VscMgrPS.zip
- SHA256 d852a2a105a6aaafdf2292580eea27dbfd16e248d7df4f3177b0086291cae60e
Overview
overview
7Static
static
5UXFrame.dll
windows10-2004-x64
1UXInit.dll
windows10-2004-x64
1UserLangua...ck.dll
windows10-2004-x64
1UserMgrProxy.dll
windows10-2004-x64
1UvcModel.dll
windows10-2004-x64
1VCardParser.dll
windows10-2004-x64
1VIDRESZR.dll
windows10-2004-x64
5VPNv2CSP.dll
windows10-2004-x64
1Vault.dll
windows10-2004-x64
1VaultCDS.dll
windows10-2004-x64
1VaultRoaming.dll
windows10-2004-x64
1VhfUm.dll
windows10-2004-x64
1VideoHandlers.dll
windows10-2004-x64
1VirtualMon.dll
windows10-2004-x64
1VirtualSur...po.dll
windows10-2004-x64
1VmApplicat...xy.dll
windows10-2004-x64
5VmCrashDump.dll
windows10-2004-x64
5VmSynthNic.dll
windows10-2004-x64
1VocabRoami...er.dll
windows10-2004-x64
1VoiceActiv...er.dll
windows10-2004-x64
1VoipRT.dll
windows10-2004-x64
1VpnSohDesktop.dll
windows10-2004-x64
1VrdUmed.dll
windows10-2004-x64
5VscMgrPS.dll
windows10-2004-x64
7userinitext.dll
windows10-2004-x64
1usermgr.dll
windows10-2004-x64
1usermgrcli.dll
windows10-2004-x64
1usoapi.dll
windows10-2004-x64
1usocoreps.dll
windows10-2004-x64
1usodocked.dll
windows10-2004-x64
1usosvc.dll
windows10-2004-x64
1usp10.dll
windows10-2004-x64
1Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
UXFrame.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
UXInit.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
UserLanguageProfileCallback.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
UserMgrProxy.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
UvcModel.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
VCardParser.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
VIDRESZR.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
VPNv2CSP.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Vault.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
VaultCDS.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
VaultRoaming.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
VhfUm.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
VideoHandlers.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
VirtualMon.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
VirtualSurroundApo.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
VmApplicationHealthMonitorProxy.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
VmCrashDump.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral18
Sample
VmSynthNic.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
VocabRoamingHandler.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
VoiceActivationManager.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
VoipRT.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
VpnSohDesktop.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
VrdUmed.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral24
Sample
VscMgrPS.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral25
Sample
userinitext.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
usermgr.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
usermgrcli.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
usoapi.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
usocoreps.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
usodocked.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
usosvc.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
usp10.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target VscMgrPS.zip
- Size 23.1MB
- Sample260812-gnfsjszeke
- SHA256 d852a2a105a6aaafdf2292580eea27dbfd16e248d7df4f3177b0086291cae60e
- MD5 5d57a21f772104640a6300551b99c82c
- SHA1 f704b8e1bd27e07ab99fbbae55b5cb11be6cf2a8
- SHA512 d1bf265ac34aae2e5cead875908dba917e7abb47241ccb896ac38666092ce58e5d98f057cd17584ecc8bba109a416d0eb860fc8073e35105afaf0253c9c28aad
- SSDEEP 393216:DAaWRHqyGtldD3hn8KQWSbrnDafgHNEzK2jFejzU9YhKaMDnyrBhsvQ3vnXso:MaGqnDdVn83P3nDaJW2pejJrtBhsvKEo
- TLSH T1E837331DCD3BA584EC0732B21A662E215437D6DB0AB48875FF950C6D3CDEFA06B56C0A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack001/vmdevicehost.dll - Unsigned PE 50 IoCs
Checks for missing Authenticode signature.
resource unpack001/UXFrame.dll unpack001/UXInit.dll unpack001/UserLanguageProfileCallback.dll unpack001/UserMgrProxy.dll unpack001/UvcModel.dll unpack001/VCardParser.dll unpack001/VPNv2CSP.dll unpack001/Vault.dll unpack001/VaultCDS.dll unpack001/VaultRoaming.dll unpack001/VhfUm.dll unpack001/VideoHandlers.dll unpack001/VirtualMon.dll unpack001/VirtualSurroundApo.dll unpack001/VocabRoamingHandler.dll unpack001/VoiceActivationManager.dll unpack001/VoipRT.dll unpack001/VpnSohDesktop.dll unpack001/VscMgrPS.dll unpack001/userinitext.dll unpack001/usermgr.dll unpack001/usoapi.dll unpack001/usocoreps.dll unpack001/usodocked.dll unpack001/usosvc.dll unpack001/usp10.dll unpack001/ustprov.dll unpack001/utcutil.dll unpack001/uudf.dll unpack001/uxtheme.dll unpack001/vaultcli.dll unpack001/vaultsvc.dll unpack001/vbsapi.dll unpack001/vbscript.dll unpack001/vbssysprep.dll unpack001/vccorlib110.dll unpack001/vds_ps.dll unpack001/vdsbas.dll unpack001/vdsdyn.dll unpack001/vdsutil.dll unpack001/vdsvd.dll unpack001/vfpapi.dll unpack001/vfuprov.dll unpack001/vfwwdm32.dll unpack001/vmdevicehost.dll unpack001/vmhbmgmt.dll unpack001/vmrdvcore.dll unpack001/vmvpci.dll unpack001/vpnike.dll unpack001/vpnikeapi.dll
File Explorer
-
VscMgrPS.zip.zip 23.1MB
-
UXFrame.dll.dll 531KB
-
UXInit.dll.dll 160KB
-
UserLanguageProfileCallback.dll.dll 104KB
-
UserMgrProxy.dll.dll 428KB
-
UvcModel.dll.dll 184KB
-
VCardParser.dll.dll 204KB
-
VIDRESZR.DLL.dll 170KB
-
VPNv2CSP.dll.dll 288KB
-
Vault.dll.dll 320KB
-
VaultCDS.dll.dll 164KB
-
VaultRoaming.dll.dll 144KB
-
VhfUm.dll.dll 60KB
-
VideoHandlers.dll.dll 256KB
-
VirtualMon.dll.dll 204KB
-
VirtualSurroundApo.dll.dll 132KB
-
VmApplicationHealthMonitorProxy.dll.dll 53KB
-
VmCrashDump.dll.dll 321KB
-
VmSynthNic.dll.dll 469KB
-
VocabRoamingHandler.dll.dll 172KB
-
VoiceActivationManager.dll.dll 132KB
-
VoipRT.dll.dll 256KB
-
VpnSohDesktop.dll.dll 32KB
-
VrdUmed.dll.dll 53KB
-
VscMgrPS.dll.dll 40KB
-
userinitext.dll.dll 84KB
-
usermgr.dll.dll 1.4MB
-
usermgrcli.dll.dll 102KB
-
usoapi.dll.dll 208KB
-
usocoreps.dll.dll 64KB
-
usodocked.dll.dll 676KB
-
usosvc.dll.dll 104KB
-
usp10.dll.dll 100KB
-
ustprov.dll.dll 112KB
-
utcapi.dll.dll 65KB
-
utcutil.dll.dll 156KB
-
utildll.dll.dll 74KB
-
uudf.dll.dll 196KB
-
uxlib.dll.dll 181KB
-
uxlibres.dll.dll 21KB
-
uxtheme.dll.dll 664KB
-
vaultcli.dll.dll 316KB
-
vaultsvc.dll.dll 440KB
-
vbsapi.dll.dll 248KB
-
vbscript.dll.dll 660KB
-
vbssysprep.dll.dll 160KB
-
vcamp140.dll.dll 409KB
-
vccorlib110.dll.dll 364KB
-
vccorlib140.dll.dll 344KB
-
vcomp140.dll.dll 188KB
-
vcruntime140.dll.dll 121KB
-
vcruntime140_1.dll.dll 48KB
-
vcruntime140_1_clr0400.dll.dll 38KB
-
vcruntime140_clr0400.dll.dll 96KB
-
vcruntime140_threads.dll.dll 37KB
-
vds_ps.dll.dll 112KB
-
vdsbas.dll.dll 328KB
-
vdsdyn.dll.dll 636KB
-
vdsutil.dll.dll 172KB
-
vdsvd.dll.dll 108KB
-
veinterop.dll.dll 45KB
-
verifier.dll.dll 392KB
-
version.dll.dll 53KB
-
vertdll.dll.dll 211KB
-
vfpapi.dll.dll 156KB
-
vfuprov.dll.dll 128KB
-
vfwwdm32.dll.dll 92KB
-
vid.dll.dll 257KB
-
virtdisk.dll.dll 101KB
-
vmbuspipe.dll.dll 82KB
-
vmbuspiper.dll.dll 73KB
-
vmbusvdev.dll.dll 265KB
-
vmchipset.dll.dll 1.1MB
-
vmcompute.dll.dll 813KB
-
vmcomputeeventlog.dll.dll 45KB
-
vmdevicehost.dll.dll 260KB
-
vmdynmem.dll.dll 389KB
-
vmfirmware.dll.dll 6.1MB
-
vmfirmwarehcl.dll.dll 34.5MB
-
vmflexio.dll.dll 585KB
-
vmhbmgmt.dll.dll 128KB
-
vmiccore.dll.dll 373KB
-
vmictimeprovider.dll.dll 101KB
-
vmpmem.dll.dll 541KB
-
vmprox.dll.dll 429KB
-
vmrdvcore.dll.dll 468KB
-
vmserial.dll.dll 573KB
-
vmsif.dll.dll 333KB
-
vmsifcore.dll.dll 145KB
-
vmsifproxystub.dll.dll 49KB
-
vmsmb.dll.dll 445KB
-
vmsynthstor.dll.dll 505KB
-
vmuidevices.dll.dll 609KB
-
vmusrv.dll.dll 709KB
-
vmvirtio.dll.dll 165KB
-
vmvpci.dll.dll 472KB
-
vmwpctrl.dll.dll 121KB
-
vmwpevents.dll.dll 129KB
-
vp9fs.dll.dll 321KB
-
vpnike.dll.dll 720KB
-
vpnikeapi.dll.dll 80KB
UXFrame.dll
- IMPHASH cf71ebd7fc530f53e35a0bf0acda96a3
- SHA256 1d92ed039c04a3be3768696820c0be86ac90649fc74aa91d767caf802ae0e9f8
- MD5 a3abe28d9b608325e3c1268f27034983
- SHA1 479eb19ddadf00c7ee5140bd18f3172fd3ce52f8
- SHA512 b8b04a42a07b8379f148a3736a214f184a48fe8c7374702cf7de334f936dd74f4e72b88ae9a3fa5b8a855d62bec91b4229953228dd531a4fbbb439f43a1d5557
- SSDEEP 12288:qVujkLRK3fHfSHwNz4gMaivb6FrtZJYmG+W:qVuQLE3fHfSHkEgMaGkemG+W
- TLSH T134C45A6962A807E5E2BAE17DD917890BF6B23855037687CB023081491F2BFF4993F761
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
13520
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
UXFrame.pdb
api-ms-win-appmodel-runtime-internal-l1-1-7
AddDependencyToProcessPackageGraph
user32
GetMonitorInfoW
OffsetRect
IntersectRect
SetWindowPos
IsWindow
LoadStringW
IsWindowVisible
ShowWindow
EnableWindow
PostMessageW
LoadIconW
SendMessageW
DestroyIcon
GetWindowRect
AdjustWindowRectExForDpi
SwitchToThisWindow
SetForegroundWindow
SetPropW
GetDpiForWindow
MonitorFromWindow
GetCursorPos
GetWindowLongW
AdjustWindowRectEx
DestroyWindow
SetWindowRgn
RegisterHotKey
GetForegroundWindow
GetWindowBand
SetWindowBand
GetWindowLongPtrW
GetLastActivePopup
SetWindowTextW
SendMessageTimeoutW
AllowSetForegroundWindow
SetFocus
GetActiveWindow
GetClientRect
GetMessageW
TranslateMessage
DispatchMessageW
RegisterWindowMessageW
CreateWindowExW
RegisterClassExW
RegisterClassW
CreateWindowInBand
PostQuitMessage
SetWindowLongPtrW
GetSystemMetrics
MonitorFromPoint
ReplyMessage
SendNotifyMessageW
DefWindowProcW
GetWindowThreadProcessId
MonitorFromRect
combase
GetErrorInfo
ord179
SetErrorInfo
dwmapi
DwmGetWindowAttribute
DwmSetWindowAttribute
gdi32
CreateRectRgnIndirect
DeleteObject
coremessaging
CreateDispatcherQueueController
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegNotifyChangeKeyValue
RegCreateKeyExW
RegGetValueW
RegOpenKeyExW
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventWriteTransfer
EventRegister
EventSetInformation
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-processthreads-l1-1-0
ProcessIdToSessionId
GetCurrentThread
OpenThread
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
OpenProcessToken
GetProcessIdOfThread
GetCurrentThreadId
GetProcessId
api-ms-win-core-localization-l1-2-0
GetThreadUILanguage
FormatMessageW
GetLocaleInfoW
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
GetModuleHandleW
GetProcAddress
LoadLibraryExW
FreeLibrary
GetModuleHandleExW
GetModuleFileNameA
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapReAlloc
HeapFree
api-ms-win-core-com-l1-1-0
CoCreateFreeThreadedMarshaler
CoCreateInstance
CoTaskMemFree
PropVariantClear
CoWaitForMultipleHandles
CoTaskMemAlloc
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionEx
CreateSemaphoreExW
ResetEvent
InitializeCriticalSection
WaitForSingleObject
OpenSemaphoreW
CreateMutexExW
SetEvent
WaitForSingleObjectEx
DeleteCriticalSection
ReleaseMutex
AcquireSRWLockShared
InitializeCriticalSectionAndSpinCount
ReleaseSemaphore
ReleaseSRWLockShared
LeaveCriticalSection
EnterCriticalSection
CreateEventExW
ReleaseSRWLockExclusive
CreateEventW
AcquireSRWLockExclusive
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
SetLastError
RaiseException
UnhandledExceptionFilter
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
DisassociateCurrentThreadFromCallback
SetThreadpoolTimerEx
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CloseThreadpoolWait
TrySubmitThreadpoolCallback
CreateThreadpoolWait
CreateThreadpoolTimer
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-registry-l1-1-1
RegDeleteKeyValueW
RegSetKeyValueW
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolQueueTask
SHTaskPoolGetUniqueContext
api-ms-win-core-winrt-robuffer-l1-1-0
RoGetBufferMarshaler
api-ms-win-core-winrt-error-l1-1-0
RoFailFastWithErrorContext
RoOriginateErrorW
RoTransformError
RoOriginateError
api-ms-win-core-winrt-string-l1-1-0
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsCreateString
WindowsPromoteStringBuffer
WindowsPreallocateStringBuffer
WindowsCreateStringReference
WindowsDeleteString
WindowsDeleteStringBuffer
WindowsGetStringRawBuffer
api-ms-win-security-base-l1-1-0
IsValidSid
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
CompareStringOrdinal
api-ms-win-core-winrt-l1-1-0
RoUninitialize
RoGetActivationFactory
RoActivateInstance
api-ms-win-core-psapi-l1-1-0
K32EmptyWorkingSet
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceComplete
InitOnceExecuteOnce
InitOnceBeginInitialize
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-shcore-scaling-l1-1-1
GetDpiForMonitor
api-ms-win-core-largeinteger-l1-1-0
MulDiv
oleaut32
VariantInit
SysStringLen
SysAllocString
SysFreeString
api-ms-win-core-localization-obsolete-l1-2-0
GetUserDefaultUILanguage
api-ms-win-core-processthreads-l1-1-1
OpenProcess
IsProcessorFeaturePresent
api-ms-win-ro-typeresolution-l1-1-1
RoCreatePropertySetSerializer
api-ms-win-shlwapi-winrt-storage-l1-1-1
SHCreateWorkerWindowW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
ext-ms-win-uiacore-l1-1-0
UiaReturnRawElementProvider
UiaHostProviderFromHwnd
api-ms-win-core-processthreads-l1-1-3
SetThreadDescription
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-rtcore-ntuser-window-l1-1-0
GetPropW
api-ms-win-core-atoms-l1-1-0
GlobalGetAtomNameW
ntdll
RtlAllocateHeap
RtlNtStatusToDosErrorNoTeb
RtlFreeHeap
RtlCompareUnicodeString
RtlInitUnicodeString
NtQueryInformationToken
api-ms-win-crt-private-l1-1-0
memcpy
wcschr
__std_terminate
memcmp
__CxxFrameHandler4
_CxxThrowException
__C_specific_handler
memmove
__CxxFrameHandler3
_o___std_exception_copy
_o___std_exception_destroy
_o___std_type_info_destroy_list
_o___stdio_common_vsprintf
_o___stdio_common_vswprintf
_o__beginthreadex
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o_abort
_o_free
_o_iswspace
_o_malloc
_o_memcpy_s
_o_roundf
_o_strtoul
_o_terminate
_o_wcstoul
api-ms-win-crt-string-l1-1-0
strncmp
strcmp
memset
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
msvcp_win
?_Xout_of_range@std@@YAXPEBD@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
_Cnd_do_broadcast_at_thread_exit
?__ExceptionPtrDestroy@@YAXPEAX@Z
?_Xlength_error@std@@YAXPEBD@Z
_Thrd_yield
?_Xbad_function_call@std@@YAXXZ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
_Thrd_detach
?_Throw_Cpp_error@std@@YAXH@Z
_Thrd_id
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-interlocked-l1-1-0
InterlockedPushEntrySList
InitializeSListHead
InterlockedFlushSList
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
api-ms-win-core-com-l1-1-1
RoGetAgileReference
DllCanUnloadNow
DllGetActivationFactory
UXFrameMain
UXFramePrecreate
Name
.text
Size
401KB
Virtual Size
400KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
98KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=7, id=259, version=33145,
count=30, id=261, version=33145,
count=10, id=257, version=33145,
count=109, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1343, id=1, productName=Unmarked objects,
count=1, id=253, version=33145,
count=14, id=265, version=33145,
count=1, id=256, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
UXInit.dll
- IMPHASH 43840bcaaa52abd100f4cebe3dbd78bd
- SHA256 fdaf121aa7ac7b77d07795a603f6c5fedf57c3188bb9db4e0833c544b6d0563b
- MD5 a97e62c75d59d11c54e2dc2e40b88c10
- SHA1 d56e810d190c17f13e4d4e3e6beec2a274d661ec
- SHA512 b2fe36806e948287c06bb8fc5aedd706e623867eadd2fcdecac24c64e92dc99efedb6ec749ee9429755d7c30129f3099a4c935436546c2685b9b4a2956ba3343
- SSDEEP 3072:rk8mfEAgG+vxdGnKhVhPJBdLtqf3pY1cBOi/Y1uav:Y7JZ+VhVhRBxwf32SY1u
- TLSH T1CEF34A2E72FA20A5D57A91BC82864215F673743123016BEF06D0C2B99F17ADC7E3AF51
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
74640
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
UXInit.pdb
msvcrt
memcmp
_vsnwprintf
swprintf_s
wcsrchr
wcsncmp
memmove
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
memmove_s
_purecall
memcpy_s
memcpy
rand_s
wcschr
_wcsicmp
memset
api-ms-win-core-libraryloader-l1-2-0
LoadResource
FindResourceExW
GetProcAddress
LockResource
FreeLibrary
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameA
SizeofResource
GetModuleHandleExW
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionEx
CreateSemaphoreExW
ReleaseSRWLockShared
AcquireSRWLockShared
CreateEventW
CreateMutexExW
InitializeCriticalSection
AcquireSRWLockExclusive
WaitForSingleObject
ResetEvent
ReleaseSRWLockExclusive
EnterCriticalSection
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseSemaphore
DeleteCriticalSection
ReleaseMutex
LeaveCriticalSection
api-ms-win-core-heap-l1-1-0
HeapReAlloc
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
SetLastError
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
OpenProcessToken
SetThreadToken
GetCurrentThreadId
GetCurrentThread
TerminateProcess
GetCurrentProcessId
OpenThreadToken
ExitThread
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
SetThreadpoolTimer
CloseThreadpoolTimer
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventUnregister
EventSetInformation
EventWriteTransfer
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-memory-l1-1-0
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
api-ms-win-core-threadpool-private-l1-1-0
RegisterWaitForSingleObjectEx
api-ms-win-core-kernel32-legacy-l1-1-0
UnregisterWait
RegisterWaitForSingleObject
api-ms-win-core-threadpool-legacy-l1-1-0
UnregisterWaitEx
ntdll
RtlGetCompressionWorkSpaceSize
RtlUnhandledExceptionFilter
NtCreateSection
NtOpenSection
RtlCompressBuffer
NtAlpcConnectPort
RtlDeleteCriticalSection
RtlInitializeCriticalSection
NtClose
NtSetInformationThread
NtDuplicateToken
RtlImageNtHeader
NtQuerySystemInformation
RtlNtStatusToDosError
NtCreateEvent
RtlInitUnicodeString
NtAlpcSendWaitReceivePort
EtwEventRegister
EtwEventUnregister
RtlDecompressBufferEx
user32
ord2711
GetDpiForMonitorInternal
EnumDisplayMonitors
CloseDesktop
SetThreadDesktop
OpenInputDesktop
GetThreadDesktop
GetDpiForSystem
EnumDisplayDevicesW
EnumDisplaySettingsW
DisplayConfigGetDeviceInfo
SystemParametersInfoW
GetSystemMetrics
GetWindowDC
RegisterDManipHook
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-file-l1-1-0
GetFinalPathNameByHandleW
SetFilePointer
CreateFileW
GetFileSize
WriteFile
ReadFile
api-ms-win-core-string-l1-1-0
CompareStringW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegEnumValueW
RegOpenCurrentUser
RegQueryValueExW
RegSetValueExW
api-ms-win-core-com-l1-1-0
StringFromGUID2
CoCreateGuid
api-ms-win-core-path-l1-1-0
PathCchRemoveFileSpec
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
api-ms-win-core-string-obsolete-l1-1-0
lstrlenW
lstrcmpiW
api-ms-win-core-localization-obsolete-l1-2-0
GetUserDefaultUILanguage
gdi32
ClearBitmapAttributes
SetBitmapAttributes
CreateDIBSection
CreateSessionMappedDIBSection
DeleteObject
ThemeUserLogoff
ThemeUserLogon
ThemeUserStartShell
ThemeUserTSReconnect
ThemeWatchForStart
ThemesOnCreateSession
ThemesOnDisconnect
ThemesOnEarlyCreateSession
ThemesOnLogoff
ThemesOnLogon
ThemesOnReconnect
ThemesOnTerminateSession
Name
.text
Size
100KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
392B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
324B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=62, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33145,
count=5, id=259, version=33145,
count=239, id=1, productName=Unmarked objects,
count=9, id=257, version=33145,
count=1, id=256, version=33145,
count=37, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
UserLanguageProfileCallback.dll
- IMPHASH a62787ab1cf69953396277530396c2f3
- SHA256 29bc35f68deedd693383212163f76aa8a8e2ca755d38827f403effad82b56c4f
- MD5 37205156587246eb32c9d5d1dae36f00
- SHA1 c78122f91de791dd7ca8293aff50cfb1d3a5b58c
- SHA512 aeb7299a8516ee3107812d9018ad184fc5cce93968823f0d59244757591b3f99eb5adec520348d0cdaf24b838b25a08c3f959702389f6c3936bb94a3d053b38e
- SSDEEP 3072:5kx5oe25bnqYjSsAaWCIRxT6V+pCbWQWKs5YZl:G5x8bqY2sAaWCIRxTWwnnKs5Y
- TLSH T151A32A2E716C20AAE572907D86530A0AD3717076631267FF03A0C1BD5F67FE52E39BA1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7952
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
UserLanguageProfileCallback.pdb
msvcrt
free
_initterm
_XcptFilter
memmove
memcpy
__C_specific_handler
?terminate@@YAXXZ
_lock
_CxxThrowException
_unlock
_onexit
__dllonexit
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
memcmp
??0exception@@QEAA@AEBQEBD@Z
_callnewh
malloc
__CxxFrameHandler4
memmove_s
??1type_info@@UEAA@XZ
__CxxFrameHandler3
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
_purecall
??3@YAXPEAX@Z
memcpy_s
_vsnwprintf
_amsg_exit
memset
api-ms-win-core-com-l1-1-0
CoCreateInstance
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
CreateSemaphoreExW
EnterCriticalSection
ReleaseMutex
AcquireSRWLockShared
WaitForSingleObject
CreateMutexExW
ReleaseSRWLockExclusive
OpenEventW
CreateEventW
ReleaseSemaphore
AcquireSRWLockExclusive
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
oleaut32
SysFreeString
VariantClear
SysAllocString
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetProcAddress
GetModuleHandleExW
GetModuleHandleW
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
Sleep
InitOnceComplete
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsDeleteString
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-winrt-l1-1-0
RoUninitialize
RoInitialize
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-security-capability-l1-1-0
CapabilityCheck
bcp47langs
GetSerializedUserLanguageProfile
GetUserLanguagesForUser
GetUserLanguages
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
OnUserProfileChanged
Name
.text
Size
52KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
604B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=46, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=15, id=260, version=33145,
count=5, id=259, version=33145,
count=105, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=8, id=261, version=33145,
count=1, id=256, version=33145,
count=6, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
UserMgrProxy.dll
- IMPHASH f0ef1cec8e4f0c7f5e3697407528e4e0
- SHA256 0e29f22f8ae751b7cc69e2aa9624153466137dfda25147b672c0e3aca5295236
- MD5 00854d2f28d07007c361a66e9fca2511
- SHA1 0a7f70dbdceb959ac7e1653317e087c970c89280
- SHA512 80bb10044b6859e47cbb69a3e06b6040f82ce71f95f2cb9a59d6ffec329edf020aa423dd882321b1eb306fff2e2c8583789be0e204eeb521d1d4cdb9e7a59b1b
- SSDEEP 6144:fN0z7c6UzUIL12splQppxZs+FVJhWWxdW2zeu5k+dWY1rsXdL0Q:fqzHUzU4IpxZlJgtuNsNw
- TLSH T1BE94071EFA9840A6D97AE27CC1774606E3B23C145752D3CB2224613D9E3BFD49E39B60
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
113360
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
UserMgrProxy.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__get_errno
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
memmove
_o__wtol
_o_atoi
_o_free
_o_malloc
_o_terminate
__C_specific_handler
__CxxFrameHandler3
__current_exception
__current_exception_context
_CxxThrowException
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o__crt_atexit
_o__configure_narrow_argv
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
strstr
strchr
wcschr
_o__cexit
_o__callnewh
_o__execute_onexit_table
_o__errno
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
ntdll
RtlQueryInformationAcl
RtlGetDaclSecurityDescriptor
RtlFreeHeap
RtlEqualSid
RtlLengthSid
RtlAllocateHeap
RtlCreateAcl
RtlIsMultiSessionSku
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlSetDaclSecurityDescriptor
RtlGetAce
RtlAddAccessAllowedAce
NtQuerySecurityObject
RtlInitUnicodeString
RtlCreateSecurityDescriptor
RtlAddAce
NtSetSecurityObject
RtlCapabilityCheck
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
LoadLibraryExW
GetProcAddress
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleW
DisableThreadLibraryCalls
LoadLibraryExA
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceExecuteOnce
InitOnceComplete
api-ms-win-core-synch-l1-1-0
SetEvent
ResetEvent
EnterCriticalSection
LeaveCriticalSection
CreateSemaphoreExW
ReleaseMutex
InitializeCriticalSectionEx
CreateEventW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
ReleaseSRWLockExclusive
CreateEventExW
WaitForSingleObject
InitializeSRWLock
AcquireSRWLockShared
CreateMutexExW
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSemaphore
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
RaiseException
GetLastError
SetLastError
SetUnhandledExceptionFilter
api-ms-win-core-winrt-string-l1-1-0
HSTRING_UserSize64
HSTRING_UserFree64
HSTRING_UserMarshal
HSTRING_UserSize
HSTRING_UserUnmarshal
HSTRING_UserUnmarshal64
WindowsCreateString
WindowsDuplicateString
WindowsGetStringRawBuffer
HSTRING_UserFree
WindowsDeleteString
WindowsCreateStringReference
HSTRING_UserMarshal64
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsCompareStringOrdinal
api-ms-win-core-com-l1-1-0
CoRevertToSelf
CoTaskMemAlloc
CoCopyProxy
CoReleaseMarshalData
CoGetStandardMarshal
CoCreateInstance
CoImpersonateClient
CoSetProxyBlanket
CoWaitForMultipleHandles
CoSwitchCallContext
CoTaskMemFree
CoCreateFreeThreadedMarshaler
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
OpenProcessToken
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetCurrentProcess
OpenThreadToken
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
RoOriginateErrorW
RoOriginateError
SetRestrictedErrorInfo
GetRestrictedErrorInfo
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringOrdinal
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
GetSystemTime
GetSystemInfo
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
OpenProcess
IsProcessorFeaturePresent
crypt32
CryptStringToBinaryA
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegOpenCurrentUser
RegCloseKey
api-ms-win-security-base-l1-1-0
CreateWellKnownSid
RevertToSelf
ImpersonateLoggedOnUser
GetAce
EqualSid
GetTokenInformation
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventUnregister
EventActivityIdControl
EventRegister
EventWriteTransfer
api-ms-win-core-localization-l1-2-3
GetUserDefaultGeoName
api-ms-win-core-winrt-l1-1-0
RoUninitialize
RoGetActivationFactory
RoInitialize
RoActivateInstance
api-ms-win-core-winrt-error-l1-1-1
RoReportFailedDelegate
IsErrorPropagationEnabled
RoGetMatchingRestrictedErrorInfo
api-ms-win-core-threadpool-legacy-l1-1-0
QueueUserWorkItem
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-heap-l2-1-0
LocalFree
LocalReAlloc
LocalAlloc
api-ms-win-security-base-l1-2-0
CheckTokenMembershipEx
api-ms-win-core-memory-l1-1-0
VirtualQuery
VirtualProtect
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
combase
ord148
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
216KB
Virtual Size
213KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
164KB
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
384B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=77, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33145,
count=5, id=259, version=33145,
count=1293, id=1, productName=Unmarked objects,
count=8, id=257, version=33145,
count=27, id=261, version=33145,
count=1, id=256, version=33145,
count=30, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
UvcModel.dll
- IMPHASH fdd0ce580ada5cafb1b2a127b26f9d7a
- SHA256 fb00b161c3bb08d11215af54e90b4087fb5041490cba135334a0fb5c234c2619
- MD5 bdb864b575cecbc260c70074ce805594
- SHA1 6fabd0003f8e3e3595600c4f17bb9d7c0bd9df58
- SHA512 3498d49dd7c8d2453b76a42f398350adcff03cefca2911b749c796d7045b610a71698267fda35dec4597785164393003c35c7b42f93618b95542d2f6d6fe5050
- SSDEEP 3072:YMms9a9eMh88jHhcY78EAHc+ZQM7XSFIv4WB0SaLjJImU78ftF2D9uGc:nK9eMh8eBhA8+ZQM7Qdli8fX28
- TLSH T10104195B26AA01B6E176913CC9C34E09E2B37866972297CF0264437E5F13FE89D3D760
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7584
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
UvcModel.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_abort
_o_free
_o_iswspace
_o_malloc
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
_o__cexit
_o__callnewh
_CxxThrowException
_o___stdio_common_vswprintf
_o__configure_narrow_argv
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__CxxFrameHandler3
__std_terminate
__CxxFrameHandler4
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
FreeLibrary
GetModuleHandleExW
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseMutex
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
WaitForSingleObjectEx
OpenSemaphoreW
InitializeSRWLock
ReleaseSRWLockShared
AcquireSRWLockShared
CreateMutexExW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
RaiseException
SetLastError
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
RoFailFastWithErrorContext
SetRestrictedErrorInfo
RoOriginateErrorW
GetRestrictedErrorInfo
RoOriginateError
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventWriteTransfer
EventRegister
EventSetInformation
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
InitOnceExecuteOnce
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-winrt-string-l1-1-0
WindowsDuplicateString
WindowsCreateStringReference
WindowsCompareStringOrdinal
WindowsDeleteString
WindowsCreateString
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InterlockedFlushSList
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoGetApartmentType
CoTaskMemFree
CoCreateInstance
PropVariantClear
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
RoOriginateLanguageException
IsErrorPropagationEnabled
RoReportFailedDelegate
api-ms-win-core-string-l2-1-1
SHLoadIndirectString
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_frequency
_Query_perf_counter
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetActivationFactory
Name
.text
Size
108KB
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
992B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=59, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=1168, id=1, productName=Unmarked objects,
count=2, id=257, version=33145,
count=28, id=261, version=33145,
count=1, id=256, version=33145,
count=1, id=253, version=33145,
count=12, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
VCardParser.dll
- IMPHASH e74ce249e56083ad62fcdf6a9ee82995
- SHA256 535dbef453d34feec3d6bcc2ea1f20076efa01a956157ce7d95cd9324b1a7190
- MD5 9ee20d607ecf7f6381efc7c450a1c66d
- SHA1 a2036c00554c0a33424fb48cd97c113dbd872ca9
- SHA512 466db4d0bce1793a3578aa6ea82abdadfc1b79f7b3bfb5977d81c991b63f4f5e21137a1000cd3ed0b118cb96a4b8863eef2257acf33a8633c6860b933e91eba0
- SSDEEP 3072:3N/35gy7fwAf2hdgvt6Wa7m6ZQR8jJUSinac9veuUYMCjEmytXzUT:9/3j7f7Igvt686yySnac9eDYTQmyNz
- TLSH T176145B597AE011FADDA6933CC2C7461EE2B97702333116DF03D282B85E5BBE1A17A714
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5024
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
VCardParser.pdb
msvcrt
_amsg_exit
_initterm
_callnewh
memmove
realloc
malloc
_XcptFilter
__CxxFrameHandler3
wcsstr
_wcslwr_s
_lock
_unlock
__dllonexit
__C_specific_handler
_onexit
iswdigit
_wcsnset_s
_wtoi
wcstok_s
wcstoul
memcpy_s
_wcsnicmp
_ultoa_s
isdigit
_memicmp
atoi
strcspn
_strdup
_strupr_s
free
_wcsdup
strncmp
strncpy_s
_vsnwprintf_s
_vscwprintf
_vsnwprintf
_vsnprintf
_itoa_s
_stricmp
_vsnprintf_s
_vscprintf
_purecall
strstr
_wcsicmp
_strnicmp
strtol
memchr
memcpy
memset
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventRegister
EventWriteTransfer
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
InitializeCriticalSection
api-ms-win-core-errorhandling-l1-1-0
GetLastError
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
CompareStringW
api-ms-win-core-heap-l2-1-0
GlobalFree
GlobalAlloc
LocalAlloc
LocalFree
api-ms-win-core-localization-l1-2-0
IsDBCSLeadByteEx
api-ms-win-core-heap-l1-1-0
GetProcessHeap
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
EnumDynamicTimeZoneInformation
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
GetSystemTime
api-ms-win-core-file-l1-2-3
GetTempPath2W
api-ms-win-core-heap-obsolete-l1-1-0
GlobalUnlock
GlobalLock
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
pimstore
POutlookAppManager_CreateInstance
userdatatypehelperutil
ReplaceChar
DupString
EcGlobalObjIdToUid
CreateWrapFileNameStm
CreateWrapFileStm
ReadStreamContentA
SafeLPWSTR
EcUidToGlobalObjId
userdataplatformhelperutil
GetTempFileNameWithExt
ResizeImageBySizeToStream
ConvertHtmlStringToPlainTextStringOneCore
phoneutil
ValidPhoneNumberInplaceStripInvalidCharacters
userdatalanguageutil
UninitializeLanguageUtil
InitializeLanguageUtil
GetWideSz
ConvertToMultiByte
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
CreateCardParser
CreateCardParserEx
CreateCardParserExA
CreateICalGen
CreateVCardGen
EncodeQP
Name
.text
Size
140KB
Virtual Size
139KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
200B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=50, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=4, id=259, version=33145,
count=15, id=260, version=33145,
count=146, id=1, productName=Unmarked objects,
count=13, id=257, version=33145,
count=8, id=261, version=33145,
count=1, id=256, version=33145,
count=24, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
VIDRESZR.DLL
- IMPHASH 33e2a23a810a071fedc6efa550a94705
- SHA256 05d92be636dae1f6564c29d60388ac1031c41c6c83ef5c81a26ef72877408df2
- MD5 a30b9edb97b9af2cfb60ad765db7e882
- SHA1 503fcfb470e7a4c74db071d61040cbe3d0bba0dd
- SHA512 e724bb300e4a63e513e91f75813c4c806b4a1467f391becf662ad998fd9c3d9209871f911085783ff85f5377d38ea972a0375f8204d8c28b0993e85e161ba5d6
- SSDEEP 3072:tEXE/z2iLjBTzGZ4/Ctcc6GWKiay1lIYUcAKLoiBaQJHsEigIetyCfFrc2Cx6M:CEz32KLoE3PIUyCfFrQ1
- TLSH T1DB047C5EB2BA20D5D922A03C86970656FA72B479130027FF16E0C67D5F23BDCAE35724
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
aa:ce:42:01:65:ee:b3:6e:b2:37:72:5b:79:82:86:74:e0:f3:4d:d5:9d:77:69:1d:5a:31:26:54:42:56:a4:05
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A400-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:28:f0:a5:87:d7:f3:c8:1e:40:00:01:00:00:02:28
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
7216
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
VIDRESZR.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
perror
api-ms-win-crt-private-l1-1-0
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memcpy
_o_free
_o_malloc
__C_specific_handler
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
memcmp
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetModuleHandleW
GetModuleFileNameA
LoadLibraryExA
GetProcAddress
api-ms-win-core-featurestaging-l1-1-0
GetFeatureEnabledState
SubscribeFeatureStateChangeNotification
RecordFeatureUsage
UnsubscribeFeatureStateChangeNotification
api-ms-win-core-synch-l1-1-0
OpenSemaphoreW
EnterCriticalSection
ReleaseSemaphore
LeaveCriticalSection
CreateEventW
SetEvent
InitializeCriticalSection
DeleteCriticalSection
CreateMutexExW
WaitForSingleObject
ReleaseMutex
CreateSemaphoreExW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
GetLastError
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetThreadPriority
CreateThread
TerminateProcess
SetThreadPriority
GetCurrentProcessId
GetCurrentThread
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventUnregister
EventWriteTransfer
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemInfo
GetTickCount
api-ms-win-core-registry-l1-1-0
RegSetValueExA
RegDeleteTreeW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
api-ms-win-core-registry-l2-1-0
RegCreateKeyW
RegSetValueA
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
oleaut32
SysFreeString
SysAllocString
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoTaskMemFree
PropVariantClear
mfplat
MFTRegister
MFTUnregister
msdmo
DMORegister
MoCopyMediaType
MoFreeMediaType
MoInitMediaType
DMOUnregister
mfperfhelper
ord1
ord66
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
CreateInstance
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
108KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
760B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=33145,
count=55, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1168, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=17, id=260, version=33145,
count=5, id=259, version=33145,
count=20, id=261, version=33145,
count=1, id=256, version=33145,
count=12, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
VPNv2CSP.dll
- IMPHASH cfd82621ae174e89a3f6731076e0b541
- SHA256 c96d32ae9bbc12a0b91ba866ccd31d2380167e6cae1ccce720151a3e19960771
- MD5 5ffd8530022c658d978b21cea5ffe1b8
- SHA1 d9969c8b06ee87a4cbd2389232ad32ae366de744
- SHA512 c692e62d81e2a98feb536692660e0abdb8474aaba203b80f3fbee7272c2b361f808252b9558cd29ac2ea24039b4ee52df0b0efd98fe76a59913ceadd990856fa
- SSDEEP 6144:DaRkY4C0n39dPGhqN6z0g2RSKAgkKUk8QkvNQbJxI:xU0n39tGhjzT2RSKzFEYo
- TLSH T198543A1EA2EC1DB9E5B6827C8587471AE3B178550B22C6CF01A181365F23FE49F39F46
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
10080
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
VPNv2CSP.pdb
msvcp_win
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
?good@ios_base@std@@QEBA_NXZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA_N_N@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??Bid@locale@std@@QEAA_KXZ
?id@?$ctype@G@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?widen@?$ctype@G@std@@QEBAGD@Z
?_Xbad_alloc@std@@YAXXZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ
??1?$basic_istream@GU?$char_traits@G@std@@@std@@UEAA@XZ
??Bios_base@std@@QEBA_NXZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?uncaught_exception@std@@YA_NXZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
api-ms-win-crt-string-l1-1-0
memmove_s
memset
wcsncmp
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o_abort
_o_free
_o_iswspace
_o_malloc
_o_memcpy_s
_o_wcstol
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
_o__crt_atexit
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
GetModuleHandleExW
GetModuleHandleExA
DisableThreadLibraryCalls
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameA
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceLoggerHandle
GetTraceEnableLevel
RegisterTraceGuidsW
TraceMessage
GetTraceEnableFlags
UnregisterTraceGuids
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventUnregister
EventWriteTransfer
EventActivityIdControl
EventRegister
oleaut32
SysStringLen
GetErrorInfo
VariantClear
SetErrorInfo
SysAllocString
SysFreeString
VariantChangeType
VariantCopy
VariantInit
api-ms-win-core-errorhandling-l1-1-0
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstanceEx
CoCreateFreeThreadedMarshaler
ntdll
RtlIsStateSeparationEnabled
RtlIpv4AddressToStringExW
RtlIpv6AddressToStringExW
RtlIpv4StringToAddressW
RtlIpv6StringToAddressW
RtlFreeSid
EtwTraceMessage
api-ms-win-appmodel-runtime-l1-1-1
VerifyPackageFamilyName
api-ms-win-appmodel-identity-l1-2-0
AppContainerDeriveSidFromMoniker
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
GetLocalTime
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedPushEntrySList
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
firewallapi
FwStringToPorts
FWFreeFirewallRules
FwStringToAddresses
FwGetAddressesAsString
rasapi32
RasDeleteEntryW
IsActiveAutoTriggerConnectionEx
RasSetAutoTriggerProfileEx
DoesProtocolListInfoContain
RasSetEntryAdvancedProperties
RasGetPbkPath
RasSetCustomAuthDataW
RasSetCredentialsW
RasSetEntryPropertiesW
RasMobileCore
IsProtocolListInfoValid
RasFreeEntryAdvancedProperties
RasGetEntryPropertiesW
RasGetEntryAdvancedProperties
RasGetCustomAuthDataW
RasGetCredentialsW
RasValidateEntryNameW
RasEnumEntriesW
rpcrt4
RpcStringBindingComposeW
RpcBindingSetAuthInfoExW
RpcBindingSetOption
NdrClientCall3
RpcBindingFree
RpcStringFreeW
RpcBindingFromStringBindingW
api-ms-win-security-base-l1-1-0
CreateWellKnownSid
api-ms-win-security-lsalookup-l1-1-0
LookupAccountSidLocalW
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockExclusive
OpenSemaphoreW
ReleaseMutex
AcquireSRWLockShared
CreateMutexExW
ReleaseSemaphore
CreateSemaphoreExW
WaitForSingleObjectEx
ReleaseSRWLockShared
InitializeCriticalSectionEx
EnterCriticalSection
LeaveCriticalSection
AcquireSRWLockExclusive
DeleteCriticalSection
WaitForSingleObject
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
eappcfg
EapHostPeerConfigBlob2Xml
EapHostPeerCreateMethodConfiguration
EapHostPeerConfigXml2Blob
EapHostPeerFreeErrorMemory
EapHostPeerFreeMemory
EapHostPeerGetMethods
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
188KB
Virtual Size
185KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
992B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=92, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=11, id=260, version=33145,
count=5, id=259, version=33145,
count=1349, id=1, productName=Unmarked objects,
count=9, id=257, version=33145,
count=24, id=261, version=33145,
count=1, id=256, version=33145,
count=24, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
Vault.dll
- IMPHASH 5b1bc849013ea159ca1bf4eabb91287a
- SHA256 d553c4f4f63da82b231985bfa136d328e4c8dcc35988e89b12820e8f4795ae91
- MD5 94ac1b6c15cfa1a691800a157c37a46c
- SHA1 b4eded3d42207be5216bf47c42bf4e3fe00f00c9
- SHA512 61d8b8ab1be2b52391264e6e9344f5f3c7fca05ba5188763eac083399aac2a37d3ea0b6564c175f0c9f22f59ac5bfdf20b6b33272a41a4625a5980d0590cb72b
- SSDEEP 6144:tA8gBUWsVKCJ+Bl8qGk/FZzgIlbMGYf/MK6l:ynCJ+BlRxMbfel
- TLSH T11F64282EB2A80876F1B7827C95838E09E3B274694722C7CF11B1027EBE17BD49D35E15
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
8080
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vault.pdb
msvcrt
wcscpy_s
__RTDynamicCast
memset
memcmp
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
free
_amsg_exit
_XcptFilter
memmove
memcpy
__CxxFrameHandler3
_CxxThrowException
??0exception@@QEAA@AEBQEBD@Z
_callnewh
malloc
_vsnwprintf_s
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBV0@@Z
_vsnwprintf
memcpy_s
memmove_s
tolower
?terminate@@YAXXZ
_purecall
__CxxFrameHandler4
??3@YAXPEAX@Z
shell32
SHBindToObject
ord25
ord18
ord155
ShellExecuteExW
SHParseDisplayName
shlwapi
ord514
ord24
ord156
ord174
ord199
ord158
ord204
SHStrDupW
ord256
ord618
ord219
ord176
ord172
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
TraceMessage
UnregisterTraceGuids
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
GetSystemTime
GetSystemDirectoryW
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
LoadStringW
GetModuleHandleW
GetProcAddress
GetModuleHandleExW
GetModuleFileNameA
LoadLibraryExW
GetModuleFileNameW
crypt32
CertFindCertificateInStore
CertGetEnhancedKeyUsage
CertFreeCertificateContext
CertGetNameStringW
CertGetCertificateContextProperty
CertOpenSystemStoreW
CertCloseStore
CertAddSerializedElementToStore
CertFreeCertificateChainList
CertSelectCertificateChains
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoCreateInstance
api-ms-win-security-credentials-l1-1-0
CredEnumerateW
CredFree
CredWriteW
CredDeleteW
CredUnmarshalCredentialW
CredMarshalCredentialW
CredGetSessionTypes
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
OpenThreadToken
GetCurrentProcessId
CreateProcessW
GetCurrentThreadId
OpenProcessToken
GetCurrentThread
GetCurrentProcess
api-ms-win-core-handle-l1-1-0
CloseHandle
oleaut32
SysAllocString
SysFreeString
VariantClear
api-ms-win-security-base-l1-1-0
CopySid
InitializeSid
GetSidSubAuthorityCount
GetTokenInformation
GetSidSubAuthority
EqualSid
GetLengthSid
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
AcquireSRWLockExclusive
AcquireSRWLockShared
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx
InitializeCriticalSectionEx
WaitForSingleObject
OpenSemaphoreW
CreateMutexExW
CreateSemaphoreExW
InitializeCriticalSection
ReleaseSRWLockShared
ReleaseSRWLockExclusive
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringOrdinal
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
api-ms-win-core-datetime-l1-1-0
GetDateFormatW
api-ms-win-core-file-l1-1-0
CompareFileTime
FileTimeToLocalFileTime
rpcrt4
UuidToStringW
RpcStringFreeW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
sspicli
LsaFreeReturnBuffer
LsaConnectUntrusted
LsaDeregisterLogonProcess
LsaLookupAuthenticationPackage
LsaLogonUser
userenv
ord211
vaultcli
VaultEnumerateVaults
VaultGetItemType
VaultAddItem
VaultGetItem
VaultRemoveItem
VaultFree
VaultCloseVault
VaultOpenVault
VaultGetInformation
VaultEnumerateItems
credui
CredUnPackAuthenticationBufferW
CredUIPromptForWindowsCredentialsW
cryptui
CertSelectionGetSerializedBlob
kernel32
LocalSize
ActivateActCtx
DeactivateActCtx
CreateActCtxW
ReleaseActCtx
ntdll
EtwLogTraceEvent
EtwEventWriteTransfer
EtwEventRegister
EtwEventUnregister
WinSqmAddToStream
NtAllocateLocallyUniqueId
RtlInitString
EtwEventSetInformation
RtlSubAuthoritySid
RtlInitializeSid
RtlNtStatusToDosError
EtwTraceMessage
user32
LoadImageW
SetCursor
LoadCursorW
GetFocus
DestroyIcon
dui70
?FindElementWithShortcutAndDoDefaultAction@XProvider@DirectUI@@UEAAHGH@Z
?CanSetFocus@XProvider@DirectUI@@UEAAJPEA_N@Z
?Navigate@XProvider@DirectUI@@UEAAJHPEA_N@Z
?SetFocus@XProvider@DirectUI@@UEAAJPEAVElement@2@@Z
?IsDescendent@XProvider@DirectUI@@UEAAJPEAVElement@2@PEA_N@Z
?GetDesiredSize@XProvider@DirectUI@@UEAAJHHPEAUtagSIZE@@@Z
?SetParameter@XProvider@DirectUI@@UEAAJAEBU_GUID@@PEAX@Z
?AddRef@XProvider@DirectUI@@UEAAKXZ
?GetClassInfoPtr@HWNDElement@DirectUI@@SAPEAUIClassInfo@2@XZ
?SetDefaultButtonTracking@XProvider@DirectUI@@UEAAJ_N@Z
?SetHandleEnterKey@XProvider@DirectUI@@IEAAX_N@Z
?CreateDUI@XProvider@DirectUI@@UEAAJPEAVIXElementCP@2@PEAPEAUHWND__@@@Z
?GetRoot@XProvider@DirectUI@@IEAAPEAVElement@2@XZ
?Initialize@XProvider@DirectUI@@QEAAJPEAVElement@2@PEAVIXProviderCP@2@@Z
??0Proxy@DirectUI@@QEAA@XZ
??0Element@DirectUI@@QEAA@XZ
?Initialize@ClassInfoBase@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG_NPEBQEBUPropertyInfo@2@I@Z
?Register@ClassInfoBase@DirectUI@@QEAAJXZ
?ClassExist@ClassInfoBase@DirectUI@@SA_NPEAPEAUIClassInfo@2@PEBQEBUPropertyInfo@2@IPEAU32@PEAUHINSTANCE__@@PEBG_N@Z
??1CritSecLock@DirectUI@@QEAA@XZ
?GetFactoryLock@Element@DirectUI@@SAPEAU_RTL_CRITICAL_SECTION@@XZ
??0CritSecLock@DirectUI@@QEAA@PEAU_RTL_CRITICAL_SECTION@@@Z
?Destroy@Element@DirectUI@@QEAAJ_N@Z
?Initialize@Element@DirectUI@@QEAAJIPEAV12@PEAK@Z
??1Proxy@DirectUI@@UEAA@XZ
?IsRTLReading@Element@DirectUI@@UEAA_NXZ
?IsContentProtected@Element@DirectUI@@UEAA_NXZ
?GetContentStringAsDisplayed@Element@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanged@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanged@Element@DirectUI@@UEAAXPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnGroupChanged@Element@DirectUI@@UEAAXH_N@Z
?OnInput@Element@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?OnKeyFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?OnMouseFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?OnDestroy@Element@DirectUI@@UEAAXXZ
?OnEvent@Element@DirectUI@@UEAAXPEAUEvent@2@@Z
?Paint@Element@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z
?Create@XResourceProvider@DirectUI@@SAJPEAUHINSTANCE__@@PEBG11PEAPEAV12@@Z
?QueryInterface@XProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?GetContentSize@Element@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?Add@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?Insert@Element@DirectUI@@UEAAJPEAPEAV12@II@Z
?Remove@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?GetHostedElementID@XProvider@DirectUI@@UEAAJPEAG@Z
?GetAdjacent@Element@DirectUI@@UEAAPEAV12@PEAV12@HPEBUNavReference@2@K@Z
??1XProvider@DirectUI@@UEAA@XZ
?ForceThemeChange@XProvider@DirectUI@@UEAAJ_K_J@Z
?EnsureVisible@Element@DirectUI@@UEAA_NHHHH@Z
?ClickDefaultButton@XProvider@DirectUI@@UEAAHXZ
?SetRegisteredDefaultButton@XProvider@DirectUI@@UEAAJPEAVElement@2@@Z
?SetButtonClassAcceptsEnterKey@XProvider@DirectUI@@UEAAJ_N@Z
?CreateXBaby@XProvider@DirectUI@@UEAAJPEAVIXElementCP@2@PEAUHWND__@@PEAVElement@2@PEAKPEAPEAUIXBaby@2@@Z
??0XProvider@DirectUI@@QEAA@XZ
?GetAtomZero@Value@DirectUI@@SAPEAV12@XZ
?GetUnset@Value@DirectUI@@SAPEAV12@XZ
?GetStringNull@Value@DirectUI@@SAPEAV12@XZ
?Init@NavReference@DirectUI@@QEAAXPEAVElement@2@PEAUtagRECT@@@Z
?GetAtom@Value@DirectUI@@QEAAGXZ
?SetKeyFocus@Element@DirectUI@@UEAAXXZ
?AddBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
?RemoveBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
?MessageCallback@Element@DirectUI@@UEAAIPEAUtagGMSG@@@Z
?GetValue@Element@DirectUI@@QEAAPEAVValue@2@PEBUPropertyInfo@2@HPEAUUpdateCache@2@@Z
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UEAAXPEAUtagRECT@@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MEAAXHH@Z
UnInitThread
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
UnInitProcessPriv
InitThread
InitProcessPriv
?OnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
?OnUnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
?UpdateTooltip@Element@DirectUI@@MEAAXPEAV12@@Z
?Click@Button@DirectUI@@SA?AVUID@@XZ
?ActivateTooltip@Element@DirectUI@@MEAAXPEAV12@K@Z
?RemoveTooltip@Element@DirectUI@@MEAAXPEAV12@@Z
?GetKeyFocused@Element@DirectUI@@UEAA_NXZ
?GetAccessibleImpl@Element@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
?DefaultAction@Element@DirectUI@@UEAAJXZ
?GetUIAElementProvider@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?GetElementProviderImpl@Element@DirectUI@@UEAAJPEAVInvokeHelper@2@PEAPEAVElementProvider@2@@Z
?GetClassInfoPtr@Element@DirectUI@@SAPEAUIClassInfo@2@XZ
?Register@Element@DirectUI@@SAJXZ
?GetString@Value@DirectUI@@QEAAPEBGXZ
?HandleUiaDestroyListener@Element@DirectUI@@UEAAXXZ
?HandleUiaPropertyListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@@Z
?HandleUiaEventListener@Element@DirectUI@@UEAAXPEAUEvent@2@@Z
?GetUiaFocusDelegate@Element@DirectUI@@UEAAPEAV12@XZ
?GetType@Value@DirectUI@@QEBAHXZ
??1Element@DirectUI@@UEAA@XZ
?SetActive@Element@DirectUI@@QEAAJH@Z
?EraseBkgnd@HWNDHost@DirectUI@@MEAA_NPEAUHDC__@@PEA_J@Z
?CreateHWND@Combobox@DirectUI@@UEAAPEAUHWND__@@PEAU3@@Z
?SetWindowDirection@HWNDHost@DirectUI@@UEAAXPEAUHWND__@@@Z
?GetID@Element@DirectUI@@QEAAGXZ
?OnAdjustWindowSize@Combobox@DirectUI@@UEAAHHHI@Z
?OnWindowStyleChanged@HWNDHost@DirectUI@@UEAAX_KPEBUtagSTYLESTRUCT@@@Z
?OnCtrlThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnSinkThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnSysChar@HWNDHost@DirectUI@@UEAA_NG@Z
?OnMessage@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?GetHWND@HWNDHost@DirectUI@@UEAAPEAUHWND__@@XZ
?GetAccessibleImpl@HWNDHost@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
?GetKeyFocused@HWNDHost@DirectUI@@UEAA_NXZ
?OnUnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z
?OnHosted@Combobox@DirectUI@@UEAAXPEAVElement@2@@Z
?QueryInterface@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?MessageCallback@HWNDHost@DirectUI@@UEAAIPEAUtagGMSG@@@Z
?SetKeyFocus@HWNDHost@DirectUI@@UEAAXXZ
?GetContentSize@Combobox@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?Paint@HWNDHost@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z
?OnEvent@HWNDHost@DirectUI@@UEAAXPEAUEvent@2@@Z
?OnDestroy@HWNDHost@DirectUI@@UEAAXXZ
?OnInput@Combobox@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?OnPropertyChanged@Combobox@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
??1Combobox@DirectUI@@UEAA@XZ
??0Combobox@DirectUI@@QEAA@XZ
?GetClassInfoPtr@Expando@DirectUI@@SAPEAUIClassInfo@2@XZ
?GetExpanded@Expandable@DirectUI@@QEAA_NXZ
?GetParent@Element@DirectUI@@QEAAPEAV12@XZ
GetElementDataEntry
?GetClassInfoPtr@Combobox@DirectUI@@SAPEAUIClassInfo@2@XZ
?GetContentString@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z
?SetAccDesc@Element@DirectUI@@QEAAJPEBG@Z
?Release@Value@DirectUI@@QEAAXXZ
?SetAccName@Element@DirectUI@@QEAAJPEBG@Z
StrToID
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z
?GetChildren@Element@DirectUI@@QEAAPEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@PEAPEAVValue@2@@Z
??1IDataEngine@DirectUI@@UEAA@XZ
??0IDataEngine@DirectUI@@QEAA@XZ
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?GetByClassIndex@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?GetPICount@ClassInfoBase@DirectUI@@UEBAIXZ
?Initialize@Combobox@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z
??0ClassInfoBase@DirectUI@@QEAA@XZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UEBAIXZ
??1ClassInfoBase@DirectUI@@UEAA@XZ
?GetName@ClassInfoBase@DirectUI@@UEBAPEBGXZ
?IsValidProperty@ClassInfoBase@DirectUI@@UEBA_NPEBUPropertyInfo@2@@Z
?Register@Combobox@DirectUI@@SAJXZ
?OnNotify@Combobox@DirectUI@@UEAA_NI_K_JPEA_J@Z
?Release@ClassInfoBase@DirectUI@@UEAAHXZ
?IsSubclassOf@ClassInfoBase@DirectUI@@UEBA_NPEAUIClassInfo@2@@Z
?SetAbsorbsShortcut@Element@DirectUI@@QEAAJ_N@Z
?SetValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@@Z
?ContentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?RemoveLocalValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZ@Z
?GetModule@ClassInfoBase@DirectUI@@UEBAPEAUHINSTANCE__@@XZ
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUHICON__@@_N11@Z
?SetDataEngine@Repeater@DirectUI@@QEAAXPEAUIDataEngine@2@@Z
?IsGlobal@ClassInfoBase@DirectUI@@UEBA_NXZ
?AddChild@ClassInfoBase@DirectUI@@UEAAXXZ
?RemoveChild@ClassInfoBase@DirectUI@@UEAAXXZ
?GetChildren@ClassInfoBase@DirectUI@@UEBAHXZ
?AddRef@ClassInfoBase@DirectUI@@UEAAXXZ
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UEBAXXZ
?AddListener@Element@DirectUI@@QEAAJPEAUIElementListener@2@@Z
??0IDataEntry@DirectUI@@QEAA@XZ
??1IDataEntry@DirectUI@@UEAA@XZ
?SetEncodedContentString@Element@DirectUI@@QEAAJPEBG@Z
?FireEvent@Element@DirectUI@@QEAAXPEAUEvent@2@_N1@Z
?GetEncodedContentString@Element@DirectUI@@QEAAJPEAG_K@Z
?SetContentString@Element@DirectUI@@QEAAJPEBG@Z
?SetEnabled@Element@DirectUI@@QEAAJ_N@Z
?SetLayoutPos@Element@DirectUI@@QEAAJH@Z
?SetVisible@Element@DirectUI@@QEAAJ_N@Z
?SetBorderStyle@Element@DirectUI@@QEAAJH@Z
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
192KB
Virtual Size
191KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
88KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=66, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=20, id=260, version=33145,
count=5, id=259, version=33145,
count=447, id=1, productName=Unmarked objects,
count=21, id=257, version=33145,
count=10, id=261, version=33145,
count=1, id=256, version=33145,
count=59, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
VaultCDS.dll
- IMPHASH 7f91022ba208f24a5817e673d4854562
- SHA256 e04446893dfab819d39276bfad3b257b052b7908847810784a04fdde33033859
- MD5 8b2e0fb8f68d26f8f6fee4736995075a
- SHA1 6282e02547928ac2b0cf40ce3baf315a811a9c92
- SHA512 9d666b6682d0f6a206e09bdc96de9e24493fb68a02ceaff619386e657582e45bfa640b2255cf6c3b764a4a5fe5a10cf66a0ad91b31c46679e9be2ed86739ec5d
- SSDEEP 3072:LrNlYepwNrLCVfSTlRPTsZe/rk+ozkLnaKqa2UrPo9/xwjAbve:llYOw9uVAHoZeYw+3a2UrQxxsAb
- TLSH T1A8F3177D766D10B6E17BE17DCAD24A0AF6B27455431253CF03A002BE1E27FE82D39662
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
9920
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vaultcds.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__callnewh
_o_free
_o_malloc
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
__CxxFrameHandler3
__std_type_info_compare
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
_CxxThrowException
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
GetModuleHandleW
GetModuleFileNameA
GetProcAddress
GetModuleHandleExW
FreeLibrary
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockExclusive
CreateMutexExW
WaitForSingleObjectEx
ReleaseSRWLockShared
LeaveCriticalSection
EnterCriticalSection
ReleaseMutex
DeleteCriticalSection
WaitForSingleObject
InitializeCriticalSectionEx
ReleaseSemaphore
OpenSemaphoreW
CreateSemaphoreExW
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
SetLastError
RaiseException
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringOrdinal
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
TraceMessage
GetTraceEnableLevel
GetTraceEnableFlags
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventActivityIdControl
EventWriteTransfer
EventSetInformation
EventUnregister
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-com-l1-1-0
CoCreateGuid
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
StringFromGUID2
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsDeleteString
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-heap-obsolete-l1-1-0
LocalSize
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
VaultCDSEnumerateItems
VaultCDSSaveItem
Name
.text
Size
104KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
524B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=55, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=1163, id=1, productName=Unmarked objects,
count=2, id=257, version=33145,
count=27, id=261, version=33145,
count=1, id=256, version=33145,
count=9, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
VaultRoaming.dll
- IMPHASH a98e5d21b89c9173a6c53147b970d023
- SHA256 063fd09f2eac8c613325a7069e91556ecbfddc1d2b1d0c246041fde4131f7dbe
- MD5 332dcf13e83ba0fe7ba4e70e35e1bad3
- SHA1 7383d6c7e506322937c432549ec91b2388e859b0
- SHA512 9dfaa9b206c336e07d6ddf7693e687b4e06df85c41f6db2f19960b5506c230655551dcae8d0aee7c002423f4c5801f12e5cdc02179b222bc63395fb1f910e02a
- SSDEEP 3072:eTCmkcjABxs4PsRl7PGCHwLyb12nmCkiMNBoMbDZCnE7N//OzY7:PmtALPg7eybonmrNiMbDZVXOzY
- TLSH T159E3171E37E820A9D172523DC9930A15E775B820272163DF07A8827D9F37BE89D3DB61
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
6272
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
VaultRoaming.pdb
msvcrt
_amsg_exit
realloc
_callnewh
__CxxFrameHandler3
memcpy_s
memmove_s
_initterm
memset
_lock
memcpy
_unlock
malloc
__dllonexit
_purecall
_wcsicmp
_vsnwprintf
wcsncpy_s
wcscat_s
free
wcscpy_s
__C_specific_handler
_vsnprintf
_XcptFilter
_onexit
wcscmp
oleaut32
SysStringLen
SysAllocString
LoadTypeLi
RegisterTypeLi
VariantClear
VariantInit
UnRegisterTypeLi
SysFreeString
SysAllocStringLen
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister
api-ms-win-core-localization-l1-2-0
GetThreadLocale
SetThreadLocale
FormatMessageW
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockExclusive
CreateMutexExW
ReleaseSemaphore
CreateEventExW
WaitForSingleObjectEx
ReleaseMutex
InitializeSRWLock
AcquireSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObject
InitializeCriticalSection
CreateSemaphoreExW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
api-ms-win-core-errorhandling-l1-1-0
SetLastError
UnhandledExceptionFilter
RaiseException
GetLastError
SetUnhandledExceptionFilter
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
GetProcAddress
GetModuleHandleExW
LoadLibraryExW
LoadLibraryExA
GetModuleHandleW
GetModuleFileNameW
GetModuleFileNameA
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegDeleteValueW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegQueryInfoKeyW
api-ms-win-core-com-l1-1-0
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoWaitForMultipleHandles
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance
StringFromCLSID
api-ms-win-core-file-l1-1-0
CompareFileTime
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetLocalTime
GetSystemInfo
GetTickCount
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentProcess
GetCurrentThread
OpenProcessToken
TerminateProcess
SetThreadStackGuarantee
OpenThreadToken
GetCurrentThreadId
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
SystemTimeToFileTime
api-ms-win-core-registry-l2-1-0
RegCreateKeyW
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
RoOriginateError
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateString
WindowsIsStringEmpty
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
rpcrt4
UuidEqual
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableLevel
UnregisterTraceGuids
TraceMessage
GetTraceLoggerHandle
RegisterTraceGuidsW
GetTraceEnableFlags
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
ntdll
RtlAllocateHeap
RtlImageNtHeader
RtlFreeHeap
propsys
PSPropertyBag_ReadDWORD
PSPropertyBag_WriteBOOL
PSPropertyBag_ReadBOOL
PSPropertyBag_WriteBSTR
PSPropertyBag_ReadBSTR
PSPropertyBag_WriteDWORD
api-ms-win-core-memory-l1-1-0
VirtualQuery
VirtualProtect
VirtualAlloc
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
Name
.text
Size
80KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=74, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=16, id=260, version=33145,
count=176, id=1, productName=Unmarked objects,
count=7, id=257, version=33145,
count=7, id=261, version=33145,
count=1, id=256, version=33145,
count=14, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
VhfUm.dll
- IMPHASH 5f2d4a75b2ec9ffc28e4b2345d0f0dd8
- SHA256 65af7ee12ea2e3a9e553a2b6999440c1d012e43de0e49dc77cec8923d87302bf
- MD5 7d90dad367be2d0b9766053147441eef
- SHA1 47b7803965e3c884dd87f2390314768a66743b32
- SHA512 3b007f1e9d615367d29fc5ec711cef2f320ed70fb40a67e189dcbd784ee03975bc7e32e0dc97c37571c25bad44aece7e5e8c5bb1defd296c1c71e8676d89da1f
- SSDEEP 768:WMcA7vXsvzyuhkEK+0oR4oeSaAPidu/C:WMcmsv+uhkkebAPiY/C
- TLSH T1ED53F95D51E410F7ECF9C27D860A451AF2A17825131A7BFF1CE482F86F16BE0993AE48
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4752
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
VhfUm.pdb
msvcrt
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_purecall
malloc
free
memset
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage
RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceEnableFlags
wpprecorderum
WppAutoLogStop
WppAutoLogTrace
WppAutoLogStart
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateEventW
WaitForSingleObject
SetEvent
ResetEvent
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
api-ms-win-core-io-l1-1-0
GetOverlappedResult
DeviceIoControl
CancelIoEx
api-ms-win-core-processthreads-l1-1-0
CreateThread
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
ntdll
NtQuerySystemInformation
RtlInitUnicodeString
VhfAsyncOperationComplete
VhfCreate
VhfDelete
VhfReadReportSubmit
VhfStart
Name
.text
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=26, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33136,
count=4, id=259, version=33136,
count=1, id=261, version=33136,
count=51, id=1, productName=Unmarked objects,
count=3, id=257, version=33136,
count=1, id=256, version=33136,
count=7, id=264, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
VideoHandlers.dll
- IMPHASH ad798ec0b5a12e906e565a70f88985bb
- SHA256 8e60c70b105bf8398150d9ed4569822f364869c5c579a651bd60b920d486eff3
- MD5 9b1b99122fbb601fb3ed5d55edb5d341
- SHA1 683b34f5386e5de2d5d35d2befe38b22691c63b3
- SHA512 73b4faf8ed6f241c4fc735b5037b6ab355455eba075c1620a9fd6426d825fedbd72c31f679f3c53301423484cc8f16a8426260af4bb826bf1131a4cc9e7d0fc9
- SSDEEP 3072:cPmA7o6tnL1NoPbwmEL8pITAIJ2OWp/PQpTDiA9l+P6W5YE2XBk0TNmS3t4cg4Cd:uL7LnpNibZEIpPgp6A9w+sCD0XMDfr
- TLSH T1E0443B1F26E90CA7E5B6917DC993450DD3B238611762E3DF0261016E8F1BBE8AD3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
9984
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
VideoHandlers.pdb
msvcp_win
_Query_perf_frequency
_Cnd_do_broadcast_at_thread_exit
_Query_perf_counter
_Thrd_detach
?_Throw_Cpp_error@std@@YAXH@Z
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_ceilf
_o_free
_o_malloc
_o_qsort
_o_realloc
_o_strncpy_s
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
_CxxThrowException
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o__beginthreadex
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__CxxFrameHandler3
__std_terminate
__CxxFrameHandler4
memcpy
api-ms-win-crt-string-l1-1-0
strnlen
wcsncmp
memset
wcsnlen
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
GetModuleHandleW
DisableThreadLibraryCalls
GetModuleFileNameA
GetProcAddress
GetModuleHandleExW
FreeLibrary
api-ms-win-core-synch-l1-2-0
InitOnceComplete
Sleep
InitOnceBeginInitialize
api-ms-win-core-featurestaging-l1-1-0
UnsubscribeFeatureStateChangeNotification
RecordFeatureUsage
GetFeatureEnabledState
SubscribeFeatureStateChangeNotification
api-ms-win-core-synch-l1-1-0
SetEvent
InitializeSRWLock
ReleaseSemaphore
ResetEvent
EnterCriticalSection
InitializeCriticalSectionEx
WaitForSingleObject
AcquireSRWLockShared
CreateMutexExW
DeleteCriticalSection
LeaveCriticalSection
ReleaseMutex
ReleaseSRWLockShared
CreateSemaphoreExW
CreateEventW
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeCriticalSection
CreateEventExW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventRegister
EventUnregister
EventSetInformation
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
TlsGetValue
GetCurrentThreadId
TlsSetValue
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
CreateThread
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringOrdinal
api-ms-win-core-winrt-string-l1-1-0
WindowsCompareStringOrdinal
WindowsDeleteString
WindowsCreateStringReference
WindowsCreateString
WindowsGetStringRawBuffer
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoTaskMemFree
CoInitializeEx
CoCreateInstance
CoUninitialize
CoIncrementMTAUsage
CoWaitForMultipleHandles
CoDecrementMTAUsage
CoCreateFreeThreadedMarshaler
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-winrt-l1-1-0
RoUninitialize
RoActivateInstance
RoGetActivationFactory
RoInitialize
api-ms-win-shcore-thread-l1-1-0
SHCreateThread
api-ms-win-shcore-registry-l1-1-0
SHGetValueW
SHSetValueW
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
RoReportFailedDelegate
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
RoOriginateError
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegSetKeySecurity
RegOpenKeyExW
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
api-ms-win-shcore-scaling-l1-1-1
ord244
api-ms-win-security-base-l1-1-0
GetTokenInformation
ntdll
RtlUnsubscribeWnfStateChangeNotification
NtPowerInformation
RtlSubscribeWnfStateChangeNotification
api-ms-win-power-setting-l1-1-0
PowerWriteDCValueIndex
PowerReadDCValue
PowerSetActiveScheme
PowerGetActiveScheme
api-ms-win-shell-changenotify-l1-1-1
SHChangeNotifyDeregister
SHChangeNotification_Unlock
SHChangeNotifyRegister
SHChangeNotification_Lock
api-ms-win-storage-exports-internal-l1-1-0
SHGetKnownFolderIDList
api-ms-win-rtcore-ntuser-window-l1-1-0
DispatchMessageW
GetMessageW
CreateWindowExW
UnregisterClassW
RegisterClassExW
DefWindowProcW
SendMessageW
TranslateMessage
PostQuitMessage
GetWindowRect
DestroyWindow
AllowSetForegroundWindow
d3d11
D3D11CreateDevice
api-ms-win-ntuser-sysparams-l1-1-0
DisplayConfigGetDeviceInfo
QueryDisplayConfig
GetDisplayConfigBufferSizes
EnumDisplayDevicesW
api-ms-win-ntuser-rectangle-l1-1-0
IntersectRect
PtInRect
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
GetSetting
NotifyVideoHandler
Name
.text
Size
152KB
Virtual Size
151KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
64KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=100, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33145,
count=5, id=259, version=33145,
count=1263, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=32, id=261, version=33145,
count=1, id=256, version=33145,
count=15, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
VirtualMon.dll
- IMPHASH e8e3f001eaf2b73d2db0fadc4792e54c
- SHA256 6d53b09702746b67e82e8816331894ec270f716a5531df0f9977218fd8c2eb4b
- MD5 31310e8cb036e9d05441d9a25f7b8b76
- SHA1 d5d80d9f97a8a9fe51e41b19bcf270fc4124d6fd
- SHA512 0de87dc549c63a9c16afe4d83bbcceb637c0537ef1ff644aefc0cb7e33baeedcd2346395384cd806ff96da7eacb02d8b47850d5ef2038d124932797e88a103f5
- SSDEEP 3072:2YM3w6LLZs/t/ljHcJ9H1aC72Jgbv+eQ60A8rQJPIyxMKLMA/vV1:23LLZ0t/ljZJw4GQqYAn
- TLSH T1F914292E72AD00B9E0B7D17DDE924A07E9B37429432156DF02A0C27D5F27EE8B539B11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
8240
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
VirtualMon.pdb
msvcp_win
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-string-l1-1-0
memset
wcsncmp
wcscmp
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_abort
_o_ceilf
_o_free
_o_iswspace
_o_malloc
_o_towlower
_o_wmemcpy_s
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__configure_narrow_argv
__std_terminate
__CxxFrameHandler4
_o__cexit
memcmp
_o__callnewh
_o___stdio_common_vswprintf
memcpy
ntdll
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
spoolss
FreePrintPropertyValue
OpenPrinterW
SetJobW
RevertToPrinterSelf
GetJobNamedPropertyValue
ClosePrinter
RouterAllocBidiResponseContainer
RouterAllocBidiMem
ImpersonatePrinterClient
RouterFreeBidiMem
RouterFreeBidiResponseContainer
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
FreeLibrary
GetModuleFileNameA
DisableThreadLibraryCalls
GetModuleHandleW
LoadLibraryExW
GetModuleHandleExW
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-synch-l1-1-0
ReleaseMutex
CreateEventW
WaitForSingleObjectEx
WaitForSingleObject
SetEvent
ReleaseSemaphore
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
CreateMutexExW
CreateSemaphoreExW
OpenSemaphoreW
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
RaiseException
GetLastError
SetLastError
SetUnhandledExceptionFilter
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventRegister
EventSetInformation
EventUnregister
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetUserDefaultLocaleName
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
TrySubmitThreadpoolCallback
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegCloseKey
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoCreateFreeThreadedMarshaler
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsCreateStringReference
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoActivateInstance
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InterlockedPushEntrySList
InitializeSListHead
api-ms-win-shcore-stream-l1-1-0
SHCreateStreamOnFileEx
api-ms-win-shcore-stream-winrt-l1-1-0
CreateRandomAccessStreamOverStream
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
oleaut32
SysStringLen
SetErrorInfo
GetErrorInfo
SysFreeString
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
api-ms-win-core-winrt-error-l1-1-0
RoFailFastWithErrorContext
InitializePrintMonitor2
Name
.text
Size
132KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=62, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=1186, id=1, productName=Unmarked objects,
count=7, id=257, version=33145,
count=26, id=261, version=33145,
count=1, id=256, version=33145,
count=9, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
