProcessId
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
DisableThreadLibraryCalls
GetProcAddress
LoadStringW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
LoadLibraryExW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-handle-l1-1-0
CloseHandle
SetHandleInformation
GetHandleInformation
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-core-registry-l1-1-0
RegOpenKeyExA
RegEnumKeyExW
RegCloseKey
RegGetValueA
RegOpenKeyExW
RegGetValueW
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
Sleep
bcrypt
BCryptGenRandom
BCryptFinishHash
BCryptCreateHash
BCryptDestroyHash
BCryptHashData
logoncli
I_NetlogonComputeClientSignature
I_NetlogonComputeClientDigest
I_NetlogonComputeServerDigest
DsGetSiteNameW
DsGetDcNameW
NetLogonGetTimeServiceParentDomain
I_NetlogonComputeServerSignature
NetLogonSetServiceBits
I_NetlogonGetTrustRid
api-ms-win-security-base-l1-1-0
AdjustTokenPrivileges
GetSecurityDescriptorDacl
GetTokenInformation
PrivilegeCheck
api-ms-win-service-management-l1-1-0
OpenSCManagerW
CreateServiceW
OpenServiceW
CloseServiceHandle
DeleteService
api-ms-win-service-management-l2-1-0
ChangeServiceConfigW
ChangeServiceConfig2W
QueryServiceConfigW
SetServiceObjectSecurity
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventUnregister
EventWrite
EventWriteTransfer
EventRegister
api-ms-win-power-setting-l1-1-0
PowerSettingRegisterNotification
PowerSettingUnregisterNotification
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
api-ms-win-core-sysinfo-l1-2-0
GetSystemTimePreciseAsFileTime
api-ms-win-service-core-l1-1-0
RegisterServiceCtrlHandlerExW
SetServiceStatus
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-file-l1-1-0
FileTimeToLocalFileTime
CreateFileW
WriteFile
GetFileSizeEx
api-ms-win-service-winsvc-l1-1-0
QueryServiceStatus
crypt32
CertFreeCertificateContext
CryptHashCertificate2
api-ms-win-core-threadpool-private-l1-1-0
RegisterWaitForSingleObjectEx
api-ms-win-service-private-l1-1-0
I_ScSetServiceBitsW
api-ms-win-core-perfcounters-l1-1-0
PerfSetCounterRefValue
PerfStopProvider
PerfStartProvider
PerfDeleteInstance
PerfCreateInstance
PerfSetCounterSetInfo
api-ms-win-core-threadpool-legacy-l1-1-0
ChangeTimerQueueTimer
UnregisterWaitEx
QueueUserWorkItem
CreateTimerQueueTimer
DeleteTimerQueueTimer
api-ms-win-core-registry-l2-1-0
RegDeleteKeyW
ntdll
RtlInitializeResource
RtlAcquireResourceExclusive
RtlDeleteCriticalSection
RtlDeleteElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlLeaveCriticalSection
RtlInsertElementGenericTableAvl
RtlEnterCriticalSection
RtlInitializeGenericTableAvl
RtlInitializeCriticalSection
EtwEventUnregister
EtwEventWrite
EtwEventRegister
RtlConvertExclusiveToShared
RtlConvertSharedToExclusive
RtlIsStateSeparationEnabled
RtlGetVersion
NtQuerySystemInformation
NtSetSystemInformation
RtlFreeHeap
RtlImageNtHeader
RtlAllocateHeap
RtlAcquireResourceShared
RtlReleaseSRWLockExclusive
RtlRunOnceExecuteOnce
RtlNtStatusToDosError
RtlGetDeviceFamilyInfoEnum
RtlAcquireSRWLockExclusive
RtlInitUnicodeString
RtlDeleteResource
RtlReleaseResource
NtSetSystemTime
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
api-ms-win-core-memory-l1-1-0
VirtualProtect
VirtualQuery
VirtualAlloc
api-ms-win-core-xstate-l2-1-0
GetEnabledXStateFeatures
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllInstall
DllRegisterServer
DllUnregisterServer
SvchostEntry_W32Time
SvchostPushServiceGlobals
TimeProvClose
TimeProvCommand
TimeProvOpen
W32TimeBufferFree
W32TimeDcPromo
W32TimeDeleteConfig
W32TimeGetNetlogonServiceBits
W32TimeLog
W32TimeQueryConfig
W32TimeQueryConfiguration
W32TimeQueryHardwareProviderStatus
W32TimeQueryNTPProviderStatus
W32TimeQueryNtpProviderConfiguration
W32TimeQuerySource
W32TimeQueryStatus
W32TimeSetConfig
W32TimeSyncNow
W32TimeVerifyJoinConfig
W32TimeVerifyUnjoinConfig
W32TmServiceMain
fnW32TmI_ScSetServiceBits
fnW32TmRegisterServiceCtrlHandlerEx
fnW32TmSetServiceStatus
Name
.text
Size
424KB
Virtual Size
421KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
216KB
Virtual Size
214KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
376B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=96, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=1392, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=26, id=261, version=33145,
count=9, id=259, version=33145,
count=1, id=256, version=33145,
count=55, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
w32topl.dll
- IMPHASH 912422dddec69649f9794c9e93acfcdd
- SHA256 1c0ba4012aa90ae3379f45c5c2ede15edf959902da6bac91246a00f3bb60d0e8
- MD5 db20f1eaa38ad989353bac5a6fdea8ec
- SHA1 2e2ebf29b5ecc639cbe08792932128f5488f33cd
- SHA512 af66486bd354867d33ed6bfb4cb28e774e5d4421551a0389f0340db29385d7b968da5a4806f0518a60eca59a29b04db8cf0fdcf516ace2ccc0544c8372443549
- SSDEEP 768:Jh9jUWrhChtkLJh4RQBNdBHMrQc/PB35LBmuz93KLr:tbYCLJ03ZBmE93KLr
- TLSH T1A8434B5F7AA42094F065923FC74B078FD5F1742A23A167EF4690837ECA939D0D439B52
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4752
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
w32topl.pdb
msvcrt
__C_specific_handler
malloc
free
_amsg_exit
_XcptFilter
bsearch
qsort
_initterm
memcpy
memset
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
RaiseException
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TlsAlloc
TerminateProcess
TlsSetValue
GetCurrentProcessId
GetCurrentThreadId
TlsFree
TlsGetValue
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
ntdll
RtlInsertElementGenericTable
RtlGetElementGenericTable
RtlDeleteElementGenericTable
RtlAllocateHeap
RtlReAllocateHeap
RtlFreeHeap
RtlEnumerateGenericTable
RtlIsGenericTableEmpty
RtlInitializeGenericTable
ToplAddEdgeSetToGraph
ToplAddEdgeToGraph
ToplDeleteComponents
ToplDeleteGraphState
ToplDeleteSpanningTreeEdges
ToplEdgeAssociate
ToplEdgeCreate
ToplEdgeDestroy
ToplEdgeDisassociate
ToplEdgeFree
ToplEdgeGetFromVertex
ToplEdgeGetToVertex
ToplEdgeGetWeight
ToplEdgeInit
ToplEdgeSetFromVertex
ToplEdgeSetToVertex
ToplEdgeSetVtx
ToplEdgeSetWeight
ToplFree
ToplGetAlwaysSchedule
ToplGetSpanningTreeEdgesForVtx
ToplGraphAddVertex
ToplGraphCreate
ToplGraphDestroy
ToplGraphFindEdgesForMST
ToplGraphFree
ToplGraphInit
ToplGraphMakeRing
ToplGraphNumberOfVertices
ToplGraphRemoveVertex
ToplGraphSetVertexIter
ToplHeapCreate
ToplHeapDestroy
ToplHeapExtractMin
ToplHeapInsert
ToplHeapIsElementOf
ToplHeapIsEmpty
ToplIsToplException
ToplIterAdvance
ToplIterCreate
ToplIterFree
ToplIterGetObject
ToplListAddElem
ToplListCreate
ToplListFree
ToplListNumberOfElements
ToplListRemoveElem
ToplListSetIter
ToplMakeGraphState
ToplPScheduleValid
ToplSTHeapAdd
ToplSTHeapCostReduced
ToplSTHeapDestroy
ToplSTHeapExtractMin
ToplSTHeapInit
ToplScheduleCacheCreate
ToplScheduleCacheDestroy
ToplScheduleCreate
ToplScheduleDuration
ToplScheduleExportReadonly
ToplScheduleImport
ToplScheduleIsEqual
ToplScheduleMaxUnavailable
ToplScheduleMerge
ToplScheduleNumEntries
ToplScheduleValid
ToplSetAllocator
ToplVertexCreate
ToplVertexDestroy
ToplVertexFree
ToplVertexGetId
ToplVertexGetInEdge
ToplVertexGetOutEdge
ToplVertexGetParent
ToplVertexInit
ToplVertexNumberOfInEdges
ToplVertexNumberOfOutEdges
ToplVertexSetId
ToplVertexSetParent
Name
.text
Size
24KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
132B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33136,
count=4, id=259, version=33136,
count=43, id=1, productName=Unmarked objects,
count=5, id=257, version=33136,
count=1, id=256, version=33136,
count=13, id=264, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
wavemsp.dll
- IMPHASH 9f90b6bdbf20cb050d07d2c86ecee8fa
- SHA256 0e93d9a915972c51e987badcc81afee79605cac50193dc399f82715829aca4e3
- MD5 b096145f66d933f0c29e1b8c0afcc603
- SHA1 ca9157aa3838e6e20c75317bbdcd440d9e323051
- SHA512 5bcd4098aa72006baf1c64c18c8b5c7e4c837bbf2456fb6d3bc59d305c2ac7409ec48fe895b0bc7498d3f0bf8c472ddecc1bb475a3d077de1c38253727336318
- SSDEEP 6144:4d3Bkt2nQccu9O7RMJnJXYqryn2K+UidMaE4BIMwU:IK2nEuicg
- TLSH T1D544B4086FA44EF5CA85113491534785E2B1EDA1D319D2FB66BC92AECEA33C1BE74F01
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5344
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wavemsp.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o_malloc
_o_realloc
_o_terminate
__current_exception
__current_exception_context
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___std_type_info_destroy_list
__C_specific_handler
__std_terminate
__CxxFrameHandler4
__RTDynamicCast
memcpy
api-ms-win-crt-string-l1-1-0
memset
atl
ord23
ord16
ord21
ord15
ord18
ord22
ord30
ord32
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
kernel32
RtlLookupFunctionEntry
OutputDebugStringA
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
CompareStringW
InitializeCriticalSection
DeleteCriticalSection
DisableThreadLibraryCalls
CloseHandle
GetCurrentProcess
CreateThread
GetModuleHandleW
IsDebuggerPresent
GetCurrentThreadId
GetSystemInfo
LeaveCriticalSection
EnterCriticalSection
UnhandledExceptionFilter
GetProcessHeap
HeapAlloc
SetEvent
SetLastError
HeapFree
SetUnhandledExceptionFilter
RtlVirtualUnwind
IsProcessorFeaturePresent
TerminateProcess
GetLocalTime
UnregisterWaitEx
GetLastError
RegisterWaitForSingleObject
QueueUserWorkItem
WaitForSingleObject
CreateEventW
RtlCaptureContext
ole32
CoUninitialize
CLSIDFromString
StringFromIID
IIDFromString
CreateBindCtx
StringFromGUID2
CoTaskMemFree
StringFromCLSID
CoCreateInstance
CoInitializeEx
CoCreateFreeThreadedMarshaler
oleaut32
SetErrorInfo
VariantClear
SysFreeString
SysAllocString
VariantInit
VariantCopy
LoadRegTypeLi
rtutils
TraceVprintfExA
TraceDeregisterW
TraceRegisterExW
user32
DefWindowProcW
DestroyWindow
SetWindowLongPtrW
CreateWindowExW
UnregisterClassW
LoadStringW
UnregisterDeviceNotification
TranslateMessage
RegisterClassW
MsgWaitForMultipleObjectsEx
PeekMessageW
DispatchMessageW
GetWindowLongPtrW
RegisterDeviceNotificationW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
108KB
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
124KB
Virtual Size
121KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=257, version=33145,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1213, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=20, id=260, version=33145,
count=5, id=259, version=33145,
count=23, id=261, version=33145,
count=1, id=256, version=33145,
count=21, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wbemcomn.dll
- IMPHASH cf2eb3b40a9b3dda5e04f3b9b4c77e67
- SHA256 a386929986d12222169bb945a64df70c19da01c2d87c6425a0b3f9d2d8b8bc36
- MD5 eb6e62e213359cc7736eaf3e3d5b7d95
- SHA1 d57922c8392418ab88dd3c6efc5ff801bdf83e40
- SHA512 613fbc3c5de7de50613c9c25d6b5b46888ef9dfe89a0c8f1ee686200bb5823d3818f09ca617646f377adb3be5ede73bd88fabf8c2d9b8883244b565583d783d4
- SSDEEP 12288:wBqFP564RuYkFL5txQbC2dmyh+sMWj9O:wgJ564QNF5QhmNlWRO
- TLSH T165B46C1DE3BE1096E476D23C88434506E9B2B4291B138FCB029687B97E2BFD85D3DB54
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
189088
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wbemcomn.pdb
msvcrt
mbstowcs
malloc
_initterm
asctime
??0exception@@QEAA@AEBQEBD@Z
free
localtime
time
iswspace
_vsnprintf
wcschr
??0exception@@QEAA@AEBQEBDH@Z
_lock
_unlock
wcstoul
fprintf
fopen
__dllonexit
wcstol
_onexit
?what@exception@@UEBAPEBDXZ
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_lseek
_amsg_exit
_write
_filelengthi64
_XcptFilter
??0exception@@QEAA@AEBV0@@Z
_wunlink
_wcsicmp
_purecall
_close
_read
_wopen
printf
qsort
wcstok
_wtoi
??1exception@@UEAA@XZ
memset
memcmp
swscanf_s
swscanf
_vsnwprintf
_CxxThrowException
__C_specific_handler
__CxxFrameHandler4
__CxxFrameHandler3
memcpy
fclose
memmove
wcstombs
wcscmp
api-ms-win-core-heap-l1-1-0
HeapFree
HeapReAlloc
HeapAlloc
HeapSize
GetProcessHeap
HeapDestroy
api-ms-win-core-synch-l1-1-0
InitializeCriticalSection
OpenEventW
ResetEvent
InitializeCriticalSectionAndSpinCount
CreateEventW
SetEvent
CreateMutexA
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
ReleaseMutex
api-ms-win-core-sysinfo-l1-1-0
GetVersionExW
GlobalMemoryStatusEx
GetSystemDirectoryW
GetComputerNameExW
GetSystemTimeAsFileTime
GetVersion
GetSystemInfo
GetSystemTime
GetTickCount
GetSystemTimeAdjustment
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-processthreads-l1-1-0
GetCurrentThread
TerminateProcess
CreateThread
TlsFree
TlsGetValue
GetCurrentProcessId
TlsAlloc
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-timezone-l1-1-0
GetTimeZoneInformation
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
api-ms-win-core-string-l1-1-0
CompareStringW
GetStringTypeExW
api-ms-win-core-localization-l1-2-0
LCMapStringW
GetLocaleInfoW
GetSystemDefaultLangID
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventWrite
EventUnregister
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
LoadLibraryExW
FreeLibrary
LoadStringW
DisableThreadLibraryCalls
GetModuleHandleW
GetModuleFileNameW
GetModuleHandleExW
api-ms-win-core-file-l1-1-0
CreateDirectoryW
CreateFileW
SetFilePointerEx
GetFileSize
GetFileSizeEx
DeleteFileW
WriteFile
GetFileAttributesW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-file-l2-1-0
MoveFileExW
api-ms-win-core-debug-l1-1-0
DebugBreak
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureStackBackTrace
RtlCaptureContext
api-ms-win-core-localization-l1-2-2
LCIDToLocaleName
api-ms-win-core-wow64-l1-1-0
IsWow64Process
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
api-ms-win-core-memory-l1-1-0
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
ntdll
RtlFreeSid
RtlLengthSecurityDescriptor
RtlEqualSid
RtlUnicodeToMultiByteN
RtlLengthSid
api-ms-win-core-string-obsolete-l1-1-0
lstrlenW
lstrlenA
api-ms-win-core-threadpool-legacy-l1-1-0
QueueUserWorkItem
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
??0?$CLockableFlexArray@VCStaticCritSec@@@@QEAA@$$QEAV0@@Z
??0?$CLockableFlexArray@VCStaticCritSec@@@@QEAA@AEAV0@@Z
??0?$CLockableFlexArray@VCStaticCritSec@@@@QEAA@XZ
??0?$SZLess@PEBG@@QEAA@AEBU0@@Z
??0?$SZLess@PEBG@@QEAA@XZ
??0C9XAce@@QEAA@AEBV0@@Z
??0C9XAce@@QEAA@KKKPEAG@Z
??0C9XAce@@QEAA@XZ
??0CAbstractQl1Parser@@QEAA@AEBV0@@Z
??0CAbstractQl1Parser@@QEAA@PEAVCGenLexSource@@@Z
??0CArena@@QEAA@$$QEAV0@@Z
??0CArena@@QEAA@AEBV0@@Z
??0CArena@@QEAA@XZ
??0CBaseAce@@QEAA@AEBV0@@Z
??0CBaseAce@@QEAA@XZ
??0CBasicUnloadInstruction@@IEAA@XZ
??0CBasicUnloadInstruction@@QEAA@AEBV0@@Z
??0CBasicUnloadInstruction@@QEAA@VCWbemInterval@@@Z
??0CBuffer@@QEAA@AEBV0@@Z
??0CBuffer@@QEAA@PEAEKH@Z
??0CCheckedInCritSec@@QEAA@PEAVCCritSec@@@Z
??0CCircularQueue@@QEAA@XZ
??0CClientOpsNode@@QEAA@XZ
??0CContainerControl@@QEAA@$$QEAV0@@Z
??0CContainerControl@@QEAA@AEBV0@@Z
??0CContainerControl@@QEAA@PEAUIUnknown@@@Z
??0CCritSec@@QEAA@XZ
??0CDMTFParser@@QEAA@PEBG@Z
??0CDatePart@@QEAA@XZ
??0CDateTimeParser@@IEAA@XZ
??0CDateTimeParser@@QEAA@PEBG@Z
??0CEnterWbemCriticalSection@@QEAA@PEAVCWbemCriticalSection@@K@Z
??0CEventLog@@QEAA@AEBV0@@Z
??0CEventLog@@QEAA@PEBGAEBU_GUID@@K@Z
??0CEventLogRecord@@QEAA@AEAV0@@Z
??0CEventLogRecord@@QEAA@GAEBU_EVENT_DESCRIPTOR@@VCInsertionString@@111111111@Z
??0CExecQueue@@QEAA@AEAV0@@Z
??0CExecQueue@@QEAA@XZ
??0CExecRequest@@QEAA@AEBV0@@Z
??0CExecRequest@@QEAA@XZ
??0CFlexArray@@QEAA@AEAV0@@Z
??0CFlexArray@@QEAA@HH@Z
??0CFlexQueue@@QEAA@H@Z
??0CHaltable@@QEAA@AEBV0@@Z
??0CHaltable@@QEAA@XZ
??0CHex@@QEAA@J@Z
??0CIdentitySecurity@@QEAA@AEBV0@@Z
??0CIdentitySecurity@@QEAA@_N@Z
??0CIdentityTest@@QEAA@AEBV0@@Z
??0CIdentityTest@@QEAA@PEAVCTimerInstruction@@@Z
??0CInCritSec@@QEAA@PEAU_RTL_CRITICAL_SECTION@@@Z
??0CInsertionString@@QEAA@$$QEAV0@@Z
??0CInsertionString@@QEAA@AEBV0@@Z
??0CInsertionString@@QEAA@J@Z
??0CInsertionString@@QEAA@PEBD@Z
??0CInsertionString@@QEAA@PEBG@Z
??0CInsertionString@@QEAA@VCHex@@@Z
??0CInsertionString@@QEAA@XZ
??0CInstructionQueue@@QEAA@XZ
??0CInstructionTest@@QEAA@$$QEAV0@@Z
??0CInstructionTest@@QEAA@AEBV0@@Z
??0CInstructionTest@@QEAA@XZ
??0CLifeControl@@QEAA@$$QEAV0@@Z
??0CLifeControl@@QEAA@AEBV0@@Z
??0CLifeControl@@QEAA@XZ
??0CLike@@QEAA@AEBV0@@Z
??0CLike@@QEAA@PEBGG@Z
??0CLike@@QEAA@XZ
??0CLimitControl@@QEAA@AEBV0@@Z
??0CLimitControl@@QEAA@XZ
??0CMRCICompression@@QEAA@XZ
??0CMRCIControl@@QEAA@XZ
??0CMUILocaleList@@QEAA@XZ
??0CMemoryLog@@QEAA@XZ
??0CMinMaxLimitControl@@QEAA@$$QEAV0@@Z
??0CMinMaxLimitControl@@QEAA@AEBV0@@Z
??0CMinMaxLimitControl@@QEAA@HPEBG@Z
??0CNtAce@@QEAA@AEBV0@@Z
??0CNtAce@@QEAA@KKKAEAVCNtSid@@@Z
??0CNtAce@@QEAA@KKKPEAG@Z
??0CNtAce@@QEAA@PEAU_ACCESS_ALLOWED_ACE@@@Z
??0CNtAce@@QEAA@XZ
??0CNtAcl@@QEAA@AEBV0@@Z
??0CNtAcl@@QEAA@K@Z
??0CNtAcl@@QEAA@PEAU_ACL@@@Z
??0CNtSecurityDescriptor@@QEAA@AEAV0@@Z
??0CNtSecurityDescriptor@@QEAA@PEAX@Z
??0CNtSecurityDescriptor@@QEAA@XZ
??0CNtSid@@QEAA@AEBV0@@Z
??0CNtSid@@QEAA@PEAG@Z
??0CNtSid@@QEAA@PEAX@Z
??0CNtSid@@QEAA@W4SidType@0@@Z
??0CNtSid@@QEAA@XZ
??0CPropertyName@@QEAA@AEBV0@@Z
??0CPropertyName@@QEAA@XZ
??0CQl1ParseSink@@QEAA@$$QEAV0@@Z
??0CQl1ParseSink@@QEAA@AEBV0@@Z
??0CQl1ParseSink@@QEAA@XZ
??0CRegistryMinMaxLimitControl@@QEAA@$$QEAV0@@Z
??0CRegistryMinMaxLimitControl@@QEAA@AEBV0@@Z
??0CRegistryMinMaxLimitControl@@QEAA@HPEBG0000@Z
??0CSafeArray@@QEAA@AEAV0@@Z
??0CSafeArray@@QEAA@HHHH@Z
??0CSafeArray@@QEAA@PEAUtagSAFEARRAY@@HHH@Z
??0CStaticCritSec@@QEAA@XZ
??0CTextTemplate@@QEAA@AEBV0@@Z
??0CTextTemplate@@QEAA@PEBG@Z
??0CTimerGenerator@@QEAA@AEBV0@@Z
??0CTimerGenerator@@QEAA@XZ
??0CTimerInstruction@@QEAA@AEBV0@@Z
??0CTimerInstruction@@QEAA@XZ
??0CTraceSessionControl@@QEAA@XZ
??0CUnk@@QEAA@AEBV0@@Z
??0CUnk@@QEAA@PEAVCLifeControl@@PEAUIUnknown@@@Z
??0CUnkInternal@@QEAA@AEBV0@@Z
??0CUnkInternal@@QEAA@PEAVCLifeControl@@@Z
??0CVar@@QEAA@AEBV0@@Z
??0CVar@@QEAA@D@Z
??0CVar@@QEAA@E@Z
??0CVar@@QEAA@F@Z
??0CVar@@QEAA@FH@Z
??0CVar@@QEAA@G@Z
??0CVar@@QEAA@HPEAG@Z
??0CVar@@QEAA@HPEAUtagSAFEARRAY@@@Z
??0CVar@@QEAA@HVauto_bstr@@@Z
??0CVar@@QEAA@J@Z
??0CVar@@QEAA@K@Z
??0CVar@@QEAA@M@Z
??0CVar@@QEAA@N@Z
??0CVar@@QEAA@PEADH@Z
??0CVar@@QEAA@PEAGH@Z
??0CVar@@QEAA@PEAU_FILETIME@@@Z
??0CVar@@QEAA@PEAU_GUID@@H@Z
??0CVar@@QEAA@PEAUtagBLOB@@H@Z
??0CVar@@QEAA@PEAUtagVARIANT@@@Z
??0CVar@@QEAA@PEAVCVarVector@@H@Z
??0CVar@@QEAA@XZ
??0CVarVector@@QEAA@AEAV0@@Z
??0CVarVector@@QEAA@HHH@Z
??0CVarVector@@QEAA@HPEAUtagSAFEARRAY@@H@Z
??0CVarVector@@QEAA@XZ
??0CWMITraceSettings@@QEAA@XZ
??0CWQLScanner@@QEAA@AEAV0@@Z
??0CWQLScanner@@QEAA@PEAVCGenLexSource@@@Z
??0CWStringArray@@QEAA@AEAV0@@Z
??0CWStringArray@@QEAA@HH@Z
??0CWbemCallSecurity@@AEAA@AEBV0@@Z
??0CWbemCallSecurity@@AEAA@K@Z
??0CWbemCriticalSection@@QEAA@XZ
??0CWbemInstallObject@@QEAA@XZ
??0CWbemInterval@@IEAA@K@Z
??0CWbemInterval@@QEAA@XZ
??0CWbemTime@@IEAA@_J@Z
??0CWbemTime@@QEAA@AEBV0@@Z
??0CWbemTime@@QEAA@XZ
??0CWbemTimeSpan@@QEAA@HHHHHHH@Z
??0CWin32DefaultArena@@QEAA@AEBV0@@Z
??0CWin32DefaultArena@@QEAA@XZ
??0QL1_Parser@@QEAA@AEBV0@@Z
??0QL1_Parser@@QEAA@PEAVCGenLexSource@@@Z
??0QL_LEVEL_1_RPN_EXPRESSION@@QEAA@AEBU0@@Z
??0QL_LEVEL_1_RPN_EXPRESSION@@QEAA@XZ
??0QL_LEVEL_1_TOKEN@@QEAA@AEBU0@@Z
??0QL_LEVEL_1_TOKEN@@QEAA@XZ
??0Registry@@QEAA@PEAUHKEY__@@KKPEBG@Z
??0Registry@@QEAA@PEAUHKEY__@@KPEBG@Z
??0Registry@@QEAA@PEBGK@Z
??0Registry@@QEAA@XZ
??0WString2@@QEAA@AEBV0@@Z
??0WString2@@QEAA@KPEAUHINSTANCE__@@@Z
??0WString2@@QEAA@PEAGH@Z
??0WString2@@QEAA@PEBD@Z
??0WString2@@QEAA@PEBG@Z
??0WString2@@QEAA@XZ
??0WString2@@QEAA@_K@Z
??0WString@@QEAA@AEBV0@@Z
??0WString@@QEAA@KPEAUHINSTANCE__@@@Z
??0WString@@QEAA@PEAGH@Z
??0WString@@QEAA@PEBD@Z
??0WString@@QEAA@PEBG@Z
??0WString@@QEAA@XZ
??1?$CLockableFlexArray@VCStaticCritSec@@@@QEAA@XZ
??1?$SZLess@PEBG@@UEAA@XZ
??1C9XAce@@UEAA@XZ
??1CAbstractQl1Parser@@UEAA@XZ
??1CBaseAce@@UEAA@XZ
??1CBasicUnloadInstruction@@UEAA@XZ
??1CBuffer@@QEAA@XZ
??1CCheckedInCritSec@@QEAA@XZ
??1CClientOpsNode@@QEAA@XZ
??1CCritSec@@QEAA@XZ
??1CDMTFParser@@QEAA@XZ
??1CDatePart@@QEAA@XZ
??1CDateTimeParser@@QEAA@XZ
??1CEnterWbemCriticalSection@@QEAA@XZ
??1CEventLog@@QEAA@XZ
??1CEventLogRecord@@QEAA@XZ
??1CExecQueue@@QEAA@XZ
??1CExecRequest@@UEAA@XZ
??1CFlexArray@@QEAA@XZ
??1CFlexQueue@@QEAA@XZ
??1CHaltable@@UEAA@XZ
??1CIdentitySecurity@@QEAA@XZ
??1CIdentityTest@@QEAA@XZ
??1CInCritSec@@QEAA@XZ
??1CInsertionString@@QEAA@XZ
??1CInstructionQueue@@QEAA@XZ
??1CLike@@QEAA@XZ
??1CLimitControl@@UEAA@XZ
??1CMRCICompression@@QEAA@XZ
??1CMUILocaleList@@QEAA@XZ
??1CMinMaxLimitControl@@UEAA@XZ
??1CNtAce@@UEAA@XZ
??1CNtAcl@@QEAA@XZ
??1CNtSecurityDescriptor@@QEAA@XZ
??1CNtSid@@QEAA@XZ
??1CPropertyName@@QEAA@XZ
??1CPublishWMIOperationEvent@@QEAA@XZ
??1CRegistryMinMaxLimitControl@@UEAA@XZ
??1CSafeArray@@QEAA@XZ
??1CStaticCritSec@@QEAA@XZ
??1CTextTemplate@@QEAA@XZ
??1CTimerGenerator@@UEAA@XZ
??1CTimerInstruction@@UEAA@XZ
??1CUnk@@UEAA@XZ
??1CUnkInternal@@UEAA@XZ
??1CVar@@QEAA@XZ
??1CVarVector@@QEAA@XZ
??1CWQLScanner@@QEAA@XZ
??1CWStringArray@@QEAA@XZ
??1CWbemCallSecurity@@AEAA@XZ
??1CWbemCriticalSection@@QEAA@XZ
??1CWbemInstallObject@@QEAA@XZ
??1CWin32DefaultArena@@QEAA@XZ
??1QL1_Parser@@UEAA@XZ
??1QL_LEVEL_1_RPN_EXPRESSION@@QEAA@XZ
??1QL_LEVEL_1_TOKEN@@QEAA@XZ
??1Registry@@QEAA@XZ
??1WString2@@QEAA@XZ
??1WString@@QEAA@XZ
??4?$CLockableFlexArray@VCStaticCritSec@@@@QEAAAEAV0@$$QEAV0@@Z
??4?$CLockableFlexArray@VCStaticCritSec@@@@QEAAAEAV0@AEAV0@@Z
??4?$SZLess@PEBG@@QEAAAEAU0@AEBU0@@Z
??4C9XAce@@QEAAAEAV0@AEBV0@@Z
??4CAbstractQl1Parser@@QEAAAEAV0@AEBV0@@Z
??4CArena@@QEAAAEAV0@$$QEAV0@@Z
??4CArena@@QEAAAEAV0@AEBV0@@Z
??4CBaseAce@@QEAAAEAV0@AEBV0@@Z
??4CBaseMrciCompression@@QEAAAEAV0@$$QEAV0@@Z
??4CBaseMrciCompression@@QEAAAEAV0@AEBV0@@Z
??4CBasicUnloadInstruction@@QEAAAEAV0@AEBV0@@Z
??4CBuffer@@QEAAAEAV0@AEBV0@@Z
??4CCheckedInCritSec@@QEAAAEAV0@AEBV0@@Z
??4CCircularQueue@@QEAAAEAV0@$$QEAV0@@Z
??4CCircularQueue@@QEAAAEAV0@AEBV0@@Z
??4CClientOpsNode@@QEAAAEAV0@AEBV0@@Z
??4CContainerControl@@QEAAAEAV0@$$QEAV0@@Z
??4CContainerControl@@QEAAAEAV0@AEBV0@@Z
??4CCritSec@@QEAAAEAV0@AEBV0@@Z
??4CDMTFParser@@QEAAAEAV0@AEBV0@@Z
??4CDatePart@@QEAAAEAV0@AEBV0@@Z
??4CDateTimeParser@@QEAAAEAV0@AEBV0@@Z
??4CEnterWbemCriticalSection@@QEAAAEAV0@AEBV0@@Z
??4CExecQueue@@QEAAAEAV0@AEAV0@@Z
??4CExecRequest@@QEAAAEAV0@AEBV0@@Z
??4CFlexArray@@QEAAAEAV0@AEAV0@@Z
??4CFlexQueue@@QEAAAEAV0@AEBV0@@Z
??4CHaltable@@QEAAAEAV0@AEBV0@@Z
??4CHex@@QEAAAEAV0@$$QEAV0@@Z
??4CHex@@QEAAAEAV0@AEBV0@@Z
??4CIdentitySecurity@@QEAAAEAV0@AEBV0@@Z
??4CIdentityTest@@QEAAAEAV0@AEBV0@@Z
??4CInCritSec@@QEAAAEAV0@AEBV0@@Z
??4CInsertionString@@QEAAAEAV0@$$QEAV0@@Z
??4CInsertionString@@QEAAAEAV0@AEBV0@@Z
??4CInstructionQueue@@QEAAAEAV0@AEBV0@@Z
??4CInstructionTest@@QEAAAEAV0@$$QEAV0@@Z
??4CInstructionTest@@QEAAAEAV0@AEBV0@@Z
??4CLifeControl@@QEAAAEAV0@$$QEAV0@@Z
??4CLifeControl@@QEAAAEAV0@AEBV0@@Z
??4CLike@@QEAAAEAV0@AEBV0@@Z
??4CLimitControl@@QEAAAEAV0@AEBV0@@Z
??4CMRCICompression@@QEAAAEAV0@AEBV0@@Z
??4CMRCIControl@@QEAAAEAV0@$$QEAV0@@Z
??4CMRCIControl@@QEAAAEAV0@AEBV0@@Z
??4CMUILocale@@QEAAAEAV0@$$QEAV0@@Z
??4CMUILocale@@QEAAAEAV0@AEBV0@@Z
??4CMUILocaleList@@QEAAAEAV0@AEBV0@@Z
??4CMemoryLog@@QEAAAEAV0@$$QEAV0@@Z
??4CMemoryLog@@QEAAAEAV0@AEBV0@@Z
??4CMinMaxLimitControl@@QEAAAEAV0@$$QEAV0@@Z
??4CMinMaxLimitControl@@QEAAAEAV0@AEBV0@@Z
??4CNtAce@@QEAAAEAV0@AEBV0@@Z
??4CNtAcl@@QEAAAEAV0@AEBV0@@Z
??4CNtSecurity@@QEAAAEAV0@$$QEAV0@@Z
??4CNtSecurity@@QEAAAEAV0@AEBV0@@Z
??4CNtSecurityDescriptor@@QEAAAEAV0@AEAV0@@Z
??4CNtSid@@QEAAAEAV0@AEBV0@@Z
??4CPersistentConfig@@QEAAAEAV0@$$QEAV0@@Z
??4CPersistentConfig@@QEAAAEAV0@AEBV0@@Z
??4CPropertyName@@QEAAXAEBU_tag_WbemPropertyName@@@Z
??4CPropertyName@@QEAAXAEBV0@@Z
??4CPublishWMIOperationEvent@@QEAAAEAV0@AEBV0@@Z
??4CQl1ParseSink@@QEAAAEAV0@$$QEAV0@@Z
??4CQl1ParseSink@@QEAAAEAV0@AEBV0@@Z
??4CRegistryMinMaxLimitControl@@QEAAAEAV0@$$QEAV0@@Z
??4CRegistryMinMaxLimitControl@@QEAAAEAV0@AEBV0@@Z
??4CSafeArray@@QEAAAEAV0@AEAV0@@Z
??4CSmallArrayBlob@@QEAAAEAV0@$$QEAV0@@Z
??4CSmallArrayBlob@@QEAAAEAV0@AEBV0@@Z
??4CStaticCritSec@@QEAAAEAV0@AEBV0@@Z
??4CTextTemplate@@QEAAAEAV0@AEBV0@@Z
??4CTimerGenerator@@QEAAAEAV0@AEBV0@@Z
??4CTimerInstruction@@QEAAAEAV0@AEBV0@@Z
??4CTraceSessionControl@@QEAAAEAV0@$$QEAV0@@Z
??4CTraceSessionControl@@QEAAAEAV0@AEBV0@@Z
??4CUnk@@QEAAAEAV0@AEBV0@@Z
??4CUnkInternal@@QEAAAEAV0@AEBV0@@Z
??4CVar@@QEAAAEAV0@AEBV0@@Z
??4CVarVector@@QEAAAEAV0@AEAV0@@Z
??4CWMITraceSettings@@QEAAAEAV0@$$QEAV0@@Z
??4CWMITraceSettings@@QEAAAEAV0@AEBV0@@Z
??4CWQLScanner@@QEAAAEAV0@AEAV0@@Z
??4CWStringArray@@QEAAAEAV0@AEAV0@@Z
??4CWbemCallSecurity@@AEAAAEAV0@AEBV0@@Z
??4CWbemCriticalSection@@QEAAAEAV0@AEBV0@@Z
??4CWbemInstallObject@@QEAAAEAV0@AEBV0@@Z
??4CWbemInterval@@QEAAAEAV0@$$QEAV0@@Z
??4CWbemInterval@@QEAAAEAV0@AEBV0@@Z
??4CWbemTime@@QEAAXAEBV0@@Z
??4CWbemTimeSpan@@QEAAAEAV0@$$QEAV0@@Z
??4CWbemTimeSpan@@QEAAAEAV0@AEBV0@@Z
??4CWin32DefaultArena@@QEAAAEAV0@AEBV0@@Z
??4MD5@@QEAAAEAV0@$$QEAV0@@Z
??4MD5@@QEAAAEAV0@AEBV0@@Z
??4QL1_Parser@@QEAAAEAV0@AEBV0@@Z
??4QL_LEVEL_1_RPN_EXPRESSION@@QEAAAEAU0@AEBU0@@Z
??4QL_LEVEL_1_TOKEN@@QEAAAEAU0@AEBU0@@Z
??4QL_LEVEL_1_TOKEN@@QEAAAEAU0@AEBU_tag_WbemQl1Token@@@Z
??4Registry@@QEAAAEAV0@AEBV0@@Z
??4SHA256@@QEAAAEAV0@$$QEAV0@@Z
??4SHA256@@QEAAAEAV0@AEBV0@@Z
??4WString2@@QEAAAEAV0@AEBV0@@Z
??4WString2@@QEAAAEAV0@PEBG@Z
??4WString@@QEAAAEAV0@AEBV0@@Z
??4WString@@QEAAAEAV0@PEBG@Z
??8CEventLogRecord@@QEAAHAEBV0@@Z
??8CNtSid@@QEAAHAEAV0@@Z
??8CPropertyName@@QEAAHAEBU_tag_WbemPropertyName@@@Z
??8CVar@@QEAAHAEAV0@@Z
??8CVarVector@@QEAAHAEAV0@@Z
??ACFlexArray@@QEAAAEAPEAXH@Z
??ACFlexArray@@QEBAPEAXH@Z
??ACSmallArrayBlob@@QEBAPEAXH@Z
??ACVarVector@@QEAAAEAVCVar@@H@Z
??ACWStringArray@@QEBAPEAGH@Z
??AWString2@@QEBAGH@Z
??AWString@@QEBAGH@Z
??BCHex@@QEAAJXZ
??BCVar@@QEAA?AU_FILETIME@@XZ
??BCVar@@QEAADXZ
??BCVar@@QEAAEXZ
??BCVar@@QEAAFXZ
??BCVar@@QEAAGXZ
??BCVar@@QEAAJXZ
??BCVar@@QEAAKXZ
??BCVar@@QEAAMXZ
??BCVar@@QEAANXZ
??BCVar@@QEAAPEADXZ
??BCVar@@QEAAPEAGXZ
??BCVar@@QEAAPEAU_GUID@@XZ
??BCVar@@QEAAPEAUtagBLOB@@XZ
??BCVar@@QEAAPEAVCVarVector@@XZ
??BWString2@@QEAAPEAGXZ
??BWString2@@QEBAPEBGXZ
??BWString@@QEAAPEAGXZ
??BWString@@QEBAPEBGXZ
??DCWbemInterval@@QEBA?AV0@N@Z
??GCWbemTime@@QEBA?AV0@AEBVCWbemTimeSpan@@@Z
??GCWbemTime@@QEBA?AVCWbemInterval@@AEBV0@@Z
??HCWbemInterval@@QEBA?AV0@V0@@Z
??HCWbemTime@@QEBA?AV0@AEBVCWbemInterval@@@Z
??HCWbemTime@@QEBA?AV0@AEBVCWbemTimeSpan@@@Z
??MCWbemInterval@@QEAAHV0@@Z
??MCWbemTime@@QEBAHAEBV0@@Z
??MWString2@@QEBAHPEBG@Z
??MWString@@QEBAHPEBG@Z
??NCWbemTime@@QEBAHAEBV0@@Z
??NWString2@@QEBAHPEBG@Z
??NWString@@QEBAHPEBG@Z
??OCWbemInterval@@QEAAHV0@@Z
??OCWbemTime@@QEBAHAEBV0@@Z
??OWString2@@QEBAHPEBG@Z
??OWString@@QEBAHPEBG@Z
??PCWbemTime@@QEBAHAEBV0@@Z
??PWString2@@QEBAHPEBG@Z
??PWString@@QEBAHPEBG@Z
??R?$SZLess@PEBG@@QEBA_NAEBQEBG0@Z
??RCIdentityTest@@UEAAHPEAVCTimerInstruction@@@Z
??RWString2@@QEBA?AV0@HH@Z
??RWString@@QEBA?AV0@HH@Z
??YCWbemInterval@@QEAAXV0@@Z
??YWString2@@QEAAAEAV0@AEBV0@@Z
??YWString2@@QEAAAEAV0@G@Z
??YWString2@@QEAAAEAV0@PEBG@Z
??YWString@@QEAAAEAV0@AEBV0@@Z
??YWString@@QEAAAEAV0@G@Z
??YWString@@QEAAAEAV0@PEBG@Z
??_7?$SZLess@PEBG@@6B@
??_7C9XAce@@6B@
??_7CAbstractQl1Parser@@6B@
??_7CArena@@6B@
??_7CBaseAce@@6B@
??_7CBasicUnloadInstruction@@6B@
??_7CBuffer@@6B@
??_7CContainerControl@@6B@
??_7CExecQueue@@6B@
??_7CExecRequest@@6B@
??_7CHaltable@@6B@
??_7CIdentityTest@@6B@
??_7CInstructionTest@@6B@
??_7CLifeControl@@6B@
??_7CLimitControl@@6B@
??_7CMinMaxLimitControl@@6B@
??_7CNtAce@@6B@
??_7CQl1ParseSink@@6B@
??_7CRegistryMinMaxLimitControl@@6B@
??_7CTimerGenerator@@6B@
??_7CTimerInstruction@@6B@
??_7CUnk@@6B@
??_7CUnkInternal@@6B@
??_7CWbemCallSecurity@@6B@
??_7CWin32DefaultArena@@6B@
??_7QL1_Parser@@6B@
??_7QL_LEVEL_1_RPN_EXPRESSION@@6B@
??_FCBuffer@@QEAAXXZ
??_FCEventLog@@QEAAXXZ
??_FCFlexArray@@QEAAXXZ
??_FCFlexQueue@@QEAAXXZ
??_FCNtAcl@@QEAAXXZ
??_FCTextTemplate@@QEAAXXZ
??_FCUnk@@QEAAXXZ
??_FCWStringArray@@QEAAXXZ
??_FCWbemCallSecurity@@QEAAXXZ
?AbortCompression@CMRCIControl@@QEAAXXZ
?AbortRequested@CMRCIControl@@QEAAHXZ
?Access@CSafeArray@@QEAAJPEAPEAX@Z
?AccessCheck@CIdentitySecurity@@QEAAHXZ
?AccessRawArray@CVarVector@@QEAAJPEAPEAX@Z
?Add@CFlexArray@@QEAAHPEAX@Z
?Add@CMinMaxLimitControl@@UEAAJKKPEAK@Z
?Add@CVarVector@@QEAAHAEAVCVar@@@Z
?Add@CVarVector@@QEAAHPEAVCVar@@@Z
?Add@CWStringArray@@QEAAHPEBG@Z
?AddAce@CNtAcl@@QEAAHPEAVCNtAce@@@Z
?AddAggregationProperty@QL_LEVEL_1_RPN_EXPRESSION@@UEAAXAEBVCPropertyName@@@Z
?AddAllAggregationProperties@QL_LEVEL_1_RPN_EXPRESSION@@UEAAXXZ
?AddAllProperties@QL_LEVEL_1_RPN_EXPRESSION@@UEAAXXZ
?AddAppropriateToken@CAbstractQl1Parser@@IEAAXAEBU_tag_WbemQl1Token@@@Z
?AddBSTR@CSafeArray@@QEAAHPEAG@Z
?AddBool@CSafeArray@@QEAAHF@Z
?AddByte@CSafeArray@@QEAAHE@Z
?AddChild@CClientOpsNode@@QEAAXPEAV1@@Z
?AddCulture@CMUILocaleList@@AEAAJPEBGW4LocaleType@CMUILocale@@K@Z
?AddDispatch@CSafeArray@@QEAAHPEAUIDispatch@@@Z
?AddDouble@CSafeArray@@QEAAHN@Z
?AddElement@CPropertyName@@QEAAXPEBG@Z
?AddEnvironmentValue@CWbemInstallObject@@SAJPEBG0@Z
?AddFloat@CSafeArray@@QEAAHM@Z
?AddHavingToken@QL_LEVEL_1_RPN_EXPRESSION@@UEAAXAEBU_tag_WbemQl1Token@@@Z
?AddInsertionString@CEventLogRecord@@IEAAXAEAVCInsertionString@@@Z
?AddLocale@CMUILocaleList@@AEAAJPEBGW4LocaleType@CMUILocale@@K@Z
?AddLong@CSafeArray@@QEAAHJ@Z
?AddMember@CLimitControl@@UEAAJXZ
?AddProperty@QL_LEVEL_1_RPN_EXPRESSION@@UEAAXAEBVCPropertyName@@@Z
?AddRecord@CEventLog@@IEAAHPEAVCEventLogRecord@@@Z
?AddRef@CBasicUnloadInstruction@@UEAAXXZ
?AddRef@CBuffer@@UEAAKXZ
?AddRef@CContainerControl@@UEAAXPEAUIUnknown@@@Z
?AddRef@CExecQueue@@QEAAXXZ
?AddRef@CUnk@@UEAAKXZ
?AddRef@CUnkInternal@@UEAAKXZ
?AddRef@CWbemCallSecurity@@UEAAKXZ
?AddRef@QL_LEVEL_1_RPN_EXPRESSION@@QEAAXXZ
?AddScalar@CSafeArray@@AEAAHTSA_ArrayScalar@@@Z
?AddShort@CSafeArray@@QEAAHF@Z
?AddToken@QL_LEVEL_1_RPN_EXPRESSION@@QEAAXAEBUQL_LEVEL_1_TOKEN@@@Z
?AddToken@QL_LEVEL_1_RPN_EXPRESSION@@UEAAXAEBU_tag_WbemQl1Token@@@Z
?AddUnknown@CSafeArray@@QEAAHPEAUIUnknown@@@Z
?AddVariant@CSafeArray@@QEAAHPEAUtagVARIANT@@@Z
?AdjustInitialPriority@CExecQueue@@MEAAXPEAVCExecRequest@@@Z
?AdjustPriorityForPassing@CExecQueue@@MEAAXPEAVCExecRequest@@@Z
?Advance@CBuffer@@QEAAJK@Z
?AliasToTable@CWQLScanner@@QEAAQEAGPEAG@Z
?Alloc@CWin32DefaultArena@@UEAAPEAX_K@Z
?AllocAmPm@CDateTimeParser@@IEAAPEAGXZ
?AppendBuffer@WString2@@AEAAXPEBG_K@Z
?AppendCulture@CMUILocaleList@@AEAAJPEBG@Z
?AppendLocale@CMUILocaleList@@AEAAJPEBG@Z
?Apply@CTextTemplate@@QEAAPEAGPEAUIWbemClassObject@@@Z
?Bind@CFlexArray@@QEAAXAEAV1@@Z
?BindPtr@WString2@@QEAAXPEAG@Z
?BindPtr@WString@@QEAAXPEAG@Z
?BreakWait@CInstructionQueue@@QEAAXXZ
?BuildSWQLColRef@CWQLScanner@@AEAAHAEAVCFlexArray@@AEAUSWQLColRef@@@Z
?CalcSitOutPenalty@CExecQueue@@MEAAKJ@Z
?CanDelete@CVar@@QEAAHXZ
?CaptureStackTrace@CMemoryLog@@AEAAXQEAPEAX@Z
?Change@CInstructionQueue@@QEAAJPEAVCTimerInstruction@@VCWbemTime@@@Z
?ChangeTypeTo@CVar@@QEAAHG@Z
?ChangeTypeToEx@CVar@@QEAAHGK@Z
?CheckDMTFDateTimeFormat@CDateTimeParser@@SAHPEBGHH@Z
?CheckDMTFDateTimeFormatInternal@CDateTimeParser@@IEAAHPEBG@Z
?CheckDMTFDateTimeInterval@CDateTimeParser@@SAHPEBG@Z
?CheckDateFormat@CDateTimeParser@@IEAAHPEBGH@Z
?CheckLangNeutral@CMUILocale@@SAJPEBGPEA_N@Z
?CheckTimeFormat@CDateTimeParser@@IEAAHPEBGH@Z
?CheckType@CSafeArray@@AEAAXH@Z
?CleanUp@CWbemInstallObject@@SAXXZ
?ClearPropRefs@CWQLScanner@@AEAAXXZ
?ClearTableRefs@CWQLScanner@@AEAAXXZ
?ClearTokens@CWQLScanner@@AEAAXXZ
?Clone@CBuffer@@UEAAJPEAPEAUIStream@@@Z
?CloneData@CSmallArrayBlob@@QEAAPEAPEAXXZ
?CloneThreadContext@CWbemCallSecurity@@UEAAJH@Z
?CloneThreadToken@CWbemCallSecurity@@AEAAJK@Z
?Close@CEventLog@@QEAAHXZ
?CoCreateInstance@CWbemInstallObject@@SAJAEBU_GUID@@PEAUIUnknown@@K0PEAPEAX@Z
?CoGetClassObject@CWbemInstallObject@@SAJAEBU_GUID@@KPEAU_COSERVERINFO@@0PEAPEAX@Z
?Commit@CBuffer@@UEAAJK@Z
?CompareEls@CFlexArray@@KAHPEBX0@Z
?CompareEls@CSmallArrayBlob@@KAHPEBX0@Z
?CompareTo@CVar@@QEAAHAEAV1@H@Z
?CompareTo@CVarVector@@QEAAHAEAV1@H@Z
?Compress@CFlexArray@@QEAAXXZ
?Compress@CWStringArray@@QEAAXXZ
?CompressBuffer@CMRCICompression@@QEAAIPEAEK0KW4CompressionLevel@1@@Z
?CompressFile@CMRCICompression@@QEAAHPEBG0KW4CompressionLevel@1@PEAVCMRCIControl@@@Z
?CompressFileV1@CMRCICompression@@IEAAHHHKW4CompressionLevel@1@PEAVCMRCIControl@@@Z
?ComputePenalty@CMinMaxLimitControl@@IEAAJKKPEAKPEAH@Z
?ConcatWithoutQuotes@CTextTemplate@@AEAAXAEAVWString2@@AEAPEAG@Z
?ContainsSid@CNtAcl@@QEAAHAEAVCNtSid@@AEAE@Z
?CopyBuffer@WString2@@AEAAXPEBG_K@Z
?CopyData@CSmallArrayBlob@@IEAAXPEAV1@@Z
?CopyDataFrom@CFlexArray@@QEAAHAEBV1@@Z
?CopyTo@CBuffer@@UEAAJPEAUIStream@@T_ULARGE_INTEGER@@PEAT3@2@Z
?CopyTo@CNtSid@@QEAAHPEAX@Z
?CountQuery@CWQLScanner@@QEAAHXZ
?CreateBlob@CSmallArrayBlob@@SAPEAV1@H@Z
?CreateInst@CWbemCallSecurity@@SAPEAVIWbemCallSecurity@@K@Z
?CreateNewThread@CExecQueue@@MEAAHXZ
?CurrentLine@CAbstractQl1Parser@@QEAAHXZ
?CurrentToken@CAbstractQl1Parser@@QEAAPEAGXZ
?DateFormat10@CDateTimeParser@@IEAAHPEBG0H@Z
?DateFormat11@CDateTimeParser@@IEAAHPEBG0H@Z
?DateFormat12@CDateTimeParser@@IEAAHPEBG0H@Z
?DateFormat13@CDateTimeParser@@IEAAHPEBG0H@Z
?DateFormat14@CDateTimeParser@@IEAAHPEBG0H@Z
?DateFormat15@CDateTimeParser@@IEAAHPEBGH@Z
?DateFormat1@CDateTimeParser@@IEAAHPEBGH@Z
?DateFormat2@CDateTimeParser@@IEAAHPEBGH@Z
?DateFormat3@CDateTimeParser@@IEAAHPEBGH@Z
?DateFormat4@CDateTimeParser@@IEAAHPEBGH@Z
?DateFormat5@CDateTimeParser@@IEAAHPEBGH@Z
?DateFormat6@CDateTimeParser@@IEAAHPEBGH@Z
?DateFormat7@CDateTimeParser@@IEAAHPEBGH@Z
?DateFormat8@CDateTimeParser@@IEAAHPEBGH@Z
?DateFormat9@CDateTimeParser@@IEAAHPEBG0H@Z
?DebugDump@CFlexArray@@QEAAXXZ
?DecrementIndex@CFlexQueue@@IEAAXAEAH@Z
?DeleteAce@CNtAcl@@QEAAHH@Z
?DeletePropertyName@CAbstractQl1Parser@@IEAAXXZ
?DeleteSacl@CNtSecurityDescriptor@@QEAAJXZ
?DeleteStr@CWStringArray@@QEAAHH@Z
?DeleteString@WString2@@AEAAX_N@Z
?DeleteString@WString@@AEAAXPEAG@Z
?DeleteValue@Registry@@QEAAHPEBG@Z
?Dequeue@CFlexQueue@@QEAAPEAXXZ
?Dequeue@CInstructionQueue@@QEAAJAEAPEAVCTimerInstruction@@AEAVCWbemTime@@@Z
?Deserialize@C9XAce@@UEAA_NPEAE@Z
?Deserialize@CNtAce@@UEAA_NPEAE@Z
?Difference@CWStringArray@@SAXAEAV1@00@Z
?Disable@CTraceSessionControl@@QEAAKXZ
?DoLike@CLike@@IEAA_NPEBG0G@Z
?DoesNeedNewThread@CExecQueue@@MEAAHPEAVCExecRequest@@@Z
?DoesVectorTypeMatchArrayType@CVarVector@@QEAAHXZ
?Dump@CWQLScanner@@QEAAXXZ
?Dump@QL_LEVEL_1_RPN_EXPRESSION@@QEAAXPEBD@Z
?Dump@QL_LEVEL_1_TOKEN@@QEAAXPEAU_iobuf@@@Z
?DumpError@CExecRequest@@UEAAXXZ
?DumpText@CVar@@QEAAHPEAU_iobuf@@@Z
?ElementSize@CSafeArray@@QEAAHXZ
?Empty@CFlexArray@@QEAAXXZ
?Empty@CPropertyName@@QEAAXXZ
?Empty@CSafeArray@@QEAAXXZ
?Empty@CVar@@QEAAXXZ
?Empty@CVarVector@@QEAAXXZ
?Empty@CWStringArray@@QEAAXXZ
?Empty@WString2@@QEAAXXZ
?Empty@WString@@QEAAXXZ
?Enable@CTraceSessionControl@@QEAAKXZ
?EncryptedCall@CIdentitySecurity@@AEAA_NXZ
?Enqueue@CExecQueue@@UEAAJPEAVCExecRequest@@PEAPEAX@Z
?Enqueue@CFlexQueue@@QEAA_NPEAX@Z
?Enqueue@CInstructionQueue@@QEAAJVCWbemTime@@PEAVCTimerInstruction@@@Z
?EnqueueAndWait@CExecQueue@@QEAAJPEAVCExecRequest@@@Z
?EnqueueWithoutSleep@CExecQueue@@QEAAJPEAVCExecRequest@@PEAPEAX@Z
?EnsureAllocated@CPropertyName@@IEAAXJ@Z
?EnsureExtent@CFlexArray@@QEAAHH@Z
?EnsureExtent@CSmallArrayBlob@@IEAAPEAV1@H@Z
?EnsureMatchState@CLike@@AEAAX_K@Z
?EnsureRunning@CTimerGenerator@@AEAAXXZ
?EnsureSize@CBuffer@@AEAAXK@Z
?Enter@CCheckedInCritSec@@QEAAXXZ
?Enter@CCritSec@@QEAAXXZ
?Enter@CExecQueue@@QEAAXXZ
?Enter@CStaticCritSec@@QEAAXXZ
?Enter@CWbemCriticalSection@@QEAAHK@Z
?Equal@WString2@@QEBAHPEBG@Z
?Equal@WString@@QEBAHPEBG@Z
?EqualNoCase@WString2@@QEBAHPEBG@Z
?EqualNoCase@WString@@QEBAHPEBG@Z
?EscapeQuotes@WString2@@QEBA?AV1@XZ
?EscapeQuotes@WString@@QEBA?AV1@XZ
?Execute@CExecQueue@@MEAAHPEAVCThreadRecord@1@@Z
?ExpandEnvironmentStringsW@CWbemInstallObject@@SAKPEBGPEAGK@Z
?ExpandVariableValue@CWbemInstallObject@@CAJPEBGPEAG_KPEA_K@Z
?ExtractNext@CWQLScanner@@AEAAPEAUWSLexToken@@H@Z
?ExtractSelectType@CWQLScanner@@AEAAHXZ
?ExtractToken@WString2@@QEAAHGAEAV1@@Z
?ExtractToken@WString2@@QEAAHPEBGAEAV1@@Z
?ExtractToken@WString@@QEAAHGAEAV1@@Z
?ExtractToken@WString@@QEAAHPEBGAEAV1@@Z
?Fatal@CSafeArray@@AEAAXPEBD@Z
?FillCVarAt@CVarVector@@QEAAXHAEAVCVar@@@Z
?FillDMTF@CDateTimeParser@@QEAAHPEAG_K@Z
?FillVariant@CVar@@QEAAXPEAUtagVARIANT@@H@Z
?FinalizeMatchState@CLike@@AEAAXXZ
?FindStr@CWStringArray@@QEAAHPEBGH@Z
?FlipOperator@CAbstractQl1Parser@@IEAAHH@Z
?FlushRepository@CWbemInstallObject@@SAJXZ
?Free@CWin32DefaultArena@@UEAAHPEAX@Z
?FreeMap@CWbemInstallObject@@SAXXZ
?Get100nss@CWbemTime@@QEBA_JXZ
?GetAbsoluteCopy@CNtSecurityDescriptor@@QEAAPEAUSNtAbsoluteSD@@XZ
?GetAccessMask@C9XAce@@UEAAKXZ
?GetAccessMask@CNtAce@@UEAAKXZ
?GetAce@CNtAcl@@QEAAHHAEAVCNtAce@@@Z
?GetAce@CNtAcl@@QEAAPEAVCNtAce@@H@Z
?GetAclSizeInfo@CNtAcl@@QEAAHPEAK0@Z
?GetActiveImpersonation@CWbemCallSecurity@@UEAAJXZ
?GetActualVarType@CSafeArray@@QEAAHPEAG@Z
?GetAreaFlags@CWMITraceSettings@@QEAAKXZ
?GetArenaHeap@CWin32DefaultArena@@SAPEAXXZ
?GetArray@CSafeArray@@QEAAPEAUtagSAFEARRAY@@XZ
?GetArrayCopy@CSafeArray@@QEAAPEAUtagSAFEARRAY@@XZ
?GetArrayPtr@CFlexArray@@QEAAPEAPEAXXZ
?GetArrayPtr@CFlexArray@@QEBAPEBQEAXXZ
?GetArrayPtr@CSmallArrayBlob@@QEAAPEAPEAXXZ
?GetArrayPtr@CSmallArrayBlob@@QEBAPEBQEAXXZ
?GetArrayPtr@CWStringArray@@QEAAPEAPEBGXZ
?GetAt@CFlexArray@@QEBAPEAXH@Z
?GetAt@CSmallArrayBlob@@QEBAPEAXH@Z
?GetAt@CVarVector@@QEAAAEAVCVar@@H@Z
?GetAt@CWStringArray@@QEBAPEAGH@Z
?GetAuthenticationId@CWbemCallSecurity@@UEAAKAEAU_LUID@@@Z
?GetAutoRecoverFolder@CWbemInstallObject@@SAPEBGXZ
?GetBSTR@CVar@@QEAAPEAGXZ
?GetBSTRAt@CSafeArray@@QEAAPEAGH@Z
?GetBSTRAtThrow@CSafeArray@@QEAAPEAGH@Z
?GetBinary@Registry@@QEAAHPEBGPEAPEAEPEAK@Z
?GetBinaryPath@CWbemInstallObject@@SAPEBGXZ
?GetBlob@CVar@@QEAAPEAUtagBLOB@@XZ
?GetBool@CVar@@QEAAFXZ
?GetBoolAt@CSafeArray@@QEAAFH@Z
?GetByte@CVar@@QEAAEXZ
?GetByteAt@CSafeArray@@QEAAEH@Z
?GetCallerIdentity@CWbemCallSecurity@@QEAAPEBGXZ
?GetChar@CVar@@QEAADXZ
?GetChildren@CClientOpsNode@@QEAAPEAV1@XZ
?GetClientProcID@CWbemCallSecurity@@QEBAKXZ
?GetClsId@CVar@@QEAAPEAU_GUID@@XZ
?GetCompressedFileInfo@CMRCICompression@@SAHPEBGAEAW4CompressionLevel@1@AEAKAEAU_FILETIME@@AEA_J@Z
?GetCreationTime@CEventLogRecord@@QEAA?AVCWbemTime@@XZ
?GetCultures@CMUILocaleList@@QEAAPEBGXZ
?GetDMTF@CWbemTime@@AEAAHHKPEAG@Z
?GetDWORD@CVar@@QEAAKXZ
?GetDWORD@Registry@@QEAAHPEBGPEAK@Z
?GetDWORDStr@Registry@@QEAAHPEBGPEAK@Z
?GetDacl@CNtSecurityDescriptor@@QEAAHAEAVCNtAcl@@@Z
?GetDacl@CNtSecurityDescriptor@@QEAAJPEAPEAVCNtAcl@@@Z
?GetDacl@CNtSecurityDescriptor@@QEAAPEAVCNtAcl@@XZ
?GetDay@CDateTimeParser@@QEAAEXZ
?GetDispatch@CVar@@QEAAPEAUIDispatch@@XZ
?GetDispatchAt@CSafeArray@@QEAAPEAUIDispatch@@H@Z
?GetDouble@CVar@@QEAANXZ
?GetDoubleAt@CSafeArray@@QEAANH@Z
?GetElementSize@CVarVector@@QEAAHXZ
?GetEmbeddedObject@CVar@@QEAAPEAUIUnknown@@XZ
?GetEnvironmentValue@CWbemInstallObject@@CAJPEBGPEAPEBG@Z
?GetEventTraceProperties@CWMITraceSettings@@QEAAPEAU_EVENT_TRACE_PROPERTIES@@XZ
?GetExpression@CLike@@QEAAPEBGXZ
?GetFILETIME@CWbemTime@@QEBAHPEAU_FILETIME@@@Z
?GetFileTime@CVar@@QEAA?AU_FILETIME@@XZ
?GetFirstFiringTime@CBasicUnloadInstruction@@UEBA?AVCWbemTime@@XZ
?GetFirst_ms_XXX_Locale@CMUILocaleList@@QEAAJPEAPEAG@Z
?GetFlags@C9XAce@@UEAAHXZ
?GetFlags@CNtAce@@UEAAHXZ
?GetFloat@CVar@@QEAAMXZ
?GetFloatAt@CSafeArray@@QEAAMH@Z
?GetFunctionPointers@CMUILocale@@CAJXZ
?GetFunctionPointers@CPublishWMIOperationEvent@@SAJXZ
?GetGroup@CNtSecurityDescriptor@@QEAAPEAVCNtSid@@XZ
?GetHandle@CPropertyName@@QEAAPEAXXZ
?GetHours@CDateTimeParser@@QEAAEXZ
?GetIdleTimeout@CExecQueue@@MEAAKPEAVCThreadRecord@1@@Z
?GetIndex@CBuffer@@QEAAKXZ
?GetInfinity@CWbemInterval@@SA?AV1@XZ
?GetInfinity@CWbemTime@@SA?AV1@XZ
?GetInfo@CClientOpsNode@@QEAAPEAXXZ
?GetInfo@CNtSid@@QEAAHPEAPEAG0PEAK@Z
?GetInnerUnknown@CUnk@@QEAAPEAUIUnknown@@XZ
?GetInstructionType@CBasicUnloadInstruction@@UEAAHXZ
?GetLPSTR@CVar@@QEAAPEADXZ
?GetLPSTR@WString2@@QEBAPEADXZ
?GetLPSTR@WString@@QEBAPEADXZ
?GetLPWSTR@CVar@@QEAAPEAGXZ
?GetLToken@WString2@@QEBAPEAGG@Z
?GetLToken@WString@@QEBAPEAGG@Z
?GetLastError@Registry@@QEAAJXZ
?GetLocalInfoAndAlloc@CDateTimeParser@@IEAAXKAEAPEAG@Z
?GetLocalOffsetForDate@CWbemTime@@SAJPEBU_SYSTEMTIME@@@Z
?GetLocales@CMUILocaleList@@QEAAPEBGXZ
?GetLockCount@CWbemCriticalSection@@QEAAJXZ
?GetLong@CVar@@QEAAJXZ
?GetLongAt@CSafeArray@@QEAAJH@Z
?GetMicroseconds@CDateTimeParser@@QEAAIXZ
?GetMilliseconds@CWbemInterval@@QEBAKXZ
?GetMinutes@CDateTimeParser@@QEAAEXZ
?GetMonth@CDateTimeParser@@QEAAEXZ
?GetMultiStr@Registry@@QEAAPEAGPEBGAEAK@Z
?GetNewSafeArray@CVar@@QEAAPEAUtagSAFEARRAY@@XZ
?GetNewSafeArray@CVarVector@@QEAAPEAUtagSAFEARRAY@@XZ
?GetNewVariant@CVar@@QEAAPEAUtagVARIANT@@XZ
?GetNext@CClientOpsNode@@QEAAPEAV1@XZ
?GetNext@CExecRequest@@QEAAPEAV1@XZ
?GetNextElement@CCircularQueue@@QEAAKPEAPEAULOG_ELEMENT@@@Z
?GetNextFiringTime@CBasicUnloadInstruction@@UEBA?AVCWbemTime@@V2@PEAJ@Z
?GetNumAces@CNtAcl@@QEAAHXZ
?GetNumElements@CPropertyName@@QEBAJXZ
?GetNumInstructions@CInstructionQueue@@QEAAJXZ
?GetNumStrings@CEventLogRecord@@QEAAGXZ
?GetOleType@CVar@@QEAAHXZ
?GetOwner@CNtSecurityDescriptor@@QEAAPEAVCNtSid@@XZ
?GetOwningThreadId@CWbemCriticalSection@@QEAAKXZ
?GetPart@CDatePart@@QEAAJHPEAH@Z
?GetPersistentCfgValue@CPersistentConfig@@QEAAHKAEAK@Z
?GetPotentialImpersonation@CWbemCallSecurity@@UEAAJXZ
?GetPreferedDateFormat@CDateTimeParser@@IEAAXXZ
?GetPreferredLanguages@CMUILocale@@SAJKPEAPEAGPEAK@Z
?GetPreferredLanguages@CMUILocale@@SAJPEAPEAGPEAK@Z
?GetPrevious@CClientOpsNode@@QEAAPEAV1@XZ
?GetPriority@CExecRequest@@QEAAJXZ
?GetPropertyFromIUnknown@CTextTemplate@@AEAAPEAGPEAGPEAUIUnknown@@@Z
?GetPtr@CNtAce@@QEAAPEAU_ACCESS_ALLOWED_ACE@@XZ
?GetPtr@CNtAcl@@QEAAPEAU_ACL@@XZ
?GetPtr@CNtSecurityDescriptor@@QEAAPEAXXZ
?GetPtr@CNtSid@@QEAAPEAXXZ
?GetQWORD@Registry@@QEAAHPEBGPEA_K@Z
?GetQueryClass@QL1_Parser@@QEAAHPEAGH@Z
?GetQueueSize@CFlexQueue@@QEBAHXZ
?GetRawArrayData@CVarVector@@QEAAJPEAXH@Z
?GetRawData@CBuffer@@QEAAPEAEXZ
?GetRawData@CSafeArray@@QEAAHPEAXH@Z
?GetRawData@CVar@@QEAAPEAXXZ
?GetRecursionCount@CWbemCriticalSection@@QEAAJXZ
?GetReferencedAliases@CWQLScanner@@QEAAHAEAVCWStringArray@@@Z
?GetReferencedTables@CWQLScanner@@QEAAHAEAVCWStringArray@@@Z
?GetRegistryPathCIMOM@CWbemInstallObject@@SAPEBGXZ
?GetRegistryPathRoot@CWbemInstallObject@@SAPEAUHKEY__@@XZ
?GetRegistryPathWbem@CWbemInstallObject@@SAPEBGXZ
?GetRepositoryFolder@CWbemInstallObject@@SAPEBGXZ
?GetSYSTEMTIME@CWbemTime@@QEBAHPEAU_SYSTEMTIME@@@Z
?GetSacl@CNtSecurityDescriptor@@QEAAJPEAPEAVCNtAcl@@@Z
?GetSacl@CNtSecurityDescriptor@@QEAAPEAVCNtAcl@@XZ
?GetSafeArray@CVarVector@@QEAAPEAUtagSAFEARRAY@@H@Z
?GetScalarAt@CSafeArray@@AEAA?ATSA_ArrayScalar@@H@Z
?GetSeconds@CDateTimeParser@@QEAAEXZ
?GetSeconds@CWbemInterval@@QEBAKXZ
?GetSelectedColumns@CWQLScanner@@QEAAPEBVCFlexArray@@XZ
?GetSerializedSize@C9XAce@@UEAAKXZ
?GetSerializedSize@CNtAce@@UEAAKXZ
?GetSessionName@CWMITraceSettings@@QEAAPEAGXZ
?GetShort@CVar@@QEAAFXZ
?GetShortAt@CSafeArray@@QEAAFH@Z
?GetSid@CNtAce@@QEAAHAEAVCNtSid@@@Z
?GetSid@CNtAce@@QEAAPEAVCNtSid@@XZ
?GetSidFromThreadOrProcess@CIdentitySecurity@@AEAAJAEAVCNtSid@@@Z
?GetSinglePropertyName@CAbstractQl1Parser@@IEAAPEBGXZ
?GetSitoutPenalty@CExecQueue@@QEAAKXZ
?GetSize@CBuffer@@QEAAKXZ
?GetSize@CNtAce@@QEAAKXZ
?GetSize@CNtAcl@@QEAAKXZ
?GetSize@CNtSecurityDescriptor@@QEAAKXZ
?GetSize@CNtSid@@QEAAKXZ
?GetStatus@C9XAce@@UEAAKXZ
?GetStatus@CNtAce@@UEAAKXZ
?GetStatus@CNtAcl@@QEAAKXZ
?GetStatus@CNtSecurityDescriptor@@QEAAKXZ
?GetStatus@CNtSid@@QEAAKXZ
?GetStr@Registry@@QEAAHPEBGPEAPEAG@Z
?GetString@CInsertionString@@QEAAPEBGXZ
?GetStringAt@CEventLogRecord@@QEAAPEBGH@Z
?GetStringAt@CPropertyName@@QEBAPEBGJ@Z
?GetStringPointerByRef@WString2@@QEBAAEBQEBGXZ
?GetStringPointerByRef@WString@@QEBAAEBQEBGXZ
?GetText@CPropertyName@@QEAAPEAGXZ
?GetText@CVar@@QEAAPEAGJJPEBG@Z
?GetText@CVarVector@@QEAAPEAGJJ@Z
?GetText@QL_LEVEL_1_RPN_EXPRESSION@@QEAAPEAGXZ
?GetText@QL_LEVEL_1_TOKEN@@QEAAPEAGXZ
?GetTextSid@CNtSid@@QEAAHPEAGPEAK@Z
?GetTextSid@CNtSid@@QEAAJPEAPEAG@Z
?GetTickCount@CWbemTime@@SA?AV1@XZ
?GetTlsIndex@CExecQueue@@SAKXZ
?GetToken@CWbemCallSecurity@@UEAAPEAXXZ
?GetTraceLevel@CWMITraceSettings@@QEAAEXZ
?GetType@C9XAce@@UEAAHXZ
?GetType@CExecQueue@@UEAAPEBGXZ
?GetType@CNtAce@@UEAAHXZ
?GetType@CSafeArray@@QEAAHXZ
?GetType@CVar@@QEAAHXZ
?GetType@CVarVector@@QEAAHXZ
?GetType@Registry@@QEAAHPEBGPEAK@Z
?GetTypeText@CVar@@QEAAPEAGXZ
?GetUTC@CDateTimeParser@@QEAAHXZ
?GetUnknown@CUnk@@QEAAPEAUIUnknown@@XZ
?GetUnknown@CUnkInternal@@QEAAPEAUIUnknown@@XZ
?GetUnknown@CVar@@QEAAPEAUIUnknown@@XZ
?GetUnknownAt@CSafeArray@@QEAAPEAUIUnknown@@H@Z
?GetValue@CDMTFParser@@QEAAHH@Z
?GetVarVector@CVar@@QEAAPEAVCVarVector@@XZ
?GetVariantAt@CSafeArray@@QEAA?AUtagVARIANT@@H@Z
?GetWhenDoneHandle@CExecRequest@@QEAAPEAXXZ
?GetWord@CVar@@QEAAGXZ
?GetYear@CDateTimeParser@@QEAAIXZ
?GetZero@CWbemTime@@SA?AV1@XZ
?Grow@CFlexQueue@@IEAA_NXZ
?Grow@CSmallArrayBlob@@IEAAPEAV1@XZ
?Halt@CHaltable@@QEAAJXZ
?HandleEmbeddedObjectProperties@CTextTemplate@@AEAAPEAGPEAGPEAUIWbemClassObject@@@Z
?HasChildren@CClientOpsNode@@QEAA_NXZ
?HasOwner@CNtSecurityDescriptor@@QEAAHXZ
?HasToBeEnabled@CTraceSessionControl@@QEAA_NXZ
?ImpersonateClient@CWbemCallSecurity@@UEAAJXZ
?InOrder@CQl1ParseSink@@UEAAXJ@Z
?IncrementIndex@CFlexQueue@@IEAAXAEAH@Z
?Init@CPropertyName@@QEAAXXZ
?Init@CPublishWMIOperationEvent@@SAJXZ
?Init@CVar@@AEAAXXZ
?InitMap@CWbemInstallObject@@SAXXZ
?InitTls@CExecQueue@@KAXXZ
?InitToken@CAbstractQl1Parser@@KAXPEAU_tag_WbemQl1Token@@@Z
?Initialize@CMUILocaleList@@QEAAJPEAG_N@Z
?Initialize@CSmallArrayBlob@@IEAAXH@Z
?Initialize@CTraceSessionControl@@QEAAKPEBG@Z
?Initialize@CUnk@@UEAAHXZ
?InitializeThread@CExecQueue@@MEAAJXZ
?Insert@CClientOpsNode@@AEAAXPEAV1@@Z
?InsertAt@CFlexArray@@QEAAHHPEAX@Z
?InsertAt@CSmallArrayBlob@@QEAAPEAV1@HPEAX@Z
?InsertAt@CVarVector@@QEAAHHAEAVCVar@@@Z
?InsertAt@CWStringArray@@QEAAHHPEBG@Z
?InternalAddRef@CUnkInternal@@QEAAKXZ
?InternalQueryInterface@CUnkInternal@@QEAAJAEBU_GUID@@PEAPEAX@Z
?InternalRawArrayAccess@CVarVector@@QEAAJXZ
?InternalRelease@CUnkInternal@@QEAAKXZ
?Intersection@CWStringArray@@SAXAEAV1@00@Z
?IsAppropriateThread@CExecQueue@@MEAAHXZ
?IsDataNull@CVar@@QEAAHXZ
?IsEmbeddedObjectProperty@CTextTemplate@@AEAAHPEAG@Z
?IsEmpty@CInsertionString@@QEAAHXZ
?IsEmpty@CInstructionQueue@@QEAAHXZ
?IsEnabled@CTraceSessionControl@@QEAA_NXZ
?IsEntered@CCheckedInCritSec@@QEAAHXZ
?IsEntered@CEnterWbemCriticalSection@@QEAAHXZ
?IsEventEnabled@CPublishWMIOperationEvent@@SAJAEBU_EVENT_DESCRIPTOR@@@Z
?IsFinite@CWbemInterval@@QEBAHXZ
?IsFinite@CWbemTime@@QEBAHXZ
?IsHalted@CHaltable@@QEAAHXZ
?IsIdleTooLong@CExecQueue@@MEAAHPEAVCThreadRecord@1@K@Z
?IsImpersonating@CWbemCallSecurity@@UEAAHXZ
?IsInitialized@CWbemInstallObject@@CA_NXZ
?IsInterval@CDMTFParser@@QEAA_NXZ
?IsNull@CVar@@QEAAHXZ
?IsOffline@CWbemInstallObject@@SA_NXZ
?IsOk@CExecRequest@@QEAA_NXZ
?IsOptimized@CVarVector@@QEAAHXZ
?IsSTA@CExecQueue@@MEAAHXZ
?IsSTAThread@CExecQueue@@SAHXZ
?IsSuitableThread@CExecQueue@@MEAAHPEAVCThreadRecord@1@PEAVCExecRequest@@@Z
?IsUsed@CDMTFParser@@QEAA_NH@Z
?IsUser@CNtSid@@QEAA_NXZ
?IsUserInGroup@CNtSecurity@@SAHPEAXAEAVCNtSid@@PEAH@Z
?IsValid@CDMTFParser@@QEAA_NXZ
?IsValid@CNtAcl@@QEAAHXZ
?IsValid@CNtSecurityDescriptor@@QEAAHXZ
?IsValid@CNtSid@@QEAAHXZ
?IsValidAmPmString@CDateTimeParser@@IEAAHPEAGPEBGQEAPEAG@Z
?IsValidColonMillisecond@CDateTimeParser@@IEAAHPEAGPEBG@Z
?IsValidDateTime@CDateTimeParser@@QEAAHXZ
?IsValidDayNumber@CDateTimeParser@@IEAAHPEAGPEBG@Z
?IsValidDotMillisecond@CDateTimeParser@@IEAAHPEAGPEBG@Z
?IsValidHourNumber@CDateTimeParser@@IEAAHPEAGPEBG@Z
?IsValidMinuteNumber@CDateTimeParser@@IEAAHPEAGPEBG@Z
?IsValidMonthNumber@CDateTimeParser@@IEAAHPEAGPEBG@Z
?IsValidMonthString@CDateTimeParser@@IEAAHPEAGPEBGQEAPEAG2@Z
?IsValidSecondNumber@CDateTimeParser@@IEAAHPEAGPEBG@Z
?IsValidVectorArray@CVarVector@@SAHHPEAUtagSAFEARRAY@@@Z
?IsValidVectorType@CVarVector@@SAHH@Z
?IsValidYearMonthDayNumber@CDateTimeParser@@IEAAHPEAG@Z
?IsValidYearNumber@CDateTimeParser@@IEAAHPEAGPEBGH@Z
?IsWildcard@CDMTFParser@@QEAA_NH@Z
?IsZero@CWbemInterval@@QEBAHXZ
?IsZero@CWbemTime@@QEBAHXZ
?LCID_To_Culture_Format@CMUILocale@@SAJKPEAG_K@Z
?LCID_To_ms_XXX_Format@CMUILocale@@SAJKPEAG_K@Z
?Leave@CCheckedInCritSec@@QEAAXXZ
?Leave@CCritSec@@QEAAXXZ
?Leave@CExecQueue@@QEAAXXZ
?Leave@CStaticCritSec@@QEAAXXZ
?Leave@CWbemCriticalSection@@QEAAXXZ
?Length@WString2@@QEBAHXZ
?Length@WString@@QEBAHXZ
?LocaleName_To_LCID@CMUILocale@@SAJPEBGPEA_NPEAK@Z
?Lock@?$CLockableFlexArray@VCStaticCritSec@@@@QEAAXXZ
?Lock@CClientOpsNode@@QEAAXXZ
?LockRegion@CBuffer@@UEAAJT_ULARGE_INTEGER@@0K@Z
?LogError@CExecQueue@@MEAAXPEAVCExecRequest@@H@Z
?MakeInternalCopyOfThread@CWbemCallSecurity@@SAPEAV1@XZ
?MakeOptimized@CVarVector@@QEAAHHHH@Z
?MarkForRemoval@CTimerInstruction@@UEAAJXZ
?Match@CLike@@QEAA_NPEBG@Z
?MatchSet@CLike@@IEAA_NPEBG0AEAH@Z
?MoveToSubkey@Registry@@QEAAHPEBG@Z
?Mrci1Decompress@CBaseMrciCompression@@QEAAIPEAEI0I@Z
?Mrci1MaxCompress@CBaseMrciCompression@@QEAAIPEAEI0I@Z
?Mrci2Decompress@CBaseMrciCompression@@QEAAIPEAEI0I@Z
?Mrci2MaxCompress@CBaseMrciCompression@@QEAAIPEAEI0I@Z
?Next@CAbstractQl1Parser@@MEAAHH@Z
?Next@CWQLScanner@@AEAAHXZ
?NotifyStartingThread@CTimerGenerator@@MEAAXXZ
?NotifyStoppingThread@CTimerGenerator@@MEAAXXZ
?ObjectCreated@CContainerControl@@UEAAHPEAUIUnknown@@@Z
?ObjectDestroyed@CContainerControl@@UEAAXPEAUIUnknown@@@Z
?OnInitialize@CUnk@@UEAAHXZ
?Open@CEventLog@@QEAAHXZ
?Open@Registry@@QEAAHPEAUHKEY__@@PEBGK@Z
?OrderAces@CNtAcl@@QEAAPEAV1@XZ
?Parse@CAbstractQl1Parser@@QEAAHPEAVCQl1ParseSink@@H@Z
?Parse@CWQLScanner@@QEAAHXZ
?Parse@QL1_Parser@@QEAAHPEAPEAUQL_LEVEL_1_RPN_EXPRESSION@@@Z
?ParseAbsolute@CDMTFParser@@IEAAXPEBG@Z
?ParseDate@CDMTFParser@@IEAAXPEBG@Z
?ParseInterval@CDMTFParser@@IEAAXPEBG@Z
?ParsePart@CDMTFParser@@IEAAHPEBGHHPEAHHH@Z
?Peek@CFlexQueue@@QEAAPEAXXZ
?ProcessArray@CTextTemplate@@AEAAPEAGAEBUtagVARIANT@@PEAG@Z
?Publish@CPublishWMIOperationEvent@@SAJPEAGKK0000K_K0H@Z
?PublishClientRequestFailure@CPublishWMIOperationEvent@@SAJPEBGPEAG1K10J0@Z
?PublishESSDrop@CPublishWMIOperationEvent@@SAJPEAG0@Z
?PublishESSPollingQuery@CPublishWMIOperationEvent@@SAJKPEAG0KK@Z
?PublishEssStarted@CPublishWMIOperationEvent@@SAJPEAG00K0K0@Z
?PublishEssToConsumer@CPublishWMIOperationEvent@@SAJPEAG0@Z
?PublishEssToConsumerBinding@CPublishWMIOperationEvent@@SAJPEAG000@Z
?PublishMethodExec@CPublishWMIOperationEvent@@SAJPEAGKK000000K_K0H@Z
?PublishProviderInfo@CPublishWMIOperationEvent@@SAJKPEAGK000PEAUIWbemContext@@@Z
?PublishProviderStarted@CPublishWMIOperationEvent@@SAJPEAGJ0K0@Z
?PublishRepDelete@CPublishWMIOperationEvent@@SAJKPEAGPEAUIWbemContext@@K0_KH@Z
?PublishRepUpdate@CPublishWMIOperationEvent@@SAJKPEAGKPEAUIWbemContext@@K0_KH@Z
?PublishStop@CPublishWMIOperationEvent@@SAJKJPEAG@Z
?PublishTemporaryEssStarted@CPublishWMIOperationEvent@@SAJPEAG00K00@Z
?PublishWin32ProcessCreation@CPublishWMIOperationEvent@@SAJPEAGKK0K_K000K1H@Z
?Pushback@CWQLScanner@@AEAAHPEAUWSLexToken@@@Z
?Query@CTraceSessionControl@@SAK_KPEAGPEAPEAVCWMITraceSettings@@@Z
?QueryBlanket@CWbemCallSecurity@@UEAAJPEAK0PEAPEAG00PEAPEAX0@Z
?QueryInterface@CBuffer@@UEAAJAEBU_GUID@@PEAPEAX@Z
?QueryInterface@CUnk@@UEAAJAEBU_GUID@@PEAPEAX@Z
?QueryInterface@CUnkInternal@@UEAAJAEBU_GUID@@PEAPEAX@Z
?QueryInterface@CWbemCallSecurity@@UEAAJAEBU_GUID@@PEAPEAX@Z
?QueueUnblockedWaitForSingleObject@CExecQueue@@SAKPEAXK@Z
?QueueWaitForSingleObject@CExecQueue@@SAKPEAXK@Z
?Read@CBuffer@@UEAAJPEAXKPEAK@Z
?ReadFromRegistry@CWMITraceSettings@@QEAAKPEBG@Z
?ReadLPWSTR@CBuffer@@QEAAJAEAPEBG@Z
?Realloc@CWin32DefaultArena@@UEAAPEAXPEAX_K@Z
?ReduceSql89Joins@CWQLScanner@@AEAAHXZ
?ReduceSql92Joins@CWQLScanner@@AEAAHXZ
?Register@CExecQueue@@KAXPEAVCThreadRecord@1@@Z
?RegisterCMIFlushRepositoryCacheHook@CWbemInstallObject@@SAXP6AJH@Z@Z
?Release@CBasicUnloadInstruction@@UEAAXXZ
?Release@CBuffer@@UEAAKXZ
?Release@CContainerControl@@UEAAXPEAUIUnknown@@@Z
?Release@CExecQueue@@QEAAXXZ
?Release@CUnk@@UEAAKXZ
?Release@CUnkInternal@@UEAAKXZ
?Release@CWbemCallSecurity@@UEAAKXZ
?Release@QL_LEVEL_1_RPN_EXPRESSION@@QEAAXXZ
?RemainsUntil@CWbemTime@@QEBA?AVCWbemInterval@@AEBV1@@Z
?Remove@CInstructionQueue@@QEAAJPEAVCInstructionTest@@PEAPEAVCTimerInstruction@@@Z
?Remove@CMinMaxLimitControl@@UEAAJK@Z
?Remove@CTimerGenerator@@QEAAJPEAVCInstructionTest@@@Z
?RemoveAt@CFlexArray@@QEAAHH@Z
?RemoveAt@CSafeArray@@QEAAHH@Z
?RemoveAt@CSmallArrayBlob@@QEAAPEAV1@HPEAPEAX@Z
?RemoveAt@CVarVector@@QEAAHH@Z
?RemoveAt@CWStringArray@@QEAAHH@Z
?RemoveMember@CLimitControl@@UEAAJXZ
?RemoveSelf@CClientOpsNode@@QEAAXXZ
?ReplaceAt@CWStringArray@@QEAAHHPEAG@Z
?ReplaceClassName@QL1_Parser@@SAPEAGPEAUQL_LEVEL_1_RPN_EXPRESSION@@PEBG@Z
?Report@CEventLog@@QEAAHGAEBU_EVENT_DESCRIPTOR@@VCInsertionString@@111111111@Z
?Requeue@CFlexQueue@@QEAA_NPEAX@Z
?Reread@CRegistryMinMaxLimitControl@@QEAAJXZ
?Reset@CBuffer@@QEAAXXZ
?Reset@CMRCIControl@@QEAAXXZ
?ResetDate@CDateTimeParser@@IEAAXH@Z
?ResetDateTime@CDateTimeParser@@IEAAXH@Z
?ResetQueue@CFlexQueue@@QEAAXXZ
?ResetTime@CDateTimeParser@@IEAAXH@Z
?Resize@CNtAcl@@QEAAHK@Z
?Resume@CHaltable@@QEAAJXZ
?ResumeAll@CHaltable@@QEAAJXZ
?ReturnEscapedReturns@CTextTemplate@@AEAAPEAGPEAG@Z
?Revert@CBuffer@@UEAAJXZ
?RevertToSelf@CWbemCallSecurity@@UEAAJXZ
?ScheduleFreeUnusedLibraries@CTimerGenerator@@QEAAXXZ
?SchedulerThread@CTimerGenerator@@CAKPEAX@Z
?SearchForRecord@CEventLog@@IEAAHPEAVCEventLogRecord@@@Z
?SearchForSuitableRequest@CExecQueue@@MEAAPEAVCExecRequest@@PEAVCThreadRecord@1@@Z
?Seek@CBuffer@@UEAAJT_LARGE_INTEGER@@KPEAT_ULARGE_INTEGER@@@Z
?SelectList@CWQLScanner@@AEAAHXZ
?Serialize@C9XAce@@UEAA_NPEAE_K@Z
?Serialize@CNtAce@@UEAA_NPEAE_K@Z
?Set100nss@CWbemTime@@QEAAX_J@Z
?Set@CTimerGenerator@@QEAAJPEAVCTimerInstruction@@VCWbemTime@@@Z
?SetAggregated@QL_LEVEL_1_RPN_EXPRESSION@@UEAAXXZ
?SetAggregationTolerance@QL_LEVEL_1_RPN_EXPRESSION@@UEAAXAEBU_tag_WbemQl1Tolerance@@@Z
?SetAreaFlags@CWMITraceSettings@@QEAAXK@Z
?SetAsNull@CVar@@QEAAXXZ
?SetAt@CFlexArray@@QEAAXHPEAX@Z
?SetAt@CSmallArrayBlob@@QEAAPEAV1@HPEAXPEAPEAX@Z
?SetAt@CWStringArray@@QEAAHHPEBG@Z
?SetAutoRecoverFolder@CWbemInstallObject@@SAXPEBG@Z
?SetBSTR@CVar@@QEAAHPEAG@Z
?SetBSTR@CVar@@QEAAHVauto_bstr@@@Z
?SetBSTRAt@CSafeArray@@QEAAHHPEAG@Z
?SetBinary@Registry@@QEAAHPEBGPEAEK@Z
?SetBinaryPath@CWbemInstallObject@@SAXPEBG@Z
?SetBlob@CVar@@QEAAXPEAUtagBLOB@@H@Z
?SetBool@CVar@@QEAAXF@Z
?SetBoolAt@CSafeArray@@QEAAHHF@Z
?SetByte@CVar@@QEAAXE@Z
?SetByteAt@CSafeArray@@QEAAHHE@Z
?SetCanDelete@CVar@@QEAAXH@Z
?SetChar@CVar@@QEAAXD@Z
?SetClassName@QL_LEVEL_1_RPN_EXPRESSION@@UEAAXPEBG@Z
?SetClsId@CVar@@QEAAXPEAU_GUID@@H@Z
?SetCountQuery@QL_LEVEL_1_RPN_EXPRESSION@@UEAAXXZ
?SetDMTF@CWbemTime@@QEAAHPEBG@Z
?SetDWORD@CVar@@QEAAXK@Z
?SetDWORD@Registry@@QEAAHPEBGK@Z
?SetDWORDStr@Registry@@QEAAHPEBGK@Z
?SetDacl@CNtSecurityDescriptor@@QEAAHPEAVCNtAcl@@@Z
?SetDate@CDatePart@@QEAAJPEBD@Z
?SetDate@CDatePart@@QEAAJPEBG@Z
?SetDateTime@CDateTimeParser@@QEAAHPEBG@Z
?SetDefaultValues@CWMITraceSettings@@QEAAKXZ
?SetDestructorPolicy@CSafeArray@@QEAAXH@Z
?SetDispatch@CVar@@QEAAXPEAUIDispatch@@@Z
?SetDispatchAt@CSafeArray@@QEAAHHPEAUIDispatch@@@Z
?SetDouble@CVar@@QEAAXN@Z
?SetDoubleAt@CSafeArray@@QEAAHHN@Z
?SetEmbeddedObject@CVar@@QEAAXPEAUIUnknown@@@Z
?SetExpandStr@Registry@@QEAAHPEBG0@Z
?SetExpression@CLike@@QEAAXPEBGG@Z
?SetFailure@CStaticCritSec@@SAXXZ
?SetFileTime@CVar@@QEAAXPEAU_FILETIME@@@Z
?SetFileTime@CWbemTime@@QEAAHAEBU_FILETIME@@@Z
?SetFlags@C9XAce@@UEAAXJ@Z
?SetFlags@CNtAce@@UEAAXJ@Z
?SetFloat@CVar@@QEAAXM@Z
?SetFloatAt@CSafeArray@@QEAAHHM@Z
?SetFromAbsoluteCopy@CNtSecurityDescriptor@@QEAAHPEAUSNtAbsoluteSD@@@Z
?SetGroup@CNtSecurityDescriptor@@QEAAHPEAVCNtSid@@@Z
?SetGrowGranularity@CSafeArray@@QEAAXH@Z
?SetHandle@CPropertyName@@QEAAXPEAX@Z
?SetIdleTimeout@CExecQueue@@QEAAXK@Z
?SetInfo@CClientOpsNode@@QEAAXPEAX@Z
?SetInterval@CBasicUnloadInstruction@@QEAAXAEAVCWbemInterval@@@Z
?SetLPSTR@CVar@@QEAAHPEADH@Z
?SetLPWSTR@CVar@@QEAAHPEAGH@Z
?SetLogingEnabled@CMemoryLog@@QEAAX_N@Z
?SetLong@CVar@@QEAAXJ@Z
?SetLongAt@CSafeArray@@QEAAHHJ@Z
?SetMax@CMinMaxLimitControl@@QEAAXK@Z
?SetMilliseconds@CWbemInterval@@QEAAXK@Z
?SetMin@CMinMaxLimitControl@@QEAAXK@Z
?SetMultiStr@Registry@@QEAAHPEBGPEAGK@Z
?SetNext@CExecRequest@@QEAAXPEAV1@@Z
?SetOffline@CWbemInstallObject@@SAX_N@Z
?SetOverflowIdleTimeout@CExecQueue@@QEAAXK@Z
?SetOwner@CNtSecurityDescriptor@@QEAAHPEAVCNtSid@@@Z
?SetPersistentCfgValue@CPersistentConfig@@QEAAHKK@Z
?SetPreferredLanguages@CMUILocale@@SAJKPEBGPEAK@Z
?SetPriority@CExecRequest@@QEAAXJ@Z
?SetQWORD@Registry@@QEAAHPEBG_K@Z
?SetRaw@CVar@@QEAAXHPEAXH@Z
?SetRawArrayBinding@CVarVector@@QEAAXH@Z
?SetRawArrayData@CVarVector@@QEAAJPEAXHH@Z
?SetRawArrayMaxElement@CSafeArray@@QEAAXH@Z
?SetRawArraySize@CVarVector@@QEAAHH@Z
?SetRawData@CSafeArray@@QEAAHPEAXHH@Z
?SetRegistryPathCIMOM@CWbemInstallObject@@SAXPEBG@Z
?SetRegistryPathRoot@CWbemInstallObject@@SAXPEAUHKEY__@@@Z
?SetRegistryPathWbem@CWbemInstallObject@@SAXPEBG@Z
?SetRepositoryFolder@CWbemInstallObject@@SAXPEBG@Z
?SetRequestLimits@CExecQueue@@QEAAXJJJ@Z
?SetSacl@CNtSecurityDescriptor@@QEAAHPEAVCNtAcl@@@Z
?SetSafeArray@CVar@@QEAAXHPEAUtagSAFEARRAY@@@Z
?SetScalarAt@CSafeArray@@AEAAHHTSA_ArrayScalar@@@Z
?SetShort@CVar@@QEAAXF@Z
?SetShortAt@CSafeArray@@QEAAHHF@Z
?SetSize@CBuffer@@QEAAJK@Z
?SetSize@CBuffer@@UEAAJT_ULARGE_INTEGER@@@Z
?SetSize@CFlexArray@@QEAAXH@Z
?SetSleepAtMax@CMinMaxLimitControl@@QEAAXK@Z
?SetStr@Registry@@QEAAHPEBG0@Z
?SetSystemTime@CWbemTime@@QEAAHAEBU_SYSTEMTIME@@@Z
?SetTemplate@CTextTemplate@@QEAAXPEBG@Z
?SetThreadLimits@CExecQueue@@QEAAXJJJ@Z
?SetTolerance@QL_LEVEL_1_RPN_EXPRESSION@@UEAAXAEBU_tag_WbemQl1Tolerance@@@Z
?SetTraceLevel@CWMITraceSettings@@QEAAXE@Z
?SetUnknown@CVar@@QEAAXPEAUIUnknown@@@Z
?SetUnknownAt@CSafeArray@@QEAAHHPEAUIUnknown@@@Z
?SetVarVector@CVar@@QEAAXPEAVCVarVector@@H@Z
?SetVariant@CVar@@QEAAHPEAUtagVARIANT@@H@Z
?SetVariantAt@CSafeArray@@QEAAHHPEAUtagVARIANT@@@Z
?SetWhenDoneHandle@CExecRequest@@QEAAXPEAX@Z
?SetWord@CVar@@QEAAXG@Z
?Shrink@CSmallArrayBlob@@IEAAPEAV1@XZ
?ShrinkIfNeeded@CSmallArrayBlob@@IEAAPEAV1@XZ
?Shutdown@CExecQueue@@QEAAXXZ
?Shutdown@CTimerGenerator@@UEAAJXZ
?Shutdown@CWbemInstallObject@@SAXXZ
?ShutdownThread@CExecQueue@@MEAAXPEAVCThreadRecord@1@@Z
?SitOutPenalty@CExecQueue@@MEAAXJ@Z
?Size@CFlexArray@@QEBAHXZ
?Size@CSafeArray@@QEAAHXZ
?Size@CSmallArrayBlob@@QEBAHXZ
?Size@CVarVector@@QEAAHXZ
?Size@CWStringArray@@QEBAHXZ
?Sort@CFlexArray@@QEAAXXZ
?Sort@CSmallArrayBlob@@QEAAXXZ
?Sort@CWStringArray@@QEAAXXZ
?Start@CTraceSessionControl@@SAKPEBU_GUID@@PEAVCWMITraceSettings@@@Z
?Stat@CBuffer@@UEAAJPEAUtagSTATSTG@@K@Z
?Status@CSafeArray@@QEAAHXZ
?Status@CVar@@QEAAHXZ
?Status@CVarVector@@QEAAHXZ
?StripToToken@WString2@@QEAAAEAV1@GH@Z
?StripToToken@WString@@QEAAAEAV1@GH@Z
?StripWhereClause@CWQLScanner@@AEAAHXZ
?StripWs@WString2@@QEAAAEAV1@H@Z
?StripWs@WString@@QEAAAEAV1@H@Z
?SwitchRow@CLike@@AEAAX_KAEAPEAE1@Z
?Terminate@CBasicUnloadInstruction@@QEAAXXZ
?ThreadMain@CExecQueue@@MEAAXPEAVCThreadRecord@1@@Z
?TimeFormat1@CDateTimeParser@@IEAAHPEBGH@Z
?TimeFormat2@CDateTimeParser@@IEAAHPEBGH@Z
?TimeFormat3@CDateTimeParser@@IEAAHPEBGH@Z
?TimeFormat4@CDateTimeParser@@IEAAHPEBGH@Z
?TimeFormat5@CDateTimeParser@@IEAAHPEBGH@Z
?TimeFormat6@CDateTimeParser@@IEAAHPEBGH@Z
?TimeFormat7@CDateTimeParser@@IEAAHPEBGH@Z
?TimeFormat8@CDateTimeParser@@IEAAHPEBGH@Z
?TimeFormat9@CDateTimeParser@@IEAAHPEBGH@Z
?TimeToWait@CInstructionQueue@@IEAA?AVCWbemInterval@@XZ
?ToSingleChar@CVar@@QEAAHXZ
?ToSingleChar@CVarVector@@QEAAHXZ
?ToUI4@CVar@@QEAAHXZ
?ToUI4@CVarVector@@QEAAHXZ
?TouchHead@CInstructionQueue@@IEAAXXZ
?Transform@MD5@@SAXPEAXIQEAE@Z
?Transform@SHA256@@SAXPEAXIQEAE@Z
?TranslateIntrinsic@CAbstractQl1Parser@@KAKPEBG@Z
?Trim@CFlexArray@@QEAAXXZ
?Trim@CSafeArray@@QEAAHXZ
?Trim@CSmallArrayBlob@@QEAAXXZ
?TruncAtLToken@WString2@@QEAAAEAV1@G@Z
?TruncAtLToken@WString@@QEAAAEAV1@G@Z
?TruncAtRToken@WString2@@QEAAAEAV1@G@Z
?TruncAtRToken@WString@@QEAAAEAV1@G@Z
?TypeToText@CVar@@SAPEAGH@Z
?Unaccess@CSafeArray@@QEAAJXZ
?UnaccessRawArray@CVarVector@@QEAAJXZ
?UnbindPtr@CFlexArray@@QEAAPEAPEAXXZ
?UnbindPtr@WString2@@QEAAPEAGXZ
?UnbindPtr@WString@@QEAAPEAGXZ
?UnblockedWaitForSingleObject@CExecQueue@@MEAAKPEAXKPEAVCThreadRecord@1@@Z
?UncompressBuffer@CMRCICompression@@QEAAIPEAEK0KW4CompressionLevel@1@@Z
?UncompressFile@CMRCICompression@@QEAAHPEBG0@Z
?UncompressFileV1@CMRCICompression@@IEAAHHH@Z
?UninitializeThread@CExecQueue@@MEAAXXZ
?Union@CWStringArray@@SAXAEAV1@00@Z
?Unlock@?$CLockableFlexArray@VCStaticCritSec@@@@QEAAXXZ
?Unlock@CClientOpsNode@@QEAAXXZ
?UnlockRegion@CBuffer@@UEAAJT_ULARGE_INTEGER@@0K@Z
?Unqueue@CFlexQueue@@QEAAPEAXXZ
?Unquote@WString2@@QEAAXXZ
?Unquote@WString@@QEAAXXZ
?UnregisterCMIFlushRepositoryCacheHook@CWbemInstallObject@@SAXXZ
?UpdateChildren@CClientOpsNode@@AEAAXPEAV1@@Z
?ValidateMemSize@CWin32DefaultArena@@SAHH@Z
?WaitAndPeek@CInstructionQueue@@QEAAJAEAPEAVCTimerInstruction@@AEAVCWbemTime@@@Z
?WaitForResumption@CHaltable@@QEAAJXZ
?WaitForSingleObjectWhileBusy@CExecQueue@@MEAAKPEAXKPEAVCThreadRecord@1@@Z
?WbemHeapFree@CWin32DefaultArena@@SAXXZ
?WbemHeapInitialize@CWin32DefaultArena@@SAHPEAX@Z
?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z
?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z
?WbemMemReAlloc@CWin32DefaultArena@@SAPEAXPEAX_K@Z
?WbemMemSize@CWin32DefaultArena@@SA_KPEAX@Z
?WbemOutOfMemory@CWin32DefaultArena@@SAHXZ
?WbemSysAllocString@CWin32DefaultArena@@SAPEAGPEBG@Z
?WbemSysAllocStringByteLen@CWin32DefaultArena@@SAPEAGPEBDI@Z
?WbemSysAllocStringLen@CWin32DefaultArena@@SAPEAGPEBGI@Z
?WbemSysFreeString@CWin32DefaultArena@@SAXPEAG@Z
?WbemSysReAllocString@CWin32DefaultArena@@SAHPEAPEAGPEBG@Z
?WbemSysReAllocStringLen@CWin32DefaultArena@@SAHPEAPEAGPEBGI@Z
?WildcardTest@WString@@QEBAHPEBG@Z
?Write@CBuffer@@UEAAJPEBXKPEAK@Z
?Write@CMemoryLog@@QEAAXJ@Z
?Write@CMemoryLog@@QEAAXPEAXK@Z
?WriteLPWSTR@CBuffer@@QEAAJPEBG@Z
?WriteToRegistry@CWMITraceSettings@@QEAAKPEBG@Z
?_Alloc@CMUILocale@@SAPEAX_K@Z
?_Free@CMUILocale@@SAHPEAX@Z
?_GetSystemDefaultLocale@CMUILocale@@SAJPEAPEAGK@Z
?_GetSystemDefaultLocaleName@CMUILocale@@SAJPEAPEAG@Z
?_GetThreadPreferredUILanguages@CMUILocale@@SAJKPEAKPEAG0@Z
?_LCIDToLocaleName@CMUILocale@@SAJKPEAGHK@Z
?_LocaleNameToLCID@CMUILocale@@SAJPEAGKPEAK@Z
?_RetrieveSidFromCall@CIdentitySecurity@@AEAAJAEAVCNtSid@@@Z
?_SetThreadPreferredUILanguages@CMUILocale@@SAJKPEBGPEAK@Z
?_ThreadEntry@CExecQueue@@KAKPEAX@Z
?aggregate_by@CAbstractQl1Parser@@IEAAHXZ
?aggregate_within@CAbstractQl1Parser@@IEAAHXZ
?aggregation_params@CAbstractQl1Parser@@IEAAHXZ
?anyFailed_@CStaticCritSec@@0HA
?anyFailure@CStaticCritSec@@SAHXZ
?charbuf@CBaseMrciCompression@@AEAAXI@Z
?class_name@CAbstractQl1Parser@@IEAAHXZ
?comp_operator@CAbstractQl1Parser@@IEAAHXZ
?equiv_operator@CAbstractQl1Parser@@IEAAHXZ
?expandstring@CBaseMrciCompression@@AEAAXPEAPEAEII@Z
?expr2@CAbstractQl1Parser@@IEAAHXZ
?expr@CAbstractQl1Parser@@IEAAHXZ
?finalize@CAbstractQl1Parser@@IEAAHXZ
?getbit@CBaseMrciCompression@@AEAAIXZ
?getbits@CBaseMrciCompression@@AEAAII@Z
?inithash@CBaseMrciCompression@@AEAAXXZ
?isValid@CHaltable@@QEAA_NXZ
?is_operator@CAbstractQl1Parser@@IEAAHXZ
?leading_ident_expr@CAbstractQl1Parser@@IEAAHXZ
?m_bOffline@CWbemInstallObject@@0_NA
?m_csFunctionPointers@CMUILocale@@0VCCritSec@@A
?m_csFunctionPointers@CPublishWMIOperationEvent@@0VCCritSec@@A
?m_csGlobal@CClientOpsNode@@0VCCritSec@@A
?m_fEventActivityIdControl@CPublishWMIOperationEvent@@2P6AKKPEAU_GUID@@@ZEA
?m_fEventEnabled@CPublishWMIOperationEvent@@0P6AE_KPEBU_EVENT_DESCRIPTOR@@@ZEA
?m_fEventRegister@CPublishWMIOperationEvent@@0P6AKPEBU_GUID@@P6AX0KE_K1PEAU_EVENT_FILTER_DESCRIPTOR@@PEAX@Z3PEA_K@ZEA
?m_fEventUnregister@CPublishWMIOperationEvent@@0P6AK_K@ZEA
?m_fEventWrite@CPublishWMIOperationEvent@@0P6AK_KPEAU_EVENT_DESCRIPTOR@@KPEAU_EVENT_DATA_DESCRIPTOR@@@ZEA
?m_fEventWriteTransfer@CPublishWMIOperationEvent@@2P6AK_KPEBU_EVENT_DESCRIPTOR@@PEBU_GUID@@2KPEAU_EVENT_DATA_DESCRIPTOR@@@ZEA
?m_fGetLocaleInfoEx@CMUILocale@@0PEAXEA
?m_fGetSystemDefaultLocaleName@CMUILocale@@0PEAXEA
?m_fGetThreadPreferredUILanguages@CMUILocale@@0PEAXEA
?m_fLCIDToLocaleName@CMUILocale@@0PEAXEA
?m_fLocaleNameToLCID@CMUILocale@@0PEAXEA
?m_fSetThreadPreferredUILanguages@CMUILocale@@0PEAXEA
?m_hAdvAPI32@CPublishWMIOperationEvent@@0PEAUHINSTANCE__@@EA
?m_hKernel32@CMUILocale@@0PEAUHINSTANCE__@@EA
?m_hRegistryPathRoot@CWbemInstallObject@@0PEAUHKEY__@@EA
?m_pEnvironmentMap@CWbemInstallObject@@0PEAV?$map@PEBGPEBGU?$SZLess@PEBG@@V?$wbem_allocator@PEBG@@@std@@EA
?m_pfFlushCache@CWbemInstallObject@@0P6AJH@ZEA
?m_publisher@CPublishWMIOperationEvent@@2_KA
?m_pwszAutoRecoverPath@CWbemInstallObject@@0PEBGEB
?m_pwszBinaryPath@CWbemInstallObject@@0PEBGEB
?m_pwszRegistryPathCIMOM@CWbemInstallObject@@0PEBGEB
?m_pwszRegistryPathWbem@CWbemInstallObject@@0PEBGEB
?m_pwszRepositoryPath@CWbemInstallObject@@0PEBGEB
?m_rgClsidDllMap@CWbemInstallObject@@0PAUClsidDllMapping@@A
?m_rgDllModules@CWbemInstallObject@@0PAUDllModuleHandle@@A
?mrci1outsingle@CBaseMrciCompression@@AEAAXI@Z
?mrci1outstring@CBaseMrciCompression@@AEAAXII@Z
?mrci2outsingle@CBaseMrciCompression@@AEAAXI@Z
?mrci2outstring@CBaseMrciCompression@@AEAAXII@Z
?ms_XXX_Locale_From_LCID@CMUILocale@@SAJKPEAPEAG@Z
?ms_XXX_Locale_To_LCID@CMUILocale@@SAJPEBGPEAK@Z
?mstatic_lNumInits@CExecQueue@@1JA
?opt_aggregation@CAbstractQl1Parser@@IEAAHXZ
?opt_having@CAbstractQl1Parser@@IEAAHXZ
?opt_where@CAbstractQl1Parser@@IEAAHXZ
?outlength@CBaseMrciCompression@@AEAAXI@Z
?parse@CAbstractQl1Parser@@IEAAHH@Z
?parse_property_name@CAbstractQl1Parser@@IEAAHAEAVCPropertyName@@@Z
?prop_list@CAbstractQl1Parser@@IEAAHXZ
?prop_list_2@CAbstractQl1Parser@@IEAAHXZ
?property_name@CAbstractQl1Parser@@IEAAHXZ
?putbits@CBaseMrciCompression@@AEAAXII@Z
?rel_operator@CAbstractQl1Parser@@IEAAHXZ
?sMatachedWithOneChar@CLike@@0EB
?sMatachedWithWildcardChar@CLike@@0EB
?sNoMatch@CLike@@0EB
?simple_expr@CAbstractQl1Parser@@IEAAHXZ
?staticRead@CBasicUnloadInstruction@@SA?AVCWbemInterval@@PEAUIWbemServices@@PEAUIWbemContext@@PEBG@Z
?term2@CAbstractQl1Parser@@IEAAHXZ
?term@CAbstractQl1Parser@@IEAAHXZ
?tolerance@CAbstractQl1Parser@@IEAAHXZ
?trailing_const_expr@CAbstractQl1Parser@@IEAAHXZ
?trailing_ident_expr@CAbstractQl1Parser@@IEAAHXZ
?trailing_or_null@CAbstractQl1Parser@@IEAAHXZ
?trailing_prop_expr@CAbstractQl1Parser@@IEAAHXZ
?typed_constant@CAbstractQl1Parser@@IEAAHXZ
AdjustPrivIfLocalSystem
BlobAssign
BlobClear
BlobCopy
BreakOnDbgAndRenterLoop
BuildOperationInfo
BuildSecurityDescriptorParameter
ChangeVariantToCIMTYPE
ComposeName
CopyFileToAutorecover
CriticalFailADAPTrace
DebugTrace
DumpClientOps
EnableAllPrivileges
EnablePrivilege
ErrorTrace
ExtractMachineName
GetAccessToken
GetFQDN_Ipv4
GetGlobalClientOps
GetLoggingLevelEnabled
GetMemLogObject
GetQFDN_Ipv6
GetSecurityDescriptorFromParameters
GetWMIADAPCmdLine
GetWMITraceSession
Get_WPP_INIT_TRACING_Call_State
IsAdmin
IsInAdminGroup
IsLocalConnection
IsLocalService
IsNT
IsNetworkService
IsNtSetupRunning
IsPrivilegePresent
IsValidElementName
IsValidElementName2
IsW2KOrMore
LoggingLevelEnabled
NormalizeCimDateTime
ReadI64
ReadUI64
RegisterDLL
RegisterDllAppid
RemoveFileFromAutoRecoverFolder
RetrieveSidFromCall
RetrieveSidFromToken
SetObjectAccess2
SetWMITraceSession
Set_WPP_INIT_TRACING_Call_State
TestDirExistAndCreateWithSDIfNotThere
Throttle
UnRegisterDLL
UnregisterDllAppid
WMIControlCallback
WMIControlClientOpsCallback
WbemGetMachineShutdown
WbemSetDynamicCloaking
WbemSetMachineShutdown
WbemVariantChangeType
WinPEKey
_DoTraceHRFailure_
_IsValidElementName
_ThrowMemoryException_
bAreWeLocal
isunialpha
isunialphanum
mstatic_dwTlsIndex
Name
.text
Size
288KB
Virtual Size
286KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
128KB
Virtual Size
125KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
32KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
992B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=54, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=19, id=260, version=33145,
count=4, id=259, version=33145,
count=228, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=7, id=261, version=33145,
count=1, id=256, version=33145,
count=67, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wbiosrvc.dll
- IMPHASH 8b03a08c46da5791f94f383b83d428e2
- SHA256 534541caf73ad611373718f2754da266333e393ec64e546a42313893493feff5
- MD5 5b0e93b87b8f2d2235fcedc903086047
- SHA1 2608d8a6e1f0bd6db74014160b566ae9f03792e6
- SHA512 a79e64d8ed2c8c9f6391ae10677d0bc3e0d4a2c269a7bd77ed83882fca617ac3d2defe71078a61e509dfdbded38fb59b81b708a10839b3a1f9e82f5afbc38cc6
- SSDEEP 24576:6ZC2KqDDuVApRdIrgsfgAaDGcdNDhT1ctcHGsrSKhLvGH:ICPqDDuapPhsIJDndNDhT6tcHGCG
- TLSH T15D355C1EE3EE10E8D4BEC1BDC697462AFAB13425533196CB1921426C2E27FE4763E711
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
387312
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wbiosrvc.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__strnicmp
_o__wcsicmp
_o__wcsnicmp
memmove
_o_abort
_o_ceilf
_o_free
_o_iswalpha
_o_iswdigit
_o_iswupper
_o_iswxdigit
_o_localeconv
_o_malloc
_o_terminate
_o_towlower
_o_towupper
_o_wcsncpy_s
_o_wcstoul
__C_specific_handler
__current_exception
__current_exception_context
_CxxThrowException
_o__dsign
_o__dclass
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o__beginthreadex
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
__CxxFrameHandler3
wcsstr
_o___stdio_common_vsprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__execute_onexit_table
_o__errno
__std_terminate
__CxxFrameHandler4
__C_specific_handler_noexcept
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
wcscmp
strnlen
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExW
LoadLibraryExW
GetProcAddress
GetModuleHandleExA
FreeLibraryAndExitThread
FreeLibrary
LoadStringW
api-ms-win-core-synch-l1-1-0
CreateWaitableTimerExW
SetWaitableTimer
ResetEvent
InitializeCriticalSectionAndSpinCount
SetEvent
CreateEventW
AcquireSRWLockShared
AcquireSRWLockExclusive
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionEx
CreateEventExW
ReleaseSRWLockShared
LeaveCriticalSection
CancelWaitableTimer
InitializeCriticalSection
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
ReleaseSRWLockExclusive
OpenEventW
InitializeSRWLock
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
GetLastError
SetLastError
api-ms-win-core-processthreads-l1-1-0
ProcessIdToSessionId
GetCurrentProcessId
ResumeThread
CreateThread
SetPriorityClass
TerminateProcess
GetCurrentThread
OpenThreadToken
GetCurrentThreadId
GetPriorityClass
GetCurrentProcess
OpenProcessToken
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventWriteTransfer
EventRegister
EventActivityIdControl
EventUnregister
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
TrySubmitThreadpoolCallback
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableLevel
api-ms-win-service-core-l1-1-0
SetServiceStatus
RegisterServiceCtrlHandlerExW
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-service-management-l1-1-0
OpenSCManagerW
OpenServiceW
CloseServiceHandle
api-ms-win-service-winsvc-l1-1-0
QueryServiceStatus
api-ms-win-service-management-l2-1-0
QueryServiceConfigW
ChangeServiceConfigW
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetTickCount
GetTickCount64
GetSystemTime
api-ms-win-core-memory-l1-1-0
ReadProcessMemory
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
OpenProcess
IsProcessorFeaturePresent
api-ms-win-core-synch-l1-2-1
CreateSemaphoreW
WaitForMultipleObjects
api-ms-win-core-io-l1-1-1
CancelSynchronousIo
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegCopyTreeW
RegCloseKey
RegDeleteValueW
RegEnumKeyExW
RegQueryInfoKeyW
RegGetValueW
RegOpenKeyExW
RegDeleteTreeW
api-ms-win-core-io-l1-1-0
CancelIoEx
PostQueuedCompletionStatus
CreateIoCompletionPort
DeviceIoControl
GetQueuedCompletionStatus
GetOverlappedResult
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
SystemTimeToFileTime
api-ms-win-security-lsalookup-l2-1-0
LookupPrivilegeValueW
api-ms-win-security-base-l1-1-0
GetLengthSid
SetSecurityDescriptorOwner
AdjustTokenPrivileges
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
IsValidSecurityDescriptor
IsValidSid
EqualDomainSid
ImpersonateLoggedOnUser
FreeSid
GetSidIdentifierAuthority
AccessCheck
AddAccessAllowedAce
InitializeAcl
InitializeSecurityDescriptor
CopySid
AllocateAndInitializeSid
EqualSid
GetSidSubAuthorityCount
CreateWellKnownSid
GetTokenInformation
GetSidSubAuthority
api-ms-win-power-setting-l1-1-0
PowerSettingRegisterNotification
PowerSettingUnregisterNotification
api-ms-win-core-file-l1-1-0
GetFileSize
CreateDirectoryW
FindClose
FindNextFileW
FindFirstFileW
ReadFile
CompareFileTime
CreateFileW
WriteFile
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
K32EnumProcesses
K32GetProcessMemoryInfo
api-ms-win-core-memory-l1-1-1
PrefetchVirtualMemory
api-ms-win-core-namedpipe-l1-1-0
CreatePipe
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW
ConvertSidToStringSidW
rpcrt4
RpcServerInterfaceGroupDeactivate
RpcServerUnsubscribeForNotification
UuidEqual
RpcImpersonateClient
RpcRevertToSelf
RpcServerSubscribeForNotification
RpcServerInterfaceGroupActivate
RpcRaiseException
NdrClientCall3
RpcServerInterfaceGroupClose
RpcServerTestCancel
RpcServerInterfaceGroupCreateW
UuidToStringW
RpcExceptionFilter
I_RpcExceptionFilter
RpcBindingSetAuthInfoExW
RpcEpResolveBinding
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcBindingFree
RpcStringFreeW
RpcServerInqCallAttributesW
RpcRevertToSelfEx
RpcBindingBind
RpcBindingCreateW
RpcAsyncCompleteCall
UuidCreate
I_RpcMapWin32Status
Ndr64AsyncServerCallAll
NdrServerCallAll
NdrAsyncServerCall
NdrServerCall2
api-ms-win-service-core-l1-1-4
GetServiceDirectory
bcrypt
BCryptDestroyKey
BCryptFinishHash
BCryptImportKey
BCryptExportKey
BCryptGetProperty
BCryptDecrypt
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptHashData
BCryptCreateHash
BCryptEncrypt
BCryptSetProperty
BCryptGenerateSymmetricKey
BCryptGenRandom
BCryptOpenAlgorithmProvider
ncrypt
NCryptEncrypt
NCryptGetProperty
NCryptOpenKey
NCryptDecrypt
NCryptSetProperty
NCryptCreatePersistedKey
NCryptOpenStorageProvider
NCryptDeleteKey
NCryptFinalizeKey
NCryptFreeObject
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateString
api-ms-win-devices-config-l1-1-1
CM_Locate_DevNodeW
CM_Get_Device_Interface_PropertyW
CM_Get_Device_Interface_List_SizeW
CM_MapCrToWin32Err
CM_Get_Device_Interface_ListW
CM_Get_DevNode_Registry_PropertyW
api-ms-win-security-base-l1-2-0
SetCachedSigningLevel
GetCachedSigningLevel
api-ms-win-core-version-l1-1-0
GetFileVersionInfoSizeExW
api-ms-win-core-sysinfo-l1-2-0
GetSystemFirmwareTable
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-service-private-l1-1-0
I_ScRegisterDeviceNotification
I_ScUnregisterDeviceNotification
profapi
ord104
api-ms-win-security-lsapolicy-l1-1-0
LsaClose
LsaOpenPolicy
LsaFreeMemory
LsaQueryInformationPolicy
api-ms-win-core-registry-l2-1-0
RegDeleteKeyW
api-ms-win-core-kernel32-legacy-l1-1-0
WTSGetActiveConsoleSessionId
api-ms-win-core-heap-obsolete-l1-1-0
LocalSize
ntdll
RtlUnsubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlAllocateWnfSerializationGroup
RtlSubscribeWnfStateChangeNotification
NtQueryWnfStateData
NtGetDevicePowerState
RtlPublishWnfStateData
NtQueryInformationProcess
NtTerminateProcess
RtlIsStateSeparationEnabled
RtlIsMultiSessionSku
RtlNtStatusToDosError
NtQuerySystemInformation
RtlFreeUnicodeString
RtlDosPathNameToNtPathName_U_WithStatus
RtlGetNtProductType
RtlEqualSid
RtlCreateProcessParametersEx
NtCreateUserProcess
RtlImageNtHeader
umpdc
PdcSignalClientPulse
PdcSignalClientUnregister
PdcSignalClientRegister
msvcp_win
_Mtx_current_owns
?_Xout_of_range@std@@YAXPEBD@Z
_Thrd_join
_Thrd_id
_Thrd_detach
_Cnd_do_broadcast_at_thread_exit
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
??0task_continuation_context@Concurrency@@AEAA@XZ
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
_Cnd_timedwait
_Query_perf_frequency
_Query_perf_counter
_Cnd_init_in_situ
_Mtx_init_in_situ
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
_Cnd_unregister_at_thread_exit
_Cnd_destroy_in_situ
_Cnd_wait
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
_Mtx_unlock
_Mtx_lock
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_broadcast
_Cnd_register_at_thread_exit
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
_Xtime_get_ticks
?_Syserror_map@std@@YAPEBDH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
_Mtx_destroy_in_situ
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
OutOfProcessExceptionEventCallback
OutOfProcessExceptionEventDebuggerLaunchCallback
OutOfProcessExceptionEventSignatureCallback
ServiceMain
SvchostPushServiceGlobals
Name
.text
Size
824KB
Virtual Size
821KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
204KB
Virtual Size
202KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
48KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
712B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
32KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=129, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33145,
count=1514, id=1, productName=Unmarked objects,
count=6, id=257, version=33145,
count=32, id=261, version=33145,
count=7, id=259, version=33145,
count=1, id=256, version=33145,
count=100, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wc_storage.dll
- IMPHASH 0838d12c1081eaf78ae2eac19e95b19b
- SHA256 b594bcb81c10a3480d5cb9e6b4a9c186974e03e43f72d43fc204025c468c8e10
- MD5 2bee22c5cf29ba28c4d8b02539badd41
- SHA1 9a72c7feca46567a88bca629e40588a0f42a575b
- SHA512 bbd749acf06c35c746e4a6dfe90fc08c5a43d835e86c4704b4405240514de6095129233a3f538ecbd0e4df23d460bf1e2b0cfbf7813adfaae2562a3006940603
- SSDEEP 6144:ckA8SnX9/ylZFKN350NO7GTpbuLhA/IT4iV6f2noIUCj9sV:ckA8SnXaFKN5ebuvT4S6fjkj9
- TLSH T142646C2EE29914F5E537C278CA938A07E2B27465132196DF02D0C2793F5BFE8B539B50
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
10640
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wc_storage.pdb
msvcp_win
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_Syserror_map@std@@YAPEBDH@Z
_Cnd_unregister_at_thread_exit
_Cnd_register_at_thread_exit
_Cnd_wait
_Cnd_broadcast
_Cnd_signal
_Cnd_destroy_in_situ
_Cnd_init_in_situ
_Mtx_unlock
_Mtx_lock
?__ExceptionPtrRethrow@@YAXPEBX@Z
_Mtx_init_in_situ
?_Throw_Cpp_error@std@@YAXH@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGD@Z
?put@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@G@Z
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
??0task_continuation_context@Concurrency@@AEAA@XZ
_Mtx_destroy_in_situ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?good@ios_base@std@@QEBA_NXZ
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?uncaught_exception@std@@YA_NXZ
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_Xbad_function_call@std@@YAXXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__seh_filter_dll
_o__callnewh
memmove
_o__wcsicmp
_o__wcsnicmp
_o_abort
_o_calloc
_o_ceilf
_o_free
_o_malloc
_o_towlower
_o_wcscat_s
_o_wcsncat_s
_o_wcsncpy_s
_o_wcstol
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
__std_terminate
__CxxFrameHandler4
_o__aligned_malloc
_o__aligned_free
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_local_unwind
memcmp
memcpy
_o__register_onexit_function
api-ms-win-crt-string-l1-1-0
memset
wcsncmp
wcsnlen
wcscmp
ntdll
RtlNtStatusToDosError
NtCreateFile
RtlAllocateHeap
RtlDosPathNameToNtPathName_U_WithStatus
RtlFreeUnicodeString
NtSetInformationFile
NtClose
RtlFreeHeap
NtOpenFile
RtlDosPathNameToNtPathName_U
NtSetInformationThread
NtDelayExecution
NtQueryInformationFile
NtOpenThreadToken
NtQueryObject
RtlImpersonateSelf
NtAdjustPrivilegesToken
NtDeviceIoControlFile
NtFsControlFile
NtWaitForSingleObject
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlQueryRegistryValuesEx
NtQueryDirectoryFile
RtlUpcaseUnicodeChar
RtlRunOnceComplete
RtlRunOnceBeginInitialize
RtlFindNextForwardRunClear
RtlNumberOfSetBits
RtlInitializeSRWLock
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA
GetProcAddress
api-ms-win-core-synch-l1-1-0
CreateEventW
InitializeCriticalSectionEx
ResetEvent
SetEvent
CreateMutexExW
EnterCriticalSection
LeaveCriticalSection
CreateSemaphoreExW
ReleaseSemaphore
WaitForSingleObject
ReleaseMutex
InitializeCriticalSectionAndSpinCount
AcquireSRWLockShared
DeleteCriticalSection
WaitForSingleObjectEx
ReleaseSRWLockShared
OpenSemaphoreW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
GetLastError
api-ms-win-core-processthreads-l1-1-0
TlsGetValue
OpenProcessToken
GetCurrentThreadId
GetCurrentProcess
TlsFree
TerminateProcess
TlsAlloc
TlsSetValue
GetCurrentThread
OpenThreadToken
GetCurrentProcessId
SetThreadToken
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
CompareStringOrdinal
api-ms-win-core-file-l1-1-0
DeleteFileW
GetFileSize
ReadFile
SetFilePointer
WriteFile
SetFileAttributesW
FindFirstFileW
FindFirstFileExW
GetFileSizeEx
FindClose
FlushFileBuffers
FindNextFileW
CreateDirectoryW
GetFinalPathNameByHandleW
GetFileAttributesW
CreateFileW
SetFileInformationByHandle
GetTempFileNameW
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-sysinfo-l1-1-0
GetVersionExA
GetSystemWindowsDirectoryW
GetSystemTimeAsFileTime
rpcrt4
UuidCreate
api-ms-win-core-file-l1-2-3
GetTempPath2W
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventWriteTransfer
EventUnregister
EventRegister
EventActivityIdControl
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
CreateHardLinkW
api-ms-win-core-file-l2-1-2
CopyFileW
fltlib
FilterSendMessage
FilterConnectCommunicationPort
FilterDetach
api-ms-win-security-base-l1-1-0
GetSecurityDescriptorControl
InitializeSecurityDescriptor
IsValidSecurityDescriptor
SetSecurityDescriptorGroup
GetSecurityDescriptorLength
DestroyPrivateObjectSecurity
RevertToSelf
MakeSelfRelativeSD
GetAce
DuplicateToken
GetSecurityDescriptorDacl
GetSidSubAuthority
CreatePrivateObjectSecurityWithMultipleInheritance
IsValidSid
InitializeAcl
SetPrivateObjectSecurityEx
SetSecurityDescriptorOwner
GetSidLengthRequired
AllocateAndInitializeSid
FreeSid
GetLengthSid
InitializeSid
SetSecurityDescriptorDacl
AddAccessAllowedAce
api-ms-win-core-namedpipe-l1-1-0
CreatePipe
api-ms-win-core-kernel32-legacy-l1-1-0
BackupWrite
BackupRead
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-file-l1-2-0
GetVolumeNameForVolumeMountPointW
api-ms-win-security-provider-l1-1-0
GetNamedSecurityInfoW
SetSecurityInfo
SetEntriesInAclW
GetSecurityInfo
SetNamedSecurityInfoW
WcAttachFilterEx
WcCreateSandboxStubFiles
WcDestroyLayer
WcDetachFilterEx
WcExportLayerEx
WcImportLayerEx
WcInitializeSandbox
WcInitializeSandboxEx
Name
.text
Size
228KB
Virtual Size
225KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
PAGE
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
PAGECMRC
Size
4KB
Virtual Size
130B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
52KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
696B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=90, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=1442, id=1, productName=Unmarked objects,
count=9, id=257, version=33145,
count=29, id=261, version=33145,
count=8, id=259, version=33145,
count=1, id=256, version=33145,
count=67, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wci.dll
- IMPHASH 799985702965dc56b6cde11ae22233bc
- SHA256 81f399c50a74c3d9ef4307e483321645c3f25b9940ee2842f9c13032d8427317
- MD5 6057ab2ef6865ecf249bb43c93baaa62
- SHA1 97459c158cc885c99bf1ff531430e4deca014c02
- SHA512 23ac96106755a62b116e2cc29ed875a05beaa0c0c67fe0ff80e683178ab98012383e4cd69b0438037731a0e2f1b9958e08bb36abf3db564316b7bb6273644a02
- SSDEEP 768:zTzh8cQjPKAkpXfdYjciJr8SX1UEAiazR8z:LhpM6pXfdOJfuE1aziz
- TLSH T1F643194DA6E634A9D8728239D087051AF6B5B83537005AFF03D1C63C6E2ABD17139F81
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5056
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wci.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
memcpy
_o_calloc
_o_free
_o_malloc
_o_wcsncat_s
_o_wcsncpy_s
__C_specific_handler
_o___stdio_common_vfprintf
_o___std_type_info_destroy_list
_o___acrt_iob_func
_local_unwind
api-ms-win-crt-string-l1-1-0
wcsncmp
memset
fltlib
FilterDetach
FilterConnectCommunicationPort
FilterSendMessage
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-file-l1-1-0
SetFileAttributesW
SetFileInformationByHandle
CreateFileW
GetFileAttributesW
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
api-ms-win-core-handle-l1-1-0
CloseHandle
ntdll
RtlNtStatusToDosError
RtlDosPathNameToNtPathName_U
NtDelayExecution
NtQueryInformationFile
RtlFreeHeap
NtQueryObject
RtlImpersonateSelf
NtAdjustPrivilegesToken
NtDeviceIoControlFile
NtFsControlFile
NtWaitForSingleObject
NtCreateFile
NtOpenThreadToken
RtlAllocateHeap
NtClose
NtSetInformationThread
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
OpenProcessToken
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-file-l1-2-0
GetVolumeNameForVolumeMountPointW
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
api-ms-win-security-base-l1-1-0
AllocateAndInitializeSid
FreeSid
api-ms-win-security-provider-l1-1-0
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetEntriesInAclW
api-ms-win-core-heap-l2-1-0
LocalFree
WcAttachFilter
WcDetachFilter
WcRemoveReparseData
WcRemoveTombstoneReparseData
WciConfigureFilter
WciConfigureVolume
WciGenerateFilterConfiguration
WciGetUnions
WciReadReparsePointData
WciRemoveRoot
WciSetReparsePointData
WciSetReparsePointDataEx
WciSetTombstone
WciSetupFilter
Name
.text
Size
20KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
948B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
992B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
136B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=49, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1137, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=4, id=259, version=33145,
count=13, id=261, version=33145,
count=1, id=256, version=33145,
count=9, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wcimage.dll
- IMPHASH 6c20c30a5a30964aefb93f52f4a3497f
- SHA256 680f808f6ac13b513f7ee7ba0b8ed2bb8e43de11f147c9f7dcbb09b80d6c13db
- MD5 a245d42ad5a076b2302e4184a747db80
- SHA1 c530b7156fe1fbb0e1862ca683fad89c65bde10c
- SHA512 50c1dd8be21efd5a2da4774a5de7e84ac9a3b6e305e3080ea8432902c213ad2a5865e7661c9f6ae988387c67d9e4f55a52aa7c34ba9919a172f48c7ff27ec61d
- SSDEEP 3072:/pTAjuK9ypNMeL3J/75i4EcLuSo++T0+buMFrXOgS:+juK4pH3MmuSJYfHOg
- TLSH T177F35B0A77A660B5D57AC378C5960617F7B3B02223106BCF07F4C9782B67AE87539B81
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5488
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wcimage.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
memmove
_o__wcsicmp
_o__wcsnicmp
_o_calloc
_o_free
_o_malloc
_o_wcscat_s
_o_wcsncat_s
_o_wcsncpy_s
_o_wcstok_s
__C_specific_handler
_o__aligned_malloc
_o__aligned_free
_o__configure_narrow_argv
_o___std_type_info_destroy_list
_o__cexit
wcsrchr
_local_unwind
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
wcsnlen
wcsncmp
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventRegister
EventUnregister
EventWriteTransfer
api-ms-win-core-registry-l1-1-0
RegQueryInfoKeyW
RegGetKeySecurity
RegEnumValueW
RegCloseKey
api-ms-win-core-registry-l2-1-0
RegOpenKeyW
RegEnumKeyW
ntdll
RtlNtStatusToDosError
RtlAdjustPrivilege
NtWaitForSingleObject
RtlFreeUnicodeString
RtlFreeHeap
NtFsControlFile
NtDeviceIoControlFile
NtQueryObject
NtOpenThreadToken
NtQueryInformationFile
NtDelayExecution
NtSetInformationThread
RtlDosPathNameToNtPathName_U
NtAdjustPrivilegesToken
NtCreateFile
RtlFindNextForwardRunClear
RtlNumberOfSetBits
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
RtlAllocateHeap
NtClose
RtlUpcaseUnicodeChar
NtOpenFile
RtlRunOnceBeginInitialize
RtlImpersonateSelf
RtlInitializeSRWLock
RtlDosPathNameToNtPathName_U_WithStatus
NtSetInformationFile
RtlRunOnceComplete
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-sysinfo-l1-1-0
GetVersionExW
GetTickCount64
GetSystemWindowsDirectoryW
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetSystemInfo
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetLastError
GetLastError
SetUnhandledExceptionFilter
api-ms-win-core-file-l1-1-0
FindFirstFileExW
FindClose
SetFileInformationByHandle
CreateFileW
CreateDirectoryW
FlushFileBuffers
FindNextFileW
RemoveDirectoryW
GetFileAttributesW
GetFileSizeEx
ReadFile
WriteFile
GetFinalPathNameByHandleW
SetFileAttributesW
DeleteFileW
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObjectEx
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
api-ms-win-core-file-l2-1-0
CreateHardLinkW
GetFileInformationByHandleEx
api-ms-win-security-provider-l1-1-0
SetNamedSecurityInfoW
SetEntriesInAclW
GetNamedSecurityInfoW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-heap-l2-1-0
LocalFree
fltlib
FilterSendMessage
FilterConnectCommunicationPort
FilterDetach
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-threadpool-legacy-l1-1-0
QueueUserWorkItem
api-ms-win-core-synch-l1-2-0
WakeAllConditionVariable
SleepConditionVariableSRW
InitializeConditionVariable
WakeConditionVariable
Sleep
api-ms-win-core-com-l1-1-0
CoTaskMemFree
api-ms-win-core-path-l1-1-0
PathCchAddBackslash
api-ms-win-core-kernel32-legacy-l1-1-1
SetVolumeMountPointW
api-ms-win-shcore-stream-l1-1-0
SHCreateStreamOnFileW
xmllite
CreateXmlReader
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
CreateThread
TlsGetValue
TlsAlloc
GetCurrentProcessId
TlsSetValue
TerminateProcess
GetCurrentThreadId
TlsFree
OpenProcessToken
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetProcAddress
virtdisk
AttachVirtualDisk
OpenVirtualDisk
GetVirtualDiskPhysicalPath
CreateVirtualDisk
DetachVirtualDisk
wimgapi
WIMCloseHandle
WIMSetTemporaryPath
WIMApplyImage
WIMCreateFile
WIMLoadImage
drvstore
DriverStoreClose
DriverStoreOpenW
DriverStoreEnumObjectsW
api-ms-win-security-base-l1-1-0
RevertToSelf
CreatePrivateObjectSecurityWithMultipleInheritance
SetPrivateObjectSecurityEx
AllocateAndInitializeSid
FreeSid
GetSecurityDescriptorLength
IsValidSecurityDescriptor
DestroyPrivateObjectSecurity
MakeSelfRelativeSD
GetSecurityDescriptorControl
api-ms-win-core-file-l1-2-0
GetVolumeNameForVolumeMountPointW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
WcCompressFile
WcCompressFileAsync
WcConvertToReparsePoint
WcCreateContainerImageFromPortableBaseLayer
WcCreateContainerImageFromWim
WcCreateContainerImageFromWimEx
WcDismountVirtualDisk
WcDismountVirtualDiskFromHandle
WcEnsurePathExists
WcExpandContainerWim
WcMountVirtualDisk
WcProcessContainerLayer
WcSetVirtualDiskAttributes
WcWaitForPendingFileCompressionOperations
Name
.text
Size
92KB
Virtual Size
91KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
PAGE
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
PAGECMRC
Size
4KB
Virtual Size
130B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=257, version=33145,
count=75, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1260, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=6, id=259, version=33145,
count=13, id=261, version=33145,
count=1, id=256, version=33145,
count=63, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wcmapi.dll
- IMPHASH 023554662c6bbcc8178cf729a20fcb10
- SHA256 33b6d9248d6b0b1baa8afd8717043a9698193c3e338c7e4b0f6cfc54867205fd
- MD5 d481ee1cc783d7816cb7e116296ea5eb
- SHA1 13aed2f4138c785d50831756acc748d60aff1304
- SHA512 8d3b912b203c83a6b041d2573d40eb3b5096b3244493145b1d46d5b0b3f39f759d66ba73ed1871fefa685b11bc4da35935295988fe8988c8d46f470285b31b53
- SSDEEP 3072:Wa1k4Wifi9n5cyZ5EVUvAO08EM46DVL08uUbUCoe8S24gtIIU9:zawfi9n5cyUVWbpgtIIU
- TLSH T146044B2AF69910BAD47AD27DC5C30A16F7B178245B1383CB016083795F63BE46E3DB52
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
27888
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wcmapi.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o_malloc
_o_terminate
__CxxFrameHandler3
__current_exception
__current_exception_context
_CxxThrowException
_o__configure_narrow_argv
_o___stdio_common_vswprintf
_o__cexit
_o__callnewh
__C_specific_handler
__std_terminate
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
GetModuleHandleW
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleExW
GetModuleFileNameA
GetModuleHandleExA
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-eventing-classicprovider-l1-1-0
RegisterTraceGuidsW
TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
UnregisterTraceGuids
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventRegister
EventUnregister
EventWriteTransfer
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-errorhandling-l1-1-0
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-synch-l1-1-0
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
OpenSemaphoreW
ReleaseMutex
CreateMutexExW
ReleaseSRWLockExclusive
WaitForSingleObjectEx
CreateEventW
InitializeCriticalSection
AcquireSRWLockExclusive
InitializeCriticalSectionEx
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ReleaseSRWLockShared
AcquireSRWLockShared
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
InitOnceExecuteOnce
rpcrt4
RpcBindingSetOption
RpcStringBindingComposeW
RpcBindingFree
RpcStringFreeW
RpcAsyncCancelCall
Ndr64AsyncClientCall
NdrClientCall3
RpcAsyncCompleteCall
RpcAsyncInitializeHandle
RpcSsDestroyClientContext
RpcExceptionFilter
I_RpcBindingInqLocalClientPID
UuidCreate
UuidToStringW
UuidFromStringW
RpcBindingFromStringBindingW
api-ms-win-service-private-l1-1-0
I_QueryTagInformation
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-psapi-l1-1-0
K32GetModuleFileNameExW
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CLSIDFromString
CoTaskMemFree
ntdll
RtlPublishWnfStateData
RtlReportException
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegCloseKey
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
WcmAddAppBasedRoutePolicy
WcmAddRoutePolicy
WcmCancelOnDemandRequest
WcmCheckCapabilityStatus
WcmCloseHandle
WcmCloseOnDemandRequestHandle
WcmDeleteAppBasedRoutePolicy
WcmDeleteProxyInformation
WcmDeprovisionCapability
WcmEnumInterfaces
WcmFreeMemory
WcmGetInterfaceContextTable
WcmGetProfileList
WcmGetProfileListByPurpose
WcmGetRoutingHint
WcmOpenHandle
WcmOpenOnDemandRequestHandle
WcmOpenOnDemandRequestHandleByWwanProfileName
WcmOrderConnection
WcmQueryOnDemandRequestStateInfo
WcmQueryParameter
WcmQueryProperty
WcmRemoveMatchingRoutePolicy
WcmRemoveRoutePolicy
WcmSetParameter
WcmSetProfileList
WcmSetProperty
WcmSetProxyInformation
WcmStartOnDemandRequest
WcmUpdateCapabilityAccess
Name
.text
Size
108KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=63, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=1186, id=1, productName=Unmarked objects,
count=2, id=257, version=33145,
count=24, id=261, version=33145,
count=1, id=256, version=33145,
count=1, id=253, version=33145,
count=29, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wcmcsp.dll
- IMPHASH 1aa9164c1b95ebca121bbce59f452ff0
- SHA256 c9b057b2453b3498ca17497d7d0427baab38f440ebefafaa3fed8371a9369315
- MD5 e636eafbfe3fcce33698136b686676bf
- SHA1 55cb3e0864c843d789b1b8a02263b71f5cc05994
- SHA512 8c1c9a238a52ca0ed1e68b1fb0693d08f7567489918c181e560ab3d55ef69f91bd42f62d4ad22b001dcec547db7bd82c955fe56f19a29f44ad6eb47a6181cf57
- SSDEEP 3072:sNeNKcgViHNzvdXgMqMX6nflys/sjnlkUwpGJH1GlOdIV8LfSnVmY8VxSLteJT91:sVVithQvVlyDLwpwH1TIV8LfS7JLtoT
- TLSH T184443C2DA3A91CA5E87BD27C89834645EAB2382A1B32D7CF02B041391F17FF45A3D755
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
9008
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wcmcsp.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o_ceilf
_o_free
_o_malloc
__C_specific_handler
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_CxxThrowException
_o__cexit
__std_terminate
__CxxFrameHandler4
memcmp
_o__callnewh
memcpy
api-ms-win-crt-string-l1-1-0
wcscmp
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExA
GetModuleHandleW
GetProcAddress
GetModuleFileNameA
FreeLibrary
GetModuleHandleExW
LoadLibraryExW
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThread
GetCurrentProcess
GetCurrentThreadId
GetThreadId
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
ntdll
EtwTraceMessage
EtwGetTraceEnableFlags
EtwEventUnregister
EtwRegisterTraceGuidsW
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwEventRegister
EtwUnregisterTraceGuids
NtQueryWnfStateData
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-synch-l1-1-0
InitializeSRWLock
OpenSemaphoreW
ReleaseSemaphore
WaitForSingleObject
TryAcquireSRWLockExclusive
CreateMutexExW
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
CreateEventExW
SetEvent
ResetEvent
ReleaseMutex
CreateSemaphoreExW
WaitForSingleObjectEx
EnterCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
LeaveCriticalSection
CreateEventW
ReleaseSRWLockExclusive
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount64
GetTickCount
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventRegister
EventWriteTransfer
EventUnregister
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolWorkCallbacks
SubmitThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
CloseThreadpool
WaitForThreadpoolTimerCallbacks
SetThreadpoolThreadMaximum
SetThreadpoolThreadMinimum
CreateThreadpool
CreateThreadpoolWork
CloseThreadpoolWork
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
api-ms-win-security-base-l1-1-0
GetLengthSid
FreeSid
api-ms-win-core-threadpool-legacy-l1-1-0
QueueUserWorkItem
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
EthernetCspDeInit
EthernetCspInit
WlanCspDeInit
WlanCspInit
WwanCspDeInit
WwanCspInit
Name
.text
Size
192KB
Virtual Size
191KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
336B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
704B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=59, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33145,
count=5, id=259, version=33145,
count=21, id=261, version=33145,
count=1211, id=1, productName=Unmarked objects,
count=2, id=257, version=33145,
count=1, id=256, version=33145,
count=20, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wcmsvc.dll
- IMPHASH 5a11ac9618a6fce93b5375e764c7cd6d
- SHA256 2d61a1cb79ade243988f07c92cf9a764f032c2a4dedf7797a4cdd67593cfc368
- MD5 9b454c2a5da6d2d46240f37f3b88584d
- SHA1 a1851113a24383eb9e4c93640d8424e5498c3dd0
- SHA512 5075e80795d4ad048b731232fb7746b059b96d5c2ad6dc2d853efd26d5859d8bdbe4effc2288d0da5eabf7b8d5ff91d92b68a49901849b9a5c568a0932801ae9
- SSDEEP 24576:RPkm3b+3JblklxclGTlTo67N3nUR8/UyDWZy:9kYCJboxCcls6ZUR8Myu
- TLSH T1EF556C1E96AD00D5D0BED27DC6434A0AEAB2382A077287DF0578827D1F27FE4563EB15
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
469536
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wcmsvc.pdb
msvcp_win
_Wcsxfrm
_Wcscoll
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?tolower@?$ctype@G@std@@QEBAGG@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG0@Z
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?id@?$collate@G@std@@2V0locale@2@A
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
??Bid@locale@std@@QEAA_KXZ
?id@?$ctype@G@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0facet@locale@std@@IEAA@_K@Z
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
??1facet@locale@std@@MEAA@XZ
??0_Lockit@std@@QEAA@H@Z
??0_Locinfo@std@@QEAA@PEBD@Z
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGXZ
?width@ios_base@std@@QEAA_J_J@Z
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??1_Lockit@std@@QEAA@XZ
??1_Locinfo@std@@QEAA@XZ
?is@?$ctype@G@std@@QEBA_NFG@Z
?_Xbad_alloc@std@@YAXXZ
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Incref@facet@locale@std@@UEAAXXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Xbad_function_call@std@@YAXXZ
_Query_perf_frequency
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
_Query_perf_counter
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?width@ios_base@std@@QEBA_JXZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?uncaught_exceptions@std@@YAHXZ
?good@ios_base@std@@QEBA_NXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?flags@ios_base@std@@QEBAHXZ
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__itow_s
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsicmp
memmove
_o__wtoi
_o__wtol
_o_abort
_o_calloc
_o_ceilf
_o_free
_o_iswspace
_o_malloc
_o_realloc
_o_strcpy_s
_o_terminate
_o_wcscpy_s
__CxxFrameHandler3
__current_exception
__current_exception_context
_CxxThrowException
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o__execute_onexit_table
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__errno
__C_specific_handler
__std_type_info_compare
__std_terminate
__CxxFrameHandler4
_o__wcsnicmp
memchr
memcmp
memcpy
strchr
api-ms-win-crt-string-l1-1-0
wcscmp
memset
api-ms-win-core-libraryloader-l1-2-0
FindStringOrdinal
GetProcAddress
GetModuleHandleExA
LoadLibraryExW
FreeLibrary
LoadStringW
GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExW
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
CreateMutexExW
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionEx
OpenSemaphoreW
WaitForSingleObjectEx
SetEvent
ReleaseSRWLockShared
ReleaseSRWLockExclusive
ReleaseMutex
InitializeSRWLock
WaitForSingleObject
AcquireSRWLockExclusive
ReleaseSemaphore
AcquireSRWLockShared
CreateEventExW
CreateSemaphoreExW
InitializeCriticalSection
TryEnterCriticalSection
CreateEventW
ResetEvent
TryAcquireSRWLockExclusive
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
api-ms-win-core-processthreads-l1-1-0
OpenThreadToken
GetCurrentProcess
GetPriorityClass
GetCurrentThread
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetThreadId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringOrdinal
MultiByteToWideChar
ntdll
NtDeleteWnfStateName
EtwEventWriteTransfer
EtwTraceMessage
RtlReportException
RtlIpv4StringToAddressExW
RtlIpv6StringToAddressExW
EtwEventUnregister
NtCreateWnfStateName
RtlQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion
EtwEventSetInformation
EtwEventRegister
NtPowerInformation
RtlNtStatusToDosError
NtQueryWnfStateData
RtlQueryPackageIdentity
RtlIsStateSeparationEnabled
RtlGetDeviceFamilyInfoEnum
RtlInitUnicodeString
EtwEventWrite
RtlUnsubscribeWnfStateChangeNotification
RtlSubscribeWnfStateChangeNotification
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
RtlPublishWnfStateData
api-ms-win-core-threadpool-legacy-l1-1-0
ChangeTimerQueueTimer
DeleteTimerQueueEx
CreateTimerQueue
CreateTimerQueueTimer
DeleteTimerQueueTimer
UnregisterWaitEx
api-ms-win-core-sysinfo-l1-1-0
GetTickCount64
GetTickCount
GetSystemTimeAsFileTime
GetSystemInfo
GetVersionExW
GetSystemTime
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-com-l1-1-0
CoIncrementMTAUsage
CoWaitForMultipleHandles
CoCreateFreeThreadedMarshaler
CoDecrementMTAUsage
CLSIDFromString
CoInitializeEx
CoCreateInstance
PropVariantClear
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CoSetProxyBlanket
StringFromGUID2
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolWait
CreateThreadpoolWait
WaitForThreadpoolWaitCallbacks
SetThreadpoolTimerEx
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks
CreateThreadpoolWork
IsThreadpoolTimerSet
CloseThreadpoolWait
CloseThreadpool
DisassociateCurrentThreadFromCallback
StartThreadpoolIo
CloseThreadpoolIo
WaitForThreadpoolIoCallbacks
CreateThreadpoolIo
CloseThreadpoolTimer
CancelThreadpoolIo
SetThreadpoolThreadMaximum
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
SubmitThreadpoolWork
CreateThreadpool
SetThreadpoolThreadMinimum
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
InitOnceExecuteOnce
Sleep
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-io-l1-1-0
GetOverlappedResult
DeviceIoControl
api-ms-win-core-file-l1-1-0
FileTimeToLocalFileTime
CreateFileW
api-ms-win-rtcore-ntuser-powermanagement-l1-1-0
UnregisterPowerSettingNotification
api-ms-win-security-base-l1-1-0
RevertToSelf
ImpersonateSelf
FreeSid
CreateWellKnownSid
IsValidSid
GetTokenInformation
CheckTokenMembership
GetLengthSid
CopySid
api-ms-win-core-processthreads-l1-1-1
OpenProcess
IsProcessorFeaturePresent
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
K32GetProcessImageFileNameW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
SystemTimeToFileTime
api-ms-win-core-sysinfo-l1-2-0
GetOsSafeBootMode
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-interlocked-l1-1-0
InterlockedPushEntrySList
InitializeSListHead
combase
ord154
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventUnregister
EventRegister
EventSetInformation
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegGetValueW
RegSetValueExW
RegCreateKeyExW
RegNotifyChangeKeyValue
RegQueryValueExW
RegEnumKeyExW
RegOpenKeyExW
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
api-ms-win-core-state-helpers-l1-1-0
GetRegistryValueWithFallbackW
api-ms-win-security-grouppolicy-l1-1-0
UnregisterGPNotificationInternal
RegisterGPNotificationInternal
api-ms-win-core-winrt-l1-1-0
RoInitialize
RoUninitialize
RoActivateInstance
RoGetActivationFactory
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
api-ms-win-core-registry-l1-1-1
RegDeleteKeyValueW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
CdeGetProfileList
CdeQueryParameter
CdeSetParameter
SvchostPushServiceGlobals
WcmSvcMain
Name
.text
Size
996KB
Virtual Size
992KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
252KB
Virtual Size
250KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
52KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
28KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=90, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=14, id=260, version=33145,
count=1493, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=35, id=261, version=33145,
count=7, id=259, version=33145,
count=1, id=256, version=33145,
count=1, id=253, version=33145,
count=85, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wcncsvc.dll
- IMPHASH 28fa76f13d13945f007ef8581188b750
- SHA256 0a814cc075797f3ba4b5f8ca7488c2fc1b251c724571a16f94d42fa236d068b9
- MD5 39fafd200d6bb702857292bf3dca25ad
- SHA1 8b05f49fd0977f4972c56d9f3301b2efb49a1624
- SHA512 cc120caa2c0e7c93c136b031d57cafd5ecd3f80620a5a0274736a49681f98a76df74f7950186f5f3de97f10b2aaaa73af4d9086540c34c4ca9a34012b97bccf9
- SSDEEP 6144:BDqN1BUjsJYl0iGfChZgAd+ZQd+nY3aCZ5pt/oBclBc0Rs+5o3b/N4euTv4X/zRd:U0sJ3hfOAeNoBclewa3blevQz
- TLSH T1E4A4291C63AC0026E86AE238C5534F4BF7B2B46D47219AC756A4D17D5F03EEA1F76B02
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5776
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wcncsvc.pdb
msvcrt
vswprintf_s
wcsncmp
sscanf_s
_vsnwprintf
__RTDynamicCast
memcmp
memset
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
memmove
memcpy
__CxxFrameHandler3
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_callnewh
malloc
free
??_V@YAXPEAX@Z
__C_specific_handler
_purecall
??3@YAXPEAX@Z
swprintf_s
__CxxFrameHandler4
wcscmp
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
SetEvent
EnterCriticalSection
AcquireSRWLockShared
InitializeCriticalSection
ReleaseSRWLockShared
DeleteCriticalSection
WaitForSingleObject
WaitForSingleObjectEx
WaitForMultipleObjectsEx
ResetEvent
CreateEventW
AcquireSRWLockExclusive
InitializeSRWLock
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
api-ms-win-core-synch-l1-2-0
SleepConditionVariableSRW
WakeAllConditionVariable
Sleep
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
RaiseException
SetLastError
UnhandledExceptionFilter
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-threadpool-legacy-l1-1-0
UnregisterWaitEx
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
CompareStringOrdinal
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThread
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
OpenThreadToken
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetComputerNameExW
GetVersionExW
GetTickCount
GetTickCount64
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
ntdll
EtwGetTraceEnableFlags
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwEventWriteTransfer
RtlInitUnicodeString
EtwUnregisterTraceGuids
RtlNtStatusToDosError
NtOpenFile
EtwRegisterTraceGuidsW
EtwEventRegister
EtwEventUnregister
EtwTraceMessage
devobj
DevObjGetClassDevs
DevObjGetDeviceInterfaceDetail
DevObjGetDeviceInterfaceProperty
DevObjEnumDeviceInterfaces
DevObjCreateDeviceInfoList
bcrypt
BCryptSecretAgreement
BCryptCreateHash
BCryptHashData
BCryptDestroySecret
BCryptDestroyHash
BCryptDeriveKey
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptGenRandom
BCryptOpenAlgorithmProvider
BCryptGenerateSymmetricKey
BCryptDecrypt
BCryptGetProperty
BCryptEncrypt
BCryptSetProperty
BCryptImportKeyPair
BCryptExportKey
BCryptGenerateKeyPair
BCryptFinalizeKeyPair
BCryptDestroyKey
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolCleanupGroup
CloseThreadpoolWork
CreateThreadpoolTimer
CreateThreadpoolWork
CloseThreadpoolTimer
WaitForThreadpoolWorkCallbacks
SubmitThreadpoolWork
CreateThreadpoolCleanupGroup
rpcrt4
RpcServerUnregisterIfEx
RpcEpUnregister
RpcServerRegisterAuthInfoW
RpcFreeAuthorizationContext
RpcServerUseProtseqEpW
RpcBindingVectorFree
RpcBindingToStringBindingW
RpcAsyncAbortCall
UuidCreate
RpcGetAuthorizationContextForClient
RpcStringFreeW
RpcStringBindingParseW