VirtualSurroundApo.dll
- IMPHASH 557b3eb68bbc060a1f3762cf582c441a
- SHA256 53775b81078494328e867e6d51d46c624f85ade42361323b5b7427d7ca550e3f
- MD5 ff23bd7b44f8f8be58053a45235957e3
- SHA1 0e13f150e8bb1ef8ed5b7c5f4568c74d7d0adc4b
- SHA512 ec49cdec57af48a6c3660b08c5412dad4e87e5bb06e5f951932f92bff19bddf0b0a17cc25653cedef95be409526b6dfb4de1e8f042392d3f9c0b07cf2f82c34e
- SSDEEP 3072:YW4NyImYS2yUd/79MC12Gu5YAettsqYKZhWV:Kyhv2yUd/WC12GumAdKXW
- TLSH T1ABD34A6BB75940DAD17AD07C89438E1EE3B1B4255B2247CF2790836E0F63BD89E39391
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
25808
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
VirtualSurroundApo.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o_malloc
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
__CxxFrameHandler3
_CxxThrowException
_o__aligned_malloc
_o__aligned_free
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleExW
GetProcAddress
GetModuleHandleW
api-ms-win-core-synch-l1-1-0
CreateSemaphoreExW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
OpenSemaphoreW
WaitForSingleObjectEx
LeaveCriticalSection
CreateMutexExW
DeleteCriticalSection
ReleaseSRWLockShared
ReleaseMutex
AcquireSRWLockShared
WaitForSingleObject
InitializeCriticalSection
ReleaseSemaphore
EnterCriticalSection
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
SetLastError
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventUnregister
EventRegister
EventSetInformation
EventActivityIdControl
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
RoOriginateError
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoCreateGuid
CoTaskMemAlloc
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount64
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolQueueTask
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
60KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
RT_CODE
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
36KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=55, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=1147, id=1, productName=Unmarked objects,
count=2, id=257, version=33145,
count=28, id=261, version=33145,
count=1, id=256, version=33145,
count=15, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
VmApplicationHealthMonitorProxy.dll
- IMPHASH 165a5f892c36523111ac728542e9b705
- SHA256 9896fa5b242ebf4bcc9808167001c14bf771b8364c2e62fdde8e38e158a4fb0f
- MD5 c356ee79241cddd7379dceb99edbedb3
- SHA1 1bf060b20123d052d8edab61412c66dc3868c1c5
- SHA512 ee0e80d33a3cdf9e6e32a4a394745b6232ed602d55ba73c6678d7feddf68f18ca026550462eb7271c9090911de25645052150d32542197f05783de940eba536e
- SSDEEP 384:NtOSfaDzWA/VRO/nBkhkwQ53VoWNcWhJ/vDBRJc2jR9zrQE:HO5zR9R6BoPw3V7Bv1PR9zME
- TLSH T1F8337DD6EF9D4481E976A93445A7CE17B939FB02031142EB0362B40D0DBBBD6AB343D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
8a:be:ad:ef:48:d4:99:65:4e:63:20:38:54:5c:b2:e7:bb:19:66:43:6d:17:74:ba:7c:91:74:03:e8:39:19:52
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 11, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:551A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1b:d0:b2:b8:02:67:f7:72:cf:00:01:00:00:02:1b
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
5056
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
VmApplicationHealthMonitorProxy.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___std_type_info_destroy_list
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
__C_specific_handler
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
528B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
224B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
380B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=29, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1114, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=4, id=259, version=33145,
count=11, id=261, version=33145,
count=1, id=256, version=33145,
count=5, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
VmCrashDump.dll
- IMPHASH 3d2a3245a8cf10df1a96ca57e0b88c18
- SHA256 e72ea38b1ce6ce91628d03f815f4f6e878685e8de9f2e428ae758b2a783ad2b5
- MD5 eb4bc75f86737c3bdd9a4dd406b701e1
- SHA1 d5a8b43868fde8e8567c27140ee065c6590f496b
- SHA512 370db9229d6e5fe00c4a46a5b5dcfa822a0bb1d5aac5e48d70ee77b174f1a93088110727650e5849b56bc559b412ee589083a995eac59a05a5e57e6e1496c1ca
- SSDEEP 3072:953bzByoFSnbMscuGyE4QeNjvmldoMl2p9MAwtORfJux3RVMJarpa19ZAOJgAm:LLzByoUnwuGTlWjsCRvM7t9f/rpazZA7
- TLSH T102643C3D66690CE5ED7BD13889538A05F67278600322D2CF0590827E5FAFFE4A93EB54
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
6c:96:ac:02:86:c0:67:9b:68:b8:95:58:1e:95:c9:8e:c5:ae:89:c2:18:6e:c9:05:28:d0:1e:92:49:8a:c7:31
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:521A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:17:71:fb:2e:a5:af:01:1d:ea:00:01:00:00:02:17
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
10944
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vmcrashdump.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
memmove
_o_free
_o_malloc
_o_terminate
_o_wcscpy_s
_o_wcstoll
_o_wcstoull
__CxxFrameHandler3
__current_exception
__current_exception_context
_CxxThrowException
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__execute_onexit_table
_o__errno
__std_terminate
__C_specific_handler
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetModuleFileNameW
GetProcAddress
GetModuleHandleW
GetModuleHandleExW
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
InitializeSRWLock
ReleaseSemaphore
ReleaseSRWLockShared
ResetEvent
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
SetEvent
ReleaseSRWLockExclusive
CreateSemaphoreExW
InitializeCriticalSection
LeaveCriticalSection
ReleaseMutex
InitializeCriticalSectionEx
WaitForSingleObject
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegGetValueW
RegOpenKeyExW
RegDeleteKeyExW
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolWork
CloseThreadpoolIo
SetThreadpoolThreadMaximum
WaitForThreadpoolWorkCallbacks
CancelThreadpoolIo
TrySubmitThreadpoolCallback
CreateThreadpoolIo
StartThreadpoolIo
CloseThreadpool
CloseThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SubmitThreadpoolWork
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
RtlCaptureStackBackTrace
RtlPcToFileHeader
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-synch-l1-2-0
SleepConditionVariableCS
WakeAllConditionVariable
WakeByAddressAll
InitOnceBeginInitialize
InitOnceComplete
InitializeConditionVariable
SleepConditionVariableSRW
WaitOnAddress
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventWriteTransfer
EventEnabled
EventUnregister
EventRegister
EventWrite
EventActivityIdControl
api-ms-win-core-psapi-l1-1-0
K32GetModuleInformation
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoTaskMemAlloc
StringFromCLSID
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
GetCurrentProcessorNumberEx
api-ms-win-core-file-l1-1-0
WriteFile
SetEndOfFile
SetFilePointerEx
api-ms-win-core-file-l1-2-0
CreateFile2
xmllite
CreateXmlReaderInputWithEncodingName
CreateXmlReader
oleaut32
SysFreeString
api-ms-win-core-perfcounters-l1-1-0
PerfStartProvider
PerfDeleteInstance
PerfSetCounterSetInfo
PerfStopProvider
PerfSetCounterRefValue
PerfCreateInstance
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
164KB
Virtual Size
163KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
72KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
44KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=63, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1199, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=29, id=261, version=33145,
count=1, id=256, version=33145,
count=21, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
VmSynthNic.dll
- IMPHASH a8a7d3259c332808019fa1d1c213bd63
- SHA256 05b2ec7f74a0a8cd7a515ed408e94671a67a1796ce235c6e91591306ef0c37f4
- MD5 79cf322cae132c2ca37cf2c2c3085a62
- SHA1 d0de9671fe2de7e321cab41e5a55c36bb5c52740
- SHA512 7a4d8fb70efd94c2a0d38291fb612222d4da5b6ea685c9ade43a76ec57d336b23f966de3553d57260e9402eb8668e77647fed3cb693ee1334ce9471c97db1e65
- SSDEEP 6144:N7oVVO/YaJWmQFDd8sCKs2l+m0QP+JnWs5gHH2U1fj1TWo+6PdF:S8A9H8sddeJCHH2U1RT3+6PdF
- TLSH T1F9A44A19E7A804E6E1B7D27CC9A38606E6B37C69477187CF11A0D26D1F33BE4993A311
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
76:9b:79:19:2d:0b:36:9f:9a:73:d4:bd:69:3e:0b:ea:f4:04:d2:57:7d:df:fb:4d:8f:99:65:31:b3:b6:6c:d4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:DC00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:24:3b:84:21:b0:2c:ac:64:22:00:01:00:00:02:24
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
62752
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
VmSynthNic.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
_o__wcsicmp
_o_abort
_o_calloc
_o_ceilf
_o_free
_o_iswspace
_o_iswxdigit
_o_malloc
_o_terminate
_o_wcscpy_s
_o_wcstod
_o_wcstoull
__current_exception
__AdjustPointer
__CxxFrameHandler3
__current_exception_context
_CxxThrowException
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__C_specific_handler
__CxxFrameHandler4
memcmp
memcpy
memmove
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetModuleFileNameW
FindResourceExW
GetModuleFileNameA
GetProcAddress
GetModuleHandleW
LockResource
LoadResource
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
WaitForSingleObjectEx
InitializeSRWLock
ReleaseSRWLockExclusive
ResetEvent
SetEvent
WaitForSingleObject
InitializeCriticalSectionEx
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseMutex
ReleaseSemaphore
CreateEventW
CreateMutexW
InitializeCriticalSectionAndSpinCount
CreateMutexExW
EnterCriticalSection
OpenSemaphoreW
CreateSemaphoreExW
InitializeCriticalSection
DeleteCriticalSection
AcquireSRWLockShared
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegEnumKeyExW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegDeleteKeyExW
RegGetValueW
RegDeleteValueW
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolIo
WaitForThreadpoolTimerCallbacks
CreateThreadpoolWork
StartThreadpoolIo
CancelThreadpoolIo
SetThreadpoolThreadMaximum
SubmitThreadpoolWork
CloseThreadpoolTimer
CloseThreadpoolIo
CloseThreadpool
SetThreadpoolTimer
FreeLibraryWhenCallbackReturns
CreateThreadpoolTimer
CloseThreadpoolWork
TrySubmitThreadpoolCallback
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureStackBackTrace
RtlVirtualUnwind
RtlCaptureContext
RtlPcToFileHeader
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
WakeAllConditionVariable
Sleep
WakeByAddressAll
SleepConditionVariableSRW
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventSetInformation
EventUnregister
EventEnabled
EventActivityIdControl
EventWrite
api-ms-win-core-psapi-l1-1-0
K32GetModuleInformation
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-sysinfo-l1-1-0
GetTickCount64
GetTickCount
GetSystemTimeAsFileTime
GetVersionExW
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoCreateInstance
CoGetObjectContext
StringFromCLSID
CoTaskMemAlloc
CLSIDFromString
xmllite
CreateXmlReaderInputWithEncodingName
CreateXmlReader
oleaut32
SafeArrayDestroy
VariantInit
SafeArrayCreateVectorEx
SafeArrayUnaccessData
SafeArrayAccessData
SysStringLen
SafeArrayGetUBound
SafeArrayGetLBound
SysAllocString
SysAllocStringLen
SysReAllocStringLen
VariantChangeTypeEx
SysFreeString
SafeArrayGetVartype
VariantClear
SafeArrayPutElement
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
api-ms-win-core-shlwapi-legacy-l1-1-0
PathIsUNCServerShareW
PathIsUNCServerW
mpr
WNetGetResourceInformationW
api-ms-win-core-file-l1-1-0
GetFileAttributesW
iphlpapi
ConvertInterfaceLuidToGuid
ntdll
RtlInitUnicodeString
NtSetInformationFile
RtlEqualUnicodeString
RtlEthernetStringToAddressW
RtlIpv6StringToAddressW
RtlIpv4StringToAddressW
devobj
DevObjDestroyDeviceInfoList
DevObjGetDeviceProperty
DevObjEnumDeviceInfo
DevObjGetClassDevs
DevObjOpenDevRegKey
DevObjCreateDeviceInfoList
DevObjOpenDeviceInfo
api-ms-win-core-io-l1-1-0
CancelIoEx
GetOverlappedResult
DeviceIoControl
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-sysinfo-l1-2-0
GetSystemTimePreciseAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
vmprox
GetVmErrInfo
SetVmErrInfo
vmsif
VmsIfNicGetVfInfo
VmsIfNicAllocateVF
VmsIfNicFreeVF
VmsIfPortPropertyUpdate
VmsIfSwitchListenIcmpEcho
VmsIfSwitchSendIcmpEcho
VmsIfNicVmphuComplete
VmsIfNicVmphuBegin
VmsIfNicSuspendSynthetic
VmsIfPortEnumerateLearnedMacAddresses
VmsIfNicNotifyRestored
VmsIfNicRestore
VmsIfPortOpenWithHandle
VmsIfMemFree
VmsIfDriverClose
VmsIfNicRelearnMac
VmsIfDriverOpen
VmsIfNicDisableOptimizations
VmsIfRegisterHandle
VmsIfNicEnableOptimizations
VmsIfCapsIsFeaturePresent
VmsIfNicGetStatus
VmsIfIoctlGetOutputRecord
VmsIfIoctlGetOutputBuffer
VmsIfIoctlResizeOutputBuffer
VmsIfIoctlSendIoctl
VmsIfIoctlDeinitializeOperation
VmsIfIoctlInitializeOperation
VmsIfIoctlAddToInputBuffer
VmsIfPortFeatureStatusFree
VmsIfPortFeatureStatusQuery
netmgmtif
NetMgmtNicResumeSynthetic
NetMgmtNicDeleteSynthetic
NetMgmtConnectSwitchPort
NetMgmtNicCreateSynthetic
NetMgmtDisconnectSwitchPort
NetMgmtNicMorphToSynthNic
NetMgmtNicPauseSynthetic
api-ms-win-devices-config-l1-1-1
CM_Get_Device_ID_Size
CM_Get_Parent
CM_Get_Device_IDW
netsetupapi
NetSetupClose
NetSetupInitialize
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
284KB
Virtual Size
281KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
112KB
Virtual Size
109KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=257, version=33145,
count=81, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1321, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=11, id=260, version=33145,
count=31, id=261, version=33145,
count=7, id=259, version=33145,
count=1, id=256, version=33145,
count=39, id=264, version=33145,
count=2, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
VocabRoamingHandler.dll
- IMPHASH 6f061eea9294507dac94dbe3255883f5
- SHA256 d8b90b17082fd1ecd337b79c74b327973354601bdc842b472718cb2a3f358606
- MD5 22842456bfa03a54e8533b3165a09c05
- SHA1 a5760d6a357c446d2c4d39e61a153887e297c65f
- SHA512 f871f5051e9d28859fa361218f575623493af3bd77744ecc7597e83dd00d97df13722e77531a83d7b89fb18a5c518b38c82c6eeaf335c575e82e9c87cfacb308
- SSDEEP 3072:dPCTPcR9W7BpT2T/POL4xpbCo3h6pH+FzoQ6JV1zw34AZ:EjcR9WPT2T+0xhCo3h6x8z0w34
- TLSH T14E043B2F72A810E6E676D07CC6570A1AF7727051131252DF43A082BE4F5BBE87E39B91
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
11088
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
VocabRoamingHandler.pdb
msvcrt
__dllonexit
_lock
__C_specific_handler
wcsncpy_s
_onexit
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
memcmp
_initterm
free
_vsnwprintf
_amsg_exit
memcpy_s
_XcptFilter
_purecall
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
_callnewh
malloc
??0exception@@QEAA@XZ
_unlock
??0exception@@QEAA@AEBV0@@Z
??3@YAXPEAX@Z
memmove
memcpy
_wcsicmp
memmove_s
__CxxFrameHandler3
__CxxFrameHandler4
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetModuleHandleExW
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleW
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
Sleep
InitOnceComplete
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
CreateSemaphoreExW
ReleaseSemaphore
EnterCriticalSection
ReleaseSRWLockExclusive
DeleteCriticalSection
ReleaseMutex
InitializeCriticalSectionEx
AcquireSRWLockShared
WaitForSingleObject
WaitForSingleObjectEx
ReleaseSRWLockShared
CreateMutexExW
LeaveCriticalSection
OpenSemaphoreW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
SetLastError
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventWriteTransfer
EventActivityIdControl
EventRegister
EventUnregister
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
LocaleNameToLCID
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-shlwapi-obsolete-l1-1-0
StrStrIW
QISearch
api-ms-win-core-com-l1-1-0
StringFromGUID2
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegCloseKey
RegGetValueW
RegQueryValueExW
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-file-l1-1-0
GetTempFileNameW
DeleteFileW
CreateFileW
ReadFile
WriteFile
CreateDirectoryW
SetFilePointerEx
GetFileSizeEx
api-ms-win-core-localization-l1-2-2
LCIDToLocaleName
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFileExistsW
PathFindFileNameW
api-ms-win-core-file-l1-2-3
GetTempPath2W
api-ms-win-core-file-l2-1-0
ReplaceFileW
MoveFileExW
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
104KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
36KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=60, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=14, id=260, version=33145,
count=5, id=259, version=33145,
count=131, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=6, id=261, version=33145,
count=1, id=256, version=33145,
count=14, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
VoiceActivationManager.dll
- IMPHASH 465fcc0f6a80a95ab764fb24c024e138
- SHA256 6c723fc59ff51f7313d6e71514c2f3a5567fccae15b3937b4f486dd084ad2494
- MD5 c01a0d32b22d655952d9b8a5627a5937
- SHA1 5d490cf7d25ed62fe47ec06d62585b079ad97059
- SHA512 4b3cd0f196a89313e9e7ed84d066808fc801b0331736611d748c53e4ba8ed38c29553566cd5e4c2af1349ca3347dd66531047cdc16d3aa51b1037bbce851ff66
- SSDEEP 3072:8mJPg/GSBrF5waEuADX5YIY2bg3LevSaZ0z2h:xaG6HzEuADX5YI5bg3LG0z2
- TLSH T132D3182F72A920EAD679C17989520A44EB71B032131127EF52D0C1BD5F27BE8AD3DF25
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
6928
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
VoiceActivationManager.pdb
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
memmove
_o__execute_onexit_table
_o_calloc
_o_free
_o_malloc
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o___stdio_common_vswprintf
_o__cexit
_o__callnewh
__std_terminate
__C_specific_handler
__CxxFrameHandler4
_CxxThrowException
__C_specific_handler_noexcept
memcpy
rmclient
RmAcquireResources
RmReleaseResources
RmGetNotification
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleW
LoadLibraryExW
LoadResource
FindResourceExW
DisableThreadLibraryCalls
GetModuleFileNameW
SizeofResource
FreeLibrary
api-ms-win-core-featurestaging-l1-1-0
GetFeatureEnabledState
RecordFeatureUsage
SubscribeFeatureStateChangeNotification
UnsubscribeFeatureStateChangeNotification
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance
CoGetMalloc
PropVariantClear
StringFromGUID2
CoTaskMemAlloc
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
InitializeCriticalSectionEx
WaitForSingleObjectEx
DeleteCriticalSection
CreateMutexExW
CreateSemaphoreExW
EnterCriticalSection
OpenSemaphoreW
ReleaseSemaphore
AcquireSRWLockExclusive
InitializeCriticalSection
SetEvent
ReleaseSRWLockExclusive
CreateEventW
ReleaseMutex
WaitForSingleObject
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter
api-ms-win-devices-query-l1-1-0
DevFindProperty
DevFreeObjectProperties
DevGetObjectProperties
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
ntdll
RtlPublishWnfStateData
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
CreateThread
GetCurrentProcess
api-ms-win-core-com-l1-1-3
CoRevokeDeviceCatalog
CoRegisterDeviceCatalog
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
oleaut32
SysAllocString
SysStringLen
VarUI4FromStr
RegisterTypeLi
LoadTypeLi
SysFreeString
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventUnregister
EventSetInformation
EventWriteTransfer
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-devices-config-l1-1-1
CM_MapCrToWin32Err
CM_Register_Notification
CM_Unregister_Notification
api-ms-win-core-file-l1-1-0
CreateFileW
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegCreateKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteValueW
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
mmdevapi
ord27
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
80KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
568B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=33145,
count=73, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1195, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=11, id=260, version=33145,
count=5, id=259, version=33145,
count=22, id=261, version=33145,
count=1, id=256, version=33145,
count=7, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
VoipRT.dll
- IMPHASH d288947351759043acd7ab57814bd8c6
- SHA256 3072e59c32b1e07cdab2a9681a8d9d53db28edab11a83ef5a5f4007d60fdc539
- MD5 85b5df2c75b509d0f42419487c83f3f4
- SHA1 0220a7be1b4e6c367fd5c80ec9f7584e6523ef32
- SHA512 9cd03816c028be996cc8cfc814bf9921edb00daf44eb083f4616890fe3c8ad3846d5217ad6c2cc7d24c13ce821ac0921ca15e0ed3cf213aeec848c45a7fd6550
- SSDEEP 6144:OaSSeYMQYqWI56zp0IiQebt19oVW5FJV6s:JSSgQYo56zp0H9+VYVn
- TLSH T10C444B3A3A7D08E6D926A13D84574F0EE2B5F5211312A6DB0255817D8F1BFF8E93EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7568
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
VoipRT.pdb
msvcrt
_onexit
__CxxFrameHandler3
_unlock
_lock
_initterm
_purecall
memmove
_amsg_exit
__dllonexit
_XcptFilter
free
memcpy
memcmp
time
memmove_s
memcpy_s
_vsnwprintf
_callnewh
__C_specific_handler
malloc
memset
userdataplatformhelperutil
??1RpcClient@Comms@@QEAA@XZ
api-ms-win-core-url-l1-1-0
PathCreateFromUrlW
UrlUnescapeW
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetProcAddress
DisableThreadLibraryCalls
GetModuleHandleW
GetModuleFileNameA
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-synch-l1-1-0
InitializeSRWLock
ReleaseMutex
ReleaseSemaphore
ReleaseSRWLockExclusive
WaitForSingleObjectEx
AcquireSRWLockExclusive
WaitForSingleObject
OpenSemaphoreW
DeleteCriticalSection
AcquireSRWLockShared
EnterCriticalSection
LeaveCriticalSection
CreateMutexExW
CreateSemaphoreExW
ReleaseSRWLockShared
InitializeCriticalSectionEx
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventSetInformation
EventRegister
EventUnregister
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
RoOriginateError
SetRestrictedErrorInfo
RoOriginateErrorW
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceExecuteOnce
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsDuplicateString
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsCreateStringReference
WindowsGetStringLen
WindowsDeleteString
WindowsCreateString
api-ms-win-core-com-l1-1-0
CoCreateGuid
CoGetApartmentType
CoCreateFreeThreadedMarshaler
CoReleaseMarshalData
CoTaskMemFree
CoCreateInstance
CoMarshalInterface
StringFromCLSID
CreateStreamOnHGlobal
CoTaskMemAlloc
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
rpcrt4
NdrClientCall3
RpcEpUnregister
NdrServerCall2
NdrServerCallAll
RpcServerUseProtseqEpW
RpcBindingVectorFree
RpcStringFreeW
RpcBindingFree
RpcServerInqBindings
RpcExceptionFilter
RpcBindingSetAuthInfoExW
RpcBindingFromStringBindingW
RpcEpRegisterW
RpcStringBindingComposeW
RpcServerRegisterIf3
RpcServerUnregisterIf
RpcServerUnregisterIfEx
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
OpenProcessToken
GetCurrentProcessId
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
SetLastError
api-ms-win-core-winrt-l1-1-0
RoInitialize
RoGetActivationFactory
RoUninitialize
api-ms-win-core-winrt-error-l1-1-1
IsErrorPropagationEnabled
RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
ntdll
RtlUnsubscribeWnfStateChangeNotification
RtlAllocateWnfSerializationGroup
RtlSubscribeWnfStateChangeNotification
RtlGetAppContainerNamedObjectPath
RtlFreeUnicodeString
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
164KB
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
992B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=58, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=15, id=260, version=33145,
count=5, id=259, version=33145,
count=145, id=1, productName=Unmarked objects,
count=7, id=257, version=33145,
count=7, id=261, version=33145,
count=1, id=256, version=33145,
count=18, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
VpnSohDesktop.dll
- IMPHASH bb544dadfd488c90d977497feeddb49a
- SHA256 6cec2899f79a816ff3ae63cac9510f14aef11c9638c85dc54f2e1a07cd2e0249
- MD5 5a85d66e6fc1244398840db74bf66fd1
- SHA1 5885fd16a67de1bda85b21353fe7de0bb6f8d3da
- SHA512 c9474a63519237fb3462efe26957b2b1f84e096439bf642fa2189b5f1215dba11ab7cc764e7dd98e9a6d0c2945a8f96e74152e1bfc101f8b5e7cc6e23a79dc23
- SSDEEP 96:OyvvPd8UZ2QD6k/MEHwp551ZdDb7yWIk4TAbmliB6/kYYMX265qlEWz3WwEE:HIDUtQp5XrpN4pvYMX26JWz3W9E
- TLSH T1A1E2F9CEB33857BDF4668178C1174503BA35B120674183EB0670929D4E3B7C1AA3DFA6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4752
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
VpnSohDesktop.pdb
msvcrt
__C_specific_handler
_XcptFilter
_initterm
malloc
free
_amsg_exit
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
wscapi
wscAntiSpywareGetStatus
wscAntiVirusGetStatus
wscFirewallGetStatus
VpnWscFreeProductInfo
VpnWscGetProductInfo
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
264B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=4, id=259, version=33136,
count=13, id=260, version=33136,
count=29, id=1, productName=Unmarked objects,
count=5, id=257, version=33136,
count=1, id=256, version=33136,
count=2, id=264, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
VrdUmed.dll
- IMPHASH 0082512d3925904a6d3814938c0a0bf1
- SHA256 b7c6676ebc48fcae8a409a95936097a57666aef4a5ad7a80fd98be55fbd00b08
- MD5 c159678aa3edd804f8fe47629cf39918
- SHA1 2b1ead759267739b353034b2c13d5634d27a97fd
- SHA512 8e95e6e1313ad78e3fae10dc8ee0783ed6fa8734602ad24afa01de28b1945b646b9ac5974ab6967839518caefd3b05de974b7508380236c8d7e7e51e70094361
- SSDEEP 768:LObEymrY+3EVcQeTIZVxbi9p101Pns9zS2R:wmr30V/OIZVxbi9p1EPkzS2R
- TLSH T114336CC5AF5C04C2E9BA2538C583CA4B7839B6911B2122DB47B1C11D1D37BE4EA397DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
2f:3c:1b:cc:99:81:50:b6:26:64:f2:83:96:95:a7:03:4a:7c:58:52:35:5f:bb:37:c2:76:90:e3:8a:2f:e0:62
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 3, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:D082-4BFD-EEBA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:dc:c1:e0:8c:c2:5f:58:5e:8e:00:01:00:00:01:dc
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 12, 2023 - Jan 10, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
5056
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
VrdUmed.pdb
api-ms-win-crt-string-l1-1-0
wcsnlen
memset
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___std_exception_copy
_o___std_exception_destroy
_o___std_type_info_destroy_list
_o___stdio_common_vswprintf
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
memcpy
_o_free
_o_malloc
__C_specific_handler
_CxxThrowException
__std_terminate
__CxxFrameHandler4
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-com-l1-1-0
StringFromCLSID
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameW
api-ms-win-core-registry-l2-1-0
RegCreateKeyW
RegDeleteKeyW
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegCloseKey
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
780B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
204B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1095, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33138,
count=4, id=259, version=33138,
count=20, id=261, version=33138,
count=1, id=256, version=33138,
count=4, id=264, version=33138,
count=1, id=253, version=33138,
count=1, id=255, version=33138,
count=1, id=258, version=33138,
VscMgrPS.dll
- IMPHASH baa26ac6ee8eaeee611d25b903d2e5ad
- SHA256 8a516050a21e825e0c342da36af0eeb02f28670f856fec2e34e64a6fc8b2ef3c
- MD5 5c5dc394d19c4f0af321459e20d444a8
- SHA1 79d2d9b53d78fd683b37e9dc126c86e47f12d824
- SHA512 463dc43524d5f02b35befbbf6e5bae9b43e3d9a1f3ead41efa8d03babf6e02ffb2a5ad3d43f724f6ecfbe8f167b2f4cf891d44e241fae33b423d6e7f8c665b8a
- SSDEEP 384:AhEWdBzUwzITFnuoHpXcsPLgqWsP7g3MWx:ABQwzonuoHpXtPUh7
- TLSH T1DE03C689B731599AF5755178846F0E23A72AFD14076287EB8A30163D1C7B3C18E38BD2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4752
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
VscMgrPS.pdb
msvcrt
_amsg_exit
__C_specific_handler
_initterm
malloc
free
_XcptFilter
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
rpcrt4
NdrOleAllocate
NdrDllUnregisterProxy
NdrOleFree
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrDllRegisterProxy
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-marshal-l1-1-0
HWND_UserSize64
HWND_UserSize
HWND_UserUnmarshal
HWND_UserMarshal64
HWND_UserUnmarshal64
HWND_UserFree64
HWND_UserFree
HWND_UserMarshal
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
612B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33140,
count=4, id=259, version=33140,
count=39, id=1, productName=Unmarked objects,
count=3, id=257, version=33140,
count=1, id=256, version=33140,
count=6, id=264, version=33140,
count=1, id=255, version=33140,
count=1, id=258, version=33140,
userinitext.dll
- IMPHASH e3ffef0ea26129ae4c034854fb9276fc
- SHA256 179348d544ba498226b3bbd3e0e40a67ae2489ca36647aa3e3ad24d8d2fbb7ce
- MD5 c47908ad2ed944519eab75766a7eba75
- SHA1 18fb640a31200307e6fd1494029850e0588d63fe
- SHA512 f916e97fc0a17a61270d31e769d3ed27a62f7b5360c10e5947fa24a8a894e5c11a69be07cfc35cc764b6d0d7acdc48e39deca69b4aa80d9fbdb95ad3122a2f63
- SSDEEP 1536:49njpsJBM//nN8hnT93zynmKMWINHuZqtPxP7:4NWM/eF93pVNOZqt5T
- TLSH T1F0831A1D62B83099E57A8139C5A68614E2F1B43537125AFF03E0C2BD9F17BD4A63DF22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
8864
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
userinitext.pdb
msvcrt
_onexit
_lock
memcmp
_vsnwprintf
__dllonexit
_unlock
_initterm
malloc
free
_amsg_exit
memmove_s
_vscwprintf
_purecall
??3@YAXPEAX@Z
memcpy_s
__C_specific_handler
memset
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegGetValueW
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegDeleteTreeW
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
OpenProcessToken
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
CreateProcessW
ProcessIdToSessionId
api-ms-win-core-processenvironment-l1-1-0
SetCurrentDirectoryW
ExpandEnvironmentStringsW
api-ms-win-core-localization-l1-2-0
GetUserDefaultLangID
FormatMessageW
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister
api-ms-win-core-synch-l1-1-0
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseSRWLockShared
AcquireSRWLockExclusive
LeaveCriticalSection
InitializeCriticalSectionEx
AcquireSRWLockShared
DeleteCriticalSection
SetEvent
ReleaseSemaphore
EnterCriticalSection
CreateSemaphoreExW
WaitForSingleObject
OpenEventW
ReleaseSRWLockExclusive
CreateEventW
CreateMutexExW
ReleaseMutex
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-sysinfo-l1-1-0
GetTickCount64
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
FreeLibrary
GetModuleFileNameA
GetModuleHandleExW
LoadStringW
GetModuleHandleExA
GetModuleHandleW
GetProcAddress
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-synch-l1-2-0
Sleep
WakeAllConditionVariable
SleepConditionVariableSRW
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
ntdll
DbgPrint
NtClose
RtlInitUnicodeString
NtOpenKey
NtQuerySystemInformation
NtTerminateProcess
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
CreateExplorerSessionKey
DisplayMessageAndExitWindows
ImmWorker
IsSubDesktopSession
IsTSAppCompatOn
LoadRemoteFontsAndInitMiscWorker
PerformXForestLogonCheck
ProcesRemoteSessionInitialCommand
ProcessTermSrvIniFiles
SetShellDesktopSwitchEvent
SetupHotKeyForKeyboardLayout
UserinitExt
Name
.text
Size
40KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
228B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=42, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=14, id=260, version=33145,
count=126, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=1, id=261, version=33145,
count=1, id=256, version=33145,
count=7, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
usermgr.dll
- IMPHASH fab005af83f78f757c7b6575239386be
- SHA256 084d9dafe67d89dc8c3ddc72a949a0c8f027698504fa3809484ee70dca60d3ef
- MD5 d00ffba5982bb07dab64b62f16ffcbc8
- SHA1 4c5237c064a930b029f16d246225f4fee8897e77
- SHA512 eac0e5220b5e5f4d588f29a82f93c9d0693c23612e56c593ae4ede7170e60cc4accf747b9765ed0c63cb27334b77f7f3f8c7f396c3265a8b3dcf3611c1b0cd9f
- SSDEEP 24576:oHV/uEaQng6tEV0KNFehfJp7RlXMP41KTSMJzqxXEH:o1/uYtRLRhX0UEH
- TLSH T11B655C2FABAC019AD57AD13DC023461BEAB174261331A6CB0551867D9F2BFE45E3DF20
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
388544
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
usermgr.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__ui64tow_s
_o__wcsicmp
_o__wcsnicmp
memmove
_o__wtoi
_o__wtol
_o_free
_o_malloc
_o_rand
_o_realloc
_o_terminate
_o_wcstol
__C_specific_handler
__CxxFrameHandler3
__current_exception
__current_exception_context
_CxxThrowException
_o__execute_onexit_table
_o__errno
_o__get_errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o__aligned_malloc
_o__aligned_free
_o___stdio_common_vswprintf
wcschr
wcsstr
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
strrchr
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
wcscmp
wcsnlen
memset
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoRegisterClassObject
CoDisconnectContext
CoGetCancelObject
CoResumeClassObjects
CoDecrementMTAUsage
CoInitializeSecurity
CoIncrementMTAUsage
CoReleaseServerProcess
CoRevokeClassObject
CoAddRefServerProcess
CoReleaseMarshalData
CoGetInterfaceAndReleaseStream
CoTaskMemFree
CoWaitForMultipleHandles
CoSetProxyBlanket
CoGetCallContext
CoCopyProxy
CoTaskMemRealloc
CreateStreamOnHGlobal
CoMarshalInterface
CoEnableCallCancellation
CoDisableCallCancellation
CoCreateGuid
CoGetApartmentType
CoRevertToSelf
CoImpersonateClient
StringFromCLSID
CoGetMalloc
PropVariantClear
api-ms-win-core-libraryloader-l1-2-0
LockResource
LoadLibraryExW
GetModuleFileNameA
FreeLibrary
DisableThreadLibraryCalls
LoadResource
FindResourceExW
GetModuleHandleW
GetModuleFileNameW
GetModuleHandleExA
GetModuleHandleExW
GetProcAddress
api-ms-win-core-synch-l1-1-0
CreateSemaphoreExW
CreateEventExW
EnterCriticalSection
ReleaseSemaphore
LeaveCriticalSection
InitializeCriticalSectionEx
TryAcquireSRWLockShared
WaitForSingleObject
ReleaseMutex
CreateEventW
ReleaseSRWLockExclusive
SetEvent
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseSRWLockShared
InitializeSRWLock
AcquireSRWLockShared
DeleteCriticalSection
CreateMutexExW
InitializeCriticalSectionAndSpinCount
ResetEvent
api-ms-win-core-realtime-l1-1-0
QueryUnbiasedInterruptTime
api-ms-win-security-base-l1-1-0
MakeAbsoluteSD
PrivilegeCheck
AccessCheckByType
CheckTokenMembership
AdjustTokenPrivileges
CreateRestrictedToken
RevertToSelf
ImpersonateLoggedOnUser
AllocateLocallyUniqueId
DuplicateTokenEx
GetTokenInformation
DuplicateToken
GetLengthSid
CopySid
IsWellKnownSid
DestroyPrivateObjectSecurity
EqualSid
AllocateAndInitializeSid
FreeSid
SetTokenInformation
IsValidSid
AccessCheck
CreateWellKnownSid
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceExecuteOnce
Sleep
WaitOnAddress
WakeByAddressAll
InitOnceComplete
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
WindowsConcatString
WindowsDuplicateString
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCompareStringOrdinal
WindowsGetStringLen
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsCreateString
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventSetInformation
EventUnregister
EventRegister
EventActivityIdControl
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolWorkCallbacks
WaitForThreadpoolTimerCallbacks
CloseThreadpoolWork
SetThreadpoolTimer
CloseThreadpoolTimer
SubmitThreadpoolWork
CreateThreadpoolWork
CreateThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
ResumeThread
CreateProcessAsUserW
GetCurrentThreadId
ProcessIdToSessionId
GetCurrentProcessId
TerminateProcess
OpenProcessToken
GetCurrentProcess
CreateThread
GetProcessId
OpenThreadToken
GetCurrentThread
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoRegisterActivationFactories
RoUninitialize
RoGetActivationFactory
RoInitialize
RoRevokeActivationFactories
api-ms-win-core-winrt-error-l1-1-0
RoFailFastWithErrorContext
GetRestrictedErrorInfo
SetRestrictedErrorInfo
RoOriginateErrorW
RoOriginateError
RoTransformError
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-sysinfo-l1-1-0
GetTickCount64
GetSystemTimeAsFileTime
GetTickCount
GetComputerNameExW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringOrdinal
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-1
OpenProcess
IsProcessorFeaturePresent
GetProcessMitigationPolicy
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegCreateKeyExW
RegQueryInfoKeyW
RegDeleteValueW
RegFlushKey
RegDeleteTreeW
RegEnumKeyExW
RegEnumValueW
RegGetValueW
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
api-ms-win-core-file-l2-1-0
MoveFileExW
api-ms-win-core-heap-l2-1-0
LocalReAlloc
LocalFree
LocalAlloc
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-file-l1-1-0
CreateDirectoryW
WriteFile
GetFileSizeEx
CreateFileW
ReadFile
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate
IsErrorPropagationEnabled
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-registry-l1-1-1
RegDeleteKeyValueW
api-ms-win-core-localization-l1-2-3
GetUserDefaultGeoName
api-ms-win-security-base-l1-2-0
CheckTokenCapability
CheckTokenMembershipEx
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-core-threadpool-legacy-l1-1-0
UnregisterWaitEx
QueueUserWorkItem
api-ms-win-core-kernel32-legacy-l1-1-0
MulDiv
RegisterWaitForSingleObject
api-ms-win-core-heap-obsolete-l1-1-0
LocalSize
api-ms-win-service-private-l1-1-0
I_ScBroadcastServiceControlMessage
api-ms-win-security-base-private-l1-1-1
CreateAppContainerToken
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
ntdll
RtlAllocateHeap
RtlSubAuthorityCountSid
RtlSubAuthoritySid
RtlNtStatusToDosErrorNoTeb
RtlCompareUnicodeString
NtDuplicateToken
RtlAdjustPrivilege
EtwTraceMessage
RtlCopySid
RtlGetDaclSecurityDescriptor
NtQuerySecurityObject
NtCreateFile
RtlCreateSecurityDescriptor
NtCreateSymbolicLinkObject
RtlFreeSid
NtOpenDirectoryObject
NtClose
RtlAllocateAndInitializeSid
RtlAddAccessAllowedAceEx
NtSetInformationToken
RtlConvertSidToUnicodeString
RtlSetDaclSecurityDescriptor
RtlAddAccessAllowedAce
RtlAddAce
RtlGetAce
RtlCreateAcl
RtlQueryInformationAcl
RtlLengthSid
RtlCapabilityCheck
NtQueryInformationToken
NtSetInformationProcess
RtlSetProcessIsCritical
RtlCheckSandboxedToken
RtlInitUnicodeString
RtlNtStatusToDosError
RtlIsCapabilitySid
RtlValidSid
RtlEqualSid
NtCompareTokens
RtlRandomEx
RtlSubscribeWnfStateChangeNotification
RtlQueryWnfStateData
NtAllocateLocallyUniqueId
RtlInitString
RtlIsMultiSessionSku
RtlUnsubscribeWnfStateChangeNotification
RtlGetDeviceFamilyInfoEnum
RtlPublishWnfStateData
RtlGetCurrentServiceSessionId
NtQuerySystemInformation
NtCreateDirectoryObjectEx
RtlQueryElevationFlags
RtlDeriveCapabilitySidsFromName
NtDeviceIoControlFile
NtOpenFile
RtlRunOnceExecuteOnce
RtlQueryRegistryValuesEx
RtlFreeHeap
combase
ord69
ord68
ord66
ord67
msvcp_win
?setf@ios_base@std@@QEAAHH@Z
?setf@ios_base@std@@QEAAHHH@Z
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?_Xlength_error@std@@YAXPEBD@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?_Xbad_function_call@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
DllGetClassObject
ServiceMain
Name
.text
Size
960KB
Virtual Size
957KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
348KB
Virtual Size
345KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
48KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=101, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=16, id=260, version=33145,
count=5, id=259, version=33145,
count=1585, id=1, productName=Unmarked objects,
count=6, id=257, version=33145,
count=35, id=261, version=33145,
count=1, id=256, version=33145,
count=99, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
usermgrcli.dll
- IMPHASH 0b09b53321b6dff98f512760e139808f
- SHA256 8f36df633756eecef02a2c606a7c5ab7ba032bbb164709c4977a8b26b0232b89
- MD5 0097f2e45943dd0b0bf26e89f03f500a
- SHA1 5324c65c4310b76f52db12c51b098779e61cbb4f
- SHA512 d37d75fb183fcf6caaa0bfda8e16313547706ee62a619faaf2472179b0f4763c2847910315ca73241db8f103dbdef2906427f15bef276c0258383d68708e1007
- SSDEEP 1536:hi4OpyMWYCjcAmKcC+bBRkD2ug29lmKPHlveIP4oz4:wBOjcAD+83HmyHl7Qo8
- TLSH T12CA3394AA3682094E43A907C80974E2ADB71F570575253DF2690C2BD5F337C86F3AEA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
45:c7:77:d4:65:74:e9:18:11:c3:84:1a:35:fe:6e:ca:48:7d:82:9d:f1:81:56:a4:54:6b:bc:88:77:26:85:e1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 21, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:18:41:84:19:ad:cb:ad:29:4f:00:00:00:00:05:18
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 19, 2025 - Jun 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6F1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1c:09:55:15:d7:c3:59:07:d1:00:01:00:00:02:1c
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
22208
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
usermgrcli.pdb
msvcrt
memmove
_XcptFilter
_callnewh
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
__CxxFrameHandler4
malloc
free
??0exception@@QEAA@AEBV0@@Z
_initterm
?terminate@@YAXXZ
_lock
??0exception@@QEAA@XZ
__CxxFrameHandler3
??1exception@@UEAA@XZ
memcpy
_unlock
_amsg_exit
__dllonexit
_CxxThrowException
_onexit
_purecall
??3@YAXPEAX@Z
memcpy_s
??1type_info@@UEAA@XZ
_vsnwprintf
__C_specific_handler
?what@exception@@UEBAPEBDXZ
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameA
api-ms-win-core-synch-l1-1-0
WaitForSingleObject
ReleaseMutex
CreateMutexExW
ReleaseSemaphore
CreateSemaphoreExW
OpenSemaphoreW
WaitForSingleObjectEx
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcess
OpenProcessToken
GetCurrentProcessId
GetCurrentThreadId
rpcrt4
NdrClientCall3
RpcBindingFromStringBindingW
RpcStringBindingComposeW
I_RpcExceptionFilter
RpcBindingSetAuthInfoExW
RpcBindingFree
RpcStringFreeW
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-security-base-l1-1-0
CreateWellKnownSid
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
ntdll
RtlIsMultiSessionSku
RtlGetCurrentServiceSessionId
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
IsInteractiveUserSession
QueryActiveSession
QueryUserToken
RegisterUsertokenForNoWinlogon
UMgrChangeSessionActiveShellUser
UMgrChangeSessionUserToken
UMgrClearDefaultSignInAccount
UMgrConnectLocalUser
UMgrDisconnectLocalUser
UMgrEnumerateSessionUsers
UMgrFreeSessionUsers
UMgrFreeUserCredentials
UMgrGetCachedCredentials
UMgrGetConstrainedUserToken
UMgrGetDefaultSignInAccount
UMgrGetImpersonationTokenForContext
UMgrGetSessionActiveShellUserToken
UMgrGetStandardAccessImpersonationTokenForContext
UMgrInformFlags
UMgrInformSecondaryUserLogoff
UMgrInformSecondaryUserLogon
UMgrInformUserLogoff
UMgrInformUserLogon
UMgrIsAllowedToActivateAsUser
UMgrLaunchShell
UMgrLaunchShellInfrastructureHost
UMgrLogonUser
UMgrOpenProcessHandleForAccess
UMgrOpenProcessTokenForQuery
UMgrQueryDefaultAccountToken
UMgrQuerySessionUserToken
UMgrQuerySessionVirtualAccountToken
UMgrQueryUserContext
UMgrQueryUserContextFromName
UMgrQueryUserContextFromSid
UMgrQueryUserToken
UMgrQueryUserTokenFromName
UMgrQueryUserTokenFromSid
UMgrSetCachedCredentials
UMgrSetShellInformation
UMgrpGetRegistryLocation
Name
.text
Size
36KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=42, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=15, id=260, version=33145,
count=88, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=7, id=261, version=33145,
count=1, id=256, version=33145,
count=6, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
usoapi.dll
- IMPHASH 6f1e24089caf2b2a9c90b516eeadac8a
- SHA256 21390119b79818b7a8c0af521cebb304552d222667e1106d141a3fb36703838b
- MD5 0ab9cbcbf403c84ea3b83d76c5e5338b
- SHA1 84d2296c47b3f17ce581283502cd3dc1da9630af
- SHA512 db29a6bafa074d80c81fb62f2932700fbbdeb650344d1bc11d6f8cec67160c3667b356aac10ea38ff38b02643db69e59fc4cb91e0d74fa4630a23b4ab294df24
- SSDEEP 6144:2HtKKegt/PTI5cCdC+iXIzO3pcQUfBAZ7OZYiXY:atPebkTi
- TLSH T1A5247F0BA9110467CF3DA27884878A49E3B6AC54939643CB0164667DDE3F3CC7F76BA4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5664
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
UsoApi.pdb
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
memcmp
_o__errno
_o__wcsicmp
_o_free
_o_malloc
_o_terminate
_o_wcsncpy_s
__current_exception
__current_exception_context
_CxxThrowException
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__crt_atexit
_o__configure_narrow_argv
__C_specific_handler
_o__cexit
__std_terminate
_o__callnewh
__CxxFrameHandler4
memcpy
_o__execute_onexit_table
__C_specific_handler_noexcept
_o___stdio_common_vswprintf
oleaut32
VariantClear
VariantInit
BSTR_UserSize
BSTR_UserFree
SystemTimeToVariantTime
BSTR_UserUnmarshal64
BSTR_UserUnmarshal
BSTR_UserMarshal
BSTR_UserFree64
LoadTypeLi
LoadRegTypeLi
SysStringLen
BSTR_UserSize64
BSTR_UserMarshal64
VARIANT_UserSize64
VarUI4FromStr
VARIANT_UserMarshal64
VARIANT_UserFree
VARIANT_UserUnmarshal
VARIANT_UserSize
VARIANT_UserMarshal
VARIANT_UserFree64
SysFreeString
VARIANT_UserUnmarshal64
rpcrt4
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
NdrStubForwardingFunction
NdrStubCall3
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrOleFree
IUnknown_QueryInterface_Proxy
NdrOleAllocate
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetModuleHandleW
LoadLibraryExW
DisableThreadLibraryCalls
SizeofResource
FreeLibrary
GetProcAddress
GetModuleFileNameA
FindResourceExW
LoadResource
GetModuleFileNameW
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoCreateFreeThreadedMarshaler
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-errorhandling-l1-1-0
GetLastError
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegCreateKeyExW
RegDeleteValueW
RegQueryInfoKeyW
RegEnumKeyExW
RegSetValueExW
RegCloseKey
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
ReleaseSemaphore
LeaveCriticalSection
CreateSemaphoreExW
WaitForSingleObject
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
DeleteCriticalSection
InitializeCriticalSection
CreateMutexExW
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-service-management-l2-1-0
QueryServiceConfig2W
ChangeServiceConfigW
QueryServiceConfigW
ChangeServiceConfig2W
api-ms-win-service-management-l1-1-0
OpenSCManagerW
StartServiceW
OpenServiceW
CloseServiceHandle
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-sysinfo-l1-2-0
VerSetConditionMask
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-service-winsvc-l1-1-0
QueryServiceStatus
api-ms-win-security-base-l1-1-0
FreeSid
AllocateAndInitializeSid
CheckTokenMembership
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
api-ms-win-core-kernel32-legacy-l1-1-1
VerifyVersionInfoW
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
52KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
124KB
Virtual Size
123KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=73, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=1223, id=1, productName=Unmarked objects,
count=2, id=257, version=33145,
count=30, id=261, version=33145,
count=1, id=256, version=33145,
count=28, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
usocoreps.dll
- IMPHASH 39e98e7eb57424decc8d617729fdb8ff
- SHA256 c71a63e503dcaad929e82e6962a562672c0b37cb7664b28748abb60b8d2180e7
- MD5 70d15022f3538ba2a9fa4676682bd628
- SHA1 53e0b6f6667c0784909c9231bc82a7055d821ee9
- SHA512 cc5ad0a67d9315f310e4ad1caa8179f57cbf0d3f38e2218594ba447836a1e90d99dce88a46466645628f1cdee5c61ac24558d1e7cd7321657d46799957d2b8db
- SSDEEP 1536:vBfSDp1gWeNweXePeNeEecExXjv+DNL9BGrg:vBSl1gpmsNL9Yrg
- TLSH T17653185EFB8860AAD1399179C5A70E08E37AF420930257EF02E4513E5E73BD5AF34B85
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5312
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
UsoCorePS.pdb
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
memcpy
_o_free
_o_malloc
_o_wcsncpy_s
_CxxThrowException
_o__callnewh
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__C_specific_handler
__CxxFrameHandler4
__C_specific_handler_noexcept
oleaut32
BSTR_UserMarshal
BSTR_UserSize64
BSTR_UserMarshal64
VarUI4FromStr
BSTR_UserSize
BSTR_UserFree
BSTR_UserFree64
BSTR_UserUnmarshal
BSTR_UserUnmarshal64
rpcrt4
NdrOleAllocate
NdrDllCanUnloadNow
NdrOleFree
NdrDllGetClassObject
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameW
GetProcAddress
LoadResource
GetModuleHandleW
SizeofResource
FindResourceExW
DisableThreadLibraryCalls
FreeLibrary
LoadLibraryExW
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
api-ms-win-core-registry-l1-1-0
RegEnumKeyExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegCreateKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
api-ms-win-core-errorhandling-l1-1-0
GetLastError
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
20KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=49, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1145, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=23, id=261, version=33145,
count=1, id=256, version=33145,
count=7, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
usodocked.dll
- IMPHASH b3640593243308a6f17cfc58ffa40c1d
- SHA256 14a86eb828cce2ea91c310a4db9ed70a82e1891fc7459ccc6ac0a7a28a1f22c4
- MD5 f3859df4530a4fe95cfb474ae6db9f45
- SHA1 56b5646e0050f6d360da7e675b4c1448ede6c5a2
- SHA512 846f7bbb364104d51bd2fcd1e65eba15c6c60af9f5722f3d273db0f022f9bed7378a5db21f9c5265112528dc7e6517fe9ea6e85b2c15ca1e3d4eb314aa267ab0
- SSDEEP 12288:z77c9HS/lYOK5kOBSQJQgCu3A+vmzZ+sX8QOT6TSKL:/xlTK+O8QQgCGAZIsXTSK
- TLSH T1C5E43A1EA2FC01A5E175D1BD8A434516EAB37825533296CB025082BD5E3BFEC5B3EF21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
29248
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
UsoDocked.pdb
msvcp_win
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA_N_N@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$ctype@G@std@@2V0locale@2@A
?widen@?$ctype@G@std@@QEBAGD@Z
_Thrd_join
_Thrd_id
_Cnd_do_broadcast_at_thread_exit
??Bid@locale@std@@QEAA_KXZ
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@N@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@J@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@I@Z
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
_Xtime_get_ticks
_Cnd_timedwait
_Query_perf_frequency
_Query_perf_counter
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?_Xbad_function_call@std@@YAXXZ
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
_Cnd_unregister_at_thread_exit
?good@ios_base@std@@QEBA_NXZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?get@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@PEBG4@Z
?_Getcat@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?__ExceptionPtrToBool@@YA_NPEBX@Z
_Thrd_sleep
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?_Xlength_error@std@@YAXPEBD@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBGHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
_Cnd_register_at_thread_exit
_Thrd_yield
?_Winerror_map@std@@YAHH@Z
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
_Cnd_signal
?_Syserror_map@std@@YAPEBDH@Z
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
??0task_continuation_context@Concurrency@@AEAA@XZ
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
_Cnd_wait
_Cnd_broadcast
_Mtx_unlock
_Mtx_lock
?_Throw_Cpp_error@std@@YAXH@Z
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
_Cnd_destroy_in_situ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
_Cnd_init_in_situ
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
_Mtx_current_owns
_Mtx_init_in_situ
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
_Mtx_destroy_in_situ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@H@Z
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__free_locale
_o__fseeki64
_o__get_stream_buffer_pointers
_o__i64toa_s
_o__i64tow_s
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__localtime64_s
_o__lock_file
_o__mktime64
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__ui64toa_s
_o__ui64tow_s
_o__unlock_file
_o__wcsicmp
memcmp
_o__wcsnicmp
_o__wcstod_l
_o__wtoi
_o__wtol
_o_abort
_o_exit
_o_fclose
_o_fflush
_o_fgetc
_o_fgetpos
_o_fputc
_o_fread
_o_free
_o_fsetpos
_o_fwrite
_o_iswspace
_o_malloc
_o_setvbuf
_o_terminate
_o_tolower
_o_towlower
_o_ungetc
_o_wcsftime
__C_specific_handler
__CxxFrameHandler3
__current_exception
__current_exception_context
_CxxThrowException
_o__crt_atexit
_o__create_locale
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnwprintf_s
_o__configure_narrow_argv
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___pctype_func
_o__cexit
_o__callnewh
_o__beginthreadex
_o____lc_codepage_func
__std_terminate
__CxxFrameHandler4
memmove
memcpy
api-ms-win-crt-string-l1-1-0
memset
wcsnlen
strnlen
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameW
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
FreeLibrary
GetModuleFileNameA
GetModuleHandleW
DisableThreadLibraryCalls
LoadStringW
api-ms-win-core-synch-l1-1-0
AcquireSRWLockShared
ReleaseSemaphore
EnterCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
WaitForSingleObject
ReleaseMutex
CreateSemaphoreExW
LeaveCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
OpenSemaphoreW
CreateEventW
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
CreateMutexExW
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
SetLastError
RaiseException
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
TrySubmitThreadpoolCallback
WaitForThreadpoolTimerCallbacks
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetExitCodeProcess
CreateProcessAsUserW
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
OpenProcessToken
SetPriorityClass
SetThreadPriority
GetCurrentThread
OpenThreadToken
api-ms-win-core-localization-l1-2-0
GetLocaleInfoEx
FormatMessageA
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
oleaut32
SysFreeString
SysAllocString
VariantInit
VariantTimeToSystemTime
GetErrorInfo
SetErrorInfo
VariantClear
SysStringLen
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
CompareStringW
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventWriteTransfer
EventRegister
EventUnregister
EventActivityIdControl
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetVersionExW
GetSystemTimeAsFileTime
GlobalMemoryStatusEx
GetSystemInfo
GetSystemDirectoryW
GetSystemTime
api-ms-win-security-base-l1-1-0
GetTokenInformation
ImpersonateLoggedOnUser
RevertToSelf
AllocateAndInitializeSid
DuplicateTokenEx
GetLengthSid
CopySid
FreeSid
AdjustTokenPrivileges
CheckTokenMembership
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-registry-l1-1-0
RegDeleteTreeW
RegQueryInfoKeyW
RegEnumKeyExW
RegCopyTreeW
RegDeleteValueW
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegGetValueW
RegCloseKey
RegCreateKeyExW
api-ms-win-core-processthreads-l1-1-3
SetProcessInformation
api-ms-win-core-processthreads-l1-1-2
SetThreadInformation
api-ms-win-core-com-l1-1-0
CoGetApartmentType
CoGetObjectContext
CoCreateFreeThreadedMarshaler
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
api-ms-win-core-sysinfo-l1-2-0
VerSetConditionMask
GetProductInfo
api-ms-win-core-localization-l1-2-3
GetUserDefaultGeoName
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
GetEnvironmentVariableW
SetEnvironmentVariableW
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedPushEntrySList
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFindFileNameW
ntdll
RtlQueryPackageIdentity
NtQueryWnfStateData
RtlUnsubscribeWnfStateChangeNotification
RtlSubscribeWnfStateChangeNotification
DbgPrintEx
RtlFreeHeap
RtlReAllocateHeap
RtlAllocateHeap
RtlRaiseStatus
NtIsSystemResumeAutomatic
RtlPublishWnfStateData
NtSetInformationThread
NtSetInformationProcess
NtPowerInformation
RtlGetDeviceFamilyInfoEnum
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
api-ms-win-core-sysinfo-l1-2-1
GetPhysicallyInstalledSystemMemory
api-ms-win-core-file-l1-1-0
GetFileAttributesExW
FindFirstFileW
FindClose
GetDiskFreeSpaceExW
CreateFileW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-processtopology-obsolete-l1-1-0
GetActiveProcessorCount
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-psapi-l1-1-0
K32GetModuleFileNameExW
QueryFullProcessImageNameW
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-wow64-l1-1-1
IsWow64Process2
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
api-ms-win-core-kernel32-legacy-l1-1-1
PowerSetRequest
PowerCreateRequest
VerifyVersionInfoW
PowerClearRequest
api-ms-win-oobe-notification-l1-1-0
OOBEComplete
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
DllCanUnloadNow
DllGetClassObject
GetDockedComponent
IsCapabilityEnabled
Name
.text
Size
480KB
Virtual Size
478KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
140KB
Virtual Size
136KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
28KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
680B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=104, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=16, id=260, version=33145,
count=1535, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=44, id=261, version=33145,
count=7, id=259, version=33145,
count=1, id=256, version=33145,
count=62, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
usosvc.dll
- IMPHASH d8fec025a7b4406fe1c543e008625e62
- SHA256 c2ba76d0661a63220c4e38c6239ba869d0b97a4ba46d3ba14a97c3fc441b7f13
- MD5 52b107670442c8e80144f595919c8924
- SHA1 b685ee0caec995b11cb5747094a7697c152e4648
- SHA512 a1ddb2c87eca8522bd91337ba544e2c7f713add37c912e054bcfd5a6b4860e751bafa31b7b401014ea4331509979d47b0b5bfe0a80de9a9a08316393a19e86f5
- SSDEEP 1536:tDbf8GYPhgWnRUhXRVus2owZZqfCqa0zg96izOQVxlbyF+RZDrXpXVL:tDbNYirb5raUgkLaMF+R1rjL
- TLSH T1C7A32A7D32A820A6E476D17CC5860A0AE3B1B025531267EF43D081BE5F57BE46C3EFA1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
9760
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
USOSvc.pdb
msvcp_win
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_abort
_o_free
_o_malloc
__C_specific_handler
_CxxThrowException
_o__callnewh
_o___stdio_common_vswprintf
_o____lc_codepage_func
__std_terminate
__CxxFrameHandler4
_o__cexit
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleExW
GetModuleFileNameA
GetModuleHandleW
LoadLibraryExW
FreeLibrary
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
CreateMutexExW
InitializeCriticalSectionEx
EnterCriticalSection
WaitForSingleObjectEx
LeaveCriticalSection
ReleaseMutex
AcquireSRWLockShared
WaitForSingleObject
ReleaseSRWLockExclusive
ReleaseSemaphore
CreateSemaphoreExW
AcquireSRWLockExclusive
OpenSemaphoreW
ReleaseSRWLockShared
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetLocaleInfoEx
FormatMessageA
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoTaskMemFree
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-service-core-l1-1-0
RegisterServiceCtrlHandlerExW
SetServiceStatus
api-ms-win-core-wow64-l1-1-1
IsWow64Process2
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventRegister
EventWriteTransfer
EventUnregister
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-file-l1-1-0
CreateFileW
GetFileAttributesExW
FindFirstFileW
FindClose
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
DllCanUnloadNow
DllGetClassObject
DllMain
GeneralizeForImaging
ServiceMain
SvchostPushServiceGlobals
Name
.text
Size
60KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
308B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=62, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=1178, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=24, id=261, version=33145,
count=1, id=256, version=33145,
count=4, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
usp10.dll
- SHA256 23d73fc8824016734847593c0f7767e26d59f99984d8131d45913390d5b7d62b
- MD5 228db6762f62cae20a05f2ec78a55fa3
- SHA1 0c882bab2d7442c32bb3d3e5a9ab7a2134cd9bfb
- SHA512 4d74ba0db1cac10b5bb9c88945eccb67f021efadec99d7454aaac0971860ff63b0aa1e00827a4ee34457413ec5c6736d7ae71e1fefd596bc81ea5cc873126bed
- SSDEEP 1536:7+qE+h5jTZWpwLrCziIK8+wv/O50y5FE2bdEGcToZAD56k8:6qE+hPL2zHoytG5dHJZE5d8
- TLSH T14BA3AE31ED806D3BE09A87BE02BBD77BD375AD248763139AB483730C19356D54B6431A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
usp10.pdb
LpkPresent
ScriptApplyDigitSubstitution
ScriptApplyLogicalWidth
ScriptBreak
ScriptCPtoX
ScriptCacheGetHeight
ScriptFreeCache
ScriptGetCMap
ScriptGetFontAlternateGlyphs
ScriptGetFontFeatureTags
ScriptGetFontLanguageTags
ScriptGetFontProperties
ScriptGetFontScriptTags
ScriptGetGlyphABCWidth
ScriptGetLogicalWidths
ScriptGetProperties
ScriptIsComplex
ScriptItemize
ScriptItemizeOpenType
ScriptJustify
ScriptLayout
ScriptPlace
ScriptPlaceOpenType
ScriptPositionSingleGlyph
ScriptRecordDigitSubstitution
ScriptShape
ScriptShapeOpenType
ScriptStringAnalyse
ScriptStringCPtoX
ScriptStringFree
ScriptStringGetLogicalWidths
ScriptStringGetOrder
ScriptStringOut
ScriptStringValidate
ScriptStringXtoCP
ScriptString_pLogAttr
ScriptString_pSize
ScriptString_pcOutChars
ScriptSubstituteSingleGlyph
ScriptTextOut
ScriptXtoCP
UspAllocCache
UspAllocTemp
UspFreeMem
Name
.text
Size
4KB
Virtual Size
118B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
64B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.00cfg
Size
4KB
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
72KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
44B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=259, version=33136,
count=4, id=260, version=33136,
count=1, id=256, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
ustprov.dll
- IMPHASH 7270a7b4a8823a3ff1490e56bc029356
- SHA256 39221fa14dfbd48451001214572c219233d7f79e759fd854a5112d495bd43e7f
- MD5 16cc5b45f6518a896387b36d2b6b0f31
- SHA1 2fc1592d473caef6e5c87d2ff7f6463acc58cc51
- SHA512 47984fe253b62fd674462723786f77709d24be50fd4e20cf458dde54e4ed201979aaad40dc346863fc26ca4c1605ceb3e35c153065789a294e51644ad8ce957e
- SSDEEP 3072:Id25KHpfmFMVVk+RB4k6NIlURq4EURQnbSPBgq:025KHpeF44bkLnnbSPe
- TLSH T101B32A2E72B830A9E6B6917C85560A15D7B1B035271257FF02E0C2BE5F13BE82E39F51
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5456
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ustprov.pdb
msvcrt
free
??0exception@@QEAA@AEBV0@@Z
_amsg_exit
??0exception@@QEAA@XZ
_vsnwprintf
?terminate@@YAXXZ
_lock
memcpy_s
_XcptFilter
_callnewh
memmove_s
_unlock
__C_specific_handler
??1type_info@@UEAA@XZ
??1exception@@UEAA@XZ
_initterm
_purecall
malloc
__CxxFrameHandler4
_CxxThrowException
_onexit
__CxxFrameHandler3
memcmp
__dllonexit
memset
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoGetCallContext
CoRevertToSelf
StringFromCLSID
CoCreateInstance
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegCloseKey
RegDeleteKeyExW
RegSetValueExW
RegOpenCurrentUser
RegOpenKeyExW
RegDeleteValueW
RegEnumValueW
RegQueryValueExW
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
OpenThreadToken
SetThreadToken
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentThread
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetProcAddress
GetModuleFileNameW
GetModuleFileNameA
GetModuleHandleW
DisableThreadLibraryCalls
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
WideCharToMultiByte
api-ms-win-core-errorhandling-l1-1-0
SetLastError
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-synch-l1-1-0
OpenSemaphoreW
WaitForSingleObject
DeleteCriticalSection
ReleaseSemaphore
ReleaseMutex
ReleaseSRWLockShared
CreateMutexExW
ReleaseSRWLockExclusive
LeaveCriticalSection
WaitForSingleObjectEx
AcquireSRWLockExclusive
AcquireSRWLockShared
EnterCriticalSection
InitializeCriticalSectionEx
CreateSemaphoreExW
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-security-base-l1-1-0
ImpersonateLoggedOnUser
RevertToSelf
GetTokenInformation
CheckTokenMembership
IsValidSid
oleaut32
VariantClear
SysAllocStringLen
SafeArrayGetElement
SafeArrayPutElement
SafeArrayCreateVector
SafeArrayRedim
SafeArrayDestroy
VariantInit
SafeArrayGetUBound
SafeArrayUnlock
SafeArrayGetLBound
VariantCopyInd
SysFreeString
SafeArrayCopy
SysStringByteLen
SafeArrayGetVartype
SysAllocString
VariantCopy
SafeArrayLock
SysStringLen
SafeArrayCreate
VariantChangeType
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-security-sddl-l1-1-0
ConvertStringSidToSidW
api-ms-win-core-heap-l2-1-0
LocalFree
ntdll
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwTraceMessage
EtwUnregisterTraceGuids
shlwapi
SHDeleteKeyW
wtsapi32
WTSQueryUserToken
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
384B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=44, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=17, id=260, version=33145,
count=5, id=259, version=33145,
count=133, id=1, productName=Unmarked objects,
count=9, id=257, version=33145,
count=9, id=261, version=33145,
count=1, id=256, version=33145,
count=12, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
utcapi.dll
- IMPHASH d041d43346bd20862488ccbc05c59bc0
- SHA256 ba0dab038ffa2b8efba5e179b1ce9c24d869dd7cb8e24a7c66b306c4ba350dda
- MD5 e2c5156e5aa2664575695d73abc4fd1b
- SHA1 4a337c1fd4612e96d3ff9b51f1afa65c77c25c68
- SHA512 9211681a167e5b924ee2e48836478978376d24df13d51e9f17f7f4dd11cc15f44635338e84951dc59a006a015b5ffee35040d129a14994dc303b6463590a8b4c
- SSDEEP 384:NWDHMaG4nz0FXjJ1CpHeGZvh9RUlEK2HmNZ6C930E5+zSKWwgjWPyYu6/vDBRJQ9:YfKjGl/Zvh9RUv2GNZFJ+zgIZv1P/9z4
- TLSH T1B963298BA7450496E4BBC175819B4C36797DF9828B6207DB4AC0822C1E327D47F38EED
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
21:b5:d4:89:0e:03:32:47:fa:38:15:ea:40:ac:d5:53:8e:fe:05:88:54:aa:74:b5:b7:12:b8:e2:63:e4:ef:d5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:591A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:14:8d:cd:23:44:ee:06:df:72:00:01:00:00:02:14
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
5056
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
utcapi.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___stdio_common_vswprintf
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
_o_terminate
_o_wcscpy_s
_o___std_type_info_destroy_list
__C_specific_handler
__CxxFrameHandler3
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoTaskMemAlloc
rpcrt4
RpcStringFreeW
RpcBindingFromStringBindingW
NdrClientCall3
RpcStringBindingComposeW
RpcExceptionFilter
RpcBindingFree
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
UtcClearTimerConfiguration
UtcCloseSessionHandle
UtcCreateSessionHandle
UtcDownloadLatestSettingsForNamespaceEx
UtcEscalateScenarioEx
UtcForceUpload
UtcGetActiveScenarioList2
UtcGetTimerConfiguration
UtcIsScenarioActive
UtcSetTelemetryOptIn
UtcTenantRegister
UtcTenantUnregister
UtcTenantUpdateDailyUploadQuota
UtcUpdateTimerConfiguration
Name
.text
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
752B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=35, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1101, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=17, id=261, version=33145,
count=1, id=256, version=33145,
count=6, id=264, version=33145,
count=2, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
utcutil.dll
- IMPHASH b8bb8868bb0cacef2cd99f8f5f17d2ec
- SHA256 a1157715ce9be670207bd32b354d8febf7a9587da96f8ee82f49a6ce176b9330
- MD5 3e91b694b8c8e7c09b1c13ea1796a416
- SHA1 d3f35bbabf75d277b8bbfe99040308e26be7e87b
- SHA512 e11f2dbe51312a87aed37ba0d27bb3d3433db00ba0cdbb9b88476b3c650a056f30435eec595c1d9977aaf95a1b2b4a40fa746801c7b60580c9ac5a06df177d80
- SSDEEP 3072:s8opbGr4zXbDIO4ewjqeZF4ao/vvTCduVNgGWl:7r4TIhJduVNgGW
- TLSH T103F3392E72E901B6E5B6D07CC983061AE3B27465032243DF429082BE5F57FE8AD3DB51
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
10400
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
utcutil.pdb
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_lock
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_unlock
?_Xbad_function_call@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
api-ms-win-crt-string-l1-1-0
memset
strcspn
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__get_errno
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
memmove
_o__wcsicmp
_o__wcsnicmp
_o_abort
_o_free
_o_iswspace
_o_malloc
_o_terminate
_o_tolower
_o_towlower
_o_towupper
_o_wcscpy_s
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__cexit
_o__callnewh
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___stdio_common_vswprintf_s
__std_terminate
__CxxFrameHandler4
_o___stdio_common_vswprintf
memcmp
memcpy
ntdll
RtlGetVersion
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlConvertDeviceFamilyInfoToString
NtQueryInformationProcess
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
FreeLibrary
DisableThreadLibraryCalls
GetModuleHandleW
GetModuleFileNameA
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-synch-l1-1-0
CreateSemaphoreExW
LeaveCriticalSection
WaitForSingleObject
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
ReleaseMutex
EnterCriticalSection
ReleaseSRWLockShared
ReleaseSemaphore
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventRegister
EventWriteTransfer
EventSetInformation
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
TerminateProcess
OpenThreadToken
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringOrdinal
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
StringFromGUID2
CoTaskMemFree
CoCreateGuid
CLSIDFromString
CoTaskMemRealloc
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegCreateKeyExW
RegGetValueW
RegQueryValueExW
RegEnumValueW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
userenv
ExpandEnvironmentStringsForUserW
api-ms-win-core-sysinfo-l1-2-0
GetProductInfo
sspicli
GetUserNameExW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-security-sddl-l1-1-0
ConvertStringSidToSidW
api-ms-win-security-lsalookup-l2-1-0
LookupAccountSidW
api-ms-win-security-lsalookup-l1-1-2
LsaLookupUserAccountType
bcrypt
BCryptOpenAlgorithmProvider
BCryptHashData
BCryptCreateHash
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptDestroyHash
rpcrt4
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcBindingFree
RpcExceptionFilter
NdrClientCall3
RpcStringFreeW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
oleaut32
SetErrorInfo
SysFreeString
SysStringLen
DiskCleanupEnd
DiskCleanupStart
GetCommonAttributes
GetPropertyAlloc
Name
.text
Size
88KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
36KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=76, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=11, id=260, version=33145,
count=5, id=259, version=33145,