RpcServerRegisterIfEx
NdrServerCall2
Ndr64AsyncServerCallAll
NdrServerCallAll
NdrAsyncServerCall
RpcServerUnsubscribeForNotification
RpcServerSubscribeForNotification
RpcAsyncCompleteCall
RpcServerInqBindings
RpcImpersonateClient
RpcServerInqDefaultPrincNameW
RpcRevertToSelf
RpcEpRegisterW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
SvchostPushServiceGlobals
WcnServiceMain
Name
.text
Size
332KB
Virtual Size
331KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
96KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
400B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=60, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=4, id=259, version=33145,
count=243, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=18, id=261, version=33145,
count=18, id=260, version=33145,
count=1, id=256, version=33145,
count=78, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wcnwiz.dll
- IMPHASH a4f10700acf3ef16f60b157b74f0eb4e
- SHA256 37c8c40f3cad680a6e526a74946efe83127e656faec0af91572f9d5041890ef2
- MD5 53f3e50e26e0297be08f2dfd26206efe
- SHA1 e7dc2292904912304a5ca59a847a5c6fdf42b4da
- SHA512 1ac122a1873a55d45a3017743c0e8e09772b44032da7402b073ae23b947d8871816446b264ce14948fe772760de2165083aafa64ef26023d0d8468990165744c
- SSDEEP 3072:LLJIhGD8uJof6QDxKFUAe5WcjdDwQFfQfYSo359Qia9MTT2t9cpTZIv5wW9IoRP:3apUF9e5pjdDwQFUYSIJTVTZQwq
- TLSH T17A74081EB3680C95D96A813CC4438E4DE3B3F4359711A7CB25A082BE6E13BD91E7AF15
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5920
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wcnwiz.pdb
api-ms-win-crt-string-l1-1-0
wcscmp
memset
wcsncmp
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsdup
memmove
_o__wtol
_o_free
_o_malloc
_o_pow
_o_rand_s
_o_wcscat_s
_o_wmemcpy_s
_CxxThrowException
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__execute_onexit_table
_o__errno
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
__CxxFrameHandler3
__C_specific_handler_noexcept
__std_terminate
__C_specific_handler
__CxxFrameHandler4
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
__RTDynamicCast
memcmp
memcpy
oleaut32
SysAllocString
BSTR_UserMarshal64
BSTR_UserSize64
BSTR_UserFree64
BSTR_UserMarshal
BSTR_UserUnmarshal
BSTR_UserUnmarshal64
BSTR_UserFree
BSTR_UserSize
SysFreeString
api-ms-win-core-libraryloader-l1-2-0
SizeofResource
LoadLibraryExW
DisableThreadLibraryCalls
FreeLibrary
FindResourceExW
LoadResource
GetProcAddress
GetModuleHandleExW
LoadStringW
GetModuleHandleW
GetModuleFileNameW
LoadLibraryExA
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-synch-l1-1-0
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
api-ms-win-core-com-l1-1-0
IIDFromString
CoTaskMemAlloc
StringFromGUID2
CoTaskMemFree
CreateStreamOnHGlobal
CoInitializeEx
CoCreateInstance
CoWaitForMultipleHandles
CoUninitialize
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
IsDebuggerPresent
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegOpenKeyExW
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount64
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
rpcrt4
NdrDllCanUnloadNow
NdrOleAllocate
NdrDllGetClassObject
NdrOleFree
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapReAlloc
HeapFree
HeapAlloc
HeapSize
HeapDestroy
api-ms-win-core-memory-l1-1-0
VirtualAlloc
VirtualFree
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-processthreads-l1-1-1
FlushInstructionCache
IsProcessorFeaturePresent
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedPushEntrySList
InterlockedPopEntrySList
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
ntdll
EtwRegisterTraceGuidsW
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwTraceMessage
EtwGetTraceEnableFlags
EtwUnregisterTraceGuids
EtwEventUnregister
EtwEventRegister
EtwEventWriteTransfer
WinSqmSetDWORD
kernel32
CreateSemaphoreExW
ReleaseSemaphore
ReleaseMutex
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
DebugBreak
InitializeCriticalSectionEx
WaitForThreadpoolTimerCallbacks
MulDiv
CreateActCtxW
ActivateActCtx
FindActCtxSectionStringW
DeactivateActCtx
QueryActCtxW
CloseThreadpoolTimer
FormatMessageW
LockResource
LocalFree
GetComputerNameW
lstrcmpW
RegGetValueW
GlobalFree
RegQueryValueExW
CreateFileW
CloseHandle
FindResourceW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WaitForMultipleObjects
SetThreadpoolTimer
CreateEventW
SetEvent
CreateThread
WaitForSingleObject
ResetEvent
GetModuleHandleExA
GetSystemDirectoryW
GetFileSizeEx
ReadFile
GlobalAlloc
WriteFile
AcquireSRWLockShared
CreateThreadpoolTimer
ReleaseSRWLockShared
GetModuleFileNameA
user32
EnableWindow
ReleaseDC
SetWindowTextW
SetWindowPos
GetDC
GetWindowRect
GetWindowTextLengthW
SystemParametersInfoW
IsWindowVisible
GetWindowTextW
ShowWindow
SetDlgItemTextW
LoadImageW
UnregisterClassA
PostMessageW
GetPropW
SetWindowLongPtrW
SendMessageW
RemovePropW
SetPropW
GetDlgItem
KillTimer
GetParent
DestroyIcon
GetWindowLongPtrW
EndPaint
BeginPaint
InvalidateRect
SetRect
IntersectRect
DrawFocusRect
GetSystemMetrics
SetFocus
TrackMouseEvent
GetClientRect
GetAncestor
InflateRect
SetTimer
PostThreadMessageW
wlanapi
WFDGetProfileKeyInfoInt
WFDParseProfileXmlInt
WFDGetDefaultGroupProfileInt
WlanUtf8SsidToDisplayName
WlanStringToSsid
AcmGenerateConnectionIdForNotification
ConvertPassPhraseKeyStringToBuffer
WlanFreeMemory
WlanCloseHandle
WlanHostedNetworkQueryStatus
WlanOpenHandle
WlanGetProfile
WlanHostedNetworkQueryProperty
WFDFreeMemoryInt
AcmGenerateNetworkId
WFDLowPrivIsWfdSupportedInt
WlanInternalScan
WlanQueryInterface
WlanGetProfileList
WlanSetProfile
WlanEnumInterfaces
WlanGetAvailableNetworkList
WlanRegisterNotification
WlanGetNetworkBssList
WlanScan
WlanGenerateProfileXmlBasicSettings
WlanParseProfileXmlBasicSettings
dui70
?SetContentString@Element@DirectUI@@QEAAJPEBG@Z
?GetID@Element@DirectUI@@QEAAGXZ
DuiCreateObject
?GetClassInfoPtr@HWNDElement@DirectUI@@SAPEAUIClassInfo@2@XZ
?GetEncodedContentString@Element@DirectUI@@QEAAJPEAG_K@Z
StrToID
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z
?KeyWithinProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?ContentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?GetRoot@Element@DirectUI@@QEAAPEAV12@XZ
?RemoveLocalValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZ@Z
?SetValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@@Z
?GetContentString@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z
?Release@Value@DirectUI@@QEAAXXZ
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUHICON__@@_N11@Z
?SetMaxLength@TouchEditBase@DirectUI@@QEAAJH@Z
?SetClass@Element@DirectUI@@QEAAJPEBG@Z
?SetEnabled@Element@DirectUI@@QEAAJ_N@Z
?GetBool@Value@DirectUI@@QEAA_NXZ
?Click@TouchButton@DirectUI@@SA?AVUID@@XZ
?HasContent@Element@DirectUI@@QEAA_NXZ
?SetVisible@Element@DirectUI@@QEAAJ_N@Z
?SetLayoutPos@Element@DirectUI@@QEAAJH@Z
?UserTextChanged@TouchEditBase@DirectUI@@SA?AVUID@@XZ
?SetPasswordCharacter@TouchEditBase@DirectUI@@QEAAJH@Z
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
crypt32
CryptProtectData
CryptUnprotectData
shell32
SHGetKnownFolderPath
gdi32
CreateFontW
CreateFontIndirectW
StartPage
EndDoc
GetDeviceCaps
GetTextMetricsW
DeleteDC
TextOutW
SetBkColor
CreateSolidBrush
DeleteObject
GetObjectW
GetTextExtentPoint32W
SelectObject
StartDocW
CreateDIBSection
EndPage
ole32
CoGetObject
uxtheme
ord121
ord120
GetThemeMetric
IsAppThemed
DrawThemeParentBackground
CloseThemeData
DrawThemeBackground
OpenThemeData
SetWindowTheme
xmllite
CreateXmlReader
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
windowscodecs
WICCreateImagingFactory_Proxy
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
196KB
Virtual Size
195KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
88KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=61, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=19, id=260, version=33145,
count=5, id=259, version=33145,
count=1390, id=1, productName=Unmarked objects,
count=24, id=257, version=33145,
count=35, id=261, version=33145,
count=1, id=256, version=33145,
count=61, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wdc.dll
- IMPHASH a0505b03b0694d570b00fedd48a6c8d7
- SHA256 b99f104c37f88e50bcddfc68be7b1ae1180e4d5c6d19cb55c53c2644ca1a2ad1
- MD5 f42115085bae6f27c816a29cbe80c73a
- SHA1 4f23d0b38db0e1bf2e705aa58958139776f7d648
- SHA512 d266c103e93f7e0d3f29c4e1b20504b2df627e771a0b9d71f5b009372ab6fcbe3c4ae6155b3199ec37d1106233a6abe7802cd83eb64910a4e2b04d2b6994c0a8
- SSDEEP 12288:6HG6EfVcTcXfksikBbYgsODTBFabjvoBMmQ4s4hDqtzdT+hD:6m6EfV+cXcaKPaTBgjwBK4s4hEzx+
- TLSH T13B05291D67FC00A6D57B8238C95B466AFAB17031376595DB2690C23C9F3BBD05A3AF20
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
146320
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wdc.pdb
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsicmp
_o__wcsnicmp
_o__wtoi
memmove
_o_abort
_o_ceil
_o_ceilf
_o_floor
_o_free
_o_iswdigit
_o_iswspace
_o_malloc
_o_mbstowcs
_o_pow
_o_towlower
_o_wcscat_s
_o_wcstok
_o_wcstombs
_o_wcstoul
__CxxFrameHandler4
__std_terminate
wcschr
_CxxThrowException
__CxxFrameHandler3
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
wcsstr
wcsrchr
__C_specific_handler
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
wcscmp
duser
ForwardGadgetMessage
gdi32
Polygon
SetROP2
LineTo
CreateSolidBrush
CreateCompatibleBitmap
CreateCompatibleDC
Polyline
MoveToEx
BitBlt
CreatePen
EndDoc
EndPage
CreateDIBSection
StartPage
StartDocW
GetDeviceCaps
DeleteObject
SelectObject
GetStockObject
CreateFontIndirectW
advapi32
ConvertSecurityDescriptorToStringSecurityDescriptorW
ProcessTrace
EnableTraceEx
StartTraceW
OpenTraceW
StopTraceW
QueryTraceW
I_QueryTagInformation
IsValidSid
QueryServiceConfigW
EnumServicesStatusExW
ControlService
StartServiceW
CloseServiceHandle
QueryServiceStatus
OpenServiceW
OpenSCManagerW
RegisterWaitChainCOMCallback
GetThreadWaitChain
OpenThreadWaitChainSession
EventRegister
EventUnregister
RegOpenKeyExW
RegEnumValueW
RegQueryValueExW
RegCloseKey
RegGetValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
MakeAbsoluteSD
GetSecurityDescriptorGroup
SetSecurityDescriptorGroup
GetSecurityDescriptorOwner
SetSecurityDescriptorOwner
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CloseTrace
MapGenericMask
EventWriteTransfer
CreateWellKnownSid
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
OpenProcessToken
AdjustTokenPrivileges
CloseThreadWaitChainSession
ntdll
WinSqmAddToStream
WinSqmAddToAverageDWORD
WinSqmIncrementDWORD
NtQueryInformationToken
NtOpenFile
RtlIpv6AddressToStringExW
NtQuerySystemInformation
RtlNtStatusToDosError
NtQuerySystemInformationEx
NtSuspendProcess
NtQuerySystemTime
NtQueryInformationProcess
NtResumeProcess
NtQueryInformationThread
NtQueryObject
RtlIpv4AddressToStringW
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlInitUnicodeString
RtlIpv6AddressToStringW
pdh
PdhExpandWildCardPathW
PdhGetFormattedCounterValue
PdhAddEnglishCounterW
PdhCloseQuery
PdhCollectQueryData
PdhOpenQueryW
PdhGetFormattedCounterArrayW
pdhui
PdhUiBrowseCountersExHW
shlwapi
ord348
AssocQueryStringW
shell32
ShellExecuteW
ord265
CommandLineToArgvW
SHGetMalloc
ShellExecuteExW
SHBrowseForFolderW
SHGetPathFromIDListW
DragQueryFileW
SHGetSpecialFolderLocation
comctl32
ord344
ord412
ord413
ord410
ord345
kernel32
CreateEventW
SetEvent
GetTickCount
ReadFile
CreateFileW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
CancelSynchronousIo
OutputDebugStringA
QueryActCtxW
GetModuleFileNameW
CreateActCtxW
FindActCtxSectionStringW
LoadLibraryW
ActivateActCtx
DeactivateActCtx
CreateThread
TlsFree
TlsAlloc
HeapSetInformation
IsDebuggerPresent
DebugBreak
GetModuleHandleW
GetProcessHeap
GetCurrentProcessId
DeleteCriticalSection
AcquireSRWLockShared
FreeLibrary
GetProcAddress
HeapAlloc
CreateThreadpoolTimer
ReleaseSRWLockShared
SetThreadpoolTimer
CloseHandle
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
CloseThreadpoolTimer
OutputDebugStringW
ReleaseSRWLockExclusive
GetLastError
FormatMessageW
ReleaseMutex
GetCurrentThreadId
WaitForSingleObject
WaitForThreadpoolTimerCallbacks
InitializeCriticalSectionEx
LeaveCriticalSection
GetModuleHandleExW
ReleaseSemaphore
EnterCriticalSection
SetLastError
HeapFree
CreateSemaphoreExW
GetModuleFileNameA
GetLocalTime
WaitForMultipleObjects
ExpandEnvironmentStringsW
WriteFile
LocalAlloc
HeapReAlloc
GetLocaleInfoW
GetFileAttributesW
DeleteFileW
FileTimeToLocalFileTime
LocalFree
FileTimeToSystemTime
GetDateFormatW
GetTimeFormatW
GetCommandLineW
ResetEvent
FindResourceW
ResolveDelayLoadedAPI
DelayLoadFailureHook
InterlockedPushEntrySList
LoadLibraryExW
LoadResource
LockResource
SizeofResource
FreeResource
FindFirstFileW
FindNextFileW
FindClose
GetTempPath2W
GetTempFileNameW
InitializeCriticalSection
GetFileSize
GetCurrentProcess
ProcessIdToSessionId
WideCharToMultiByte
MulDiv
SetErrorMode
GetErrorMode
lstrcmpW
GetNumberFormatW
SetThreadPriority
GetCurrentThread
TryEnterCriticalSection
TlsGetValue
CreateMutexW
UnmapViewOfFile
SetProcessWorkingSetSize
CreateFileMappingW
MapViewOfFile
TlsSetValue
OpenProcess
GetProcessTimes
QueryFullProcessImageNameW
lstrlenW
TerminateProcess
GetActiveProcessorGroupCount
GetProcessorSystemCycleTime
GetVersionExW
IsWow64Process
GetDiskFreeSpaceExW
QueryPerformanceFrequency
GetLogicalDriveStringsW
QueryDosDeviceW
ReadProcessMemory
TerminateThread
DuplicateHandle
GetSystemWindowsDirectoryW
K32EnumDeviceDrivers
K32EnumProcessModulesEx
GetComputerNameW
K32GetDeviceDriverBaseNameW
K32GetDeviceDriverFileNameW
K32GetModuleBaseNameW
K32GetModuleFileNameExW
GetPhysicallyInstalledSystemMemory
HeapSize
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
CreateMutexExW
user32
IsHungAppWindow
IsWindowVisible
GetWindowLongW
GetFocus
GetSysColor
SetClipboardData
EmptyClipboard
GetMessagePos
GetScrollPos
PtInRect
RemoveMenu
ReleaseDC
SetWindowPos
SetRect
DeleteMenu
AppendMenuW
GetMenuItemID
GetMenu
MapWindowPoints
UpdateWindow
EndPaint
BeginPaint
InvalidateRect
RegisterClassW
FillRect
CreateWindowExW
DestroyWindow
ShowWindow
GetSystemMetrics
MessageBeep
GetWindow
GetWindowThreadProcessId
DestroyIcon
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
SetActiveWindow
OpenDesktopW
CheckMenuRadioItem
GetMenuItemCount
DestroyMenu
TrackPopupMenuEx
EnableMenuItem
CheckMenuItem
GetSubMenu
LoadMenuW
GetWindowRect
GetKeyState
LoadCursorW
SetCursor
IsWindowEnabled
FlashWindow
DefWindowProcW
RegisterClipboardFormatW
SetTimer
KillTimer
PostThreadMessageW
SendMessageTimeoutW
LoadBitmapW
GetDC
CallWindowProcW
CheckRadioButton
GetParent
PostMessageW
SendDlgItemMessageW
GetDlgItemTextW
GetWindowTextW
SetFocus
DialogBoxParamW
CheckDlgButton
IsDlgButtonChecked
EndDialog
NotifyWinEvent
SetDlgItemTextW
GetWindowLongPtrW
SetWindowLongPtrW
EnableWindow
GetClientRect
SetWindowTextW
SendMessageW
GetDlgItem
LoadStringW
LoadIconW
LoadImageW
GetThreadDesktop
SetThreadDesktop
EnumDesktopWindows
CloseDesktop
OpenWindowStationW
GetProcessWindowStation
SetProcessWindowStation
EnumDesktopsW
CloseWindowStation
EnumWindowStationsW
CharLowerW
GhostWindowFromHungWindow
HungWindowFromGhostWindow
GetMenuStringW
GetClassNameW
oleaut32
SysStringLen
SetErrorInfo
GetErrorInfo
SysAllocString
SysFreeString
VariantInit
VariantClear
VariantChangeType
SafeArrayDestroy
SafeArrayCreate
VariantCopy
SysAllocStringLen
SysStringByteLen
SafeArrayUnaccessData
SafeArrayAccessData
SystemTimeToVariantTime
VariantTimeToSystemTime
ole32
CoGetActivationState
CoGetCallState
CoTaskMemRealloc
CoTaskMemFree
CoInitializeEx
CreateOleAdviseHolder
CoSetProxyBlanket
StringFromGUID2
CoTaskMemAlloc
WriteClassStm
ReadClassStm
StringFromCLSID
GetHGlobalFromStream
CreateStreamOnHGlobal
CoCreateInstanceEx
CoInitialize
CoCreateInstance
CoUninitialize
odbc32
ord24
ord157
ord31
ord75
uxtheme
SetWindowTheme
secur32
GetUserNameExW
credui
CredUIPromptForCredentialsW
wevtapi
EvtClose
EvtRender
EvtOpenSession
EvtCreateRenderContext
EvtOpenPublisherMetadata
EvtSubscribe
EvtNext
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
pla
PlaGetServerCapabilities
PlaDeleteReport
PlaGetLegacyAlertActionsStringFromFlags
PlaGetLegacyAlertActionsFlagsFromString
PlaExpandTaskArguments
iphlpapi
GetIfEntry2
NhGetInterfaceNameFromDeviceGuid
GetAdaptersAddresses
GetExtendedUdpTable
GetPerTcp6ConnectionEStats
GetPerTcpConnectionEStats
SetPerTcp6ConnectionEStats
SetPerTcpConnectionEStats
GetExtendedTcpTable
winsta
WinStationGetProcessSid
utildll
CachedGetUserFromSid
wtsapi32
WTSFreeMemory
WTSQuerySessionInformationW
api-ms-win-core-appcompat-l1-1-1
BaseReadAppCompatDataForProcess
BaseFreeAppCompatDataForProcess
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-libraryloader-l1-2-0
FindResourceExW
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
WdcParseLegacyFile
WdcRunTaskAsInteractiveUser
Name
.text
Size
580KB
Virtual Size
577KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
168KB
Virtual Size
164KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
24KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=19, id=260, version=33145,
count=5, id=259, version=33145,
count=1815, id=1, productName=Unmarked objects,
count=51, id=257, version=33145,
count=25, id=261, version=33145,
count=1, id=256, version=33145,
count=76, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wdi.dll
- IMPHASH 5d6755a15afaff3f7152e44817a5f8c3
- SHA256 8179aebabd33fcd715119b1c02bd7f306eec1af762feee526b2768520989cd02
- MD5 6552f246d2fcbfba9a66d598027bcde5
- SHA1 9c6e81ffc2f6179efe2ec62a9a23bf95ea29d1c6
- SHA512 d3c919159eb0f120fa3a238fbbe24616befd95cc6f586ee6bc25337559bdf60e6f9f6b2cd67fef260a7446a290d6ebce785ef2321993d7b93c65d53c674e3cd5
- SSDEEP 1536:UPoEKd5GNhUZHrJXBSJDSP3ydlF9q4gB5+b5SdPWi9BUJT8f:CoOnUZHrCJDS/yd84gb2SdO+BUlU
- TLSH T11FC3D5287BE920A8E9B24674C9F60179C37078212B319BEF45D0C5BDAE62BC1BD35F51
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
42656
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wdi.pdb
msvcrt
__C_specific_handler
memcpy
_amsg_exit
_XcptFilter
_wcsicmp
free
_callnewh
_initterm
malloc
swscanf_s
_vsnwprintf
wcsrchr
memset
ntdll
TpAllocAlpcCompletion
TpReleaseAlpcCompletion
NtSetInformationThread
NtQueryInformationThread
NtAlpcImpersonateClientOfPort
NtAlpcAcceptConnectPort
NtAlpcCancelMessage
NtQueryInformationProcess
AlpcInitializeMessageAttribute
TpWaitForAlpcCompletion
NtAlpcQueryInformation
NtAlpcDisconnectPort
NtAlpcSendWaitReceivePort
RtlNtStatusToDosError
NtAlpcConnectPort
RtlInitUnicodeString
AlpcMaxAllowedMessageLength
AlpcGetMessageAttribute
api-ms-win-core-synch-l1-1-0
CreateEventW
EnterCriticalSection
DeleteCriticalSection
WaitForMultipleObjectsEx
InitializeCriticalSection
SetEvent
WaitForSingleObject
ResetEvent
LeaveCriticalSection
api-ms-win-core-sysinfo-l1-1-0
GetSystemDirectoryW
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-file-l1-1-0
CreateFileW
CreateDirectoryW
CompareFileTime
api-ms-win-security-base-l1-1-0
GetLengthSid
CreateWellKnownSid
IsValidSid
RevertToSelf
CopySid
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
api-ms-win-core-file-l2-1-0
CopyFileExW
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
CreateThread
GetCurrentThread
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventUnregister
EventActivityIdControl
EventWrite
EventEnabled
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-libraryloader-l1-2-0
FreeLibraryAndExitThread
LoadLibraryExW
DisableThreadLibraryCalls
LoadStringW
FreeLibrary
GetModuleHandleExW
GetProcAddress
api-ms-win-core-registry-l1-1-0
RegQueryInfoKeyW
RegOpenKeyExW
RegCloseKey
RegEnumKeyExW
RegQueryValueExW
api-ms-win-eventing-controller-l1-1-0
ControlTraceW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
kernelbase
WTSGetServiceSessionId
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
ServiceMain
WdiAddFileToInstance
WdiAddParameter
WdiCancel
WdiCloseInstance
WdiCreateInstance
WdiDeleteQueuedResolution
WdiDiagnose
WdiGetClientActivityId
WdiGetClientLCID
WdiGetDiagnosticModuleId
WdiGetEvent
WdiGetInstanceFilePath
WdiGetInstanceId
WdiGetLoggerSnapshotPath
WdiGetParameterByIndex
WdiGetParameterByName
WdiGetParameterCount
WdiGetParameterData
WdiGetParameterDataLength
WdiGetParameterDiagnosticModuleId
WdiGetParameterFlags
WdiGetParameterName
WdiGetProgress
WdiGetQueuedResolutionAudience
WdiGetQueuedResolutionExpirationDate
WdiGetQueuedResolutionId
WdiGetQueuedResolutionName
WdiGetQueuedResolutionPriority
WdiGetResult
WdiGetScenarioIcon
WdiGetScenarioInfo
WdiGetScenarioInstanceCreatedDate
WdiGetScenarioInstanceFilePath
WdiGetScenarioInstanceId
WdiGetScenarioInstances
WdiGetScenarioSourceName
WdiGetScenarioTypeName
WdiImpersonateClient
WdiIsQueuedResolutionAdmin
WdiLaunchQueuedResolution
WdiOpenInstance
WdiQueueCurrentResolution
WdiResolve
WdiRevertToSelf
WdiSetFeedback
WdiSetProblemDetectionResult
WdiSetProgress
WdiSetResolution
WdipLaunchLocalHost
WdipLaunchRunDLLUserHost
Name
.text
Size
64KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
160B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
196B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=44, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=14, id=260, version=33145,
count=4, id=259, version=33145,
count=128, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=2, id=261, version=33145,
count=1, id=256, version=33145,
count=20, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wdigest.dll
- IMPHASH f1abc69789ac9dd22da9c7b5bd6fa56c
- SHA256 54235e3a8456890744b1737a7302fbe0c60d6aea2f0d0d711575850092509216
- MD5 2cc62e0652b29f937a4a64de8ee36db3
- SHA1 9e86a0c2c1a96a55b976ee4fb70ad101622281c6
- SHA512 3d998dcd1f3ad7a3b104f58b312067b638eb9bd5bd8777f46e9008e834621fad7b4cb770877278c5b1d0c4756ad158cd32f913d9eba7fa9238f0dc8d2af4a815
- SSDEEP 6144:biSwAx+A4uVSAdzH6xkgSoInG5HBfbthqh5DBua/4aThUZdtedededtvoOCpjkB:RwH3ugAdDIkgSoInGBlGmrj
- TLSH T10E643B3DE2A824B9E466977885831365AFB1702D2B214ADF22F085357F03AF15B39F4D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
79728
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wdigest.pdb
api-ms-win-crt-string-l1-1-0
strncmp
memset
strnlen
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__strnicmp
_o__configure_narrow_argv
memmove
_o__wcsnicmp
_o__wsplitpath_s
_o_free
_o_isspace
_o_malloc
_o_strcat_s
_o_strcpy_s
_o_strncat_s
_o_strtok_s
_o_wcscat_s
_o_wcscpy_s
_o_wcsncat_s
_o_wcsncpy_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__cexit
_o__callnewh
_o__crt_atexit
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_CxxThrowException
wcschr
__C_specific_handler
_o___stdio_common_vsnwprintf_s
memcmp
__CxxFrameHandler3
memcpy
__std_terminate
__CxxFrameHandler4
api-ms-win-security-cryptoapi-l1-1-0
CryptDestroyKey
CryptSetHashParam
CryptDecrypt
CryptGetHashParam
CryptEncrypt
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptAcquireContextW
CryptGenRandom
CryptImportKey
CryptReleaseContext
CryptSetKeyParam
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetProcAddress
GetModuleFileNameA
GetModuleFileNameW
FreeLibrary
LoadLibraryExW
GetModuleHandleExW
api-ms-win-core-synch-l1-1-0
OpenSemaphoreW
InitializeCriticalSection
CreateEventW
InitializeSRWLock
TryAcquireSRWLockExclusive
EnterCriticalSection
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
ReleaseSRWLockShared
CreateSemaphoreExW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseMutex
WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection
ReleaseSemaphore
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
SetThreadToken
OpenProcessToken
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-security-base-l1-1-0
GetTokenInformation
RevertToSelf
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemInfo
GetWindowsDirectoryW
GetComputerNameExW
GetVersionExW
GetSystemTimeAsFileTime
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegCloseKey
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegNotifyChangeKeyValue
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetEnvironmentVariableW
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlCompareMemory
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-synch-l1-2-0
Sleep
ntdll
RtlEqualSid
NtOpenThreadToken
RtlAllocateHeap
RtlFreeHeap
NtSetSecurityObject
RtlAllocateAndInitializeSid
RtlDeleteCriticalSection
NtOpenProcessToken
NtCreateToken
RtlCreateSecurityDescriptor
RtlCreateAcl
RtlAddAccessAllowedAce
NtQueryInformationToken
RtlSetDaclSecurityDescriptor
RtlCompareUnicodeString
RtlAnsiStringToUnicodeString
RtlRegisterWait
RtlDeregisterWait
RtlDeregisterWaitEx
RtlFreeUnicodeString
NtAllocateLocallyUniqueId
RtlCopyUnicodeString
RtlAppendUnicodeToString
RtlAppendUnicodeStringToString
RtlLengthSid
RtlUpcaseUnicodeString
RtlEqualDomainName
RtlCopySid
RtlLengthRequiredSid
RtlSubAuthorityCountSid
RtlSubAuthoritySid
RtlCharToInteger
RtlEqualString
RtlConvertSharedToExclusive
RtlCompareString
RtlAcquireResourceExclusive
RtlInitializeResource
NtClose
RtlReleaseResource
RtlAcquireResourceShared
RtlGetNtProductType
RtlDeleteResource
RtlDowncaseUnicodeString
RtlInitUnicodeString
NtQuerySystemTime
NtQuerySystemInformation
NtOpenEvent
EtwUnregisterTraceGuids
NtCreateEvent
NtSetEvent
RtlNtStatusToDosError
RtlLeaveCriticalSection
RtlDuplicateUnicodeString
NtWaitForSingleObject
RtlValidSid
RtlInitializeCriticalSection
RtlEnterCriticalSection
RtlEqualUnicodeString
RtlInitString
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-memory-l1-1-0
VirtualAlloc
OpenFileMappingW
MapViewOfFileEx
CreateFileMappingW
UnmapViewOfFile
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventSetInformation
EventUnregister
EventWriteTransfer
api-ms-win-service-private-l1-1-0
I_QueryTagInformation
api-ms-win-core-file-l1-1-0
CreateDirectoryW
api-ms-win-core-version-l1-1-0
GetFileVersionInfoSizeExW
VerQueryValueW
GetFileVersionInfoExW
api-ms-win-eventing-controller-l1-1-0
ControlTraceW
StartTraceW
EnableTraceEx2
api-ms-win-core-threadpool-legacy-l1-1-0
CreateTimerQueueTimer
ChangeTimerQueueTimer
UnregisterWaitEx
DeleteTimerQueueTimer
api-ms-win-core-file-l2-1-0
MoveFileExW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-threadpool-private-l1-1-0
RegisterWaitForSingleObjectEx
CredentialUpdateFree
CredentialUpdateNotify
CredentialUpdateRegister
DllMain
SpInitialize
SpInstanceInit
SpLsaModeInitialize
SpUserModeInitialize
SsiCredentialsUpdateFree
SsiCredentialsUpdateNotify
Name
.text
Size
228KB
Virtual Size
227KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
328B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
832B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=79, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1309, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=26, id=261, version=33145,
count=1, id=256, version=33145,
count=25, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wdscore.dll
- IMPHASH 3eb12f734973ef536026f12e386ed6bd
- SHA256 3fa8e8cf3c9e5d434f25461832e08a54082e6be43e2038bbf9d8156c111deb2b
- MD5 983f30e32b2ca35d27e6ef44b2cfe7ac
- SHA1 081f35b57fb19e8d1d3775dd74e22278ee43c4f6
- SHA512 55d63f7651cd7a87e8f9db300874ee8c2d489ff040d6f77a37b3545051e1927a70e8b8004ea65d70ac3422501dbadc3bae65b68fee47188115157bf1ee74d11f
- SSDEEP 6144:jztviFbuKhwVj7vmnCc27CJjlpFLeU3fn4p6zoA:jz6eVjSnCc27CJB/nnzX
- TLSH T1A0645C5D97E914F6F5B7E23DC6868206E2B1B420572292CF06A0CA3D7F23AD4663DF11
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
85:5a:68:08:b2:fe:49:d8:ce:9d:59:e9:65:07:f0:d0:28:58:8d:c3:fd:8b:68:ce:c5:d2:2b:e2:09:3c:80:51
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9600-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:26:35:b4:3e:67:43:93:f6:1f:00:01:00:00:02:26
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
5744
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB paths
wdscore.pdb
msvcrt
_wfopen
wcstok_s
fclose
swscanf_s
feof
_callnewh
fgetws
_XcptFilter
_wcsnicmp
_amsg_exit
_initterm
_lock
_unlock
__dllonexit
_onexit
iswctype
malloc
free
_wcslwr_s
calloc
memmove_s
strrchr
?terminate@@YAXXZ
??0exception@@QEAA@AEBV0@@Z
??1type_info@@UEAA@XZ
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
memcpy_s
towlower
wcschr
_wcslwr
_purecall
_vsnprintf
memmove
memcpy
__CxxFrameHandler3
wcsrchr
wcsncmp
_wtoi
memcmp
_wcsicmp
_vsnwprintf
_CxxThrowException
__C_specific_handler
memset
ntdll
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-heap-l1-1-0
HeapSize
HeapDestroy
HeapCreate
HeapReAlloc
GetProcessHeap
HeapWalk
HeapAlloc
HeapValidate
HeapFree
HeapCompact
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
RaiseException
SetErrorMode
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
WaitForSingleObjectEx
CreateMutexW
OpenSemaphoreW
ReleaseSRWLockShared
ReleaseSRWLockExclusive
WaitForMultipleObjectsEx
CreateEventW
EnterCriticalSection
SetEvent
CreateMutexExW
ReleaseMutex
AcquireSRWLockShared
InitializeCriticalSectionEx
ReleaseSemaphore
CreateSemaphoreExW
InitializeCriticalSection
OpenEventW
ResetEvent
LeaveCriticalSection
DeleteCriticalSection
WaitForSingleObject
api-ms-win-core-processthreads-l1-1-0
GetCurrentThread
OpenProcessToken
OpenThreadToken
TlsSetValue
GetExitCodeProcess
GetCurrentProcessId
TlsGetValue
CreateThread
TlsFree
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
CreateProcessA
TlsAlloc
CreateProcessW
ExitProcess
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-libraryloader-l1-1-0
LoadLibraryExW
GetModuleHandleW
LoadLibraryExA
SizeofResource
LockResource
FindResourceExW
LoadResource
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleExA
GetProcAddress
FreeLibrary
api-ms-win-core-localization-l1-2-0
SetThreadPreferredUILanguages
FormatMessageW
GetLocaleInfoW
FormatMessageA
api-ms-win-core-file-l1-1-0
FindClose
SetFilePointer
RemoveDirectoryW
CreateDirectoryW
GetFileSizeEx
WriteFile
FindNextFileW
FindFirstFileW
GetTempFileNameW
GetLogicalDrives
DeleteFileW
SetFileTime
ReadFile
FlushFileBuffers
GetDriveTypeW
SetEndOfFile
GetFileAttributesW
GetFullPathNameW
GetVolumeInformationW
GetFileType
GetFileSize
SetFileAttributesW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
CreateFileW
GetLogicalDriveStringsW
GetShortPathNameW
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-memory-l1-1-0
CreateFileMappingW
UnmapViewOfFile
VirtualFree
VirtualQuery
VirtualAlloc
MapViewOfFile
VirtualProtect
api-ms-win-core-processenvironment-l1-1-0
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
api-ms-win-core-sysinfo-l1-1-0
GetComputerNameExW
GetSystemTimeAsFileTime
GetVersionExW
GetSystemInfo
GetVersionExA
GetWindowsDirectoryA
GetTickCount
GetWindowsDirectoryW
GetLocalTime
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-privateprofile-l1-1-0
GetPrivateProfileStringW
api-ms-win-core-heap-obsolete-l1-1-0
GlobalFree
GlobalLock
GlobalAlloc
GlobalSize
LocalFree
GlobalUnlock
api-ms-win-core-io-l1-1-0
GetOverlappedResult
DeviceIoControl
api-ms-win-core-file-l2-1-0
MoveFileExW
CopyFileExW
api-ms-win-core-kernel32-legacy-l1-1-0
GlobalMemoryStatus
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
api-ms-win-security-base-l1-1-0
SetSecurityDescriptorDacl
EqualSid
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
InitializeSecurityDescriptor
InitializeAcl
GetLengthSid
AddAccessAllowedAce
GetTokenInformation
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-errorhandling-l1-1-1
AddVectoredExceptionHandler
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
oleaut32
SystemTimeToVariantTime
VariantTimeToSystemTime
ConstructPartialMsgIfA
ConstructPartialMsgIfW
ConstructPartialMsgVA
ConstructPartialMsgVW
CurrentIP
DecrementPartialMsgIndent
DestructPartialMsg
EndMajorTask
EndMinorTask
GetMajorTask
GetMajorTaskA
GetMinorTask
GetMinorTaskA
GetPartialMsgIndent
IncrementPartialMsgIndent
StartMajorTask
StartMinorTask
WdsAbortBlackboardItemEnum
WdsAddModule
WdsAddUsmtLogStack
WdsAllocCollection
WdsCollectionAddValue
WdsCollectionGetValue
WdsCopyBlackboardItems
WdsCopyBlackboardItemsEx
WdsCreateBlackboard
WdsDeleteBlackboardValue
WdsDeleteEvent
WdsDestroyBlackboard
WdsDuplicateData
WdsEnableDiagnosticMode
WdsEnableExit
WdsEnableExitEx
WdsEnumFirstBlackboardItem
WdsEnumFirstCollectionValue
WdsEnumNextBlackboardItem
WdsEnumNextCollectionValue
WdsExecuteWorkQueue
WdsExecuteWorkQueue2
WdsExecuteWorkQueueEx
WdsExitImmediately
WdsExitImmediatelyEx
WdsFreeCollection
WdsFreeData
WdsGenericSetupLogInit
WdsGetAssertFlags
WdsGetBlackboardBinaryData
WdsGetBlackboardStringA
WdsGetBlackboardStringW
WdsGetBlackboardUintPtr
WdsGetBlackboardValue
WdsGetCurrentExecutionGroup
WdsGetPointer
WdsGetSetupLog
WdsGetTempDir
WdsInitialize
WdsInitializeCallbackArray
WdsInitializeDataBinary
WdsInitializeDataStringA
WdsInitializeDataStringW
WdsInitializeDataUInt32
WdsInitializeDataUInt64
WdsIsDiagnosticModeEnabled
WdsIterateOfflineQueue
WdsIterateQueue
WdsLockBlackboardValue
WdsLockExecutionGroup
WdsLogCreate
WdsLogDestroy
WdsLogRegStockProviders
WdsLogRegisterProvider
WdsLogStructuredException
WdsLogUnRegStockProviders
WdsLogUnRegisterProvider
WdsPackCollection
WdsPublish
WdsPublishEx
WdsPublishImmediateAsync
WdsPublishImmediateEx
WdsPublishOffline
WdsSeqAlloc
WdsSeqFree
WdsSetAssertFlags
WdsSetBlackboardValue
WdsSetNextExecutionGroup
WdsSetUILanguage
WdsSetupLogDestroy
WdsSetupLogInit
WdsSetupLogMessageA
WdsSetupLogMessageW
WdsSubscribeEx
WdsTerminate
WdsUnlockExecutionGroup
WdsUnpackCollection
WdsUnsubscribe
WdsUnsubscribeEx
WdsValidBlackboard
g_Kernel32
g_bEnableDiagnosticMode
Name
.text
Size
204KB
Virtual Size
200KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
72KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
816B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=74, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=17, id=260, version=33145,
count=274, id=1, productName=Unmarked objects,
count=7, id=257, version=33145,
count=9, id=261, version=33145,
count=1, id=256, version=33145,
count=33, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
webauthn.dll
- IMPHASH 604293382085276cd71be5ab43936b7c
- SHA256 744e18d6d1623b678e59f2729f0237592daaa1994e89c4c2193f77f1074cec89
- MD5 136bf3a03c1ead62d6feaea5ab84bed8
- SHA1 b60271799059356124642b0a7334f517be139601
- SHA512 830cfcbf77656b94bcdfa650ab8facf413aa23e1e16ac4f501c4cc2069eeb674c5e9322885c90f189118df944237415e14aaac44070ac7d584f4ba2468bb538c
- SSDEEP 49152:3aJDmogokSIa099rd43nQU0fMRSNdgT0XIapM1SYJ5:y
- TLSH T1FF959D2E96EC42F9D0BED27CC9974A0BE670745583359ACF01A546A81F27FF4993E320
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
101280
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
webauthn.pdb
msvcp_win
??0facet@locale@std@@IEAA@_K@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$numpunct@D@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
_Thrd_yield
?uncaught_exception@std@@YA_NXZ
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??1facet@locale@std@@MEAA@XZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??0_Lockit@std@@QEAA@H@Z
??0_Locinfo@std@@QEAA@PEBD@Z
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??1_Lockit@std@@QEAA@XZ
??1_Locinfo@std@@QEAA@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
_Query_perf_frequency
_Query_perf_counter
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Xbad_function_call@std@@YAXXZ
_Xtime_get_ticks
_Mtx_current_owns
_Cnd_timedwait
_Cnd_do_broadcast_at_thread_exit
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
_Cnd_init_in_situ
_Mtx_init_in_situ
_Cnd_unregister_at_thread_exit
_Cnd_destroy_in_situ
_Mtx_destroy_in_situ
_Cnd_wait
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
_Mtx_unlock
_Mtx_lock
_Cnd_broadcast
_Cnd_register_at_thread_exit
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?_Syserror_map@std@@YAPEBDH@Z
_Thrd_id
_Thrd_join
?_Xbad_alloc@std@@YAXXZ
_Thrd_detach
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?_Throw_Cpp_error@std@@YAXH@Z
api-ms-win-crt-string-l1-1-0
wcscspn
wcscmp
wcsncmp
memset
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__fdclass
_o__fdsign
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__ldclass
_o__ldsign
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsicmp
memchr
_o__wcsnicmp
_o__wcstoui64
_o_abort
_o_calloc
_o_ceilf
_o_free
_o_iswspace
_o_localeconv
_o_malloc
_o_qsort
_o_strtod
_o_strtoll
_o_strtoull
_o_terminate
_o_tolower
_o_towlower
_o_towupper
_o_wcstoul
__CxxFrameHandler3
__current_exception
__current_exception_context
strchr
_CxxThrowException
memcmp
_o__beginthreadex
_o__dsign
_o__execute_onexit_table
_o__dclass
memcpy
wcsrchr
wcsstr
_o__crt_atexit
_o__configure_narrow_argv
_o___stdio_common_vswprintf
_o__errno
_o___stdio_common_vsprintf
_o___stdio_common_vfwprintf_s
_o___stdio_common_vfprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___acrt_iob_func
__C_specific_handler
__std_terminate
__CxxFrameHandler4
memmove
_o__cexit
_o__callnewh
api-ms-win-core-libraryloader-l1-2-0
LockResource
GetModuleFileNameA
LoadResource
FindResourceExW
SizeofResource
FreeLibrary
LoadLibraryExW
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
LoadStringW
api-ms-win-core-synch-l1-1-0
CreateSemaphoreExW
EnterCriticalSection
ReleaseSemaphore
LeaveCriticalSection
InitializeCriticalSectionEx
WaitForSingleObject
CreateMutexExW
InitializeSRWLock
AcquireSRWLockShared
ReleaseMutex
ReleaseSRWLockExclusive
InitializeCriticalSectionAndSpinCount
ResetEvent
AcquireSRWLockExclusive
CreateEventExW
SetEvent
OpenEventW
InitializeCriticalSection
DeleteCriticalSection
WaitForSingleObjectEx
OpenSemaphoreW
CreateEventW
ReleaseSRWLockShared
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolWaitEx
FreeLibraryWhenCallbackReturns
TrySubmitThreadpoolCallback
CreateThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimerEx
api-ms-win-core-processthreads-l1-1-0
OpenThreadToken
SetThreadToken
GetCurrentThread
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
OpenProcessToken
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
OutputDebugStringA
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-eventing-provider-l1-1-0
EventActivityIdControl
EventUnregister
EventRegister
EventWriteTransfer
EventSetInformation
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
Sleep
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-core-heap-l2-1-0
LocalReAlloc
LocalFree
LocalAlloc
api-ms-win-core-sysinfo-l1-1-0
GetTickCount64
GetTickCount
GetVersionExW
GetSystemTimeAsFileTime
GetLocalTime
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
api-ms-win-core-file-l1-1-0
SetFilePointer
SetEndOfFile
CreateFileW
WriteFile
GetFileSize
ReadFile
CompareFileTime
api-ms-win-core-registry-l1-1-0
RegDeleteTreeW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegCreateKeyExW
RegSetValueExA
RegGetValueA
RegDeleteKeyExW
RegSetValueExW
RegDeleteValueA
RegQueryValueExW
RegGetValueW
RegDeleteValueW
RegQueryInfoKeyW
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedPushEntrySList
api-ms-win-core-processthreads-l1-1-1
OpenProcess
IsProcessorFeaturePresent
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-core-io-l1-1-0
CancelIoEx
api-ms-win-core-registry-private-l1-1-0
RegRenameKey
api-ms-win-security-provider-l1-1-0
GetSecurityInfo
api-ms-win-core-heap-obsolete-l1-1-0
LocalSize
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
ntdll
RtlPublishWnfStateData
RtlUnsubscribeWnfStateChangeNotification
RtlIsMultiSessionSku
RtlCompareUnicodeString
NtQueryInformationToken
RtlUnhandledExceptionFilter
NtTerminateProcess
RtlSubscribeWnfStateChangeNotification
NtQueryWnfStateData
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-shell-associations-l1-1-3
SHAssocEnumHandlersForProtocolByApplication
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-datetime-l1-1-0
GetDateFormatA
GetTimeFormatA
oleaut32
SetErrorInfo
SysStringLen
SysFreeString
GetErrorInfo
api-ms-win-core-sysinfo-l1-2-0
GetSystemTimePreciseAsFileTime
CryptsvcDllCtrl
EXPERIMENTAL_WebAuthNDecodeGetAssertionRequest
EXPERIMENTAL_WebAuthNDecodeMakeCredentialRequest
EXPERIMENTAL_WebAuthNEncodeGetAssertionResponse
EXPERIMENTAL_WebAuthNEncodeMakeCredentialResponse
EXPERIMENTAL_WebAuthNFreeDecodedGetAssertionRequest
EXPERIMENTAL_WebAuthNFreeDecodedMakeCredentialRequest
EXPERIMENTAL_WebAuthNIsUserVerifyingNativePlatformAuthenticatorAvailable
EXPERIMENTAL_WebAuthNPluginAddAuthenticator
EXPERIMENTAL_WebAuthNPluginAuthenticatorAddCredentials
EXPERIMENTAL_WebAuthNPluginAuthenticatorFreeCredentialDetailsList
EXPERIMENTAL_WebAuthNPluginAuthenticatorGetAllCredentials
EXPERIMENTAL_WebAuthNPluginAuthenticatorRemoveAllCredentials
EXPERIMENTAL_WebAuthNPluginAuthenticatorRemoveCredentials
EXPERIMENTAL_WebAuthNPluginFreeAddAuthenticatorResponse
EXPERIMENTAL_WebAuthNPluginFreeGetOperationSigningPublicKeyResponse
EXPERIMENTAL_WebAuthNPluginFreePerformUvResponse
EXPERIMENTAL_WebAuthNPluginGetAuthenticatorState
EXPERIMENTAL_WebAuthNPluginGetOperationSigningPublicKey
EXPERIMENTAL_WebAuthNPluginPerformUv
EXPERIMENTAL_WebAuthNPluginRegisterStatusChangeCallback
EXPERIMENTAL_WebAuthNPluginRemoveAuthenticator
EXPERIMENTAL_WebAuthNPluginUnregisterStatusChangeCallback
EXPERIMENTAL_WebAuthNPluginUpdateAuthenticatorDetails
I_WebAuthNCtapDecodeGetAssertionRpcResponse
I_WebAuthNCtapDecodeMakeCredentialRpcResponse
I_WebAuthNCtapEncodeGetAssertionRpcRequest
I_WebAuthNCtapEncodeMakeCredentialRpcRequest
VirtualChannelGetInstance
WebAuthNAuthenticatorDBFreeInfo
WebAuthNAuthenticatorDBGetInfo
WebAuthNAuthenticatorGetAssertion
WebAuthNAuthenticatorGetAssertionWithNgcContext
WebAuthNAuthenticatorMakeCredential
WebAuthNAuthenticatorMakeCredentialWithNgcContext
WebAuthNCancelCurrentOperation
WebAuthNCtapChangeClientPin
WebAuthNCtapChangeClientPinForSelectedDevice
WebAuthNCtapFreeSelectedDeviceInformation
WebAuthNCtapGetAssertion
WebAuthNCtapGetSupportedTransports
WebAuthNCtapGetWnfLocalizedString
WebAuthNCtapIsStopSendCommandError
WebAuthNCtapMakeCredential
WebAuthNCtapManageAuthenticatePin
WebAuthNCtapManageCancelEnrollFingerprint
WebAuthNCtapManageChangePin
WebAuthNCtapManageClose
WebAuthNCtapManageDeleteCredential
WebAuthNCtapManageEnableEnterpriseAttestation
WebAuthNCtapManageEnrollFingerprint
WebAuthNCtapManageFreeDisplayCredentials
WebAuthNCtapManageGetDisplayCredentials
WebAuthNCtapManageGetLargeBlobs
WebAuthNCtapManageRemoveFingerprints
WebAuthNCtapManageResetDevice
WebAuthNCtapManageSelect
WebAuthNCtapManageSetAlwaysUv
WebAuthNCtapManageSetLargeBlobs
WebAuthNCtapManageSetMinPinLength
WebAuthNCtapManageSetPin
WebAuthNCtapParseAuthenticatorData
WebAuthNCtapResetDevice
WebAuthNCtapRpcGetAssertionUserList
WebAuthNCtapRpcGetCborCommand
WebAuthNCtapRpcRenderQrCode
WebAuthNCtapRpcSelectGetAssertion
WebAuthNCtapSendCommand
WebAuthNCtapSetClientPin
WebAuthNCtapStartDeviceChangeNotify
WebAuthNCtapStopDeviceChangeNotify
WebAuthNCtapVerifyGetAssertion
WebAuthNDecodeAccountInformation
WebAuthNDecodeGetAssertionRequest
WebAuthNDecodeMakeCredentialRequest
WebAuthNDeletePlatformCredential
WebAuthNDeletePlatformCredentialServer
WebAuthNEncodeAccountInformation
WebAuthNEncodeGetAssertionResponse
WebAuthNEncodeMakeCredentialResponse
WebAuthNFreeAssertion
WebAuthNFreeAuthenticatorList
WebAuthNFreeCredentialAttestation
WebAuthNFreeDecodedAccountInformation
WebAuthNFreeDecodedGetAssertionRequest
WebAuthNFreeDecodedMakeCredentialRequest
WebAuthNFreeEncodedAccountInformation
WebAuthNFreePlatformCredentialList
WebAuthNFreeUserEntityList
WebAuthNGetApiVersionNumber
WebAuthNGetAuthenticatorList
WebAuthNGetCancellationId
WebAuthNGetCoseAlgorithmIdentifier
WebAuthNGetCredentialIdFromAuthenticatorData
WebAuthNGetErrorName
WebAuthNGetPlatformCredentialList
WebAuthNGetPlatformCredentialListServer
WebAuthNGetPlatformCredentialListSettings
WebAuthNGetW3CExceptionDOMError
WebAuthNIsUserVerifyingPlatformAuthenticatorAvailable
WebAuthNPluginAddAuthenticator
WebAuthNPluginAddAuthenticator2
WebAuthNPluginAuthenticatorAddCredentials
WebAuthNPluginAuthenticatorFreeCredentialDetailsArray
WebAuthNPluginAuthenticatorGetAllCredentials
WebAuthNPluginAuthenticatorRemoveAllCredentials
WebAuthNPluginAuthenticatorRemoveCredentials
WebAuthNPluginFreeAddAuthenticatorResponse
WebAuthNPluginFreeAuthenticatorList
WebAuthNPluginFreePublicKeyResponse
WebAuthNPluginFreeUserVerificationResponse
WebAuthNPluginGetAuthenticatorList
WebAuthNPluginGetAuthenticatorState
WebAuthNPluginGetOperationSigningPublicKey
WebAuthNPluginGetUserVerificationCount
WebAuthNPluginGetUserVerificationPublicKey
WebAuthNPluginPerformUserVerification
WebAuthNPluginPerformUserVerification2
WebAuthNPluginRegisterStatusChangeCallback
WebAuthNPluginRemoveAuthenticator
WebAuthNPluginSetAuthenticatorState
WebAuthNPluginUnregisterStatusChangeCallback
WebAuthNPluginUpdateAuthenticatorDetails
WebAuthNPluginUpdateAuthenticatorDetails2
WebAuthNReportPasskeyHeartbeat
WebAuthNReportPasskeyHeartbeatServer
WebAuthNSyncAddTrustedDevice
WebAuthNSyncCheckEnableSaveLocalDevice
WebAuthNSyncFreeSyncStatus
WebAuthNSyncFreeTrustedDeviceList
WebAuthNSyncGetSyncStatus
WebAuthNSyncGetTrustedDeviceList
WebAuthNSyncInvalidateCredentialCache
WebAuthNSyncIsFirstPartyProviderSupported
WebAuthNSyncIsSaveLocalDeviceEnabled
WebAuthNSyncIsSyncEnabled
WebAuthNSyncIsThirdPartyProviderSupported
WebAuthNSyncOTSApi
WebAuthNSyncRemoveTrustedDevice
WebAuthNSyncRenameTrustedDevice
WebAuthNSyncResetAccount
WebAuthNSyncRunSettingsOTS
WebAuthNSyncToggleSaveLocalDevice
WebAuthNSyncToggleSync
WebAuthNWriteEventCleanedupLocalStore
WebAuthNWriteEventCloudStoreOperationFailure
WebAuthNWriteEventCloudStoreOperationSuccess
WebAuthNWriteEventCreatedUserStorage
WebAuthNWriteEventDeletedTrustGroup
WebAuthNWriteEventKeyRotationFailure
WebAuthNWriteEventKeyRotationSuccess
WebAuthNWriteEventLocalStoreOperationFailure
WebAuthNWriteEventLocalStoreOperationSuccess
WebAuthNWriteEventSyncState
WebAuthNWriteEventSyncTrustedGroupDeletion
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
372KB
Virtual Size
371KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
64KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
196KB
Virtual Size
193KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=92, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=1645, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=36, id=261, version=33145,
count=17, id=260, version=33145,
count=5, id=259, version=33145,
count=1, id=256, version=33145,
count=103, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
webcheck.dll
- IMPHASH d430a5254eb3f127c3b473105d0f7dfb
- SHA256 0aecca75725d363148351f14bc1a330a59b40a26252ee45274344b5d1a302b05
- MD5 1e75b35aefb32f9829d8926ef9d3964b
- SHA1 9c654092de17543cd9ad81f1c0c464702f08af60
- SHA512 10f0d76b3e98d799b51aa4fbd5a32f7210f6004fcf72c38e086106e20dcf5985e0e86e5da4bbc57ef8fc6a1174e91795a5b8cecf8360664080a7f361eb5f16ab
- SSDEEP 6144:pq8AAaQWDpl4faAyFgcgBAtjAHX0SMMHMMM6MMZMMMblMMMOMMeUMM:pq8AAaQsIfJ2gcgH0SMMHMMM6MMZMMMn
- TLSH T1BA644B1EE3B518E4DA7A903C85038A69D6B2BC31D30192DB12E0D67E5F37BE47A39711
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4976
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
webcheck.pdb
msvcrt
_vsnwprintf
memcmp
memcpy
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
wcsncmp
wcschr
iswalpha
wcspbrk
_vsnprintf
_itow_s
memcpy_s
memset
ieframe
ord163
ord159
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
kernel32
ActivateActCtx
DeactivateActCtx
CreateActCtxW
GetSystemTime
SystemTimeToFileTime
LocalAlloc
LocalFree
FormatMessageW
MultiByteToWideChar
GetLocalTime
GetUserDefaultLCID
CopyFileW
GlobalLock
GlobalUnlock
WideCharToMultiByte
FileTimeToSystemTime
GetLocaleInfoW
GetTickCount
LoadLibraryExW
GetProcAddress
FreeLibrary
GetACP
LocalFileTimeToFileTime
CompareStringA
LocalReAlloc
HeapAlloc
GetProcessHeap
HeapFree
GetSystemTimeAsFileTime
GetWindowsDirectoryW
lstrcmpiA
GetModuleFileNameW
GetTimeFormatW
LoadLibraryExA
DisableThreadLibraryCalls
CreateFileW
GetLastError
CloseHandle
lstrcmpA
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ReadFile
GetModuleFileNameA
CreateSemaphoreExW
SetLastError
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
GetCurrentProcessId
GetModuleHandleW
DebugBreak
IsDebuggerPresent
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
QueryPerformanceCounter
RaiseFailFastException
RaiseException
ExpandEnvironmentStringsA
ReleaseActCtx
lstrcmpW
lstrlenW
lstrlenA
GetPrivateProfileStringW
ResolveDelayLoadedAPI
DelayLoadFailureHook
GetDateFormatW
user32
GetWindowTextW
GetSysColor
GetClientRect
IsWindow
GetMenuItemCount
GetMenuItemInfoW
CreatePopupMenu
RemoveMenu
GetSubMenu
DispatchMessageW
MessageBoxW
RemovePropW
SetPropW
LoadImageW
GetPropW
GetForegroundWindow
CheckRadioButton
GetParent
ShowWindow
EnableWindow
SetMenuDefaultItem
PeekMessageW
FindWindowW
RegisterWindowMessageW
MessageBoxIndirectW
DestroyIcon
GetSystemMetrics
SetCursor
GetDesktopWindow
DestroyMenu
LoadMenuW
KillTimer
SetTimer
PostMessageW
DefWindowProcW
GetWindowLongPtrW
DestroyWindow
SetWindowLongPtrW
RegisterClassW
RegisterClipboardFormatW
EnableMenuItem
LoadIconW
SendMessageW
LoadStringW
SetDlgItemInt
SendDlgItemMessageW
IsDlgButtonChecked
GetDlgItemInt
GetWindowThreadProcessId
GetDlgItem
GetDlgItemTextW
DialogBoxParamW
EndDialog
SetDlgItemTextW
LoadCursorW
CheckDlgButton
CreateWindowExW
shlwapi
ord354
StrCSpnA
StrSpnA
UrlCombineW
ord346
PathStripPathW
SHEnumValueW
StrCmpW
StrTrimW
UrlCompareW
PathRemoveBlanksW
ord217
SHStrDupW
StrFormatByteSizeW
ord219
PathIsURLW
PathFindExtensionW
PathFindFileNameW
PathIsDirectoryW
ord15
StrCmpNIW
StrRChrW
ord215
SHRegGetValueW
SHGetValueW
StrCmpIW
SHDeleteKeyW
StrChrW
ord158
StrDupW
iertutil
ord75
ord81
ord78
ord85
advapi32
RegCloseKey
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegQueryValueExW
RegQueryValueW
RegQueryInfoKeyW
RegDeleteValueW
RegEnumKeyW
RegEnumValueW
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyExW
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
176KB
Virtual Size
172KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
36KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
56KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=253, version=33145,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=41, id=260, version=33145,
count=368, id=1, productName=Unmarked objects,
count=19, id=257, version=33145,
count=4, id=261, version=33145,
count=1, id=256, version=33145,
count=61, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
webio.dll
- IMPHASH 96dbfd5a94cf5643423e73fdbb36c176
- SHA256 cc206d69bb8a1409ee048f1e390212055b2dd9d24bf8b503d09be46ec039fd26
- MD5 f0657b20a73f2bbb5ff2c0793cf1277a
- SHA1 978ba48147ac127cf50225bf5b665286d83e7048
- SHA512 cdd9921b3ee9164773a7fcbd59699f9a0e766b36b53d08d7d1feda7d4c251ab7612f722c5027dc7d4715743baf9f818c9295178f83c3baa099a19b2f35508ca9
- SSDEEP 12288:4GveqK4jbcUwe6AHR+dBxq6RPIuEgDUqBqX+xFHi2CRNiT904OwU+6TqdL:4npEOe6bdBxjPTD7hxdKXjAU+6TSL
- TLSH T1D2154A1AA7FC21A4D0BFC178C9174626F671B8391320AADF1660877D5B27BD05B3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
2c:52:88:45:ce:5c:2c:18:de:3d:f9:80:ad:f8:d0:4f:86:e0:29:67:e8:3c:3f:9f:56:05:ed:32:dc:7e:e3:c3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:DC00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:24:3b:84:21:b0:2c:ac:64:22:00:01:00:00:02:24
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
467744
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
webio.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__stricmp
_o__strnicmp
_o__wcsicmp
memmove
_o_free
_o_isalnum
_o_isalpha
_o_isdigit
_o_isspace
_o_malloc
_o_memcpy_s
_o_tolower
_o_toupper
__C_specific_handler
_o__cexit
_o__callnewh
_o__crt_atexit
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnwprintf_s
_o___std_type_info_destroy_list
_o__configure_narrow_argv
wcsrchr
__CxxFrameHandler4
__std_terminate
__CxxFrameHandler3
_o__execute_onexit_table
memcmp
memcpy
_o__wcsnicmp
api-ms-win-crt-string-l1-1-0
strcmp
strncmp
memmove_s
memset
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
CreateThread
SwitchToThread
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
OpenThreadToken
SetThreadToken
TlsFree
TlsGetValue
TlsAlloc
TlsSetValue
GetCurrentThread
api-ms-win-core-sysinfo-l1-1-0
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount64
GetTickCount
GetSystemDirectoryW
api-ms-win-core-interlocked-l1-1-0
QueryDepthSList
InterlockedPopEntrySList
InitializeSListHead
InterlockedPushEntrySList
InterlockedFlushSList
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-libraryloader-l1-2-0
FreeLibraryAndExitThread
GetModuleHandleExA
GetModuleFileNameA
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
api-ms-win-core-synch-l1-1-0
TryAcquireSRWLockExclusive
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CreateMutexExW
WaitForMultipleObjectsEx
CreateSemaphoreExW
OpenSemaphoreW
ReleaseSRWLockShared
WaitForSingleObjectEx
InitializeCriticalSectionEx
AcquireSRWLockShared
ResetEvent
WaitForSingleObject
CreateEventW
InitializeCriticalSection
SetEvent
EnterCriticalSection
ReleaseMutex
ReleaseSemaphore
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
CreateEventA
api-ms-win-core-file-l1-1-0
LocalFileTimeToFileTime
CompareFileTime
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventSetInformation
EventRegister
EventActivityIdControl
EventWrite
EventEnabled
EventUnregister
EventWriteEx
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
SystemTimeToFileTime
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
api-ms-win-core-localization-l1-2-0
GetCPInfo
IdnToAscii
IdnToUnicode
IsDBCSLeadByteEx
GetCPInfoExW
FormatMessageW
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableA
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringOrdinal
MultiByteToWideChar
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-threadpool-l1-2-0
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolIo
CancelThreadpoolIo
CreateThreadpoolIo
StartThreadpoolIo
CloseThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolWait
CreateThreadpoolCleanupGroup
CreateThreadpoolWait
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolCleanupGroup
CloseThreadpoolWait
CallbackMayRunLong
api-ms-win-security-base-l1-1-0
GetTokenInformation
RevertToSelf
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegOpenKeyExA
RegGetValueA
RegQueryValueExW
RegCloseKey
RegGetValueW
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
Sleep
api-ms-win-core-kernel32-legacy-l1-1-0
GetComputerNameW
SetFileCompletionNotificationModes
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpA
ntdll