count=1202, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=26, id=261, version=33145,
count=1, id=256, version=33145,
count=14, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
utildll.dll
- IMPHASH 9ae444748afd27e5604c0837a8503af4
- SHA256 0fc114defa66d2e83c4589b1f615b780248d7d6359ad40be6a88ff01d68fb7e5
- MD5 f0b225b936549f883e8ecef978b6c178
- SHA1 9d24c19d0a2670a931fec3be0c292430083ab211
- SHA512 e316993b1f4393f2d86f9a22393ead8a9325297a6797460268c21cea376ca6d574fc4ad21555f031aad7d46d8e2fa6882861d610ae0380d305c1aefe1ee31f39
- SSDEEP 768:oGEhs9oYl/HvHQg0+J4ftSxUFBOTq4s8eWIht01PLFT9zM:NEq/JPHQgUSaFBOTq4xeWInEPLTzM
- TLSH T1ED73494D67F83095E97B8638816A8A42E976757113506AFF02E0C37D9F637C1EA38F01
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
13:1e:d8:34:4d:dd:81:8d:30:7b:33:fd:fa:9e:d8:9d:6c:ae:d9:6c:86:c3:ee:f8:d8:ac:0e:4f:2e:d9:ac:9e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 1, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8D00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:f3:c5:0a:43:ae:03:cc:1d:31:00:01:00:00:01:f3
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
9552
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
utildll.pdb
ntdll
__chkstk
RtlEnterCriticalSection
RtlInitializeCriticalSection
RtlLeaveCriticalSection
_wcsnicmp
NtQueryVolumeInformationFile
wcsrchr
memcpy
strstr
wcsstr
RtlFreeSid
swprintf_s
_wcslwr
RtlAllocateAndInitializeSid
vswprintf_s
wcscat_s
wcscpy_s
_wcsicmp
memcpy_s
_vsnwprintf
__C_specific_handler
memset
msvcrt
malloc
_amsg_exit
fwprintf
_XcptFilter
_initterm
__iob_func
free
kernel32
ResolveDelayLoadedAPI
DelayLoadFailureHook
QueryDosDeviceW
SetLastError
LocalAlloc
CreateFileW
MultiByteToWideChar
FormatMessageW
GetLastError
FileTimeToSystemTime
GlobalAlloc
GlobalFree
CloseHandle
LoadLibraryW
FileTimeToLocalFileTime
GetLocalTime
GetDefaultCommConfigW
GetProcAddress
LocalFree
GetTimeFormatW
SetDefaultCommConfigW
SystemTimeToFileTime
GetModuleHandleW
FreeLibrary
WideCharToMultiByte
CommConfigDialogW
lstrcmpiW
GetDateFormatW
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetTickCount
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
QueryPerformanceCounter
advapi32
EqualSid
CopySid
GetLengthSid
RegEnumValueW
LookupAccountSidW
LsaClose
LsaOpenPolicy
LsaQueryInformationPolicy
RegOpenKeyExW
RegOpenKeyExA
CheckTokenMembership
RegEnumKeyExW
RegQueryValueExA
RegQueryValueExW
RegCloseKey
LsaFreeMemory
winsta
WinStationQueryInformationW
user32
LoadStringW
LoadCursorW
SetCursor
MessageBoxW
samcli
NetLocalGroupGetMembers
netutils
NetApiBufferFree
AsyncDeviceEnumerate
CachedGetUserFromSid
CalculateDiffTime
CalculateElapsedTime
CompareElapsedTime
ConfigureModem
CurrentDateTimeString
DateTimeString
ElapsedTimeString
EnumerateMultiUserServers
FormDecoratedAsyncDeviceName
GetAssociatedPortName
GetSystemMessageA
GetSystemMessageW
GetUnknownString
GetUserFromSid
HaveAnonymousUsersChanged
InitializeAnonymousUserCompareList
InstallModem
IsPartOfDomain
NetBIOSDeviceEnumerate
NetworkDeviceEnumerate
ParseDecoratedAsyncDeviceName
QueryCurrentWinStation
RegGetNetworkDeviceName
RegGetNetworkServiceName
StandardErrorMessage
StrAsyncConnectState
StrConnectState
StrProcessState
StrSdClass
StrSystemWaitReason
TestUserForAdmin
WinEnumerateDevices
Name
.text
Size
24KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
912B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=261, version=33136,
count=1, productName=Unmarked objects (old),
count=4, id=259, version=33136,
count=15, id=260, version=33136,
count=17, id=257, version=33136,
count=119, id=1, productName=Unmarked objects,
count=1, id=256, version=33136,
count=5, id=264, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
uudf.dll
- IMPHASH c7bb46e14be6fcfef8507074a9a08f8a
- SHA256 5e5ef362ba42c35acfa86a412beccf5825ea07ea292b5a511edc2d19c318e914
- MD5 f7ad7b7bfccca2a3813cdd435619bd5f
- SHA1 584f5ec1f3eb3227bc2a4634fac36b9dbf389a5f
- SHA512 9512612f9bf0f4c7a3afa5da9d78a881f1b812be9409827680647c6c42515da28d02423abb274188bca662e82a6bc86e8e5985448c087b9c4be8062d4e02d651
- SSDEEP 3072:bDZybjWkFq0CbOLJ7SN3zK0z9LgXpLiAfThCTfMD4Huqps+RjUexS:QbvaoJ7SN3WW98hSOwx
- TLSH T1AE146B2EA2AA20F9C4A7D1BCD4420547EBF33425132A5AEF21F1C5755F037E8B53CA99
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4752
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
uudf.pdb
msvcrt
memset
memcmp
memcpy
memmove
_initterm
malloc
free
_amsg_exit
_XcptFilter
_vsnprintf
_vsnwprintf
__C_specific_handler
ntdll
RtlFreeHeap
RtlNumberGenericTableElementsAvl
NtQuerySystemTime
RtlSystemTimeToLocalTime
RtlTimeToTimeFields
DbgPrint
RtlRaiseStatus
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlAllocateHeap
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
GetTraceEnableFlags
TraceMessage
UnregisterTraceGuids
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetLastError
SetErrorMode
GetLastError
SetUnhandledExceptionFilter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetWindowsDirectoryW
GetTickCount
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
ulib
??1MESSAGE@@UEAA@XZ
??0MESSAGE@@QEAA@XZ
?DisplayMsg@MESSAGE@@QEAAEKW4MESSAGE_TYPE@@K@Z
?Initialize@WSTRING@@QEAAEPEBV1@KK@Z
?Stricmp@WSTRING@@QEBAJPEBV1@@Z
?Initialize@WSTRING@@QEAAEPEBGK@Z
?MakeFileToken@MESSAGE@@SA_KPEBD@Z
?DisplayMsg@MESSAGE@@QEAAEKW4MESSAGE_TYPE@@KPEBDZZ
?QueryString@WSTRING@@QEBAPEAV1@KK@Z
?Display@MESSAGE@@QEAAEPEBDZZ
?DisplayMsg@MESSAGE@@QEAAEK@Z
?Initialize@HMEM@@QEAAEXZ
??1HMEM@@UEAA@XZ
??0HMEM@@QEAA@XZ
??0LIST@@QEAA@XZ
?FindNext@ITERATOR@@UEAAPEAVOBJECT@@PEBV2@@Z
?Initialize@FSTRING@@QEAAPEAVWSTRING@@PEAGK@Z
??0FSTRING@@QEAA@XZ
??1DSTRING@@UEAA@XZ
??0DSTRING@@QEAA@XZ
?DisplayMsg@MESSAGE@@QEAAEKPEBDZZ
?DebugDump@OBJECT@@UEBAXE@Z
?Compare@OBJECT@@UEBAJPEBV1@@Z
UlibRealloc
??1OBJECT@@UEAA@XZ
??0OBJECT@@IEAA@XZ
??1ITERATOR@@UEAA@XZ
??1LIST@@UEAA@XZ
?Initialize@LIST@@QEAAEXZ
?QueryIterator@LIST@@UEBAPEAVITERATOR@@XZ
?DeleteAllMembers@SEQUENTIAL_CONTAINER@@UEAAEXZ
??0MEM_ALLOCATOR@@QEAA@XZ
??1MEM_ALLOCATOR@@UEAA@XZ
?Initialize@MEM_ALLOCATOR@@QEAAE_KK@Z
?Allocate@MEM_ALLOCATOR@@QEAAPEAXK@Z
??0ITERATOR@@IEAA@XZ
??1FSTRING@@UEAA@XZ
ifsutil
?Write@IO_DP_DRIVE@@QEAAEVBIG_INT@@KPEAX@Z
?QueryUdfMediaSupportsBackgroundFormat@DP_DRIVE@@QEAAEXZ
?WaitForUnit@DP_DRIVE@@QEAAEPEAVMESSAGE@@@Z
?Recover@VOL_LIODPDRV@@QEAAEPEBVWSTRING@@PEAVMESSAGE@@@Z
?DismountVolume@IFS_SYSTEM@@SAEPEBVWSTRING@@@Z
?QueryUdfMediaNeedsVat@DP_DRIVE@@QEAAEXZ
?QueryUdfMediaNeedsSparing@DP_DRIVE@@QEAAEXZ
?Format@VOL_LIODPDRV@@QEAA?AW4FORMAT_ERROR_CODE@@PEBVWSTRING@@PEAVMESSAGE@@KKK@Z
?QueryUdfMediaNeedsLowLevelFormat@DP_DRIVE@@QEAAEXZ
?Initialize@DP_DRIVE@@QEAAEPEBVWSTRING@@PEAVMESSAGE@@EE@Z
??0DP_DRIVE@@QEAA@XZ
?QueryUdfMediaType@DP_DRIVE@@QEAAKXZ
?QueryRewritableMOSupport@DP_DRIVE@@QEAAEXZ
?DismountAndLock@IO_DP_DRIVE@@QEAAEXZ
?DosDriveNameToNtDriveName@IFS_SYSTEM@@SAEPEBVWSTRING@@PEAV2@@Z
?PowForceAllocation@IO_DP_DRIVE@@QEAAEKKPEAKW4NwaType@DP_DRIVE@@@Z
?EliminateCycles@DIGRAPH@@QEAAEPEAVCONTAINER@@PEAE@Z
?RemoveEdge@DIGRAPH@@QEAAEKK@Z
?QueryParents@DIGRAPH@@QEBAEKPEAVNUMBER_SET@@@Z
?Remove@NUMBER_SET@@QEAAEPEBV1@@Z
?QueryParentsWithChildren@DIGRAPH@@QEBAEPEAVNUMBER_SET@@K@Z
?QueryNumParents@DIGRAPH@@QEBAKK@Z
?QueryNumber@NUMBER_SET@@QEBA?AVBIG_INT@@V2@@Z
?QueryChildren@DIGRAPH@@QEBAEKPEAVNUMBER_SET@@@Z
?ChkDsk@VOL_LIODPDRV@@QEAAEW4FIX_LEVEL@@PEAVMESSAGE@@KKGPEAKPEBVWSTRING@@@Z
?Lock@IO_DP_DRIVE@@QEAAEXZ
?SetFileSystemName@VOL_LIODPDRV@@QEAAEPEBG@Z
?Write@SECRUN@@UEAAEXZ
?Initialize@SECRUN@@QEAAEPEAVMEM@@PEAVIO_DP_DRIVE@@VBIG_INT@@K@Z
??1SECRUN@@UEAA@XZ
??0SECRUN@@QEAA@XZ
?Read@IO_DP_DRIVE@@QEAAEVBIG_INT@@KPEAX@Z
??1NUMBER_SET@@UEAA@XZ
?Add@NUMBER_SET@@QEAAEVBIG_INT@@@Z
?CheckAndRemove@NUMBER_SET@@QEAAEVBIG_INT@@PEAE@Z
?QueryEccBlockSizeInSectors@DP_DRIVE@@QEAAGXZ
?AddEdge@DIGRAPH@@QEAAEKK@Z
?QueryDisjointRange@NUMBER_SET@@QEBAXKPEAVBIG_INT@@0@Z
?Initialize@NUMBER_SET@@QEAAEXZ
??0NUMBER_SET@@QEAA@XZ
?Add@NUMBER_SET@@QEAAEVBIG_INT@@0@Z
?Remove@NUMBER_SET@@QEAAEVBIG_INT@@0@Z
?DoesIntersectSet@NUMBER_SET@@QEBAEVBIG_INT@@0@Z
?QueryUdfMediaHasPow@DP_DRIVE@@QEAAEXZ
?ReinitiateBackgroundFormat@DP_DRIVE@@QEAAEXZ
?QueryUdfMediaSupportsQuickGrow@DP_DRIVE@@QEAAEXZ
?ReadFormattableCapacity@DP_DRIVE@@QEAAEEPEAKPEAE0@Z
?QueryVolumeBounds@DP_DRIVE@@QEAAEPEAK0@Z
?QueryNextWritableAddress@DP_DRIVE@@QEAAEPEAKW4NwaType@1@@Z
?QueryFreeBlocksInLastTrack@DP_DRIVE@@QEAAEPEAK@Z
?SendPowLowLevelFormat@DP_DRIVE@@QEAAEPEAVMESSAGE@@@Z
?WriteEntireDrive@VOL_LIODPDRV@@UEAA?AW4FORMAT_ERROR_CODE@@PEAVMESSAGE@@PEAXKII@Z
?QueryNativeNVMe@DP_DRIVE@@UEAAEPEAE@Z
?QueryBusType@DP_DRIVE@@UEAAEPEAW4_STORAGE_BUS_TYPE@@@Z
?QueryPartitionInfo@DP_DRIVE@@UEAAEPEAU_PARTITION_INFORMATION_EX@@@Z
?QueryTierCount@DP_DRIVE@@UEAAJPEAK@Z
?QueryReadCacheSize@DP_DRIVE@@UEAAJPEA_K@Z
?QueryDataRedundancyCount@DP_DRIVE@@UEAAJPEAK0@Z
?QuerySectors@DP_DRIVE@@UEBA?AVBIG_INT@@XZ
?QueryWriteBlockSize@DP_DRIVE@@UEBAKXZ
?QuerySectorSize@DP_DRIVE@@UEBAKXZ
?Initialize@VOL_LIODPDRV@@IEAA?AW4FORMAT_ERROR_CODE@@PEBVWSTRING@@PEAVSUPERAREA@@PEAVMESSAGE@@EEW4_MEDIA_TYPE@@GEIEE@Z
??1VOL_LIODPDRV@@UEAA@XZ
??0VOL_LIODPDRV@@IEAA@XZ
?VerifyRead@SECRUN@@UEAAEPEAE@Z
?Read@SECRUN@@UEAAEXZ
?IsUdfMediaWritable@DP_DRIVE@@QEAAEXZ
?QueryDiscStatus@DP_DRIVE@@QEAAEPEAK0@Z
?Initialize@SUPERAREA@@IEAAEPEAVMEM@@PEAVLOG_IO_DP_DRIVE@@KPEAVMESSAGE@@@Z
??1SUPERAREA@@UEAA@XZ
??0SUPERAREA@@IEAA@XZ
?Initialize@DIGRAPH@@QEAAEK@Z
??1DIGRAPH@@UEAA@XZ
??0DIGRAPH@@QEAA@XZ
?FormatScaleTotalFreeClusters@IFS_SYSTEM@@SAE_K0PEAK1PEA_K2@Z
?WaitForWriteCompletion@DP_DRIVE@@QEAAEPEAVMESSAGE@@@Z
?FlushCache@IO_DP_DRIVE@@QEAAEXZ
?Initialize@READ_WRITE_CACHE@@QEAAEPEAVIO_DP_DRIVE@@KE@Z
??0READ_WRITE_CACHE@@QEAA@XZ
?Initialize@READ_MODIFY_WRITE_CACHE@@QEAAEPEAVIO_DP_DRIVE@@KKEE@Z
??0READ_MODIFY_WRITE_CACHE@@QEAA@XZ
?Initialize@POW_CACHE@@QEAAEKKKKK@Z
?Initialize@POW_CACHE@@QEAAEPEAVIO_DP_DRIVE@@@Z
??0POW_CACHE@@QEAA@XZ
?SetCache@IO_DP_DRIVE@@QEAAXPEAVDRIVE_CACHE@@@Z
?Initialize@WRITE_ONCE_CACHE@@QEAAEPEAVIO_DP_DRIVE@@KKK@Z
??0WRITE_ONCE_CACHE@@QEAA@XZ
?SetSectors@DP_DRIVE@@QEAAXVBIG_INT@@@Z
?QueryHighestTrackAddress@DP_DRIVE@@QEAAEPEAK@Z
?QueryLastWritableAddress@DP_DRIVE@@QEAAEPEAKW4NwaType@1@@Z
?SetPowTrackConfiguration@DP_DRIVE@@QEAAEE@Z
??0METADATA_PARTITION@@QEAA@XZ
??0UDF_LVOL@@QEAA@XZ
??0UDF_SA@@QEAA@XZ
??0UDF_VOL@@QEAA@XZ
??1METADATA_PARTITION@@UEAA@XZ
??1UDF_LVOL@@UEAA@XZ
??1UDF_SA@@UEAA@XZ
??1UDF_VOL@@UEAA@XZ
?CreateOnDisk@UDF_LVOL@@QEAAEPEAVUDF_SA@@PEAVMESSAGE@@PEAVVDS@@PEAUEXTENTAD@@K3@Z
?Initialize@UDF_SA@@QEAAEPEAVLOG_IO_DP_DRIVE@@PEAVMESSAGE@@G@Z
?Initialize@UDF_VOL@@QEAA?AW4FORMAT_ERROR_CODE@@PEBVWSTRING@@PEAVMESSAGE@@EGEEEE@Z
?ReadFromDisk@UDF_LVOL@@QEAAEPEAVUDF_SA@@PEAVMESSAGE@@PEAVVDS@@@Z
Chkdsk
ChkdskEx
Format
FormatEx
GetFilesystemInformation
Recover
Name
.text
Size
148KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
992B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
448B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=14, id=260, version=33138,
count=4, id=259, version=33138,
count=188, id=1, productName=Unmarked objects,
count=9, id=257, version=33138,
count=1, id=256, version=33138,
count=33, id=264, version=33138,
count=1, id=255, version=33138,
count=1, id=258, version=33138,
uxlib.dll
- IMPHASH a64c49b71e4e8f27a56ff5f1c2ddb200
- SHA256 ab33369fc073c4499119adc793a4c2d8ae4df164bc2e36a3b5e78ee5f787851e
- MD5 28b66a78f6c462ba01c6f29db61194fb
- SHA1 a66ec4022029da342546d5e089a778375fa7ca39
- SHA512 00ae418ab966061036f2d127db6cddffc51677fe9685d1ed4bf685de578f982099affe2c2aca42006a989b3910fe20dcf515c62f1ec19d65e8026bc707a1fd1c
- SSDEEP 3072:4u1RRH938kSG50HCBNjqNNc0RDoQuAHgEaP:4u1RJR8NG50HCmNPuAA7
- TLSH T16C04186633EA2265D13A933D98A3C009D2F9741107B2CBFF42A643765A573D4AE3DF09
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
34:88:62:10:9d:15:c0:29:a0:7c:02:0d:47:96:82:3a:fb:77:be:0a:29:56:46:51:df:5d:57:72:9e:5e:93:bd
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 28, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6B05-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:f6:83:2f:26:6a:54:5d:22:c1:00:01:00:00:01:f6
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
5488
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB paths
UXLib.pdb
msvcrt
_wcsnicmp
_wtoi
wcsncmp
_wcsicoll
memset
_onexit
__dllonexit
_unlock
_lock
realloc
_errno
_initterm
_amsg_exit
_XcptFilter
__C_specific_handler
_callnewh
_vsnwprintf
wcstoul
memmove
memcpy
wcscspn
malloc
memmove_s
wcsrchr
wcscoll
free
_wcslwr_s
wcsspn
_wcsupr_s
wcsstr
wcschr
_vscwprintf
wcspbrk
_purecall
vswprintf_s
iswspace
_wcsrev
_wcsicmp
memcpy_s
calloc
__CxxFrameHandler3
wcscmp
user32
UnregisterClassA
oleaut32
VariantInit
SysReAllocStringLen
SysAllocStringLen
VariantChangeType
VariantClear
kernel32
GetVersionExA
GetSystemDirectoryW
GetFileAttributesW
SizeofResource
GetEnvironmentVariableW
MultiByteToWideChar
FormatMessageW
LockResource
RaiseException
FindResourceExW
LoadResource
LocalFree
GetLastError
LocaleNameToLCID
SearchPathW
LocalAlloc
LoadLibraryExW
FreeLibrary
GetLocaleInfoEx
EnumSystemLocalesEx
LoadLibraryW
GetProcAddress
GetProcessHeap
CompareStringW
GetExitCodeProcess
GetModuleHandleW
CreateRemoteThread
CloseHandle
CreateProcessW
HeapSize
HeapReAlloc
HeapAlloc
HeapDestroy
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
GetModuleHandleExW
VerifyVersionInfoW
IsValidLocale
VerSetConditionMask
IsValidCodePage
GetPrivateProfileSectionW
MapViewOfFile
CreateFileMappingW
LCIDToLocaleName
UnmapViewOfFile
GetVersionExW
CreateFileW
GetLocaleInfoW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
SetLastError
GetFullPathNameW
GetPrivateProfileStringW
HeapFree
shlwapi
PathFileExistsW
wdscore
WdsDestroyBlackboard
WdsSetupLogMessageW
WdsCreateBlackboard
WdsEnumFirstBlackboardItem
WdsEnumNextBlackboardItem
WdsGetBlackboardValue
WdsInitializeDataStringW
WdsPublishImmediateAsync
WdsPublishImmediateEx
WdsAbortBlackboardItemEnum
WdsSetBlackboardValue
ConstructPartialMsgVW
WdsInitializeDataUInt32
CurrentIP
WdsFreeData
wdsutil
IsCrossArchitectureInstall
gdi32
DeleteDC
CreateDCW
EnumFontFamiliesExW
TranslateCharsetInfo
ntdll
RtlFreeHeap
RtlAllocateHeap
advapi32
RegEnumValueW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
??0?$CSimpleArray@PEAU_BLOCKED_REASON@@V?$CSimpleArrayEqualHelper@PEAU_BLOCKED_REASON@@@ATL@@@ATL@@QEAA@AEBV01@@Z
??0?$CSimpleArray@PEAU_BLOCKED_REASON@@V?$CSimpleArrayEqualHelper@PEAU_BLOCKED_REASON@@@ATL@@@ATL@@QEAA@XZ
??0?$CSimpleArray@PEAVCLocale@@V?$CSimpleArrayEqualHelper@PEAVCLocale@@@ATL@@@ATL@@QEAA@AEBV01@@Z
??0?$CSimpleArray@PEAVCLocale@@V?$CSimpleArrayEqualHelper@PEAVCLocale@@@ATL@@@ATL@@QEAA@XZ
??0?$CSimpleArray@VCDriverItem@@V?$CSimpleArrayEqualHelper@VCDriverItem@@@ATL@@@ATL@@QEAA@AEBV01@@Z
??0?$CSimpleArray@VCDriverItem@@V?$CSimpleArrayEqualHelper@VCDriverItem@@@ATL@@@ATL@@QEAA@XZ
??0?$CSimpleArray@VCLanguageItem@@V?$CSimpleArrayEqualHelper@VCLanguageItem@@@ATL@@@ATL@@QEAA@AEBV01@@Z
??0?$CSimpleArray@VCLanguageItem@@V?$CSimpleArrayEqualHelper@VCLanguageItem@@@ATL@@@ATL@@QEAA@XZ
??0?$CSimpleStringT@G$0A@@ATL@@QEAA@AEBV01@@Z
??0?$CSimpleStringT@G$0A@@ATL@@QEAA@AEBV?$CSimpleStringT@G$00@1@@Z
??0?$CSimpleStringT@G$0A@@ATL@@QEAA@PEAUIAtlStringMgr@1@@Z
??0?$CSimpleStringT@G$0A@@ATL@@QEAA@PEBGHPEAUIAtlStringMgr@1@@Z
??0?$CSimpleStringT@G$0A@@ATL@@QEAA@PEBGPEAUIAtlStringMgr@1@@Z
??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAA@AEBUtagVARIANT@@@Z
??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAA@AEBUtagVARIANT@@PEAUIAtlStringMgr@1@@Z
??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAA@AEBV01@@Z
??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAA@DH@Z
??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAA@GH@Z
??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAA@PEAUIAtlStringMgr@1@@Z
??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAA@PEBD@Z
??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAA@PEBDH@Z
??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAA@PEBDHPEAUIAtlStringMgr@1@@Z
??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAA@PEBDPEAUIAtlStringMgr@1@@Z
??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAA@PEBE@Z
??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAA@PEBEPEAUIAtlStringMgr@1@@Z
??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAA@PEBG@Z
??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAA@PEBGH@Z
??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAA@PEBGHPEAUIAtlStringMgr@1@@Z
??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAA@PEBGPEAUIAtlStringMgr@1@@Z
??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAA@XZ
??0CImageData@@AEAA@XZ
??0CImageData@@QEAA@AEBV0@@Z
??0CInternationalUtils@@QEAA@XZ
??0CKeyboardLayout@@QEAA@AEBV0@@Z
??0CKeyboardLayout@@QEAA@V?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@0@Z
??0CKeyboardLayouts@@QEAA@AEBV0@@Z
??0CKeyboardLayouts@@QEAA@XZ
??0CLanguage@@QEAA@AEBV0@@Z
??0CLanguage@@QEAA@V?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@000@Z
??0CLanguages@@QEAA@AEBV0@@Z
??0CLanguages@@QEAA@XZ
??0CLayeredDriver@@QEAA@AEBV0@@Z
??0CLayeredDriver@@QEAA@V?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@0@Z
??0CLayeredDrivers@@QEAA@AEBV0@@Z
??0CLayeredDrivers@@QEAA@XZ
??0CLoadDriver@@AEAA@XZ
??0CLoadDriver@@QEAA@AEBV0@@Z
??0CLocale@@QEAA@AEBV0@@Z
??0CLocale@@QEAA@V?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@0@Z
??0CLocales@@QEAA@AEBV0@@Z
??0CLocales@@QEAA@XZ
??0COSK@@QEAA@XZ
??0CProductKeyModule@@QEAA@AEBV0@@Z
??0CProductKeyModule@@QEAA@XZ
??0IImageData@@QEAA@$$QEAV0@@Z
??0IImageData@@QEAA@AEBV0@@Z
??0IImageData@@QEAA@XZ
??0IProductKeyModule@@QEAA@$$QEAV0@@Z
??0IProductKeyModule@@QEAA@AEBV0@@Z
??0IProductKeyModule@@QEAA@XZ
??0MyUtilString@@QEAA@XZ
??0PIDUtilStringView@@QEAA@AEBV0@@Z
??0PIDUtilStringView@@QEAA@XZ
??1?$CSimpleArray@PEAU_BLOCKED_REASON@@V?$CSimpleArrayEqualHelper@PEAU_BLOCKED_REASON@@@ATL@@@ATL@@QEAA@XZ
??1?$CSimpleArray@PEAVCLocale@@V?$CSimpleArrayEqualHelper@PEAVCLocale@@@ATL@@@ATL@@QEAA@XZ
??1?$CSimpleArray@VCDriverItem@@V?$CSimpleArrayEqualHelper@VCDriverItem@@@ATL@@@ATL@@QEAA@XZ
??1?$CSimpleArray@VCLanguageItem@@V?$CSimpleArrayEqualHelper@VCLanguageItem@@@ATL@@@ATL@@QEAA@XZ
??1?$CSimpleStringT@G$0A@@ATL@@QEAA@XZ
??1?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAA@XZ
??1CImageData@@EEAA@XZ
??1CInternationalUtils@@QEAA@XZ
??1CKeyboardLayout@@QEAA@XZ
??1CKeyboardLayouts@@QEAA@XZ
??1CLanguage@@QEAA@XZ
??1CLanguages@@QEAA@XZ
??1CLayeredDriver@@QEAA@XZ
??1CLayeredDrivers@@QEAA@XZ
??1CLoadDriver@@EEAA@XZ
??1CLocale@@QEAA@XZ
??1CLocales@@QEAA@XZ
??1COSK@@QEAA@XZ
??1PIDUtilStringView@@UEAA@XZ
??4?$CSimpleArray@PEAU_BLOCKED_REASON@@V?$CSimpleArrayEqualHelper@PEAU_BLOCKED_REASON@@@ATL@@@ATL@@QEAAAEAV01@AEBV01@@Z
??4?$CSimpleArray@PEAVCLocale@@V?$CSimpleArrayEqualHelper@PEAVCLocale@@@ATL@@@ATL@@QEAAAEAV01@AEBV01@@Z
??4?$CSimpleArray@VCDriverItem@@V?$CSimpleArrayEqualHelper@VCDriverItem@@@ATL@@@ATL@@QEAAAEAV01@AEBV01@@Z
??4?$CSimpleArray@VCLanguageItem@@V?$CSimpleArrayEqualHelper@VCLanguageItem@@@ATL@@@ATL@@QEAAAEAV01@AEBV01@@Z
??4?$CSimpleStringT@G$0A@@ATL@@QEAAAEAV01@AEBV01@@Z
??4?$CSimpleStringT@G$0A@@ATL@@QEAAAEAV01@AEBV?$CSimpleStringT@G$00@1@@Z
??4?$CSimpleStringT@G$0A@@ATL@@QEAAAEAV01@PEBG@Z
??4?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAAEAV01@AEBUtagVARIANT@@@Z
??4?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAAEAV01@AEBV01@@Z
??4?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAAEAV01@D@Z
??4?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAAEAV01@G@Z
??4?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAAEAV01@PEBD@Z
??4?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAAEAV01@PEBE@Z
??4?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAAEAV01@PEBG@Z
??4CImageData@@QEAAAEAV0@AEBV0@@Z
??4CInternationalUtils@@QEAAAEAV0@AEBV0@@Z
??4CKeyboardLayout@@QEAAAEAV0@AEBV0@@Z
??4CKeyboardLayouts@@QEAAAEAV0@AEBV0@@Z
??4CLanguage@@QEAAAEAV0@AEBV0@@Z
??4CLanguages@@QEAAAEAV0@AEBV0@@Z
??4CLayeredDriver@@QEAAAEAV0@AEBV0@@Z
??4CLayeredDrivers@@QEAAAEAV0@AEBV0@@Z
??4CLoadDriver@@QEAAAEAV0@AEBV0@@Z
??4CLocale@@QEAAAEAV0@AEBV0@@Z
??4CLocales@@QEAAAEAV0@AEBV0@@Z
??4COSK@@QEAAAEAV0@AEBV0@@Z
??4CProductKeyModule@@QEAAAEAV0@AEBV0@@Z
??4IImageData@@QEAAAEAV0@$$QEAV0@@Z
??4IImageData@@QEAAAEAV0@AEBV0@@Z
??4IProductKeyModule@@QEAAAEAV0@$$QEAV0@@Z
??4IProductKeyModule@@QEAAAEAV0@AEBV0@@Z
??4MyUtilString@@QEAAAEAV0@$$QEAV0@@Z
??4MyUtilString@@QEAAAEAV0@AEBV0@@Z
??4PIDUtilStringView@@QEAAAEAV0@AEBV0@@Z
??A?$CSimpleArray@PEAU_BLOCKED_REASON@@V?$CSimpleArrayEqualHelper@PEAU_BLOCKED_REASON@@@ATL@@@ATL@@QEAAAEAPEAU_BLOCKED_REASON@@H@Z
??A?$CSimpleArray@PEAU_BLOCKED_REASON@@V?$CSimpleArrayEqualHelper@PEAU_BLOCKED_REASON@@@ATL@@@ATL@@QEBAAEBQEAU_BLOCKED_REASON@@H@Z
??A?$CSimpleArray@PEAVCLocale@@V?$CSimpleArrayEqualHelper@PEAVCLocale@@@ATL@@@ATL@@QEAAAEAPEAVCLocale@@H@Z
??A?$CSimpleArray@PEAVCLocale@@V?$CSimpleArrayEqualHelper@PEAVCLocale@@@ATL@@@ATL@@QEBAAEBQEAVCLocale@@H@Z
??A?$CSimpleArray@VCDriverItem@@V?$CSimpleArrayEqualHelper@VCDriverItem@@@ATL@@@ATL@@QEAAAEAVCDriverItem@@H@Z
??A?$CSimpleArray@VCDriverItem@@V?$CSimpleArrayEqualHelper@VCDriverItem@@@ATL@@@ATL@@QEBAAEBVCDriverItem@@H@Z
??A?$CSimpleArray@VCLanguageItem@@V?$CSimpleArrayEqualHelper@VCLanguageItem@@@ATL@@@ATL@@QEAAAEAVCLanguageItem@@H@Z
??A?$CSimpleArray@VCLanguageItem@@V?$CSimpleArrayEqualHelper@VCLanguageItem@@@ATL@@@ATL@@QEBAAEBVCLanguageItem@@H@Z
??A?$CSimpleStringT@G$0A@@ATL@@QEBAGH@Z
??ACImageData@@UEAAAEAVCLanguageItem@@I@Z
??ACKeyboardLayouts@@UEAA?AVCKeyboardLayout@@H@Z
??ACLanguages@@UEAA?AVCLanguage@@H@Z
??ACLayeredDrivers@@UEAA?AVCLayeredDriver@@H@Z
??ACLoadDriver@@UEAAAEAVCDriverItem@@I@Z
??ACLocales@@UEAA?AVCLocale@@H@Z
??B?$CSimpleStringT@G$0A@@ATL@@QEAAAEAV?$CSimpleStringT@G$00@1@XZ
??B?$CSimpleStringT@G$0A@@ATL@@QEBAPEBGXZ
??B?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAAEAV?$CSimpleStringT@G$00@1@XZ
??Y?$CSimpleStringT@G$0A@@ATL@@QEAAAEAV01@AEBV01@@Z
??Y?$CSimpleStringT@G$0A@@ATL@@QEAAAEAV01@D@Z
??Y?$CSimpleStringT@G$0A@@ATL@@QEAAAEAV01@E@Z
??Y?$CSimpleStringT@G$0A@@ATL@@QEAAAEAV01@G@Z
??Y?$CSimpleStringT@G$0A@@ATL@@QEAAAEAV01@PEBG@Z
??Y?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAAEAV01@AEBUtagVARIANT@@@Z
??Y?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAAEAV01@AEBV?$CSimpleStringT@G$0A@@1@@Z
??Y?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAAEAV01@D@Z
??Y?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAAEAV01@E@Z
??Y?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAAEAV01@G@Z
??Y?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAAEAV01@PEBD@Z
??Y?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAAEAV01@PEBG@Z
??_7CImageData@@6B@
??_7CKeyboardLayouts@@6B@
??_7CLanguages@@6B@
??_7CLayeredDrivers@@6B@
??_7CLoadDriver@@6B@
??_7CLocales@@6B@
??_7CProductKeyModule@@6B@
??_7IImageData@@6B@
??_7IProductKeyModule@@6B@
??_7PIDUtilStringView@@6B@
?Add@?$CSimpleArray@PEAU_BLOCKED_REASON@@V?$CSimpleArrayEqualHelper@PEAU_BLOCKED_REASON@@@ATL@@@ATL@@QEAAHAEBQEAU_BLOCKED_REASON@@@Z
?Add@?$CSimpleArray@PEAVCLocale@@V?$CSimpleArrayEqualHelper@PEAVCLocale@@@ATL@@@ATL@@QEAAHAEBQEAVCLocale@@@Z
?Add@?$CSimpleArray@VCDriverItem@@V?$CSimpleArrayEqualHelper@VCDriverItem@@@ATL@@@ATL@@QEAAHAEBVCDriverItem@@@Z
?Add@?$CSimpleArray@VCLanguageItem@@V?$CSimpleArrayEqualHelper@VCLanguageItem@@@ATL@@@ATL@@QEAAHAEBVCLanguageItem@@@Z
?AllocSysString@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEBAPEAGXZ
?Append@?$CSimpleStringT@G$0A@@ATL@@QEAAXAEBV12@@Z
?Append@?$CSimpleStringT@G$0A@@ATL@@QEAAXPEBG@Z
?Append@?$CSimpleStringT@G$0A@@ATL@@QEAAXPEBGH@Z
?AppendChar@?$CSimpleStringT@G$0A@@ATL@@QEAAXG@Z
?AppendFormat@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAXIZZ
?AppendFormat@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAXPEBGZZ
?AppendFormatV@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAXPEBGPEAD@Z
?Attach@?$CSimpleStringT@G$0A@@ATL@@AEAAXPEAUCStringData@2@@Z
?CanReadMedia@CLoadDriver@@UEAAHXZ
?CharToOemA@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAXXZ
?CheckImplicitLoad@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@AEAA_NPEBX@Z
?ClearDriverList@CLoadDriver@@UEAAXXZ
?ClearString@MyUtilString@@QEAAXXZ
?ClearString@PIDUtilStringView@@QEAAXXZ
?CloneData@?$CSimpleStringT@G$0A@@ATL@@CAPEAUCStringData@2@PEAU32@@Z
?CloseOSK@COSK@@QEAAHPEAX@Z
?Collate@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEBAHPEBG@Z
?CollateNoCase@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEBAHPEBG@Z
?Compare@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEBAHPEBG@Z
?CompareNoCase@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEBAHPEBG@Z
?Concatenate@?$CSimpleStringT@G$0A@@ATL@@KAXAEAV12@PEBGH1H@Z
?Construct@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@SAXPEAV12@@Z
?CopyChars@?$CSimpleStringT@G$0A@@ATL@@SAXPEAGPEBGH@Z
?CopyChars@?$CSimpleStringT@G$0A@@ATL@@SAXPEAG_KPEBGH@Z
?CopyCharsOverlapped@?$CSimpleStringT@G$0A@@ATL@@SAXPEAGPEBGH@Z
?CopyCharsOverlapped@?$CSimpleStringT@G$0A@@ATL@@SAXPEAG_KPEBGH@Z
?Delete@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAHHH@Z
?Empty@?$CSimpleStringT@G$0A@@ATL@@QEAAXXZ
?Find@?$CSimpleArray@PEAU_BLOCKED_REASON@@V?$CSimpleArrayEqualHelper@PEAU_BLOCKED_REASON@@@ATL@@@ATL@@QEBAHAEBQEAU_BLOCKED_REASON@@@Z
?Find@?$CSimpleArray@PEAVCLocale@@V?$CSimpleArrayEqualHelper@PEAVCLocale@@@ATL@@@ATL@@QEBAHAEBQEAVCLocale@@@Z
?Find@?$CSimpleArray@VCDriverItem@@V?$CSimpleArrayEqualHelper@VCDriverItem@@@ATL@@@ATL@@QEBAHAEBVCDriverItem@@@Z
?Find@?$CSimpleArray@VCLanguageItem@@V?$CSimpleArrayEqualHelper@VCLanguageItem@@@ATL@@@ATL@@QEBAHAEBVCLanguageItem@@@Z
?Find@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEBAHGH@Z
?Find@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEBAHPEBGH@Z
?FindOneOf@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEBAHPEBG@Z
?Fork@?$CSimpleStringT@G$0A@@ATL@@AEAAXH@Z
?Format@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAXIZZ
?Format@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAXPEBGZZ
?FormatMessageV@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAXPEBGPEAPEAD@Z
?FormatMessageW@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAXIZZ
?FormatMessageW@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAXPEBGZZ
?FormatV@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAXPEBGPEAD@Z
?FreeExtra@?$CSimpleStringT@G$0A@@ATL@@QEAAXXZ
?FreeInstance@CImageData@@UEAAXXZ
?GetAbbrevName@CLanguage@@QEAA?AV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@XZ
?GetAbbrevName@CLocale@@QEAA?AV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@XZ
?GetAllocLength@?$CSimpleStringT@G$0A@@ATL@@QEBAHXZ
?GetAt@?$CSimpleStringT@G$0A@@ATL@@QEBAGH@Z
?GetBuffer@?$CSimpleStringT@G$0A@@ATL@@QEAAPEAGH@Z
?GetBuffer@?$CSimpleStringT@G$0A@@ATL@@QEAAPEAGXZ
?GetBufferSetLength@?$CSimpleStringT@G$0A@@ATL@@QEAAPEAGH@Z
?GetColumnDataAtIndex@CImageData@@UEAAPEAGI@Z
?GetCount@CImageData@@UEAAIXZ
?GetCount@CLoadDriver@@UEAAIXZ
?GetData@?$CSimpleArray@PEAU_BLOCKED_REASON@@V?$CSimpleArrayEqualHelper@PEAU_BLOCKED_REASON@@@ATL@@@ATL@@QEBAPEAPEAU_BLOCKED_REASON@@XZ
?GetData@?$CSimpleArray@PEAVCLocale@@V?$CSimpleArrayEqualHelper@PEAVCLocale@@@ATL@@@ATL@@QEBAPEAPEAVCLocale@@XZ
?GetData@?$CSimpleArray@VCDriverItem@@V?$CSimpleArrayEqualHelper@VCDriverItem@@@ATL@@@ATL@@QEBAPEAVCDriverItem@@XZ
?GetData@?$CSimpleArray@VCLanguageItem@@V?$CSimpleArrayEqualHelper@VCLanguageItem@@@ATL@@@ATL@@QEBAPEAVCLanguageItem@@XZ
?GetData@?$CSimpleStringT@G$0A@@ATL@@AEBAPEAUCStringData@2@XZ
?GetDefault@CLoadDriver@@UEAAHXZ
?GetDefaultFallbackLanguage@CLanguages@@UEAA?AVCLanguage@@XZ
?GetDefaultLanguage@CImageData@@UEAAPEAGXZ
?GetDefaultLayout@CKeyboardLayouts@@QEAA?AVCKeyboardLayout@@XZ
?GetDescription@CImageData@@UEAAPEAGXZ
?GetDriverListAsync@CLoadDriver@@UEAAHV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@HP6AXPEAXH@Z1@Z
?GetEditionName@CImageData@@UEAAPEAGXZ
?GetEnvironmentVariableW@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAHPEBG@Z
?GetFoundationFlag@CImageData@@UEAAHXZ
?GetHardwareFilter@CLoadDriver@@UEAAHXZ
?GetID@CLayeredDriver@@QEAA?AV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@XZ
?GetImageIdentifier@CImageData@@UEAAPEAGXZ
?GetInstance@CImageData@@SAPEAVIImageData@@XZ
?GetInstance@CLoadDriver@@SAPEAVILoadDriver@@XZ
?GetKeyboard@CInternationalUtils@@SA?AV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@XZ
?GetLanguage@CInternationalUtils@@SA?AV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@XZ
?GetLanguage@CLanguages@@UEAA?AVCLanguage@@H@Z
?GetLanguageCount@CLanguages@@UEAAHXZ
?GetLanguageFromLocalizedName@CLanguages@@UEAA?AVCLanguage@@V?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@@Z
?GetLanguageFromNativeDisplayName@CLanguages@@UEAA?AVCLanguage@@V?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@@Z
?GetLanguageFromNativeName@CLanguages@@UEAA?AVCLanguage@@V?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@@Z
?GetLanguageNativeDisplayNameCount@CLanguages@@QEAAHXZ
?GetLayeredDriver@CLayeredDrivers@@UEAA?AVCLayeredDriver@@H@Z
?GetLayeredDriver@CLayeredDrivers@@UEAA?AVCLayeredDriver@@V?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@@Z
?GetLayeredDriverCount@CLayeredDrivers@@UEAAHXZ
?GetLayout@CKeyboardLayouts@@UEAA?AVCKeyboardLayout@@H@Z
?GetLayout@CKeyboardLayouts@@UEAA?AVCKeyboardLayout@@V?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@@Z
?GetLayoutCount@CKeyboardLayouts@@UEAAHXZ
?GetLayoutID@CKeyboardLayout@@QEAA?AV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@XZ
?GetLayoutName@CKeyboardLayout@@QEAA?AV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@XZ
?GetLength@?$CSimpleStringT@G$0A@@ATL@@QEBAHXZ
?GetLocale@CInternationalUtils@@SA?AV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@XZ
?GetLocale@CLocales@@UEAA?AVCLocale@@H@Z
?GetLocale@CLocales@@UEAA?AVCLocale@@V?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@@Z
?GetLocaleCount@CLocales@@UEAAHXZ
?GetLocaleName@CLocale@@QEAA?AV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@XZ
?GetLocalizedName@CLanguage@@QEAA?AV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@XZ
?GetManager@?$CSimpleStringT@G$0A@@ATL@@QEBAPEAUIAtlStringMgr@2@XZ
?GetManager@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEBAPEAUIAtlStringMgr@2@XZ
?GetName@CLayeredDriver@@QEAA?AV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@XZ
?GetNativeDisplayName@CLanguage@@QEAA?AV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@XZ
?GetNativeName@CLanguage@@QEAA?AV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@XZ
?GetPidStr@PIDUtilStringView@@QEAAPEBGXZ
?GetShowFlag@CProductKeyModule@@UEAAHXZ
?GetShowFlagEarlyF6@CLoadDriver@@UEAAHXZ
?GetShowLangKeyboard@CInternationalUtils@@SAHXZ
?GetShowLangNeutral@CInternationalUtils@@SAHXZ
?GetSize@?$CSimpleArray@PEAU_BLOCKED_REASON@@V?$CSimpleArrayEqualHelper@PEAU_BLOCKED_REASON@@@ATL@@@ATL@@QEBAHXZ
?GetSize@?$CSimpleArray@PEAVCLocale@@V?$CSimpleArrayEqualHelper@PEAVCLocale@@@ATL@@@ATL@@QEBAHXZ
?GetSize@?$CSimpleArray@VCDriverItem@@V?$CSimpleArrayEqualHelper@VCDriverItem@@@ATL@@@ATL@@QEBAHXZ
?GetSize@?$CSimpleArray@VCLanguageItem@@V?$CSimpleArrayEqualHelper@VCLanguageItem@@@ATL@@@ATL@@QEBAHXZ
?GetString@?$CSimpleStringT@G$0A@@ATL@@QEBAPEBGXZ
?GetString@MyUtilString@@QEAAPEBGXZ
?Initialize@CImageData@@UEAAHPEAX@Z
?Initialize@CKeyboardLayouts@@UEAAHV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@0@Z
?Initialize@CLanguages@@UEAAHXZ
?Initialize@CLayeredDrivers@@UEAAHV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@0@Z
?Initialize@CLoadDriver@@UEAAHPEAX@Z
?Initialize@CLocales@@UEAAHV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@@Z
?Initialize@CProductKeyModule@@UEAAHPEAX@Z
?Insert@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAHHG@Z
?Insert@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAHHPEBG@Z
?InsertChar@MyUtilString@@QEAAHHG@Z
?InsertString@MyUtilString@@QEAAHHPEBG@Z
?InsertString@PIDUtilStringView@@QEAAHHPEBG@Z
?InstallDriver@CLoadDriver@@UEAAHJP6AXPEAXH@Z0@Z
?InternalSetAtIndex@?$CSimpleArray@PEAU_BLOCKED_REASON@@V?$CSimpleArrayEqualHelper@PEAU_BLOCKED_REASON@@@ATL@@@ATL@@QEAAXHAEBQEAU_BLOCKED_REASON@@@Z
?InternalSetAtIndex@?$CSimpleArray@PEAVCLocale@@V?$CSimpleArrayEqualHelper@PEAVCLocale@@@ATL@@@ATL@@QEAAXHAEBQEAVCLocale@@@Z
?InternalSetAtIndex@?$CSimpleArray@VCDriverItem@@V?$CSimpleArrayEqualHelper@VCDriverItem@@@ATL@@@ATL@@QEAAXHAEBVCDriverItem@@@Z
?InternalSetAtIndex@?$CSimpleArray@VCLanguageItem@@V?$CSimpleArrayEqualHelper@VCLanguageItem@@@ATL@@@ATL@@QEAAXHAEBVCLanguageItem@@@Z
?IsDigitalMarkerKeyValid@CProductKeyModule@@AEAAHXZ
?IsEmpty@?$CSimpleStringT@G$0A@@ATL@@QEBA_NXZ
?IsLanguageEnabled@CInternationalUtils@@SAHV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@0@Z
?IsVolumeLicensingKeyValid@CProductKeyModule@@AEAAHXZ
?Left@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEBA?AV12@H@Z
?LoadStringW@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAHI@Z
?LoadStringW@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAHPEAUHINSTANCE__@@I@Z
?LoadStringW@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAHPEAUHINSTANCE__@@IG@Z
?LockBuffer@?$CSimpleStringT@G$0A@@ATL@@QEAAPEAGXZ
?MakeLower@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAAEAV12@XZ
?MakeReverse@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAAEAV12@XZ
?MakeUpper@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAAEAV12@XZ
?Mid@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEBA?AV12@H@Z
?Mid@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEBA?AV12@HH@Z
?OemToCharA@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAXXZ
?OnCallback@CProductKeyModule@@UEAA_KPEBUWDS_DATA@@@Z
?PopulateDriverList@CLoadDriver@@AEAAHXZ
?PopulateImageData@CImageData@@UEAAHPEBGPEAGHPEAUHINSTANCE__@@@Z
?Preallocate@?$CSimpleStringT@G$0A@@ATL@@QEAAXH@Z
?PrepareWrite2@?$CSimpleStringT@G$0A@@ATL@@AEAAXH@Z
?PrepareWrite@?$CSimpleStringT@G$0A@@ATL@@AEAAPEAGH@Z
?PublishLanguageGatherEvent@CInternationalUtils@@SAJPEAX@Z
?Reallocate@?$CSimpleStringT@G$0A@@ATL@@AEAAXH@Z
?ReleaseBuffer@?$CSimpleStringT@G$0A@@ATL@@QEAAXH@Z
?ReleaseBufferSetLength@?$CSimpleStringT@G$0A@@ATL@@QEAAXH@Z
?Remove@?$CSimpleArray@PEAU_BLOCKED_REASON@@V?$CSimpleArrayEqualHelper@PEAU_BLOCKED_REASON@@@ATL@@@ATL@@QEAAHAEBQEAU_BLOCKED_REASON@@@Z
?Remove@?$CSimpleArray@PEAVCLocale@@V?$CSimpleArrayEqualHelper@PEAVCLocale@@@ATL@@@ATL@@QEAAHAEBQEAVCLocale@@@Z
?Remove@?$CSimpleArray@VCDriverItem@@V?$CSimpleArrayEqualHelper@VCDriverItem@@@ATL@@@ATL@@QEAAHAEBVCDriverItem@@@Z
?Remove@?$CSimpleArray@VCLanguageItem@@V?$CSimpleArrayEqualHelper@VCLanguageItem@@@ATL@@@ATL@@QEAAHAEBVCLanguageItem@@@Z
?Remove@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAHG@Z
?RemoveAll@?$CSimpleArray@PEAU_BLOCKED_REASON@@V?$CSimpleArrayEqualHelper@PEAU_BLOCKED_REASON@@@ATL@@@ATL@@QEAAXXZ
?RemoveAll@?$CSimpleArray@PEAVCLocale@@V?$CSimpleArrayEqualHelper@PEAVCLocale@@@ATL@@@ATL@@QEAAXXZ
?RemoveAll@?$CSimpleArray@VCDriverItem@@V?$CSimpleArrayEqualHelper@VCDriverItem@@@ATL@@@ATL@@QEAAXXZ
?RemoveAll@?$CSimpleArray@VCLanguageItem@@V?$CSimpleArrayEqualHelper@VCLanguageItem@@@ATL@@@ATL@@QEAAXXZ