RtlInsertElementGenericTableAvl
RtlNumberGenericTableElementsAvl
RtlEnumerateGenericTableAvl
RtlNtStatusToDosError
RtlIpv4StringToAddressExW
RtlIpv6StringToAddressExW
RtlIpv6AddressToStringW
RtlDowncaseUnicodeChar
RtlGetCurrentProcessorNumber
RtlInitializeGenericTableAvl
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlGetVersion
NtSetInformationFile
RtlCompareUnicodeStrings
RtlIsCriticalSectionLockedByThread
api-ms-win-core-sysinfo-l1-2-0
GetProductInfo
api-ms-win-core-memory-l1-1-0
VirtualFree
VirtualAlloc
api-ms-win-core-io-l1-1-0
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-threadpool-legacy-l1-1-0
QueueUserWorkItem
kernelbase
UnsubscribeWdagEnabledStateChange
GetIsWdagEnabled
SubscribeEdpEnabledStateChange
GetIsEdpEnabled
UnsubscribeEdpEnabledStateChange
SubscribeWdagEnabledStateChange
Name
.text
Size
608KB
Virtual Size
604KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
_wpp_sf
Size
24KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
84KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
28KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
712B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
76KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1004B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=33145,
count=79, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1393, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=24, id=261, version=33145,
count=1, id=256, version=33145,
count=134, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
webplatstorageserver.dll
- IMPHASH b0df9400887cd7a54fefa86c2ebcadf6
- SHA256 04721a5fcbaf30319cdb490216f9051a31848915c2b908f70ff1ffb28389ce5a
- MD5 b487c33562fd930861aee29f8266a089
- SHA1 b4a8ea7d0e59d7b8bd2945f17424f941580d5ae8
- SHA512 fb91fec0aa659ff900a708b999047b20ac331a0658c087cbac6880be0c61410f2e85be9925226c3e6bed292d5d8533f48216ccb46f555046cabf7a299d2a365a
- SSDEEP 12288:AnQo0gGhrRsWWkTtJFrXGTGIh2Rxvgtj8EncRsIqOK71TWT+aN9gZ4v:AQo0ZhyW1tJFrXchOKy+1++abg
- TLSH T169456B3D5AAC00E5E47FC27DC2538A0BFAB2745103259ADF595086B91FAFFE0523A790
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
468560
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
webplatstorageserver.pdb
msvcp_win
?_Random_device@std@@YAIXZ
_Unlock_shared_ptr_spin_lock
_Lock_shared_ptr_spin_lock
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
api-ms-win-crt-string-l1-1-0
memset
wcsncmp
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_ceil
_o_ceilf
_o_floor
_o_free
_o_iswdigit
_o_malloc
_o_memcpy_s
_o_terminate
_o_towlower
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstol
_o_wcstoul
__current_exception
__current_exception_context
_CxxThrowException
_o___stdio_common_vswprintf
_o__execute_onexit_table
_o__errno
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
__C_specific_handler
__std_terminate
_o__callnewh
__CxxFrameHandler4
__C_specific_handler_noexcept
memcmp
memcpy
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetProcAddress
GetModuleHandleExW
LoadLibraryExW
SizeofResource
GetModuleFileNameA
LoadResource
FindResourceExW
GetModuleFileNameW
FreeLibrary
GetModuleHandleExA
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
TerminateProcess
GetCurrentThread
GetCurrentProcess
GetCurrentThreadId
CreateThread
OpenProcessToken
SetThreadPriority
OpenThreadToken
SwitchToThread
api-ms-win-core-localization-l1-2-0
FormatMessageW
oleaut32
LPSAFEARRAY_UserFree
SysFreeString
LPSAFEARRAY_UserUnmarshal
SafeArrayCopy
SafeArrayGetVartype
SafeArrayCreate
SafeArrayLock
SafeArrayGetLBound
SafeArrayGetUBound
VariantCopyInd
SafeArrayUnlock
SafeArrayDestroy
VariantClear
VariantInit
VarUI4FromStr
SysStringLen
LPSAFEARRAY_UserSize
LPSAFEARRAY_UserFree64
LPSAFEARRAY_UserMarshal64
SysAllocStringLen
SystemTimeToVariantTime
LPSAFEARRAY_UserUnmarshal64
LPSAFEARRAY_UserMarshal
LPSAFEARRAY_UserSize64
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
WaitForSingleObject
DeleteCriticalSection
ReleaseSemaphore
OpenSemaphoreW
ResetEvent
InitializeSRWLock
WaitForMultipleObjectsEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
InitializeCriticalSectionEx
CreateMutexExW
TryAcquireSRWLockExclusive
ReleaseMutex
CreateEventW
InitializeCriticalSection
CreateSemaphoreExW
WaitForSingleObjectEx
SetEvent
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-errorhandling-l1-1-0
GetLastError
RaiseException
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-registry-l1-1-0
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
RegOpenKeyExW
RegCloseKey
RegQueryInfoKeyW
api-ms-win-core-synch-l1-2-0
InitializeConditionVariable
InitOnceExecuteOnce
Sleep
WakeConditionVariable
WaitOnAddress
WakeByAddressAll
InitOnceBeginInitialize
SleepConditionVariableSRW
SleepConditionVariableCS
InitOnceComplete
WakeAllConditionVariable
api-ms-win-security-base-l1-1-0
AddAccessAllowedAce
GetTokenInformation
EqualSid
RevertToSelf
GetSidSubAuthorityCount
ImpersonateLoggedOnUser
GetSidSubAuthority
CopySid
CreateWellKnownSid
GetLengthSid
InitializeAcl
ImpersonateSelf
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
GlobalAlloc
GlobalFree
api-ms-win-core-wow64-l1-1-0
IsWow64Process
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-eventing-provider-l1-1-0
EventWriteEx
EventUnregister
EventRegister
EventSetInformation
EventActivityIdControl
EventWriteTransfer
api-ms-win-core-threadpool-l1-2-0
TrySubmitThreadpoolCallback
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
api-ms-win-core-sysinfo-l1-1-0
GetLocalTime
GetTickCount
GetSystemTime
GetSystemTimeAsFileTime
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
api-ms-win-core-file-l1-1-0
CreateFileW
RemoveDirectoryW
FindNextFileW
FindFirstFileW
GetFileAttributesW
FindFirstFileExW
SetFileAttributesW
GetFileAttributesExW
GetDiskFreeSpaceExW
FindClose
DeleteFileW
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-1
OpenProcess
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-file-l1-2-0
GetTempPathW
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
api-ms-win-core-path-l1-1-0
PathAllocCombine
PathCchAddBackslash
PathCchRemoveFileSpec
api-ms-win-core-processthreads-l1-1-3
SetThreadDescription
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFindExtensionW
PathFindFileNameW
PathMatchSpecW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-heap-obsolete-l1-1-0
GlobalReAlloc
GlobalUnlock
GlobalSize
GlobalLock
api-ms-win-core-shlwapi-obsolete-l1-1-0
StrCmpICW
ntdll
ZwQueryWnfStateData
RtlQueryPackageClaims
RtlFreeSid
NtQueryInformationToken
RtlNtStatusToDosError
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
Name
.text
Size
812KB
Virtual Size
809KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
_wpp_sf
Size
4KB
Virtual Size
975B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
288KB
Virtual Size
287KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
48KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
968B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=98, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33145,
count=5, id=259, version=33145,
count=27, id=261, version=33145,
count=5, id=257, version=33145,
count=1501, id=1, productName=Unmarked objects,
count=1, id=256, version=33145,
count=251, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
webservices.dll
- IMPHASH e661f74d516d4d827f70dc15ce8b985a
- SHA256 40f8836e0bccbccafa7d19afad05e187ecf24ec8c47e4b7f7266e98042fa64f6
- MD5 69994c9c9f477f807e48aec8761a85ed
- SHA1 68b31865efee24483d7701c5783baa849b2844d1
- SHA512 f3a6fd73039e9b500fb6042b011b914b34e390e458bb3866f8ca69361094eac2d5679c42bc439a134004c75c62423d644c8f218ee7cf2b95e8a7f401e5de59de
- SSDEEP 24576:V0adokXj5vqBZAsakizJ2y826uj6+EB4m2bK/Lvil0a:ndtXj5vWZAsSzJ9Z6N+EBl2kxa
- TLSH T192657D1A66AC10E5C7FF9238C64B862FDBF17415632057DF06604679AF23BE4963E328
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
10:a4:00:f8:e7:7a:34:09:bd:7f:2d:2f:32:d7:9f:b4:b1:ca:da:71:39:84:ce:87:23:13:ee:74:01:62:e3:f9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:E002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:29:0e:d5:64:2a:b4:97:f2:1a:00:01:00:00:02:29
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
507568
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WebServices.pdb
ntdll
EtwLogTraceEvent
EtwUnregisterTraceGuids
EtwGetTraceLoggerHandle
EtwEventRegister
EtwEventUnregister
qsort
WinSqmAddToStreamEx
WinSqmIncrementDWORD
NtQuerySystemInformation
RtlReportException
EtwEventActivityIdControl
_vsnwprintf
memset
__C_specific_handler
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlUnregisterFeatureConfigurationChangeNotification
RtlRegisterFeatureConfigurationChangeNotification
TpCallbackIndependent
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
WinSqmIsOptedIn
EtwEventWrite
EtwGetTraceEnableLevel
EtwEventWriteTransfer
__chkstk
memcmp
memcpy
memmove
wcscmp
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetComputerNameExW
GetSystemInfo
GetTickCount
GetVersionExW
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
LoadLibraryExW
GetModuleFileNameW
GetProcAddress
DisableThreadLibraryCalls
GetModuleHandleW
FreeLibrary
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThread
OpenThreadToken
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
OpenProcessToken
api-ms-win-core-errorhandling-l1-1-0
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
GetLastError
api-ms-win-core-debug-l1-1-0
DebugBreak
api-ms-win-core-synch-l1-1-0
WaitForMultipleObjectsEx
SetWaitableTimerEx
DeleteCriticalSection
EnterCriticalSection
ResetEvent
CreateEventW
WaitForSingleObject
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
CreateWaitableTimerExW
SetEvent
api-ms-win-core-heap-l1-1-0
HeapFree
HeapReAlloc
HeapCreate
HeapAlloc
GetProcessHeap
HeapDestroy
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-string-l1-1-0
CompareStringW
api-ms-win-core-threadpool-l1-2-0
SubmitThreadpoolWork
CancelThreadpoolIo
StartThreadpoolIo
CreateThreadpoolWork
CloseThreadpoolIo
CreateThreadpoolIo
CloseThreadpoolWork
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
bcrypt
BCryptGenRandom
api-ms-win-core-localization-obsolete-l1-2-0
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
api-ms-win-security-base-l1-1-0
GetLengthSid
RevertToSelf
EqualSid
CopySid
ImpersonateLoggedOnUser
GetTokenInformation
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceExecuteOnce
api-ms-win-core-processthreads-l1-1-1
GetProcessMitigationPolicy
GetCurrentProcessorNumberEx
api-ms-win-core-realtime-l1-1-0
QueryUnbiasedInterruptTime
api-ms-win-core-heap-l2-1-0
GlobalFree
LocalAlloc
LocalFree
api-ms-win-core-io-l1-1-0
CancelIoEx
GetOverlappedResult
api-ms-win-core-memory-l1-1-0
OpenFileMappingW
CreateFileMappingW
MapViewOfFile
api-ms-win-core-file-l1-1-0
CreateFileW
ReadFile
WriteFile
api-ms-win-core-namedpipe-l1-1-0
SetNamedPipeHandleState
CreateNamedPipeW
ConnectNamedPipe
api-ms-win-core-io-l1-1-1
CancelIo
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-kernel32-legacy-l1-1-0
SetFileCompletionNotificationModes
api-ms-win-core-localization-l1-2-2
LCIDToLocaleName
WsAbandonCall
WsAbandonMessage
WsAbortChannel
WsAbortListener
WsAbortServiceHost
WsAbortServiceProxy
WsAcceptChannel
WsAddCustomHeader
WsAddErrorString
WsAddMappedHeader
WsAddressMessage
WsAlloc
WsAsyncExecute
WsCall
WsCheckMustUnderstandHeaders
WsCloseChannel
WsCloseListener
WsCloseServiceHost
WsCloseServiceProxy
WsCombineUrl
WsCopyError
WsCopyNode
WsCreateChannel
WsCreateChannelForListener
WsCreateError
WsCreateFaultFromError
WsCreateHeap
WsCreateListener
WsCreateMessage
WsCreateMessageForChannel
WsCreateMetadata
WsCreateReader
WsCreateServiceEndpointFromTemplate
WsCreateServiceHost
WsCreateServiceProxy
WsCreateServiceProxyFromTemplate
WsCreateWriter
WsCreateXmlBuffer
WsCreateXmlSecurityToken
WsDateTimeToFileTime
WsDecodeUrl
WsEncodeUrl
WsEndReaderCanonicalization
WsEndWriterCanonicalization
WsFileTimeToDateTime
WsFillBody
WsFillReader
WsFindAttribute
WsFlushBody
WsFlushWriter
WsFreeChannel
WsFreeError
WsFreeHeap
WsFreeListener
WsFreeMessage
WsFreeMetadata
WsFreeReader
WsFreeSecurityToken
WsFreeServiceHost
WsFreeServiceProxy
WsFreeWriter
WsGetChannelProperty
WsGetCustomHeader
WsGetDictionary
WsGetErrorProperty
WsGetErrorString
WsGetFaultErrorDetail
WsGetFaultErrorProperty
WsGetHeader
WsGetHeaderAttributes
WsGetHeapProperty
WsGetListenerProperty
WsGetMappedHeader
WsGetMessageProperty
WsGetMetadataEndpoints
WsGetMetadataProperty
WsGetMissingMetadataDocumentAddress
WsGetNamespaceFromPrefix
WsGetOperationContextProperty
WsGetPolicyAlternativeCount
WsGetPolicyProperty
WsGetPrefixFromNamespace
WsGetReaderNode
WsGetReaderPosition
WsGetReaderProperty
WsGetSecurityContextProperty
WsGetSecurityTokenProperty
WsGetServiceHostProperty
WsGetServiceProxyProperty
WsGetWriterPosition
WsGetWriterProperty
WsGetXmlAttribute
WsInitializeMessage
WsMarkHeaderAsUnderstood
WsMatchPolicyAlternative
WsMoveReader
WsMoveWriter
WsOpenChannel
WsOpenListener
WsOpenServiceHost
WsOpenServiceProxy
WsPullBytes
WsPushBytes
WsReadArray
WsReadAttribute
WsReadBody
WsReadBytes
WsReadChars
WsReadCharsUtf8
WsReadElement
WsReadEndAttribute
WsReadEndElement
WsReadEndpointAddressExtension
WsReadEnvelopeEnd
WsReadEnvelopeStart
WsReadMessageEnd
WsReadMessageStart
WsReadMetadata
WsReadNode
WsReadQualifiedName
WsReadStartAttribute
WsReadStartElement
WsReadToStartElement
WsReadType
WsReadValue
WsReadXmlBuffer
WsReadXmlBufferFromBytes
WsReceiveMessage
WsRegisterOperationForCancel
WsRemoveCustomHeader
WsRemoveHeader
WsRemoveMappedHeader
WsRemoveNode
WsRequestReply
WsRequestSecurityToken
WsResetChannel
WsResetError
WsResetHeap
WsResetListener
WsResetMessage
WsResetMetadata
WsResetServiceHost
WsResetServiceProxy
WsRevokeSecurityContext
WsSendFaultMessageForError
WsSendMessage
WsSendReplyMessage
WsSetChannelProperty
WsSetErrorProperty
WsSetFaultErrorDetail
WsSetFaultErrorProperty
WsSetHeader
WsSetInput
WsSetInputToBuffer
WsSetListenerProperty
WsSetMessageProperty
WsSetOutput
WsSetOutputToBuffer
WsSetReaderPosition
WsSetWriterPosition
WsShutdownSessionChannel
WsSkipNode
WsStartReaderCanonicalization
WsStartWriterCanonicalization
WsTrimXmlWhitespace
WsVerifyXmlNCName
WsWriteArray
WsWriteAttribute
WsWriteBody
WsWriteBytes
WsWriteChars
WsWriteCharsUtf8
WsWriteElement
WsWriteEndAttribute
WsWriteEndCData
WsWriteEndElement
WsWriteEndStartElement
WsWriteEnvelopeEnd
WsWriteEnvelopeStart
WsWriteMessageEnd
WsWriteMessageStart
WsWriteNode
WsWriteQualifiedName
WsWriteStartAttribute
WsWriteStartCData
WsWriteStartElement
WsWriteText
WsWriteType
WsWriteValue
WsWriteXmlBuffer
WsWriteXmlBufferToBytes
WsWriteXmlnsAttribute
WsXmlStringEquals
Name
.text
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
236KB
Virtual Size
235KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
56KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=58, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=33145,
count=128, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=4, id=259, version=33145,
count=1, id=256, version=33145,
count=369, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
webthreatdefsvc.dll
- IMPHASH b35c23bbd9cd04c1f12f2295a085c4ad
- SHA256 77d2e59419b5075198e6fc37375bd80248a3f2772b1de171f6516bb89de2ae6e
- MD5 bcc1172421c2a5d321fa24632160e44f
- SHA1 162ae2989e3882659686ed73f82f867d885691c4
- SHA512 c269bc2b9e45900dfdfdb873d9ff03f18225ba0a906afb53393466385109337767f373e771b32824b0ca5062759300466e150c8d92dd605367b0ae095b828042
- SSDEEP 3072:ScnUGsSnJkoshHGKbWSM1Y70J7QTZhh95pxMHFPJAXKgWN/y:fUGsSnJkoshHGKbDM1rJ7c5MlPJAv
- TLSH T160143B6E62A800B6E17BA17DCAD3470AF7B13456572297CF03A042BE1F27FE85939351
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ee:fc:d7:55:4d:ab:74:e5:d3:c6:56:a8:a7:16:60:9b:da:dd:25:24:6c:03:03:88:0d:18:f3:a0:2a:4d:02:b9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8603-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:25:80:c7:37:c6:cd:aa:77:49:00:01:00:00:02:25
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
10608
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
webthreatdefsvc.pdb
msvcp_win
_Mtx_destroy_in_situ
_Mtx_init_in_situ
?_Xlength_error@std@@YAXPEBD@Z
_Mtx_lock
_Mtx_unlock
?_Throw_Cpp_error@std@@YAXH@Z
?_Xbad_function_call@std@@YAXXZ
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o___std_exception_destroy
_o___std_type_info_destroy_list
_o___stdio_common_vswprintf
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o___std_exception_copy
_o_free
_o_malloc
_o_terminate
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
memmove
api-ms-win-crt-string-l1-1-0
memset
kernel32
CreateThreadpoolTimer
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
GetModuleHandleExA
AcquireSRWLockExclusive
IsDebuggerPresent
DebugBreak
WideCharToMultiByte
GetModuleHandleW
GetProcessHeap
LocalAlloc
LocalFree
ResolveDelayLoadedAPI
DelayLoadFailureHook
GetCurrentProcessId
TerminateProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
ResetEvent
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
GetCurrentThread
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
InitOnceExecuteOnce
InitOnceComplete
InitOnceBeginInitialize
DecodePointer
VerifyVersionInfoW
VerSetConditionMask
SetEvent
CreateEventW
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateMutexExW
GetProcAddress
HeapAlloc
CloseHandle
OpenSemaphoreW
WaitForSingleObjectEx
OutputDebugStringW
GetLastError
FormatMessageW
ReleaseMutex
GetCurrentThreadId
WaitForSingleObject
GetModuleHandleExW
ReleaseSemaphore
SetLastError
HeapFree
CreateSemaphoreExW
GetModuleFileNameA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionEx
DisableThreadLibraryCalls
UnregisterWait
SetThreadpoolTimer
ntdll
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlSubscribeWnfStateChangeNotification
RtlPublishWnfStateData
rpcrt4
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrDllRegisterProxy
NdrDllUnregisterProxy
NdrOleFree
NdrOleAllocate
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllRegisterServer
DllUnregisterServer
ServiceMain
SvchostPushServiceGlobals
Name
.text
Size
108KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
36KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
408B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=11, id=260, version=33145,
count=5, id=259, version=33145,
count=1267, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=32, id=261, version=33145,
count=1, id=256, version=33145,
count=18, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
webthreatdefusersvc.dll
- IMPHASH ed1655bb4e3c06a28db131a8d32e0c49
- SHA256 b17bb4f0afabe4206dfb6446df25e1af607a22ab99367d0c059815bbcbcc3df5
- MD5 bb785de19a6cb48c849e89be533b8695
- SHA1 3b542b3e7b346f8db34e482be1e2eb32e0fba8cc
- SHA512 248f531a4ba101348e14f22d19f9fe49d119a45aa5e25c5368795199124955bd00b9851883a718ee3d315f7ce429b3d9bbee33cb3c532786131a9a4d03aa5a42
- SSDEEP 6144:TX5TtowBB3QRqAiMfvk/2W/677c9qzUKzAumx16EwrkG4+Cvf:TpTdLQYAiMfvk/D/677c9q4aqxtGOf
- TLSH T17A541A6A66A80CE5E977E17DC9838A0EF7B178025712D7CF0364425E1F3BBD8A939350
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
bf:f3:03:93:45:fd:09:40:ba:d4:b9:7c:ee:0a:1b:f1:0b:0e:9c:6f:a2:fe:95:fd:cb:ba:56:44:43:11:31:2b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:551A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1b:d0:b2:b8:02:67:f7:72:cf:00:01:00:00:02:1b
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
13888
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
webthreatdefusersvc.pdb
msvcp_win
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_unlock
_Cnd_init_in_situ
_Cnd_destroy_in_situ
_Cnd_wait
_Cnd_register_at_thread_exit
_Cnd_unregister_at_thread_exit
?_Syserror_map@std@@YAPEBDH@Z
?_Xbad_function_call@std@@YAXXZ
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
??0task_continuation_context@Concurrency@@AEAA@XZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
_Thrd_join
?__ExceptionPtrCreate@@YAXPEAX@Z
_Thrd_id
_Cnd_do_broadcast_at_thread_exit
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_broadcast
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o_abort
_o_free
_o_iswspace
_o_malloc
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
__CxxFrameHandler3
_CxxThrowException
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__beginthreadex
_o__configure_narrow_argv
_o___stdio_common_vswprintf
_o__cexit
_o__callnewh
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
memmove
__std_type_info_compare
api-ms-win-crt-string-l1-1-0
memset
combase
SetErrorInfo
GetErrorInfo
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
FreeLibrary
LoadLibraryExW
GetModuleHandleExW
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleExA
GetModuleHandleW
api-ms-win-core-synch-l1-1-0
ResetEvent
WaitForMultipleObjectsEx
CreateEventExW
SetEvent
CreateEventW
InitializeCriticalSectionEx
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
InitializeCriticalSectionAndSpinCount
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
SetLastError
SetUnhandledExceptionFilter
RaiseException
GetLastError
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
OpenProcessToken
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
InitOnceExecuteOnce
api-ms-win-core-winrt-l1-1-0
RoInitialize
RoUninitialize
RoActivateInstance
RoGetActivationFactory
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister
api-ms-win-core-sysinfo-l1-2-0
VerSetConditionMask
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
HSTRING_UserSize64
HSTRING_UserFree
WindowsCreateString
HSTRING_UserFree64
HSTRING_UserSize
HSTRING_UserMarshal64
HSTRING_UserUnmarshal
HSTRING_UserMarshal
HSTRING_UserUnmarshal64
ntdll
RtlGetDeviceFamilyInfoEnum
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-com-l1-1-0
CoMarshalInterface
CoCreateFreeThreadedMarshaler
CoReleaseMarshalData
CoGetInterfaceAndReleaseStream
CoCreateInstance
CoWaitForMultipleHandles
CoTaskMemAlloc
CoTaskMemFree
CreateStreamOnHGlobal
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InterlockedPushEntrySList
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
ServiceMain
SvchostPushServiceGlobals
Name
.text
Size
176KB
Virtual Size
175KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
72KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
440B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=60, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33145,
count=1271, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=34, id=261, version=33145,
count=7, id=259, version=33145,
count=1, id=256, version=33145,
count=18, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wecapi.dll
- IMPHASH 3091b69906c42f0b1424fd374f027503
- SHA256 9687dc4417b8a4b031a365f637d195b48fc05ae1b0f9076b4e95591ba6d3878a
- MD5 fb2cd3e3b1f760a430010a99c51490b1
- SHA1 152a8c0b591b0e250d6d3ce41c04ba200de5cc59
- SHA512 816537f747c47df5027298ece34fa610ab8baf5055fa4c6ceea0f790306bf2c6f855af562f6167af055046da24df564b4397c9a5fa47b7fdbce96ddfc63469e9
- SSDEEP 1536:3bs2/ljHBg6NH0kJp2dTiVVfKspsISWJllAfQ5GO4k5v+COy6DROqlyR:LB/XgKTp2dTivfZWIBllAfQ5GO4kh+CV
- TLSH T101A32A7A76AD017AD071D079C993CE06C771B41A5B3247CF4260C2AD2F27FE08E7AA12
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5888
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wecapi.pdb
msvcrt
__CxxFrameHandler3
memcpy
memmove
?what@exception@@UEBAPEBDXZ
_lock
_unlock
_CxxThrowException
??1type_info@@UEAA@XZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
?terminate@@YAXXZ
_onexit
__dllonexit
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
__C_specific_handler
iswalnum
_initterm
__CxxFrameHandler4
_amsg_exit
malloc
_XcptFilter
free
_purecall
iswspace
memset
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
rpcrt4
RpcStringBindingComposeW
NdrClientCall3
RpcBindingFromStringBindingW
RpcStringFreeW
RpcBindingFree
RpcBindingSetAuthInfoW
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionEx
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
api-ms-win-core-file-l1-1-0
CompareFileTime
api-ms-win-service-management-l1-1-0
OpenSCManagerW
StartServiceW
CloseServiceHandle
OpenServiceW
api-ms-win-service-management-l2-1-0
QueryServiceConfigW
ChangeServiceConfig2W
ChangeServiceConfigW
api-ms-win-service-winsvc-l1-1-0
QueryServiceStatus
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-localization-l1-2-0
LocaleNameToLCID
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
wevtapi
EvtClose
EvtOpenChannelConfig
EvtGetChannelConfigProperty
EvtSetChannelConfigProperty
EvtSaveChannelConfig
EcClose
EcDeleteSubscription
EcEnumNextSubscription
EcGetObjectArrayProperty
EcGetObjectArraySize
EcGetSubscriptionProperty
EcGetSubscriptionRunTimeStatus
EcInsertObjectArrayElement
EcIsConfigRequired
EcOpenSubscription
EcOpenSubscriptionEnum
EcQuickConfig
EcRemoveObjectArrayElement
EcRetrySubscription
EcSaveSubscription
EcSetObjectArrayProperty
EcSetSubscriptionProperty
Name
.text
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
816B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=32, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=4, id=259, version=33145,
count=83, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=7, id=261, version=33145,
count=14, id=260, version=33145,
count=1, id=256, version=33145,
count=12, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wecsvc.dll
- IMPHASH 251c685ddb2f92fda9f423cf4c3a44b7
- SHA256 b5df88c38fe75a4770e351c8e5bc132e33992bd319b7c38856c0dd2a30e9f36a
- MD5 9e15894d85c6670bb1c61f4c38a7dafc
- SHA1 b0e8ed30e191d3d6701d19dcaada34ebeec35262
- SHA512 77f57ffceaa4d56a0855f9527eb634700449ae43774a261dc2c7aade2458f2001eee0bfa87cad38321dd2689dfd6c3a92cbd132c0b44918138c2e4c5263f8457
- SSDEEP 6144:0TCd8QuocPc9Qmu9lG5g9/003QaEvbPHN1KirN0:0CuVPc94G5msaEzPH7Kb
- TLSH T16A445C2D66A90C75F4B7917CCA538506E6B23C155722E2CF02F0827E5F27FE8A939B11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
6096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wecsvc.pdb
msvcrt
memset
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
__CxxFrameHandler4
memcmp
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
memmove
memcpy
__CxxFrameHandler3
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_ultow
_ltow
wcstol
memmove_s
??0exception@@QEAA@AEBV0@@Z
swprintf_s
swscanf_s
memcpy_s
_vsnwprintf
??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
malloc
abort
iswspace
wcsncpy_s
_wcsnicmp
_wcsicmp
free
_purecall
_onexit
wcscmp
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableFlags
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
TraceMessage
UnregisterTraceGuids
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
rpcrt4
RpcBindingToStringBindingW
RpcStringFreeW
RpcStringBindingParseW
RpcImpersonateClient
UuidToStringW
RpcRevertToSelf
RpcServerUseProtseqEpW
RpcServerRegisterAuthInfoW
RpcServerRegisterIfEx
UuidCreate
NdrServerCall2
NdrServerCallAll
RpcServerUnregisterIfEx
api-ms-win-security-base-l1-1-0
AllocateAndInitializeSid
FreeSid
CheckTokenMembership
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetLastError
GetLastError
SetUnhandledExceptionFilter
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
CreateEventW
CreateSemaphoreExW
SetEvent
LeaveCriticalSection
OpenSemaphoreW
WaitForSingleObjectEx
WaitForSingleObject
CreateMutexExW
InitializeCriticalSectionEx
DeleteCriticalSection
AcquireSRWLockShared
ReleaseMutex
ReleaseSemaphore
ResetEvent
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-service-core-l1-1-0
RegisterServiceCtrlHandlerExW
SetServiceStatus
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegCloseKey
RegCreateKeyExW
RegDeleteValueW
RegSetValueExW
api-ms-win-core-localization-l1-2-0
FormatMessageW
LocaleNameToLCID
GetThreadLocale
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
OpenThreadToken
GetCurrentThread
GetCurrentThreadId
SetThreadToken
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetComputerNameExW
GetSystemTime
GetTickCount
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
SystemTimeToFileTime
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-threadpool-legacy-l1-1-0
DeleteTimerQueueTimer
CreateTimerQueueTimer
UnregisterWaitEx
api-ms-win-core-kernel32-legacy-l1-1-0
GetComputerNameW
RegisterWaitForSingleObject
wsmsvc
WSManCreateSessionInternal
WSManPullEvents
WSManEnumeratorNextObject
WSManCloseSessionHandle
WSManCloseObjectHandle
WSManAckEvents
WSManCreatePullSubscription
WSManCloseSubscriptionHandle
WSManCreatePushSubscription
WSManCloseEnumeratorHandle
WSManSetSessionOption
WSManEncodeObject
WSManDecodeObject
ntdll
EtwEventWriteFull
advapi32
PerfSetULongLongCounterValue
PerfStartProviderEx
PerfSetCounterSetInfo
PerfCreateInstance
PerfSetULongCounterValue
PerfDeleteInstance
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyExW
CredWriteW
CredReadW
CredDeleteW
CredEnumerateW
RevertToSelf
CredFree
RegDeleteKeyW
EventWrite
EventRegister
EventUnregister
PerfStopProvider
wevtapi
EvtOpenPublisherMetadata
EvtClose
EvtGetPublisherMetadataProperty
EvtOpenChannelConfig
EvtGetObjectArrayProperty
EvtGetChannelConfigProperty
EvtGetObjectArraySize
api-ms-win-core-localization-l1-2-2
LCIDToLocaleName
api-ms-win-core-file-l1-1-0
CompareFileTime
DllRegisterServer
DllUnregisterServer
ServiceMain
SvchostPushServiceGlobals
Name
.text
Size
168KB
Virtual Size
167KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
48KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
988B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=54, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=14, id=260, version=33145,
count=5, id=259, version=33145,
count=185, id=1, productName=Unmarked objects,
count=11, id=257, version=33145,
count=5, id=261, version=33145,
count=1, id=256, version=33145,
count=25, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wephostsvc.dll
- IMPHASH ff4f3be1c50c12cd47c6b9c872963078
- SHA256 ce0cf53e1f54431c8c61f65d6ea969b3413b27617f370287c76e86cd70f0bfbd
- MD5 b3d4260461e220495aa792be574d8ca1
- SHA1 534757fc09f9a4db6cc66fb13b23609fe32aa5a3
- SHA512 5d4843cbc8119eb07da76b1a62ce421c4c30f10e3d63624206f6b50728c9ff0c5299ddc9f59e5ae11745e9daa197a7e30c20258ab041a306465625100f2b8739
- SSDEEP 384:N/pQiF+fP2P6JYFlnLKMiq2AWxQTBEUikqi4mylF9LvxOTfra423WoF9W+7:NdF+WP+4lLqi8ZLETfrE
- TLSH T17743082EB3B810A9E57687B985570F246A79B4391B229BDF02B0C13D1F26BD05F35F81
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4912
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wephostsvc.pdb
msvcrt
memcpy
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
memset
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
TraceMessage
UnregisterTraceGuids
GetTraceLoggerHandle
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
FreeLibrary
GetProcAddress
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
api-ms-win-core-registry-l1-1-0
RegGetValueW
api-ms-win-core-file-l1-1-0
CreateFileW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-string-l1-1-0
CompareStringW
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-security-base-l1-1-0
RevertToSelf
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventUnregister
EventWriteTransfer
api-ms-win-service-core-l1-1-0
RegisterServiceCtrlHandlerExW
SetServiceStatus
api-ms-win-core-synch-l1-1-0
SetEvent
WaitForSingleObject
CreateEventW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
ntdll
NtAccessCheck
NtPrivilegeCheck
NtOpenThreadToken
RtlNtStatusToDosError
NtGetCachedSigningLevel
NtQuerySystemInformation
NtClose
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
ServiceMain
SvchostPushServiceGlobals
Name
.text
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
744B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
300B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=42, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33138,
count=14, id=260, version=33138,
count=77, id=1, productName=Unmarked objects,
count=7, id=257, version=33138,
count=1, id=256, version=33138,
count=8, id=264, version=33138,
count=1, id=255, version=33138,
count=1, id=258, version=33138,
wer.dll
- IMPHASH a4a8b0f1253e6a08f6f20662531c54a8
- SHA256 70430b6897cfac5f251c9e2d6a3350d9384a95935c4d3081574dd26c7ab9658f
- MD5 8b48d48919c38e33d66bfb9cb104435f
- SHA1 dbb03fe714bc6a37e8701c156c2c390092071c4e
- SHA512 a6ac491fd2fd6c2e5778d34dd55ac10293dc8608d8553968c08f77dc23f0ef63ee85616971bdd40246c815467a75abdcb7e5cf43b0e473dd6c03c84e00dce84b
- SSDEEP 24576:SKQzg+crFXrnCRxv8oiP0K/tkMZT3QdkQOqOCve114kp8te:IpqzQKQOqRu4kp8te
- TLSH T141256C3DA7F81199E5B6C278C9924726EA71701D372199CF01B0C17C2F27BF06A39B66
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c7:f6:ab:d4:8c:5e:22:03:18:dc:3d:a4:da:83:a8:a2:12:cf:9b:ea:2f:9d:21:df:83:22:9a:a2:22:86:e8:97
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:651A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:15:18:03:d3:81:07:26:7c:53:00:01:00:00:02:15
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
283376
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Wer.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__strnicmp
_o__strtoui64
_o__wcsicmp
_o__wcsnicmp
_o__wcstoui64
_o__wfopen
memmove
_o__wtoi
_o__wtoi64
_o_atoi
_o_fclose
_o_fread
_o_free
_o_fseek
_o_fwrite
_o_malloc
_o_qsort
_o_rand
_o_srand
_o_terminate
_o_towlower
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstok_s
_o_wcstol
_o_wcstoul
__C_specific_handler
__current_exception
__current_exception_context
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vfwprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
memcpy
_CxxThrowException
memcmp
api-ms-win-crt-string-l1-1-0
strcmp
wcscmp
memset
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapCreate
HeapDestroy
HeapFree
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventSetInformation
EventWriteTransfer
EventRegister
api-ms-win-core-localization-l1-2-0
GetThreadUILanguage
GetSystemDefaultLCID
GetUserGeoID
GetUserDefaultLCID
FormatMessageW
IsDBCSLeadByte
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
GetCurrentThread
DeleteProcThreadAttributeList
GetThreadId
CreateProcessAsUserW
OpenProcessToken
GetProcessId
GetCurrentThreadId
InitializeProcThreadAttributeList
CreateThread
CreateProcessW
GetCurrentProcessId
GetProcessTimes
GetExitCodeProcess
OpenThreadToken
SetThreadPriority
GetThreadPriority
OpenThread
CreateRemoteThread
UpdateProcThreadAttribute
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleW
FreeLibrary
LoadLibraryExW
GetProcAddress
GetModuleHandleExW
GetModuleFileNameA
GetModuleHandleExA
LoadStringW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
OutputDebugStringA
IsDebuggerPresent
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringOrdinal
MultiByteToWideChar
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
GetTickCount64
GetSystemTime
GetSystemTimeAsFileTime
GetComputerNameExW
GetSystemDirectoryW
GetLocalTime
GetVersionExW
GlobalMemoryStatusEx
GetTickCount
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
GetLastError
SetErrorMode
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
ntdll
NtQuerySystemInformation
NtWaitForSingleObject
NtQueryMutant
NtCreateFile
NtQueryObject
RtlNtStatusToDosError
NtQueryInformationThread
RtlCreateQueryDebugBuffer
RtlStringFromGUID
NtAlpcQueryInformation
RtlReleaseSRWLockShared
NtOpenEvent
NtQueryEvent
NtQueryInformationFile
NtSetInformationFile
ZwQueryWnfStateNameInformation
ZwUpdateWnfStateData
EtwEventWriteNoRegistration
RtlAllocateAndInitializeSid
NtAlpcConnectPort
NtAlpcSendWaitReceivePort
RtlFreeSid
wcspbrk
wcsncmp
wcsspn
wcscspn
strrchr
RtlGetDeviceFamilyInfoEnum
wcschr
RtlDetermineDosPathNameType_U
wcsnlen
NtQueryInformationToken
RtlSecondsSince1970ToTime
RtlQueryPackageIdentityEx
RtlQueryTokenHostIdAsUlong64
RtlAcquireSRWLockShared
wcsrchr
RtlQueryPackageClaims
RtlAcquireSRWLockExclusive
RtlReleaseSRWLockExclusive
RtlInitUnicodeString
RtlQueryProcessDebugInformation
RtlFreeUnicodeString
NtQueryInformationProcess
RtlDestroyQueryDebugBuffer
RtlEqualUnicodeString
NtQueryWnfStateData
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwTraceMessage
RtlQueryHeapInformation
NtQueryVirtualMemory
RtlReleasePrivilege
NtUnmapViewOfSection
RtlAcquirePrivilege
NtDeviceIoControlFile
NtClose
wcsstr
NtSetInformationThread
RtlEnableThreadProfiling
RtlReadThreadProfilingData
RtlGetVersion
RtlPublishWnfStateData
RtlDisableThreadProfiling
RtlCompareUnicodeString
RtlNtStatusToDosErrorNoTeb
RtlAllocateHeap
RtlFreeHeap
RtlRbInsertNodeEx
RtlGetCompressionWorkSpaceSize
RtlCompressBuffer
RtlRbRemoveNode
RtlComputeCrc32
RtlDecompressBufferEx
strpbrk
strstr
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
NtReadVirtualMemory
DbgPrintEx
api-ms-win-oobe-notification-l1-1-0
OOBEComplete
api-ms-win-core-sidebyside-l1-1-0
DeactivateActCtx
QueryActCtxW
CreateActCtxW
FindActCtxSectionStringW
ActivateActCtx
api-ms-win-core-windowserrorreporting-l1-1-0
GetApplicationRestartSettings
GetApplicationRecoveryCallback
WerGetFlags
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-wow64-l1-1-1
GetSystemWow64DirectoryW
IsWow64Process2
api-ms-win-core-synch-l1-1-0
ResetEvent
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
SetEvent
WaitForMultipleObjectsEx
CreateSemaphoreExW
AcquireSRWLockExclusive
EnterCriticalSection
ReleaseSemaphore
LeaveCriticalSection
InitializeCriticalSection
CreateMutexW
InitializeCriticalSectionEx
CreateEventExW
WaitForSingleObject
ReleaseMutex
OpenMutexW
ReleaseSRWLockExclusive
CreateEventW
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-memory-l1-1-0
MapViewOfFile
CreateFileMappingW
VirtualFree
UnmapViewOfFile
VirtualQueryEx
VirtualAlloc
ReadProcessMemory
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
GetCurrentDirectoryW
ExpandEnvironmentStringsW
api-ms-win-core-registry-l1-1-0
RegDeleteValueW
RegEnumValueW
RegQueryInfoKeyW
RegQueryValueExW
RegGetValueW
RegDeleteKeyExW
RegEnumKeyExW
RegCloseKey
RegLoadAppKeyW
RegDeleteTreeW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
api-ms-win-core-file-l1-1-0
SetFilePointer
SetFileInformationByHandle
SetFileAttributesW
SetEndOfFile
GetFullPathNameW
GetLongPathNameW
FindClose
SetFileTime
FlushFileBuffers
WriteFile
CreateDirectoryW
GetFileAttributesW
FindFirstFileW
FindNextFileW
FindFirstFileExW
CreateFileA
GetDriveTypeW
ReadFile
GetFinalPathNameByHandleW
CreateFileW
GetFileSizeEx
SetFilePointerEx
GetDiskFreeSpaceExW
GetFileTime
CompareFileTime
DeleteFileW
api-ms-win-core-processsnapshot-l1-1-0
PssWalkSnapshot
PssWalkMarkerSeekToBeginning
PssQuerySnapshot
PssFreeSnapshot
PssDuplicateSnapshot
api-ms-win-security-base-l1-1-0
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
FreeSid
SetSecurityDescriptorDacl
SetKernelObjectSecurity
DuplicateToken
ImpersonateLoggedOnUser
GetKernelObjectSecurity
GetTokenInformation
GetSidSubAuthority
GetSidSubAuthorityCount
AllocateAndInitializeSid
GetFileSecurityW
GetLengthSid
InitializeAcl
AddAccessAllowedAceEx
AddMandatoryAce
SetSecurityDescriptorSacl
IsValidSid
CopySid
CreateWellKnownSid
GetSecurityDescriptorSacl
GetAce
RevertToSelf
CheckTokenMembership
api-ms-win-core-errorhandling-l1-1-3
SetThreadErrorMode
api-ms-win-core-heap-l2-1-0
GlobalFree
LocalFree
api-ms-win-core-console-l1-1-0
SetConsoleCtrlHandler
api-ms-win-core-file-l2-1-0
MoveFileExW
CopyFileExW
GetFileInformationByHandleEx
api-ms-win-core-psapi-l1-1-0
K32GetModuleFileNameExW
QueryFullProcessImageNameW
K32GetMappedFileNameW
K32GetProcessMemoryInfo
api-ms-win-core-file-l2-1-2
CopyFileW
api-ms-win-core-sysinfo-l1-2-0
GetProductInfo
GetNativeSystemInfo
api-ms-win-core-file-l1-2-3
GetTempPath2W
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-realtime-l1-1-0
QueryThreadCycleTime
api-ms-win-core-timezone-l1-1-0
GetTimeZoneInformation
FileTimeToSystemTime
SystemTimeToFileTime
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
api-ms-win-core-version-l1-1-0
GetFileVersionInfoSizeExW
VerQueryValueW
GetFileVersionInfoExW
api-ms-win-core-path-l1-1-0
PathCchRemoveFileSpec
PathCchRemoveBackslash
api-ms-win-core-processthreads-l1-1-3
GetProcessInformation
api-ms-win-core-kernel32-legacy-l1-1-0
GetSystemPowerStatus
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFileExistsW
api-ms-win-core-toolhelp-l1-1-0
Module32FirstW
CreateToolhelp32Snapshot
Module32NextW
api-ms-win-core-processtopology-obsolete-l1-1-0
GetProcessIoCounters
api-ms-win-core-localization-obsolete-l1-2-0
GetUserDefaultUILanguage
api-ms-win-core-file-l1-2-0
GetTempPathW
api-ms-win-core-wow64-l1-1-0
IsWow64Process
CloseThreadWaitChainSession
GetThreadWaitChain
OpenThreadWaitChainSession
RegisterWaitChainCOMCallback
WerAddExcludedApplication
WerFreeString
WerRemoveExcludedApplication
WerReportAddDump
WerReportAddFile
WerReportCloseHandle
WerReportCreate
WerReportSetParameter
WerReportSetUIOption
WerReportSubmit
WerStoreClose
WerStoreGetFirstReportKey
WerStoreGetNextReportKey
WerStoreGetReportCount
WerStoreGetSizeOnDisk
WerStoreOpen
WerStorePurge
WerStoreQueryReportMetadataV1
WerStoreQueryReportMetadataV2
WerStoreQueryReportMetadataV3
WerStoreUploadReport
WerSysprepCleanup
WerSysprepGeneralize
WerUnattendedSetup
WerpAddAppCompatData
WerpAddFile
WerpAddFileBuffer
WerpAddFileCallback
WerpAddIfRegisteredForAppLocalDump
WerpAddMemoryBlock
WerpAddRegisteredDataToReport
WerpAddRegisteredDumpsToReport
WerpAddRegisteredMetadataToReport
WerpAddTerminationReason
WerpArchiveReport
WerpAuxmdDumpProcessImages
WerpAuxmdDumpRegisteredBlocks
WerpAuxmdFree
WerpAuxmdFreeCopyBuffer
WerpAuxmdHashVaRanges
WerpAuxmdInitialize
WerpAuxmdMapFile
WerpCancelUpload
WerpCleanWer
WerpCloseStore
WerpCreateIntegratorReportId
WerpCreateMachineStore
WerpDeleteReport
WerpDestroyWerString
WerpEnumerateStoreNext
WerpEnumerateStoreStart
WerpExtractReportFiles
WerpFlushImageCache
WerpForceDeferredCollection
WerpFreeString
WerpFreeUnmappedVaRanges
WerpGetBucketId
WerpGetDynamicParameter
WerpGetEventType
WerpGetExtendedDiagData
WerpGetFileByIndex
WerpGetFilePathByIndex
WerpGetIntegratorReportId
WerpGetLegacyBucketId
WerpGetLoadedModuleByIndex
WerpGetNumFiles
WerpGetNumLoadedModules
WerpGetNumSigParams
WerpGetPathOfWERTempDirectory
WerpGetReportConsent
WerpGetReportCount
WerpGetReportFinalConsent
WerpGetReportFlags
WerpGetReportId
WerpGetReportInformation
WerpGetReportSettings
WerpGetReportTime
WerpGetReportType
WerpGetResponseId
WerpGetSigParamByIndex
WerpGetStoreLocation
WerpGetStorePath
WerpGetStoreType
WerpGetTextFromReport
WerpGetUIParamByIndex
WerpGetUploadTime
WerpGetWerStringData
WerpGetWow64Process
WerpHasOobeCompleted
WerpHashApplicationParameters
WerpInitializeImageCache
WerpIsDisabled
WerpIsOnBattery
WerpIsTransportAvailable
WerpLoadReport
WerpLoadReportFromBuffer
WerpOpenMachineArchive
WerpOpenMachineQueue
WerpPromptUser
WerpPruneStore
WerpReportCancel
WerpReportSetMaxProcessHoldMilliseconds
WerpReportSprintfParameter
WerpReserveMachineQueueReportDir
WerpResetTransientImageCacheStatistics
WerpRestartApplication
WerpSetAuxiliaryArchivePath
WerpSetCallBack
WerpSetDefaultUserConsent
WerpSetDynamicParameter
WerpSetEventName
WerpSetExitListeners
WerpSetIntegratorReportId
WerpSetIptEnabled
WerpSetProcessTimelines
WerpSetQuickDumpType
WerpSetReportApplicationIdentity
WerpSetReportFlags
WerpSetReportInformation
WerpSetReportIsFatal
WerpSetReportNamespaceParameter
WerpSetReportOption
WerpSetReportTime
WerpSetReportUploadContextToken
WerpSetTelemetryAppParams
WerpSetTelemetryKernelParams
WerpSetTelemetryServiceParams
WerpSetTtdStatus
WerpSetVelocityInformation
WerpShowUpsellUI
WerpStitchedMinidumpVmPostReadCallback
WerpStitchedMinidumpVmPreReadCallback
WerpStitchedMinidumpVmQueryCallback
WerpSubmitReportFromStore
WerpTraceAuxMemDumpStatistics
WerpTraceDuration
WerpTraceImageCacheStatistics
WerpTraceSnapshotStatistics
WerpTraceStitchedDumpWriterStatistics
WerpTraceUnmappedVaRangesStatistics
WerpUnmapProcessViews
WerpValidateReportKey
WerpWalkGatherBlocks
Name
.text
Size
724KB
Virtual Size
722KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
172KB
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=129, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1618, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=31, id=260, version=33145,
count=5, id=259, version=33145,
count=23, id=261, version=33145,
count=1, id=256, version=33145,
count=128, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
werconcpl.dll
- IMPHASH 07f00f925df038c0773ab7855696f90b
- SHA256 91e9a25a1533653b42c50b808f2c82ecb12305e87a563d42dce31cd6bd781bbd
- MD5 9133fd2b3ca6d0a7d4179380e5fd00bd
- SHA1 c9ece617da5dc5f779a62815ebaa635423497b2a
- SHA512 961cc8bb4e9728cdf184e823731f314b3091c193513b03992f267ba2e60932042754741f7f1e24c5181b1632189ab49a46c742a3a680b279aef7632fc4c0e31c
- SSDEEP 12288:7s3rTnJuvPsel0unojnD1F22AdMgQ5luq2G:7s/gfI22AqlLF
- TLSH T1AB058D2DE2B41454C13BD238D4138B16E6B1BC2897124ADB11B1F67E2E3BFF02979B59
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
22544
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
werconcpl.pdb
msvcrt
__CxxFrameHandler3
__CxxFrameHandler4
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
memcpy
memcmp
floorf
_errno
_CxxThrowException
_XcptFilter
_callnewh
_itow_s
_wtoi
bsearch
_wcsicmp
wcsncmp
_purecall
wcsnlen
wcsrchr
_vscwprintf
_vsnwprintf_s
free
malloc
wcsncpy_s
wcstol
realloc
memmove
ceilf
__C_specific_handler
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
memcpy_s
_vsnwprintf
??1type_info@@UEAA@XZ
memset
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
GetProcAddress
LoadResource
LoadStringW
GetModuleHandleExA
GetModuleHandleW
FindResourceExW
SizeofResource
GetModuleFileNameA
GetModuleFileNameW
FreeLibrary
GetModuleHandleExW
LoadLibraryExW
FreeLibraryAndExitThread
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockExclusive
DeleteCriticalSection
InitializeCriticalSection
AcquireSRWLockExclusive
OpenEventW
CreateMutexW
EnterCriticalSection
InitializeCriticalSectionEx
CreateEventW
ResetEvent
SetEvent
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
LeaveCriticalSection
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-core-processthreads-l1-1-0
TlsSetValue
OpenProcessToken
GetCurrentProcess
SetThreadPriority
CreateThread
TerminateProcess
TlsAlloc
TlsGetValue
GetCurrentThread
GetCurrentProcessId
TlsFree
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
GetLocaleInfoW
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringA
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
oleaut32
SysAllocString
SafeArrayUnaccessData
VariantInit
SafeArrayAccessData
SafeArrayGetUBound
VarUI4FromStr
SafeArrayGetLBound
SafeArrayGetDim
SysFreeString
VariantClear
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
CompareStringOrdinal
CompareStringW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegOpenKeyExW
RegCloseKey
RegEnumKeyExW
RegEnumValueW
RegDeleteValueW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
api-ms-win-core-synch-l1-2-0
SleepConditionVariableSRW
InitOnceBeginInitialize
InitOnceComplete
WakeAllConditionVariable
Sleep
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableLevel
GetTraceLoggerHandle
GetTraceEnableFlags
RegisterTraceGuidsW
TraceMessage
UnregisterTraceGuids
api-ms-win-core-com-l1-1-0
CoDisconnectObject
CoInitializeEx
PropVariantClear
CoTaskMemRealloc
CoUninitialize
CoTaskMemFree
StringFromGUID2
CoTaskMemAlloc
CoCreateInstance
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventSetInformation
EventActivityIdControl
EventRegister
EventUnregister
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
GetLocalTime
GetTickCount64
api-ms-win-core-datetime-l1-1-0
GetTimeFormatW
GetDateFormatW
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
SystemTimeToFileTime
api-ms-win-core-file-l1-1-0
FlushFileBuffers
FileTimeToLocalFileTime
CompareFileTime
FindFirstFileW
FindNextFileW
FindClose
GetLongPathNameW
GetFinalPathNameByHandleW
GetDriveTypeW
CreateFileW
WriteFile
SetFileInformationByHandle
CreateDirectoryW
GetFileAttributesW
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-security-base-l1-1-0
GetSidSubAuthorityCount
GetSidSubAuthority
GetTokenInformation
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-threadpool-l1-2-0
SubmitThreadpoolWork
CreateThreadpoolWork
WaitForThreadpoolWorkCallbacks
CloseThreadpoolWork
CloseThreadpoolWait
CreateThreadpoolWait
WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
api-ms-win-core-memory-l1-1-0
UnmapViewOfFile
api-ms-win-core-io-l1-1-0
GetOverlappedResult
CancelIoEx
api-ms-win-core-file-l2-1-0
ReadDirectoryChangesW
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-kernel32-legacy-l1-1-0
MulDiv
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-shlwapi-obsolete-l1-1-0
QISearch
StrCmpICW
StrCmpCW
ntdll
EtwLogTraceEvent
WinSqmAddToStream
EtwEventWriteTransfer
RtlSecondsSince1970ToTime
WinSqmIsOptedInEx
kernel32
LocalAlloc
DeactivateActCtx
CreateActCtxW
ReleaseActCtx
ActivateActCtx
framedynos
??4WBEMTime@@QEAAAEBV0@QEAG@Z
?GetSYSTEMTIME@WBEMTime@@QEBAHPEAU_SYSTEMTIME@@@Z
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
LaunchErcAppW
ShowCEIPDialogW
Name
.text
Size
312KB
Virtual Size
311KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
108KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
324KB
Virtual Size
320KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=82, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=24, id=260, version=33145,
count=13, id=257, version=33145,
count=16, id=261, version=33145,
count=660, id=1, productName=Unmarked objects,
count=48, id=264, version=33145,
count=1, id=256, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wercplsupport.dll
- IMPHASH ab1af4c91229cf7b34c4482536ec0453
- SHA256 299d1d93efd7beac1913b209551a893148246293bf374346bf4e4cf44784dc2a
- MD5 0940a61626b95cc12c34d5915eafe70b
- SHA1 242d175905417534b0c5e7bad28e14adc454a3bf
- SHA512 55fc72bcc65fcf86d73b7e8caa11eb029e2667673004c8e0ebd5ef2527303ea2b6349c2d260b9a8f4128f9d1c03a171b674a8f84e506161e830d6ac84a306be5
- SSDEEP 1536:94qwI3PbOCRIvqX2BzS3sPwpP3hD+7EtHYx8o+mZYUQdr+yu3URuN5L/61dDRMwX:9fPbOCSv43sPI34Q570yNRuN5L/AwwX
- TLSH T1DDD34B6F326410AAE166833885974745E7B1702877121BEF03E0D17D6F2BBE5AE38F85
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
6448
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wercplsupport.pdb
msvcrt
memmove
_onexit
__dllonexit
_unlock
_lock
__CxxFrameHandler3
__C_specific_handler
memcpy
_amsg_exit
_XcptFilter
free
_callnewh
malloc
memmove_s
memcpy_s
_vsnwprintf
_purecall
_wcsnicmp
memcmp
_initterm
_vscwprintf
_vsnwprintf_s
wcsnlen
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExA
GetProcAddress
GetModuleFileNameA
GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleHandleW
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-eventing-classicprovider-l1-1-0
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-security-base-l1-1-0
ImpersonateLoggedOnUser
GetTokenInformation
RevertToSelf
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetSidSubAuthorityCount
GetSidSubAuthority
api-ms-win-core-file-l1-1-0
GetTempFileNameW
SetFileInformationByHandle
FindFirstFileW
FindNextFileW
CreateDirectoryW
GetFinalPathNameByHandleW
GetFileAttributesW
FindClose
DeleteFileW
CreateFileW
GetLongPathNameW
api-ms-win-core-processthreads-l1-1-0
OpenProcessToken
GetCurrentThread
CreateThread
GetCurrentProcess
GetCurrentThreadId
TerminateProcess
OpenThreadToken
GetCurrentProcessId
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegCloseKey
RegGetValueW
api-ms-win-core-com-l1-1-0
CoDisconnectObject
CoInitializeEx
CoImpersonateClient
CoCreateInstance
CoRevokeClassObject
CoRegisterClassObject
CoRevertToSelf
CoUninitialize
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockExclusive
EnterCriticalSection
ReleaseMutex
AcquireSRWLockExclusive
LeaveCriticalSection
OpenSemaphoreW
DeleteCriticalSection
ReleaseSRWLockShared
CreateSemaphoreExW
WaitForSingleObjectEx
InitializeCriticalSectionEx
ReleaseSemaphore
CreateMutexExW
WaitForSingleObject
SetEvent
CreateEventW
AcquireSRWLockShared
oleaut32
BSTR_UserSize64
SysFreeString
BSTR_UserMarshal64
BSTR_UserFree64
SysAllocString
BSTR_UserMarshal
BSTR_UserUnmarshal
BSTR_UserSize
BSTR_UserFree
BSTR_UserUnmarshal64
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-file-l1-2-3
GetTempPath2W
api-ms-win-service-core-l1-1-0
SetServiceStatus
RegisterServiceCtrlHandlerExW
api-ms-win-core-threadpool-legacy-l1-1-0
UnregisterWaitEx
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer
ntdll
NtQueryInformationToken
NtDuplicateToken
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
wer
WerpGetUploadTime
WerpGetDynamicParameter
WerpCancelUpload
WerpGetSigParamByIndex
WerpGetWow64Process
WerpGetIntegratorReportId
WerpGetLoadedModuleByIndex
WerpGetNumFiles
WerpGetReportFinalConsent
WerpGetEventType
WerpGetFileByIndex
WerpGetReportType
WerpIsDisabled
WerpGetLegacyBucketId
WerpGetFilePathByIndex
WerpGetBucketId
WerpEnumerateStoreStart
WerpGetNumLoadedModules
WerpGetUIParamByIndex
WerpGetTextFromReport
WerpDeleteReport
WerpGetReportTime
WerpArchiveReport
WerpGetNumSigParams
WerpEnumerateStoreNext
WerpDestroyWerString
WerpCloseStore
WerReportCloseHandle
WerpOpenMachineArchive
WerpExtractReportFiles
WerpLoadReport
WerpOpenMachineQueue
WerpGetWerStringData
WerpGetReportInformation
diagnosticdatasettings
TelGetWerTelemetryMode
rpcrt4
NdrDllCanUnloadNow
NdrOleAllocate
NdrOleFree
NdrDllGetClassObject
api-ms-win-core-marshal-l1-1-0
HWND_UserFree64
HWND_UserSize64
HWND_UserSize
HWND_UserMarshal
HWND_UserUnmarshal64
HWND_UserMarshal64
HWND_UserFree
HWND_UserUnmarshal
DllCanUnloadNow
DllGetClassObject
ServiceMain
SvchostPushServiceGlobals
WerComGetAdminStores
Name
.text
Size
76KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=60, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=16, id=260, version=33145,
count=5, id=259, version=33145,
count=207, id=1, productName=Unmarked objects,
count=7, id=257, version=33145,
count=7, id=261, version=33145,
count=1, id=256, version=33145,
count=14, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
werdiagcontroller.dll
- IMPHASH 522f4c19a8298ce57e4b5d466819dd5f
- SHA256 cdfb30d18a94fdea09ff82c1cada35b36c5b0bd347c6831b25ae6a86231987b9
- MD5 251f8fe68045b92335216e741a5068ae
- SHA1 a2f9689fe8cde013c563e35c12ba12af0aafbca9
- SHA512 2f415fcd0fcff0d97475bf573d773643829811f37609d694414516c3cf54f1f9f48fd13b10a104a79d0a8e4783e76d7c73885e0ef64538059f737b888e3e86dd