?RemoveAt@?$CSimpleArray@PEAU_BLOCKED_REASON@@V?$CSimpleArrayEqualHelper@PEAU_BLOCKED_REASON@@@ATL@@@ATL@@QEAAHH@Z
?RemoveAt@?$CSimpleArray@PEAVCLocale@@V?$CSimpleArrayEqualHelper@PEAVCLocale@@@ATL@@@ATL@@QEAAHH@Z
?RemoveAt@?$CSimpleArray@VCDriverItem@@V?$CSimpleArrayEqualHelper@VCDriverItem@@@ATL@@@ATL@@QEAAHH@Z
?RemoveAt@?$CSimpleArray@VCLanguageItem@@V?$CSimpleArrayEqualHelper@VCLanguageItem@@@ATL@@@ATL@@QEAAHH@Z
?RemoveChar@MyUtilString@@QEAAHH@Z
?RemoveString@MyUtilString@@QEAAHHH@Z
?RemoveString@PIDUtilStringView@@QEAAHHHH@Z
?Replace@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAHGG@Z
?Replace@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAHPEBG0@Z
?ReplaceString@PIDUtilStringView@@QEAAHHHPEBG@Z
?ReverseFind@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEBAHG@Z
?Right@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEBA?AV12@H@Z
?SetActivation@CProductKeyModule@@UEAAHK@Z
?SetAt@?$CSimpleStringT@G$0A@@ATL@@QEAAXHG@Z
?SetAtIndex@?$CSimpleArray@PEAU_BLOCKED_REASON@@V?$CSimpleArrayEqualHelper@PEAU_BLOCKED_REASON@@@ATL@@@ATL@@QEAAHHAEBQEAU_BLOCKED_REASON@@@Z
?SetAtIndex@?$CSimpleArray@PEAVCLocale@@V?$CSimpleArrayEqualHelper@PEAVCLocale@@@ATL@@@ATL@@QEAAHHAEBQEAVCLocale@@@Z
?SetAtIndex@?$CSimpleArray@VCDriverItem@@V?$CSimpleArrayEqualHelper@VCDriverItem@@@ATL@@@ATL@@QEAAHHAEBVCDriverItem@@@Z
?SetAtIndex@?$CSimpleArray@VCLanguageItem@@V?$CSimpleArrayEqualHelper@VCLanguageItem@@@ATL@@@ATL@@QEAAHHAEBVCLanguageItem@@@Z
?SetEditionName@CImageData@@UEAAXPEAG@Z
?SetFoundationFlag@CImageData@@UEAAXH@Z
?SetHardwareFilter@CLoadDriver@@UEAAHH@Z
?SetHideOOBELang@CInternationalUtils@@SAHV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@@Z
?SetInstance@CImageData@@SAXPEAVIImageData@@@Z
?SetInstance@CLoadDriver@@SAXPEAVILoadDriver@@@Z
?SetLength@?$CSimpleStringT@G$0A@@ATL@@AEAAXH@Z
?SetLocale@CLayeredDrivers@@UEAAHV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@@Z
?SetManager@?$CSimpleStringT@G$0A@@ATL@@QEAAXPEAUIAtlStringMgr@2@@Z
?SetProductKey@CProductKeyModule@@AEAAXV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@@Z
?SetString@?$CSimpleStringT@G$0A@@ATL@@QEAAXPEBG@Z
?SetString@?$CSimpleStringT@G$0A@@ATL@@QEAAXPEBGH@Z
?SetSysString@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEBAPEAGPEAPEAG@Z
?SetTargetKeyboard@CInternationalUtils@@SAHV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@@Z
?SetTargetLanguage@CInternationalUtils@@SAHV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@@Z
?SetTargetLayeredDriver@CInternationalUtils@@SAHV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@@Z
?SetTargetLocale@CInternationalUtils@@SAHV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@@Z
?SetUILanguage@CInternationalUtils@@SAHV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@@Z
?SetUILanguage@CKeyboardLayouts@@UEAAHV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@@Z
?SetUILanguage@CLanguages@@UEAAHV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@@Z
?SetUILanguage@CLayeredDrivers@@UEAAHV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@@Z
?SetUILanguage@CLocales@@UEAAHV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@@Z
?ShowOSK@COSK@@QEAAPEAXHPEAG0@Z
?SpanExcluding@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEBA?AV12@PEBG@Z
?SpanIncluding@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEBA?AV12@PEBG@Z
?StaticInstallCallback@CLoadDriver@@CAXW4WDS_EVENT_RESULT@@PEBUWDS_DATA@@PEAX@Z
?StaticScanCallback@CLoadDriver@@CAXW4WDS_EVENT_RESULT@@PEBUWDS_DATA@@PEAX@Z
?StringLength@?$CSimpleStringT@G$0A@@ATL@@SAHPEBD@Z
?StringLength@?$CSimpleStringT@G$0A@@ATL@@SAHPEBG@Z
?ThrowMemoryException@?$CSimpleStringT@G$0A@@ATL@@KAXXZ
?Tokenize@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEBA?AV12@PEBGAEAH@Z
?Trim@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAAEAV12@G@Z
?Trim@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAAEAV12@PEBG@Z
?Trim@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAAEAV12@XZ
?TrimLeft@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAAEAV12@G@Z
?TrimLeft@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAAEAV12@PEBG@Z
?TrimLeft@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAAEAV12@XZ
?TrimRight@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAAEAV12@G@Z
?TrimRight@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAAEAV12@PEBG@Z
?TrimRight@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAAEAV12@XZ
?Truncate@?$CSimpleStringT@G$0A@@ATL@@QEAAXH@Z
?UnlockBuffer@?$CSimpleStringT@G$0A@@ATL@@QEAAXXZ
?ValidatePid@CProductKeyModule@@AEAAJXZ
?ValidateProductKey@CProductKeyModule@@UEAAHPEAXPEAGP6AX0_K@Z@Z
?s_Instance@CImageData@@0PEAVIImageData@@EA
?s_Instance@CLoadDriver@@0PEAVILoadDriver@@EA
?v_AddBlockedReason@CImageData@@AEAAXPEBG0@Z
?v_AddLanguage@CImageData@@AEAAXPEBG0H@Z
?v_BuildKey@CImageData@@AEAAPEAGPEBG0@Z
?v_CopyStr@CImageData@@AEAAPEAGPEBG@Z
?v_DeleteKeyboardLayouts@CKeyboardLayouts@@AEAAXXZ
?v_DeleteLanguages@CLanguages@@AEAAXXZ
?v_DeleteLayeredDrivers@CLayeredDrivers@@AEAAXXZ
?v_EnumLocalesProc@CLocales@@CAHPEAGK_J@Z
?v_FreeLanguages@CImageData@@AEAAXXZ
?v_FreeReasons@CImageData@@AEAAXXZ
?v_GetArchitectureName@CImageData@@AEAAPEAGPEAUHINSTANCE__@@K@Z
?v_GetAvailableLanguages@CImageData@@AEAAXPEBG@Z
?v_GetBBStr@CImageData@@AEAAPEAGPEBG0@Z
?v_GetBBVal@CImageData@@AEAAKPEBG0K@Z
?v_GetBlockedReasons@CImageData@@AEAAXPEBG@Z
?v_GetLangIniPath@CLanguages@@AEAA?AV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@XZ
?v_InitInputProcs@CKeyboardLayouts@@AEAAHXZ
?v_InitLanguage@CLanguages@@AEAAPEAVCLanguage@@V?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@@Z
?v_IsValid@PIDUtilStringView@@AEAAHG@Z
?v_LoadInputProcs@CKeyboardLayouts@@AEAAHXZ
?v_MakePidString@PIDUtilStringView@@AEAAHXZ
?v_MakeValidString@PIDUtilStringView@@AEAA?AV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@PEBG@Z
?v_PopulateKeyboardLayouts@CKeyboardLayouts@@AEAAHXZ
?v_PopulateLanguages@CLanguages@@AEAAHXZ
?v_PopulateLayeredDrivers@CLayeredDrivers@@AEAAHXZ
?v_PopulateLocales@CLocales@@AEAAHXZ
Name
.text
Size
84KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
60KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
696B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33138,
count=15, id=260, version=33138,
count=228, id=1, productName=Unmarked objects,
count=21, id=257, version=33138,
count=1, id=256, version=33138,
count=35, id=264, version=33138,
count=2, id=261, version=33138,
count=1, id=255, version=33138,
count=1, id=258, version=33138,
uxlibres.dll
- SHA256 fa57006fe449c3a7f5085e302cef6e415dd4390e3e1d4d7ffd576d7b26d22aee
- MD5 4a2c96a7e07ff0aadda4c7577e756b6f
- SHA1 64ed58541e41fc7489d5f4993488eb69194bf1b5
- SHA512 78fd6ec0e8d9131944bfd37df125b1fbd070f56daa41392622bd530aafc85c239ff148dac340821ed425a774c8ed2f1b2a1055cdeb6127ea09a404e4b6d5954b
- SSDEEP 192:8Wd3W1GQAXwVrDBQABJqBAY00pyEuX01k9z3AmWIx7fGgf:8Wd3W1GQA0DBRJqGEpcR9z3HLJf
- TLSH T1C3A24AC15BB80002F9EB7AB052FDDA877C3D37C75960559A1295E6841CA33C5EF28B2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
51:81:7a:b8:78:d5:da:26:80:3d:bd:71:ac:51:99:d7:a5:40:5b:32:d0:98:57:3f:11:0b:f7:75:b2:c3:74:79
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 28, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3703-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:ea:9a:24:72:d5:59:3f:61:63:00:01:00:00:01:ea
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
4KB
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=33138,
count=1, id=258, version=33138,
uxtheme.dll
- IMPHASH 3d728bb10540bea1d9ae48284baff872
- SHA256 7ef0ecf094c1df7c9fe76eb5ee61898515e3a9e52de2e9d233cde9fbfcee36fa
- MD5 2db2fb0d933c1202b07bf0f1197d6518
- SHA1 5acc16c4969455b986d2b7a65327a921e5482998
- SHA512 25fb2b8adf2aaa08ee39111e03a1b42291df72d60d647cd88653fbcc365787d0c4789aa71a44c80c6afbf6cc43202c15f3ccc75e0a8d09fe22e3ba9884d406a9
- SSDEEP 12288:z+2v23BXyxnSsOrhLbCA33sd/pV5k/jPeI2Nn:yDBXmSsMhfsd/NGOB
- TLSH T11BE4291967F80095F1BB92B9AAB74525D772BC311710D2CF0190827E9F3BFD85A39B22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
326640
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
uxtheme.pdb
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wsplitpath_s
_o__wtof
_o_atan
_o_bsearch_s
_o_cos
_o_floor
_o_fmod
_o_fputws
_o_memcpy_s
_o_pow
_o_rand
_o_rand_s
_o_sqrt
_o_terminate
_o_wcstok_s
_o_wcstol
_o_wcstoul
__current_exception
__current_exception_context
__CxxFrameHandler3
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o___stdio_common_vswprintf
_o___stdio_common_vfwprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__C_specific_handler
wcschr
__std_terminate
__CxxFrameHandler4
_o_fflush
_CxxThrowException
memcmp
memcpy
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
GetProcAddress
FreeLibraryAndExitThread
LoadLibraryExW
GetModuleHandleExW
LoadStringW
LoadResource
DisableThreadLibraryCalls
FindResourceExW
GetModuleFileNameA
GetModuleFileNameW
LockResource
GetModuleHandleW
SizeofResource
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
InitOnceExecuteOnce
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionAndSpinCount
CreateSemaphoreExW
EnterCriticalSection
ReleaseSemaphore
AcquireSRWLockShared
LeaveCriticalSection
InitializeCriticalSectionEx
WaitForSingleObject
ReleaseMutex
ReleaseSRWLockExclusive
InitializeSRWLock
DeleteCriticalSection
AcquireSRWLockExclusive
WaitForSingleObjectEx
InitializeCriticalSection
OpenSemaphoreW
ReleaseSRWLockShared
CreateMutexExW
api-ms-win-core-heap-l1-1-0
HeapCreate
HeapDestroy
HeapFree
GetProcessHeap
HeapAlloc
HeapReAlloc
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-processthreads-l1-1-0
TlsSetValue
TlsAlloc
GetCurrentProcess
SetThreadToken
GetCurrentThread
OpenThreadToken
GetCurrentThreadId
CreateThread
OpenProcessToken
GetCurrentProcessId
TlsFree
TlsGetValue
TerminateProcess
api-ms-win-core-localization-l1-2-0
GetACP
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringOrdinal
MultiByteToWideChar
GetStringTypeW
CompareStringW
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTime
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetSystemInfo
GetVersionExW
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-file-l1-1-0
ReadFile
GetFileSize
SetFilePointer
GetFullPathNameW
CreateFileW
GetFileTime
FindClose
FindNextFileW
FindFirstFileW
GetFileAttributesW
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
RoOriginateError
api-ms-win-core-registry-l1-1-0
RegOpenCurrentUser
RegOpenKeyExW
RegCreateKeyExW
RegDeleteValueW
RegSetValueExW
RegCloseKey
RegGetValueW
RegQueryValueExW
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-security-base-l1-1-0
ImpersonateLoggedOnUser
GetLengthSid
CopySid
GetTokenInformation
CheckTokenMembership
SetKernelObjectSecurity
RevertToSelf
IsValidSid
api-ms-win-core-memory-l1-1-0
UnmapViewOfFile
OpenFileMappingW
MapViewOfFile
VirtualFree
VirtualAlloc
CreateFileMappingW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
api-ms-win-core-sidebyside-l1-1-0
CreateActCtxW
DeactivateActCtx
ReleaseActCtx
ActivateActCtx
api-ms-win-core-atoms-l1-1-0
AddAtomW
DeleteAtom
GetAtomNameW
api-ms-win-core-registryuserspecific-l1-1-0
SHRegGetBoolUSValueW
api-ms-win-core-kernel32-legacy-l1-1-0
MulDiv
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpW
lstrlenW
lstrcmpiW
api-ms-win-core-shlwapi-obsolete-l1-1-0
StrRStrIW
api-ms-win-core-localization-obsolete-l1-2-0
GetUserDefaultUILanguage
ntdll
RtlGetThreadLangIdByIndex
EtwEventSetInformation
EtwEventWriteTransfer
NtAlpcSendWaitReceivePort
RtlInitUnicodeString
NtAlpcConnectPort
RtlAcquireSRWLockExclusive
EtwEventUnregister
EtwEventRegister
RtlInitializeSRWLock
RtlReleaseSRWLockShared
RtlAcquireSRWLockShared
RtlReleaseSRWLockExclusive
RtlInitializeCriticalSection
NtOpenSection
NtCreateSection
RtlWakeAllConditionVariable
SbSelectProcedure
strchr
wcsspn
RtlSleepConditionVariableSRW
gdi32
DeleteObject
SelectObject
GetClipRgn
CreateRectRgn
IntersectClipRect
CreatePen
CreateSolidBrush
GetStockObject
Rectangle
RoundRect
BeginPath
EndPath
Ellipse
SelectClipPath
BitBlt
SelectClipRgn
SetBkColor
ExtTextOutW
GetBkColor
PathToRegion
GetObjectType
ExcludeClipRect
CreateCompatibleDC
CreateCompatibleBitmap
GetObjectW
GetDCDpiScaleValue
CreateDPIScaledDIBSection
CreateDIBSection
DeleteDC
GetLayout
GetRandomRgn
LPtoDP
OffsetRgn
GetDeviceCaps
GdiFlush
SetViewportOrgEx
SetWindowOrgEx
CreateRectRgnIndirect
GdiAlphaBlend
SetStretchBltMode
StretchBlt
CreateFontIndirectW
PtInRegion
GdiGradientFill
Arc
SetLayout
GetRegionData
GdiDrawStream
SetTextColor
SetBkMode
GetRgnBox
GetCurrentObject
GetWindowOrgEx
GetViewportOrgEx
GdiWaitForTextReady
SetBitmapAttributes
SetTextAlign
GetTextAlign
GetDIBits
CreatePatternBrush
RectVisible
GetClipBox
SetBrushOrgEx
SetDIBits
ExtCreateRegion
CombineRgn
ExtCreatePen
AbortPath
StrokeAndFillPath
GetTextMetricsW
PatBlt
GdiTransparentBlt
GditPushCallerInfo
GditPopCallerInfo
SetBoundsRect
GetBoundsRect
CreateSessionMappedDIBSection
ClearBitmapAttributes
CreateDIBitmap
user32
SendNotifyMessageW
GetPropW
InflateRect
DrawTextW
DrawTextExW
GetGUIThreadInfo
GetUserObjectInformationW
GetProcessWindowStation
CopyRect
GetSystemMetrics
PtInRect
GetSysColor
RedrawWindow
KillTimer
SetTimer
EqualRect
OffsetRect
MapWindowPoints
GetWindowRect
IsRectEmpty
IntersectRect
SetRect
FillRect
IsWindow
SystemParametersInfoW
GetAncestor
SetPropW
RemovePropW
GetWindow
EnumChildWindows
OpenDesktopW
EnumDesktopWindows
CloseDesktop
EnumDesktopsW
GetClassNameW
SetProcessDPIAware
SetSysColors
GetDC
ReleaseDC
GetDesktopWindow
ord2527
ord2525
PostMessageW
GetWindowThreadProcessId
IsChild
GetDCEx
DefWindowProcW
GetWindowLongW
SetWindowLongPtrW
SetWindowLongW
CallWindowProcW
TrackMouseEvent
IsThreadDesktopComposited
GetWindowCompositionAttribute
SetWindowCompositionAttribute
SetWindowPos
GetClassLongW
GetClientRect
GetSystemMetricsForDpi
SendMessageW
MonitorFromWindow
GetMonitorInfoW
IsZoomed
GetTitleBarInfo
GetSystemMenu
GetMenuItemInfoW
GetIconInfo
CreateIconIndirect
GetWindowLongPtrW
GetParent
GetWindowInfo
IsIconic
GetForegroundWindow
GetWindowRgnBox
InvalidateRect
IsWindowInDestroy
SetWindowRgn
SetRectEmpty
CalcMenuBar
InternalGetWindowText
GetWindowTextW
GetWindowDC
LoadIconW
DestroyIcon
SetCapture
MsgWaitForMultipleObjectsEx
PeekMessageW
ReleaseCapture
DispatchMessageW
GetCapture
ClientToScreen
DrawEdge
DrawIconEx
IsWindowVisible
IsWindowRedirectedForPrint
PaintMenuBar
GetSysColorBrush
ValidateRect
DefFrameProcW
IsServerSideWindow
MonitorFromRect
GetMessagePos
GetKeyState
WindowFromDC
GetMenuItemCount
DrawMenuBar
GetDpiForSystem
SetMenuItemInfoW
CopyImage
ord2707
IsTopLevelWindow
ord2703
ord2706
ord2705
RegisterUserApiHook
ord2708
SystemParametersInfoA
SystemParametersInfoForDpi
AdjustWindowRectEx
GetWindowPlacement
FindWindowW
GetShellWindow
SetWindowsHookExW
UnhookWindowsHookEx
AllowSetForegroundWindow
CallNextHookEx
IsMenu
EnumThreadWindows
GetMenuInfo
SendMessageTimeoutW
GetClassLongPtrW
GetThreadDesktop
EnumDisplayDevicesW
EnumDisplaySettingsW
DisplayConfigGetDeviceInfo
GetDpiForMonitorInternal
ord2711
EnumDisplayMonitors
GetMenuBarInfo
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
BeginBufferedAnimation
BeginBufferedPaint
BeginPanningFeedback
BufferedPaintClear
BufferedPaintInit
BufferedPaintRenderAnimation
BufferedPaintSetAlpha
BufferedPaintStopAllAnimations
BufferedPaintUnInit
CloseThemeData
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DrawThemeBackground
DrawThemeBackgroundEx
DrawThemeEdge
DrawThemeIcon
DrawThemeParentBackground
DrawThemeParentBackgroundEx
DrawThemeText
DrawThemeTextEx
EnableThemeDialogTexture
EnableTheming
EndBufferedAnimation
EndBufferedPaint
EndPanningFeedback
GetBufferedPaintBits
GetBufferedPaintDC
GetBufferedPaintTargetDC
GetBufferedPaintTargetRect
GetColorFromPreference
GetCurrentThemeName
GetImmersiveColorFromColorSetEx
GetImmersiveUserColorSetPreference
GetThemeAnimationProperty
GetThemeAnimationTransform
GetThemeAppProperties
GetThemeBackgroundContentRect
GetThemeBackgroundExtent
GetThemeBackgroundRegion
GetThemeBitmap
GetThemeBool
GetThemeColor
GetThemeDocumentationProperty
GetThemeEnumValue
GetThemeFilename
GetThemeFont
GetThemeInt
GetThemeIntList
GetThemeMargins
GetThemeMetric
GetThemePartSize
GetThemePosition
GetThemePropertyOrigin
GetThemeRect
GetThemeStream
GetThemeString
GetThemeSysBool
GetThemeSysColor
GetThemeSysColorBrush
GetThemeSysFont
GetThemeSysInt
GetThemeSysSize
GetThemeSysString
GetThemeTextExtent
GetThemeTextMetrics
GetThemeTimingFunction
GetThemeTransitionDuration
GetUserColorPreference
GetWindowTheme
HitTestThemeBackground
IsAppThemed
IsCompositionActive
IsThemeActive
IsThemeBackgroundPartiallyTransparent
IsThemeDialogTextureEnabled
IsThemePartDefined
OpenThemeData
OpenThemeDataEx
OpenThemeDataForDpi
SetThemeAppProperties
SetWindowTheme
SetWindowThemeAttribute
ThemeInitApiHook
UpdatePanningFeedback
Name
.text
Size
408KB
Virtual Size
407KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
204KB
Virtual Size
202KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
24KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=257, version=33145,
count=81, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1507, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=11, id=260, version=33145,
count=5, id=259, version=33145,
count=25, id=261, version=33145,
count=1, id=256, version=33145,
count=74, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vaultcli.dll
- IMPHASH 6d954d7e004d90dc99c683933965fb6d
- SHA256 8b9d4741af77ac96518fd2f3fc8e6df05ba4839774bf51f45dda4fcaed9a986d
- MD5 09c9eab8e30b2c7f42cd85879cf0208b
- SHA1 e86ae0324b4488a57dab4c4bb27316043bee5897
- SHA512 dae69d8234e85daf0457d09b312dd339c542086232e6241a715cb792a4be1e692626ba54ffaa3de8a8d540fae4f753ef33b79ebb45e9d12e1fe18596bec874fe
- SSDEEP 3072:dP6ENCP9W/VoTydaN3zvfe93fznbAGWw/ooNxIUvPdg+Yw+QsAp3ZKCAqAJCzvY0:dPF8U/rife937j/o7npwfZLAnCzv
- TLSH T1BE641B2F62A901A7EA76A13DC543470AE3F178615362D2CB0264413DEE7FFE85E3A750
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
118272
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vaultcli.pdb
msvcrt
??3@YAXPEAX@Z
_amsg_exit
__CxxFrameHandler4
_XcptFilter
_purecall
memcpy_s
??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBV0@@Z
wcsncmp
_callnewh
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
?what@exception@@UEBAPEBDXZ
_CxxThrowException
memcpy
memmove
??1type_info@@UEAA@XZ
_vsnwprintf
memcmp
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
__CxxFrameHandler3
?terminate@@YAXXZ
_initterm
malloc
free
memset
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
HeapSize
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceExecuteOnce
Sleep
InitOnceComplete
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
GetLastError
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
RegisterTraceGuidsW
TraceMessage
UnregisterTraceGuids
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventUnregister
EventActivityIdControl
EventSetInformation
EventRegister
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
DisableThreadLibraryCalls
FreeLibrary
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleW
LoadStringW
api-ms-win-core-synch-l1-1-0
CreateMutexExW
OpenSemaphoreW
AcquireSRWLockExclusive
WaitForSingleObject
ReleaseMutex
ReleaseSRWLockExclusive
WaitForSingleObjectEx
CreateSemaphoreExW
InitializeSRWLock
ReleaseSemaphore
ReleaseSRWLockShared
AcquireSRWLockShared
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
OpenThreadToken
GetCurrentThread
SetThreadToken
TerminateProcess
GetCurrentProcess
OpenProcessToken
GetCurrentThreadId
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-security-base-l1-1-0
RevertToSelf
GetTokenInformation
DuplicateToken
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-security-base-l1-2-0
CheckTokenCapability
api-ms-win-core-threadpool-l1-2-0
SubmitThreadpoolWork
FreeLibraryWhenCallbackReturns
CloseThreadpool
CloseThreadpoolWork
CreateThreadpool
CreateThreadpoolWork
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-heap-obsolete-l1-1-0
LocalSize
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
VaultAddItem
VaultCloseVault
VaultCreateItemType
VaultDeleteItemType
VaultEnumerateItemTypes
VaultEnumerateItems
VaultEnumerateVaults
VaultFindItems
VaultFree
VaultGetInformation
VaultGetItem
VaultGetItemType
VaultOpenVault
VaultRemoveItem
Name
.text
Size
184KB
Virtual Size
180KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
92KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
568B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=52, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=17, id=260, version=33145,
count=5, id=259, version=33145,
count=202, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=10, id=261, version=33145,
count=1, id=256, version=33145,
count=19, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vaultsvc.dll
- IMPHASH e2cd52d752856c2d09cc335a0efcc52f
- SHA256 cfd276abf67cc9d5db8503de5fb5fa5a760cc6c64b576db267a6f236d193befd
- MD5 7199301928fddf525b876d6649c8feef
- SHA1 0f5b0d77b850e916123d4bc93aa8f0cd43e676da
- SHA512 647993eb67b78e3d8f99fd7f84d25bcec4f888bc18f78ada2886d7d614a8e956bbadebc78e836a57844b7ed8e6016fa907b4c2407939183d2ef0cf035251911f
- SSDEEP 6144:TetfMutnn7kqkGLFoWxi3OKqYp+GPtNkA2uZ4we/Iz:aV97+IaWOqO+8tNkAtc
- TLSH T1D8A4392DD3E802F5D1B6D17881835717EAB1341A5B338ACF12A0C6796F27EE49E39B41
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
239184
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vaultsvc.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsicmp
_o__wcslwr_s
memmove
_o__wsplitpath_s
_o_ceilf
_o_free
_o_malloc
_o_memcpy_s
_o_wcscpy_s
_o_wcsncpy_s
__C_specific_handler
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_CxxThrowException
__CxxFrameHandler3
wcschr
wcsstr
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
wcscmp
memmove_s
wcsnlen
api-ms-win-security-base-l1-1-0
EqualSid
GetSidIdentifierAuthority
ImpersonateSelf
GetSidSubAuthorityCount
AdjustTokenPrivileges
GetSidSubAuthority
GetLengthSid
ImpersonateLoggedOnUser
GetTokenInformation
AccessCheck
CopySid
DuplicateTokenEx
IsValidSid
RevertToSelf
FreeSid
AllocateAndInitializeSid
api-ms-win-core-com-l1-1-0
CoWaitForMultipleHandles
CoCreateFreeThreadedMarshaler
CoSetProxyBlanket
CoUninitialize
CoInitializeEx
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventRegister
EventUnregister
EventSetInformation
api-ms-win-eventing-classicprovider-l1-1-0
RegisterTraceGuidsW
TraceMessage
GetTraceEnableFlags
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableLevel
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
OpenProcessToken
OpenThreadToken
GetCurrentThread
TerminateProcess
api-ms-win-core-synch-l1-1-0
CreateSemaphoreExW
AcquireSRWLockShared
ReleaseMutex
DeleteCriticalSection
CreateEventExW
CreateEventW
ReleaseSRWLockExclusive
LeaveCriticalSection
AcquireSRWLockExclusive
CreateMutexExW
EnterCriticalSection
WaitForSingleObject
WaitForSingleObjectEx
ReleaseSRWLockShared
ReleaseSemaphore
InitializeCriticalSectionEx
SetEvent
OpenSemaphoreW
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
RaiseException
GetLastError
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleHandleW
LoadStringW
GetModuleFileNameA
GetProcAddress
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-service-core-l1-1-0
SetServiceStatus
RegisterServiceCtrlHandlerExW
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlCompareMemory
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-processthreads-l1-1-1
OpenProcess
IsProcessorFeaturePresent
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegOpenCurrentUser
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
bcrypt
BCryptGenRandom
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptExportKey
BCryptSetProperty
BCryptCreateHash
BCryptDecrypt
BCryptEncrypt
BCryptDestroyKey
BCryptGenerateSymmetricKey
BCryptImportKey
BCryptFinishHash
BCryptDestroyHash
BCryptHashData
BCryptGetProperty
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW
api-ms-win-security-base-l1-2-0
CheckTokenCapability
rpcrt4
NdrServerCall2
RpcRevertToSelf
RpcServerUnregisterIfEx
UuidFromStringW
RpcServerRegisterIf3
RpcServerInqCallAttributesW
NdrServerCallAll
RpcImpersonateClient
RpcServerUseProtseqEpW
api-ms-win-core-file-l1-1-0
WriteFile
FindClose
CreateFileW
GetFileAttributesW
ReadFile
CreateDirectoryW
GetFileSizeEx
DeleteFileW
GetVolumePathNameW
GetVolumeInformationW
GetDriveTypeW
CompareFileTime
SetFilePointer
FindNextFileW
RemoveDirectoryW
FindFirstFileExW
api-ms-win-security-credentials-l1-1-0
CredDeleteW
CredFree
CredIsProtectedW
CredWriteW
CredUnprotectW
CredReadW
CredProtectW
CredEnumerateW
api-ms-win-core-file-l2-1-0
MoveFileExW
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsCreateStringReference
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
HeapSize
GetProcessHeap
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringOrdinal
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
sspicli
GetUserNameExW
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
profapi
ord103
api-ms-win-security-lsapolicy-l1-1-0
LsaOpenPolicy
LsaQueryInformationPolicy
LsaFreeMemory
LsaClose
api-ms-win-service-private-l1-1-0
I_QueryTagInformation
api-ms-win-core-kernel32-legacy-l1-1-0
CreateFileTransactedW
api-ms-win-core-kernel32-legacy-l1-1-3
RemoveDirectoryTransactedW
CreateDirectoryTransactedW
MoveFileTransactedW
DeleteFileTransactedW
FindFirstFileTransactedW
api-ms-win-core-heap-obsolete-l1-1-0
LocalSize
lsasrv
LsaIRegisterLogonSessionCallback
LsapAdtWriteLog
LsaIUnregisterLogonSessionCallback
LsaILookupUserAccountType
LsapQueryClientInfo
LsapAdtGetCallerProcessInfo
LsaICryptProtectData
LsaICryptUnprotectData
LsapAuditFailed
ntdll
RtlLeaveCriticalSection
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlInitializeCriticalSection
RtlEnterCriticalSection
NtQueryInformationToken
RtlGetActiveConsoleId
RtlSubscribeWnfStateChangeNotification
NtSetInformationThread
RtlInitializeSid
RtlSubAuthoritySid
RtlSidDominates
NtDuplicateToken
NtSetInformationToken
RtlIsPackageSid
RtlDeleteCriticalSection
RtlGetNtProductType
RtlLengthSid
RtlCopySid
RtlDeleteResource
RtlAcquireResourceExclusive
RtlAcquireResourceShared
RtlReleaseResource
RtlConvertSharedToExclusive
NtOpenThreadToken
RtlInitializeResource
RtlInitUnicodeString
RtlPublishWnfStateData
NtClose
RtlEqualSid
RtlNtStatusToDosError
RtlValidSid
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
ServiceMain
VaultSvcStopCallback
Name
.text
Size
332KB
Virtual Size
331KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
72KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=93, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33145,
count=5, id=259, version=33145,
count=1337, id=1, productName=Unmarked objects,
count=6, id=257, version=33145,
count=26, id=261, version=33145,
count=1, id=256, version=33145,
count=40, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vbsapi.dll
- IMPHASH 5e14a5e140e5bcf1fc897bd3c230b853
- SHA256 2ad873de066ca82bbd3be42e3647d1f487b5a2ebc15523caebe9968cea8da0be
- MD5 b6277d345221da645944f1b4c8b3321d
- SHA1 8c2b1ab12e079bcf2bf77395a7c3b60dccce9446
- SHA512 20cf6488c204201ed50f0bd45a995ae6bc178b3c8a8e042b8218de978fa9cc31b70851f5a280f4655d4be3fe4c91716c22ebdf039d386fdda9002750929de5d6
- SSDEEP 6144:8PPgovD+CQ7rp1qpHIy1pcXGOyxqpfA/6:cPgVt7rp1qpxcXGOyxS4/6
- TLSH T1AA445B2A77A51C6AEC63813DD5638426E6B2B8252720D3DF02A4C13D9E0FBF47679F41
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
6096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
VbsApi.pdb
msvcrt
_initterm
_CxxThrowException
memcmp
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
__CxxFrameHandler3
free
memmove
_unlock
_callnewh
malloc
??1type_info@@UEAA@XZ
memmove_s
_XcptFilter
memcpy
wcsrchr
_wcsnicmp
_stricmp
?terminate@@YAXXZ
??0exception@@QEAA@AEBV0@@Z
_lock
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
_purecall
_amsg_exit
_onexit
__dllonexit
??3@YAXPEAX@Z
wcschr
toupper
strncmp
_wcsicmp
memcpy_s
towlower
_vsnwprintf
__C_specific_handler
wcsncmp
memset
ntdll
VerSetConditionMask
RtlVerifyVersionInfo
ZwEnumerateValueKey
RtlDosPathNameToNtPathName_U_WithStatus
ZwCreateFile
NtQueryInformationFile
RtlRunOnceExecuteOnce
RtlCopyUnicodeString
RtlUpcaseUnicodeString
RtlAppendUnicodeToString
RtlAppendUnicodeStringToString
ZwOpenFile
RtlFreeUnicodeString
RtlGetFullPathName_UEx
ZwEnumerateKey
RtlAllocateHeap
RtlFormatCurrentUserKeyPath
ZwQueryInformationFile
ZwCreateSection
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwQueryDirectoryFile
RtlpEnsureBufferSize
RtlNtPathNameToDosPathName
RtlUpcaseUnicodeChar
RtlGetNativeSystemInformation
RtlInitString
RtlxAnsiStringToUnicodeSize
RtlAnsiStringToUnicodeString
LdrResSearchResource
RtlFreeHeap
RtlGetVersion
ZwClose
ZwQuerySystemInformation
ZwOpenKey
ZwQueryValueKey
RtlInitUnicodeStringEx
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlDoesFileExists_U
RtlImageNtHeaderEx
NtOpenFile
NtClose
NtDeviceIoControlFile
NtQuerySystemEnvironmentValueEx
RtlInitUnicodeString
NtQuerySystemInformation
RtlReAllocateHeap
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegGetValueW
RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
RegDeleteKeyValueW
api-ms-win-core-sysinfo-l1-2-0
GetNativeSystemInfo
GetSystemFirmwareTable
api-ms-win-core-sysinfo-l1-2-1
GetPhysicallyInstalledSystemMemory
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcessId
CreateThread
OpenProcessToken
GetCurrentProcess
GetCurrentThreadId
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
SetLastError
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-security-base-l1-1-0
AdjustTokenPrivileges
api-ms-win-security-lsalookup-l2-1-0
LookupPrivilegeValueW
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-file-l1-1-0
FindFirstFileW
FindClose
GetFullPathNameW
CreateFileW
GetFileSizeEx
FindNextFileW
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleFileNameA
GetModuleHandleW
LoadLibraryExW
FreeLibrary
GetModuleHandleExW
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
ReleaseSemaphore
CreateMutexW
InitializeCriticalSectionEx
AcquireSRWLockShared
CreateSemaphoreExW
WaitForSingleObject
CreateMutexExW
ReleaseMutex
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-memory-l1-1-0
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
HvciGetConfig
HvciGetConfigFromVBSKey
HvciIncompatibilityScanCancel
HvciIncompatibilityScanFree
HvciIncompatibilityScanGetResult
HvciIncompatibilityScanInitialize
HvciIncompatibilityScanInitialize2
HvciIncompatibilityScanOverrideDriverCompatDatabase
HvciIncompatibilityScanOverrideServicesKey
HvciIncompatibilityScanStart
HvciIsActive
HvciIsRecommended
KernelShadowStacksGetConfig
KernelShadowStacksGetConfigFromVBSKey
KernelShadowStacksIsActive
KernelShadowStacksIsCapable
VbsGetIssues
VbsGetIssuesForWindowsPath
VbsIsCapable
VbsIsRecommended
VbsIsScenarioEnabled
VbsIsVbsRecommended
VbsSetKernelShadowStacksScenarioEnable
VbsSetKernelShadowStacksScenarioEnableToVBSKey
VbsSetScenarioEnable
VbsSetScenarioEnableToVBSKey
Name
.text
Size
148KB
Virtual Size
146KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
68KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=54, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=15, id=260, version=33145,
count=5, id=259, version=33145,
count=213, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=5, id=261, version=33145,
count=1, id=256, version=33145,
count=38, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vbscript.dll
- IMPHASH 112144d10fb4d09181aecbd165b0447c
- SHA256 6c1700ddb023d94a23b5db267cf865d436d395f7d0bea5605e113cab58bc5276
- MD5 823472655501eb2992c8b3881c95d250
- SHA1 ea910160fc3d55cb15db2263fb33efbe4ba2688e
- SHA512 396d7a04a7b58360447d585be8664247168ea4797503cc69fb72ad77f33ab622c6fd3043364dd6ad375e8bff1cc4059394559292b51e650df72cac2a924bfb67
- SSDEEP 12288:NU8nUHhMcCFpbRhoksaT1GKbhXp2YlTzG6vHpQ72Ox:Fkh5yVRhZsaZ//vHpQ71x
- TLSH T1B3E47D1EA3E801E5E16A913C96578726EBB178252721A7CF0350937E6F77FE01B39720
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
281408
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vbscript.pdb
msvcrt
wcscspn
_snwprintf_s
_mbslwr_s
_snprintf_s
_mbstok_s
_mbsnbcpy_s
_mbsicmp
_mbsnbset
_errno
_ltow
modf
wcstol
bsearch
iswspace
_wtoi
sin
_ismbblead
atoi
_callnewh
_XcptFilter
_amsg_exit
_initterm
_lock
_unlock
__dllonexit
_onexit
_resetstkoflw
toupper
_statusfp
_clearfp
wcscpy_s
strrchr
strcat_s
strcpy_s
swprintf_s
_vsnwprintf
towlower
_ultow_s
wcsncat_s
wcscat_s
_mbsrchr
calloc
__CxxFrameHandler3
wcsncmp
strtoul
_controlfp
longjmp
sprintf_s
__C_specific_handler
wcsncpy_s
_wcsnicmp
wcschr
realloc
_wcsdup
_wcsicmp
malloc
free
memmove_s
_purecall
memcpy_s
_vsnprintf
_setjmp
atan
cos
exp
floor
floorf
fmod
log
memchr
memcmp
memcpy
memmove
memset
pow
sqrt
oleaut32
SafeArrayDestroyData
SafeArrayDestroyDescriptor
VariantChangeType
VarUdateFromDate
VarDateFromUdate
VariantChangeTypeEx
SysReleaseString
SafeArrayReleaseDescriptor
SafeArrayAddRef
SysAddRefString
SafeArrayReleaseData
SafeArrayRedim
SafeArrayDestroy
CreateTypeLi
SafeArrayCreate
VariantCopy
LoadTypeLibEx
GetActiveObject
GetErrorInfo
VarR8FromStr
OleLoadPicture
VarDateFromStr
SafeArrayUnlock
SafeArrayLock
LoadTypeLi
RegisterTypeLi
VarBstrFromR8
VariantCopyInd
VarBstrFromR4
VarBstrFromI4
VarBstrFromDate
VarBstrFromUI4
VariantInit
SysStringByteLen
SysAllocStringByteLen
SysReAllocString
LoadRegTypeLi
SysFreeString
CreateTypeLib2
SysAllocString
SysStringLen
SysAllocStringLen
VariantClear
kernel32
AcquireSRWLockShared
DelayLoadFailureHook
ResolveDelayLoadedAPI
WerGetFlags
VirtualProtect
WerSetFlags
MapViewOfFile
CreateFileMappingW
FindResourceExW
LCIDToLocaleName
UnmapViewOfFile
GetVersionExW
CreateFileW
GetUserDefaultUILanguage
GetLocaleInfoEx
GetSystemDefaultUILanguage
SearchPathW
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
Sleep
UnhandledExceptionFilter
RaiseException
TerminateProcess
MulDiv
GetDateFormatW
LCMapStringW
GetDateFormatA
CompareStringA
GetVersion
GetLocaleInfoW
LCMapStringA
CompareStringW
GetLocalTime
LocaleNameToLCID
GetUserDefaultLangID
K32GetModuleInformation
GetCurrentProcess
ReadProcessMemory
Process32Next
LoadLibraryA
GetTickCount64
GetModuleHandleExA
CreateToolhelp32Snapshot
OpenProcess
RtlCaptureStackBackTrace
Process32First
QueryPerformanceCounter
GetComputerNameA
TlsFree
TlsAlloc
TlsSetValue
LoadResource
LockResource
FreeResource
FindResourceA
GetModuleFileNameW
LoadLibraryExA
SizeofResource
WideCharToMultiByte
GetVersionExA
LoadLibraryExW
VirtualQuery
GetTickCount
FreeLibrary
IsValidLocale
GetUserDefaultLCID
MultiByteToWideChar
IsValidCodePage
GetACP
GetLocaleInfoA
RtlCaptureContext
GetSystemDefaultLCID
TlsGetValue
InitializeCriticalSection
GetModuleHandleA
IsDebuggerPresent
DebugBreak
GetModuleHandleW
GetProcessHeap
GetCurrentProcessId
DeleteCriticalSection
CreateMutexExW
GetProcAddress
HeapAlloc
CreateThreadpoolTimer
ReleaseSRWLockShared
SetThreadpoolTimer
CloseHandle
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
CloseThreadpoolTimer
OutputDebugStringW
ReleaseSRWLockExclusive
GetLastError
FormatMessageW