- SSDEEP 768:PqQFEJLF5BozHAXSEq6v2FWZC89ivbXsk74KKM80+qFKvE0dS1kJwjhyniSinfJV:P5EJLvBcdakfIF35gVqTo
- TLSH T1F273F82C37A52698E5BB4239B9B90BE1B0B6B421172086FF15D0C23C4E35BF49D75F86
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5056
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WerDiagController.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___stdio_common_vswprintf
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
memmove
_o__wcsicmp
_o__wcsnicmp
_o__wtoi
_o_free
_o_isspace
_o_malloc
__C_specific_handler
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__CxxFrameHandler4
wcschr
__CxxFrameHandler3
_CxxThrowException
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetProcessId
TerminateProcess
GetCurrentProcess
CreateProcessW
GetCurrentProcessId
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemDirectoryW
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameW
GetModuleHandleExA
GetProcAddress
ntdll
RtlFreeUnicodeString
RtlInitUnicodeString
EtwEventWriteNoRegistration
ZwUpdateWnfStateData
RtlFormatCurrentUserKeyPath
NtClose
DbgPrintEx
NtWaitForSingleObject
NtOpenEvent
RtlAllocateAndInitializeSid
NtAlpcConnectPort
NtAlpcSendWaitReceivePort
ZwQueryWnfStateNameInformation
NtDeleteKey
NtDelayExecution
LdrGetDllHandle
RtlInitAnsiString
LdrGetProcedureAddress
RtlFreeSid
NtDeleteValueKey
RtlGUIDFromString
RtlDosPathNameToNtPathName_U
NtDeleteFile
NtOpenKey
NtQueryValueKey
NtSetValueKey
NtQueryInformationProcess
LdrDisableThreadCalloutsForDll
RtlCreateUserThread
NtQuerySystemInformation
api-ms-win-core-windowserrorreporting-l1-1-0
WerRegisterFile
api-ms-win-core-memory-l1-1-0
ReadProcessMemory
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-synch-l1-1-0
SetEvent
OpenEventW
CreateEventW
WaitForSingleObject
api-ms-win-core-file-l1-2-3
GetTempPath2W
api-ms-win-core-file-l1-1-0
GetTempFileNameW
CreateFileW
DeleteFileW
api-ms-win-eventing-classicprovider-l1-1-0
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
TraceEvent
api-ms-win-eventing-controller-l1-1-0
StartTraceW
api-ms-win-eventing-legacy-l1-1-0
EnableTrace
QueryOriginalBucket
StartAppRecorder
StartFDR
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=43, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1146, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=22, id=261, version=33145,
count=1, id=256, version=33145,
count=8, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
weretw.dll
- IMPHASH be727c7b9f04e37427ac17b2d7c5f62d
- SHA256 9a574af9d637295c07f9b962cd207d9567142f44fec54161871a83238815dcf3
- MD5 ab4f7f189d933a04c07bd55676822f24
- SHA1 4620c9ccfa2218893d290545c09632382c184ef4
- SHA512 275adb52ed4ceb13cd6b227b91b24d44c8cee42c1a8937ffd723ad6f0bd91b3493b494752d9cf8b3c6770cd67acd8a0670489d3ff2670b507950262067a0b5ac
- SSDEEP 6144:A8BBkd6n2z+hF/wZctkX6LF/Lf7voZuQc276/x:9Bkd7+7actkX6LF77wZuQrqx
- TLSH T1A2445D5A62A808A6EA76D17C85578A0EF7F1F4111321D3DF42E0827E1F27FE96D38B50
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
8f:17:e2:c7:b0:64:ac:60:6d:16:40:f5:28:43:55:ae:ab:40:12:a0:b1:fd:0c:84:81:77:ec:d5:b0:ed:6b:f7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6B05-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:11:45:18:39:9b:43:cf:fc:6c:00:01:00:00:02:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
6192
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WerEtw.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__gmtime64
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__memicmp
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
_o__stricmp
memmove
_o__ultow_s
_o__wcsicmp
_o__wcslwr_s
_o__wcsnicmp
_o__wtoi
_o_calloc
_o_ceilf
_o_free
_o_iswdigit
_o_malloc
_o_realloc
_o_terminate
_o_towlower
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstol
_o_wmemcpy_s
__current_exception
__current_exception_context
_CxxThrowException
_o__execute_onexit_table
_o__errno
_o__crt_atexit
wcsstr
strrchr
wcsrchr
wcschr
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__C_specific_handler
__CxxFrameHandler4
__C_specific_handler_noexcept
memchr
memcpy
api-ms-win-crt-string-l1-1-0
wcsspn
wcscmp
memset
wcsncmp
wcsnlen
wcscspn
oleaut32
SysAllocString
SysFreeString
api-ms-win-core-synch-l1-1-0
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
CreateMutexExW
CreateSemaphoreExW
ReleaseSemaphore
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
WaitForSingleObject
DeleteCriticalSection
api-ms-win-core-errorhandling-l1-1-0
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
GetLastError
api-ms-win-core-com-l1-1-0
CoInitializeEx
CoUninitialize
CoCreateGuid
StringFromGUID2
CoCreateInstance
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThread
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
GetExitCodeProcess
TerminateProcess
CreateProcessW
api-ms-win-core-sysinfo-l1-1-0
GetSystemDirectoryW
GetSystemWindowsDirectoryW
GetVersionExW
GetSystemTimeAsFileTime
GetWindowsDirectoryW
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetProcAddress
SizeofResource
LoadLibraryExW
GetModuleFileNameA
GetModuleHandleW
LoadResource
FreeLibrary
FindResourceExW
LockResource
DisableThreadLibraryCalls
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-eventing-consumer-l1-1-0
OpenTraceW
CloseTrace
ProcessTrace
api-ms-win-eventing-classicprovider-l1-1-0
RegisterTraceGuidsW
TraceEvent
UnregisterTraceGuids
api-ms-win-eventing-controller-l1-1-0
ControlTraceW
StartTraceW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
api-ms-win-core-registry-l1-1-0
RegEnumKeyExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegEnumValueW
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
api-ms-win-core-file-l1-1-0
WriteFile
GetFileAttributesW
CreateDirectoryW
FindVolumeClose
SetFilePointerEx
SetFilePointer
GetFinalPathNameByHandleW
FindNextVolumeW
CreateFileW
ReadFile
DeleteFileW
GetFullPathNameW
FindNextFileW
FindFirstFileW
GetFileSize
QueryDosDeviceW
FindFirstVolumeW
GetTempFileNameW
FindClose
api-ms-win-core-file-l1-2-0
GetTempPathW
GetVolumePathNamesForVolumeNameW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-memory-l1-1-0
CreateFileMappingW
MapViewOfFileEx
UnmapViewOfFile
api-ms-win-core-wow64-l1-1-0
IsWow64Process
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
api-ms-win-core-version-l1-1-0
VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
api-ms-win-core-libraryloader-l1-2-1
FindResourceW
api-ms-win-core-file-l2-1-2
CopyFileW
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-heap-l1-1-0
HeapFree
HeapSize
GetProcessHeap
HeapAlloc
HeapDestroy
HeapReAlloc
bcrypt
BCryptCreateHash
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptFinishHash
BCryptHashData
BCryptCloseAlgorithmProvider
BCryptDestroyHash
ntdll
RtlAcquireSRWLockExclusive
RtlReleaseSRWLockExclusive
RtlGetVersion
RtlImageRvaToVa
RtlImageDirectoryEntryToData
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
WerMergeEtl
WerMergeEtlEx
Name
.text
Size
164KB
Virtual Size
163KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=81, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=26, id=261, version=33145,
count=1224, id=1, productName=Unmarked objects,
count=4, id=257, version=33145,
count=1, id=256, version=33145,
count=22, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wersvc.dll
- IMPHASH 8e80b5d61619ca920e74c0a9e0a2680e
- SHA256 d0807b49ec9f278438d9506255cc1b887e1c1b70e38f280db36255438bb2ef70
- MD5 3f87956dd64fe3c34adebaa8a2fba7ad
- SHA1 d4dd2c5e2517439febe3e37efe5f53dee96085e5
- SHA512 6f7bd6cf8b7182fca3e394aa856a2c09ac6dacada1520729ad96b66ef28a6047959f0b1f5764fd56c3d0a82bfac94b231abb660608b4d165b5c8c5bee14fb7e8
- SSDEEP 6144:EznSfOVAe3Q6XwVcGPWr+7FXHAmDlpLlHh20fGhcP5gRgbBB:jfOV/XwRPl7Jvj+ZgbB
- TLSH T17C645B2D62F910A9E4B7C37889528621EBB2703927129ADF01E0C47C7F17EF46A79F51
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
10688
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WerSvc.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsicmp
_o__wcsnicmp
memmove
_o_free
_o_malloc
_o_terminate
_o_towlower
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstol
_o_wcstoul
__C_specific_handler
__CxxFrameHandler3
__current_exception
__current_exception_context
_CxxThrowException
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnwprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
LoadLibraryExW
GetModuleFileNameA
DisableThreadLibraryCalls
GetModuleHandleExA
FreeLibrary
GetModuleFileNameW
GetProcAddress
GetModuleHandleExW
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventWriteTransfer
EventUnregister
EventSetInformation
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetThreadId
DeleteProcThreadAttributeList
OpenThread
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
OpenThreadToken
GetExitCodeProcess
GetProcessId
GetCurrentThread
CreateThread
CreateProcessW
OpenProcessToken
GetProcessTimes
CreateProcessAsUserW
ResumeThread
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
ProcessIdToSessionId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
WideCharToMultiByte
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemDirectoryW
GetSystemInfo
GetLocalTime
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
GetLastError
api-ms-win-core-processthreads-l1-1-1
OpenProcess
IsProcessorFeaturePresent
SetProcessMitigationPolicy
api-ms-win-core-synch-l1-1-0
AcquireSRWLockShared
EnterCriticalSection
AcquireSRWLockExclusive
InitializeCriticalSectionEx
DeleteCriticalSection
SetEvent
OpenSemaphoreW
OpenEventW
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSRWLockShared
WaitForSingleObject
ResetEvent
CreateEventW
CreateMutexExW
CreateSemaphoreExW
WaitForSingleObjectEx
WaitForMultipleObjectsEx
CreateMutexW
ReleaseSemaphore
LeaveCriticalSection
api-ms-win-security-base-l1-1-0
AdjustTokenPrivileges
GetKernelObjectSecurity
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ImpersonateLoggedOnUser
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
DuplicateTokenEx
SetTokenInformation
CreateRestrictedToken
AllocateAndInitializeSid
CheckTokenMembership
DuplicateToken
CreateWellKnownSid
GetSidIdentifierAuthority
GetSecurityDescriptorOwner
EqualSid
FreeSid
SetKernelObjectSecurity
RevertToSelf
api-ms-win-core-registry-l1-1-0
RegEnumKeyExW
RegOpenKeyExW
RegGetValueW
RegCreateKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegCloseKey
api-ms-win-core-file-l1-1-0
CreateDirectoryW
SetFileInformationByHandle
FlushFileBuffers
WriteFile
ReadFile
SetFilePointerEx
GetFileSizeEx
FindNextFileW
FindFirstFileW
FindClose
GetLongPathNameW
GetFinalPathNameByHandleW
SetFileAttributesW
GetFileAttributesW
CreateFileW
api-ms-win-core-wow64-l1-1-1
IsWow64Process2
GetSystemWow64DirectoryW
GetSystemWow64Directory2W
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
K32GetModuleFileNameExW
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolCleanupGroup
CreateThreadpoolTimer
CloseThreadpoolCleanupGroupMembers
TrySubmitThreadpoolCallback
WaitForThreadpoolWaitCallbacks
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolWait
SetThreadpoolTimer
CloseThreadpoolWait
SetThreadpoolWait
LeaveCriticalSectionWhenCallbackReturns
CreateThreadpoolCleanupGroup
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
Sleep
api-ms-win-core-version-l1-1-0
VerQueryValueW
GetFileVersionInfoSizeExW
GetFileVersionInfoExW
api-ms-win-core-memory-l1-1-0
MapViewOfFile
ReadProcessMemory
UnmapViewOfFile
CreateFileMappingW
api-ms-win-core-sysinfo-l1-2-0
GetNativeSystemInfo
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
api-ms-win-core-path-l1-1-0
PathCchRemoveFileSpec
PathCchRemoveBackslash
api-ms-win-core-processthreads-l1-1-3
GetProcessInformation
SetProcessInformation
api-ms-win-core-file-l1-2-3
GetTempPath2W
rpcrt4
UuidFromStringW
UuidCreate
NdrClientCall3
RpcStringFreeW
RpcExceptionFilter
RpcStringBindingComposeW
RpcBindingFree
RpcBindingFromStringBindingW
api-ms-win-core-localization-obsolete-l1-2-0
GetUserDefaultUILanguage
ntdll
EtwUnregisterTraceGuids
EtwGetTraceEnableFlags
EtwTraceMessage
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwRegisterTraceGuidsW
RtlAllocateHeap
NtAlpcCancelMessage
NtTerminateThread
NtClose
NtWaitForSingleObject
NtQueryInformationToken
RtlSecondsSince1970ToTime
wcschr
NtQueryInformationProcess
NtQuerySystemInformation
RtlInitUnicodeString
NtCreateFile
EtwCheckCoverage
wcsnlen
wcsspn
NtAlpcOpenSenderProcess
NtAlpcOpenSenderThread
RtlCreateBoundaryDescriptor
RtlCreateServiceSid
RtlAddSIDToBoundaryDescriptor
RtlDeleteBoundaryDescriptor
NtAlpcCreatePort
NtOpenEvent
NtAlpcConnectPort
NtAlpcSendWaitReceivePort
NtAlpcAcceptConnectPort
NtTerminateProcess
AlpcInitializeMessageAttribute
AlpcGetMessageAttribute
RtlCompareUnicodeString
RtlNtStatusToDosErrorNoTeb
NtDuplicateToken
NtSetSystemInformation
NtSetInformationProcess
wcsrchr
RtlSetThreadErrorMode
RtlFreeHeap
diagnosticdatasettings
TelGetWerTelemetryMode
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-wow64-l1-1-0
IsWow64Process
api-ms-win-core-namespace-l1-1-0
ClosePrivateNamespace
OpenPrivateNamespaceW
CreatePrivateNamespaceW
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-file-l2-1-0
CopyFileExW
MoveFileExW
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-processsnapshot-l1-1-0
PssDuplicateSnapshot
api-ms-win-core-threadpool-legacy-l1-1-0
UnregisterWaitEx
windowsperformancerecordercontrol
WPRCReleaseInstanceByName
WPRCDisableBuiltinProfiles
WPRCCreateInstanceUnderInstanceName
api-ms-win-core-kernel32-legacy-l1-1-0
MoveFileW
weretw
WerMergeEtlEx
ServiceMain
SvchostPushServiceGlobals
Name
.text
Size
232KB
Virtual Size
230KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
64KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
576B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
844B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=257, version=33145,
count=109, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1433, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=17, id=260, version=33145,
count=5, id=259, version=33145,
count=29, id=261, version=33145,
count=1, id=256, version=33145,
count=36, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
werui.dll
- IMPHASH 524ca2f0902c91fbdada47ca1f2153a0
- SHA256 3fa7731bd5fabc30c112448cdf6cdfedc58f372d186bdf41b45216ad6e8892c8
- MD5 d9bcae41b153126b7cc7ed82c0c22aa2
- SHA1 41474a53f081a7b498dbe08213230682bd0da23d
- SHA512 71a29d37177b75e0fc855dc159d31e6c751e2cd75383911dd5567b88552b73116f040c9c425a6160014580131c8356f06d8816a82cf55c053c92e8a6723b001d
- SSDEEP 3072:co+3AmUEQlg3JrxuGPyD/+rLedNJKbOdb3MpFpFJ+yC3pwRb6JPqB604HHy7hRCI:MUNKJrxuGPKWrmVcTgVJyB60OHyLC7v
- TLSH T192347C1DB2A520B5C46AC278D4834725FB72B82527160BDF02E4C63D2F237E9BD36E65
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7440
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WerUi.pdb
msvcrt
_vscwprintf
wcstol
_purecall
_wtoi
__CxxFrameHandler3
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
_vsnwprintf_s
wcsnlen
??1exception@@UEAA@XZ
_wcsnicmp
_XcptFilter
_vsnwprintf
__CxxFrameHandler4
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_wcsicmp
memcpy_s
wcschr
_CxxThrowException
memcpy
memmove
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_callnewh
memset
wer
WerpGetReportSettings
WerReportCloseHandle
WerpGetReportType
WerReportSetUIOption
WerpGetUIParamByIndex
WerpIsTransportAvailable
WerpSetReportFlags
WerpGetFileByIndex
WerpGetDynamicParameter
WerpGetReportInformation
WerpIsDisabled
WerpGetNumSigParams
WerReportCreate
WerpGetSigParamByIndex
WerpGetNumFiles
WerpGetReportFlags
WerpGetEventType
advapi32
GetSidSubAuthorityCount
GetSidSubAuthority
RegGetValueW
OpenProcessToken
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
EventWriteTransfer
GetTokenInformation
TraceMessage
EventSetInformation
EventUnregister
EventRegister
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
kernel32
LeaveCriticalSection
EnterCriticalSection
DelayLoadFailureHook
ResolveDelayLoadedAPI
GetFinalPathNameByHandleW
FreeLibraryAndExitThread
CreateFileW
GetLongPathNameW
GetFileAttributesW
SetFileInformationByHandle
FormatMessageW
HeapAlloc
GetProcessHeap
GetModuleHandleExA
IsDebuggerPresent
MapViewOfFile
CreateFileMappingW
FindFirstFileW
FindNextFileW
OpenThread
GetThreadContext
OpenProcess
FindFirstFileExW
CompareFileTime
CreateProcessW
GetModuleHandleW
CreateMutexExW
DeviceIoControl
GetProcessTimes
QueryFullProcessImageNameW
FindClose
InitializeCriticalSectionEx
DeleteCriticalSection
IsWow64Process
ExpandEnvironmentStringsW
WideCharToMultiByte
WaitForMultipleObjectsEx
OpenSemaphoreW
OutputDebugStringW
ReleaseMutex
DebugBreak
ReleaseSemaphore
CreateSemaphoreExW
DisableThreadLibraryCalls
Sleep
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
UnmapViewOfFile
WaitForMultipleObjects
GetCurrentProcess
TerminateProcess
GetLastError
CompareStringOrdinal
LoadLibraryW
FreeLibrary
GetProcAddress
GetTickCount64
CreateActCtxW
ActivateActCtx
ReleaseActCtx
SetEvent
GetSystemDirectoryW
LoadLibraryExW
DeactivateActCtx
GetProcessId
SetLastError
AttachConsole
GetConsoleWindow
FreeConsole
GetModuleFileNameA
ResetEvent
WaitForSingleObjectEx
WaitForSingleObject
CreateThread
HeapFree
CreateEventW
DuplicateHandle
CloseHandle
GetModuleHandleExW
comctl32
ord412
TaskDialogIndirect
ord410
ord413
user32
LoadStringW
LoadMenuW
GetSubMenu
SetMenuDefaultItem
TrackPopupMenuEx
DestroyMenu
EndDialog
GetSysColor
ChangeWindowMessageFilter
GetWindowBand
GetMonitorInfoW
MonitorFromRect
DrawAnimatedRects
CheckWindowThreadDesktop
ChangeDisplaySettingsW
EnableMenuItem
FlashWindowEx
shell32
SHCreateDirectoryExW
Shell_NotifyIconW
ExtractIconExW
ShellExecuteExW
dbghelp
MiniDumpWriteDump
ntdll
ZwQueryWnfStateNameInformation
ZwUpdateWnfStateData
EtwEventWriteNoRegistration
NtQuerySystemInformation
NtOpenEvent
NtWaitForSingleObject
RtlAllocateAndInitializeSid
NtQueryInformationToken
NtAlpcConnectPort
NtAlpcSendWaitReceivePort
RtlFreeSid
NtClose
RtlNtStatusToDosError
NtSuspendProcess
NtResumeProcess
RtlInitUnicodeString
imagehlp
SymSetExtendedOption
SymFunctionTableAccess64
SymGetModuleInfoW64
StackWalk64
SymGetModuleBase64
SymCleanup
SymInitialize
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
diagnosticdatasettings
TelGetWerTelemetryMode
dui70
?OnPropertyChanged@CCBase@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?DirectionProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?OnDestroy@HWNDHost@DirectUI@@UEAAXXZ
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnEvent@HWNDHost@DirectUI@@UEAAXPEAUEvent@2@@Z
?Paint@HWNDHost@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z
?Add@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?Insert@Element@DirectUI@@UEAAJPEAPEAV12@II@Z
?Remove@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?GetAdjacent@Element@DirectUI@@UEAAPEAV12@PEAV12@HPEBUNavReference@2@K@Z
?EnsureVisible@Element@DirectUI@@UEAA_NHHHH@Z
?SetKeyFocus@HWNDHost@DirectUI@@UEAAXXZ
?AddBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
?RemoveBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
?MessageCallback@HWNDHost@DirectUI@@UEAAIPEAUtagGMSG@@@Z
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UEAAXPEAUtagRECT@@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MEAAXHH@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?OnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z
?OnPropertyChanged@Element@DirectUI@@UEAAXPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnGroupChanged@Element@DirectUI@@UEAAXH_N@Z
?OnInput@Element@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?OnInput@CCBase@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?OnUnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z
?GetKeyFocused@HWNDHost@DirectUI@@UEAA_NXZ
?GetAccessibleImpl@HWNDHost@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
?GetUIAElementProvider@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?GetElementProviderImpl@Element@DirectUI@@UEAAJPEAVInvokeHelper@2@PEAPEAVElementProvider@2@@Z
?GetContentStringAsDisplayed@Element@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z
?HandleUiaPropertyListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@@Z
?HandleUiaEventListener@Element@DirectUI@@UEAAXPEAUEvent@2@@Z
?GetUiaFocusDelegate@Element@DirectUI@@UEAAPEAV12@XZ
?OnKeyFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?OnMessage@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnSysChar@HWNDHost@DirectUI@@UEAA_NG@Z
?OnSinkThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnCtrlThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnWindowStyleChanged@HWNDHost@DirectUI@@UEAAX_KPEBUtagSTYLESTRUCT@@@Z
?OnAdjustWindowSize@HWNDHost@DirectUI@@UEAAHHHI@Z
?SetWindowDirection@HWNDHost@DirectUI@@UEAAXPEAUHWND__@@@Z
?CreateAccNameLabel@HWNDHost@DirectUI@@IEAAPEAUHWND__@@PEAU3@@Z
?CreateHWND@CCBase@DirectUI@@UEAAPEAUHWND__@@PEAU3@@Z
?EraseBkgnd@HWNDHost@DirectUI@@MEAA_NPEAUHDC__@@PEA_J@Z
?OnCustomDraw@CCBase@DirectUI@@UEAA_NPEAUtagNMCUSTOMDRAWINFO@@PEA_J@Z
?OnLostDialogFocus@CCBase@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z
?OnReceivedDialogFocus@CCBase@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z
?Initialize@HWNDHost@DirectUI@@QEAAJIIPEAVElement@2@PEAK@Z
?Destroy@Element@DirectUI@@QEAAJ_N@Z
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?GetByClassIndex@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?GetPICount@ClassInfoBase@DirectUI@@UEBAIXZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UEBAIXZ
?GetClassInfoPtr@CCBase@DirectUI@@SAPEAUIClassInfo@2@XZ
?GetName@ClassInfoBase@DirectUI@@UEBAPEBGXZ
?IsValidProperty@ClassInfoBase@DirectUI@@UEBA_NPEBUPropertyInfo@2@@Z
?IsSubclassOf@ClassInfoBase@DirectUI@@UEBA_NPEAUIClassInfo@2@@Z
??1CCBase@DirectUI@@UEAA@XZ
?GetModule@ClassInfoBase@DirectUI@@UEBAPEAUHINSTANCE__@@XZ
?IsGlobal@ClassInfoBase@DirectUI@@UEBA_NXZ
?AddChild@ClassInfoBase@DirectUI@@UEAAXXZ
?RemoveChild@ClassInfoBase@DirectUI@@UEAAXXZ
?GetChildren@ClassInfoBase@DirectUI@@UEBAHXZ
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UEBAXXZ
?Initialize@ClassInfoBase@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG_NPEBQEBUPropertyInfo@2@I@Z
?Register@ClassInfoBase@DirectUI@@QEAAJXZ
??1ClassInfoBase@DirectUI@@UEAA@XZ
InitThread
InitProcessPriv
CreateDUIWrapper
UnInitThread
UnInitProcessPriv
?OnNotify@CCBase@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnMouseFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
??0HWNDHost@DirectUI@@QEAA@XZ
?Release@ClassInfoBase@DirectUI@@UEAAHXZ
?AddRef@ClassInfoBase@DirectUI@@UEAAXXZ
??0ClassInfoBase@DirectUI@@QEAA@XZ
?ClassExist@ClassInfoBase@DirectUI@@SA_NPEAPEAUIClassInfo@2@PEBQEBUPropertyInfo@2@IPEAU32@PEAUHINSTANCE__@@PEBG_N@Z
?GetFactoryLock@Element@DirectUI@@SAPEAU_RTL_CRITICAL_SECTION@@XZ
?EndDefer@Element@DirectUI@@QEAAXK@Z
?Register@CCBase@DirectUI@@SAJXZ
?_ZeroRelease@Value@DirectUI@@AEAAXXZ
?FontSizeProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?SetValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@@Z
?CreateInt@Value@DirectUI@@SAPEAV12@HW4DynamicScaleValue@@@Z
?WidthProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?HeightProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?HandleUiaDestroyListener@Element@DirectUI@@UEAAXXZ
WerUICreate
WerUIDelete
WerUIGetUserSelection
WerUIPromptForSecondLevel
WerUIPromptUser
WerUIReportSilentProcessExit
WerUIShowUpsell
WerUIStart
WerUITerminate
WerUIUpdateStateProgress
WerUIUpdateUIForState
WerUIWaitForUserAction
WerUIpCheckWindow
WerUIpDefSubclassProc
WerUIpHeadlessOrImersive
WerUIpRemoveWindowSubclass
WerUIpSetWindowSubclass
WerUIpTaskDialogIndirect
WerUIpUIHandleWERWindowMsg
Name
.text
Size
96KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
36KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
336B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
80KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
560B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=19, id=260, version=33145,
count=5, id=259, version=33145,
count=365, id=1, productName=Unmarked objects,
count=9, id=257, version=33145,
count=12, id=261, version=33145,
count=1, id=256, version=33145,
count=24, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wevtapi.dll
- IMPHASH 866a3b3ac2a2cc9a91e29ccf91bf17c3
- SHA256 b8936bc13c91090f147cbfc9627c75936de3fcb5e0a67806a76ede9ae360ff44
- MD5 414490a15cffc4356d65fb91ab8b4ef8
- SHA1 35eb0e80f9badf5ed4e8413d298a53676cc646b0
- SHA512 e4741fe31b968f8d2265bfb31847b672dfafe0969ca661f6d5dddfd8a54940a109cd20ef0e25a9563c80975307579e05db9bac30fb786ead5bdbe0a6bc95b576
- SSDEEP 6144:asJ9KosHSgt9qsvbkElbBsb2QGapgO4CWRL2utQ3Jwfu:aJHSQUobBsb2QGaYCWRT+Zwfu
- TLSH T1C8747D3DA7A814A5E4B6C17CC582870AF6B238559B2157CF02B086397F37FF49A35B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
98:e2:a3:ec:72:7b:10:4d:7b:e3:a6:bb:16:f5:ae:28:08:39:c9:70:1b:29:2e:17:95:6c:c4:2c:9f:4a:4c:9d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:591A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:14:8d:cd:23:44:ee:06:df:72:00:01:00:00:02:14
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
142656
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wevtapi.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__ui64tow_s
_o__ultow_s
_o__wcsnicmp
_o__wcstoui64
_o__wtof
_o__wtoi
_o__wtoi64
_o__wtol
_o_free
_o_iswalnum
_o_iswalpha
_o_iswspace
_o_strncpy_s
_o_terminate
_o_wcscpy_s
__C_specific_handler
__current_exception
__current_exception_context
_o__configure_narrow_argv
_o__cexit
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o___std_type_info_destroy_list
_o__crt_atexit
wcschr
__std_terminate
__CxxFrameHandler4
_CxxThrowException
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
strnlen
wcsnlen
ntdll
RtlCaptureContext
EtwUnregisterTraceGuids
RtlLookupFunctionEntry
RtlVirtualUnwind
EtwGetTraceEnableFlags
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwRegisterTraceGuidsW
EtwTraceMessage
NtSetInformationFile
RtlComputeCrc32
NtWriteFile
NtReadFile
RtlNtStatusToDosError
RtlSetLastWin32Error
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-synch-l1-1-0
WaitForSingleObject
CreateEventW
ResetEvent
CreateSemaphoreExW
EnterCriticalSection
ReleaseSemaphore
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
LeaveCriticalSection
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseSRWLockShared
CreateMutexExW
AcquireSRWLockShared
DeleteCriticalSection
SetEvent
InitializeCriticalSectionEx
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-file-l1-1-0
GetVolumePathNameW
CreateFileW
GetFileInformationByHandle
SetFilePointerEx
GetTempFileNameW
GetFileType
GetFullPathNameW
ReadFile
GetFileAttributesW
SetFileInformationByHandle
GetFileSizeEx
FlushFileBuffers
GetDiskFreeSpaceExW
GetDriveTypeW
GetFinalPathNameByHandleW
api-ms-win-core-localization-l1-2-0
GetThreadUILanguage
GetLocaleInfoW
FormatMessageW
GetThreadLocale
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventRegister
EventUnregister
EventWriteTransfer
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolCleanupGroupMembers
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
CloseThreadpoolCleanupGroup
TrySubmitThreadpoolCallback
SetThreadpoolWait
CreateThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
CreateThreadpoolCleanupGroup
api-ms-win-core-processthreads-l1-1-0
TlsGetValue
GetCurrentThreadId
GetCurrentProcessId
TlsFree
GetCurrentProcess
TlsSetValue
TerminateProcess
TlsAlloc
api-ms-win-security-base-l1-1-0
GetLengthSid
IsValidSid
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
Sleep
SleepConditionVariableSRW
WakeAllConditionVariable
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExA
GetModuleFileNameA
GetProcAddress
GetModuleHandleW
GetModuleHandleExW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
CompareStringOrdinal
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
SystemTimeToFileTime
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-realtime-l1-1-0
QueryUnbiasedInterruptTime
api-ms-win-core-file-l2-1-0
MoveFileExW
ReOpenFile
GetFileInformationByHandleEx
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
EvtArchiveExportedLog
EvtCancel
EvtClearLog
EvtClose
EvtCreateBookmark
EvtCreateRenderContext
EvtExportLog
EvtFormatMessage
EvtGetChannelConfigProperty
EvtGetEventInfo
EvtGetEventMetadataProperty
EvtGetExtendedStatus
EvtGetLogInfo
EvtGetObjectArrayProperty
EvtGetObjectArraySize
EvtGetPublisherMetadataProperty
EvtGetQueryInfo
EvtIntAssertConfig
EvtIntCreateBinXMLFromCustomXML
EvtIntCreateLocalLogfile
EvtIntGetClassicLogDisplayName
EvtIntRenderResourceEventTemplate
EvtIntReportAuthzEventAndSourceAsync
EvtIntReportEventAndSourceAsync
EvtIntRetractConfig
EvtIntSysprepCleanup
EvtIntWriteXmlEventToLocalLogfile
EvtNext
EvtNextChannelPath
EvtNextEventMetadata
EvtNextPublisherId
EvtOpenChannelConfig
EvtOpenChannelEnum
EvtOpenEventMetadataEnum
EvtOpenLog
EvtOpenPublisherEnum
EvtOpenPublisherMetadata
EvtOpenSession
EvtQuery
EvtRender
EvtSaveChannelConfig
EvtSeek
EvtSetChannelConfigProperty
EvtSubscribe
EvtUpdateBookmark
Name
.text
Size
248KB
Virtual Size
246KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=59, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1228, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=21, id=261, version=33145,
count=1, id=256, version=33145,
count=69, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wevtfwd.dll
- IMPHASH 104131159769aa05b709ce4b23d28b1a
- SHA256 090404a20119c130043639fea368240c342cf6c90c6d30ba9167805e1d5a9cf8
- MD5 d8ff873669807fec40dcbeba501f7e34
- SHA1 deca7ddb857326e940aab49893e77e330a882566
- SHA512 43458a840497f9063eafe1d4484ecc8958a51e0090215af6edf9e451449a02605cc29405d8cfa9c3d236a1271042a76c0f659f24847bcd3d0b6264056f79599d
- SSDEEP 3072:HHB4u/TMHiZsnf3zFp0OwZHIeZn+gmbeBR5LcW:nB4uLMHwsnfBp0OwZHIO+kRFc
- TLSH T141C33A3A77AC1176D0B2C1BD8AA68A16D77178295B3153DF01A0C27D1F27FE49D32B22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5472
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wevtfwd.pdb
msvcrt
_vsnwprintf
_wcstoui64
swprintf_s
?terminate@@YAXXZ
_onexit
__dllonexit
memset
??1type_info@@UEAA@XZ
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
memmove
memcpy
__CxxFrameHandler3
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
wcsncpy_s
_itow
_wcsnicmp
iswspace
_wcsicmp
malloc
free
_purecall
_lock
__CxxFrameHandler4
_unlock
wcscmp
ntdll
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
kernel32
GetSystemTime
GetThreadLocale
WaitForSingleObject
CreateThread
GetComputerNameExW
GetComputerNameW
HeapAlloc
HeapFree
GetCurrentThread
CloseHandle
DisableThreadLibraryCalls
LocalFree
FormatMessageW
InitializeCriticalSectionEx
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
LoadLibraryExW
FreeLibrary
GetTickCount
Sleep
CreateEventW
GetThreadPriority
SetThreadPriority
WaitForMultipleObjects
RegisterWaitForSingleObject
SetEvent
UnregisterWaitEx
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LocaleNameToLCID
GetProcessHeap
advapi32
RegisterTraceGuidsW
RegNotifyChangeKeyValue
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueExW
EventWrite
EventRegister
EventUnregister
RegEnumValueW
GetTraceLoggerHandle
TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
UnregisterTraceGuids
OpenThreadToken
SetThreadToken
RegCloseKey
RegOpenKeyExW
wsmsvc
WSManConstructError
WSManDecodeObject
WSManCloseObjectHandle
WSManAddSubscriptionManagerInternal
WSManRemoveSubscriptionManagerInternal
WSManEncodeObject
WSManEnumeratorAddEvent
WSManClosePublisherHandle
WSManDeliverEndSubscriptionNotification
WSManDeliverEvent
wevtapi
EvtNext
EvtQuery
EvtOpenPublisherMetadata
EvtSeek
EvtClose
EvtCreateRenderContext
EvtSubscribe
EvtCreateBookmark
EvtUpdateBookmark
EvtGetQueryInfo
EvtRender
EvtFormatMessage
rpcrt4
RpcStringFreeW
UuidCreate
UuidToStringW
userenv
UnregisterGPNotification
RegisterGPNotification
WSManPluginShutdown
WSManPluginStartup
WSManProvPullEvents
WSManProvSubscribe
WSManProvUnsubscribe
Name
.text
Size
64KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
668B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33138,
count=4, id=259, version=33138,
count=134, id=1, productName=Unmarked objects,
count=17, id=257, version=33138,
count=5, id=261, version=33138,
count=1, id=256, version=33138,
count=23, id=264, version=33138,
count=1, id=255, version=33138,
count=1, id=258, version=33138,
wevtsvc.dll
- IMPHASH dda57bc21a4d652e50de74617eb3d491
- SHA256 16f4b7d71e88f011efdf4bc91550cbb75c3f7f3697c2d74bf86463a618d2a25d
- MD5 3206a399eea77d1ba7c3386548913d89
- SHA1 f1fe833b75690bffc26d1155362f588d9f20607e
- SHA512 c78923a8a6d826f5f6f758f7c2dc95cf6f04dd7a355ef820aff5c4dd66fe9969c0d7f9735cfdfeab90db312463f02772a80f8bee142828a326115bea243e415c
- SSDEEP 24576:a2DdE6Mpt2PibuExVP10tf1s0gzXFh54GgayBY:a2DO6KAPibuEzPyR1ngzH54GgayBY
- TLSH T1DD458E2EA3EC01B5D0BAC1B9C552461AE5B2781657359BCF01708A7C2F23FF95A35F22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
603696
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wevtsvc.pdb
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-string-l1-1-0
wcsspn
strnlen
wcsnlen
strncmp
wcscspn
wcsncmp
wcspbrk
memset
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__itow_s
_o__ltow_s
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__strnicmp
_o__ui64tow_s
_o__ultow_s
_o__wcsicmp
_o__wcsnicmp
memmove
_o__wcstoui64
_o__wfopen
_o__wtof
_o__wtoi
_o__wtoi64
_o__wtol
_o_bsearch
_o_fclose
_o_fgetws
_o_free
_o_iswalnum
_o_iswalpha
_o_iswspace
_o_malloc
_o_memcpy_s
_o_qsort
_o_strncpy_s
_o_terminate
_o_towupper
_o_wcscat_s
_o_wcscpy_s
_o_wcstod
_o_wcstok_s
_o_wcstol
_o_wcstoul
__C_specific_handler
__current_exception
__current_exception_context
wcsstr
wcsrchr
wcschr
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnwprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
_CxxThrowException
__C_specific_handler_noexcept
memcmp
memcpy
ntdll
RtlEthernetAddressToStringW
RtlIpv6AddressToStringW
RtlGetPersistedStateLocation
RtlSecondsSince1970ToTime
RtlSetLastWin32Error
NtReadFile
NtWriteFile
RtlComputeCrc32
NtSetInformationFile
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
NtQueryInformationProcess
RtlNtStatusToDosError
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlSubscribeWnfStateChangeNotification
RtlIpv4AddressToStringExW
RtlGetVersion
NtQuerySystemInformation
RtlpEnsureBufferSize
RtlNtPathNameToDosPathName
RtlFreeUnicodeString
RtlGetLastNtStatus
RtlNtStatusToDosErrorNoTeb
RtlTimeToSecondsSince1970
RtlIpv6AddressToStringExW
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceLoggerHandle
GetTraceEnableFlags
UnregisterTraceGuids
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventActivityIdControl
EventSetInformation
EventRegister
EventWriteTransfer
api-ms-win-core-perfcounters-l1-1-0
PerfSetCounterSetInfo
PerfCreateInstance
PerfStopProvider
PerfSetCounterRefValue
PerfDeleteInstance
PerfStartProviderEx
api-ms-win-security-base-l1-2-0
CheckTokenMembershipEx
api-ms-win-core-registry-l1-1-0
RegEnumKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegCreateKeyExW
RegCloseKey
RegGetValueW
RegOpenKeyExW
RegDeleteKeyExW
RegQueryValueExW
RegDeleteValueW
RegNotifyChangeKeyValue
api-ms-win-core-threadpool-l1-2-0
CancelThreadpoolIo
WaitForThreadpoolIoCallbacks
CallbackMayRunLong
CreateThreadpoolIo
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolWait
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolIo
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolCleanupGroup
TrySubmitThreadpoolCallback
WaitForThreadpoolWaitCallbacks
StartThreadpoolIo
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockShared
AcquireSRWLockShared
DeleteCriticalSection
CreateSemaphoreExW
ReleaseSemaphore
InitializeCriticalSectionEx
ReleaseMutex
SetEvent
OpenSemaphoreW
CreateMutexExW
CreateEventW
LeaveCriticalSection
OpenEventW
ResetEvent
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
ReleaseSRWLockExclusive
WaitForSingleObject
SetWaitableTimer
InitializeSRWLock
TryAcquireSRWLockExclusive
EnterCriticalSection
CancelWaitableTimer
WaitForSingleObjectEx
CreateWaitableTimerExW
AcquireSRWLockExclusive
WaitForMultipleObjectsEx
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
FreeLibrary
GetModuleHandleExA
GetModuleFileNameW
GetModuleHandleW
LoadResource
FindResourceExW
LockResource
FreeResource
GetProcAddress
GetModuleFileNameA
SizeofResource
DisableThreadLibraryCalls
LoadLibraryExW
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-kernel32-legacy-l1-1-0
PulseEvent
api-ms-win-core-file-l2-1-0
ReOpenFile
MoveFileExW
GetFileInformationByHandleEx
api-ms-win-security-base-l1-1-0
GetLengthSid
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
AccessCheckAndAuditAlarmW
AddAce
GetSecurityDescriptorOwner
AccessCheck
GetTokenInformation
SetSecurityDescriptorGroup
MakeSelfRelativeSD
GetSecurityDescriptorLength
MapGenericMask
InitializeAcl
InitializeSecurityDescriptor
IsValidSecurityDescriptor
GetSecurityDescriptorControl
CreateWellKnownSid
AdjustTokenPrivileges
GetSecurityDescriptorGroup
GetAce
PrivilegeCheck
IsWellKnownSid
SetSecurityDescriptorOwner
GetAclInformation
IsValidSid
SetSecurityDescriptorDacl
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
GetComputerNameExW
GetTickCount
GetTickCount64
GetVersionExW
GetSystemTimeAsFileTime
GlobalMemoryStatusEx
GetSystemTime
GetLocalTime
api-ms-win-core-processthreads-l1-1-0
OpenThreadToken
SetThreadToken
ResumeThread
GetCurrentProcessId
GetCurrentThread
CreateThread
GetCurrentProcess
OpenProcessToken
TerminateProcess
GetCurrentThreadId
api-ms-win-core-sysinfo-l1-2-0
GetOsSafeBootMode
GetSystemTimePreciseAsFileTime
api-ms-win-core-localization-l1-2-4
SetThreadPreferredUILanguages2
RestoreThreadPreferredUILanguages
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetThreadLocale
GetSystemDefaultLangID
GetThreadUILanguage
api-ms-win-core-localization-l1-2-2
LCIDToLocaleName
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-file-l1-1-0
GetFileInformationByHandle
SetFilePointerEx
CreateFileW
GetFinalPathNameByHandleW
SetFilePointer
SetEndOfFile
FileTimeToLocalFileTime
GetVolumePathNameW
GetFileSize
LocalFileTimeToFileTime
GetFileSizeEx
GetDiskFreeSpaceExW
GetFileType
GetDriveTypeW
FlushFileBuffers
SetFileInformationByHandle
GetFileAttributesExW
GetTempFileNameW
GetFileAttributesW
CompareFileTime
CreateDirectoryW
ReadFile
WriteFile
DeleteFileW
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
WakeAllConditionVariable
SleepConditionVariableSRW
api-ms-win-core-processthreads-l1-1-2
SetThreadInformation
api-ms-win-core-processthreads-l1-1-3
SetThreadDescription
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GetTimeZoneInformation
api-ms-win-core-memory-l1-1-0
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
api-ms-win-core-file-l1-2-3
GetTempPath2W
api-ms-win-core-realtime-l1-1-0
QueryUnbiasedInterruptTime
api-ms-win-core-version-l1-1-0
VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
api-ms-win-core-url-l1-1-0
UrlEscapeW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
GetEnvironmentVariableW
SearchPathW
GetCurrentDirectoryW
api-ms-win-core-state-helpers-l1-1-0
GetRegistryValueWithFallbackW
api-ms-win-core-registry-l1-1-2
RegQueryMultipleValuesW
api-ms-win-core-datetime-l1-1-1
GetTimeFormatEx
GetDateFormatEx
api-ms-win-core-file-l1-2-0
GetVolumeNameForVolumeMountPointW
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-datetime-l1-1-0
GetDateFormatW
GetTimeFormatW
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
ServiceMain
SvchostPushServiceGlobalsEx
Name
.text
Size
916KB
Virtual Size
913KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
200KB
Virtual Size
199KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
40KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
784B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
28KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=100, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33145,
count=5, id=259, version=33145,
count=1425, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=22, id=261, version=33145,
count=1, id=256, version=33145,
count=146, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wfapigp.dll
- IMPHASH 3430932905baa68f1de9920efb1bd6ca
- SHA256 fa422f701c3cf84df49cd0f1546fa7f1a74280a8d667ebeeafdd3911d7718732
- MD5 1772e08c85e3f63f319b1cd8bde80fe0
- SHA1 21dfe27ee9c723bc7b47194959b5e02af2a3d48e
- SHA512 1200d4a46b680b71a3d2dcd988506703b596d540e6176f86bf543b906e03fc8b141090e13ddf81ed86c33c6c9db83d60d217d3bf2a59f13dc401bd2b75030d95
- SSDEEP 768:vwSF4wVE3tzLdpxrNl44TgSfmn3SMRpP1M:vwFj3RBzRlCSfg3SMRp2
- TLSH T1AA430C5826FD28A5E666977889630A15D676B8346722D3EF03A0C03D1F77BE09539FC0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
6448
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WFAPIGP.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___stdio_common_vswprintf
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
_o__wcsicmp
__C_specific_handler
_o___std_type_info_destroy_list
wcsstr
api-ms-win-crt-string-l1-1-0
memset
ntdll
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
EtwTraceMessage
rpcrt4
RpcRevertToSelf
RpcImpersonateClient
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
DisableThreadLibraryCalls
GetProcAddress
LoadLibraryExW
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
api-ms-win-core-string-l1-1-0
CompareStringW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-registry-l1-1-0
RegCloseKey
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
Name
.text
Size
16KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
192B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
196B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=41, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=11, id=260, version=33145,
count=4, id=259, version=33145,
count=13, id=261, version=33145,
count=1123, id=1, productName=Unmarked objects,
count=1, id=256, version=33145,
count=4, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wfdprov.dll
- IMPHASH f246bbfd9c541322039e14c328403319
- SHA256 5781e298aeeb4a022aea9a258d6beb20c5c43dcdce53a5d67f720cad8a591b35
- MD5 e9fb5994c5f145b7db619888646426ea
- SHA1 9fc6c48fbf4290810dea1c5ca4dd3f1b9c59b649
- SHA512 af37728199c807efbb0fb3a0a9f57818c49f8f6e481235d8e90f0316801d50c1d84a06f628f6db4307cd302b95c880cc1084e6f8370bc34a89393509db5c345e
- SSDEEP 1536:OQ8Fp+4UscRJvJ426tbeipiPXfgx3mPK:OQ8f7rcRJR49beipiPvgx3mPK
- TLSH T12E633B2D637450F5D53950B889B38A26EA71742407215BDF07A4826C7FB3BF06B3AAC9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5952
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wfdprov.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
memcpy
_o_free
_o_malloc
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
api-ms-win-crt-string-l1-1-0
memset
ntdll
EtwGetTraceLoggerHandle
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
EtwGetTraceEnableLevel
EtwTraceMessage
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventSetInformation
EventWriteTransfer
EventRegister
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
WaitForSingleObject
ResetEvent
SetEvent
CreateEventW
EnterCriticalSection
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-threadpool-legacy-l1-1-0
QueueUserWorkItem
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
WFDProvConfigureAndProvisionDevice
WFDProvDeinitialize
WFDProvGetInfo
WFDProvInitialize
Name
.text
Size
28KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=43, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1125, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=25, id=261, version=33145,
count=1, id=256, version=33145,
count=6, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
whealogr.dll
- IMPHASH 086561840e2d70f72a25609ed0f717aa
- SHA256 ea2790d5fefbec4e6fab599a474595451adc73721341cb281ce1c57726f7e45b
- MD5 61b4d6662f6efa29853f23323ff0109e
- SHA1 c8b637fb0154ae92f45ef7e75c4553891894d578
- SHA512 fbd05248cd63fbe72cb21ff98931d3c6d69349bafb294ba70937532ff685d4c7325d7e261e107e5dc276de3c2b0d465128a680ad171fe95ee90b55d43599d2a8
- SSDEEP 1536:jIcfe9yxXi07n/qEZnDR+kQrSoPSCb4EPLIzc:ccf6yxXi02MDQk0SmeEcY
- TLSH T1A693E8022BEC6409F4FBE670AA7B946A763575258B20D4FF7114539C1932BC08FB9B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
9d:d6:e8:9f:ed:e9:4e:14:79:a5:77:32:6d:a6:b2:bb:06:c1:2f:15:1d:0e:da:9e:79:08:27:8a:1f:1c:e1:27
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 1, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9600-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:ef:89:3f:56:a1:58:cc:a8:da:00:01:00:00:01:ef
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
11520
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
whealogr.pdb
msvcrt
_initterm
_amsg_exit
wcscpy_s
_XcptFilter
malloc
free
_vsnwprintf
__C_specific_handler
memset
api-ms-win-eventing-tdh-l1-1-0
TdhGetProperty
TdhGetPropertySize
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventRegister
EventSetInformation
EventUnregister
EventWrite
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
FreeLibrary
DisableThreadLibraryCalls
LoadLibraryExA
devobj
DevObjCreateClassDeviceInfoList
DevObjDestroyDeviceInfoList
DevObjGetDeviceInfoListDetail
DevObjEnumDeviceInfo
cfgmgr32
CM_Locate_DevNode_ExW
CM_Get_Device_ID_ExW
api-ms-win-devices-config-l1-1-1
CM_Get_DevNode_Registry_PropertyW
api-ms-win-core-rtlsupport-l1-1-0
RtlCompareMemory
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-sysinfo-l1-1-0
GetTickCount64
GetSystemTimeAsFileTime
GetTickCount
GetSystemInfo
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-errorhandling-l1-1-0
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-memory-l1-1-0
VirtualQuery
VirtualProtect
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WdiDiagnosticModuleMain
WdiGetDiagnosticModuleInterfaceVersion
WdiHandleInstance
Name
.text
Size
20KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
924B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
28KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=30, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33136,
count=4, id=259, version=33136,
count=57, id=1, productName=Unmarked objects,
count=3, id=257, version=33136,
count=1, id=256, version=33136,
count=10, id=264, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
whesvc.dll
- IMPHASH ce7029eb3b47f3cf8b8204018d0d58a7
- SHA256 cd1ce81779945be03180ebcb8e8c05873f72af9549590e00564d075de06df203
- MD5 2b5f5710437c4c6240b5f24058c77ca5
- SHA1 887c1c758802af23f2095796cf45aa3b3944ff15
- SHA512 2c299caa50ba5fe79a4c141974a08c7058e8da7715603b1491e17a1015c326f4ed1250365caeadd7bd4802783e2b9d1952c534ab4d073dccabd43a26b35832e8
- SSDEEP 3072:ISqnlShcHlzikBfrQNcNSyPUxguYS2Urd0mK/2pGKd2ETTig:OnIhIlztf0qNAxgRthmyFQT
- TLSH T190244A6E32AD04B1F977817C89878906E67278660321A2DF06E082795F27FEC653DF52
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
12160
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
whesvc.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wtoi
_o_abort
_o_ceilf
_o_free
_o_iswspace
_o_malloc
_o_terminate
__C_specific_handler
__CxxFrameHandler3
__current_exception
__current_exception_context
_CxxThrowException
_o__execute_onexit_table
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o__errno
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__crt_atexit
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-heap-l1-1-0
HeapDestroy
HeapFree
HeapAlloc
GetProcessHeap
HeapCreate
api-ms-win-core-processthreads-l1-1-0
TerminateThread
GetCurrentProcessId
CreateThread
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
ResumeThread
GetCurrentThread
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
GetLastError
api-ms-win-core-synch-l1-1-0
CreateEventExW
ReleaseSRWLockExclusive
InitializeCriticalSectionAndSpinCount
OpenSemaphoreW
WaitForSingleObject
AcquireSRWLockShared
AcquireSRWLockExclusive
WaitForSingleObjectEx
ReleaseMutex
ReleaseSemaphore
ResetEvent
SetEvent
ReleaseSRWLockShared
CreateEventW
CreateMutexExW
CreateSemaphoreExW
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-winrt-string-l1-1-0
WindowsStringHasEmbeddedNull
WindowsGetStringRawBuffer
WindowsCreateString
WindowsDeleteString
WindowsIsStringEmpty
api-ms-win-core-libraryloader-l1-2-0
SizeofResource
DisableThreadLibraryCalls
LoadLibraryExW
GetModuleFileNameA
GetModuleHandleExW
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadResource
LockResource
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoDisconnectContext
CoRevokeClassObject
CoRegisterClassObject
CoResumeClassObjects
CoInitializeEx
CoUninitialize
api-ms-win-service-core-l1-1-0
SetServiceStatus
RegisterServiceCtrlHandlerExW
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-winrt-l1-1-0
RoRevokeActivationFactories
RoRegisterActivationFactories
RoGetActivationFactory
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
RoOriginateErrorW
api-ms-win-core-kernel32-legacy-l1-1-0
FindResourceA
UnregisterWait
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceExecuteOnce
InitOnceComplete
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount64
GetSystemTimeAsFileTime
GetTickCount
GetSystemDirectoryW
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedPushEntrySList
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
SetProcessMitigationPolicy
combase
ord69
ord66
ord67
ord68
msvcp_win
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?good@ios_base@std@@QEBA_NXZ
?uncaught_exception@std@@YA_NXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z
_Cnd_wait
_Mtx_unlock
_Mtx_lock
?_Throw_Cpp_error@std@@YAXH@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
_Cnd_signal
_Cnd_destroy_in_situ
_Cnd_init_in_situ
_Mtx_destroy_in_situ
_Mtx_init_in_situ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventSetInformation
EventWriteTransfer
EventActivityIdControl
EventRegister
api-ms-win-core-registry-l1-1-0
RegGetValueW
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-processthreads-l1-1-2
SetThreadInformation
ntdll
RtlSubscribeWnfStateChangeNotification
RtlQueryHeapInformation
RtlUnsubscribeWnfStateChangeNotification
RtlPublishWnfStateData
NtQuerySystemInformation
NtQueryWnfStateData
DbgPrint
ext-ms-win-resourcemanager-activitycoordinator-l1-1-0
DestroyActivityCoordinatorPolicy
UnsubscribeActivityCoordinatorPolicy
SubscribeActivityCoordinatorPolicy
CreateActivityCoordinatorPolicy
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-heap-l2-1-0
LocalAlloc
oleaut32
SysStringLen
GetErrorInfo
SysFreeString
SetErrorInfo
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
ServiceMain
SvchostPushServiceGlobals
Name
.text
Size
156KB
Virtual Size
154KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
588B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=75, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=11, id=260, version=33145,
count=5, id=259, version=33145,
count=1255, id=1, productName=Unmarked objects,
count=4, id=257, version=33145,
count=32, id=261, version=33145,
count=1, id=256, version=33145,
count=12, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
whesvc_assets.dll
- SHA256 b56acef2becd3b2a586a5ce29d2d17458018240fa03ef39f1b2d2693b3d09098
- MD5 d493d8c2b3278eb4a1473468ee24a82b
- SHA1 9f03872952fb47798c01c4a60584fce1c8d83eea
- SHA512 9e5106ea644a7cda445610f224f04e02ce00cd99351813b1fd05e931d93090f761d49c855b6099e75a6ae0fd67b4392ca5a914dd77738cb23c4202307fc2855f
- SSDEEP 6144:fAmeDrbCZtbNG7aSiB2R1ukAG+igPWqPPyQbJ:YFUtRGXiBekkAG+igPWqPqQ
- TLSH T1AF843B2092ED9C10CE79AC38BFD79943EE19A1FBB1150A35B17F4662EFB38014D6B452
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
4KB
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
356KB
Virtual Size
353KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=33145,
count=1, id=258, version=33145,
whhelper.dll
- IMPHASH 14843e73456af9335bd6fff94e959555
- SHA256 8ab13d8ebbfccf13be9539e86c9812d872d9f740a0df92d4889ea41929a82aa9
- MD5 e88994821543826cc934a58110456249
- SHA1 93b04e3dfcde65251ed3158922c2ffb8d7f1fd18
- SHA512 a856b1a1a946f5ac3e737a142f3402591c23835898cec8961c667ec6294df6ea51dcdb663f41073986cfd0cf17883ebdd41aee2a64be94bd657a4ea6309fa369
- SSDEEP 768:DvsNcybVzkz0WFJK5WEc/FYcxVDVbgs70rP//rY1Pbo9zHQR:ccylkzbYyy8bP70rP//rgPbgzwR
- TLSH T18C637D4A7B6820A1E9BB413481AA554BE675FAB4070153FF0BD0D07D4F23BD29A3DF46
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e8:a1:2c:da:9f:cf:da:a2:c1:2c:f4:6c:1d:d4:f7:21:43:8f:0a:08:c7:30:fc:3e:f3:c2:35:28:08:8a:cb:2e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3703-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1f:3a:70:69:e4:a2:30:2e:95:00:01:00:00:02:1f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
5056
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
whhelper.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
memcpy
_o_free
_o_localeconv
_o_malloc
_o_realloc
_o_strtod
_o_tolower
__C_specific_handler
_o___stdio_common_vsprintf
_o___std_type_info_destroy_list
_o___stdio_common_vsscanf
wcschr
api-ms-win-crt-string-l1-1-0
strncmp
memset
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
CompareStringW
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-file-l1-1-0
CreateFileW
ReadFile
GetFileSize
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
winhttp
WinHttpFreeProxySettings
WinHttpResetAutoProxy
WinHttpGetIEProxyConfigForCurrentUser
WinHttpReadProxySettings
WinHttpCloseHandle
WinHttpSetProxySettingsPerUser
WinHttpWriteProxySettings
WinHttpSetDefaultProxyConfiguration
WinHttpGetDefaultProxyConfiguration
WinHttpOpen
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegGetValueW
RegOpenKeyExW
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-heap-l2-1-0
GlobalFree
LocalFree
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
ntdll
RtlGetPersistedStateLocation
netsh.exe
RegisterContext
RegisterHelper
PrintMessage
PrintMessageFromModule
MatchToken
PreprocessCommand
InitHelperDll
Name
.text
Size
24KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
204B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=33145,
count=41, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1121, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=4, id=259, version=33145,
count=13, id=261, version=33145,
count=1, id=256, version=33145,
count=3, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wiaaut.dll
- IMPHASH 49a6c5e9557ac3c4c8958350774aedd6