ReleaseMutex
GetCurrentThreadId
WaitForSingleObject
WaitForThreadpoolTimerCallbacks
InitializeCriticalSectionEx
LeaveCriticalSection
GetModuleHandleExW
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
SetLastError
EnterCriticalSection
ReleaseSemaphore
user32
WinHelpW
GetWindowRect
GetDC
SetWindowPos
EndDialog
SetWindowTextW
ShowWindow
MapWindowPoints
GetDlgItemTextW
MessageBoxIndirectW
MoveWindow
SendDlgItemMessageA
SendMessageA
GetClientRect
GetDlgItem
GetWindowLongPtrA
DrawTextW
GetDesktopWindow
SetWindowLongPtrA
DialogBoxParamW
SetForegroundWindow
ReleaseDC
EnableWindow
GetWindowTextW
iertutil
ord594
ord793
ord791
ord796
ord398
ord597
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
488KB
Virtual Size
484KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
76KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
24KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
320B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
36KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=26, id=260, version=33145,
count=299, id=1, productName=Unmarked objects,
count=7, id=257, version=33145,
count=7, id=261, version=33145,
count=1, id=256, version=33145,
count=80, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vbssysprep.dll
- IMPHASH d8200caaf49ffab055ba2191b98a478c
- SHA256 0aca5c5461f67d6ee6d40d12970bebf5ac5a19b0b89dccdf4c6f14bc323cafc9
- MD5 c899cbfa37a282514e914c7478461b4e
- SHA1 cb0048523f8bece2f9f304cd0277d1756767b4df
- SHA512 9912441aa5b6315faa59b4d030b0e911ed1274e91583c0725d61617dd100380a43d353b8d1bb75730c91829d6d79ffe398f9cf20c64e88fb3dfabb8800e4cd86
- SSDEEP 3072:rEVJdWcmT/HLjUqG08bKg3Ld5IsaT+FV1qzz1G8SU:eJdmDL408Og3Ld5uHS
- TLSH T13CF3282E37BA206AE17A813D85534645E3B2747047112BEF46E0C27E4F67BD87D3AE21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
12096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
VbsSysprep.pdb
msvcrt
__dllonexit
??1bad_cast@@UEAA@XZ
??0bad_cast@@QEAA@PEBD@Z
??0bad_cast@@QEAA@AEBV0@@Z
memcpy_s
_wcsicmp
??3@YAXPEAX@Z
_purecall
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
memcmp
_onexit
_wsetlocale
__crtLCMapStringA
__CxxFrameHandler3
_wcsdup
memset
abort
islower
calloc
___lc_codepage_func
___lc_handle_func
isupper
__pctype_func
??0exception@@QEAA@AEBQEBDH@Z
__uncaught_exception
memmove
memcpy
_CxxThrowException
setlocale
_unlock
_lock
_callnewh
malloc
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_vsnwprintf
memmove_s
??_V@YAXPEAX@Z
free
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBD@Z
ntdll
VerSetConditionMask
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
kernel32
DecodePointer
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
QueryPerformanceCounter
EncodePointer
Sleep
IsDebuggerPresent
GetTickCount
DebugBreak
VerifyVersionInfoW
WideCharToMultiByte
FreeLibrary
GetModuleHandleW
GetProcessHeap
GetCurrentProcessId
DeleteCriticalSection
DelayLoadFailureHook
ResolveDelayLoadedAPI
InitializeCriticalSection
GetVersionExW
AcquireSRWLockShared
CreateMutexExW
GetProcAddress
HeapAlloc
LoadLibraryW
CreateThreadpoolTimer
ReleaseSRWLockShared
SetThreadpoolTimer
CloseHandle
OpenSemaphoreW
GetModuleFileNameA
InitOnceBeginInitialize
CreateSemaphoreExW
HeapFree
SetLastError
EnterCriticalSection
ReleaseSemaphore
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSectionEx
WaitForThreadpoolTimerCallbacks
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
ReleaseSRWLockExclusive
OutputDebugStringW
CloseThreadpoolTimer
InitOnceComplete
AcquireSRWLockExclusive
WaitForSingleObjectEx
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventWriteTransfer
EventSetInformation
EventActivityIdControl
EventUnregister
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegGetValueW
RegSetValueExW
wdscore
ConstructPartialMsgVW
CurrentIP
WdsSetupLogMessageW
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableLevel
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceLoggerHandle
UnregisterTraceGuids
SysprepGeneralizeEntry
SysprepSpecializeOfflineEntry
SysprepSpecializeOnlineEntry
Name
.text
Size
88KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
168B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=261, id=1, productName=Unmarked objects,
count=9, id=257, version=33145,
count=19, id=261, version=33145,
count=61, id=260, version=33145,
count=1, id=256, version=33145,
count=18, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vcamp140.dll
- IMPHASH f32ecf7e400c9fec0b860e5087220ef4
- SHA256 52af68f35476bd03d7b97752b01bef358ffdda568d150057d6ce809f77c4f704
- MD5 8cd34592f57c9ca0ec01b3314231ad97
- SHA1 ff5b76dcec9b9cce21318dcaddf5ae30fc8041ad
- SHA512 3c3e69e8ffaeea8671557ed13f06fc57f315e92292e993bd07c5483dbb46e4dd2eaff1d0d2ec12127bf17488895966cc2eb2f1081230cef314756ba4280542f2
- SSDEEP 6144:hLU/NWtDkrezmt33+pPeZDrxcM9ATDh0s3KaJnV4ahI/:qlWZkrezEePeJrxA9K48
- TLSH T12A946A1AF65C04AAE1BBD27C85A3CD1BF63278464362D6CB136487952F53BE0EE3D211
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
6c:d4:df:25:74:c3:b3:f3:ee:11:51:38:1c:ec:d2:2c:02:cd:bc:ec:88:b3:1b:cd:78:12:58:e4:29:8c:04:21
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 10, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
6c:d4:df:25:74:c3:b3:f3:ee:11:51:38:1c:ec:d2:2c:02:cd:bc:ec:88:b3:1b:cd:78:12:58:e4:29:8c:04:21
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 10, 2025
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:0d:c4:e7:bb:f4:af:f8:f0:90:00:00:00:00:01:0d
Issuer
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 15, 2025 - May 15, 2026
Subject
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:14:9d:fb:c3:1f:1f:63:c3:10:00:00:00:00:00:14
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
May 1, 2013 - May 1, 2028
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6F1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:fc:18:a0:af:cc:69:5a:87:3a:00:01:00:00:01:fc
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:7f:2f:42:2a:73:53:08:de:ea:00:00:00:00:04:7f
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 15, 2025 - May 15, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:521A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:00:0b:d7:aa:7f:1b:2a:17:56:00:01:00:00:02:00
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Minor OS version
0
Major OS version
6
Entry point
209152
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcamp140.amd64.pdb
advapi32
EventUnregister
EventWrite
EventRegister
kernel32
CreateEventExW
CloseHandle
ResetEvent
WaitForSingleObjectEx
VerSetConditionMask
VerifyVersionInfoW
SetEvent
InitializeSListHead
InterlockedPushEntrySList
InterlockedPopEntrySList
InterlockedFlushSList
InitializeCriticalSectionEx
InitOnceBeginInitialize
InitOnceComplete
DisableThreadLibraryCalls
GetLastError
FreeLibrary
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetEnvironmentVariableW
GetProcAddress
GetCurrentThreadId
LoadLibraryW
InitOnceExecuteOnce
InitOnceInitialize
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetSystemTimeAsFileTime
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
memmove
memcpy
memcmp
_CxxThrowException
__std_exception_copy
__std_exception_destroy
_purecall
wcsstr
__current_exception
__current_exception_context
__C_specific_handler
__std_type_info_destroy_list
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
_cexit
_crt_atexit
_invalid_parameter_noinfo
_errno
_execute_onexit_table
terminate
_invoke_watson
_register_onexit_function
abort
_beginthreadex
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
api-ms-win-crt-string-l1-1-0
strcpy_s
towlower
wcscpy_s
wcscat_s
wcstok_s
_wcsicmp
api-ms-win-crt-convert-l1-1-0
_wtoi64
_itow_s
api-ms-win-crt-heap-l1-1-0
_aligned_malloc
_aligned_free
free
malloc
_callnewh
msvcp140
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach
_Thrd_yield
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_Xbad_function_call@std@@YAXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
??0task_continuation_context@Concurrency@@AEAA@XZ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?_Assign@_ContextCallback@details@Concurrency@@AEAAXPEAX@Z
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ
?_Xlength_error@std@@YAXPEBD@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_lock
_Mtx_unlock
_Cnd_broadcast
_Cnd_wait
_Cnd_register_at_thread_exit
_Cnd_unregister_at_thread_exit
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
concrt140
??0critical_section@Concurrency@@QEAA@XZ
??0scoped_lock@critical_section@Concurrency@@QEAA@AEAV12@@Z
??1scoped_lock@critical_section@Concurrency@@QEAA@XZ
?try_lock@critical_section@Concurrency@@QEAA_NXZ
?lock@critical_section@Concurrency@@QEAAXXZ
?unlock@critical_section@Concurrency@@QEAAXXZ
??1critical_section@Concurrency@@QEAA@XZ
d3d11
D3D11CreateDevice
d3dcompiler_47
D3DCreateLinker
D3DLoadModule
dxgi
CreateDXGIFactory1
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
api-ms-win-crt-math-l1-1-0
pow
ceilf
ceil
??0_Event@details@Concurrency@@QEAA@AEBV012@@Z
??0_Event@details@Concurrency@@QEAA@XZ
??0accelerator@Concurrency@@AEAA@V?$_Reference_counted_obj_ptr@V_Accelerator_impl@details@Concurrency@@@details@1@@Z
??0accelerator@Concurrency@@QEAA@AEBV01@@Z
??0accelerator@Concurrency@@QEAA@XZ
??0accelerator_view@Concurrency@@AEAA@V?$_Reference_counted_obj_ptr@V_Accelerator_view_impl@details@Concurrency@@@details@1@_N@Z
??0accelerator_view@Concurrency@@QEAA@AEBV01@@Z
??0accelerator_view_removed@Concurrency@@QEAA@J@Z
??0accelerator_view_removed@Concurrency@@QEAA@PEBDJ@Z
??0invalid_compute_domain@Concurrency@@QEAA@PEBD@Z
??0invalid_compute_domain@Concurrency@@QEAA@XZ
??0out_of_memory@Concurrency@@QEAA@PEBD@Z
??0out_of_memory@Concurrency@@QEAA@XZ
??0runtime_exception@Concurrency@@QEAA@AEBV01@@Z
??0runtime_exception@Concurrency@@QEAA@J@Z
??0runtime_exception@Concurrency@@QEAA@PEBDJ@Z
??0scoped_d3d_access_lock@direct3d@Concurrency@@QEAA@$$QEAV012@@Z
??0scoped_d3d_access_lock@direct3d@Concurrency@@QEAA@AEAVaccelerator_view@2@@Z
??0scoped_d3d_access_lock@direct3d@Concurrency@@QEAA@AEAVaccelerator_view@2@Uadopt_d3d_access_lock_t@12@@Z
??0unsupported_feature@Concurrency@@QEAA@PEBD@Z
??0unsupported_feature@Concurrency@@QEAA@XZ
??1_Amp_runtime_trace@details@Concurrency@@QEAA@XZ
??1_Event@details@Concurrency@@QEAA@XZ
??1accelerator@Concurrency@@QEAA@XZ
??1accelerator_view@Concurrency@@QEAA@XZ
??1runtime_exception@Concurrency@@UEAA@XZ
??1scoped_d3d_access_lock@direct3d@Concurrency@@QEAA@XZ
??4_Event@details@Concurrency@@QEAAAEAV012@AEBV012@@Z
??4accelerator@Concurrency@@QEAAAEAV01@AEBV01@@Z
??4accelerator_view@Concurrency@@QEAAAEAV01@AEBV01@@Z
??4runtime_exception@Concurrency@@QEAAAEAV01@AEBV01@@Z
??4scoped_d3d_access_lock@direct3d@Concurrency@@QEAAAEAV012@$$QEAV012@@Z
??8_Event@details@Concurrency@@QEBA_NAEBV012@@Z
??8accelerator@Concurrency@@QEBA_NAEBV01@@Z
??8accelerator_view@Concurrency@@QEBA_NAEBV01@@Z
??9_Event@details@Concurrency@@QEBA_NAEBV012@@Z
??9accelerator@Concurrency@@QEBA_NAEBV01@@Z
??9accelerator_view@Concurrency@@QEBA_NAEBV01@@Z
?_Add_continuation@_Event@details@Concurrency@@QEAA?AV123@AEBV?$function@$$A6A?AV_Event@details@Concurrency@@XZ@std@@@Z
?_Add_event@_Event@details@Concurrency@@QEAA?AV123@V123@@Z
?_Adopt_texture@_Texture@details@Concurrency@@SAPEAV123@IW4_Short_vector_base_type_id@23@PEAUIUnknown@@Vaccelerator_view@3@I@Z
?_Clone_texture@_Texture@details@Concurrency@@SAPEAV123@PEBV123@AEBVaccelerator_view@3@1@Z
?_Copy_async_impl@details@Concurrency@@YA?AV_Event@12@PEAV_Texture@12@PEB_KI01I11@Z
?_Copy_impl@details@Concurrency@@YA?AV_Event@12@PEAV_Buffer@12@V?$_Reference_counted_obj_ptr@V_View_shape@details@Concurrency@@@12@01@Z
?_Copy_impl@details@Concurrency@@YA?AV_Event@12@PEAV_Buffer@12@_K0111@Z
?_Copy_to_async@_Buffer@details@Concurrency@@QEAA?AV_Event@23@PEAV123@V?$_Reference_counted_obj_ptr@V_View_shape@details@Concurrency@@@23@1@Z
?_Copy_to_async@_Buffer@details@Concurrency@@QEAA?AV_Event@23@PEAV123@_K11@Z
?_Copy_to_async@_Texture@details@Concurrency@@QEAA?AV_Event@23@PEAV123@PEB_K11II@Z
?_Create@_Sampler@details@Concurrency@@SAPEAV123@IIMMMM@Z
?_Create@_Sampler@details@Concurrency@@SAPEAV123@PEAX@Z
?_Create_buffer@_Buffer@details@Concurrency@@SAPEAV123@PEAXVaccelerator_view@3@_K2@Z
?_Create_buffer@_Buffer@details@Concurrency@@SAPEAV123@Vaccelerator_view@3@0_K1_NW4access_type@3@@Z
?_Create_stage_buffer@_Buffer@details@Concurrency@@SAPEAV123@Vaccelerator_view@3@0_K1_N@Z
?_Create_stage_texture@_Texture@details@Concurrency@@SAPEAV123@Vaccelerator_view@3@0I_K11II_N@Z
?_Create_stage_texture@_Texture@details@Concurrency@@SAPEAV123@Vaccelerator_view@3@0I_K11IW4_Short_vector_base_type_id@23@II@Z
?_Create_texture@_Texture@details@Concurrency@@SAPEAV123@Vaccelerator_view@3@I_K11IW4_Short_vector_base_type_id@23@II_N@Z
?_Create_ubiquitous_buffer@_Ubiquitous_buffer@details@Concurrency@@SAPEAV123@V?$_Reference_counted_obj_ptr@V_Buffer@details@Concurrency@@@23@@Z
?_Create_ubiquitous_buffer@_Ubiquitous_buffer@details@Concurrency@@SAPEAV123@_K0@Z
?_Create_view_shape@_View_shape@details@Concurrency@@SAPEAV123@IIPEBI00PEB_N@Z
?_Discard@_Ubiquitous_buffer@details@Concurrency@@QEAAXPEAU_Buffer_descriptor@23@@Z
?_Exclusively_owns_data@_Buffer@details@Concurrency@@QEAA_NXZ
?_Get@_Event@details@Concurrency@@QEAAXXZ
?_Get_CPU_access@_Buffer_descriptor@details@Concurrency@@QEBAXW4_Access_mode@@@Z
?_Get_D3D_buffer@_D3D_interop@details@Concurrency@@SAPEAUIUnknown@@PEAV_Buffer@23@@Z
?_Get_D3D_sampler@_D3D_interop@details@Concurrency@@SAPEAUIUnknown@@AEBVaccelerator_view@3@PEAV_Sampler@23@@Z
?_Get_D3D_sampler_data_ptr@_D3D_interop@details@Concurrency@@SAPEAXPEAUIUnknown@@@Z
?_Get_D3D_texture@_D3D_interop@details@Concurrency@@SAPEAUIUnknown@@PEAV_Texture@23@@Z
?_Get_accelerator_view@_Buffer@details@Concurrency@@QEBA?AVaccelerator_view@3@XZ
?_Get_access_async@_Ubiquitous_buffer@details@Concurrency@@AEAA?AV_Event@23@PEAU_Buffer_descriptor@23@Vaccelerator_view@3@W4_Access_mode@@AEAV?$_Reference_counted_obj_ptr@V_Buffer@details@Concurrency@@@23@PEA_K@Z
?_Get_access_async@_Ubiquitous_buffer@details@Concurrency@@QEAA?AV_Event@23@PEAU_Buffer_descriptor@23@V?$_Reference_counted_obj_ptr@V_Accelerator_view_impl@details@Concurrency@@@23@W4_Access_mode@@AEAV?$_Reference_counted_obj_ptr@V_Buffer@details@Concurrency@@@23@PEA_K@Z
?_Get_access_on_accelerator_view@_Buffer@details@Concurrency@@QEBA?AVaccelerator_view@3@XZ
?_Get_amp_trace@details@Concurrency@@YAPEAV_Amp_runtime_trace@12@XZ
?_Get_description@accelerator@Concurrency@@AEBAPEB_WXZ
?_Get_device_path@accelerator@Concurrency@@AEBAPEB_WXZ
?_Get_devices@details@Concurrency@@YAPEAV?$_Reference_counted_obj_ptr@V_Accelerator_impl@details@Concurrency@@@12@XZ
?_Get_master_accelerator_view@_Ubiquitous_buffer@details@Concurrency@@QEBA?AVaccelerator_view@3@XZ
?_Get_master_buffer@_Ubiquitous_buffer@details@Concurrency@@QEBA?AV?$_Reference_counted_obj_ptr@V_Buffer@details@Concurrency@@@23@XZ
?_Get_num_devices@details@Concurrency@@YA_KXZ
?_Get_preferred_copy_chunk_size@details@Concurrency@@YA_K_K@Z
?_Get_recommended_buffer_host_access_mode@details@Concurrency@@YA?AW4_Access_mode@@AEBVaccelerator_view@2@@Z
?_Get_reduced_shape_for_copy@_View_shape@details@Concurrency@@QEAAPEAV123@XZ
?_Get_src_dest_accelerator_view@details@Concurrency@@YA?AU?$pair@Vaccelerator_view@Concurrency@@V12@@std@@PEBU_Buffer_descriptor@12@0@Z
?_Get_temp_staging_buffer@_Buffer@details@Concurrency@@SAPEAV123@Vaccelerator_view@3@_K1@Z
?_Get_temp_staging_texture@_Texture@details@Concurrency@@SAPEAV123@Vaccelerator_view@3@I_K11II@Z
?_Get_view_shape@_Ubiquitous_buffer@details@Concurrency@@QEAA?AV?$_Reference_counted_obj_ptr@V_View_shape@details@Concurrency@@@23@PEAU_Buffer_descriptor@23@@Z
?_Init@accelerator@Concurrency@@AEAAXPEB_W@Z
?_Is_D3D_accelerator_view@details@Concurrency@@YA_NAEBVaccelerator_view@2@@Z
?_Is_empty@_Event@details@Concurrency@@QEBA_NXZ
?_Is_finished@_Event@details@Concurrency@@QEAA_NXZ
?_Is_finished_nothrow@_Event@details@Concurrency@@QEAA_NXZ
?_Is_mappable@_Buffer@details@Concurrency@@QEBA_NXZ
?_Launch_array_view_synchronize_event_helper@_Amp_runtime_trace@details@Concurrency@@QEAAKAEBU_Buffer_descriptor@23@@Z
?_Launch_async_copy_event_helper@_Amp_runtime_trace@details@Concurrency@@QEAAK$$TAEBU_Buffer_descriptor@23@_K@Z
?_Launch_async_copy_event_helper@_Amp_runtime_trace@details@Concurrency@@QEAAK$$TAEBU_Texture_descriptor@23@_K@Z
?_Launch_async_copy_event_helper@_Amp_runtime_trace@details@Concurrency@@QEAAKAEBU_Buffer_descriptor@23@$$T_K@Z
?_Launch_async_copy_event_helper@_Amp_runtime_trace@details@Concurrency@@QEAAKAEBU_Buffer_descriptor@23@0_K@Z
?_Launch_async_copy_event_helper@_Amp_runtime_trace@details@Concurrency@@QEAAKAEBU_Texture_descriptor@23@$$T_K@Z
?_Launch_async_copy_event_helper@_Amp_runtime_trace@details@Concurrency@@QEAAKAEBU_Texture_descriptor@23@0_K@Z
?_Map_buffer@_Buffer@details@Concurrency@@QEAAXW4_Access_mode@@_N@Z
?_Map_buffer_async@_Buffer@details@Concurrency@@QEAA?AV_Event@23@W4_Access_mode@@@Z
?_Recursive_array_copy@details@Concurrency@@YAJAEBU_Array_copy_desc@12@IV?$function@$$A6AJAEBU_Array_copy_desc@details@Concurrency@@@Z@std@@@Z
?_Register_async_event@details@Concurrency@@YAXAEBV_Event@12@AEBV?$shared_future@X@std@@@Z
?_Register_view@_Buffer@details@Concurrency@@QEAAXPEAU_Buffer_descriptor@23@@Z
?_Register_view@_Ubiquitous_buffer@details@Concurrency@@QEAAXPEAU_Buffer_descriptor@23@Vaccelerator_view@3@V?$_Reference_counted_obj_ptr@V_View_shape@details@Concurrency@@@23@QEAU423@@Z
?_Register_view_copy@_Ubiquitous_buffer@details@Concurrency@@QEAAXPEAU_Buffer_descriptor@23@0@Z
?_Release@_Reference_counter@details@Concurrency@@QEAAXXZ
?_Release_D3D_sampler_data_ptr@_D3D_interop@details@Concurrency@@SAXPEAX@Z
?_Select_copy_src_accelerator_view@details@Concurrency@@YA?AVaccelerator_view@2@PEAU_Buffer_descriptor@12@AEBV32@@Z
?_Select_default_accelerator@details@Concurrency@@YA?AVaccelerator@2@XZ
?_Set_default_accelerator@details@Concurrency@@YA_NV?$_Reference_counted_obj_ptr@V_Accelerator_impl@details@Concurrency@@@12@@Z
?_Start_array_view_synchronize_event_helper@_Amp_runtime_trace@details@Concurrency@@QEAAKAEBU_Buffer_descriptor@23@@Z
?_Start_async_op_wait_event@_Amp_runtime_trace@details@Concurrency@@AEAAKK@Z
?_Start_copy_event_helper@_Amp_runtime_trace@details@Concurrency@@QEAAK$$TAEBU_Buffer_descriptor@23@_K@Z
?_Start_copy_event_helper@_Amp_runtime_trace@details@Concurrency@@QEAAK$$TAEBU_Texture_descriptor@23@_K@Z
?_Start_copy_event_helper@_Amp_runtime_trace@details@Concurrency@@QEAAKAEBU_Buffer_descriptor@23@$$T_K@Z
?_Start_copy_event_helper@_Amp_runtime_trace@details@Concurrency@@QEAAKAEBU_Buffer_descriptor@23@0_K@Z
?_Start_copy_event_helper@_Amp_runtime_trace@details@Concurrency@@QEAAKAEBU_Texture_descriptor@23@$$T_K@Z
?_Start_copy_event_helper@_Amp_runtime_trace@details@Concurrency@@QEAAKAEBU_Texture_descriptor@23@0_K@Z
?_Start_parallel_for_each_event_helper@_Amp_runtime_trace@details@Concurrency@@QEAAKPEAU_DPC_call_handle@23@@Z
?_Unmap_buffer@_Buffer@details@Concurrency@@QEAAXXZ
?_Unregister_view@_Buffer@details@Concurrency@@QEAAXPEAU_Buffer_descriptor@23@@Z
?_Unregister_view@_Ubiquitous_buffer@details@Concurrency@@QEAAXPEAU_Buffer_descriptor@23@@Z
?_Write_end_event@_Amp_runtime_trace@details@Concurrency@@QEAAXK@Z
?amp_uninitialize@Concurrency@@YAXXZ
?cpu_accelerator@accelerator@Concurrency@@2QB_WB
?create_accelerator_view@direct3d@Concurrency@@YA?AVaccelerator_view@2@AEAVaccelerator@2@_NW4queuing_mode@2@@Z
?create_accelerator_view@direct3d@Concurrency@@YA?AVaccelerator_view@2@PEAUIUnknown@@W4queuing_mode@2@@Z
?create_marker@accelerator_view@Concurrency@@QEAA?AVcompletion_future@2@XZ
?create_view@accelerator@Concurrency@@QEAA?AVaccelerator_view@2@W4queuing_mode@2@@Z
?d3d_access_lock@direct3d@Concurrency@@YAXAEAVaccelerator_view@2@@Z
?d3d_access_try_lock@direct3d@Concurrency@@YA_NAEAVaccelerator_view@2@@Z
?d3d_access_unlock@direct3d@Concurrency@@YAXAEAVaccelerator_view@2@@Z
?default_accelerator@accelerator@Concurrency@@2QB_WB
?direct3d_ref@accelerator@Concurrency@@2QB_WB
?direct3d_warp@accelerator@Concurrency@@2QB_WB
?flush@accelerator_view@Concurrency@@QEAAXXZ
?get_accelerator@accelerator_view@Concurrency@@QEBA?AVaccelerator@2@XZ
?get_auto_selection_view@accelerator@Concurrency@@SA?AVaccelerator_view@2@XZ
?get_dedicated_memory@accelerator@Concurrency@@QEBA_KXZ
?get_default_cpu_access_type@accelerator@Concurrency@@QEBA?AW4access_type@2@XZ
?get_default_view@accelerator@Concurrency@@QEBA?AVaccelerator_view@2@XZ
?get_device@direct3d@Concurrency@@YAPEAUIUnknown@@AEBVaccelerator_view@2@@Z
?get_error_code@runtime_exception@Concurrency@@QEBAJXZ
?get_has_display@accelerator@Concurrency@@QEBA_NXZ
?get_is_auto_selection@accelerator_view@Concurrency@@QEBA_NXZ
?get_is_debug@accelerator@Concurrency@@QEBA_NXZ
?get_is_debug@accelerator_view@Concurrency@@QEBA_NXZ
?get_is_emulated@accelerator@Concurrency@@QEBA_NXZ
?get_queuing_mode@accelerator_view@Concurrency@@QEBA?AW4queuing_mode@2@XZ
?get_supports_cpu_shared_memory@accelerator@Concurrency@@QEBA_NXZ
?get_supports_double_precision@accelerator@Concurrency@@QEBA_NXZ
?get_supports_limited_double_precision@accelerator@Concurrency@@QEBA_NXZ
?get_version@accelerator@Concurrency@@QEBAIXZ
?get_version@accelerator_view@Concurrency@@QEBAIXZ
?get_view_removed_reason@accelerator_view_removed@Concurrency@@QEBAJXZ
?is_timeout_disabled@direct3d@Concurrency@@YA_NAEBVaccelerator_view@2@@Z
?set_default_cpu_access_type@accelerator@Concurrency@@QEAA_NW4access_type@2@@Z
?wait@accelerator_view@Concurrency@@QEAAXXZ
__dpc_create_call_handle
__dpc_dispatch_kernel
__dpc_release_call_handle
__dpc_set_const_buffer_info
__dpc_set_device_resource_info
__dpc_set_kernel_dispatch_info
__dpc_set_kernel_shader_info
Name
.text
Size
228KB
Virtual Size
227KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
116KB
Virtual Size
116KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=257, version=35207,
count=6, id=259, version=35207,
count=8, id=260, version=35207,
count=31, id=261, version=35207,
count=13, id=257, version=30795,
count=148, id=1, productName=Unmarked objects,
count=12, id=265, version=35207,
count=1, id=256, version=35207,
count=1, id=255, version=35207,
count=2, id=151,
count=1, id=258, version=35207,
vccorlib110.dll
- IMPHASH 712bac0fe3d1437797cd12af4f6768fb
- SHA256 2676360cc957f2d3b686c7bcabec05cf5c6f92959341ea8803e001cfd9c0d6b6
- MD5 0dd3f0e98dec0919a69f9f0d0aa8f3af
- SHA1 98749169b86ea3ce227149e5f85b712f052aa303
- SHA512 12b6d21a06fba132449dcdb4ed877e456598a67b99c0d9dce56e3861e5fce899563a7bf31a988e550a6c9b537803d4eaf65e0938202d0221a22ab5599dea59b4
- SSDEEP 6144:wcO17+z1at3OuRxtUNld2uG+WOzrD7TLj0M1Aja82yFO3RbWZ6E2d1:wf7+Zat3OOUQaLyb6
- TLSH T118845B633BAC8C93D823513546938B84FBB2FA951B71D30B31AA431E5F37362AD19635
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
149476
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vccorlib110.amd64.pdb
kernel32
RaiseException
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
FormatMessageW
IsDebuggerPresent
HeapAlloc
HeapFree
OutputDebugStringW
InitializeCriticalSection
HeapDestroy
LeaveCriticalSection
HeapCreate
EnterCriticalSection
DeleteCriticalSection
EncodePointer
SetEvent
WaitForMultipleObjectsEx
GetLastError
DecodePointer
CreateEventExW
CloseHandle
InitializeCriticalSectionEx
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount64
DisableThreadLibraryCalls
IsProcessorFeaturePresent
msvcr110
__CxxFrameHandler3
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
__CppXcptFilter
_amsg_exit
free
__C_specific_handler
_initterm
_initterm_e
__crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtCapturePreviousContext
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__clean_type_info_names_internal
??2@YAPEAX_K@Z
memmove
??1exception@std@@UEAA@XZ
?what@exception@std@@UEBAPEBDXZ
__wgetmainargs
_invoke_watson
wcscpy_s
_aligned_free
_malloc_crt
_aligned_offset_malloc
memcpy
_CxxThrowException
??3@YAXPEAX@Z
??_V@YAXPEAX@Z
printf
vswprintf_s
_purecall
?terminate@@YAXXZ
memset
msvcp110
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAPEBDH@Z
_Inf
_FInf
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringLen
WindowsDuplicateString
WindowsDeleteString
WindowsCompareStringOrdinal
WindowsCreateString
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsCreateStringReference
WindowsIsStringEmpty
api-ms-win-core-winrt-error-l1-1-0
RoCaptureErrorContext
GetRestrictedErrorInfo
RoTransformError
RoOriginateErrorW
SetRestrictedErrorInfo
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoRegisterActivationFactories
RoRevokeActivationFactories
RoUninitialize
RoInitialize
ole32
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoRevokeInitializeSpy
CoGetApartmentType
CoRegisterInitializeSpy
CoAddRefServerProcess
CoGetContextToken
CoTaskMemAlloc
CoTaskMemFree
CoCreateFreeThreadedMarshaler
CoGetObjectContext
CoReleaseServerProcess
oleaut32
SysAllocStringLen
SysFreeString
SysStringLen
?<Dispose>@Exception@Platform@@UE$AAAXXZ
?<Dispose>@String@Platform@@UE$AAAXXZ
?<Dispose>@Type@Platform@@UE$AAAXXZ
??0AccessDeniedException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0AccessDeniedException@Platform@@QE$AAA@XZ
??0Attribute@Metadata@Platform@@QE$AAA@XZ
??0Boolean@Platform@@QEAA@_N@Z
??0COMException@Platform@@QE$AAA@H@Z
??0COMException@Platform@@QE$AAA@HPE$AAVString@1@@Z
??0ChangedStateException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0ChangedStateException@Platform@@QE$AAA@XZ
??0ClassNotRegisteredException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0ClassNotRegisteredException@Platform@@QE$AAA@XZ
??0Delegate@Platform@@QE$AAA@XZ
??0DisconnectedException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0DisconnectedException@Platform@@QE$AAA@XZ
??0Enum@Platform@@QE$AAA@XZ
??0Exception@Platform@@QE$AAA@H@Z
??0Exception@Platform@@QE$AAA@HPE$AAVString@1@@Z
??0FailureException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0FailureException@Platform@@QE$AAA@XZ
??0GridLength@Xaml@UI@Windows@@QEAA@NW4GridUnitType@123@@Z
??0IntPtr@Platform@@QEAA@H@Z
??0IntPtr@Platform@@QEAA@PEAX@Z
??0InvalidArgumentException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0InvalidArgumentException@Platform@@QE$AAA@XZ
??0InvalidCastException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0InvalidCastException@Platform@@QE$AAA@XZ
??0MTAThreadAttribute@Platform@@QE$AAA@XZ
??0NotImplementedException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0NotImplementedException@Platform@@QE$AAA@XZ
??0NullReferenceException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0NullReferenceException@Platform@@QE$AAA@XZ
??0Object@Platform@@QE$AAA@XZ
??0ObjectDisposedException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0ObjectDisposedException@Platform@@QE$AAA@XZ
??0OnePhaseConstructedAttribute@CompilerServices@Runtime@Platform@@QE$AAA@XZ
??0OperationCanceledException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0OperationCanceledException@Platform@@QE$AAA@XZ
??0OutOfBoundsException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0OutOfBoundsException@Platform@@QE$AAA@XZ
??0OutOfMemoryException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0OutOfMemoryException@Platform@@QE$AAA@XZ
??0Rect@Foundation@Windows@@QEAA@VPoint@12@0@Z
??0Rect@Foundation@Windows@@QEAA@VPoint@12@VSize@12@@Z
??0RepeatBehavior@Animation@Media@Xaml@UI@Windows@@QEAA@N@Z
??0STAThreadAttribute@Platform@@QE$AAA@XZ
??0SizeT@Platform@@QEAA@H@Z
??0SizeT@Platform@@QEAA@PEAX@Z
??0Type@Platform@@QE$AAA@PE$AAVObject@1@@Z
??0Type@Platform@@QE$AAA@VIntPtr@1@@Z
??0Type@Platform@@QE$AAA@VTypeName@Interop@Xaml@UI@Windows@@@Z
??0ValueType@Platform@@QE$AAA@XZ
??0WrongThreadException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0WrongThreadException@Platform@@QE$AAA@XZ
??0char16@default@@QEAA@_W@Z
??0float32@default@@QEAA@M@Z
??0float64@default@@QEAA@N@Z
??0int16@default@@QEAA@F@Z
??0int32@default@@QEAA@H@Z
??0int64@default@@QEAA@_J@Z
??0int8@default@@QEAA@C@Z
??0uint16@default@@QEAA@G@Z
??0uint32@default@@QEAA@I@Z
??0uint64@default@@QEAA@_K@Z
??0uint8@default@@QEAA@E@Z
??BIntPtr@Platform@@SA?AV01@H@Z
??BIntPtr@Platform@@SA?AV01@PEAX@Z
??BIntPtr@Platform@@SAPEAXV01@@Z
??BType@Platform@@SA?AVTypeName@Interop@Xaml@UI@Windows@@PE$AAV01@@Z
??BType@Platform@@SAPE$AAV01@VTypeName@Interop@Xaml@UI@Windows@@@Z
??DMatrix3D@Media3D@Media@Xaml@UI@Windows@@SA?AV012345@V012345@0@Z
??GDuration@Xaml@UI@Windows@@SA?AV0123@V0123@0@Z
??HDuration@Xaml@UI@Windows@@SA?AV0123@V0123@0@Z
??MDuration@Xaml@UI@Windows@@SA_NV0123@0@Z
??NDuration@Xaml@UI@Windows@@SA_NV0123@0@Z
??ODuration@Xaml@UI@Windows@@SA_NV0123@0@Z
??PDuration@Xaml@UI@Windows@@SA_NV0123@0@Z
?AlignedAllocate@Heap@Details@Platform@@SAPEAX_K0@Z
?AlignedAllocateException@Heap@Details@Platform@@SAPEAX_K0@Z
?AlignedFree@Heap@Details@Platform@@SAXPEAX@Z
?AlignedFreeException@Heap@Details@Platform@@SAXPEAX@Z
?Allocate@Heap@Details@Platform@@SAPEAX_K@Z
?AllocateException@Heap@Details@Platform@@SAPEAX_K@Z
?Compare@Duration@Xaml@UI@Windows@@SAHV1234@0@Z
?Contains@Rect@Foundation@Windows@@QEAA_NVPoint@23@@Z
?CreateException@Exception@Platform@@SAPE$AAV12@H@Z
?CreateException@Exception@Platform@@SAPE$AAV12@HPE$AAVString@2@@Z
?CreateValue@Details@Platform@@YAPE$AAVObject@2@PE$AAVType@2@PEBX@Z
?EnableFactoryCache@@YAXXZ
?EnumerateAllocatedObjects@Heap@Details@Platform@@SAXPE$AAVHeapEntryHandler@23@@Z
?Equals@Attribute@Metadata@Platform@@QE$AAA_NPE$AAVObject@3@@Z
?Equals@Boolean@Platform@@QEAA_NPE$AAVObject@2@@Z
?Equals@Delegate@Platform@@QE$AAA_NPE$AAVObject@2@@Z
?Equals@Enum@Platform@@QE$AAA_NPE$AAVObject@2@@Z
?Equals@Exception@Platform@@UE$AAA_NPE$AAVObject@2@@Z
?Equals@MTAThreadAttribute@Platform@@QE$AAA_NPE$AAVObject@2@@Z
?Equals@Object@Platform@@QE$AAA_NPE$AAV12@@Z
?Equals@OnePhaseConstructedAttribute@CompilerServices@Runtime@Platform@@QE$AAA_NPE$AAVObject@4@@Z
?Equals@STAThreadAttribute@Platform@@QE$AAA_NPE$AAVObject@2@@Z
?Equals@Type@Platform@@UE$AAA_NPE$AAVObject@2@@Z
?Equals@ValueType@Platform@@QE$AAA_NPE$AAVObject@2@@Z
?Equals@char16@default@@QEAA_NPE$AAVObject@Platform@@@Z
?Equals@float32@default@@QEAA_NPE$AAVObject@Platform@@@Z
?Equals@float64@default@@QEAA_NPE$AAVObject@Platform@@@Z
?Equals@int16@default@@QEAA_NPE$AAVObject@Platform@@@Z
?Equals@int32@default@@QEAA_NPE$AAVObject@Platform@@@Z
?Equals@int64@default@@QEAA_NPE$AAVObject@Platform@@@Z
?Equals@int8@default@@QEAA_NPE$AAVObject@Platform@@@Z
?Equals@uint16@default@@QEAA_NPE$AAVObject@Platform@@@Z
?Equals@uint32@default@@QEAA_NPE$AAVObject@Platform@@@Z
?Equals@uint64@default@@QEAA_NPE$AAVObject@Platform@@@Z
?Equals@uint8@default@@QEAA_NPE$AAVObject@Platform@@@Z
?EventSourceAdd@Details@Platform@@YA?AVEventRegistrationToken@Foundation@Windows@@PEAPEAXPEAUEventLock@12@PE$AAVDelegate@2@@Z
?EventSourceGetTargetArray@Details@Platform@@YAPEAXPEAXPEAUEventLock@12@@Z
?EventSourceGetTargetArrayEvent@Details@Platform@@YAPEAXPEAXI@Z
?EventSourceGetTargetArraySize@Details@Platform@@YAIPEAX@Z
?EventSourceInitialize@Details@Platform@@YAXPEAPEAX@Z
?EventSourceRemove@Details@Platform@@YAXPEAPEAXPEAUEventLock@12@VEventRegistrationToken@Foundation@Windows@@@Z
?EventSourceUninitialize@Details@Platform@@YAXPEAPEAX@Z
?FlushFactoryCache@@YAXXZ
?Free@Heap@Details@Platform@@SAXPEAX@Z
?FreeException@Heap@Details@Platform@@SAXPEAX@Z
?GetActivationFactory@Details@Platform@@YAJPEAVModuleBase@1WRL@Microsoft@@PEAUHSTRING__@@PEAPEAUIActivationFactory@@@Z
?GetActivationFactoryByPCWSTR@@YAJPEAXAEAVGuid@Platform@@PEAPEAX@Z
?GetCmdArguments@Details@Platform@@YAPEAPEA_WPEAH@Z
?GetHashCode@Attribute@Metadata@Platform@@QE$AAAHXZ
?GetHashCode@Boolean@Platform@@QEAAHXZ
?GetHashCode@Delegate@Platform@@QE$AAAHXZ
?GetHashCode@Enum@Platform@@QE$AAAHXZ
?GetHashCode@Exception@Platform@@UE$AAAHXZ
?GetHashCode@Guid@Platform@@QEAAHXZ
?GetHashCode@MTAThreadAttribute@Platform@@QE$AAAHXZ
?GetHashCode@Object@Platform@@QE$AAAHXZ
?GetHashCode@OnePhaseConstructedAttribute@CompilerServices@Runtime@Platform@@QE$AAAHXZ
?GetHashCode@STAThreadAttribute@Platform@@QE$AAAHXZ
?GetHashCode@Type@Platform@@UE$AAAHXZ
?GetHashCode@ValueType@Platform@@QE$AAAHXZ
?GetHashCode@char16@default@@QEAAHXZ
?GetHashCode@float32@default@@QEAAHXZ
?GetHashCode@float64@default@@QEAAHXZ
?GetHashCode@int16@default@@QEAAHXZ
?GetHashCode@int32@default@@QEAAHXZ
?GetHashCode@int64@default@@QEAAHXZ
?GetHashCode@int8@default@@QEAAHXZ
?GetHashCode@uint16@default@@QEAAHXZ
?GetHashCode@uint32@default@@QEAAHXZ
?GetHashCode@uint64@default@@QEAAHXZ
?GetHashCode@uint8@default@@QEAAHXZ
?GetIBoxArrayVtable@Details@Platform@@YAPEAXPEAX@Z
?GetIBoxVtable@Details@Platform@@YAPEAXPEAX@Z
?GetIidsFn@@YAJHPEAKPEBU__s_GUID@@PEAPEAVGuid@Platform@@@Z
?GetObjectContext@Details@Platform@@YAPEAUIUnknown@@XZ
?GetProxyImpl@Details@Platform@@YAJPEAUIUnknown@@AEBU_GUID@@0PEAPEAU3@@Z
?GetType@Boolean@Platform@@QEAAPE$AAVType@2@XZ
?GetType@Guid@Platform@@QEAAPE$AAVType@2@XZ
?GetType@Object@Platform@@QE$AAAPE$AAVType@2@XZ
?GetType@char16@default@@QEAAPE$AAVType@Platform@@XZ
?GetType@float32@default@@QEAAPE$AAVType@Platform@@XZ
?GetType@float64@default@@QEAAPE$AAVType@Platform@@XZ
?GetType@int16@default@@QEAAPE$AAVType@Platform@@XZ
?GetType@int32@default@@QEAAPE$AAVType@Platform@@XZ
?GetType@int64@default@@QEAAPE$AAVType@Platform@@XZ
?GetType@int8@default@@QEAAPE$AAVType@Platform@@XZ
?GetType@uint16@default@@QEAAPE$AAVType@Platform@@XZ
?GetType@uint32@default@@QEAAPE$AAVType@Platform@@XZ
?GetType@uint64@default@@QEAAPE$AAVType@Platform@@XZ
?GetType@uint8@default@@QEAAPE$AAVType@Platform@@XZ
?GetTypeCode@Type@Platform@@SA?AW4TypeCode@2@PE$AAV12@@Z
?GetWeakReference@Details@Platform@@YAPEAU__abi_IUnknown@@QE$ADVObject@2@@Z
?InitializeData@Details@Platform@@YAJH@Z
?Intersect@Rect@Foundation@Windows@@QEAAXV123@@Z
?IntersectsWith@Rect@Foundation@Windows@@QEAA_NV123@@Z
?Invert@Matrix3D@Media3D@Media@Xaml@UI@Windows@@QEAAXXZ
?ReCreateException@Exception@Platform@@SAPE$AAV12@H@Z
?ReCreateFromException@Details@Platform@@YAJPE$AAVException@2@@Z
?ReferenceEquals@Object@Platform@@SA_NPE$AAV12@0@Z
?ReferenceEquals@Object@Platform@@SA_NPE$AAVString@2@0@Z
?RegisterFactories@Details@Platform@@YAPE$AAVObject@2@PEAPEAVModuleBase@1WRL@Microsoft@@PEAPEAU__abi_Module@@P6AXXZ@Z
?ReleaseInContextImpl@Details@Platform@@YAJPEAUIUnknown@@0@Z
?ResolveWeakReference@Details@Platform@@YAPE$AAVObject@2@AEBU_GUID@@PEAPEAU__abi_IUnknown@@@Z
?RunApplicationServer@Details@Platform@@YAXPEAPEAVModuleBase@1WRL@Microsoft@@PEAPEAU__abi_Module@@PEB_W@Z
?RunServer@Details@Platform@@YAXPEAPEAVModuleBase@1WRL@Microsoft@@PEAPEAU__abi_Module@@PEB_W@Z
?TerminateModule@Details@Platform@@YA_NPEAVModuleBase@1WRL@Microsoft@@@Z
?ToInt32@IntPtr@Platform@@QEAAHXZ
?ToString@Attribute@Metadata@Platform@@QE$AAAPE$AAVString@3@XZ
?ToString@Boolean@Platform@@QEAAPE$AAVString@2@XZ
?ToString@Delegate@Platform@@QE$AAAPE$AAVString@2@XZ
?ToString@Enum@Platform@@QE$AAAPE$AAVString@2@XZ
?ToString@Exception@Platform@@UE$AAAPE$AAVString@2@XZ
?ToString@Guid@Platform@@QEAAPE$AAVString@2@XZ
?ToString@MTAThreadAttribute@Platform@@QE$AAAPE$AAVString@2@XZ
?ToString@OnePhaseConstructedAttribute@CompilerServices@Runtime@Platform@@QE$AAAPE$AAVString@4@XZ