- SHA256 790c3c11af62651e14e5cadbbe5810facfa39298c7cb50758aa24e362afb6ec9
- MD5 11b4f5db9bd164181e27aa75fd080e7b
- SHA1 0529023cc7596f04e4872066ed17dc5e07bec3e5
- SHA512 edff29c2e0642626be36140e98bcfc18a97e44fd42e65e3d066839be5f56eb7a0dc6e9273d56b3560b504b6a018b6a67435957eaadbad1f174c97130e8a3e516
- SSDEEP 6144:xwkUL+SqtlOOgLka2GIqwtvU1ds6hQp2cAaHmpzBC6KoRIh7S62G92eWDAR1/J+V:xLUN6lOlLkahIltMmI5HRfc97WDyu
- TLSH T1E805E50477EC0298F4B3E2B99B766007E9B97A246B31EADF1055451E0F73BC0B635B26
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
8336
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wiaaut.pdb
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
_o__splitpath_s
memmove
_o_calloc
_o_free
_o_malloc
_o_wcscpy_s
_o_wcsncpy_s
__CxxFrameHandler3
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___std_type_info_destroy_list
__C_specific_handler
memcmp
memcpy
advapi32
EventUnregister
EventRegister
EventWriteTransfer
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegQueryInfoKeyW
RegCloseKey
EventSetInformation
RegQueryValueExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
gdi32
DeleteObject
CreateDIBSection
SelectClipRgn
Rectangle
GetDeviceCaps
CreateRectRgnIndirect
CreateMetaFileW
DeleteMetaFile
SetMapMode
LPtoDP
RestoreDC
SetViewportOrgEx
DeleteDC
SetWindowExtEx
SetWindowOrgEx
CreateDCW
CloseMetaFile
SaveDC
kernel32
CreateThreadpoolTimer
GetLocalTime
AcquireSRWLockShared
FormatMessageA
GetTickCount
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
CreateEventW
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
DecodePointer
EncodePointer
LoadLibraryExA
VirtualAlloc
GetCurrentProcess
VirtualFree
SetThreadpoolTimer
GetSystemDirectoryA
lstrcmpiW
FreeLibrary
DeleteCriticalSection
LoadResource
FindResourceExW
DisableThreadLibraryCalls
InitializeCriticalSection
SizeofResource
MulDiv
WriteFile
CopyFileW
IsDebuggerPresent
GlobalUnlock
DebugBreak
GetTempPath2W
GetTempFileNameW
WideCharToMultiByte
GetModuleHandleW
SystemTimeToFileTime
GetProcessHeap
GetCurrentProcessId
GetFileSize
CreateMutexExW
GlobalLock
GetProcAddress
HeapAlloc
RaiseException
CloseHandle
GlobalFree
OpenSemaphoreW
DeleteFileW
GlobalAlloc
WaitForSingleObjectEx
InitOnceComplete
FileTimeToSystemTime
OutputDebugStringW
GetLastError
FormatMessageW
MultiByteToWideChar
ReleaseMutex
GetCurrentThreadId
CreateFileW
WaitForSingleObject
LeaveCriticalSection
GetModuleFileNameW
GetModuleHandleExW
ReleaseSemaphore
EnterCriticalSection
SetLastError
HeapFree
CreateSemaphoreExW
InitOnceBeginInitialize
GetModuleFileNameA
ReadFile
ReleaseSRWLockShared
AcquireSRWLockExclusive
CloseThreadpoolTimer
ReleaseSRWLockExclusive
GetFileInformationByHandle
GetModuleHandleA
lstrcmpA
lstrlenA
WaitForThreadpoolTimerCallbacks
InitializeCriticalSectionEx
RemoveDirectoryW
ExpandEnvironmentStringsW
CreateDirectoryW
ReleaseActCtx
CreateActCtxW
DeactivateActCtx
ActivateActCtx
UnmapViewOfFile
CreateMutexW
LoadLibraryExW
lstrlenW
LocalAlloc
LocalFree
user32
TranslateMessage
PeekMessageW
DispatchMessageW
MsgWaitForMultipleObjects
SetCursor
CharUpperA
UnregisterClassA
GetKeyState
CallWindowProcW
GetFocus
SetWindowPos
EqualRect
SetWindowLongPtrW
SetWindowRgn
CreateWindowExW
UnionRect
GetWindowLongPtrW
RegisterClassExW
ShowWindow
IsWindow
OffsetRect
IsChild
IntersectRect
SetFocus
CharNextW
LoadCursorW
GetClientRect
GetClassInfoExW
PtInRect
InvalidateRect
BeginPaint
EndPaint
GetWindowThreadProcessId
DefWindowProcW
DestroyWindow
DrawIcon
GetActiveWindow
LoadIconW
GetDC
GetDesktopWindow
ReleaseDC
LoadStringW
CharNextA
oleaut32
VariantClear
VariantChangeType
SysAllocStringLen
SysStringLen
VariantTimeToSystemTime
VariantCopy
OleCreatePropertyFrame
VarUI4FromStr
VarBstrCmp
SafeArrayGetDim
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetLBound
OleCreatePictureIndirect
SafeArrayUnaccessData
SafeArrayCreateVector
SafeArrayAccessData
SysAllocString
SetErrorInfo
CreateErrorInfo
LoadRegTypeLi
VariantInit
LoadTypeLi
SysFreeString
SysStringByteLen
SysAllocStringByteLen
SystemTimeToVariantTime
ole32
CreateOleAdviseHolder
OleSaveToStream
ProgIDFromCLSID
CLSIDFromString
CreateStreamOnHGlobal
CoTaskMemFree
CoCreateInstance
PropVariantCopy
CoTaskMemAlloc
PropVariantClear
StringFromCLSID
CreateDataAdviseHolder
OleRegGetMiscStatus
OleRegEnumVerbs
OleLoadFromStream
CoTaskMemRealloc
CoAllowSetForegroundWindow
OleRegGetUserType
WriteClassStm
gdiplus
GdipGetImageDecodersSize
GdipGetImageEncodersSize
GdipGetImageDecoders
GdipGetEncoderParameterList
GdipGetEncoderParameterListSize
GdipBitmapSetResolution
GdipRemovePropertyItem
GdipDrawImageRectI
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipCloneBitmapAreaI
GdipImageRotateFlip
GdipSaveAddImage
GdipSetPropertyItem
GdipCreateBitmapFromGdiDib
GdipCreateBitmapFromScan0
GdipSaveImageToFile
GdipGetImageHeight
GdipGetImageFlags
GdipCloneImage
GdipBitmapUnlockBits
GdipCreateBitmapFromStream
GdipAlloc
GdipDisposeImage
GdipGetImageHorizontalResolution
GdipGetPropertySize
GdipGetAllPropertyItems
GdipGetImagePixelFormat
GdipGetImageVerticalResolution
GdipFree
GdipImageSelectActiveFrame
GdipBitmapLockBits
GdipImageGetFrameCount
GdipGetImageRawFormat
GdipGetImageWidth
GdipGetImageEncoders
GdiplusShutdown
GdiplusStartup
GdipCreateHBITMAPFromBitmap
shell32
ord18
ord155
ord28
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
516KB
Virtual Size
515KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
200KB
Virtual Size
199KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
64KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=257, version=33145,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1441, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=15, id=260, version=33145,
count=5, id=259, version=33145,
count=26, id=261, version=33145,
count=1, id=256, version=33145,
count=47, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wiadefui.dll
- IMPHASH b2dbc77aefb935ce94ae43f6cae25ad8
- SHA256 e687ee462fc376ad1c6881c8c45494984e611ce00272820fc958af5d3e078ce6
- MD5 cd506aed5382118da5de919f698fcc54
- SHA1 72a8ac2ad342c7ea66fec7be73178d51b4b53475
- SHA512 e86bf3e5f18bf14de30a4b1d9b4048d5696d45fd3b4a40ceef7a546565e271b1d66f1e6c9b437a0ab492039e70dc18baf0b4abd6ed43e4f18e64e45ac2185d21
- SSDEEP 6144:6phoukJh5c1vYizEclwyxJYmtnuloqqGvi4:6phoPJh5c1vREclwGJYYuloqqGq
- TLSH T11A34181D12BE18B4E53AD27CC583C54AC6B378746326A6EF06E1C5BA8B13AE87175F01
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5120
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wiadefui.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__seh_filter_dll
_o__initialize_onexit_table
memmove
_o_free
__C_specific_handler
_o__initialize_narrow_environment
_o__execute_onexit_table
_o__configure_narrow_argv
_o__cexit
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
memcpy
api-ms-win-crt-string-l1-1-0
memset
gdi32
GetObjectW
SelectObject
DeleteDC
DeleteObject
GetDeviceCaps
CreateCompatibleDC
LineTo
MoveToEx
SetStretchBltMode
SetBrushOrgEx
RealizePalette
SelectPalette
CreateHalftonePalette
StretchBlt
CreatePenIndirect
SetROP2
SetBkColor
Arc
Ellipse
CreatePen
BitBlt
CreateSolidBrush
CreateCompatibleBitmap
GetStockObject
SetLayout
SetTextColor
SetBkMode
CreateDIBSection
GetTextExtentPoint32W
CreateFontIndirectW
Rectangle
kernel32
GlobalAlloc
GlobalUnlock
DeleteCriticalSection
Sleep
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
GetTickCount
ExitThread
FreeLibraryAndExitThread
GetExitCodeProcess
CreateProcessW
WaitForSingleObject
ResetEvent
DuplicateHandle
GetModuleFileNameW
ReleaseActCtx
CreateActCtxW
DeactivateActCtx
ActivateActCtx
CompareStringW
LoadLibraryExW
lstrcmpW
DeleteFileW
CopyFileW
MoveFileW
MulDiv
FreeLibrary
GetProcAddress
LoadLibraryW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CloseHandle
CreateThread
CreateEventW
SetEvent
MultiByteToWideChar
GetModuleHandleW
GetLastError
DisableThreadLibraryCalls
LocalFree
LocalAlloc
GlobalLock
ExpandEnvironmentStringsW
ole32
CoUnmarshalInterface
ReleaseStgMedium
CoCreateInstance
FreePropVariantArray
CoTaskMemAlloc
CoInitialize
CLSIDFromString
CreateStreamOnHGlobal
CoTaskMemFree
PropVariantClear
CoUninitialize
oleaut32
SysFreeString
SysAllocString
SysAllocStringLen
shell32
ShellExecuteExW
SHGetFileInfoW
shlwapi
PathRemoveFileSpecW
StrFormatByteSizeW
user32
OffsetRect
IsWindowVisible
PostMessageW
RegisterWindowMessageW
GetWindowTextW
GetWindowTextLengthW
SetForegroundWindow
DispatchMessageW
TranslateMessage
IsDialogMessageW
GetMessageW
DestroyWindow
PostQuitMessage
EnableMenuItem
GetSystemMenu
SetWindowLongW
MapDialogRect
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
MapWindowPoints
ShowWindow
SetWindowTextW
MessageBoxW
GetDlgItemInt
GetParent
GetWindowLongW
SetDlgItemInt
CharUpperBuffW
SetFocus
GetFocus
CopyRect
LoadImageW
SendMessageW
SetCursor
LoadCursorW
SendDlgItemMessageW
SetDlgItemTextW
EndDialog
GetWindowRect
ReleaseDC
GetDC
GetDlgItem
EnableWindow
CopyIcon
DefWindowProcW
SetWindowLongPtrW
GetWindowLongPtrW
RegisterClassW
UpdateWindow
InvalidateRect
IsWindowEnabled
EndPaint
GetSysColorBrush
FillRect
GetClientRect
BeginPaint
RegisterClipboardFormatW
DestroyIcon
LoadStringW
IsRectEmpty
IntersectRect
GetKeyState
MoveWindow
LoadIconW
PostThreadMessageW
ReleaseCapture
CallNextHookEx
IsChild
GetCapture
SetCapture
SendNotifyMessageW
TranslateAcceleratorW
SetWindowsHookExW
LoadAcceleratorsW
CopyAcceleratorTableW
DestroyAcceleratorTable
CreateAcceleratorTableW
MessageBeep
UnhookWindowsHookEx
GetSystemMetrics
KillTimer
CopyImage
MsgWaitForMultipleObjects
PeekMessageW
IsWindow
GetDesktopWindow
MonitorFromRect
GetMonitorInfoW
SetWindowPos
SystemParametersInfoW
DrawTextW
GetIconInfo
GetSysColor
DrawIconEx
InflateRect
DrawTextExW
GetClassNameW
MonitorFromWindow
CreateWindowExW
CreateDialogParamW
DialogBoxParamW
RegisterClassExW
DrawFocusRect
FrameRect
CharNextW
CharUpperW
GetCursorPos
SetTimer
PtInRect
winmm
PlaySoundW
gdiplus
GdipGetImageHeight
GdipSetImageAttributesColorMatrix
GdipGetImageEncoders
GdipCloneImage
GdipSetImageAttributesThreshold
GdipAlloc
GdipCreateBitmapFromHBITMAP
GdipDisposeImageAttributes
GdipCreateHBITMAPFromBitmap
GdipGetImageDecodersSize
GdipCreateImageAttributes
GdipFree
GdipGetImageGraphicsContext
GdipGetImageEncodersSize
GdipDeleteGraphics
GdipGetImageDecoders
GdipGetImageWidth
GdipCreateBitmapFromScan0
GdipDrawImageRectRectI
GdiplusShutdown
GdiplusStartup
GdipDisposeImage
msimg32
AlphaBlend
advapi32
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegDeleteValueW
RegOpenKeyExW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
184KB
Virtual Size
180KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
476B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=257, version=33145,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1373, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=14, id=260, version=33145,
count=4, id=259, version=33145,
count=18, id=261, version=33145,
count=1, id=256, version=33145,
count=49, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wiadss.dll
- IMPHASH 1f1509017d1c8bdf6e8211d2ece07c59
- SHA256 b7edd80e736b697395a146ab103f637f46e175d9dd8c45823aeb46b5e1c96163
- MD5 aab0e986b2d76ee74202a1a37057b5d4
- SHA1 b12d8d1cecc788791c4c998d5f4e53441f3a1863
- SHA512 6e4747e9171fbd251ef537a537aaa15270e6c5b14de11df936543807ae1c505fdbdda6b47049126ec1dac0e5579dbb491f4a92aca8fb53fb8a70348cd5fdcece
- SSDEEP 3072:vxfcgx2xwQrsPKbrs6UeJvmE2oIw8n5AfoidHxdl+uPrLbi5sEFjv:JEgxMrsPKs6tiAdRauPrL4Fj
- TLSH T1812439186B1406E5D8B390FDF982410BE630F45867B6C2FB17A852BA9F777C5F238606
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
8272
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wiadss.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__stricmp
memmove
_o__crt_atexit
_o_free
_o_malloc
_o_pow
__C_specific_handler
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___std_type_info_destroy_list
_o__configure_narrow_argv
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
advapi32
EventUnregister
EventRegister
EventWriteTransfer
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
EventSetInformation
kernel32
EnterCriticalSection
InitializeCriticalSectionEx
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
ReleaseSRWLockShared
CreateThreadpoolTimer
AcquireSRWLockShared
DeleteCriticalSection
GetTickCount
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GlobalReAlloc
lstrcmpiW
GetFullPathNameW
GlobalSize
lstrlenW
InitOnceBeginInitialize
FreeLibrary
LoadLibraryW
CreateFileA
WriteFile
GlobalUnlock
LocalFree
GlobalLock
GlobalFree
GlobalAlloc
LocalAlloc
IsDebuggerPresent
DebugBreak
WideCharToMultiByte
GetModuleHandleW
GetProcessHeap
GetCurrentProcessId
CreateMutexExW
GetProcAddress
HeapAlloc
CloseHandle
OpenSemaphoreW
WaitForSingleObjectEx
DisableThreadLibraryCalls
OutputDebugStringW
GetLastError
FormatMessageW
MultiByteToWideChar
ReleaseMutex
GetCurrentThreadId
WaitForSingleObject
GetModuleHandleExW
ReleaseSemaphore
SetLastError
HeapFree
CreateSemaphoreExW
GetModuleFileNameA
LeaveCriticalSection
ReleaseSRWLockExclusive
CloseThreadpoolTimer
InitOnceComplete
AcquireSRWLockExclusive
user32
LoadStringW
oleaut32
SysFreeString
SysAllocString
ole32
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
PropVariantClear
CoInitialize
FreePropVariantArray
CoRegisterMessageFilter
CoUninitialize
comctl32
ord17
CloseFindContext
FindFirstImportDS
FindImportDSByDeviceName
FindNextImportDS
GetLoaderStatus
LoadImportDS
UnloadImportDS
Name
.text
Size
128KB
Virtual Size
127KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
56KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
676B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=257, version=33145,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1183, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33145,
count=5, id=259, version=33145,
count=20, id=261, version=33145,
count=1, id=256, version=33145,
count=13, id=264, version=33145,
count=2, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wiarpc.dll
- IMPHASH 99a08e46bd75f0e08d968574917d198d
- SHA256 db5a5c56af13457c9f149eedac7e95a28302052501564d8f056eb132047857f1
- MD5 b1e6a2521483f033dbba75b9de0c14d4
- SHA1 5ab9f31ef072af9a9865efe9292d66870730fb30
- SHA512 766416bb4cab32925b0c0a1c85cf3b412faac6e6c98bab1cb9ce94ff097c036d414507a93afb82c693cba11c90daa24ca3fb34d58165ec3c0828362261b025fe
- SSDEEP 1536:b5oiBaZnQRiVaGhqt/N58rjFGlzyq1ulfTWib5qvvm1HFVCnBfQo6OPdg2Is:b5o9nCMvq12fTRbltFVCnBIOPdR
- TLSH T17BE32A2A33A910B9D436D178D9934607D3B2B424232257EF03E1C5BA5F637D8BE39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
8256
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wiarpc.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__splitpath_s
memmove
_o_free
_o_malloc
__CxxFrameHandler3
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___std_type_info_destroy_list
wcschr
__C_specific_handler
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
ntdll
NtClose
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
NtDuplicateToken
api-ms-win-service-core-l1-1-0
RegisterServiceCtrlHandlerExW
SetServiceStatus
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
CreateProcessAsUserW
GetCurrentProcess
TerminateProcess
api-ms-win-core-processthreads-l1-1-1
SetProcessMitigationPolicy
IsProcessorFeaturePresent
api-ms-win-security-base-l1-1-0
DuplicateTokenEx
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegEnumValueW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegQueryInfoKeyW
RegCloseKey
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventSetInformation
EventRegister
EventUnregister
rpcrt4
RpcStringBindingComposeW
Ndr64AsyncClientCall
RpcBindingFree
RpcAsyncCancelCall
RpcStringFreeW
RpcAsyncCompleteCall
RpcAsyncGetCallStatus
I_RpcExceptionFilter
RpcAsyncInitializeHandle
RpcBindingFromStringBindingW
UuidToStringW
RpcBindingSetAuthInfoExW
user32
CharNextW
CharUpperA
CharNextA
kernel32
SetThreadpoolTimer
GetSystemDirectoryA
AcquireSRWLockExclusive
RegCreateKeyExA
CloseThreadpoolTimer
ReleaseSRWLockExclusive
GetFileInformationByHandle
GetModuleHandleA
lstrcmpA
CreateFileW
lstrlenA
WaitForThreadpoolTimerCallbacks
InitializeCriticalSectionEx
CreateMutexW
InitializeCriticalSection
RegOpenKeyExA
LoadLibraryExA
RemoveDirectoryW
ExpandEnvironmentStringsW
CreateDirectoryW
LocalAlloc
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CompareStringW
DeleteCriticalSection
WTSGetActiveConsoleSessionId
UnregisterWaitEx
ResetEvent
InitOnceComplete
DisableThreadLibraryCalls
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
RegisterWaitForSingleObject
lstrlenW
EnterCriticalSection
InitOnceBeginInitialize
IsDebuggerPresent
DebugBreak
GetModuleHandleW
GetProcessHeap
LocalFree
CreateMutexExW
GetProcAddress
HeapAlloc
CloseHandle
OpenSemaphoreW
WaitForSingleObjectEx
SetEvent
OutputDebugStringW
GetLastError
FormatMessageW
CreateEventW
ReleaseMutex
WaitForSingleObject
GetModuleHandleExW
ReleaseSemaphore
SetLastError
HeapFree
CreateSemaphoreExW
GetModuleFileNameA
ReleaseSRWLockShared
CreateThreadpoolTimer
GetLocalTime
RegQueryValueExA
AcquireSRWLockShared
FreeLibrary
GetTickCount
LoadLibraryExW
ResolveDelayLoadedAPI
DelayLoadFailureHook
DeleteFileW
??0BUFFER@@QEAA@I@Z
??0BUFFER_CHAIN@@QEAA@XZ
??0BUFFER_CHAIN_ITEM@@QEAA@I@Z
??1BUFFER@@QEAA@XZ
??1BUFFER_CHAIN@@QEAA@XZ
??1BUFFER_CHAIN_ITEM@@QEAA@XZ
??_FBUFFER@@QEAAXXZ
??_FBUFFER_CHAIN_ITEM@@QEAAXXZ
?QueryPtr@BUFFER@@QEBAPEAXXZ
?QuerySize@BUFFER@@QEBAIXZ
?QueryUsed@BUFFER_CHAIN_ITEM@@QEBAKXZ
?SetUsed@BUFFER_CHAIN_ITEM@@QEAAXK@Z
ServiceMain
Name
.text
Size
80KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
184B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
628B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=257, version=33145,
count=19, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1226, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33145,
count=5, id=259, version=33145,
count=22, id=261, version=33145,
count=1, id=256, version=33145,
count=17, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wiascanprofiles.dll
- IMPHASH 492271abb2fcfab058bf5899456bb4fb
- SHA256 340763a956a62c0ce6704804f338777909080601160f3519e719a811769118df
- MD5 b50c3408c0532227834b77295905b9f8
- SHA1 0c29a653de7f86fa7d94f9be0fe76204ef861c24
- SHA512 681b6be5b8d486bb29028d366851d62a77a3c3cf803d0db3b2b9debb2ef3cb7ff385af540559daad8cf8528d9e1be44800c3e18919039fc1955b756b1017a1b3
- SSDEEP 1536:ufDu8LSTDPO9nOzZjj/+QCb345KxNeyoEZcWarb:ufNLSnPO9n4Zunz45Kx2ESWaH
- TLSH T123C3E74AF7D4E5E6D05D60358C5B9698DA71B0116F0212EF3380837E9EB37E52E3AB42
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5136
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wiascanprofiles.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
memmove
_o__wcsicmp
_o_free
_o_malloc
_o_realloc
_o_wcscat_s
_o_wcscpy_s
_o___std_type_info_destroy_list
__C_specific_handler
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
advapi32
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
kernel32
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryExW
GetModuleHandleW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RaiseException
FindClose
FindNextFileW
FindFirstFileW
OpenFile
WideCharToMultiByte
DeleteFileW
InitializeCriticalSectionAndSpinCount
lstrcpyW
EnterCriticalSection
LeaveCriticalSection
HeapDestroy
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
GetModuleFileNameW
FindResourceExW
LoadResource
SizeofResource
MultiByteToWideChar
GetSystemInfo
VirtualQuery
VirtualAlloc
VirtualProtect
lstrcpynW
lstrcmpiW
user32
CharNextW
CharPrevW
oleaut32
SysFreeString
VarUI4FromStr
RegisterTypeLi
SysStringLen
SysAllocString
LoadTypeLi
LoadRegTypeLi
VariantClear
VariantChangeType
VariantInit
SysAllocStringLen
ole32
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CLSIDFromString
StringFromGUID2
CoTaskMemFree
rpcrt4
UuidCreate
shell32
ord75
ord165
SHGetSpecialFolderPathW
scansetting
ProfilesDialog
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
44KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
48KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
352B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=257, version=33145,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1148, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=16, id=260, version=33145,
count=5, id=259, version=33145,
count=19, id=261, version=33145,
count=1, id=256, version=33145,
count=7, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wiaservc.dll
- IMPHASH e361f9212f3b39a1402ec281aa6f99c6
- SHA256 09264bba7d1f5717319d84a4f2a9853e9ca0bfa4c7ccb57830cb37f6f2c6e4e3
- MD5 1a7d7ecff88359465806e5bbd7f177dd
- SHA1 cf5b7ae40d6fd841915b32c49918768d2ec12116
- SHA512 9006f6550331005b419d910f8fea39c340410572ef4035f63a911214bf204436953afa3be783548f4f206fe15ffa805640ae7496351385fb28ba2a0f8c2ee547
- SSDEEP 12288:86hDujoytuY6NmQp+7GaGSzRrwcPR9xy1uQGPhN:zDct23pbaGWrwkR9xcmhN
- TLSH T1B3F47B2963A802E4C0BBC179DA438517F9B1B1246371D9DB02EA816E5FB7BC5773EB01
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
193504
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wiaservc.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__splitpath_s
_o__wcsicmp
memmove
_o__wsplitpath_s
_o_free
_o_malloc
__CxxFrameHandler3
_o__execute_onexit_table
_o__errno
wcsstr
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___std_type_info_destroy_list
wcschr
__C_specific_handler
__RTDynamicCast
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
wcscmp
advapi32
EventUnregister
StartServiceW
EventSetInformation
OpenSCManagerW
EventRegister
CloseServiceHandle
QueryServiceStatus
EventWriteTransfer
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
RegCloseKey
OpenServiceW
RegDeleteValueW
RegDeleteKeyExW
SetServiceStatus
RegisterServiceCtrlHandlerExW
RegGetValueW
AddAccessAllowedAce
GetLengthSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
InitializeAcl
InitializeSecurityDescriptor
FreeSid
AllocateAndInitializeSid
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
OpenThreadToken
SetKernelObjectSecurity
GetKernelObjectSecurity
OpenProcessToken
AddAce
SetSecurityDescriptorSacl
InitializeSid
CopySid
CreatePrivateObjectSecurity
GetSidLengthRequired
DestroyPrivateObjectSecurity
GetSidSubAuthority
GetSidSubAuthorityCount
GetAce
SetSecurityDescriptorOwner
AccessCheck
GetAclInformation
GetSecurityDescriptorDacl
GetTokenInformation
LookupAccountSidW
RegQueryValueW
RegQueryValueExA
RegOpenKeyW
RegOpenKeyExA
RegCreateKeyExA
kernel32
GetThreadId
CreateThread
FreeLibraryAndExitThread
WaitForMultipleObjects
ExpandEnvironmentStringsW
SetEvent
InitOnceBeginInitialize
InitOnceComplete
PowerSetRequest
DuplicateHandle
PowerCreateRequest
PowerClearRequest
ResetEvent
GetCurrentThread
OpenProcess
UnmapViewOfFile
DeleteFileW
GetTempFileNameW
GetTempPath2W
CreateFileMappingW
MapViewOfFileEx
SetFilePointer
GetFileType
SetEndOfFile
GetFileSize
ReadFile
WideCharToMultiByte
GetModuleFileNameW
GetFileInformationByHandle
GetDateFormatW
FlushFileBuffers
PurgeComm
EscapeCommFunction
ClearCommError
SetCommMask
CreateDirectoryW
RemoveDirectoryW
LoadLibraryExA
CreateMutexW
lstrcmpA
GetModuleHandleA
GetSystemDirectoryA
FormatMessageA
VirtualProtect
RaiseException
GetSystemInfo
VirtualQuery
CreateFileW
GetModuleFileNameA
CompareStringW
CreateSemaphoreExW
HeapFree
SetLastError
EnterCriticalSection
ReleaseSemaphore
GetModuleHandleExW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
InitializeCriticalSection
InitializeCriticalSectionEx
WaitForThreadpoolTimerCallbacks
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
SetProcessMitigationPolicy
CreateEventW
Sleep
FormatMessageW
GetLastError
ReleaseSRWLockExclusive
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
MulDiv
GetLocalTime
MultiByteToWideChar
lstrlenA
WriteFile
lstrcmpW
lstrcmpiW
GetSystemTime
SystemTimeToFileTime
LocalFree
LocalAlloc
lstrlenW
LoadLibraryExW
FreeLibrary
GetSystemDirectoryW
IsDebuggerPresent
GetTickCount
DebugBreak
GetModuleHandleW
GetProcessHeap
GetCurrentProcessId
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
GetProcAddress
HeapAlloc
CreateThreadpoolTimer
ReleaseSRWLockShared
SetThreadpoolTimer
CloseHandle
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
DisableThreadLibraryCalls
CloseThreadpoolTimer
OutputDebugStringW
user32
CharNextW
PostMessageW
IsWindow
UnregisterPowerSettingNotification
RegisterPowerSettingNotification
RegisterDeviceNotificationW
UnregisterDeviceNotification
CharUpperA
CharNextA
oleaut32
SysAllocString
SysFreeString
SysStringLen
BSTR_UserSize64
BSTR_UserFree64
BSTR_UserMarshal
BSTR_UserUnmarshal
BSTR_UserUnmarshal64
BSTR_UserFree
BSTR_UserSize
BSTR_UserMarshal64
ole32
CoSuspendClassObjects
CoResumeClassObjects
CoImpersonateClient
FreePropVariantArray
CoRegisterClassObject
CreateStreamOnHGlobal
CoGetCallContext
CoRevertToSelf
CLSIDFromString
CoTaskMemFree
StringFromGUID2
StringFromCLSID
CoInitializeSecurity
CoCreateInstance
CoInitializeEx
CoUninitialize
CoRevokeClassObject
PropVariantCopy
StgOpenPropStg
PropVariantClear
StgCreatePropStg
CoTaskMemAlloc
CoDisconnectObject
rpcrt4
NdrServerCallAll
NdrAsyncServerCall
NdrServerCall2
RpcAsyncCompleteCall
UuidCreate
RpcStringFreeA
UuidToStringA
UuidCreateNil
RpcServerRegisterAuthInfoW
RpcServerSubscribeForNotification
RpcServerUnsubscribeForNotification
RpcServerTestCancel
RpcRevertToSelf
UuidToStringW
Ndr64AsyncServerCallAll
RpcImpersonateClient
RpcServerListen
RpcServerRegisterIfEx
RpcStringBindingParseW
RpcStringFreeW
RpcServerInqDefaultPrincNameW
RpcBindingToStringBindingW
RpcServerUseProtseqEpW
RpcBindingInqAuthClientW
RpcAsyncAbortCall
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
ntdll
NtQuerySystemInformation
DllRegisterServer
DllUnregisterServer
ServiceMain
wiasCreateChildAppItem
wiasCreateDrvItem
wiasCreateLogInstance
wiasCreatePropContext
wiasDebugError
wiasDebugTrace
wiasDownSampleBuffer
wiasFormatArgs
wiasFreePropContext
wiasGetChangedValueFloat
wiasGetChangedValueGuid
wiasGetChangedValueLong
wiasGetChangedValueStr
wiasGetChildrenContexts
wiasGetContextFromName
wiasGetDrvItem
wiasGetImageInformation
wiasGetItemType
wiasGetPropertyAttributes
wiasGetRootItem
wiasIsPropChanged
wiasParseEndorserString
wiasPrintDebugHResult
wiasQueueEvent
wiasReadMultiple
wiasReadPropBin
wiasReadPropFloat
wiasReadPropGuid
wiasReadPropLong
wiasReadPropStr
wiasSendEndOfPage
wiasSetItemPropAttribs
wiasSetItemPropNames
wiasSetPropChanged
wiasSetPropertyAttributes
wiasSetValidFlag
wiasSetValidListFloat
wiasSetValidListGuid
wiasSetValidListLong
wiasSetValidListStr
wiasSetValidRangeFloat
wiasSetValidRangeLong
wiasUpdateScanRect
wiasUpdateValidFormat
wiasValidateItemProperties
wiasWriteBufToFile
wiasWriteMultiple
wiasWritePageBufToFile
wiasWritePageBufToStream
wiasWritePropBin
wiasWritePropFloat
wiasWritePropGuid
wiasWritePropLong
wiasWritePropStr
Name
.text
Size
492KB
Virtual Size
490KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
212KB
Virtual Size
209KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
216B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=257, version=33145,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1365, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=15, id=260, version=33145,
count=5, id=259, version=33145,
count=25, id=261, version=33145,
count=1, id=256, version=33145,
count=69, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wiashext.dll
- IMPHASH 8b849d823046092dd2ec5b2981f284b6
- SHA256 34021dea05fd840276ec2ea4cbaa2ecc6f0b396262cef02d8d72ba7329592495
- MD5 8a3621a717d839d583c471c8ab46d504
- SHA1 011f6875d81d29ba0a257bc15b3d2bb1f7d2d2eb
- SHA512 21c9ddc34301417d160047cde57d960680bec3e4e698d32e5c145864ddcb8430fe6c38e3ac40c49cf5bf25c6f3e07a587c019606120dd771897626c8474c74c1
- SSDEEP 3072:qDcedzy0ivXIbs9YRDsUIf8DinBjY+DSSewcBm:Jedzy0i/IbfRxIf8DQBjY5wc
- TLSH T1F2C3D74E26B921B8D176D17C89874A5AD771B434132667EF06E0C2BE8F13BE4AD34F12
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5104
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wiashext.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__itow
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o_qsort
_o_wcstol
__C_specific_handler
_o__execute_onexit_table
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
wcsrchr
wcschr
wcsstr
memcpy
api-ms-win-crt-string-l1-1-0
memset
advapi32
OpenSCManagerW
ControlService
CloseServiceHandle
RegQueryValueExW
RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegEnumKeyW
OpenServiceW
gdi32
GetBkMode
SetBkColor
SetTextColor
ExtTextOutW
SetBkMode
GetDeviceCaps
SelectObject
GetTextExtentPoint32W
kernel32
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
DelayLoadFailureHook
ResolveDelayLoadedAPI
GetModuleFileNameW
ReleaseActCtx
CreateActCtxW
DeactivateActCtx
ActivateActCtx
LoadLibraryExW
MultiByteToWideChar
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyExW
RegEnumValueW
LocalAlloc
LocalFree
GetModuleHandleW
GetLastError
lstrcmpiW
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
LoadLibraryW
GetProcAddress
WideCharToMultiByte
FreeLibrary
GetDateFormatW
GetTimeFormatW
GetLocalTime
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
GetCurrentThreadId
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
ole32
CoUninitialize
FreePropVariantArray
CoUnmarshalInterface
CoCreateInstance
CLSIDFromString
PropVariantClear
ReleaseStgMedium
CoInitialize
CoMarshalInterThreadInterfaceInStream
oleaut32
SysFreeString
SysAllocString
SysAllocStringLen
shell32
SHGetFileInfoW
ord6
shlwapi
PathParseIconLocationW
ord219
AssocQueryStringW
StrFormatByteSizeW
PathRemoveArgsW
user32
RegisterClipboardFormatW
SendMessageW
GetDlgItem
LoadIconW
SendDlgItemMessageW
LoadStringW
EnableWindow
GetParent
LoadCursorW
SetWindowLongPtrW
CheckDlgButton
InvalidateRect
IsDlgButtonChecked
GetSysColor
DrawIconEx
DrawFocusRect
LoadImageW
GetWindowLongPtrW
CallWindowProcW
SetDlgItemTextW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
GetDC
ReleaseDC
DestroyIcon
GetSystemMetrics
ShowWindow
SetDlgItemInt
FindWindowExW
SetPropW
GetPropW
GetClassInfoW
RemovePropW
DefWindowProcW
IsWindowVisible
CheckRadioButton
SetCursor
MessageBoxIndirectW
GetWindowLongW
AddDeviceWasChosen
AddDeviceWasChosenA
AddDeviceWasChosenW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
DoDeleteAllItems
MakeFullPidlForDevice
Name
.text
Size
68KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
80B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
668B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=257, version=33145,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1275, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33145,
count=4, id=259, version=33145,
count=17, id=261, version=33145,
count=1, id=256, version=33145,
count=24, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wiatrace.dll
- IMPHASH c464c6a5522c51cf1b24aeda32bdf83a
- SHA256 5d06cca022e22ff503a4e2653c54bad0e570459d943c59077a1752db13340d4c
- MD5 fd3df1bf1b3e4e43bac91ba388a19a43
- SHA1 69e8bdc9919af3ee54716ca0db801418d1508351
- SHA512 e26b990fc4c69180f13247b09890693e905ddca59d65c492442e9ea9398060571f87f1533da002470448d7057f721d606c4c8d8a58679f65b6011b424032fb2f
- SSDEEP 384:5/3KsCCCGcr1jL+CqOC0JDy3al2q25cykbc9Wa/W:FCC3uLuSoq2W9bcv
- TLSH T1AF1308982BDF18DAE177427D8C530AABE571B760631B61EF43A0A03A8B19FE1513C7C1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
10992
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wiatrace.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___std_type_info_destroy_list
_o___stdio_common_vsprintf
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
_o__splitpath_s
__C_specific_handler
api-ms-win-crt-string-l1-1-0
memset
kernel32
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
TlsFree
TlsGetValue
GetCurrentProcessId
SetFilePointerEx
GetLocalTime
TlsAlloc
CopyFileA
ReleaseMutex
WaitForSingleObject
SetEndOfFile
ExpandEnvironmentStringsA
WriteFile
TlsSetValue
GetModuleFileNameA
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
WIATRACE_DecrementIndentLevel
WIATRACE_GetIndentLevel
WIATRACE_GetTraceSettings
WIATRACE_IncrementIndentLevel
WIATRACE_Init
WIATRACE_OutputString
WIATRACE_SetTraceSettings
WIATRACE_Term
Name
.text
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
804B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
132B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1096, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=13, id=261, version=33145,
count=1, id=256, version=33145,
count=2, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wifidatacapabilityhandler.dll
- IMPHASH d64ce2b28ffdfc441ecb4ed2a31746f0
- SHA256 19ba644cbb6a44d54561c866a429a67927a13c8dd887e4cebc438463950d4268
- MD5 858817deeb1b00fffb5d3263d52f1797
- SHA1 d7b853ef4a8503bbc926839dca6d382efc325583
- SHA512 ba120dbed78f1ec24cc5ee5fd04af63076f9ddefae7e3e0b2ac58cc43b89456a354e11dd8f4d102a21d1da6c8f2835cc1824aad2dcea5fc2b2688d9bfa3eb757
- SSDEEP 1536:4YWOXvLWMTSnc9hEJ50R5g5Si8SKgkG+vI6OvlnZ8TO:1JTGUQ5G5gmrgkZBOdnZ8C
- TLSH T1BA93385D76A820B5E676913CC4924A19E3B1B021231267FF43A182BE5F63BF46D3DF90
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5680
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WifiDataCapabilityHandler.pdb
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o_malloc
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___stdio_common_vswprintf
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsCreateStringReference
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
RoOriginateErrorW
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
DeleteCriticalSection
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection
ReleaseSemaphore
EnterCriticalSection
CreateSemaphoreExW
AcquireSRWLockShared
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetProcAddress
GetModuleHandleW
GetModuleHandleExW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
RaiseException
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CloseThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllMain
Name
.text
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
360B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=50, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=1143, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=24, id=261, version=33145,
count=1, id=256, version=33145,
count=4, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wifinetworkmanager.dll
- IMPHASH 9ce739ff8c626208e0cf1ebd7f3ca64e
- SHA256 72576f71ef6524bc6045e928bb0f664763fc181ac7c158b33880d5ce837502e0
- MD5 73b111c22606dae63b7a10064c0d8f91
- SHA1 502067dd566c913154a35f2cbd49a9330444d275
- SHA512 bada01737fa087adb863a38147a15182d31ec67f1c5258949223c9b021c088febd7ccc7ea89e1addbb493f0233a60f3b5fe6c7a2643ff56bb8c40a4ccea8ab53
- SSDEEP 12288:CI096HXyOn5XjPqnG6upIgvmg6VQMNWXDqEhfHO1++GKnBjoK:i96jXjPwG6kjvmg6CM0qEhfE++fxoK
- TLSH T1EEE4292E66EC0065E1B7C278DA57822AF67278255721C6CF0265437D4F27FD84F3AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
102288
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WiFiNetworkManager.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
_o__wcsicmp
_o__initialize_narrow_environment
_o__wtoi
_o_calloc
_o_ceilf
_o_free
_o_malloc
_o_realloc
_o_terminate
_o_wcscpy_s
_o_wcstoul
__current_exception
__current_exception_context
__C_specific_handler_noexcept
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o__invalid_parameter_noinfo_noreturn
strchr
wcsstr
__std_type_info_compare
__CxxFrameHandler3
_CxxThrowException
_o__invalid_parameter_noinfo
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsscanf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
_o___stdio_common_vfprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__initialize_onexit_table
memmove
_o___acrt_iob_func
__std_terminate
__C_specific_handler
__CxxFrameHandler4
memchr
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
wcscmp
memset
wcsncmp
wcsnlen
strnlen
api-ms-win-core-libraryloader-l1-2-0
LoadStringW
LoadLibraryExW
GetModuleHandleExW
DisableThreadLibraryCalls
FreeLibrary
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
GetModuleHandleExA
api-ms-win-core-synch-l1-1-0
AcquireSRWLockShared
WaitForSingleObjectEx
ReleaseSRWLockShared
CreateEventExW
ReleaseMutex
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
ReleaseSRWLockExclusive
CreateEventW
SetEvent
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
CreateSemaphoreExW
ResetEvent
InitializeCriticalSection
CreateMutexExW
ReleaseSemaphore
EnterCriticalSection
AcquireSRWLockExclusive
OpenSemaphoreW
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-com-l1-1-0
CoDisconnectContext
CoRegisterClassObject
CoUninitialize
CoRevokeClassObject
CoImpersonateClient
CoSetProxyBlanket
CoDecrementMTAUsage
CoIncrementMTAUsage
CoRevertToSelf
CoInitializeEx
CoTaskMemAlloc
StringFromGUID2
CreateStreamOnHGlobal
CLSIDFromString
CoFreeUnusedLibraries
CoCreateInstance
CoTaskMemFree
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventUnregister
EventSetInformation
EventWrite
EventWriteTransfer
api-ms-win-security-base-l1-1-0
CheckTokenMembership
GetTokenInformation
FreeSid
CopySid
GetLengthSid
AllocateAndInitializeSid
ImpersonateLoggedOnUser
EqualSid
RevertToSelf
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceLoggerHandle
TraceMessage
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThread
OpenProcessToken
TerminateProcess
GetCurrentThreadId
GetThreadId
CreateThread
OpenThreadToken
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
oleaut32
SysFreeString
SysStringLen
GetErrorInfo
VariantClear
VariantChangeType
VariantCopy
SysAllocString
VariantInit
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-stringansi-l1-1-0
CharLowerA
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
GetSystemTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
wlanapi
WlanPrivateSetInterface
WlanPrivateQueryInterface
WlanEnumInterfaces
WlanDeleteProfile
WlanOpenHandle
WlanGetProfile
WlanSetProfile
WlanGetProfileMetadata
WlanSetProfileMetadata
WlanPrivateGetAnqpVenueUrl
WlanIsUIRequestPending
WlanWcmDisconnect
WlanPrivateGetAvailableNetworkList
WlanWcmGetProfileList
WlanWcmSetProfile
WpGenerateProfileXml
WlanRegisterNotification
WpParseProfileXml
WpFreeProfile
WlanGetProfileMetadataWithProfileGuid
WpAllocMemory
WpFreeMemory
ConvertPassPhraseKeyStringToBuffer
WlanCloseHandle
WlanSetProfileEapXmlUserData
WlanFreeMemory
WlanDisconnect
WlanSendUIResponse
WlanConnect
WlanSetProfileList
WlanSetProfilePosition
WlanGetNetworkBssList
WlanQueryInterface
systemeventsbrokerclient
SebEnumerateEvents
SebQueryEventData
SebSignalEvent
SebCreateNetOperatorHotSpotAuthEvent
SebQueryEventPackage
SebDeleteEvent
combase
ord67
ord68
ord66
msvcp_win
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
_Strcoll
?id@?$collate@D@std@@2V0locale@2@A
?id@?$ctype@D@std@@2V0locale@2@A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Strxfrm
?_Xout_of_range@std@@YAXPEBD@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Xlength_error@std@@YAXPEBD@Z
??Bid@locale@std@@QEAA_KXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Incref@facet@locale@std@@UEAAXXZ
??0facet@locale@std@@IEAA@_K@Z
?tolower@?$ctype@D@std@@QEBADD@Z
?is@?$ctype@D@std@@QEBA_NFD@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
??1facet@locale@std@@MEAA@XZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
api-ms-win-core-threadpool-legacy-l1-1-0
CreateTimerQueueTimer
DeleteTimerQueueEx
DeleteTimerQueueTimer
QueueUserWorkItem
CreateTimerQueue
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolThreadMaximum
CloseThreadpool
CreateThreadpoolWork
WaitForThreadpoolWorkCallbacks
CloseThreadpoolWork
SetThreadpoolThreadMinimum
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
CreateThreadpool
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
SubmitThreadpoolWork
IsThreadpoolTimerSet
TrySubmitThreadpoolCallback
CreateThreadpoolWait
CloseThreadpoolCleanupGroup
CreateThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
api-ms-win-core-registry-l1-1-0
RegNotifyChangeKeyValue
RegSetValueExW
RegCreateKeyExW
RegGetValueW
RegEnumValueW
RegOpenKeyExW
RegDeleteValueW
RegCloseKey
RegQueryValueExW
api-ms-win-security-sddl-l1-1-0
ConvertStringSidToSidW
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
ntdll
EtwEventSetInformation
RtlIsMultiSessionSku
RtlGetDeviceFamilyInfoEnum
RtlSubscribeWnfStateChangeNotification
RtlReportException
NtQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlNtStatusToDosError
EtwEventRegister
RtlPublishWnfStateData
EtwEventWriteTransfer
EtwEventUnregister
EtwTraceMessage
rpcrt4
RpcRevertToSelfEx
RpcBindingVectorFree
RpcServerUnregisterIf
RpcEpRegisterW
RpcServerRegisterIf3
RpcServerInqBindings
NdrServerCallAll
RpcServerUseProtseqW
RpcEpUnregister
RpcSsDestroyClientContext
RpcImpersonateClient
RpcBindingFree
NdrServerCall2
UuidFromStringW
api-ms-win-appmodel-runtime-l1-1-0
GetPackagesByPackageFamily
api-ms-win-core-file-l1-1-0
WriteFile
RemoveDirectoryW
FindClose
CreateFileW
GetFileAttributesW
DeleteFileW
FlushFileBuffers
CompareFileTime
ReadFile
FindNextFileW
CreateDirectoryW
GetFileSizeEx
FindFirstFileW
api-ms-win-core-path-l1-1-0
PathCchSkipRoot
PathCchCombine
PathCchRemoveBackslash
PathAllocCanonicalize
iphlpapi
ConvertInterfaceGuidToLuid
GetIfEntry
GetAdaptersAddresses
ConvertInterfaceLuidToIndex
api-ms-win-appmodel-runtime-l1-1-1
FindPackagesByPackageFamily
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-security-capability-l1-1-0
RpcClientCapabilityCheck
api-ms-win-core-io-l1-1-0
GetOverlappedResult
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-service-management-l1-1-0
OpenSCManagerW
OpenServiceW
CloseServiceHandle
api-ms-win-service-private-l1-1-0
UnsubscribeServiceChangeNotifications
SubscribeServiceChangeNotifications
ws2_32
htons
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
policymanager
PolicyManager_GetPolicyInt
PolicyManager_GetWiFiPolicy_AllowWiFi
PolicyManager_GetWiFiPolicy_AllowAutoConnectToWiFiSenseHotspots
PolicyManager_GetWiFiPolicy_AllowManualWiFiConfiguration
api-ms-win-core-namedpipe-l1-1-0
ConnectNamedPipe
CreateNamedPipeW
api-ms-win-core-datetime-l1-1-1
GetTimeFormatEx
DllCanUnloadNow
DllGetClassObject
PopulateFuncTable
Name
.text
Size
404KB
Virtual Size
400KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
148KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
392B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
60KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=119, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=20, id=260, version=33145,
count=5, id=259, version=33145,
count=1487, id=1, productName=Unmarked objects,
count=10, id=257, version=33145,
count=35, id=261, version=33145,
count=1, id=256, version=33145,
count=78, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wimgapi.dll
- IMPHASH 9b7d8a75632af25669cd502fe6d56c43
- SHA256 912a87583a3885f3ea1496e401292d98c2c57dc64a1387edd6d427b0d7baa77f
- MD5 3aef2a94470e01412229e50602c97d8d
- SHA1 726aefc652c243df291f376329d9d2d2460be186
- SHA512 0a766b4fd1e9606bcbf3fb212cdb0594a789e62274a832fdfba7f2ab5159d619fc0659896e988495d49ead0caa26127e5ae0f284d539201064a9713b3080a56b
- SSDEEP 12288:+W3ms1SwaLanAHjRicS9mP/zuiCt0HcFO7wBdz42DtiC1FYwoz9WH9wC9FCje:+W3NToWqoeKiCHktClFCje
- TLSH T15B155D1E73F81098E9BB963489624626DA7174313331D6CF2151C5BCBF27EE16A39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ed:1b:3a:2b:72:9f:d5:46:3e:89:a9:b2:c0:a1:ed:02:33:fd:a5:24:55:a3:22:ee:95:bf:54:a6:89:b0:6e:fa
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:7F00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1e:a3:ac:a4:6e:39:6f:7c:49:00:01:00:00:02:1e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
352576
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB paths
wimgapi.pdb
msvcrt
_vscwprintf
_callnewh
_purecall
iswspace
memmove_s
memcmp
memcpy
memmove
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
wcstok_s
wcstoul
_wcsupr
_initterm
qsort
malloc
free
_wcsrev
_wcslwr
strcpy_s
towlower
towupper
_strnicmp
memcpy_s
strncpy_s
wcsncmp
wcschr
_wcsnicmp
wcsnlen
wcsstr
_vsnwprintf
_wtoi
_amsg_exit
swscanf_s
wcsrchr
_XcptFilter
_wcsicmp
_wcstoi64
memset
ntdll
RtlGetVersion
RtlDowncaseUnicodeChar
NtYieldExecution
RtlReAllocateHeap
DbgPrintEx
RtlInitializeCriticalSection
RtlDosPathNameToNtPathName_U_WithStatus
RtlRaiseStatus
NtQuerySecurityObject
RtlDeleteResource
RtlReleaseResource
RtlAcquireResourceShared
RtlAcquireResourceExclusive
RtlInitializeResource
RtlGetPersistedStateLocation
RtlCompressBuffer
RtlDecompressBufferEx
NtUnloadKey2
RtlFreeUnicodeString
NtSetEaFile
NtSetSecurityObject
RtlFindAceByType
RtlSetControlSecurityDescriptor
RtlInitUnicodeString
RtlImpersonateSelf
NtQueryVolumeInformationFile
NtCreateFile
NtQueryEaFile
NtQueryInformationProcess
NtQueryInformationFile
RtlGetLastNtStatus
NtSetInformationFile
RtlSetIoCompletionCallback
RtlFreeHeap
NtClose
NtQueryDirectoryFile
RtlAllocateHeap
NtOpenFile
RtlDosPathNameToNtPathName_U
RtlAdjustPrivilege
RtlNtStatusToDosError
RtlGetCompressionWorkSpaceSize
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleHandleW
LoadLibraryExA
LoadLibraryExW
GetModuleHandleExW
GetModuleFileNameW
FreeLibrary
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
SetThreadToken
CreateProcessW
GetExitCodeProcess
CreateThread
OpenProcessToken
TerminateProcess
GetCurrentThread
GetCurrentProcess
TlsSetValue
TlsGetValue
GetCurrentThreadId
TlsFree
GetCurrentProcessId
OpenThreadToken
TlsAlloc
api-ms-win-core-sysinfo-l1-1-0
GlobalMemoryStatusEx
GetSystemInfo
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
bcrypt
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptGetProperty
BCryptHashData
BCryptCreateHash
BCryptDestroyHash
BCryptOpenAlgorithmProvider
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringW
MultiByteToWideChar
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapReAlloc
HeapFree
GetProcessHeap
api-ms-win-core-file-l1-1-0
LocalFileTimeToFileTime
SetFileInformationByHandle
GetVolumePathNameW
CreateFileW
FindNextFileNameW
GetLongPathNameW
DeleteFileW
GetLogicalDriveStringsW
GetDriveTypeW
GetFileInformationByHandle
RemoveDirectoryW
GetVolumeInformationW
GetFullPathNameW
FindFirstFileNameW
SetFileTime
FindFirstFileW
GetFinalPathNameByHandleW
SetFileAttributesW
GetFileAttributesW
FindNextFileW
FindClose
GetTempFileNameW
GetFileSizeEx
UnlockFileEx
LockFileEx
SetEndOfFile
WriteFile
CreateDirectoryW
FlushFileBuffers
GetFileSize
SetFilePointerEx
ReadFile
SetFilePointer
api-ms-win-core-handle-l1-1-0
DuplicateHandle
GetHandleInformation
CloseHandle
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegLoadKeyW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyExW
RegFlushKey
RegUnLoadKeyW
RegSetValueExW
rpcrt4
RpcStringFreeW
I_RpcMapWin32Status
UuidCreate
UuidFromStringW
NdrClientCall3
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcBindingSetAuthInfoW
RpcBindingFree
UuidToStringW
api-ms-win-core-synch-l1-1-0
OpenEventW
InitializeCriticalSection
EnterCriticalSection
ReleaseSemaphore
ResetEvent
WaitForMultipleObjectsEx
SetEvent
CreateEventW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
ReleaseMutex
ReleaseSRWLockExclusive
LeaveCriticalSection
AcquireSRWLockExclusive
WaitForSingleObject
CreateMutexW
CreateSemaphoreExW
api-ms-win-core-processthreads-l1-1-3
SetThreadIdealProcessor
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
GetCurrentDirectoryW
ExpandEnvironmentStringsW
api-ms-win-core-io-l1-1-0
DeviceIoControl
GetOverlappedResult
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-security-base-l1-1-0
GetSecurityDescriptorLength
FreeSid
RevertToSelf
AddAccessAllowedAceEx
SetSecurityDescriptorDacl
AddAccessAllowedAce
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
GetSecurityDescriptorControl
GetAclInformation
InitializeAcl
GetLengthSid
GetTokenInformation
AllocateAndInitializeSid
InitializeSecurityDescriptor
AdjustTokenPrivileges
EqualSid
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-synch-l1-2-1
CreateSemaphoreW
WaitForMultipleObjects
api-ms-win-core-localization-l1-2-2
LCIDToLocaleName
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
CopyFileExW
api-ms-win-core-version-l1-1-0
GetFileVersionInfoSizeExW
VerQueryValueW
GetFileVersionInfoExW
api-ms-win-core-memory-l1-1-0
CreateFileMappingW
UnmapViewOfFile
VirtualQuery
VirtualProtect
MapViewOfFile
api-ms-win-core-wow64-l1-1-0
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
api-ms-win-security-lsalookup-l2-1-0
LookupPrivilegeValueW
api-ms-win-core-file-l1-2-0
GetVolumePathNamesForVolumeNameW
GetVolumeNameForVolumeMountPointW
GetTempPathW
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-string-l2-1-0
CharUpperW
api-ms-win-core-kernel32-legacy-l1-1-0
DosDateTimeToFileTime
api-ms-win-core-privateprofile-l1-1-0
GetPrivateProfileSectionW
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
DllCanUnloadNow
DllMain
WIMAddImagePath
WIMAddImagePaths
WIMAddWimbootEntry
WIMApplyImage
WIMApplyInstance
WIMCaptureImage
WIMCaptureInstance
WIMCloseHandle
WIMCommitImageHandle
WIMCopyFile
WIMCreateFile
WIMCreateFileEx
WIMCreateImageFile
WIMCreateWofCompressedFile
WIMDeleteImage
WIMDeleteImageMounts
WIMEnumImageFiles
WIMExportImage
WIMExtractImageDirectory
WIMExtractImagePath
WIMExtractImagePathByWimHandle
WIMExtractInstancePath
WIMFindFirstImageFile
WIMFindFirstInstanceFile
WIMFindNextImageFile
WIMFindNextInstanceFile
WIMGetAttributes
WIMGetImageCount
WIMGetImageInformation
WIMGetInstanceCount
WIMGetInstanceInformation
WIMGetMessageCallbackCount
WIMGetMountedImageHandle
WIMGetMountedImageInfo
WIMGetMountedImageInfoFromHandle
WIMGetMountedImages
WIMGetWIMBootEntries
WIMGetWIMBootWIMPath
WIMGetWimFileSize
WIMInitFileIOCallbacks
WIMInitializeWofDriver
WIMIsCurrentSystemWimboot
WIMIsReferenceWim
WIMLoadImage
WIMLoadInstance
WIMLoadOSInformation
WIMMountImage
WIMMountImageHandle
WIMProcessCustomImage
WIMReadFileEx
WIMReadImageFile
WIMReadInstanceFile
WIMRedirectFolderBeforeApply
WIMRegisterLogFile
WIMRegisterMessageCallback
WIMRemountImage
WIMSetBootImage
WIMSetCachedSigningLevel
WIMSetFileIOCallbackTemporaryPath
WIMSetImageInformation
WIMSetImageUserSpecifiedCreationTime
WIMSetInstanceInformation
WIMSetReferenceFile
WIMSetTemporaryPath
WIMSetWimGuid
WIMSingleInstanceFile
WIMSplitFile
WIMUnmountImage
WIMUnmountImageHandle
WIMUnregisterLogFile
WIMUnregisterMessageCallback
WIMUpdateWIMBootEntry
WIMWriteFileWithIntegrity
Name
.text
Size
684KB
Virtual Size
681KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
128KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
24KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=80, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=16, id=260, version=33145,
count=343, id=1, productName=Unmarked objects,
count=7, id=257, version=33145,
count=3, id=261, version=33145,
count=1, id=256, version=33145,
count=166, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
win32appinventorycsp.dll
- IMPHASH 02bc30db852368525dfb90471cffc18a
- SHA256 279448c36554e72cd3c286b6f1c6bfb53ad1c62bb4c0b4b4f26f62af037ff95a
- MD5 d8d3052ab25d32ce650fbd161f42e0ff
- SHA1 c492dfae2600ebe7d204df35406a3a3490579501
- SHA512 5a46a132fc62e5a9ed94d94953c84b466d3b07ddeb13df430bc6959c18244499a7e31a9c792b19778019011ec282eb72b1a79f31e9a79f75367bdd7f2dafb28d
- SSDEEP 1536:eldWpRrENTxa2wmwxXk5NTIk9wOzDc+Xjsm8Gfy1I2AiJKoewXn:eDWpeNOmwxXyIEpDt8GgI2ADoewXn
- TLSH T128D3492E77A9246AE176813CC4A2451AD7B2F421131263EF02E0C1BDAF57BE87D3DB51
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
79120
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win32AppInventoryCSP.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o__wcslwr
_o__wcsnicmp
_o_free
_o_iswspace
_o_malloc
_o_memcpy_s
_o_strcpy_s
_o_wcscat_s
_o_wcscpy_s
__C_specific_handler
_CxxThrowException
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
wcschr
wcsstr
wcsrchr
strchr
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
wcscmp
ntdll
NtCreateFile
RtlDosPathNameToRelativeNtPathName_U_WithStatus
LdrGetProcedureAddress
NtQueryInformationFile
NtClose
RtlInitString
LdrGetDllHandle
RtlInitUnicodeString
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
ZwQuerySystemInformation
RtlAppendUnicodeStringToString
RtlAllocateHeap
RtlAppendUnicodeToString
RtlGetNativeSystemInformation
RtlReAllocateHeap
RtlInitUnicodeStringEx
ZwEnumerateKey
RtlFreeHeap
ZwQueryValueKey
ZwClose
ZwOpenKey
RtlDeleteCriticalSection
RtlEqualString
RtlEnterCriticalSection
RtlMultiByteToUnicodeN
RtlInitializeCriticalSection
RtlLeaveCriticalSection
EtwEventUnregister
EtwEventWrite
EtwEventRegister
RtlUpcaseUnicodeChar
RtlInitAnsiString
kernel32
FormatMessageW
GetModuleHandleW
GetProcAddress
GetProcessHeap
HeapAlloc
GetCurrentThreadId
WaitForSingleObject
HeapFree
GetModuleHandleExW
GetModuleFileNameA
DebugBreak
GetLastError
WideCharToMultiByte
IsDebuggerPresent
OutputDebugStringW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateSemaphoreExW
CreateMutexExW
HeapReAlloc
GetCurrentProcessId
LeaveCriticalSection
CreateThreadpoolTimer
OpenSemaphoreW
ReleaseSRWLockShared
DeleteCriticalSection
InitializeCriticalSectionEx
EnterCriticalSection
WaitForSingleObjectEx
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
ReleaseMutex
ReleaseSemaphore
CloseHandle
SetLastError
oleaut32
SysAllocString
VariantInit
SysFreeString
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoTaskMemAlloc
api-ms-win-core-file-l1-1-0
WriteFile
CreateFileW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
GetModuleHandleExA
GetModuleFileNameW
LoadLibraryExW
api-ms-win-core-namedpipe-l1-1-0
SetNamedPipeHandleState
WaitNamedPipeW
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventRegister
EventUnregister
api-ms-win-core-sysinfo-l1-1-0
GetLocalTime
aeinv
GetAppInfo2
GetAppInventory
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
80KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
676B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=30, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=22, id=261, version=33145,
count=1231, id=1, productName=Unmarked objects,
count=9, id=257, version=33145,
count=1, id=256, version=33145,
count=13, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
win32spl.dll
- IMPHASH aaf99b2d3399e5181167629c0b480a57
- SHA256 47becf7b404b6d4daf6a5e258d463d9e7b77ba95a66d0192c27f0d7a38d6ac8f
- MD5 35e2c63ef70b9681fe6adc7b465ea226
- SHA1 b2499ba555bead17794217962e49d3dc44edb839
- SHA512 1da0efc198f449e247316008eeca3f38f22aba3282c64c04b3d8519d938cb0a23a1890e7b12de6978e5ffccd6a3de4d297b5fa490b85cd3bfb5abcc306206e7f
- SSDEEP 24576:jEyXv9zgHZJZwrhMhKn6+hPyr5pXEu0wS12URa5ZKAU9b:jEyXv9QZJaKhSJeQOS8Ug5dSb
- TLSH T155655C6E63E802A8D5FB827CC567060AEAF17C11133196CF0168867D5E3BFD59A3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
269232
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
win32spl.pdb
msvcp_win
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?width@ios_base@std@@QEAA_J_J@Z
?width@ios_base@std@@QEBA_JXZ
?flags@ios_base@std@@QEBAHXZ
?good@ios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??Bid@locale@std@@QEAA_KXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$collate@D@std@@2V0locale@2@A
?id@?$ctype@D@std@@2V0locale@2@A
?uncaught_exception@std@@YA_NXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
_Strxfrm
_Strcoll
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
api-ms-win-crt-string-l1-1-0
memset
wcsncmp
wcscmp
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__purecall
_o__read
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__sopen_dispatch
_o__stricmp
_o__wcsicmp
_o__wcslwr
_o__wcsnicmp
_o__wcstoi64
_o__write
_o__wsopen_dispatch
_o__wtof
_o__wtol
memmove
_o_free
_o_isdigit
_o_isupper
_o_iswspace
_o_malloc
_o_memcpy_s
_o_qsort
_o_realloc
_o_sqrt
_o_strcpy_s
_o_strtod
_o_terminate
_o_tolower
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstok_s
_o_wcstol
_o_wcstoul
__CxxFrameHandler3
__current_exception
__current_exception_context
_CxxThrowException
_o__lseek
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__execute_onexit_table
_o__errno
_o__itow_s
_o__get_errno
_o__crt_atexit
_o__configure_narrow_argv
_o__close
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
wcschr
wcsrchr
wcsstr
__C_specific_handler
__std_terminate
__CxxFrameHandler4
strchr
__std_type_info_compare
memchr
memcmp
memcpy
ntdll
TpWaitForWait
TpReleaseWork
TpWaitForWork
TpAllocAlpcCompletion
TpStartAsyncIoOperation
TpAllocIoCompletion
TpSetTimer
TpAllocTimer
TpAllocWait
TpPostWork
TpAllocWork
RtlNtStatusToDosError
TpSimpleTryPost
TpSetWait
TpCallbackMayRunLong
TpReleasePool
TpWaitForTimer
TpReleaseTimer
TpWaitForIoCompletion
RtlInitUnicodeString
TpReleaseIoCompletion
TpWaitForAlpcCompletion
TpReleaseAlpcCompletion
TpSetPoolMaxThreads
TpSetPoolMinThreads
TpAllocPool
RtlAcquireSRWLockShared
RtlReleaseSRWLockShared
RtlAcquireSRWLockExclusive
RtlReleaseSRWLockExclusive
RtlInitializeSRWLock
NtFsControlFile
NtQuerySystemInformation
RtlIsThreadWithinLoaderCallout
RtlInitAnsiString
RtlOemStringToUnicodeString
RtlUnicodeToOemN
RtlxUnicodeStringToOemSize
NtOpenThreadToken
NtImpersonateAnonymousToken
NtCreateFile
NtClose
RtlValidRelativeSecurityDescriptor
NtSetInformationThread
EtwEventRegister
EtwEventUnregister
EtwEventEnabled
EtwEventWrite
WinSqmIsOptedIn
TpReleaseWait
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
VerSetConditionMask
RtlFreeHeap
NtSetInformationToken
RtlAllocateHeap
WinSqmSetDWORD
WinSqmAddToStreamEx
WinSqmIncrementDWORD
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
SetLastError
api-ms-win-core-file-l1-1-0
FindFirstFileW
FindNextFileW
FindClose
GetFileSize
SetFileTime
SetFileAttributesW
GetFileAttributesW
DeleteFileW
SetFilePointerEx
CreateDirectoryW
WriteFile
RemoveDirectoryW
LocalFileTimeToFileTime
GetFullPathNameW
CreateFileW
ReadFile
SetEndOfFile
CompareFileTime
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
LoadLibraryExW
GetModuleFileNameA
DisableThreadLibraryCalls
LoadStringW
GetModuleFileNameW
FreeLibrary
GetModuleHandleExW
GetModuleHandleW
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetSystemPreferredUILanguages
api-ms-win-core-synch-l1-1-0
ReleaseMutex
AcquireSRWLockExclusive
OpenSemaphoreW
AcquireSRWLockShared
ReleaseSRWLockShared
ReleaseSemaphore
WaitForSingleObject
CreateMutexExW
WaitForSingleObjectEx
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
ResetEvent
CreateEventExW
SetEvent
CreateEventW
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
CreateSemaphoreExW
api-ms-win-core-processthreads-l1-1-0
OpenProcessToken
GetCurrentThread
GetCurrentProcessId
GetCurrentThreadId
OpenThreadToken
SetThreadToken
ExitProcess
TerminateProcess
GetCurrentProcess
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventUnregister
EventSetInformation
EventRegister
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
rpcrt4
RpcAsyncInitializeHandle
RpcAsyncCompleteCall
RpcSmDestroyClientContext
RpcBindingSetObject
RpcEpResolveBinding
NdrMesProcEncodeDecode3
I_RpcExceptionFilter
MesHandleFree
MesDecodeIncrementalHandleCreate
MesEncodeIncrementalHandleCreate
RpcBindingFree
RpcBindingSetOption
RpcStringFreeW
RpcBindingSetAuthInfoExW
RpcBindingFromStringBindingW
RpcStringBindingComposeW
NdrClientCall3
Ndr64AsyncClientCall
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
SubmitThreadpoolWork
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolWork
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks
IsThreadpoolTimerSet
api-ms-win-core-registry-l1-1-0
RegEnumValueW
RegQueryInfoKeyW
RegGetValueW
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyExW
RegEnumKeyExW
RegCloseKey
RegOpenCurrentUser
RegOpenKeyExW
RegQueryValueExW
api-ms-win-security-base-l1-1-0
CreateWellKnownSid
CheckTokenMembership
DuplicateTokenEx
AllocateAndInitializeSid
RevertToSelf
IsWellKnownSid
SetTokenInformation
GetTokenInformation
IsTokenRestricted
IsValidSecurityDescriptor
FreeSid
MakeSelfRelativeSD
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAceEx
AddAccessDeniedAceEx
InitializeAcl
GetLengthSid
CopySid
GetSecurityDescriptorLength
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemDirectoryW
GetSystemInfo
GetVersionExW
GetSystemTimeAsFileTime
oleaut32
VariantCopyInd
LoadTypeLi
GetRecordInfoFromTypeInfo
SysAllocStringLen
VariantClear
SysAllocString
SysFreeString
VariantInit
SafeArrayPtrOfIndex
BSTR_UserSize
BSTR_UserFree
LPSAFEARRAY_UserSize
BSTR_UserUnmarshal64
LPSAFEARRAY_UserFree
LPSAFEARRAY_UserUnmarshal
SafeArrayCreateVector
LPSAFEARRAY_UserFree64
LPSAFEARRAY_UserMarshal64
BSTR_UserUnmarshal
BSTR_UserMarshal
LPSAFEARRAY_UserUnmarshal64
LPSAFEARRAY_UserMarshal
BSTR_UserFree64
BSTR_UserSize64
LPSAFEARRAY_UserSize64
BSTR_UserMarshal64
VariantChangeType
VariantCopy
SafeArrayDestroy
SafeArrayCopyData
SafeArrayGetUBound
SafeArrayPutElement
SysStringLen
SetErrorInfo
LoadRegTypeLi
SafeArrayGetElement
api-ms-win-core-winrt-l1-1-0
RoUninitialize
RoActivateInstance
RoInitialize
RoGetActivationFactory
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
WindowsDeleteString
WindowsGetStringRawBuffer
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processtopology-obsolete-l1-1-0
GetActiveProcessorCount
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
spoolss
GetPrinterDataW
SetPortW
GetJobW
GetPrinterDriverDirectoryW
SetJobW
AppendPrinterNotifyInfoData
SetPrinterDataW
DllFreeSplStr
MIDL_user_allocate1
MIDL_user_free1
IsNameTheLocalMachineOrAClusterSpooler
DeletePrinterConnectionW
RevertToPrinterSelf
ImpersonatePrinterClient
OpenPrinterW
CacheIsNameInNodeList
IsNamedPipeRpcCall
CallRouterFindFirstPrinterChangeNotification
ClosePrinter
DllFreeSplMem
DllAllocSplMem
CallDrvDevModeConversion
AllowRemoteCalls
ReplyPrinterChangeNotificationEx
RouterFreePrinterNotifyInfo
RouterAllocPrinterNotifyInfo
RouterCreatePrintAsyncNotificationChannel
OpenPrinter2W
AllocSplStr
EnumPrintersW
GetPrinterW
SpoolerFindFirstPrinterChangeNotification
GetPrinterDriverW
GetServerPolicy
GetJobNamedPropertyValue
FreePrintPropertyValue
SpoolerFindClosePrinterChangeNotification
SpoolerRefreshPrinterChangeNotification
PartialReplyPrinterChangeNotification
ReplyPrinterChangeNotification
SplUnregisterForSessionEvents
SplRegisterForSessionEvents
localspl
SplCloseSpooler
SplIppSetJobAttributes
SplIppGetJobAttributes
SplIppCreateJobOnPrinter
SplDriverEvent
SplEnableCSRPrinterDeviceInterface
SplAddCSRPrinter
SplClosePrinter
SplStartDocPrinter
SplStartPagePrinter
SplEndPagePrinter
SplEndDocPrinter
SplWritePrinter
LocalReadPrinter
SplAbortPrinter
SplAddJob
SplScheduleJob
SplGetJob
SplReportJobProcessingProgress
SplGetJobNamedPropertyValue
SplEnumJobNamedProperties
SplCreatePrinterIC
SplPlayGdiScriptOnPrinterIC
SplDeletePrinterIC
SplResetPrinter
SplGetPrinterDriverEx
SplGetPrinterDriver
SplGetPrinterData
SplGetPrinterDataEx
SplSetPrinterData
SplCreateSpooler
SplDeletePrinterData
SplDeletePrinterWithJobs
SplGetPrinter
SplSetPrinter
SplGetDriverDir
SplGetJobExtra
SplSetJobExtra
SplSetJob
SplSetJobError
SplDeleteForm
SplAddForm
SplSetForm
SplEnumJobs
SplAddPrinterDriverEx
SplIsLocalDriverAvailable
SplGetDriverUpdateStatus
SplSetDriverUpdateStatus
SplAddPrinter
SplAddMonitor
SplCopyNumberOfFiles
SplEnumPrinterDrivers
SplIsCompatibleDriver
SplEnumPrinters
SplEnumPorts
SplXcvData
SplIsDriverInstalled
SplOpenPrinter
SplSetJobNamedProperty
SplDeleteJobNamedProperty
SplSetCSRPrinterDevnode
SplDoesCSRPrinterDevnodeExist
SplGetUserPropertyBag
SplPrintSupportOperation
SplDeleteSpooler
SplNotifyServerStatus
SplGetPrintClassObject_4CSR
SplSetPrinterDataEx
SplDeletePrinterDataEx
SplCopyFileEvent
SplLoadLibraryTheCopyFileModule
LocalAddForm
LocalDeleteForm
LocalEnumForms
SplEnumForms
SplGetForm
SplMonitorIsInstalled
SplGetPrintClassObject
SplDeletePrintProcCacheData
SplEnumPrintProcCacheData
SplGetLocalDevMode
SplSetPrintProcCacheData
SplGetPrintProcCacheData
SplEnumPrinterKey
SplEnumPrinterDataEx
SplEnumPrinterData
SplDeletePrinterKey
api-ms-win-core-kernel32-legacy-l1-1-0
GetComputerNameW
DosDateTimeToFileTime
api-ms-win-core-kernel32-legacy-l1-1-1
VerifyVersionInfoW
kernelbase
LocalReAlloc
Sleep
LocalAlloc
GetIsEdpEnabled
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
api-ms-win-core-timezone-l1-1-0
GetTimeZoneInformation
FileTimeToSystemTime
api-ms-win-core-registry-l1-1-1
RegDeleteKeyValueW
RegSetKeyValueW
api-ms-win-core-file-l2-1-0
MoveFileExW
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-privateprofile-l1-1-0
GetPrivateProfileSectionW
GetPrivateProfileStringW
combase
ord148
DllMain
InitializePrintMonitor2
InitializePrintProvidor
Name
.text
Size
948KB
Virtual Size
946KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
352KB
Virtual Size
348KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
52KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=86, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=20, id=260, version=33145,
count=5, id=259, version=33145,
count=1750, id=1, productName=Unmarked objects,
count=13, id=257, version=33145,
count=35, id=261, version=33145,
count=1, id=256, version=33145,
count=260, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
win32u.dll
- IMPHASH 737d8f41f494b92838da8aea576c290e
- SHA256 5f48b4b351dc541447b3fb5883857a9cc1728b338bee12c12dee30de41370cfb
- MD5 90e71a56500f374edf3d1855426405f6
- SHA1 4450366117914819edf135a3f875fc787d147165
- SHA512 f3c937a05cc1df19088e6b8e6d1efebfc56d996b99df069c0223763764ea869140592dbad7950ead5a8365f2dab2c7db6a64dfea121ab415bed438b2b58e8df4
- SSDEEP 1536:n9d37P99r/Ec3E0I+uxsfrO/DoNtzW39xcpP7hM22CaeBnn/mAVrNeP2gW12PhzY:n9d37VV/Ec3IrK04a23aepn/mgJD2J
- TLSH T1A1F3C1B9BF3EED45CF37043AAAD92632FB5BD08B939F9DEBCC0685F048041A54518598
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a8:5d:ad:e3:ac:0c:d3:c0:63:64:cf:52:ef:f7:5f:86:04:9e:ab:87:23:7c:34:19:ac:d5:6c:34:4a:03:1b:29
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:55:46:a8:83:17:24:6f:63:e9:00:00:00:00:05:55
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 13, 2025 - Oct 18, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:401A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:19:5e:b2:d8:54:75:f4:b1:8d:00:01:00:00:02:19
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
win32u.pdb
ntdll
RtlVirtualUnwind
RtlUnhandledExceptionFilter
RtlLookupFunctionEntry
RtlCaptureContext
NtTerminateProcess
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
ABI_Get_DpiMetricsArray
ABI_Get_ForegroundWindow
ABI_Get_OemBitmapSetArray
ABI_Get_apfnClientWorkerNtDll
ABI_Get_cbwndExtraInternal
ABI_Get_currentMonitorTopologyId
ABI_Get_tooltipStrings
NtBindCompositionSurface
NtCloseCompositionInputSink
NtCompositionInputThread
NtCompositionSetDropTarget
NtCompositorNotifyExitWindows
NtConfigureInputSpace
NtConfirmCompositionSurfaceIndependentFlipEntry
NtCreateCompositionInputSink
NtCreateCompositionSurfaceHandle
NtCreateImplicitCompositionInputSink
NtDCompositionAddCrossDeviceVisualChild
NtDCompositionBeginFrame
NtDCompositionBoostCompositorClock
NtDCompositionCommitChannel
NtDCompositionCommitSynchronizationObject
NtDCompositionConfirmFrame
NtDCompositionConnectPipe
NtDCompositionCreateAndBindSharedSection
NtDCompositionCreateBufferCollection
NtDCompositionCreateChannel
NtDCompositionCreateConnection
NtDCompositionCreateSharedResourceHandle
NtDCompositionCreateSynchronizationObject
NtDCompositionDestroyChannel
NtDCompositionDestroyConnection
NtDCompositionDuplicateHandleToProcess
NtDCompositionDuplicateSwapchainHandleToDwm
NtDCompositionEnableMMCSS
NtDCompositionGetBatchId
NtDCompositionGetChannels
NtDCompositionGetConnectionBatch
NtDCompositionGetDeletedResources
NtDCompositionGetFrameId
NtDCompositionGetFrameIdFromBatchId
NtDCompositionGetFrameLegacyTokens
NtDCompositionGetFrameStatistics
NtDCompositionGetFrameSurfaceUpdates
NtDCompositionGetMaterialProperty
NtDCompositionGetStatistics
NtDCompositionGetTargetStatistics
NtDCompositionNotifySuperWetInkWork
NtDCompositionProcessChannelBatchBuffer
NtDCompositionRegisterThumbnailVisual
NtDCompositionRegisterVirtualDesktopVisual
NtDCompositionReleaseAllResources
NtDCompositionRemoveCrossDeviceVisualChild
NtDCompositionSendDwmLpcMessage
NtDCompositionSetBlurredWallpaperSurface
NtDCompositionSetChannelCommitCompletionEvent
NtDCompositionSetChannelConnectionId
NtDCompositionSetChildRootVisual
NtDCompositionSetDebugCounter
NtDCompositionSetMaterialProperty
NtDCompositionSuspendAnimations
NtDCompositionSyncWait
NtDCompositionSynchronize
NtDCompositionTelemetrySetApplicationId
NtDCompositionUpdatePointerCapture
NtDCompositionWaitForChannel
NtDCompositionWaitForCompositorClock
NtDesktopCaptureBits
NtDuplicateCompositionInputSink
NtDxgkCancelPresents
NtDxgkCheckSinglePlaneForMultiPlaneOverlaySupport
NtDxgkConnectDoorbell
NtDxgkCreateDoorbell
NtDxgkCreateNativeFence
NtDxgkCreateTrackedWorkload
NtDxgkDDisplayEnum2
NtDxgkDestroyDoorbell
NtDxgkDestroyTrackedWorkload
NtDxgkDisableProcessDebugBlobCollection
NtDxgkDispMgrOperation
NtDxgkDisplayMuxSwitchExecute
NtDxgkDisplayMuxSwitchFinish
NtDxgkDisplayMuxSwitchPrepare
NtDxgkDisplayPortOperation
NtDxgkDuplicateHandle
NtDxgkEnableProcessDebugBlobCollection
NtDxgkEnumAdapters3
NtDxgkEnumProcesses
NtDxgkGetAvailableTrackedWorkloadIndex
NtDxgkGetNativeFenceLogDetail
NtDxgkGetProcessList
NtDxgkGetProperties
NtDxgkGetTrackedWorkloadStatistics
NtDxgkIsFeatureEnabled
NtDxgkMapProcessDebugBlob
NtDxgkNotifyWorkSubmission
NtDxgkOpenNativeFenceFromNtHandle
NtDxgkOutputDuplPresentToHwQueue
NtDxgkPinResources
NtDxgkRegisterVailProcess
NtDxgkResetTrackedWorkloadStatistics
NtDxgkSetProperties
NtDxgkSubmitPresentBltToHwQueue
NtDxgkSubmitPresentToHwQueue
NtDxgkUnmapProcessDebugBlob
NtDxgkUnpinResources
NtDxgkUpdateTrackedWorkload
NtDxgkVailConnect
NtDxgkVailDisconnect
NtDxgkVailPromoteCompositionSurface
NtEnableOneCoreTransformMode
NtFlipObjectAddContent
NtFlipObjectAddPoolBuffer
NtFlipObjectConsumerAcquirePresent
NtFlipObjectConsumerAdjustUsageReference
NtFlipObjectConsumerBeginProcessPresent
NtFlipObjectConsumerEndProcessPresent
NtFlipObjectConsumerPostMessage
NtFlipObjectConsumerQueryBufferInfo
NtFlipObjectCreate
NtFlipObjectDisconnectEndpoint
NtFlipObjectEnablePresentStatisticsType
NtFlipObjectOpen
NtFlipObjectPresentCancel
NtFlipObjectQueryBufferAvailableEvent
NtFlipObjectQueryEndpointConnected
NtFlipObjectQueryLostEvent
NtFlipObjectQueryNextMessageToProducer
NtFlipObjectReadNextMessageToProducer
NtFlipObjectRemoveContent
NtFlipObjectRemovePoolBuffer
NtFlipObjectSetContent
NtGdiAbortDoc
NtGdiAbortPath
NtGdiAddEmbFontToDC
NtGdiAddFontMemResourceEx
NtGdiAddFontResourceW
NtGdiAddInitialFonts
NtGdiAddRemoteFontToDC
NtGdiAddRemoteMMInstanceToDC
NtGdiAlphaBlend
NtGdiAngleArc
NtGdiAnyLinkedFonts
NtGdiArcInternal
NtGdiBRUSHOBJ_DeleteRbrush
NtGdiBRUSHOBJ_hGetColorTransform
NtGdiBRUSHOBJ_pvAllocRbrush
NtGdiBRUSHOBJ_pvGetRbrush
NtGdiBRUSHOBJ_ulGetBrushColor
NtGdiBeginGdiRendering
NtGdiBeginPath
NtGdiBitBlt
NtGdiCLIPOBJ_bEnum
NtGdiCLIPOBJ_cEnumStart
NtGdiCLIPOBJ_ppoGetPath
NtGdiCancelDC
NtGdiChangeGhostFont
NtGdiCheckBitmapBits
NtGdiClearBitmapAttributes
NtGdiClearBrushAttributes
NtGdiCloseFigure
NtGdiColorCorrectPalette
NtGdiCombineRgn
NtGdiCombineTransform
NtGdiComputeXformCoefficients
NtGdiConfigureOPMProtectedOutput
NtGdiConvertMetafileRect
NtGdiCreateBitmap
NtGdiCreateBitmapFromDxSurface
NtGdiCreateBitmapFromDxSurface2
NtGdiCreateClientObj
NtGdiCreateColorSpace
NtGdiCreateColorTransform
NtGdiCreateCompatibleBitmap
NtGdiCreateCompatibleDC
NtGdiCreateDIBBrush
NtGdiCreateDIBSection
NtGdiCreateDIBitmapInternal
NtGdiCreateEllipticRgn
NtGdiCreateHalftonePalette
NtGdiCreateHatchBrushInternal
NtGdiCreateMetafileDC
NtGdiCreateOPMProtectedOutput
NtGdiCreateOPMProtectedOutputs
NtGdiCreatePaletteInternal
NtGdiCreatePatternBrushInternal
NtGdiCreatePen
NtGdiCreateRectRgn
NtGdiCreateRoundRectRgn
NtGdiCreateServerMetaFile
NtGdiCreateSessionMappedDIBSection
NtGdiCreateSolidBrush
NtGdiDDCCIGetCapabilitiesString
NtGdiDDCCIGetCapabilitiesStringLength
NtGdiDDCCIGetTimingReport
NtGdiDDCCIGetVCPFeature
NtGdiDDCCISaveCurrentSettings
NtGdiDDCCISetVCPFeature
NtGdiDdCreateFullscreenSprite
NtGdiDdDDIAbandonSwapChain
NtGdiDdDDIAcquireKeyedMutex
NtGdiDdDDIAcquireKeyedMutex2
NtGdiDdDDIAcquireSwapChain
NtGdiDdDDIAddSurfaceToSwapChain
NtGdiDdDDIAdjustFullscreenGamma
NtGdiDdDDICacheHybridQueryValue
NtGdiDdDDIChangeVideoMemoryReservation
NtGdiDdDDICheckExclusiveOwnership
NtGdiDdDDICheckMonitorPowerState
NtGdiDdDDICheckMultiPlaneOverlaySupport
NtGdiDdDDICheckMultiPlaneOverlaySupport2
NtGdiDdDDICheckMultiPlaneOverlaySupport3
NtGdiDdDDICheckOcclusion
NtGdiDdDDICheckSharedResourceAccess
NtGdiDdDDICheckVidPnExclusiveOwnership
NtGdiDdDDICloseAdapter
NtGdiDdDDIConfigureSharedResource
NtGdiDdDDICreateAllocation
NtGdiDdDDICreateBundleObject
NtGdiDdDDICreateContext
NtGdiDdDDICreateContextVirtual
NtGdiDdDDICreateDCFromMemory
NtGdiDdDDICreateDevice
NtGdiDdDDICreateHwContext
NtGdiDdDDICreateHwQueue
NtGdiDdDDICreateKeyedMutex
NtGdiDdDDICreateKeyedMutex2
NtGdiDdDDICreateOutputDupl
NtGdiDdDDICreateOverlay
NtGdiDdDDICreatePagingQueue
NtGdiDdDDICreateProtectedSession
NtGdiDdDDICreateSwapChain
NtGdiDdDDICreateSynchronizationObject
NtGdiDdDDIDDisplayEnum
NtGdiDdDDIDestroyAllocation
NtGdiDdDDIDestroyAllocation2
NtGdiDdDDIDestroyContext
NtGdiDdDDIDestroyDCFromMemory
NtGdiDdDDIDestroyDevice
NtGdiDdDDIDestroyHwContext
NtGdiDdDDIDestroyHwQueue
NtGdiDdDDIDestroyKeyedMutex
NtGdiDdDDIDestroyOutputDupl
NtGdiDdDDIDestroyOverlay
NtGdiDdDDIDestroyPagingQueue
NtGdiDdDDIDestroyProtectedSession
NtGdiDdDDIDestroySynchronizationObject
NtGdiDdDDIDispMgrCreate
NtGdiDdDDIDispMgrSourceOperation
NtGdiDdDDIDispMgrTargetOperation
NtGdiDdDDIEnumAdapters
NtGdiDdDDIEnumAdapters2
NtGdiDdDDIEscape
NtGdiDdDDIEvict
NtGdiDdDDIExtractBundleObject
NtGdiDdDDIFlipOverlay
NtGdiDdDDIFlushHeapTransitions
NtGdiDdDDIFreeGpuVirtualAddress
NtGdiDdDDIGetAllocationPriority
NtGdiDdDDIGetCachedHybridQueryValue
NtGdiDdDDIGetContextInProcessSchedulingPriority
NtGdiDdDDIGetContextSchedulingPriority
NtGdiDdDDIGetDWMVerticalBlankEvent
NtGdiDdDDIGetDeviceState
NtGdiDdDDIGetDisplayModeList
NtGdiDdDDIGetMemoryBudgetTarget
NtGdiDdDDIGetMultiPlaneOverlayCaps
NtGdiDdDDIGetMultisampleMethodList
NtGdiDdDDIGetOverlayState
NtGdiDdDDIGetPostCompositionCaps
NtGdiDdDDIGetPresentHistory
NtGdiDdDDIGetPresentQueueEvent
NtGdiDdDDIGetProcessDeviceRemovalSupport
NtGdiDdDDIGetProcessSchedulingPriorityBand
NtGdiDdDDIGetProcessSchedulingPriorityClass
NtGdiDdDDIGetResourcePresentPrivateDriverData
NtGdiDdDDIGetRuntimeData
NtGdiDdDDIGetScanLine
NtGdiDdDDIGetSetSwapChainMetadata
NtGdiDdDDIGetSharedPrimaryHandle
NtGdiDdDDIGetSharedResourceAdapterLuid
NtGdiDdDDIGetSharedResourceAdapterLuidFlipManager
NtGdiDdDDIGetSwapChainSurfacePhysicalAddress
NtGdiDdDDIGetYieldPercentage
NtGdiDdDDIInvalidateActiveVidPn
NtGdiDdDDIInvalidateCache
NtGdiDdDDILock
NtGdiDdDDILock2
NtGdiDdDDIMakeResident
NtGdiDdDDIMapGpuVirtualAddress
NtGdiDdDDIMarkDeviceAsError
NtGdiDdDDINetDispGetNextChunkInfo
NtGdiDdDDINetDispQueryMiracastDisplayDeviceStatus
NtGdiDdDDINetDispQueryMiracastDisplayDeviceSupport
NtGdiDdDDINetDispStartMiracastDisplayDevice
NtGdiDdDDINetDispStopMiracastDisplayDevice
NtGdiDdDDIOfferAllocations
NtGdiDdDDIOpenAdapterFromDeviceName
NtGdiDdDDIOpenAdapterFromHdc
NtGdiDdDDIOpenAdapterFromLuid
NtGdiDdDDIOpenBundleObjectNtHandleFromName
NtGdiDdDDIOpenKeyedMutex
NtGdiDdDDIOpenKeyedMutex2
NtGdiDdDDIOpenKeyedMutexFromNtHandle
NtGdiDdDDIOpenNtHandleFromName
NtGdiDdDDIOpenProtectedSessionFromNtHandle
NtGdiDdDDIOpenResource
NtGdiDdDDIOpenResourceFromNtHandle
NtGdiDdDDIOpenSwapChain
NtGdiDdDDIOpenSyncObjectFromNtHandle
NtGdiDdDDIOpenSyncObjectFromNtHandle2
NtGdiDdDDIOpenSyncObjectNtHandleFromName
NtGdiDdDDIOpenSynchronizationObject
NtGdiDdDDIOutputDuplGetFrameInfo
NtGdiDdDDIOutputDuplGetMetaData
NtGdiDdDDIOutputDuplGetPointerShapeData
NtGdiDdDDIOutputDuplPresent
NtGdiDdDDIOutputDuplReleaseFrame
NtGdiDdDDIPollDisplayChildren
NtGdiDdDDIPresent
NtGdiDdDDIPresentMultiPlaneOverlay
NtGdiDdDDIPresentMultiPlaneOverlay2
NtGdiDdDDIPresentMultiPlaneOverlay3
NtGdiDdDDIPresentRedirected
NtGdiDdDDIQueryAdapterInfo
NtGdiDdDDIQueryAllocationResidency
NtGdiDdDDIQueryClockCalibration
NtGdiDdDDIQueryFSEBlock
NtGdiDdDDIQueryProcessOfferInfo
NtGdiDdDDIQueryProtectedSessionInfoFromNtHandle
NtGdiDdDDIQueryProtectedSessionStatus
NtGdiDdDDIQueryRemoteVidPnSourceFromGdiDisplayName
NtGdiDdDDIQueryResourceInfo
NtGdiDdDDIQueryResourceInfoFromNtHandle
NtGdiDdDDIQueryStatistics
NtGdiDdDDIQueryVidPnExclusiveOwnership
NtGdiDdDDIQueryVideoMemoryInfo
NtGdiDdDDIReclaimAllocations
NtGdiDdDDIReclaimAllocations2
NtGdiDdDDIReleaseKeyedMutex
NtGdiDdDDIReleaseKeyedMutex2
NtGdiDdDDIReleaseProcessVidPnSourceOwners
NtGdiDdDDIReleaseSwapChain
NtGdiDdDDIRemoveSurfaceFromSwapChain
NtGdiDdDDIRender
NtGdiDdDDIReserveGpuVirtualAddress
NtGdiDdDDISetAllocationPriority
NtGdiDdDDISetContextInProcessSchedulingPriority
NtGdiDdDDISetContextSchedulingPriority
NtGdiDdDDISetDisplayMode
NtGdiDdDDISetDodIndirectSwapchain
NtGdiDdDDISetFSEBlock
NtGdiDdDDISetGammaRamp
NtGdiDdDDISetHwProtectionTeardownRecovery
NtGdiDdDDISetMemoryBudgetTarget
NtGdiDdDDISetMonitorColorSpaceTransform
NtGdiDdDDISetProcessDeviceRemovalSupport
NtGdiDdDDISetProcessSchedulingPriorityBand
NtGdiDdDDISetProcessSchedulingPriorityClass
NtGdiDdDDISetQueuedLimit
NtGdiDdDDISetStablePowerState
NtGdiDdDDISetStereoEnabled
NtGdiDdDDISetSyncRefreshCountWaitTarget
NtGdiDdDDISetVidPnSourceHwProtection
NtGdiDdDDISetVidPnSourceOwner
NtGdiDdDDISetYieldPercentage
NtGdiDdDDIShareObjects
NtGdiDdDDISharedPrimaryLockNotification
NtGdiDdDDISharedPrimaryUnLockNotification
NtGdiDdDDISignalSynchronizationObject
NtGdiDdDDISignalSynchronizationObjectFromCpu
NtGdiDdDDISignalSynchronizationObjectFromGpu
NtGdiDdDDISignalSynchronizationObjectFromGpu2
NtGdiDdDDISubmitCommand
NtGdiDdDDISubmitCommandToHwQueue
NtGdiDdDDISubmitSignalSyncObjectsToHwQueue
NtGdiDdDDISubmitWaitForSyncObjectsToHwQueue
NtGdiDdDDITrimProcessCommitment
NtGdiDdDDIUnOrderedPresentSwapChain
NtGdiDdDDIUnlock
NtGdiDdDDIUnlock2
NtGdiDdDDIUpdateAllocationProperty
NtGdiDdDDIUpdateGpuVirtualAddress
NtGdiDdDDIUpdateOverlay
NtGdiDdDDIWaitForIdle
NtGdiDdDDIWaitForSynchronizationObject
NtGdiDdDDIWaitForSynchronizationObjectFromCpu
NtGdiDdDDIWaitForSynchronizationObjectFromGpu
NtGdiDdDDIWaitForVerticalBlankEvent
NtGdiDdDDIWaitForVerticalBlankEvent2
NtGdiDdDestroyFullscreenSprite
NtGdiDdNotifyFullscreenSpriteUpdate
NtGdiDdQueryVisRgnUniqueness
NtGdiDeleteClientObj
NtGdiDeleteColorSpace
NtGdiDeleteColorTransform
NtGdiDeleteObjectApp
NtGdiDescribePixelFormat
NtGdiDestroyOPMProtectedOutput
NtGdiDestroyPhysicalMonitor
NtGdiDisableUMPDSandboxing
NtGdiDoBanding
NtGdiDoPalette
NtGdiDrawEscape
NtGdiDrawStream
NtGdiDwmCreatedBitmapRemotingOutput
NtGdiEllipse
NtGdiEnableEudc
NtGdiEndDoc
NtGdiEndGdiRendering
NtGdiEndPage
NtGdiEndPath
NtGdiEngAlphaBlend
NtGdiEngAssociateSurface
NtGdiEngBitBlt
NtGdiEngCheckAbort
NtGdiEngComputeGlyphSet
NtGdiEngCopyBits
NtGdiEngCreateBitmap
NtGdiEngCreateClip
NtGdiEngCreateDeviceBitmap
NtGdiEngCreateDeviceSurface
NtGdiEngCreatePalette
NtGdiEngDeleteClip
NtGdiEngDeletePalette
NtGdiEngDeletePath
NtGdiEngDeleteSurface
NtGdiEngEraseSurface
NtGdiEngFillPath
NtGdiEngGradientFill
NtGdiEngLineTo
NtGdiEngLockSurface
NtGdiEngMarkBandingSurface
NtGdiEngPaint
NtGdiEngPlgBlt
NtGdiEngStretchBlt
NtGdiEngStretchBltROP
NtGdiEngStrokeAndFillPath
NtGdiEngStrokePath
NtGdiEngTextOut
NtGdiEngTransparentBlt
NtGdiEngUnlockSurface
NtGdiEnsureDpiDepDefaultGuiFontForPlateau
NtGdiEnumFonts
NtGdiEnumObjects
NtGdiEqualRgn
NtGdiEudcLoadUnloadLink
NtGdiExcludeClipRect
NtGdiExtCreatePen
NtGdiExtCreateRegion
NtGdiExtEscape
NtGdiExtFloodFill
NtGdiExtGetObjectW
NtGdiExtSelectClipRgn
NtGdiExtTextOutW
NtGdiFONTOBJ_cGetAllGlyphHandles
NtGdiFONTOBJ_cGetGlyphs
NtGdiFONTOBJ_pQueryGlyphAttrs
NtGdiFONTOBJ_pfdg
NtGdiFONTOBJ_pifi
NtGdiFONTOBJ_pvTrueTypeFontFile
NtGdiFONTOBJ_pxoGetXform
NtGdiFONTOBJ_vGetInfo
NtGdiFillPath
NtGdiFillRgn
NtGdiFlattenPath
NtGdiFlush
NtGdiFontIsLinked
NtGdiForceUFIMapping
NtGdiFrameRgn
NtGdiFullscreenControl
NtGdiGetAndSetDCDword
NtGdiGetAppClipBox
NtGdiGetBitmapBits
NtGdiGetBitmapDimension
NtGdiGetBitmapDpiScaleValue
NtGdiGetBoundsRect
NtGdiGetCOPPCompatibleOPMInformation
NtGdiGetCertificate
NtGdiGetCertificateByHandle
NtGdiGetCertificateSize
NtGdiGetCertificateSizeByHandle
NtGdiGetCharABCWidthsW
NtGdiGetCharSet
NtGdiGetCharWidthInfo
NtGdiGetCharWidthW
NtGdiGetCharacterPlacementW
NtGdiGetColorAdjustment
NtGdiGetColorSpaceforBitmap
NtGdiGetCurrentDpiInfo
NtGdiGetDCDpiScaleValue
NtGdiGetDCDword
NtGdiGetDCObject
NtGdiGetDCPoint
NtGdiGetDCforBitmap
NtGdiGetDIBitsInternal
NtGdiGetDeviceCaps
NtGdiGetDeviceCapsAll
NtGdiGetDeviceWidth
NtGdiGetDhpdev
NtGdiGetETM
NtGdiGetEmbUFI
NtGdiGetEmbedFonts
NtGdiGetEntry
NtGdiGetEudcTimeStampEx
NtGdiGetFontData
NtGdiGetFontFileData
NtGdiGetFontFileInfo
NtGdiGetFontResourceInfoInternalW
NtGdiGetFontUnicodeRanges
NtGdiGetGlyphIndicesW
NtGdiGetGlyphIndicesWInternal
NtGdiGetGlyphOutline
NtGdiGetKerningPairs
NtGdiGetLinkedUFIs
NtGdiGetMiterLimit
NtGdiGetMonitorID
NtGdiGetNearestColor
NtGdiGetNearestPaletteIndex
NtGdiGetNumberOfPhysicalMonitors
NtGdiGetOPMInformation
NtGdiGetOPMRandomNumber
NtGdiGetObjectBitmapHandle
NtGdiGetOutlineTextMetricsInternalW
NtGdiGetPath
NtGdiGetPerBandInfo
NtGdiGetPhysicalMonitorDescription
NtGdiGetPhysicalMonitorFromTarget
NtGdiGetPhysicalMonitors
NtGdiGetPixel
NtGdiGetProcessSessionFonts
NtGdiGetPublicFontTableChangeCookie
NtGdiGetRandomRgn
NtGdiGetRasterizerCaps
NtGdiGetRealizationInfo
NtGdiGetRegionData
NtGdiGetRgnBox
NtGdiGetServerMetaFileBits
NtGdiGetSpoolMessage
NtGdiGetStats
NtGdiGetStringBitmapW
NtGdiGetSuggestedOPMProtectedOutputArraySize
NtGdiGetSystemPaletteUse
NtGdiGetTextCharsetInfo
NtGdiGetTextExtent
NtGdiGetTextExtentExW
NtGdiGetTextFaceW
NtGdiGetTextMetricsW
NtGdiGetTransform
NtGdiGetUFI
NtGdiGetUFIPathname
NtGdiGetWidthTable
NtGdiGradientFill
NtGdiHLSurfGetInformation
NtGdiHLSurfSetInformation
NtGdiHT_Get8BPPFormatPalette
NtGdiHT_Get8BPPMaskPalette
NtGdiHfontCreate
NtGdiIcmBrushInfo
NtGdiInit
NtGdiInit2
NtGdiInitSpool
NtGdiIntersectClipRect
NtGdiInvertRgn
NtGdiLineTo
NtGdiMakeFontDir
NtGdiMakeInfoDC
NtGdiMakeObjectUnXferable
NtGdiMakeObjectXferable
NtGdiMaskBlt
NtGdiMirrorWindowOrg
NtGdiModifyWorldTransform
NtGdiMonoBitmap
NtGdiMoveTo
NtGdiOffsetClipRgn
NtGdiOffsetRgn
NtGdiOpenDCW
NtGdiPATHOBJ_bEnum
NtGdiPATHOBJ_bEnumClipLines
NtGdiPATHOBJ_vEnumStart
NtGdiPATHOBJ_vEnumStartClipLines
NtGdiPATHOBJ_vGetBounds
NtGdiPatBlt
NtGdiPathToRegion
NtGdiPlgBlt
NtGdiPolyDraw
NtGdiPolyPatBlt
NtGdiPolyPolyDraw
NtGdiPolyTextOutW
NtGdiPtInRegion
NtGdiPtVisible
NtGdiQueryFontAssocInfo
NtGdiQueryFonts
NtGdiRectInRegion
NtGdiRectVisible
NtGdiRectangle
NtGdiRemoveFontMemResourceEx
NtGdiRemoveFontResourceW
NtGdiRemoveMergeFont
NtGdiResetDC
NtGdiResizePalette
NtGdiRestoreDC
NtGdiRoundRect
NtGdiSTROBJ_bEnum
NtGdiSTROBJ_bEnumPositionsOnly
NtGdiSTROBJ_bGetAdvanceWidths
NtGdiSTROBJ_dwGetCodePage
NtGdiSTROBJ_vEnumStart
NtGdiSaveDC
NtGdiScaleRgn
NtGdiScaleValues
NtGdiScaleViewportExtEx
NtGdiScaleWindowExtEx
NtGdiSelectBitmap
NtGdiSelectBrush
NtGdiSelectClipPath
NtGdiSelectFont
NtGdiSelectPen
NtGdiSetBitmapAttributes
NtGdiSetBitmapBits
NtGdiSetBitmapDimension
NtGdiSetBoundsRect
NtGdiSetBrushAttributes
NtGdiSetBrushOrg
NtGdiSetColorAdjustment
NtGdiSetColorSpace
NtGdiSetDIBitsToDeviceInternal
NtGdiSetFontEnumeration
NtGdiSetFontXform
NtGdiSetIcmMode
NtGdiSetLayout
NtGdiSetLinkedUFIs
NtGdiSetMagicColors
NtGdiSetMetaRgn
NtGdiSetMiterLimit
NtGdiSetOPMSigningKeyAndSequenceNumbers
NtGdiSetPUMPDOBJ
NtGdiSetPixel
NtGdiSetPixelFormat
NtGdiSetRectRgn
NtGdiSetSizeDevice
NtGdiSetSystemPaletteUse
NtGdiSetTextJustification
NtGdiSetUMPDSandboxState
NtGdiSetVirtualResolution
NtGdiStartDoc
NtGdiStartPage
NtGdiStretchBlt
NtGdiStretchDIBitsInternal
NtGdiStrokeAndFillPath
NtGdiStrokePath
NtGdiSwapBuffers
NtGdiTransformPoints
NtGdiTransparentBlt
NtGdiUMPDEngFreeUserMem
NtGdiUnloadPrinterDriver
NtGdiUnmapMemFont
NtGdiUnrealizeObject
NtGdiUpdateColors
NtGdiUpdateTransform
NtGdiWaitForTextReady
NtGdiWidenPath
NtGdiXFORMOBJ_bApplyXform
NtGdiXFORMOBJ_iGetXform
NtGdiXLATEOBJ_cGetPalette
NtGdiXLATEOBJ_hGetColorTransform
NtGdiXLATEOBJ_iXlate
NtHWCursorUpdatePointer
NtInputSpaceRegionFromPoint
NtIsOneCoreTransformMode
NtKSTInitialize
NtKSTWait
NtMITAccessibilityTimerNotification
NtMITActivateInputProcessing
NtMITConfigureVirtualTouchpad
NtMITCoreMsgKOpenConnectionTo
NtMITDeactivateInputProcessing
NtMITDisableMouseIntercept
NtMITDispatchCompletion
NtMITEnableMouseIntercept
NtMITGetCursorUpdateHandle
NtMITInitMinuserThread
NtMITMinuserSetInputTransformOffset
NtMITMinuserWindowDestroyed
NtMITPostMouseInputMessage
NtMITPostThreadEventMessage
NtMITPostWindowEventMessage
NtMITPrepareReceiveInputMessage
NtMITPrepareSendInputMessage
NtMITProcessDelegateCapturedPointers
NtMITSetInputCallbacks
NtMITSetInputDelegationMode
NtMITSetInputObservationState
NtMITSetKeyboardInputRoutingPolicy
NtMITSetKeyboardOverriderState
NtMITSetLastInputRecipient
NtMITSynthesizeKeyboardInput
NtMITSynthesizeMouseInput
NtMITSynthesizeTouchInput
NtMITUninitMinuserThread
NtMITUpdateInputGlobals
NtMapVisualRelativePoints
NtMinGetInputTransform
NtMinInteropCoreMessagingWithInput
NtMinQPeekForInput
NtMinQSuspendInputProcessing
NtMinQUpdateWakeMask
NtModerncoreBeginLayoutUpdate
NtModerncoreCreateDCompositionHwndTarget
NtModerncoreCreateGDIHwndTarget
NtModerncoreDestroyDCompositionHwndTarget
NtModerncoreDestroyGDIHwndTarget
NtModerncoreEnableResizeLayoutSynchronization
NtModerncoreGetNavigationWindowVisual
NtModerncoreGetResizeDCompositionSynchronizationObject
NtModerncoreGetWindowContentVisual
NtModerncoreIdleTimerThread
NtModerncoreIsResizeLayoutSynchronizationEnabled
NtModerncoreProcessConnect
NtModerncoreRegisterEnhancedNavigationWindowHandle
NtModerncoreRegisterNavigationWindowHandle
NtModerncoreSetNavigationServiceSid
NtModerncoreUnregisterNavigationWindowHandle
NtNotifyPresentToCompositionSurface
NtOpenCompositionSurfaceDirtyRegion
NtOpenCompositionSurfaceRealizationInfo
NtOpenCompositionSurfaceSectionInfo
NtQueryCompositionInputIsImplicit
NtQueryCompositionInputQueueAndTransform
NtQueryCompositionInputSink
NtQueryCompositionInputSinkLuid
NtQueryCompositionInputSinkViewId
NtQueryCompositionSurfaceBinding
NtQueryCompositionSurfaceFrameRate
NtQueryCompositionSurfaceHDRMetaData
NtQueryCompositionSurfaceRenderingRealization
NtQueryCompositionSurfaceStatistics
NtRIMAddInputObserver
NtRIMAreSiblingDevices
NtRIMDeviceIoControl
NtRIMEnableMonitorMappingForDevice
NtRIMFreeInputBuffer
NtRIMGetDevicePreparsedData
NtRIMGetDevicePreparsedDataLockfree
NtRIMGetDeviceProperties
NtRIMGetDevicePropertiesLockfree
NtRIMGetPhysicalDeviceRect
NtRIMGetSourceProcessId
NtRIMObserveNextInput
NtRIMOnAsyncPnpWorkNotification
NtRIMOnPnpNotification
NtRIMOnTimerNotification
NtRIMQueryDevicePath
NtRIMReadInput
NtRIMRegisterForInput
NtRIMRegisterForInputEx
NtRIMRemoveInputObserver
NtRIMSetDeadzoneRotation
NtRIMSetExtendedDeviceProperty
NtRIMSetTestModeStatus
NtRIMUnregisterForInput
NtRIMUpdateInputObserverRegistration
NtSetCompositionSurfaceAnalogExclusive
NtSetCompositionSurfaceBufferUsage
NtSetCompositionSurfaceDirectFlipState
NtSetCompositionSurfaceIndependentFlipInfo
NtSetCompositionSurfaceStatistics
NtSetCursorInputSpace
NtSetPointerDeviceInputSpace
NtSetShellCursorState
NtTokenManagerConfirmOutstandingAnalogToken
NtTokenManagerCreateCompositionTokenHandle
NtTokenManagerCreateFlipObjectReturnTokenHandle
NtTokenManagerCreateFlipObjectTokenHandle
NtTokenManagerGetAnalogExclusiveSurfaceUpdates
NtTokenManagerGetAnalogExclusiveTokenEvent
NtTokenManagerOpenSectionAndEvents
NtTokenManagerThread
NtUnBindCompositionSurface
NtUpdateInputSinkTransforms
NtUserAcquireIAMKey
NtUserAcquireInteractiveControlBackgroundAccess
NtUserActivateKeyboardLayout
NtUserAddClipboardFormatListener
NtUserAddVisualIdentifier
NtUserAllowForegroundActivation
NtUserAllowSetForegroundWindow
NtUserAlterWindowStyle
NtUserApplyWindowAction
NtUserArrangeIconicWindows
NtUserAssociateInputContext
NtUserAttachThreadInput
NtUserAutoPromoteMouseInPointer
NtUserAutoRotateScreen
NtUserBeginDeferWindowPos
NtUserBeginLayoutUpdate
NtUserBeginPaint
NtUserBitBltSysBmp
NtUserBlockInput
NtUserBroadcastImeShowStatusChange
NtUserBroadcastThemeChangeEvent
NtUserBuildHimcList
NtUserBuildHwndList
NtUserBuildNameList
NtUserBuildPropList
NtUserCalcMenuBar
NtUserCalculatePopupWindowPosition
NtUserCallHwnd
NtUserCallHwndLock
NtUserCallHwndLockSafe
NtUserCallHwndOpt
NtUserCallHwndParam
NtUserCallHwndParamLock
NtUserCallHwndParamLockSafe
NtUserCallHwndSafe
NtUserCallMsgFilter
NtUserCallNextHookEx
NtUserCallNoParam
NtUserCallOneParam
NtUserCallTwoParam
NtUserCanBrokerForceForeground
NtUserCanCurrentThreadChangeForeground
NtUserCancelQueueEventCompletionPacket
NtUserChangeClipboardChain
NtUserChangeDisplaySettings
NtUserChangeWindowMessageFilter
NtUserChangeWindowMessageFilterEx
NtUserCheckAccessForIntegrityLevel
NtUserCheckImeShowStatusInThread
NtUserCheckMenuItem
NtUserCheckProcessForClipboardAccess
NtUserCheckProcessSession
NtUserCheckWindowThreadDesktop
NtUserChildWindowFromPointEx
NtUserCitSetInfo
NtUserClearForeground
NtUserClearWakeMask
NtUserClearWindowState
NtUserClipCursor
NtUserCloseClipboard
NtUserCloseDesktop
NtUserCloseWindowStation
NtUserCompositionInputSinkLuidFromPoint
NtUserCompositionInputSinkViewInstanceIdFromPoint
NtUserConfigureActivationObject
NtUserConfirmResizeCommit
NtUserConsoleControl
NtUserConvertMemHandle
NtUserConvertPrimaryPointerToMouseDrag
NtUserConvertToInterceptWindow
NtUserCopyAcceleratorTable
NtUserCountClipboardFormats
NtUserCreateAcceleratorTable
NtUserCreateActivationObject
NtUserCreateBaseWindow
NtUserCreateCaret
NtUserCreateDCompositionHwndTarget
NtUserCreateDesktopEx
NtUserCreateEmptyCursorObject
NtUserCreateInputContext
NtUserCreateLayoutSyncForHwnd
NtUserCreateLocalMemHandle
NtUserCreateMenu
NtUserCreatePalmRejectionDelayZone
NtUserCreatePopupMenu
NtUserCreateSyntheticPointerDevice2
NtUserCreateSystemThreads
NtUserCreateWindowEx
NtUserCreateWindowStation
NtUserCreateWindowStationEx
NtUserCsDdeUninitialize
NtUserCtxDisplayIOCtl
NtUserDWP_GetEnabledPopupOffset
NtUserDdeInitialize
NtUserDefSetText
NtUserDeferWindowDpiChanges
NtUserDeferWindowPosAndBand
NtUserDeferredDesktopRotation
NtUserDelegateCapturePointers
NtUserDelegateInput
NtUserDeleteMenu
NtUserDeregisterShellHookWindow
NtUserDestroyAcceleratorTable
NtUserDestroyActivationObject
NtUserDestroyCaret
NtUserDestroyCursor
NtUserDestroyDCompositionHwndTarget
NtUserDestroyInputContext
NtUserDestroyMenu
NtUserDestroyPalmRejectionDelayZone
NtUserDestroyWindow
NtUserDirectedYield
NtUserDisableImmersiveOwner
NtUserDisableProcessWindowFiltering
NtUserDisableProcessWindowsGhosting
NtUserDisableThreadIme
NtUserDiscardPointerFrameMessages
NtUserDispatchMessage
NtUserDisplayConfigGetDeviceInfo
NtUserDisplayConfigSetDeviceInfo
NtUserDoInitMessagePumpHook
NtUserDoSoundConnect
NtUserDoSoundDisconnect
NtUserDoUninitMessagePumpHook
NtUserDownlevelTouchpad
NtUserDragDetect
NtUserDragObject
NtUserDrainThreadCoreMessagingCompletions
NtUserDrainThreadCoreMessagingCompletions2
NtUserDrawAnimatedRects
NtUserDrawCaption
NtUserDrawCaptionTemp
NtUserDrawIconEx
NtUserDrawMenuBar
NtUserDrawMenuBarTemp
NtUserDwmGetRemoteSessionOcclusionEvent
NtUserDwmGetRemoteSessionOcclusionState
NtUserDwmKernelShutdown
NtUserDwmKernelStartup
NtUserDwmLockScreenUpdates
NtUserDwmValidateWindow
NtUserDwmWindowNotificationsEnabled
NtUserEmptyClipboard
NtUserEnableChildWindowDpiMessage
NtUserEnableIAMAccess
NtUserEnableMenuItem
NtUserEnableModernAppWindowKeyboardIntercept
NtUserEnableMouseInPointer
NtUserEnableMouseInPointerForThread
NtUserEnableMouseInPointerForWindow
NtUserEnableMouseInputForCursorSuppression
NtUserEnableNonClientDpiScaling
NtUserEnablePerMonitorMenuScaling
NtUserEnableResizeLayoutSynchronization
NtUserEnableScrollBar
NtUserEnableSessionForMMCSS
NtUserEnableShellWindowManagementBehavior
NtUserEnableSoftwareCursorForScreenCapture
NtUserEnableSynchronizedLayout
NtUserEnableTouchPad
NtUserEnableWindow
NtUserEnableWindowGDIScaledDpiMessage
NtUserEnableWindowResizeOptimization
NtUserEnableWindowShellWindowManagementBehavior
NtUserEndDeferWindowPosEx
NtUserEndMenu
NtUserEndPaint
NtUserEnsureDpiDepSysMetCacheForPlateau
NtUserEnsureDpiMetricsForDpi
NtUserEnsureDpiServerInfoForDpi
NtUserEnsureOemBitmapInfoForDpi
NtUserEnterMoveSizeLoop
NtUserEnumClipboardFormats
NtUserEnumDisplayDevices
NtUserEnumDisplayMonitors
NtUserEnumDisplaySettings
NtUserEvent
NtUserExcludeUpdateRgn
NtUserFillWindow
NtUserFindExistingCursorIcon
NtUserFindWindowEx
NtUserFlashWindowEx
NtUserForceEnableNumpadTranslation
NtUserForceMaxTouchpadSensitivityForCurrentProcess
NtUserForceWindowToDpiForTest
NtUserFrostCrashedWindow
NtUserFunctionalizeDisplayConfig
NtUserGetActiveProcessesDpis
NtUserGetAltTabInfo
NtUserGetAncestor
NtUserGetAppImeLevel
NtUserGetAsyncKeyState
NtUserGetAtomName
NtUserGetAutoRotationState
NtUserGetCIMSSM
NtUserGetCPD
NtUserGetCaretBlinkTime
NtUserGetCaretPos
NtUserGetClassIcoCur
NtUserGetClassInfoEx
NtUserGetClassName
NtUserGetClipCursor
NtUserGetClipboardAccessToken
NtUserGetClipboardData
NtUserGetClipboardFormatName
NtUserGetClipboardMetadata
NtUserGetClipboardOwner
NtUserGetClipboardSequenceNumber
NtUserGetClipboardViewer
NtUserGetComboBoxInfo
NtUserGetControlBrush
NtUserGetControlColor
NtUserGetCurrentDpiInfoForWindow
NtUserGetCurrentInputMessageSource
NtUserGetCursor
NtUserGetCursorFrameInfo
NtUserGetCursorInfo
NtUserGetCursorPos
NtUserGetDC
NtUserGetDCEx
NtUserGetDCompositionHwndBitmap
NtUserGetDManipHookInitFunction
NtUserGetDesktopID
NtUserGetDesktopVisualTransform
NtUserGetDeviceChangeInfo
NtUserGetDisplayAutoRotationPreferences
NtUserGetDisplayAutoRotationPreferencesByProcessId
NtUserGetDisplayConfigBufferSizes
NtUserGetDoubleClickTime
NtUserGetDpiForCurrentProcess
NtUserGetDpiForMonitor
NtUserGetDwmCursorShape
NtUserGetExtendedPointerDeviceProperty
NtUserGetForegroundWindow
NtUserGetGUIThreadInfo
NtUserGetGestureConfig
NtUserGetGestureExtArgs
NtUserGetGestureInfo
NtUserGetGuiResources
NtUserGetHDevName
NtUserGetHimetricScaleFactorFromPixelLocation
NtUserGetIMEShowStatus
NtUserGetIconInfo
NtUserGetIconSize
NtUserGetImeHotKey
NtUserGetImeInfoEx
NtUserGetInputContainerId
NtUserGetInputDesktop
NtUserGetInputEvent
NtUserGetInputLocaleInfo
NtUserGetInteractiveControlDeviceInfo
NtUserGetInteractiveControlInfo
NtUserGetInteractiveCtrlSupportedWaveforms
NtUserGetInternalWindowPos
NtUserGetKeyNameText
NtUserGetKeyState
NtUserGetKeyboardInputThreadId
NtUserGetKeyboardLayout
NtUserGetKeyboardLayoutList
NtUserGetKeyboardLayoutName
NtUserGetKeyboardState
NtUserGetKeyboardType
NtUserGetLatestInputMessageData
NtUserGetLayeredWindowAttributes
NtUserGetListBoxInfo
NtUserGetMenuBarInfo
NtUserGetMenuIndex
NtUserGetMenuItemRect
NtUserGetMessage
NtUserGetMessagePos
NtUserGetMinuserIdForBaseWindow
NtUserGetModernAppWindow
NtUserGetMouseMovePointsEx
NtUserGetObjectInformation
NtUserGetOemBitmapSize
NtUserGetOpenClipboardWindow
NtUserGetOwnerTransformedMonitorRect
NtUserGetPhysicalDeviceRect
NtUserGetPointerCursorId
NtUserGetPointerDevice
NtUserGetPointerDeviceCursors
NtUserGetPointerDeviceInputSpace
NtUserGetPointerDeviceOrientation
NtUserGetPointerDeviceProperties
NtUserGetPointerDeviceRects
NtUserGetPointerDevices
NtUserGetPointerFrameTimes
NtUserGetPointerIdForPromotion
NtUserGetPointerInfoList
NtUserGetPointerInputTransform
NtUserGetPointerProprietaryId
NtUserGetPointerType
NtUserGetPrecisionTouchPadConfiguration
NtUserGetPriorityClipboardFormat
NtUserGetProcessDefaultLayout
NtUserGetProcessDpiAwarenessContext
NtUserGetProcessUIContextInformation
NtUserGetProcessWindowStation
NtUserGetProp
NtUserGetProp2
NtUserGetQueueIocp
NtUserGetQueueStatus
NtUserGetQueueStatusReadonly
NtUserGetRawInputBuffer
NtUserGetRawInputData
NtUserGetRawInputDeviceInfo
NtUserGetRawInputDeviceList
NtUserGetRawPointerDeviceData
NtUserGetRegisteredRawInputDevices
NtUserGetRequiredCursorSizes
NtUserGetResizeDCompositionSynchronizationObject
NtUserGetScrollBarInfo
NtUserGetSendMessageReceiver
NtUserGetSharedWindowData
NtUserGetSuppressedWindowActions
NtUserGetSysMenuOffset
NtUserGetSystemContentRects
NtUserGetSystemDpiForProcess
NtUserGetSystemMenu
NtUserGetThreadDesktop
NtUserGetThreadState
NtUserGetTitleBarInfo
NtUserGetTopLevelWindow
NtUserGetTouchInputInfo
NtUserGetTouchValidationStatus
NtUserGetUniformSpaceMapping
NtUserGetUnpredictedMessagePos
NtUserGetUpdateRect
NtUserGetUpdateRgn
NtUserGetUpdatedClipboardFormats
NtUserGetWOWClass
NtUserGetWinStationInfo
NtUserGetWindowBand
NtUserGetWindowCompositionAttribute
NtUserGetWindowCompositionInfo
NtUserGetWindowContextHelpId
NtUserGetWindowDC
NtUserGetWindowDisplayAffinity
NtUserGetWindowFeedbackSetting
NtUserGetWindowMinimizeRect
NtUserGetWindowPlacement
NtUserGetWindowProcessHandle
NtUserGetWindowRgnEx
NtUserGetWindowThreadProcessId
NtUserGetWindowTrackInfoAsync
NtUserGhostWindowFromHungWindow
NtUserGrantJobUIRestrictionException
NtUserHandleDelegatedInput
NtUserHandleSystemThreadCreationFailure
NtUserHardErrorControl
NtUserHideCaret
NtUserHideCursorNoCapture
NtUserHidePointerContactVisualization
NtUserHiliteMenuItem
NtUserHungWindowFromGhostWindow
NtUserHwndQueryRedirectionInfo
NtUserHwndSetRedirectionInfo
NtUserImpersonateDdeClientWindow
NtUserInheritWindowMonitor
NtUserInitAnsiOem
NtUserInitTask
NtUserInitThreadCoreMessagingIocp
NtUserInitThreadCoreMessagingIocp2
NtUserInitialize
NtUserInitializeClientPfnArrays
NtUserInitializeGenericHidInjection
NtUserInitializeInputDeviceInjection
NtUserInitializePointerDeviceInjection
NtUserInitializePointerDeviceInjectionEx
NtUserInitializeTouchInjection
NtUserInitializeUserModeMenus
NtUserInjectDeviceInput
NtUserInjectGenericHidInput
NtUserInjectGesture
NtUserInjectKeyboardInput
NtUserInjectMouseInput
NtUserInjectPointerInput
NtUserInjectTouchInput
NtUserInjectTouchpadAction
NtUserInteractiveControlQueryUsage
NtUserInternalGetWindowIcon
NtUserInternalGetWindowText
NtUserInternalStartMoveSize
NtUserInternalToUnicode
NtUserInvalidateRect
NtUserInvalidateRgn
NtUserIsChildWindowDpiMessageEnabled
NtUserIsClipboardFormatAvailable
NtUserIsInterceptWindow
NtUserIsMouseInPointerEnabled
NtUserIsMouseInputEnabled
NtUserIsNonClientDpiScalingEnabled
NtUserIsQueueAttached
NtUserIsResizeLayoutSynchronizationEnabled
NtUserIsTopLevelWindow
NtUserIsTouchWindow
NtUserIsWindowBroadcastingDpiToChildren
NtUserIsWindowDisplayChangeSuppressed
NtUserIsWindowGDIScaledDpiMessageEnabled
NtUserKillSystemTimer
NtUserKillTimer
NtUserLW_LoadFonts
NtUserLayoutCompleted
NtUserLinkDpiCursor
NtUserLoadCursorsAndIcons
NtUserLoadKeyboardLayoutEx
NtUserLoadUserApiHook
NtUserLockCursor
NtUserLockSetForegroundWindow
NtUserLockWindowStation
NtUserLockWindowUpdate
NtUserLockWorkStation
NtUserLogicalToPerMonitorDPIPhysicalPoint
NtUserLogicalToPhysicalDpiPointForWindow
NtUserLogicalToPhysicalPoint
NtUserMNDragLeave
NtUserMNDragOver
NtUserMagControl
NtUserMagGetContextInformation
NtUserMagSetContextInformation
NtUserMapDesktopObject
NtUserMapPointsByVisualIdentifier
NtUserMapVirtualKeyEx
NtUserMarkWindowForRawMouse
NtUserMenuItemFromPoint
NtUserMessageBeep
NtUserMessageCall
NtUserMinInitialize
NtUserMinMaximize
NtUserModifyUserStartupInfoFlags
NtUserModifyWindowTouchCapability
NtUserMoveWindow
NtUserMsgWaitForMultipleObjectsEx
NtUserNavigateFocus
NtUserNlsKbdSendIMENotification
NtUserNotifyIMEStatus
NtUserNotifyOverlayWindow
NtUserNotifyProcessCreate
NtUserNotifyWinEvent
NtUserOpenClipboard
NtUserOpenDesktop
NtUserOpenInputDesktop
NtUserOpenThreadDesktop
NtUserOpenWindowStation
NtUserPaintDesktop
NtUserPaintMenuBar
NtUserPaintMonitor
NtUserPeekMessage
NtUserPerMonitorDPIPhysicalToLogicalPoint
NtUserPhysicalToLogicalDpiPointForWindow
NtUserPhysicalToLogicalPoint
NtUserPlayEventSound
NtUserPostKeyboardInputMessage
NtUserPostMessage
NtUserPostQuitMessage
NtUserPostThreadMessage
NtUserPrepareForLogoff
NtUserPrintWindow
NtUserProcessConnect
NtUserProcessInkFeedbackCommand
NtUserPromoteMouseInPointer
NtUserPromotePointer
NtUserPromotePrimaryPointerToDrag
NtUserQueryBSDRWindow
NtUserQueryDisplayConfig
NtUserQueryInformationThread
NtUserQueryInputContext
NtUserQuerySendMessage
NtUserQueryWindow
NtUserRaiseLowerShellWindow
NtUserRealChildWindowFromPoint
NtUserRealInternalGetMessage
NtUserRealWaitMessageEx
NtUserRealizePalette
NtUserReassociateQueueEventCompletionPacket
NtUserRedrawFrame
NtUserRedrawFrameAndHook
NtUserRedrawTitle
NtUserRedrawWindow
NtUserRegisterBSDRWindow
NtUserRegisterClassExWOW
NtUserRegisterCloakedNotification
NtUserRegisterCoreMessagingEndPoint
NtUserRegisterDManipHook
NtUserRegisterEdgy
NtUserRegisterErrorReportingDialog
NtUserRegisterForCustomDockTargets
NtUserRegisterForTooltipDismissNotification
NtUserRegisterGhostWindow
NtUserRegisterHotKey
NtUserRegisterLPK
NtUserRegisterLogonProcess
NtUserRegisterManipulationThread
NtUserRegisterPointerDeviceNotifications
NtUserRegisterPointerInputTarget
NtUserRegisterPrecisionTouchpadWindow
NtUserRegisterRawInputDevices
NtUserRegisterServicesProcess
NtUserRegisterSessionPort
NtUserRegisterShellHookWindow
NtUserRegisterShellPTPListener
NtUserRegisterSiblingFrostWindow
NtUserRegisterSystemThread
NtUserRegisterTasklist
NtUserRegisterTouchHitTestingWindow
NtUserRegisterTouchPadCapable
NtUserRegisterTouchpadCapableWindow
NtUserRegisterUserApiHook
NtUserRegisterUserHungAppHandlers
NtUserRegisterWindowArrangementCallout
NtUserRegisterWindowMessage
NtUserReleaseCapture
NtUserReleaseDC
NtUserReleaseDwmHitTestWaiters
NtUserRemoteConnect
NtUserRemoteConnectState
NtUserRemoteConsoleShadowStop
NtUserRemoteDisconnect
NtUserRemoteNotify
NtUserRemotePassthruDisable
NtUserRemotePassthruEnable
NtUserRemoteReconnect
NtUserRemoteRedrawRectangle
NtUserRemoteRedrawScreen
NtUserRemoteShadowCleanup
NtUserRemoteShadowSetup
NtUserRemoteShadowStart
NtUserRemoteShadowStop
NtUserRemoteStopScreenUpdates
NtUserRemoteThinwireStats
NtUserRemoveClipboardFormatListener
NtUserRemoveInjectionDevice
NtUserRemoveMenu
NtUserRemoveProp
NtUserRemoveQueueCompletion
NtUserRemoveVisualIdentifier
NtUserReplyMessage
NtUserReportInertia
NtUserRequestLowLatencyProfile
NtUserResetDblClk
NtUserResolveDesktopForWOW
NtUserRestoreWindowDpiChanges
NtUserSBGetParms
NtUserScaleSystemMetricForDPIWithoutCache
NtUserScheduleDispatchNotification
NtUserScrollDC
NtUserScrollWindowEx
NtUserSelectPalette
NtUserSendEventMessage
NtUserSendInput
NtUserSendInteractiveControlHapticsReport
NtUserSetActivationFilter
NtUserSetActiveProcessForMonitor
NtUserSetActiveWindow
NtUserSetAdditionalForegroundBoostProcesses
NtUserSetAdditionalPowerThrottlingProcess
NtUserSetAppImeLevel
NtUserSetAutoRotation
NtUserSetBridgeWindowChild
NtUserSetBrokeredForeground
NtUserSetCalibrationData
NtUserSetCancelRotationDelayHintWindow
NtUserSetCapture
NtUserSetCaretBlinkTime
NtUserSetCaretPos
NtUserSetChildWindowNoActivate
NtUserSetClassLong
NtUserSetClassLongPtr
NtUserSetClassWord
NtUserSetClipboardData
NtUserSetClipboardViewer
NtUserSetCoreWindow
NtUserSetCoreWindowPartner
NtUserSetCoveredWindowStates
NtUserSetCursor
NtUserSetCursorContents
NtUserSetCursorIconData
NtUserSetCursorIconDataEx
NtUserSetCursorPos
NtUserSetDesktopColorTransform
NtUserSetDesktopVisualInputSink
NtUserSetDialogControlDpiChangeBehavior
NtUserSetDialogPointer
NtUserSetDialogSystemMenu
NtUserSetDisplayAutoRotationPreferences
NtUserSetDisplayConfig
NtUserSetDisplayMapping
NtUserSetDoubleClickTime
NtUserSetDpiForWindow
NtUserSetFallbackForeground
NtUserSetFeatureReportResponse
NtUserSetFocus
NtUserSetForegroundRedirectionForActivationObject
NtUserSetForegroundWindow
NtUserSetForegroundWindowForApplication
NtUserSetFullscreenMagnifierOffsetsDWMUpdated
NtUserSetGUISystemInformation
NtUserSetGestureConfig
NtUserSetImeHotKey
NtUserSetImeInfoEx
NtUserSetImeOwnerWindow
NtUserSetInformationThread
NtUserSetInputServiceState
NtUserSetInteractiveControlFocus
NtUserSetInteractiveCtrlRotationAngle
NtUserSetInternalWindowPos
NtUserSetJobUILimits
NtUserSetKeyboardState
NtUserSetLayeredWindowAttributes
NtUserSetMagnificationDesktopMagnifierOffsetsDWMUpdated
NtUserSetManipulationInputTarget
NtUserSetMaxTouchpadSensitivity
NtUserSetMenu
NtUserSetMenuContextHelpId
NtUserSetMenuDefaultItem
NtUserSetMenuFlagRtoL
NtUserSetMessageExtraInfo
NtUserSetMirrorRendering
NtUserSetModernAppWindow
NtUserSetMonitorWorkArea
NtUserSetMsgBox
NtUserSetObjectInformation
NtUserSetParent
NtUserSetPrecisionTouchPadConfiguration
NtUserSetProcessDefaultLayout
NtUserSetProcessDpiAwarenessContext
NtUserSetProcessInteractionFlags
NtUserSetProcessLaunchForegroundPolicy
NtUserSetProcessMousewheelRoutingMode
NtUserSetProcessRestrictionExemption
NtUserSetProcessUIAccessZorder
NtUserSetProcessWin32Capabilities
NtUserSetProcessWindowStation
NtUserSetProgmanWindow
NtUserSetProp
NtUserSetProp2
NtUserSetScrollInfo
NtUserSetSensorPresence
NtUserSetSharedWindowData
NtUserSetShellChangeNotifyHWND
NtUserSetShellSpecialWindow
NtUserSetShellWindowEx
NtUserSetSysColors
NtUserSetSysMenu
NtUserSetSystemContentRects
NtUserSetSystemCursor
NtUserSetSystemMenu
NtUserSetSystemTimer
NtUserSetTSFEventState
NtUserSetTargetForResourceBrokering
NtUserSetTaskmanWindow
NtUserSetThreadDesktop
NtUserSetThreadInputBlocked
NtUserSetThreadLayoutHandles
NtUserSetThreadQueueMergeSetting
NtUserSetThreadState
NtUserSetTimer
NtUserSetUserObjectCapability
NtUserSetVisible
NtUserSetWaitForQueueAttach
NtUserSetWatermarkStrings
NtUserSetWinEventHook
NtUserSetWindowArrangement
NtUserSetWindowBand
NtUserSetWindowCompositionAttribute
NtUserSetWindowCompositionTransition
NtUserSetWindowContextHelpId
NtUserSetWindowDisplayAffinity
NtUserSetWindowFNID
NtUserSetWindowFeedbackSetting
NtUserSetWindowLong
NtUserSetWindowLongPtr
NtUserSetWindowMessageCapability
NtUserSetWindowPlacement
NtUserSetWindowPos
NtUserSetWindowRgn
NtUserSetWindowRgnEx
NtUserSetWindowShowState
NtUserSetWindowState
NtUserSetWindowStationUser
NtUserSetWindowWord
NtUserSetWindowsHookAW
NtUserSetWindowsHookEx
NtUserShellForegroundBoostProcess
NtUserShellHandwritingDelegateInput
NtUserShellHandwritingHandleDelegatedInput
NtUserShellHandwritingUndelegateInput
NtUserShellMigrateWindow
NtUserShellRegisterHotKey
NtUserShellSetWindowPos
NtUserShowCaret
NtUserShowCursor
NtUserShowOwnedPopups
NtUserShowScrollBar
NtUserShowStartGlass
NtUserShowSystemCursor
NtUserShowWindow
NtUserShowWindowAsync
NtUserShutdownBlockReasonCreate
NtUserShutdownBlockReasonQuery
NtUserShutdownReasonDestroy
NtUserSignalRedirectionStartComplete
NtUserSlicerControl
NtUserSoundSentry
NtUserStopAndEndInertia
NtUserSuppressWindowActions
NtUserSuppressWindowDisplayChange
NtUserSwapMouseButton
NtUserSwitchDesktop
NtUserSwitchToThisWindow
NtUserSystemParametersInfo
NtUserSystemParametersInfoForDpi
NtUserTestForInteractiveUser
NtUserThreadMessageQueueAttached
NtUserThunkedMenuInfo
NtUserThunkedMenuItemInfo
NtUserToUnicodeEx
NtUserTraceLoggingSendMixedModeTelemetry
NtUserTrackMouseEvent
NtUserTrackPopupMenuEx
NtUserTransformPoint
NtUserTransformRect
NtUserTranslateAccelerator
NtUserTranslateMessage
NtUserUndelegateInput
NtUserUnhookWinEvent
NtUserUnhookWindowsHook
NtUserUnhookWindowsHookEx
NtUserUnloadKeyboardLayout
NtUserUnlockWindowStation
NtUserUnregisterClass
NtUserUnregisterHotKey
NtUserUnregisterSessionPort
NtUserUnregisterUserApiHook
NtUserUpdateClientRect
NtUserUpdateDefaultDesktopThumbnail
NtUserUpdateInputContext
NtUserUpdateInstance
NtUserUpdateLayeredWindow
NtUserUpdatePerUserImmEnabling
NtUserUpdatePerUserSystemParameters
NtUserUpdateWindow
NtUserUpdateWindowInputSinkHints
NtUserUpdateWindowTrackingInfo
NtUserUpdateWindows
NtUserUserHandleGrantAccess
NtUserUserPowerCalloutWorker
NtUserValidateHandleSecure
NtUserValidateRect
NtUserValidateRgn
NtUserValidateTimerCallback
NtUserVkKeyScanEx
NtUserWOWCleanup
NtUserWOWModuleUnload
NtUserWaitAvailableMessageEx
NtUserWaitForInputIdle
NtUserWaitForMsgAndEvent
NtUserWaitForRedirectionStartComplete
NtUserWaitMessage
NtUserWakeRITForShutdown
NtUserWindowFromDC
NtUserWindowFromPhysicalPoint
NtUserWindowFromPoint
NtUserYieldTask
NtUserZapActiveAndFocus
NtValidateCompositionSurfaceHandle
NtVisualCaptureBits
gDispatchTableValues
Name
.text
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
72KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
984B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=33145,
count=6, id=1, productName=Unmarked objects,
count=4, id=260, version=33145,
count=1, id=256, version=33145,
count=4, id=259, version=33145,
count=3, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
winbio.dll
- IMPHASH bbbca62344da39eeea27ce540f5b7c92
- SHA256 4466fdffd320751cb38cb65c6b12b1a1491e43bc5be712e9d778fc266a22d69f
- MD5 225bbf02e89a694feff53bfafd4e9fa5
- SHA1 2e212546f1629745da685083dfd6355ecb0febb9
- SHA512 8253ced1365d30b5d59bf3c5dfd5f63fc20cdb452f40f50985e4811c9be0b284468b8a4137228e861d56518a7b7f9e159af3da3d04021c2bceac12562c2c0bb5
- SSDEEP 6144:x3I7larMGxA0NSq0PTaj5Uw7mbgd3DVOJ7l5oXcqXC:WlarMGxA0vAYM0C
- TLSH T199344C3A72A409BAD97FC0BDC8D34A19E671782143A157CB0690817C8F1BBE8B73DB55
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
6784
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
winbio.pdb
msvcp_win
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_ceilf
_o_free
_o_malloc
_o_terminate
_o_wcsncpy_s
__current_exception
__current_exception_context
_CxxThrowException
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf
_o__configure_narrow_argv
_o__cexit
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__callnewh
_o__crt_atexit
__C_specific_handler
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
FreeLibraryAndExitThread
GetModuleHandleExW
GetModuleHandleExA
GetModuleHandleW
GetProcAddress
GetModuleFileNameA
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
InitializeCriticalSectionEx
InitializeSRWLock
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
CreateEventW
ReleaseSRWLockExclusive
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
CreateThread
ResumeThread
OpenProcessToken
OpenThreadToken
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-sysinfo-l1-1-0
GetSystemTime
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-io-l1-1-0
PostQueuedCompletionStatus
CreateIoCompletionPort
GetQueuedCompletionStatus
api-ms-win-core-synch-l1-2-0
WakeConditionVariable
SleepConditionVariableCS
InitializeConditionVariable
Sleep
api-ms-win-security-base-l1-1-0
IsValidSid
CopySid
GetLengthSid
GetTokenInformation
ImpersonateLoggedOnUser
RevertToSelf
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventRegister
EventUnregister
EventActivityIdControl
EventWriteTransfer
api-ms-win-core-console-l3-2-0
GetConsoleWindow
api-ms-win-core-file-l1-1-0
ReadFile
WriteFile
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegEnumKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegGetValueW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
api-ms-win-core-kernel32-legacy-l1-1-0
UnregisterWait
RegisterWaitForSingleObject
api-ms-win-core-threadpool-legacy-l1-1-0
UnregisterWaitEx
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
ntdll
RtlImageNtHeader
NtQuerySystemInformation
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
WinBioAcquireFocus
WinBioAreEnhancedSignInSecurityRequirementsMet
WinBioAreNonEssSensorsEnabled
WinBioAsyncEnumBiometricUnits
WinBioAsyncEnumDatabases
WinBioAsyncEnumServiceProviders
WinBioAsyncMonitorFrameworkChanges
WinBioAsyncOpenFramework
WinBioAsyncOpenSession
WinBioCancel
WinBioCaptureSample
WinBioCaptureSampleWithCallback
WinBioCloseFramework
WinBioCloseSession
WinBioConsumeFactorDeletedByService
WinBioControlUnit
WinBioControlUnitPrivileged
WinBioDeleteTemplate
WinBioDeleteVtl0Containers
WinBioDiscardTicket
WinBioEnrollAuthorize
WinBioEnrollBegin
WinBioEnrollCapture
WinBioEnrollCaptureWithCallback
WinBioEnrollCommit
WinBioEnrollDiscard
WinBioEnrollRevoke
WinBioEnrollSelect
WinBioEnumBiometricUnits
WinBioEnumDatabases
WinBioEnumEnrollments
WinBioEnumServiceProviders
WinBioFree
WinBioGetConnectedSensors
WinBioGetCredentialState
WinBioGetCredentialWithTicket
WinBioGetDomainLogonSetting
WinBioGetEnabledSetting
WinBioGetEnhancedSignInSecurityEnrolledFactors
WinBioGetEnhancedSignInSecurityStateSource
WinBioGetEnrolledFactors
WinBioGetEssState
WinBioGetFactorsDeletedByService
WinBioGetGestureMetadata
WinBioGetLastBioUseTime
WinBioGetLogonSetting
WinBioGetPolicyProtectionSupport
WinBioGetProperty
WinBioGetProtectionPolicy
WinBioGetSetting
WinBioIdentify
WinBioIdentifyAndReleaseTicket
WinBioIdentifyWithCallback
WinBioImproveBegin
WinBioImproveEnd
WinBioIsDeviceEnhancedSignInSecurityCapable
WinBioIsDeviceEnhancedSignInSecurityEnabled
WinBioIsESSCapable
WinBioLocateSensor
WinBioLocateSensorWithCallback
WinBioLockUnit
WinBioLogonIdentifiedUser
WinBioMonitorPresence
WinBioNgcAuthorizeEnrollment
WinBioNgcCloseAuthorizationSession
WinBioNgcGetAuthorizationWithTicket
WinBioNgcOpenAuthorizationSession
WinBioNotifyPasswordChange
WinBioOpenSession
WinBioProtectData
WinBioProtectDataWithPolicy
WinBioRegisterEventMonitor
WinBioRegisterServiceMonitor
WinBioReleaseFocus
WinBioRemoveAllCredentials
WinBioRemoveAllDomainCredentials
WinBioRemoveCredential
WinBioSendTelemetry
WinBioSetCredential
WinBioSetMSACredential
WinBioSetProperty
WinBioSetSetting
WinBioUnlockUnit
WinBioUnprotectData
WinBioUnregisterEventMonitor
WinBioUnregisterServiceMonitor
WinBioVerify
WinBioVerifyAndReleaseTicket
WinBioVerifyWithCallback
WinBioWait
_BioLogonIdentifiedUser
Name
.text
Size
144KB
Virtual Size
143KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
368B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=72, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=14, id=260, version=33145,
count=5, id=259, version=33145,
count=24, id=261, version=33145,
count=1248, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=1, id=256, version=33145,
count=30, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
winbioext.dll
- IMPHASH 7f8d2b6eb21bb20fdfa6795ab858391c
- SHA256 2ab67affc7120e09d5862e4f14fb572812fa42f23f966a20d074e7f4974a29a6
- MD5 435a7ece75540db0e5e050107162f5ab
- SHA1 33ba420603b14f144b25322e30a5d226f60f2459
- SHA512 27bc6bc8733a2d1f7d0bfa64750bdf8de006ad16bdaa9678312aa7dcda3513092569f86b190be22ff19b1a9e6c15986d509e9624d2952396c9d5109ad7cddee6
- SSDEEP 768:Qh9tj1VWdjT18CuhXAoVeVhmqnVHGsotLGVriDmNSwWexCLuA:y9pO19uhXvVOTJ9ot6V9YpexCLuA
- TLSH T115635C6D7A6820E9F479923DC8534B0DE171F460A75257DF0360C2AE2F63BF82538BA5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5344
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
winbioext.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__register_onexit_function
_o__seh_filter_dll
memcpy
_o_free
_o_malloc
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o___stdio_common_vswprintf
__std_terminate
__CxxFrameHandler4
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
api-ms-win-crt-string-l1-1-0
memset
ext-ms-win-biometrics-winbio-core-l1-1-0
WinBioCloseSession
WinBioFree
WinBioGetEnrolledFactors
WinBioEnumBiometricUnits
WinBioDeleteTemplate
ext-ms-win-biometrics-winbio-l1-2-0
WinBioOpenSession
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
GetModuleHandleExW
FreeLibraryAndExitThread
api-ms-win-core-synch-l1-1-0
ResetEvent
DeleteCriticalSection
CreateMutexExW
SetEvent
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
ReleaseMutex
EnterCriticalSection
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
LeaveCriticalSection
OpenSemaphoreW
CreateEventW
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentThreadId
CreateThread
ResumeThread
GetCurrentProcessId
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-security-sddl-l1-1-0
ConvertStringSidToSidW
api-ms-win-security-base-l1-1-0
CopySid
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
ntdll
RtlGetDeviceFamilyInfoEnum
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
DllCanUnloadNow
DllGetClassObject
WinBioAcquireFocus
WinBioAsyncEnumDatabases
WinBioAsyncMonitorFrameworkChanges
WinBioCaptureSample
WinBioCaptureSampleWithCallback
WinBioEnrollCaptureWithCallback
WinBioEnumDatabases
WinBioGetDomainLogonSetting
WinBioGetEnabledSetting
WinBioGetLogonSetting
WinBioIdentifyWithCallback
WinBioIsESSCapable
WinBioIsLegacy
WinBioLocateSensor
WinBioLocateSensorWithCallback
WinBioLogonIdentifiedUser
WinBioNotifyPasswordChange
WinBioOpenSession
WinBioRegisterEventMonitor
WinBioRegisterServiceMonitor
WinBioReleaseFocus
WinBioUnregisterEventMonitor
WinBioUnregisterServiceMonitor
WinBioVerifyWithCallback
Name
.text
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=49, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=1133, id=1, productName=Unmarked objects,
count=4, id=257, version=33145,
count=24, id=261, version=33145,
count=1, id=256, version=33145,
count=7, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
winbrand.dll
- IMPHASH 03bc69f852efb9c7558341e4e48351d0
- SHA256 36b2f9cc1dcd1946c340d888eb1d77c346b941f2615199a79b939c3e54d6f846
- MD5 f0b7bb05ffd087cbe3074ab48abb27ea
- SHA1 d7e4910427b11655d39457685205dd0bb1f23037
- SHA512 2727ea6e6e78becd6238997dbdc8418e226ff9694a71ce92205c456aec194495a95976ffbc09418596b3e3317148df5a36070e9ac5ff0f13b8bf653011fde3f7
- SSDEEP 3072:QqwGf4CsRn4cMyVbCegv7o2mAh8IkWo9qsgiuKvCnrB6DLq/SGyxRDYx8Qh5qQ:4GACs6q+edACIkUbi9vCnrqL2WxRDY4Q
- TLSH T18D24494E22EE11D4E63B9538D9828347FA717039531266EF12D0C57D5B23EE8BAB8F01
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
01:df:68:ec:86:6e:f9:71:33:80:e3:84:df:fb:68:72:1f:3c:09:c8:a0:73:3c:34:54:49:70:b5:97:77:31:da
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:2D1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:12:d1:08:06:3c:ca:18:4f:aa:00:01:00:00:02:12
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
122608
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
winbrand.pdb
msvcrt
_wcsnicmp
?terminate@@YAXXZ
wcschr
_wcsicmp
__CxxFrameHandler4
??1exception@@UEAA@XZ
__dllonexit
_CxxThrowException
??0exception@@QEAA@AEBV0@@Z
_amsg_exit
memmove
free
malloc
memmove_s
wcsncmp
_initterm
_vscwprintf
__C_specific_handler
memcmp
_lock
_XcptFilter
memcpy
_onexit
_purecall
memcpy_s
_vsnwprintf
wcsstr
_unlock
??1type_info@@UEAA@XZ
??0exception@@QEAA@XZ
memset
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-libraryloader-l1-2-0
LoadStringW
GetProcAddress
GetModuleFileNameW
FreeLibrary
LoadResource
GetModuleHandleW
LockResource
DisableThreadLibraryCalls
FindResourceExW
LoadLibraryExW
GetModuleFileNameA
SizeofResource
GetModuleHandleExW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringW
api-ms-win-core-file-l1-1-0
GetFullPathNameW
GetFileAttributesW
api-ms-win-core-localization-l1-2-0
GetLocaleInfoW
FormatMessageW
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
GetLastError
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
GlobalAlloc
GlobalFree
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
GetSystemWindowsDirectoryW
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
LeaveCriticalSection
AcquireSRWLockExclusive
ReleaseSemaphore
DeleteCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockShared
CreateMutexExW
ReleaseSRWLockShared
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
WaitForSingleObject
InitializeCriticalSectionEx
CreateSemaphoreExW
api-ms-win-core-com-l1-1-0
CoInitializeEx
CoCreateInstance
CoUninitialize
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-largeinteger-l1-1-0
MulDiv
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegSetValueExW
ntdll
RtlFreeHeap
RtlAllocateHeap
RtlGetVersion
RtlGetPersistedStateLocation
RtlPublishWnfStateData
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-sysinfo-l1-2-0
GetProductInfo
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-localization-obsolete-l1-2-0
GetUserDefaultUILanguage
api-ms-win-core-file-l2-1-0
CopyFileExW
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
BrandingFormatString
BrandingFormatStringForEdition
BrandingLoadBitmap
BrandingLoadCursor
BrandingLoadIcon
BrandingLoadImage
BrandingLoadNeutralStringForEdition
BrandingLoadString
BrandingLoadStringForEdition
EulaFreeBuffer
GetEULAFile
GetEULAFileEx
GetEULAInCurrentUILanguage
GetHinstanceByNameSpace
GetInstalledEULAPath
InstallEULA
Name
.text
Size
156KB
Virtual Size
153KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
136B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=74, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=17, id=260, version=33145,
count=5, id=259, version=33145,
count=5, id=261, version=33145,
count=206, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=1, id=256, version=33145,
count=40, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wincorlib.dll
- IMPHASH 0397dff454811ee9ec17516f2f18c613
- SHA256 27e07e4bb4778ff70bce9b2d0be5ec92f0b8ab618142e1448f77a991d53f7faf
- MD5 3ef4a905794ab782d847378d28278f52
- SHA1 f7a13349bf977507d0365f55c0badcb56ea8dd8f
- SHA512 72fe84f91e6e8500623e01ca86a68a5c3c69f22de97c94d75d982a490a0b9c4a6c687ede8a4f3dc265bb915a3add13d363eb1a2916b6e9f8a85af452d42db2a6
- SSDEEP 6144:rlQN4JtKIH80zJ3tumxHUlOY+tv4zBPpcXnPm:Cyxd3tumx0lZG4zBafm
- TLSH T10A84F82BBA5C4CD3E931B03D8A97470AE7B274450791D3CB1694034E9E6FBE86C3A671
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
57712
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wincorlib.pdb
msvcrt
??0exception@@QEAA@AEBV0@@Z
_vsnwprintf
wcsstr
_aligned_offset_malloc
_aligned_free
wcscpy_s
__wgetmainargs
malloc
_onexit
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
__dllonexit
_unlock
memcpy_s
_lock
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
??_V@YAXPEAX@Z
__C_specific_handler
_initterm
free
_amsg_exit
_XcptFilter
??3@YAXPEAX@Z
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
__CxxFrameHandler4
??0exception@@QEAA@AEBQEBD@Z
memmove
memcpy
__CxxFrameHandler3
_CxxThrowException
printf
swprintf_s
_purecall
_callnewh
memset
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
RaiseException
SetLastError
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockShared
CreateMutexExW
CreateSemaphoreExW
InitializeCriticalSectionEx
AcquireSRWLockExclusive
ReleaseSemaphore
DeleteCriticalSection
EnterCriticalSection
ReleaseSRWLockExclusive
LeaveCriticalSection
InitializeSRWLock
AcquireSRWLockShared
TryAcquireSRWLockShared
OpenSemaphoreW
WaitForSingleObject
WaitForMultipleObjectsEx
CreateEventExW
ReleaseMutex
WaitForSingleObjectEx
SetEvent
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
GetModuleHandleExW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringA
OutputDebugStringW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-util-l1-1-0
DecodePointer
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
?<Dispose>@Exception@Platform@@UE$AAAXXZ
?<Dispose>@String@Platform@@UE$AAAXXZ
?<Dispose>@Type@Platform@@UE$AAAXXZ
??0AccessDeniedException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0AccessDeniedException@Platform@@QE$AAA@XZ
??0Attribute@Metadata@Platform@@QE$AAA@XZ
??0Boolean@Platform@@QEAA@_N@Z
??0COMException@Platform@@QE$AAA@H@Z
??0COMException@Platform@@QE$AAA@HPE$AAVString@1@@Z
??0ChangedStateException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0ChangedStateException@Platform@@QE$AAA@XZ
??0ClassNotRegisteredException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0ClassNotRegisteredException@Platform@@QE$AAA@XZ
??0Delegate@Platform@@QE$AAA@XZ
??0DisconnectedException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0DisconnectedException@Platform@@QE$AAA@XZ
??0Enum@Platform@@QE$AAA@XZ
??0Exception@Platform@@QE$AAA@H@Z
??0Exception@Platform@@QE$AAA@HPE$AAVString@1@@Z
??0FailureException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0FailureException@Platform@@QE$AAA@XZ
??0GridLength@Xaml@UI@Windows@@QEAA@NW4GridUnitType@123@@Z
??0IntPtr@Platform@@QEAA@H@Z
??0IntPtr@Platform@@QEAA@PEAX@Z
??0InvalidArgumentException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0InvalidArgumentException@Platform@@QE$AAA@XZ
??0InvalidCastException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0InvalidCastException@Platform@@QE$AAA@XZ
??0MTAThreadAttribute@Platform@@QE$AAA@XZ
??0NotImplementedException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0NotImplementedException@Platform@@QE$AAA@XZ
??0NullReferenceException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0NullReferenceException@Platform@@QE$AAA@XZ
??0Object@Platform@@QE$AAA@XZ
??0ObjectDisposedException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0ObjectDisposedException@Platform@@QE$AAA@XZ
??0OnePhaseConstructedAttribute@CompilerServices@Runtime@Platform@@QE$AAA@XZ
??0OperationCanceledException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0OperationCanceledException@Platform@@QE$AAA@XZ
??0OutOfBoundsException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0OutOfBoundsException@Platform@@QE$AAA@XZ
??0OutOfMemoryException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0OutOfMemoryException@Platform@@QE$AAA@XZ
??0Rect@Foundation@Windows@@QEAA@VPoint@12@0@Z
??0Rect@Foundation@Windows@@QEAA@VPoint@12@VSize@12@@Z
??0RepeatBehavior@Animation@Media@Xaml@UI@Windows@@QEAA@N@Z
??0STAThreadAttribute@Platform@@QE$AAA@XZ
??0SizeT@Platform@@QEAA@H@Z
??0SizeT@Platform@@QEAA@PEAX@Z
??0Type@Platform@@QE$AAA@PE$AAVObject@1@@Z
??0Type@Platform@@QE$AAA@VIntPtr@1@@Z
??0Type@Platform@@QE$AAA@VTypeName@Interop@Xaml@UI@Windows@@@Z
??0ValueType@Platform@@QE$AAA@XZ
??0WrongThreadException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0WrongThreadException@Platform@@QE$AAA@XZ
??0char16@default@@QEAA@_W@Z
??0float32@default@@QEAA@M@Z
??0float64@default@@QEAA@N@Z
??0int16@default@@QEAA@F@Z
??0int32@default@@QEAA@H@Z
??0int64@default@@QEAA@_J@Z
??0int8@default@@QEAA@C@Z
??0uint16@default@@QEAA@G@Z
??0uint32@default@@QEAA@I@Z
??0uint64@default@@QEAA@_K@Z
??0uint8@default@@QEAA@E@Z
??BIntPtr@Platform@@SA?AV01@H@Z
??BIntPtr@Platform@@SA?AV01@PEAX@Z
??BIntPtr@Platform@@SAPEAXV01@@Z
??BType@Platform@@SA?AVTypeName@Interop@Xaml@UI@Windows@@PE$AAV01@@Z
??BType@Platform@@SAPE$AAV01@VTypeName@Interop@Xaml@UI@Windows@@@Z
??DMatrix3D@Media3D@Media@Xaml@UI@Windows@@SA?AV012345@V012345@0@Z
??GDuration@Xaml@UI@Windows@@SA?AV0123@V0123@0@Z
??HDuration@Xaml@UI@Windows@@SA?AV0123@V0123@0@Z
??MDuration@Xaml@UI@Windows@@SA_NV0123@0@Z
??NDuration@Xaml@UI@Windows@@SA_NV0123@0@Z
??ODuration@Xaml@UI@Windows@@SA_NV0123@0@Z
??PDuration@Xaml@UI@Windows@@SA_NV0123@0@Z
?AlignedAllocate@Heap@Details@Platform@@SAPEAX_K00@Z
?AlignedAllocate@Heap@Details@Platform@@SAPEAX_K0@Z
?AlignedAllocateException@Heap@Details@Platform@@SAPEAX_K00@Z
?AlignedAllocateException@Heap@Details@Platform@@SAPEAX_K0@Z
?AlignedFree@Heap@Details@Platform@@SAXPEAX@Z
?AlignedFreeException@Heap@Details@Platform@@SAXPEAX@Z
?Allocate@Heap@Details@Platform@@SAPEAX_K0@Z
?Allocate@Heap@Details@Platform@@SAPEAX_K@Z
?AllocateException@Heap@Details@Platform@@SAPEAX_K0@Z
?AllocateException@Heap@Details@Platform@@SAPEAX_K@Z
?Compare@Duration@Xaml@UI@Windows@@SAHV1234@0@Z
?Contains@Rect@Foundation@Windows@@QEAA_NVPoint@23@@Z
?CreateException@Exception@Platform@@SAPE$AAV12@H@Z
?CreateException@Exception@Platform@@SAPE$AAV12@HPE$AAVString@2@@Z
?CreateValue@Details@Platform@@YAPE$AAVObject@2@W4TypeCode@2@PEBX@Z
?EnableFactoryCache@@YAXXZ
?EnumerateAllocatedObjects@Heap@Details@Platform@@SAXPE$AAVHeapEntryHandler@23@@Z
?Equals@Attribute@Metadata@Platform@@QE$AAA_NPE$AAVObject@3@@Z
?Equals@Boolean@Platform@@QEAA_NPE$AAVObject@2@@Z
?Equals@Delegate@Platform@@QE$AAA_NPE$AAVObject@2@@Z
?Equals@Enum@Platform@@QE$AAA_NPE$AAVObject@2@@Z
?Equals@Exception@Platform@@UE$AAA_NPE$AAVObject@2@@Z
?Equals@MTAThreadAttribute@Platform@@QE$AAA_NPE$AAVObject@2@@Z
?Equals@Object@Platform@@QE$AAA_NPE$AAV12@@Z
?Equals@OnePhaseConstructedAttribute@CompilerServices@Runtime@Platform@@QE$AAA_NPE$AAVObject@4@@Z
?Equals@STAThreadAttribute@Platform@@QE$AAA_NPE$AAVObject@2@@Z
?Equals@Type@Platform@@UE$AAA_NPE$AAVObject@2@@Z
?Equals@ValueType@Platform@@QE$AAA_NPE$AAVObject@2@@Z
?Equals@char16@default@@QEAA_NPE$AAVObject@Platform@@@Z
?Equals@float32@default@@QEAA_NPE$AAVObject@Platform@@@Z
?Equals@float64@default@@QEAA_NPE$AAVObject@Platform@@@Z
?Equals@int16@default@@QEAA_NPE$AAVObject@Platform@@@Z
?Equals@int32@default@@QEAA_NPE$AAVObject@Platform@@@Z
?Equals@int64@default@@QEAA_NPE$AAVObject@Platform@@@Z
?Equals@int8@default@@QEAA_NPE$AAVObject@Platform@@@Z
?Equals@uint16@default@@QEAA_NPE$AAVObject@Platform@@@Z
?Equals@uint32@default@@QEAA_NPE$AAVObject@Platform@@@Z
?Equals@uint64@default@@QEAA_NPE$AAVObject@Platform@@@Z
?Equals@uint8@default@@QEAA_NPE$AAVObject@Platform@@@Z
?EventSourceAdd@Details@Platform@@YA?AVEventRegistrationToken@Foundation@Windows@@PEAPEAXPEAUEventLock@12@PE$AAVDelegate@2@@Z
?EventSourceGetTargetArray@Details@Platform@@YAPEAXPEAXPEAUEventLock@12@@Z
?EventSourceGetTargetArrayEvent@Details@Platform@@YAPEAXPEAXIPEBXPEA_J@Z
?EventSourceGetTargetArraySize@Details@Platform@@YAIPEAX@Z
?EventSourceInitialize@Details@Platform@@YAXPEAPEAX@Z
?EventSourceRemove@Details@Platform@@YAXPEAPEAXPEAUEventLock@12@VEventRegistrationToken@Foundation@Windows@@@Z
?EventSourceUninitialize@Details@Platform@@YAXPEAPEAX@Z
?FlushFactoryCache@@YAXXZ
?Free@Heap@Details@Platform@@SAXPEAX@Z
?FreeException@Heap@Details@Platform@@SAXPEAX@Z
?GetActivationFactory@Details@Platform@@YAJPEAVModuleBase@1WRL@Microsoft@@PEAUHSTRING__@@PEAPEAUIActivationFactory@@@Z
?GetActivationFactoryByPCWSTR@@YAJPEAXAEAVGuid@Platform@@PEAPEAX@Z
?GetCmdArguments@Details@Platform@@YAPEAPEA_WPEAH@Z
?GetHashCode@Attribute@Metadata@Platform@@QE$AAAHXZ
?GetHashCode@Boolean@Platform@@QEAAHXZ
?GetHashCode@Delegate@Platform@@QE$AAAHXZ
?GetHashCode@Enum@Platform@@QE$AAAHXZ
?GetHashCode@Exception@Platform@@UE$AAAHXZ
?GetHashCode@Guid@Platform@@QEAAHXZ
?GetHashCode@MTAThreadAttribute@Platform@@QE$AAAHXZ
?GetHashCode@Object@Platform@@QE$AAAHXZ
?GetHashCode@OnePhaseConstructedAttribute@CompilerServices@Runtime@Platform@@QE$AAAHXZ
?GetHashCode@STAThreadAttribute@Platform@@QE$AAAHXZ
?GetHashCode@Type@Platform@@UE$AAAHXZ
?GetHashCode@ValueType@Platform@@QE$AAAHXZ
?GetHashCode@char16@default@@QEAAHXZ
?GetHashCode@float32@default@@QEAAHXZ
?GetHashCode@float64@default@@QEAAHXZ
?GetHashCode@int16@default@@QEAAHXZ
?GetHashCode@int32@default@@QEAAHXZ
?GetHashCode@int64@default@@QEAAHXZ
?GetHashCode@int8@default@@QEAAHXZ
?GetHashCode@uint16@default@@QEAAHXZ
?GetHashCode@uint32@default@@QEAAHXZ
?GetHashCode@uint64@default@@QEAAHXZ
?GetHashCode@uint8@default@@QEAAHXZ
?GetIBoxArrayVtable@Details@Platform@@YAPEAXPEAX@Z
?GetIBoxVtable@Details@Platform@@YAPEAXPEAX@Z
?GetIidsFn@@YAJHPEAKPEBU__s_GUID@@PEAPEAVGuid@Platform@@@Z
?GetObjectContext@Details@Platform@@YAPEAUIUnknown@@XZ
?GetProxyImpl@Details@Platform@@YAJPEAUIUnknown@@AEBU_GUID@@0PEAPEAU3@@Z
?GetType@Boolean@Platform@@QEAAPE$AAVType@2@XZ
?GetType@Guid@Platform@@QEAAPE$AAVType@2@XZ
?GetType@Object@Platform@@QE$AAAPE$AAVType@2@XZ
?GetType@char16@default@@QEAAPE$AAVType@Platform@@XZ
?GetType@float32@default@@QEAAPE$AAVType@Platform@@XZ
?GetType@float64@default@@QEAAPE$AAVType@Platform@@XZ
?GetType@int16@default@@QEAAPE$AAVType@Platform@@XZ
?GetType@int32@default@@QEAAPE$AAVType@Platform@@XZ
?GetType@int64@default@@QEAAPE$AAVType@Platform@@XZ
?GetType@int8@default@@QEAAPE$AAVType@Platform@@XZ
?GetType@uint16@default@@QEAAPE$AAVType@Platform@@XZ
?GetType@uint32@default@@QEAAPE$AAVType@Platform@@XZ
?GetType@uint64@default@@QEAAPE$AAVType@Platform@@XZ
?GetType@uint8@default@@QEAAPE$AAVType@Platform@@XZ
?GetTypeCode@Type@Platform@@SA?AW4TypeCode@2@PE$AAV12@@Z
?GetWeakReference@Details@Platform@@YAPEAU__abi_IUnknown@@QE$ADVObject@2@@Z
?InitControlBlock@ControlBlock@Details@Platform@@AEAAXPEAX_N11@Z
?InitializeData@Details@Platform@@YAJH@Z
?Intersect@Rect@Foundation@Windows@@QEAAXV123@@Z
?IntersectsWith@Rect@Foundation@Windows@@QEAA_NV123@@Z
?Invert@Matrix3D@Media3D@Media@Xaml@UI@Windows@@QEAAXXZ
?ReCreateException@Exception@Platform@@SAPE$AAV12@H@Z
?ReCreateFromException@Details@Platform@@YAJPE$AAVException@2@@Z
?ReferenceEquals@Object@Platform@@SA_NPE$AAV12@0@Z
?ReferenceEquals@Object@Platform@@SA_NPE$AAVString@2@0@Z
?RegisterFactories@Details@Platform@@YAPE$AAVObject@2@PEAPEAVModuleBase@1WRL@Microsoft@@PEAPEAU__abi_Module@@P6AXXZ@Z
?ReleaseInContextImpl@Details@Platform@@YAJPEAUIUnknown@@0@Z
?ReleaseTarget@ControlBlock@Details@Platform@@AEAAXXZ
?ResolveWeakReference@Details@Platform@@YAPE$AAVObject@2@AEBU_GUID@@PEAPEAU__abi_IUnknown@@@Z
?RunApplicationServer@Details@Platform@@YAXPEAPEAVModuleBase@1WRL@Microsoft@@PEAPEAU__abi_Module@@PEB_W@Z
?RunServer@Details@Platform@@YAXPEAPEAVModuleBase@1WRL@Microsoft@@PEAPEAU__abi_Module@@PEB_W@Z
?TerminateModule@Details@Platform@@YA_NPEAVModuleBase@1WRL@Microsoft@@@Z
?ToInt32@IntPtr@Platform@@QEAAHXZ
?ToString@Attribute@Metadata@Platform@@QE$AAAPE$AAVString@3@XZ
?ToString@Boolean@Platform@@QEAAPE$AAVString@2@XZ
?ToString@Delegate@Platform@@QE$AAAPE$AAVString@2@XZ
?ToString@Enum@Platform@@QE$AAAPE$AAVString@2@XZ
?ToString@Exception@Platform@@UE$AAAPE$AAVString@2@XZ
?ToString@Guid@Platform@@QEAAPE$AAVString@2@XZ
?ToString@MTAThreadAttribute@Platform@@QE$AAAPE$AAVString@2@XZ
?ToString@OnePhaseConstructedAttribute@CompilerServices@Runtime@Platform@@QE$AAAPE$AAVString@4@XZ
?ToString@STAThreadAttribute@Platform@@QE$AAAPE$AAVString@2@XZ
?ToString@Type@Platform@@UE$AAAPE$AAVString@2@XZ
?ToString@ValueType@Platform@@QE$AAAPE$AAVString@2@XZ
?ToString@char16@default@@QEAAPE$AAVString@Platform@@XZ
?ToString@float32@default@@QEAAPE$AAVString@Platform@@XZ
?ToString@float64@default@@QEAAPE$AAVString@Platform@@XZ
?ToString@int16@default@@QEAAPE$AAVString@Platform@@XZ
?ToString@int32@default@@QEAAPE$AAVString@Platform@@XZ
?ToString@int64@default@@QEAAPE$AAVString@Platform@@XZ
?ToString@int8@default@@QEAAPE$AAVString@Platform@@XZ
?ToString@uint16@default@@QEAAPE$AAVString@Platform@@XZ
?ToString@uint32@default@@QEAAPE$AAVString@Platform@@XZ
?ToString@uint64@default@@QEAAPE$AAVString@Platform@@XZ
?ToString@uint8@default@@QEAAPE$AAVString@Platform@@XZ
?UninitializeData@Details@Platform@@YAXH@Z
?Union@Rect@Foundation@Windows@@QEAAXV123@@Z
?Union@Rect@Foundation@Windows@@QEAAXVPoint@23@@Z
?WriteLine@Console@Details@Platform@@SAXPE$AAVObject@3@@Z
?WriteLine@Console@Details@Platform@@SAXPE$AAVString@3@@Z
?WriteLine@Console@Details@Platform@@SAXXZ
?__abi_FailFast@@YAXXZ
?__abi_ObjectToString@__abi_details@@YAPE$AAVString@Platform@@PE$AAVObject@3@_N@Z
?__abi_Resolve@ControlBlock@Details@Platform@@UEAAJAEAVGuid@3@PEAPEAU__abi_IInspectable@@@Z
?__abi_WinRTraiseAccessDeniedException@@YAXXZ
?__abi_WinRTraiseCOMException@@YAXJ@Z
?__abi_WinRTraiseChangedStateException@@YAXXZ
?__abi_WinRTraiseClassNotRegisteredException@@YAXXZ
?__abi_WinRTraiseDisconnectedException@@YAXXZ
?__abi_WinRTraiseFailureException@@YAXXZ
?__abi_WinRTraiseInvalidArgumentException@@YAXXZ
?__abi_WinRTraiseInvalidCastException@@YAXXZ
?__abi_WinRTraiseNotImplementedException@@YAXXZ
?__abi_WinRTraiseNullReferenceException@@YAXXZ
?__abi_WinRTraiseObjectDisposedException@@YAXXZ
?__abi_WinRTraiseOperationCanceledException@@YAXXZ
?__abi_WinRTraiseOutOfBoundsException@@YAXXZ
?__abi_WinRTraiseOutOfMemoryException@@YAXXZ
?__abi_WinRTraiseWrongThreadException@@YAXXZ
?__abi_cast_Object_to_String@__abi_details@@YAPE$AAVString@Platform@@_NPE$AAVObject@3@@Z
?__abi_cast_String_to_Object@__abi_details@@YAPE$AAVObject@Platform@@PE$AAVString@3@@Z
?__abi_make_type_id@@YAPE$AAVType@Platform@@AEBU__abi_type_descriptor@@@Z
?__abi_translateCurrentException@@YAJ_N@Z
?__getActivationFactoryByHSTRING@@YAJPEAUHSTRING__@@AEAVGuid@Platform@@PEAPEAX@Z
?get@Bottom@Rect@Foundation@Windows@@QEAAMXZ
?get@BreakOnAllocationId@Heap@Details@Platform@@SAHXZ
?get@BreakOnFreeId@Heap@Details@Platform@@SAHXZ
?get@CurrentAllocationId@Heap@Details@Platform@@SAHXZ
?get@Empty@Rect@Foundation@Windows@@SA?AV234@XZ
?get@Empty@Size@Foundation@Windows@@SA?AV234@XZ
?get@FullName@Type@Platform@@QE$AAAPE$AAVString@3@XZ
?get@HasInverse@Matrix3D@Media3D@Media@Xaml@UI@Windows@@QEAA_NXZ
?get@Message@Exception@Platform@@QE$AAAPE$AAVString@3@XZ
?get@ObjectCount@Heap@Details@Platform@@SAHXZ
?get@Right@Rect@Foundation@Windows@@QEAAMXZ
?get@TrackingLevel@Heap@Details@Platform@@SA?AW4HeapAllocationTrackingLevel@34@XZ
?set@BreakOnAllocationId@Heap@Details@Platform@@SAXH@Z
?set@BreakOnFreeId@Heap@Details@Platform@@SAXH@Z
?set@TrackingLevel@Heap@Details@Platform@@SAXW4HeapAllocationTrackingLevel@34@@Z
Name
.text
Size
176KB
Virtual Size
175KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
116KB
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
336B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=34, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=134, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=13, id=261, version=33145,
count=17, id=260, version=33145,
count=1, id=256, version=33145,
count=19, id=265, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wincredprovider.dll
- IMPHASH 22cc5889dd15ef0bea4b542e68cc6824
- SHA256 6ed97d93893ca985ea2eb89c7308aeb34499b1fc6989dfcbe1e2c79bdb4544dd
- MD5 ffdb4202f6c629f7810c692a6bbdfedc
- SHA1 e6cbd1a9208edc2b06c9aaa2e713082add1eb11f
- SHA512 672eb64017b6637afceb243c48a4f300343325305aafbf7c27d07fc2d325af7636b1460533df8799e38ee8bc9df40c33e8acf80f69903ff01db9c792151d308c
- SSDEEP 1536:fMX+NQQw17XLBdYMX7GNfwhnE8kFNmz182E2TXFeYNXlqPH:EQQH/BmMXKGjkFIzjLFJNe
- TLSH T1BFA3170E72A870A9E46A8139C8574644E371F8212B1257FF13E0A3BE5F73BD46D39B91
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5664
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wincredprovider.pdb
msvcrt
_errno
_onexit
realloc
__C_specific_handler
__dllonexit
memcmp
_lock
_initterm
_amsg_exit
_XcptFilter
memmove_s
_callnewh
_purecall
memcpy_s
malloc
wcsncpy_s
wcscat_s
free
wcscpy_s
_unlock
_vsnwprintf
memset
oleaut32
LoadTypeLi
VarUI4FromStr
RegisterTypeLi
SysAllocString
SysStringLen
UnRegisterTypeLi
SysFreeString
api-ms-win-core-libraryloader-l1-2-0
FindResourceExW
LoadResource
GetModuleFileNameW
SizeofResource
GetProcAddress
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA
FreeLibrary
DisableThreadLibraryCalls
LoadLibraryExW
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetThreadLocale
SetThreadLocale
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockExclusive
DeleteCriticalSection
InitializeCriticalSectionEx
WaitForSingleObjectEx
CreateMutexExW
CreateSemaphoreExW
ReleaseSemaphore
ReleaseSRWLockShared
AcquireSRWLockShared
EnterCriticalSection
AcquireSRWLockExclusive
LeaveCriticalSection
WaitForSingleObject
InitializeCriticalSection
OpenSemaphoreW
ReleaseMutex
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
RaiseException
SetLastError
UnhandledExceptionFilter
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegCloseKey
RegDeleteValueW
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoTaskMemRealloc
StringFromGUID2
CoCreateInstance
CoTaskMemAlloc
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
OutputDebugStringA
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
api-ms-win-core-heap-l2-1-0
LocalFree
kernel32
lstrcmpiW
user32
UnregisterClassA
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
48KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
372B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=52, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=15, id=260, version=33145,
count=164, id=1, productName=Unmarked objects,
count=11, id=257, version=33145,
count=5, id=261, version=33145,
count=1, id=256, version=33145,
count=9, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wincredui.dll
- IMPHASH 57ddaef8776bf4e3eeab32017e43629d
- SHA256 809101c8cd8e28b2d1ca9e262af0b8ee33d37308e2dd12fa397b1590410d6976
- MD5 fb195c75e8d4f7fb5970cf05bab2fee0
- SHA1 f6127bcefb725a2c225a458b6182206ee3e9f7cc
- SHA512 ef5a266fa022f9a40df1e3563c9902ed0c4caa592325845fde4929f8e018233e43a66d3851e43453ea5f68fd123db64880701c3c52099da20a5cb3c48f02166f
- SSDEEP 6144:TAP3ahBII139t2yrBtRgAnbmkLQog5I30A65naCW:TAYBn139t2yrFdm6QoGIlCW
- TLSH T120445B2E36BA18E6D93B903C8543860AD2F378212312E6DF09E0D67D5F77AE47139B54
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
12032
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wincredui.pdb
msvcrt
memset
_amsg_exit
_XcptFilter
_callnewh
free
malloc
_unlock
__dllonexit
wcschr
_vsnwprintf
toupper
wcstol
_onexit
_resetstkoflw
__C_specific_handler
_purecall
_wcsicmp
wcsrchr
__iob_func
__CxxFrameHandler4
wcscpy_s
_wcsnicmp
wcsstr
putchar
__CxxFrameHandler3
memcmp
memcpy
strcmp
_lock
fputs
memmove
memmove_s
memcpy_s
_initterm
wcscmp
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
GetModuleHandleExW
GetModuleFileNameA
GetModuleHandleW
LoadStringW
GetModuleFileNameW
FreeLibrary
GetProcAddress
LoadLibraryExA
LoadLibraryExW
api-ms-win-core-localization-l1-2-0
SetThreadUILanguage
GetThreadUILanguage
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetProcessId
GetCurrentProcessId
CreateThread
ProcessIdToSessionId
ResumeThread
GetCurrentProcess
OpenThreadToken
GetCurrentThread
OpenProcessToken
GetCurrentThreadId
GetExitCodeThread
api-ms-win-core-errorhandling-l1-1-0
RaiseException
UnhandledExceptionFilter
SetLastError
GetLastError
SetUnhandledExceptionFilter
api-ms-win-core-synch-l1-1-0
CreateEventW
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
OpenSemaphoreW
LeaveCriticalSection
AcquireSRWLockShared
ReleaseSRWLockShared
InitializeCriticalSectionEx
CreateMutexExW
CreateSemaphoreExW
AcquireSRWLockExclusive
ReleaseSemaphore
ReleaseMutex
ReleaseSRWLockExclusive
InitializeCriticalSection
DeleteCriticalSection
SetEvent
EnterCriticalSection
WaitForSingleObject
WaitForMultipleObjectsEx
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventActivityIdControl
EventSetInformation
EventRegister
EventUnregister
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
Sleep
InitOnceComplete
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegQueryValueExA
RegCreateKeyExW
RegOpenKeyExW
RegDeleteKeyExW
RegGetValueW
RegQueryInfoKeyW
RegQueryValueExW
RegEnumKeyExW
RegCloseKey
RegOpenKeyExA
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
GetVersionExW
GetComputerNameExW
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-security-base-l1-1-0
FreeSid
InitializeSid
GetSidLengthRequired
GetSidSubAuthority
GetSidSubAuthorityCount
AllocateAndInitializeSid
GetSidIdentifierAuthority
EqualSid
GetTokenInformation
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCompareMemory
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsA
GetStdHandle
api-ms-win-core-sidebyside-l1-1-0
ReleaseActCtx
CreateActCtxW
ActivateActCtx
DeactivateActCtx
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFindFileNameW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpW
lstrlenW
ntdll
EtwEventWrite
NtQueryInformationProcess
RtlFreeHeap
NtQueryInformationToken
RtlAllocateHeap
RtlNtStatusToDosErrorNoTeb
RtlCompareUnicodeString
RtlInitUnicodeString
RtlInitString
EtwEventUnregister
EtwEventRegister
ole32
MkParseDisplayName
CreateBindCtx
api-ms-win-core-file-l1-1-0
GetFileType
WriteFile
api-ms-win-core-console-l1-1-0
WriteConsoleW
GetConsoleOutputCP
SetConsoleMode
ReadConsoleW
GetConsoleMode
api-ms-win-core-console-l1-2-0
PeekConsoleInputW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
CredUIInternalCmdLinePromptForCredentialsA
CredUIInternalCmdLinePromptForCredentialsW
CredUIInternalConfirmCredentialsA
CredUIInternalConfirmCredentialsW
CredUIInternalInitControls
CredUIInternalPromptForCredentialsA
CredUIInternalPromptForCredentialsW
CredUIInternalPromptForWindowsCredentialsA
CredUIInternalPromptForWindowsCredentialsW
CredUIInternalPromptForWindowsCredentialsWorker
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
PasskeyOTSPrompt
WHOTSLaunch
Name
.text
Size
164KB
Virtual Size
163KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
28KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
804B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=68, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=253, version=33145,
count=1, productName=Unmarked objects (old),
count=21, id=260, version=33145,
count=5, id=259, version=33145,
count=413, id=1, productName=Unmarked objects,
count=7, id=257, version=33145,
count=6, id=261, version=33145,
count=1, id=256, version=33145,
count=40, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
windiag.dll
- IMPHASH 678cd3321d86c63e33b9bdf65753bbb5
- SHA256 a6662185be667b1fb90c8af5481e4ac3f318ebc6d9b3be360f6684cfcaf0b735
- MD5 55bb832f6dfa2a1792608bfa449ad81f
- SHA1 83aafe6220179ad175102236ea3ac85cfde44328
- SHA512 6b054e4d723aaa5a443560d3b5f14f3fa1915a2c6d17748e84c92e4b13ac7b2065c92d83834891e3f6bc96db2d5d4c2043bc216ee7dded080963c1ed02234e7c
- SSDEEP 24576:k+yrTkfJK4iDmvhq1w43m5MMWbcwaUgq:k+yr4fJK4Dhq1w43IMMWyUg
- TLSH T106156B6E66BC00A4D9BAC17D8A82450BD2F2B425037196CF16E187BE5F17FF45A3BB10
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
13360
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
windiag.pdb
msvcp_win
?_Incref@facet@locale@std@@UEAAXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?swap@?$basic_iostream@DU?$char_traits@D@std@@@std@@IEAAXAEAV12@@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z
?getline@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@PEAG_J@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?id@?$collate@G@std@@2V0locale@2@A
_Wcsxfrm
_Wcscoll
??Bid@locale@std@@QEAA_KXZ
?widen@?$ctype@G@std@@QEBAGD@Z
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??Bios_base@std@@QEBA_NXZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??1?$basic_istream@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
??_D?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?tolower@?$ctype@G@std@@QEBAGG@Z
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA_N_N@Z
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
?id@?$ctype@G@std@@2V0locale@2@A
?_Xbad_alloc@std@@YAXXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
_Cnd_init_in_situ
_Cnd_do_broadcast_at_thread_exit
_Cnd_destroy_in_situ
_Xtime_get_ticks
_Unlock_shared_ptr_spin_lock
_Lock_shared_ptr_spin_lock
_Mtx_current_owns
_Cnd_timedwait
_Cnd_wait
_Mtx_unlock
_Mtx_lock
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?is@?$ctype@G@std@@QEBA_NFG@Z
_Cnd_signal
?_Xinvalid_argument@std@@YAXPEBD@Z
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Xout_of_range@std@@YAXPEBD@Z
_Thrd_id
_Thrd_join
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_init_in_situ
??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ
_Mtx_destroy_in_situ
?_Xbad_function_call@std@@YAXXZ
?good@ios_base@std@@QEBA_NXZ
??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?unshift@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?uncaught_exception@std@@YA_NXZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
api-ms-win-crt-runtime-l1-1-0
_initterm_e
__fpecode
_initterm
signal
api-ms-win-crt-stdio-l1-1-0
tmpfile
tmpnam
_tempnam
api-ms-win-crt-string-l1-1-0
strpbrk
wcsnlen
strncmp
memset
strcmp
strspn
wcscmp
strnlen
api-ms-win-crt-private-l1-1-0
_o__beginthreadex
_o__callnewh
_o__cexit
_o__configthreadlocale
_o__configure_narrow_argv
_o__crt_atexit
_o__difftime64
_o__errno
_o__execute_onexit_table
_o__fseeki64
_o__ftelli64
_o__get_stream_buffer_pointers
_o__gmtime64
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__localtime64
_o__lock_file
_o__mktime64
_o__pclose
_o__popen
_o__purecall
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
_o__stricmp
_o__strnicmp
__intrinsic_setjmp
_o__unlock_file
_o_abort
_o_acos
_o_asin
_o_atan2
_o_ceil
_o_clearerr
_o_cos
_o_exit
_o_exp
_o_fclose
_o_feof
_o_ferror
_o_fflush
_o_fgetc
_o_fgetpos
_o_fgets
_o_floor
_o_fmod
_o_fopen
_o_fputc
_o_fread
_o_free
_o_freopen
_o_frexp
_o_fsetpos
_o_fwrite
_o_getc
_o_getenv
_o_isalnum
_o_isalpha
_o_iscntrl
_o_isdigit
_o_isgraph
_o_islower
_o_ispunct
_o_isspace
_o_isupper
_o_iswspace
_o_isxdigit
_o_ldexp
_o_localeconv
_o_log
_o_log10
_o_log2
_o_malloc
_o_pow
_o_realloc
_o_remove
_o_rename
_o_setlocale
_o_setvbuf
_o_sin
_o_sqrt
_o_strcoll
_o_strerror
_o_strftime
_o_strtod
_o_strtoul
_o_strtoull
_o_system
_o_tan
_o_terminate
_o_tolower
_o_toupper
_o_ungetc
_o_wcsncpy_s
_o_wcstoull
__CxxFrameHandler3
__current_exception_context
_CxxThrowException
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___stdio_common_vfprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___acrt_iob_func
_o____lc_codepage_func
__C_specific_handler
__std_type_info_compare
strstr
memcpy
strchr
memcmp
memchr
strrchr
wcschr
__current_exception
longjmp
__std_terminate
__CxxFrameHandler4
memmove
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExA
GetModuleHandleExA
GetModuleHandleExW
LockResource
LoadLibraryExW
FreeLibrary
LoadResource
GetModuleHandleW
SizeofResource
GetModuleFileNameW
GetModuleFileNameA
GetProcAddress
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
ReleaseSemaphore
WaitForSingleObjectEx
ReleaseSRWLockShared
LeaveCriticalSection
CreateSemaphoreExW
AcquireSRWLockExclusive
ResetEvent
WaitForSingleObject
SetEvent
ReleaseMutex
InitializeCriticalSectionAndSpinCount
TryAcquireSRWLockExclusive
InitializeCriticalSectionEx
OpenSemaphoreW
ReleaseSRWLockExclusive
InitializeSRWLock
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
CreateEventW
api-ms-win-core-heap-l1-1-0
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
RaiseException
SetLastError
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolWait
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
CloseThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
ProcessIdToSessionId
GetCurrentThread
GetCurrentProcessId
SetThreadToken
GetExitCodeProcess
ResumeThread
CreateProcessAsUserW
CreateProcessW
TerminateProcess
OpenProcessToken
GetCurrentThreadId
OpenThread
OpenThreadToken
api-ms-win-core-localization-l1-2-0
GetLocaleInfoEx
FormatMessageA
FormatMessageW
LCMapStringEx
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventRegister
EventUnregister
EventWriteTransfer
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-sysinfo-l1-1-0
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-file-l1-1-0
CreateFileW
GetFileSizeEx
FindFirstFileW
GetFileAttributesA
FindClose
CreateFileA
WriteFile
DeleteFileA
ReadFile
GetFileAttributesExW
FindNextFileW
SetFileInformationByHandle
FileTimeToLocalFileTime
GetFileInformationByHandle
SetFilePointer
GetFinalPathNameByHandleW
FindFirstFileExW
GetFileAttributesW
CreateDirectoryW
cabinet
ord11
ord43
ord10
ord40
ord13
ord14
ord45
api-ms-win-core-kernel32-legacy-l1-1-0
FindResourceA
FileTimeToDosDateTime
WTSGetActiveConsoleSessionId
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableA
GetCommandLineW
GetCurrentDirectoryW
ExpandEnvironmentStringsW
userenv
CreateEnvironmentBlock
ExpandEnvironmentStringsForUserW
DestroyEnvironmentBlock
api-ms-win-eventing-consumer-l1-1-0
ProcessTrace
CloseTrace
OpenTraceW
rpcrt4
RpcStringFreeA
UuidToStringA
UuidCreate
UuidFromStringA
api-ms-win-security-base-l1-1-0
GetTokenInformation
DuplicateTokenEx
AdjustTokenPrivileges
SetTokenInformation
api-ms-win-security-lsalookup-l2-1-0
LookupPrivilegeValueW
api-ms-win-core-file-l1-2-3
GetTempPath2W
oleaut32
SysStringLen
GetErrorInfo
SetErrorInfo
SysAllocStringByteLen
SafeArrayGetLBound
SafeArrayDestroy
SysFreeString
SysAllocStringLen
SysAllocString
SafeArrayGetVartype
SafeArrayCopy
SafeArrayUnlock
SafeArrayLock
VariantCopy
VariantInit
VariantClear
SysStringByteLen
SafeArrayGetUBound
api-ms-win-eventing-tdh-l1-1-0
TdhGetEventMapInformation
TdhGetEventInformation
TdhEnumerateProviders
TdhFormatProperty
api-ms-win-eventing-controller-l1-1-0
StartTraceW
TraceSetInformation
EnableTraceEx2
QueryAllTracesW
ControlTraceW
EnumerateTraceGuidsEx
api-ms-win-eventing-legacy-l1-1-0
EnumerateTraceGuids
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
FindResourceW
api-ms-win-core-com-l1-1-0
CoCreateFreeThreadedMarshaler
CoUninitialize
CoCreateInstance
CoInitializeEx
CoSetProxyBlanket
CoCreateGuid
CoTaskMemFree
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
SystemTimeToFileTime
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
MoveFileExW
api-ms-win-core-file-l2-1-2
CopyFileW
api-ms-win-service-management-l1-1-0
CloseServiceHandle
OpenServiceW
OpenSCManagerW
api-ms-win-core-sysinfo-l1-2-0
GetSystemTimePreciseAsFileTime
api-ms-win-core-processthreads-l1-1-3
GetThreadDescription
SetThreadDescription
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
ntdll
NtCreateWnfStateName
NtQuerySystemInformation
NtQueryInformationProcess
RtlNtStatusToDosError
NtPowerInformation
NtQueryWnfStateData
NtDeleteWnfStateData
NtDeleteWnfStateName
NtUpdateWnfStateData
NtQueryWnfStateNameInformation
NtOpenFile
RtlInitUnicodeString
api-ms-win-core-realtime-l1-1-1
QueryInterruptTimePrecise
QueryUnbiasedInterruptTimePrecise
api-ms-win-core-processthreads-l1-1-2
GetSystemTimes
api-ms-win-service-core-l1-1-1
EnumServicesStatusExW
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
GetThreadTimes
OpenProcess
api-ms-win-core-debug-l1-1-1
CheckRemoteDebuggerPresent
api-ms-win-core-realtime-l1-1-0
QueryThreadCycleTime
api-ms-win-core-libraryloader-l1-2-3
EnumResourceNamesA
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-namedpipe-ansi-l1-1-0
WaitNamedPipeA
api-ms-win-core-registry-l1-1-0
RegDeleteKeyExW
RegEnumValueW
RegGetValueA
RegDeleteTreeW
RegSetValueExW
RegGetValueW
RegOpenKeyExW
RegDeleteValueW
RegCreateKeyExW
RegCloseKey
crypt32
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-power-base-l1-1-0
CallNtPowerInformation
api-ms-win-core-registry-l2-1-0
RegEnumKeyW
api-ms-win-core-io-l1-1-1
CancelSynchronousIo
api-ms-win-core-namedpipe-l1-1-0
CreatePipe
api-ms-win-security-lsalookup-ansi-l2-1-0
LookupAccountSidA
LookupPrivilegeNameA
api-ms-win-security-sddl-ansi-l1-1-0
ConvertSidToStringSidA
api-ms-win-core-memory-l1-1-0
CreateFileMappingW
VirtualProtect
VirtualQuery
UnmapViewOfFile
MapViewOfFile
imagehlp
SymUnloadModule64
SymGetModuleInfoW64
SymSetOptions
SymGetOptions
SymCleanup
ImageDirectoryEntryToDataEx
ImageNtHeader
SymFindFileInPathW
api-ms-win-core-version-l1-1-0
VerQueryValueW
api-ms-win-service-management-l2-1-0
QueryServiceStatusEx
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedPushEntrySList
dbghelp
SymSrvGetFileIndexInfoW
SymInitializeW
SymGetLineFromAddrW64
SymFromAddrW
SymLoadModuleExW
tdh
TdhGetWppProperty
TdhOpenDecodingHandle
TdhSetDecodingParameter
TdhCloseDecodingHandle
api-ms-win-crt-time-l1-1-0
clock
_time64
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
WinDiagnosticsFree
WinDiagnosticsModules
WinDiagnosticsRequest
WinDiagnosticsResume
Name
.text
Size
640KB
Virtual Size
636KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
128KB
Virtual Size
125KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
32KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
100KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=140, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=6, id=259, version=33145,
count=1564, id=1, productName=Unmarked objects,
count=7, id=257, version=33145,
count=63, id=261, version=33145,
count=1, id=256, version=33145,
count=29, id=264, version=33145,
count=2, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
windlp.dll
- IMPHASH 2fe95f0b12b58f58c7e7662f4edf2296
- SHA256 28e9cd173bf1331d8b5ed7a996514b69a49bc2c8bb27fd662864e2823328cd27
- MD5 255d0b1eeb4e3ab1361c2e6c506ae46e
- SHA1 3d5c85cdeb0c55c718355de966d1bd95e236541f
- SHA512 7e777023f0451a6debef811b4270ee42bd62373de1f1149e66442c02335bdffa763363253c5fea6641b75078d3791b89b3e2604c1309b7c9107585c0f6da60c3
- SSDEEP 12288:niTPv3+Ts1Vx1w8J0cqsFKO69bcx5Us9oVsjIb1V8rk/7xy670y6DjH7BsthvC:nyp7wbnVrB70vjH7KvC
- TLSH T11005081A23F800D8F6FBE678EA728511DA727431A731D9EF1150883D6F6E9D09D38B25
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
6416
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB paths
WinDlp.pdb
msvcrt
_XcptFilter
_CxxThrowException
memcmp
fflush
_vsnwprintf_s
fwprintf
memcpy
swprintf_s
_callnewh
memcpy_s
wcsncmp
memmove
_vsnwprintf
??1type_info@@UEAA@XZ
__CxxFrameHandler4
?terminate@@YAXXZ
_wcsicmp
wcscpy_s
wcsrchr
_purecall
??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBV0@@Z
wcschr
__iob_func
iswalpha
wcstoul
_wcstoui64
_wcsnicmp
wcsstr
memset
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
malloc
free
_amsg_exit
memmove_s
wcscmp
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
CreateThread
SetPriorityClass
SetThreadToken
GetCurrentProcessId
GetThreadPriority
GetCurrentThread
SetThreadPriority
OpenProcessToken
GetCurrentProcess
OpenThreadToken
GetPriorityClass
GetExitCodeThread
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemWindowsDirectoryW
GetSystemTime
GetSystemDirectoryW
GetSystemTimeAsFileTime
bcrypt
BCryptHashData
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptOpenAlgorithmProvider
BCryptCreateHash
BCryptGetProperty
rpcrt4
I_RpcMapWin32Status
UuidFromStringW
UuidCreate
UuidToStringW
RpcStringFreeW
wintrust
WTHelperProvDataFromStateData
WinVerifyTrust
WTHelperGetProvSignerFromChain
crypt32
CertGetNameStringW
imagehlp
CheckSumMappedFile
ntdll
RtlGetVersion
RtlSetThreadErrorMode
RtlGetThreadErrorMode
NtShutdownSystem
RtlFreeHeap
NtSetInformationFile
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
LdrAccessResource
LdrFindResource_U
NtQuerySystemEnvironmentValueEx
NtSetSystemEnvironmentValueEx
NtQuerySystemInformation
RtlNtStatusToDosError
NtQueryInformationThread
NtQueryInformationFile
NtClose
RtlImageNtHeader
NtSetInformationThread
NtReadFile
NtOpenProcess
NtQueryInformationProcess
NtWriteFile
RtlAdjustPrivilege
RtlDosPathNameToNtPathName_U
RtlInitUnicodeString
RtlAllocateHeap
NtSetInformationProcess
wimgapi
WIMLoadImage
WIMCreateFile
WIMWriteFileWithIntegrity
WIMSplitFile
WIMCloseHandle
WIMInitFileIOCallbacks
WIMApplyImage
WIMSetImageInformation
WIMSetReferenceFile
WIMUnregisterMessageCallback
WIMReadFileEx
WIMExportImage
WIMSetTemporaryPath
WIMAddImagePath
WIMGetImageInformation
WIMGetImageCount
WIMGetAttributes
WIMSetFileIOCallbackTemporaryPath
WIMCopyFile
WIMRegisterMessageCallback
WIMCaptureImage
api-ms-win-core-file-l1-1-0
GetFileAttributesExW
FindClose
FindFirstFileNameW
QueryDosDeviceW
SetFileInformationByHandle
FindNextFileNameW
GetLongPathNameW
GetFinalPathNameByHandleW
GetVolumePathNameW
GetDiskFreeSpaceExW
CreateFileW
GetFileAttributesW
SetEndOfFile
SetFileAttributesW
CreateDirectoryW
ReadFile
WriteFileEx
FlushFileBuffers
DeleteFileW
GetVolumeInformationW
FindFirstFileW
GetFileSizeEx
ReadFileEx
GetTempFileNameW
GetFileInformationByHandle
RemoveDirectoryW
WriteFile
SetFilePointerEx
FindNextFileW
GetFullPathNameW
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExW
LoadLibraryExW
GetProcAddress
FreeLibrary
LoadStringW
api-ms-win-security-cryptoapi-l1-1-0
CryptImportKey
CryptExportKey
CryptGetKeyParam
CryptAcquireContextW
CryptSetKeyParam
CryptGetUserKey
CryptGenKey
CryptReleaseContext
CryptDestroyKey
CryptEncrypt
CryptDecrypt
oleaut32
SafeArrayCreateVector
VariantClear
SafeArrayDestroy
VariantInit
SafeArrayPutElement
SysAllocStringLen
SysFreeString
SysAllocString
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringW
api-ms-win-core-synch-l1-1-0
CreateSemaphoreExW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
EnterCriticalSection
ReleaseMutex
InitializeCriticalSectionAndSpinCount
CreateEventW
SetEvent
ReleaseSRWLockShared
DeleteCriticalSection
AcquireSRWLockShared
OpenSemaphoreW
WaitForSingleObject
WaitForSingleObjectEx
CreateMutexExW
ResetEvent
ReleaseSemaphore
InitializeCriticalSectionEx
LeaveCriticalSection
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
SetLastError
SetUnhandledExceptionFilter
SetErrorMode
GetLastError
UnhandledExceptionFilter
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoInitializeEx
CoSetProxyBlanket
CoUninitialize
CoTaskMemFree
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-heap-l2-1-0
LocalFree
GlobalFree
LocalAlloc
api-ms-win-core-file-l1-2-0
GetVolumeNameForVolumeMountPointW
api-ms-win-core-kernel32-legacy-l1-1-0
SetVolumeLabelW
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-timezone-l1-1-0
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-shcore-stream-l1-1-0
SHCreateStreamOnFileW
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
MoveFileExW
CopyFileExW
api-ms-win-core-file-l2-1-2
CopyFileW
api-ms-win-core-memory-l1-1-0
CreateFileMappingW
VirtualFree
VirtualAlloc
UnmapViewOfFile
MapViewOfFile
VirtualQuery
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
api-ms-win-core-privateprofile-l1-1-0
GetPrivateProfileSectionW
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventUnregister
EventRegister
api-ms-win-core-shlwapi-legacy-l1-1-0
PathRemoveBackslashW
api-ms-win-security-base-l1-1-0
GetSecurityDescriptorControl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorDacl
AdjustTokenPrivileges
GetSecurityDescriptorSacl
CopySid
GetTokenInformation
DuplicateTokenEx
AllocateAndInitializeSid
FreeSid
AddAccessAllowedAce
GetLengthSid
InitializeAcl
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-security-provider-l1-1-0
SetNamedSecurityInfoW
SetSecurityInfo
api-ms-win-security-lsalookup-l2-1-0
LookupPrivilegeValueW
api-ms-win-core-processenvironment-l1-1-0
GetCurrentDirectoryW
api-ms-win-core-string-l2-1-0
CharUpperW
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-rtlsupport-l1-1-0
RtlCompareMemory
bcd
SyspartIsSpace
BcdOpenStoreFromFile
BcdOpenObject
SyspartGetPhysicalPartitions
BcdCloseObject
BcdCloseStore
BcdGetElementData
BcdSetElementData
BcdCopyObject
BcdSetLogging
SyspartGetSystemPartition
BcdQueryObject
unattend
UnattendCtxBeginModify
UnattendCtxSetString
UnattendFreeNode
UnattendCtxGetRootNode
UnattendCtxSetStringByNode
UnattendCtxDeserializeBuffer
UnattendCtxCleanup
UnattendCtxSerializeToBuffer
UnattendCtxRemoveNode
UnattendCtxDeserializeString
UnattendCtxCommitModify
UnattendCtxGetString
UnattendCtxOpenNodeByNode
UnattendCtxSpliceTrees
UnattendCtxDeserializeFile
UnattendCtxGetCountByNode
UnattendCtxPrettyPrint
UnattendCtxGetStringByNode
UnattendCtxOpenNode
winhttp
WinHttpReceiveResponse
WinHttpAddRequestHeaders
WinHttpQueryHeaders
WinHttpReadData
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpSetOption
WinHttpCloseHandle
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpSendRequest
WinHttpSetTimeouts
WinHttpConnect
WinHttpCrackUrl
WinHttpOpen
api-ms-win-core-shutdown-l1-1-0
InitiateSystemShutdownExW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpW
CreateDlpManager
Name
.text
Size
592KB
Virtual Size
588KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
188KB
Virtual Size
187KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=96, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=20, id=260, version=33145,
count=425, id=1, productName=Unmarked objects,
count=25, id=257, version=33145,
count=8, id=261, version=33145,
count=86, id=264, version=33145,
count=1, id=256, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,