?ToString@STAThreadAttribute@Platform@@QE$AAAPE$AAVString@2@XZ
?ToString@Type@Platform@@UE$AAAPE$AAVString@2@XZ
?ToString@ValueType@Platform@@QE$AAAPE$AAVString@2@XZ
?ToString@char16@default@@QEAAPE$AAVString@Platform@@XZ
?ToString@float32@default@@QEAAPE$AAVString@Platform@@XZ
?ToString@float64@default@@QEAAPE$AAVString@Platform@@XZ
?ToString@int16@default@@QEAAPE$AAVString@Platform@@XZ
?ToString@int32@default@@QEAAPE$AAVString@Platform@@XZ
?ToString@int64@default@@QEAAPE$AAVString@Platform@@XZ
?ToString@int8@default@@QEAAPE$AAVString@Platform@@XZ
?ToString@uint16@default@@QEAAPE$AAVString@Platform@@XZ
?ToString@uint32@default@@QEAAPE$AAVString@Platform@@XZ
?ToString@uint64@default@@QEAAPE$AAVString@Platform@@XZ
?ToString@uint8@default@@QEAAPE$AAVString@Platform@@XZ
?UninitializeData@Details@Platform@@YAXH@Z
?Union@Rect@Foundation@Windows@@QEAAXV123@@Z
?Union@Rect@Foundation@Windows@@QEAAXVPoint@23@@Z
?WriteLine@Console@Details@Platform@@SAXPE$AAVObject@3@@Z
?WriteLine@Console@Details@Platform@@SAXPE$AAVString@3@@Z
?WriteLine@Console@Details@Platform@@SAXXZ
?__abi_FailFast@@YAXXZ
?__abi_ObjectToString@__abi_details@@YAPE$AAVString@Platform@@PE$AAVObject@3@_N@Z
?__abi_WinRTraiseAccessDeniedException@@YAXXZ
?__abi_WinRTraiseCOMException@@YAXJ@Z
?__abi_WinRTraiseChangedStateException@@YAXXZ
?__abi_WinRTraiseClassNotRegisteredException@@YAXXZ
?__abi_WinRTraiseDisconnectedException@@YAXXZ
?__abi_WinRTraiseFailureException@@YAXXZ
?__abi_WinRTraiseInvalidArgumentException@@YAXXZ
?__abi_WinRTraiseInvalidCastException@@YAXXZ
?__abi_WinRTraiseNotImplementedException@@YAXXZ
?__abi_WinRTraiseNullReferenceException@@YAXXZ
?__abi_WinRTraiseObjectDisposedException@@YAXXZ
?__abi_WinRTraiseOperationCanceledException@@YAXXZ
?__abi_WinRTraiseOutOfBoundsException@@YAXXZ
?__abi_WinRTraiseOutOfMemoryException@@YAXXZ
?__abi_WinRTraiseWrongThreadException@@YAXXZ
?__abi_cast_Object_to_String@__abi_details@@YAPE$AAVString@Platform@@_NPE$AAVObject@3@@Z
?__abi_cast_String_to_Object@__abi_details@@YAPE$AAVObject@Platform@@PE$AAVString@3@@Z
?__abi_make_type_id@@YAPE$AAVType@Platform@@AEBU__abi_type_descriptor@@@Z
?__getActivationFactoryByHSTRING@@YAJPEAUHSTRING__@@AEAVGuid@Platform@@PEAPEAX@Z
?get@Bottom@Rect@Foundation@Windows@@QEAAMXZ
?get@BreakOnAllocationId@Heap@Details@Platform@@SAHXZ
?get@BreakOnFreeId@Heap@Details@Platform@@SAHXZ
?get@CurrentAllocationId@Heap@Details@Platform@@SAHXZ
?get@Empty@Rect@Foundation@Windows@@SA?AV234@XZ
?get@Empty@Size@Foundation@Windows@@SA?AV234@XZ
?get@FullName@Type@Platform@@QE$AAAPE$AAVString@3@XZ
?get@HasInverse@Matrix3D@Media3D@Media@Xaml@UI@Windows@@QEAA_NXZ
?get@Message@Exception@Platform@@QE$AAAPE$AAVString@3@XZ
?get@ObjectCount@Heap@Details@Platform@@SAHXZ
?get@Right@Rect@Foundation@Windows@@QEAAMXZ
?get@TrackingLevel@Heap@Details@Platform@@SA?AW4HeapAllocationTrackingLevel@34@XZ
?set@BreakOnAllocationId@Heap@Details@Platform@@SAXH@Z
?set@BreakOnFreeId@Heap@Details@Platform@@SAXH@Z
?set@TrackingLevel@Heap@Details@Platform@@SAXW4HeapAllocationTrackingLevel@34@@Z
Name
.text
Size
153KB
Virtual Size
153KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
116KB
Virtual Size
115KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
42KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
minATL
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=203, version=50628,
count=1, id=199, version=41118,
count=2, id=205, version=50628,
count=13, id=206, version=50628,
count=8, id=207, version=50628,
count=112, id=1, productName=Unmarked objects,
count=7, id=185, version=30716,
count=17, id=211, version=50628,
count=1, id=202, version=50628,
count=1, id=201, version=50628,
count=1, id=204, version=50628,
vccorlib140.dll
- IMPHASH 4b8a73c69b5df9623905e0e06e504347
- SHA256 19839407c3fdbc824e5bce189bf68ddf8097f12ec28b757797ffa0415c144ddd
- MD5 0b4d02b22ffe3957db27d9cc6cff6edf
- SHA1 bec5a8eed4434222956d9f0f0482f8562d992317
- SHA512 9588f6e2c96b2793598cd6335bf10cdd53acd77886a5f703118c77af676da1ec3f393d55a1b1dc28dd33bf69c4c5bc70c615f8d41e1829e473ff9bbc1163ea3c
- SSDEEP 6144:PpVeNd1C++IAU1qsxEW5QcT2Xgs4hiWi/GDhmVejWXaV+GpfOqmIzt/mtBGgVa0J:Pp0+Xgs4hiWi/GDhmVejWXabO/IzgtK+
- TLSH T16C74E4277B9C4CC3C931A0794E978309E372694207A1E3CB0691970E5F7B7E8AD3B665
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
61:42:1e:6f:cd:1d:8f:6a:36:f6:8c:af:1a:05:3e:3e:9c:e4:89:89:ca:0e:c2:c0:49:89:cf:b1:76:9a:d3:ba
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 10, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
61:42:1e:6f:cd:1d:8f:6a:36:f6:8c:af:1a:05:3e:3e:9c:e4:89:89:ca:0e:c2:c0:49:89:cf:b1:76:9a:d3:ba
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 10, 2025
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:0d:c4:e7:bb:f4:af:f8:f0:90:00:00:00:00:01:0d
Issuer
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 15, 2025 - May 15, 2026
Subject
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:14:9d:fb:c3:1f:1f:63:c3:10:00:00:00:00:00:14
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
May 1, 2013 - May 1, 2028
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:3605-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:f7:58:20:75:04:ca:fb:c2:f4:00:01:00:00:01:f7
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:7f:2f:42:2a:73:53:08:de:ea:00:00:00:00:04:7f
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 15, 2025 - May 15, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:431A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:fa:fb:3b:44:d3:77:33:c6:d3:00:01:00:00:01:fa
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Minor OS version
0
Major OS version
6
Entry point
167296
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\binaries\amd64ret\bin\amd64\vccorlib140.amd64.pdb
kernel32
RaiseException
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
FormatMessageW
GetProcAddress
LoadLibraryExW
HeapFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
GetLastError
OutputDebugStringW
HeapAlloc
DeleteCriticalSection
GetProcessHeap
CreateEventExW
WaitForMultipleObjectsEx
SetEvent
CloseHandle
DecodePointer
InitializeSRWLock
TryAcquireSRWLockShared
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
__std_type_info_destroy_list
memcpy
memcmp
_purecall
memset
_CxxThrowException
__C_specific_handler
__current_exception_context
__current_exception
_SetWinRTOutOfMemoryExceptionCallback
__GetPlatformExceptionInfo
__std_exception_copy
__std_exception_destroy
__std_terminate
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__stdio_common_vswprintf_s
__stdio_common_vfprintf
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_register_onexit_function
_execute_onexit_table
_invoke_watson
__p___wargv
__p___argc
_configure_wide_argv
terminate
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_cexit
_initterm_e
_initterm
_initialize_onexit_table
api-ms-win-crt-heap-l1-1-0
free
_aligned_offset_malloc
_aligned_free
malloc
_callnewh
api-ms-win-crt-string-l1-1-0
wcscpy_s
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
ole32
CoTaskMemFree
CoGetContextToken
CoAddRefServerProcess
CoReleaseServerProcess
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoGetApartmentType
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoGetObjectContext
oleaut32
SysFreeString
SysAllocStringLen
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
WindowsIsStringEmpty
WindowsGetStringRawBuffer
WindowsGetStringLen
WindowsCompareStringOrdinal
WindowsStringHasEmbeddedNull
WindowsCreateString
WindowsDuplicateString
WindowsDeleteString
api-ms-win-core-winrt-error-l1-1-0
GetRestrictedErrorInfo
SetRestrictedErrorInfo
RoOriginateError
RoTransformError
api-ms-win-core-winrt-l1-1-0
RoRegisterActivationFactories
RoUninitialize
RoInitialize
RoUnregisterForApartmentShutdown
RoGetActivationFactory
RoRegisterForApartmentShutdown
RoGetApartmentIdentifier
RoRevokeActivationFactories
api-ms-win-crt-math-l1-1-0
ceilf
?<Dispose>@Exception@Platform@@UE$AAAXXZ
?<Dispose>@String@Platform@@UE$AAAXXZ
?<Dispose>@Type@Platform@@UE$AAAXXZ
??0AccessDeniedException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0AccessDeniedException@Platform@@QE$AAA@XZ
??0Attribute@Metadata@Platform@@QE$AAA@XZ
??0Boolean@Platform@@QEAA@_N@Z
??0COMException@Platform@@QE$AAA@H@Z
??0COMException@Platform@@QE$AAA@HPE$AAVString@1@@Z
??0ChangedStateException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0ChangedStateException@Platform@@QE$AAA@XZ
??0ClassNotRegisteredException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0ClassNotRegisteredException@Platform@@QE$AAA@XZ
??0Delegate@Platform@@QE$AAA@XZ
??0DisconnectedException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0DisconnectedException@Platform@@QE$AAA@XZ
??0Enum@Platform@@QE$AAA@XZ
??0Exception@Platform@@QE$AAA@H@Z
??0Exception@Platform@@QE$AAA@HPE$AAVString@1@@Z
??0FailureException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0FailureException@Platform@@QE$AAA@XZ
??0GridLength@Xaml@UI@Windows@@QEAA@NW4GridUnitType@123@@Z
??0IntPtr@Platform@@QEAA@H@Z
??0IntPtr@Platform@@QEAA@PEAX@Z
??0InvalidArgumentException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0InvalidArgumentException@Platform@@QE$AAA@XZ
??0InvalidCastException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0InvalidCastException@Platform@@QE$AAA@XZ
??0MTAThreadAttribute@Platform@@QE$AAA@XZ
??0NotImplementedException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0NotImplementedException@Platform@@QE$AAA@XZ
??0NullReferenceException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0NullReferenceException@Platform@@QE$AAA@XZ
??0Object@Platform@@QE$AAA@XZ
??0ObjectDisposedException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0ObjectDisposedException@Platform@@QE$AAA@XZ
??0OnePhaseConstructedAttribute@CompilerServices@Runtime@Platform@@QE$AAA@XZ
??0OperationCanceledException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0OperationCanceledException@Platform@@QE$AAA@XZ
??0OutOfBoundsException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0OutOfBoundsException@Platform@@QE$AAA@XZ
??0OutOfMemoryException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0OutOfMemoryException@Platform@@QE$AAA@XZ
??0Rect@Foundation@Windows@@QEAA@VPoint@12@0@Z
??0Rect@Foundation@Windows@@QEAA@VPoint@12@VSize@12@@Z
??0RepeatBehavior@Animation@Media@Xaml@UI@Windows@@QEAA@N@Z
??0STAThreadAttribute@Platform@@QE$AAA@XZ
??0SizeT@Platform@@QEAA@H@Z
??0SizeT@Platform@@QEAA@PEAX@Z
??0Type@Platform@@QE$AAA@PE$AAVObject@1@@Z
??0Type@Platform@@QE$AAA@VIntPtr@1@@Z
??0Type@Platform@@QE$AAA@VTypeName@Interop@Xaml@UI@Windows@@@Z
??0ValueType@Platform@@QE$AAA@XZ
??0WrongThreadException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0WrongThreadException@Platform@@QE$AAA@XZ
??0char16@default@@QEAA@_W@Z
??0float32@default@@QEAA@M@Z
??0float64@default@@QEAA@N@Z
??0int16@default@@QEAA@F@Z
??0int32@default@@QEAA@H@Z
??0int64@default@@QEAA@_J@Z
??0int8@default@@QEAA@C@Z
??0uint16@default@@QEAA@G@Z
??0uint32@default@@QEAA@I@Z
??0uint64@default@@QEAA@_K@Z
??0uint8@default@@QEAA@E@Z
??BIntPtr@Platform@@SA?AV01@H@Z
??BIntPtr@Platform@@SA?AV01@PEAX@Z
??BIntPtr@Platform@@SAPEAXV01@@Z
??BType@Platform@@SA?AVTypeName@Interop@Xaml@UI@Windows@@PE$AAV01@@Z
??BType@Platform@@SAPE$AAV01@VTypeName@Interop@Xaml@UI@Windows@@@Z
??DMatrix3D@Media3D@Media@Xaml@UI@Windows@@SA?AV012345@V012345@0@Z
??GDuration@Xaml@UI@Windows@@SA?AV0123@V0123@0@Z
??HDuration@Xaml@UI@Windows@@SA?AV0123@V0123@0@Z
??MDuration@Xaml@UI@Windows@@SA_NV0123@0@Z
??NDuration@Xaml@UI@Windows@@SA_NV0123@0@Z
??ODuration@Xaml@UI@Windows@@SA_NV0123@0@Z
??PDuration@Xaml@UI@Windows@@SA_NV0123@0@Z
?AlignedAllocate@Heap@Details@Platform@@SAPEAX_K00@Z
?AlignedAllocate@Heap@Details@Platform@@SAPEAX_K0@Z
?AlignedAllocateException@Heap@Details@Platform@@SAPEAX_K00@Z
?AlignedAllocateException@Heap@Details@Platform@@SAPEAX_K0@Z
?AlignedFree@Heap@Details@Platform@@SAXPEAX@Z
?AlignedFreeException@Heap@Details@Platform@@SAXPEAX@Z
?Allocate@Heap@Details@Platform@@SAPEAX_K0@Z
?Allocate@Heap@Details@Platform@@SAPEAX_K@Z
?AllocateException@Heap@Details@Platform@@SAPEAX_K0@Z
?AllocateException@Heap@Details@Platform@@SAPEAX_K@Z
?Compare@Duration@Xaml@UI@Windows@@SAHV1234@0@Z
?Contains@Rect@Foundation@Windows@@QEAA_NVPoint@23@@Z
?CreateException@Exception@Platform@@SAPE$AAV12@H@Z
?CreateException@Exception@Platform@@SAPE$AAV12@HPE$AAVString@2@@Z
?CreateValue@Details@Platform@@YAPE$AAVObject@2@W4TypeCode@2@PEBX@Z
?EnableFactoryCache@@YAXXZ
?EnumerateAllocatedObjects@Heap@Details@Platform@@SAXPE$AAVHeapEntryHandler@23@@Z
?Equals@Attribute@Metadata@Platform@@QE$AAA_NPE$AAVObject@3@@Z
?Equals@Boolean@Platform@@QEAA_NPE$AAVObject@2@@Z
?Equals@Delegate@Platform@@QE$AAA_NPE$AAVObject@2@@Z
?Equals@Enum@Platform@@QE$AAA_NPE$AAVObject@2@@Z
?Equals@Exception@Platform@@UE$AAA_NPE$AAVObject@2@@Z
?Equals@MTAThreadAttribute@Platform@@QE$AAA_NPE$AAVObject@2@@Z
?Equals@Object@Platform@@QE$AAA_NPE$AAV12@@Z
?Equals@OnePhaseConstructedAttribute@CompilerServices@Runtime@Platform@@QE$AAA_NPE$AAVObject@4@@Z
?Equals@STAThreadAttribute@Platform@@QE$AAA_NPE$AAVObject@2@@Z
?Equals@Type@Platform@@UE$AAA_NPE$AAVObject@2@@Z
?Equals@ValueType@Platform@@QE$AAA_NPE$AAVObject@2@@Z
?Equals@char16@default@@QEAA_NPE$AAVObject@Platform@@@Z
?Equals@float32@default@@QEAA_NPE$AAVObject@Platform@@@Z
?Equals@float64@default@@QEAA_NPE$AAVObject@Platform@@@Z
?Equals@int16@default@@QEAA_NPE$AAVObject@Platform@@@Z
?Equals@int32@default@@QEAA_NPE$AAVObject@Platform@@@Z
?Equals@int64@default@@QEAA_NPE$AAVObject@Platform@@@Z
?Equals@int8@default@@QEAA_NPE$AAVObject@Platform@@@Z
?Equals@uint16@default@@QEAA_NPE$AAVObject@Platform@@@Z
?Equals@uint32@default@@QEAA_NPE$AAVObject@Platform@@@Z
?Equals@uint64@default@@QEAA_NPE$AAVObject@Platform@@@Z
?Equals@uint8@default@@QEAA_NPE$AAVObject@Platform@@@Z
?EventSourceAdd@Details@Platform@@YA?AVEventRegistrationToken@Foundation@Windows@@PEAPEAXPEAUEventLock@12@PE$AAVDelegate@2@@Z
?EventSourceGetTargetArray@Details@Platform@@YAPEAXPEAXPEAUEventLock@12@@Z
?EventSourceGetTargetArrayEvent@Details@Platform@@YAPEAXPEAXIPEBXPEA_J@Z
?EventSourceGetTargetArraySize@Details@Platform@@YAIPEAX@Z
?EventSourceInitialize@Details@Platform@@YAXPEAPEAX@Z
?EventSourceRemove@Details@Platform@@YAXPEAPEAXPEAUEventLock@12@VEventRegistrationToken@Foundation@Windows@@@Z
?EventSourceUninitialize@Details@Platform@@YAXPEAPEAX@Z
?FlushFactoryCache@@YAXXZ
?Free@Heap@Details@Platform@@SAXPEAX@Z
?FreeException@Heap@Details@Platform@@SAXPEAX@Z
?GetActivationFactory@Details@Platform@@YAJPEAVModuleBase@1WRL@Microsoft@@PEAUHSTRING__@@PEAPEAUIActivationFactory@@@Z
?GetActivationFactoryByPCWSTR@@YAJPEAXAEAVGuid@Platform@@PEAPEAX@Z
?GetCmdArguments@Details@Platform@@YAPEAPEA_WPEAH@Z
?GetHashCode@Attribute@Metadata@Platform@@QE$AAAHXZ
?GetHashCode@Boolean@Platform@@QEAAHXZ
?GetHashCode@Delegate@Platform@@QE$AAAHXZ
?GetHashCode@Enum@Platform@@QE$AAAHXZ
?GetHashCode@Exception@Platform@@UE$AAAHXZ
?GetHashCode@Guid@Platform@@QEAAHXZ
?GetHashCode@MTAThreadAttribute@Platform@@QE$AAAHXZ
?GetHashCode@Object@Platform@@QE$AAAHXZ
?GetHashCode@OnePhaseConstructedAttribute@CompilerServices@Runtime@Platform@@QE$AAAHXZ
?GetHashCode@STAThreadAttribute@Platform@@QE$AAAHXZ
?GetHashCode@Type@Platform@@UE$AAAHXZ
?GetHashCode@ValueType@Platform@@QE$AAAHXZ
?GetHashCode@char16@default@@QEAAHXZ
?GetHashCode@float32@default@@QEAAHXZ
?GetHashCode@float64@default@@QEAAHXZ
?GetHashCode@int16@default@@QEAAHXZ
?GetHashCode@int32@default@@QEAAHXZ
?GetHashCode@int64@default@@QEAAHXZ
?GetHashCode@int8@default@@QEAAHXZ
?GetHashCode@uint16@default@@QEAAHXZ
?GetHashCode@uint32@default@@QEAAHXZ
?GetHashCode@uint64@default@@QEAAHXZ
?GetHashCode@uint8@default@@QEAAHXZ
?GetIBoxArrayVtable@Details@Platform@@YAPEAXPEAX@Z
?GetIBoxVtable@Details@Platform@@YAPEAXPEAX@Z
?GetIidsFn@@YAJHPEAKPEBU__s_GUID@@PEAPEAVGuid@Platform@@@Z
?GetObjectContext@Details@Platform@@YAPEAUIUnknown@@XZ
?GetProxyImpl@Details@Platform@@YAJPEAUIUnknown@@AEBU_GUID@@0PEAPEAU3@@Z
?GetType@Boolean@Platform@@QEAAPE$AAVType@2@XZ
?GetType@Guid@Platform@@QEAAPE$AAVType@2@XZ
?GetType@Object@Platform@@QE$AAAPE$AAVType@2@XZ
?GetType@char16@default@@QEAAPE$AAVType@Platform@@XZ
?GetType@float32@default@@QEAAPE$AAVType@Platform@@XZ
?GetType@float64@default@@QEAAPE$AAVType@Platform@@XZ
?GetType@int16@default@@QEAAPE$AAVType@Platform@@XZ
?GetType@int32@default@@QEAAPE$AAVType@Platform@@XZ
?GetType@int64@default@@QEAAPE$AAVType@Platform@@XZ
?GetType@int8@default@@QEAAPE$AAVType@Platform@@XZ
?GetType@uint16@default@@QEAAPE$AAVType@Platform@@XZ
?GetType@uint32@default@@QEAAPE$AAVType@Platform@@XZ
?GetType@uint64@default@@QEAAPE$AAVType@Platform@@XZ
?GetType@uint8@default@@QEAAPE$AAVType@Platform@@XZ
?GetTypeCode@Type@Platform@@SA?AW4TypeCode@2@PE$AAV12@@Z
?GetWeakReference@Details@Platform@@YAPEAU__abi_IUnknown@@QE$ADVObject@2@@Z
?InitControlBlock@ControlBlock@Details@Platform@@AEAAXPEAX_N11@Z
?InitializeData@Details@Platform@@YAJH@Z
?Intersect@Rect@Foundation@Windows@@QEAAXV123@@Z
?IntersectsWith@Rect@Foundation@Windows@@QEAA_NV123@@Z
?Invert@Matrix3D@Media3D@Media@Xaml@UI@Windows@@QEAAXXZ
?ReCreateException@Exception@Platform@@SAPE$AAV12@H@Z
?ReferenceEquals@Object@Platform@@SA_NPE$AAV12@0@Z
?ReferenceEquals@Object@Platform@@SA_NPE$AAVString@2@0@Z
?RegisterFactories@Details@Platform@@YAPE$AAVObject@2@PEAPEAVModuleBase@1WRL@Microsoft@@PEAPEAU__abi_Module@@P6AXXZ@Z
?ReleaseInContextImpl@Details@Platform@@YAJPEAUIUnknown@@0@Z
?ReleaseTarget@ControlBlock@Details@Platform@@AEAAXXZ
?ResolveWeakReference@Details@Platform@@YAPE$AAVObject@2@AEBU_GUID@@PEAPEAU__abi_IUnknown@@@Z
?RunApplicationServer@Details@Platform@@YAXPEAPEAVModuleBase@1WRL@Microsoft@@PEAPEAU__abi_Module@@PEB_W@Z
?RunServer@Details@Platform@@YAXPEAPEAVModuleBase@1WRL@Microsoft@@PEAPEAU__abi_Module@@PEB_W@Z
?TerminateModule@Details@Platform@@YA_NPEAVModuleBase@1WRL@Microsoft@@@Z
?ToInt32@IntPtr@Platform@@QEAAHXZ
?ToString@Attribute@Metadata@Platform@@QE$AAAPE$AAVString@3@XZ
?ToString@Boolean@Platform@@QEAAPE$AAVString@2@XZ
?ToString@Delegate@Platform@@QE$AAAPE$AAVString@2@XZ
?ToString@Enum@Platform@@QE$AAAPE$AAVString@2@XZ
?ToString@Exception@Platform@@UE$AAAPE$AAVString@2@XZ
?ToString@Guid@Platform@@QEAAPE$AAVString@2@XZ
?ToString@MTAThreadAttribute@Platform@@QE$AAAPE$AAVString@2@XZ
?ToString@OnePhaseConstructedAttribute@CompilerServices@Runtime@Platform@@QE$AAAPE$AAVString@4@XZ
?ToString@STAThreadAttribute@Platform@@QE$AAAPE$AAVString@2@XZ
?ToString@Type@Platform@@UE$AAAPE$AAVString@2@XZ
?ToString@ValueType@Platform@@QE$AAAPE$AAVString@2@XZ
?ToString@char16@default@@QEAAPE$AAVString@Platform@@XZ
?ToString@float32@default@@QEAAPE$AAVString@Platform@@XZ
?ToString@float64@default@@QEAAPE$AAVString@Platform@@XZ
?ToString@int16@default@@QEAAPE$AAVString@Platform@@XZ
?ToString@int32@default@@QEAAPE$AAVString@Platform@@XZ
?ToString@int64@default@@QEAAPE$AAVString@Platform@@XZ
?ToString@int8@default@@QEAAPE$AAVString@Platform@@XZ
?ToString@uint16@default@@QEAAPE$AAVString@Platform@@XZ
?ToString@uint32@default@@QEAAPE$AAVString@Platform@@XZ
?ToString@uint64@default@@QEAAPE$AAVString@Platform@@XZ
?ToString@uint8@default@@QEAAPE$AAVString@Platform@@XZ
?UninitializeData@Details@Platform@@YAXH@Z
?Union@Rect@Foundation@Windows@@QEAAXV123@@Z
?Union@Rect@Foundation@Windows@@QEAAXVPoint@23@@Z
?WriteLine@Console@Details@Platform@@SAXPE$AAVObject@3@@Z
?WriteLine@Console@Details@Platform@@SAXPE$AAVString@3@@Z
?WriteLine@Console@Details@Platform@@SAXXZ
?__abi_FailFast@@YAXXZ
?__abi_ObjectToString@__abi_details@@YAPE$AAVString@Platform@@PE$AAVObject@3@_N@Z
?__abi_Resolve@ControlBlock@Details@Platform@@UEAAJAEAVGuid@3@PEAPEAU__abi_IInspectable@@@Z
?__abi_WinRTraiseAccessDeniedException@@YAXXZ
?__abi_WinRTraiseCOMException@@YAXJ@Z
?__abi_WinRTraiseChangedStateException@@YAXXZ
?__abi_WinRTraiseClassNotRegisteredException@@YAXXZ
?__abi_WinRTraiseDisconnectedException@@YAXXZ
?__abi_WinRTraiseFailureException@@YAXXZ
?__abi_WinRTraiseInvalidArgumentException@@YAXXZ
?__abi_WinRTraiseInvalidCastException@@YAXXZ
?__abi_WinRTraiseNotImplementedException@@YAXXZ
?__abi_WinRTraiseNullReferenceException@@YAXXZ
?__abi_WinRTraiseObjectDisposedException@@YAXXZ
?__abi_WinRTraiseOperationCanceledException@@YAXXZ
?__abi_WinRTraiseOutOfBoundsException@@YAXXZ
?__abi_WinRTraiseOutOfMemoryException@@YAXXZ
?__abi_WinRTraiseWrongThreadException@@YAXXZ
?__abi_cast_Object_to_String@__abi_details@@YAPE$AAVString@Platform@@_NPE$AAVObject@3@@Z
?__abi_cast_String_to_Object@__abi_details@@YAPE$AAVObject@Platform@@PE$AAVString@3@@Z
?__abi_make_type_id@@YAPE$AAVType@Platform@@AEBU__abi_type_descriptor@@@Z
?__abi_translateCurrentException@@YAJ_N@Z
?__getActivationFactoryByHSTRING@@YAJPEAUHSTRING__@@AEAVGuid@Platform@@PEAPEAX@Z
?get@Bottom@Rect@Foundation@Windows@@QEAAMXZ
?get@BreakOnAllocationId@Heap@Details@Platform@@SAHXZ
?get@BreakOnFreeId@Heap@Details@Platform@@SAHXZ
?get@CurrentAllocationId@Heap@Details@Platform@@SAHXZ
?get@Empty@Rect@Foundation@Windows@@SA?AV234@XZ
?get@Empty@Size@Foundation@Windows@@SA?AV234@XZ
?get@FullName@Type@Platform@@QE$AAAPE$AAVString@3@XZ
?get@HasInverse@Matrix3D@Media3D@Media@Xaml@UI@Windows@@QEAA_NXZ
?get@Message@Exception@Platform@@QE$AAAPE$AAVString@3@XZ
?get@ObjectCount@Heap@Details@Platform@@SAHXZ
?get@Right@Rect@Foundation@Windows@@QEAAMXZ
?get@TrackingLevel@Heap@Details@Platform@@SA?AW4HeapAllocationTrackingLevel@34@XZ
?set@BreakOnAllocationId@Heap@Details@Platform@@SAXH@Z
?set@BreakOnFreeId@Heap@Details@Platform@@SAXH@Z
?set@TrackingLevel@Heap@Details@Platform@@SAXW4HeapAllocationTrackingLevel@34@@Z
Name
.text
Size
164KB
Virtual Size
164KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
100KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
41KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=257, version=35207,
count=4, id=259, version=35207,
count=8, id=260, version=35207,
count=27, id=261, version=35207,
count=7, id=257, version=30795,
count=118, id=1, productName=Unmarked objects,
count=17, id=265, version=35207,
count=1, id=256, version=35207,
count=1, id=255, version=35207,
count=1, id=151,
count=1, id=258, version=35207,
vcomp140.dll
- IMPHASH a7f7752d6202c6b5602510cb5c8c7dee
- SHA256 55aba23cdcd6484fbb06f4155b8ca75adfce7a881f10afd0c49457165e677164
- MD5 58cdd0d365e9d2cfe6d482415d2314bc
- SHA1 e994ef11626973ba4bf77f712339083421105222
- SHA512 92ceb762c8503b2acba329cef5ba80bac77ed39bef3dd9c7850d0ebd923881d20c990f74eca37aa38c45988a0c86725fe751de883a00618a7bff211fe257ca91
- SSDEEP 3072:7jHvnFGfFeBLMiHxPT0g4v6KdKnFhSIOJGuV9ZlYIECdjPPYyB5/d/o/tF:7jH9VBL9T0xvpKFhRDcom/dAT
- TLSH T170148D46B3E9006BE87B9634C9674916E773784207609BDF03A443BE5F273C1AD3AB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
f6:80:f1:3d:80:86:3f:0d:c3:6c:c8:be:ed:1f:c2:45:ac:d6:df:6f:c0:bf:28:be:92:82:b0:3b:2e:92:e6:95
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 10, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
f6:80:f1:3d:80:86:3f:0d:c3:6c:c8:be:ed:1f:c2:45:ac:d6:df:6f:c0:bf:28:be:92:82:b0:3b:2e:92:e6:95
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 10, 2025
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:0d:c4:e7:bb:f4:af:f8:f0:90:00:00:00:00:01:0d
Issuer
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 15, 2025 - May 15, 2026
Subject
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:14:9d:fb:c3:1f:1f:63:c3:10:00:00:00:00:00:14
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
May 1, 2013 - May 1, 2028
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:521A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:00:0b:d7:aa:7f:1b:2a:17:56:00:01:00:00:02:00
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:7f:2f:42:2a:73:53:08:de:ea:00:00:00:00:04:7f
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 15, 2025 - May 15, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
27168
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcomp140.amd64.pdb
kernel32
FormatMessageW
OutputDebugStringW
LocalAlloc
LocalFree
GetConsoleWindow
GetConsoleScreenBufferInfo
WriteConsoleW
WideCharToMultiByte
WriteFile
GetLastError
GetCurrentThreadId
HeapFree
GetProcessHeap
UnhandledExceptionFilter
CloseHandle
WaitForSingleObjectEx
SetEvent
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
HeapAlloc
TryEnterCriticalSection
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
GetTickCount
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
Sleep
SwitchToThread
ExitProcess
GetStdHandle
CreateThread
QueueUserWorkItem
CreateEventW
LoadLibraryExW
FreeLibrary
GetProcAddress
VirtualAlloc
GetModuleHandleW
VirtualProtect
VirtualFree
GetNativeSystemInfo
QueryPerformanceFrequency
GetSystemTimeAdjustment
GetEnvironmentVariableW
lstrlenW
lstrcmpiW
GetStringTypeExW
ResetEvent
GetCurrentProcess
SetThreadPreferredUILanguages
GetThreadPreferredUILanguages
FindFirstFileW
FindNextFileW
FindClose
GetModuleFileNameW
FindResourceExW
LoadResource
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
RtlUnwindEx
SetLastError
IsDebuggerPresent
GetModuleHandleExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
FlsGetValue
FlsSetValue
LCMapStringW
SetFilePointerEx
GetStringTypeW
SetStdHandle
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
RaiseException
CreateFileW
EncodePointer
RtlPcToFileHeader
C2VectParallel
_vcomp_atomic_add_i1
_vcomp_atomic_add_i2
_vcomp_atomic_add_i4
_vcomp_atomic_add_i8
_vcomp_atomic_add_r4
_vcomp_atomic_add_r8
_vcomp_atomic_and_i1
_vcomp_atomic_and_i2
_vcomp_atomic_and_i4
_vcomp_atomic_and_i8
_vcomp_atomic_div_i1
_vcomp_atomic_div_i2
_vcomp_atomic_div_i4
_vcomp_atomic_div_i8
_vcomp_atomic_div_r4
_vcomp_atomic_div_r8
_vcomp_atomic_div_ui1
_vcomp_atomic_div_ui2
_vcomp_atomic_div_ui4
_vcomp_atomic_div_ui8
_vcomp_atomic_mul_i1
_vcomp_atomic_mul_i2
_vcomp_atomic_mul_i4
_vcomp_atomic_mul_i8
_vcomp_atomic_mul_r4
_vcomp_atomic_mul_r8
_vcomp_atomic_or_i1
_vcomp_atomic_or_i2
_vcomp_atomic_or_i4
_vcomp_atomic_or_i8
_vcomp_atomic_shl_i1
_vcomp_atomic_shl_i2
_vcomp_atomic_shl_i4
_vcomp_atomic_shl_i8
_vcomp_atomic_shr_i1
_vcomp_atomic_shr_i2
_vcomp_atomic_shr_i4
_vcomp_atomic_shr_i8
_vcomp_atomic_shr_ui1
_vcomp_atomic_shr_ui2
_vcomp_atomic_shr_ui4
_vcomp_atomic_shr_ui8
_vcomp_atomic_sub_i1
_vcomp_atomic_sub_i2
_vcomp_atomic_sub_i4
_vcomp_atomic_sub_i8
_vcomp_atomic_sub_r4
_vcomp_atomic_sub_r8
_vcomp_atomic_xor_i1
_vcomp_atomic_xor_i2
_vcomp_atomic_xor_i4
_vcomp_atomic_xor_i8
_vcomp_barrier
_vcomp_copyprivate_broadcast
_vcomp_copyprivate_receive
_vcomp_enter_critsect
_vcomp_flush
_vcomp_for_dynamic_init
_vcomp_for_dynamic_init_i8
_vcomp_for_dynamic_next
_vcomp_for_dynamic_next_i8
_vcomp_for_static_end
_vcomp_for_static_init
_vcomp_for_static_init_i8
_vcomp_for_static_simple_init
_vcomp_for_static_simple_init_i8
_vcomp_fork
_vcomp_get_thread_num
_vcomp_leave_critsect
_vcomp_master_barrier
_vcomp_master_begin
_vcomp_master_end
_vcomp_ordered_begin
_vcomp_ordered_end
_vcomp_ordered_loop_end
_vcomp_reduction_i1
_vcomp_reduction_i2
_vcomp_reduction_i4
_vcomp_reduction_i8
_vcomp_reduction_r4
_vcomp_reduction_r8
_vcomp_reduction_u1
_vcomp_reduction_u2
_vcomp_reduction_u4
_vcomp_reduction_u8
_vcomp_sections_init
_vcomp_sections_next
_vcomp_set_num_threads
_vcomp_single_begin
_vcomp_single_end
omp_destroy_lock
omp_destroy_nest_lock
omp_get_dynamic
omp_get_max_threads
omp_get_nested
omp_get_num_procs
omp_get_num_threads
omp_get_thread_num
omp_get_wtick
omp_get_wtime
omp_in_parallel
omp_init_lock
omp_init_nest_lock
omp_set_dynamic
omp_set_lock
omp_set_nest_lock
omp_set_nested
omp_set_num_threads
omp_test_lock
omp_test_nest_lock
omp_unset_lock
omp_unset_nest_lock
Name
.text
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
50KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=30795,
count=124, id=261, version=30795,
count=9, id=260, version=30795,
count=12, id=260, version=35207,
count=23, id=261, version=35207,
count=3, id=257, version=30795,
count=112, id=1, productName=Unmarked objects,
count=14, id=265, version=35207,
count=11, id=259, version=35207,
count=1, id=256, version=35207,
count=1, id=255, version=35207,
count=1, id=151,
count=1, id=258, version=35207,
vcruntime140.dll
- IMPHASH 6b799efc51fdd03aa3707013f22955b8
- SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
- MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
- SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
- SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
- SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
- TLSH T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
16:1c:67:8a:c5:2f:a0:39:a4:a9:0f:75:90:8c:e8:cb:7d:a9:39:8b:9d:1e:9f:21:df:a7:31:d7:8e:36:45:9a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 10, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
16:1c:67:8a:c5:2f:a0:39:a4:a9:0f:75:90:8c:e8:cb:7d:a9:39:8b:9d:1e:9f:21:df:a7:31:d7:8e:36:45:9a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 10, 2025
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:0d:c4:e7:bb:f4:af:f8:f0:90:00:00:00:00:01:0d
Issuer
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 15, 2025 - May 15, 2026
Subject
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:14:9d:fb:c3:1f:1f:63:c3:10:00:00:00:00:00:14
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
May 1, 2013 - May 1, 2028
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6F1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:fc:18:a0:af:cc:69:5a:87:3a:00:01:00:00:01:fc
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:7f:2f:42:2a:73:53:08:de:ea:00:00:00:00:04:7f
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 15, 2025 - May 15, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:651A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:f5:99:09:94:bc:f1:c6:50:8c:00:01:00:00:01:f5
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Minor OS version
0
Major OS version
6
Entry point
66448
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb
api-ms-win-crt-runtime-l1-1-0
terminate
abort
api-ms-win-crt-string-l1-1-0
strncmp
wcsncmp
strcmp
strcpy_s
strlen
api-ms-win-crt-heap-l1-1-0
free
malloc
calloc
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
__stdio_common_vsprintf
api-ms-win-crt-convert-l1-1-0
atol
kernel32
GetLastError
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
RtlLookupFunctionEntry
RtlUnwindEx
RtlUnwind
GetModuleHandleW
GetModuleFileNameW
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
InterlockedPushEntrySList
InterlockedFlushSList
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FreeLibrary
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetProcAddress
_CreateFrameInfo
_CxxThrowException
_FindAndUnlinkFrame
_IsExceptionObjectToBeDestroyed
_SetWinRTOutOfMemoryExceptionCallback
__AdjustPointer
__BuildCatchObject
__BuildCatchObjectHelper
__C_specific_handler
__C_specific_handler_noexcept
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxFrameHandler2
__CxxFrameHandler3
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__FrameUnwindFilter
__GetPlatformExceptionInfo
__NLG_Dispatch2
__NLG_Return2
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__TypeMatch
__current_exception
__current_exception_context
__intrinsic_setjmp
__intrinsic_setjmpex
__processing_throw
__report_gsfailure
__std_exception_copy
__std_exception_destroy
__std_terminate
__std_type_info_compare
__std_type_info_destroy_list
__std_type_info_hash
__std_type_info_name
__telemetry_main_invoke_trigger
__telemetry_main_return_trigger
__unDName
__unDNameEx
__uncaught_exception
__uncaught_exceptions
__vcrt_GetModuleFileNameW
__vcrt_GetModuleHandleW
__vcrt_InitializeCriticalSectionEx
__vcrt_LoadLibraryExW
_get_purecall_handler
_get_unexpected
_is_exception_typeof
_local_unwind
_purecall
_set_purecall_handler
_set_se_translator
longjmp
memchr
memcmp
memcpy
memmove
memset
set_unexpected
strchr
strrchr
strstr
unexpected
wcschr
wcsrchr
wcsstr
Name
.text
Size
72KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
504B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
976B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
744B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=30795,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=47, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=16, id=260, version=35207,
count=31, id=261, version=35207,
count=21, id=259, version=35207,
count=1, id=256, version=35207,
count=1, id=255, version=35207,
count=1, id=258, version=35207,
vcruntime140_1.dll
- IMPHASH faf1de4e688195ca9bd5697cb1dccd29
- SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
- MD5 cd1b08f4930b276ad78853580b76b5c6
- SHA1 a0330279d3d0d47f19ed984726e25260b547a228
- SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
- SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
- TLSH T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
09:59:12:2e:f4:9b:e6:8f:66:97:13:c3:ec:b6:9e:ef:07:7f:f6:e1:9f:d5:4b:1d:e4:28:28:aa:b4:93:13:3b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 10, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
09:59:12:2e:f4:9b:e6:8f:66:97:13:c3:ec:b6:9e:ef:07:7f:f6:e1:9f:d5:4b:1d:e4:28:28:aa:b4:93:13:3b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 10, 2025
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:0d:c4:e7:bb:f4:af:f8:f0:90:00:00:00:00:01:0d
Issuer
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 15, 2025 - May 15, 2026
Subject
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:14:9d:fb:c3:1f:1f:63:c3:10:00:00:00:00:00:14
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
May 1, 2013 - May 1, 2028
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:401A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:fe:d0:a8:c2:7b:34:21:0b:01:00:01:00:00:01:fe
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:7f:2f:42:2a:73:53:08:de:ea:00:00:00:00:04:7f
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 15, 2025 - May 15, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:4C1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:ff:12:38:7c:f7:c1:65:d6:a1:00:01:00:00:01:ff
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Minor OS version
0
Major OS version
6
Entry point
16656
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb
api-ms-win-crt-runtime-l1-1-0
terminate
abort
api-ms-win-crt-string-l1-1-0
wcsncmp
strcmp
strcpy_s
strlen
api-ms-win-crt-heap-l1-1-0
free
malloc
calloc
vcruntime140
memcpy
__processing_throw
__C_specific_handler
memmove
__current_exception
kernel32
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
RtlUnwindEx
RtlLookupFunctionEntry
LoadLibraryExW
GetProcAddress
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
GetLastError
EncodePointer
RaiseException
RtlPcToFileHeader
DeleteCriticalSection
__CxxFrameHandler4
__NLG_Dispatch2
__NLG_Return2
Name
.text
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
984B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
324B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=30795,
count=2, id=257, version=35207,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=53, id=1, productName=Unmarked objects,
count=7, id=260, version=35207,
count=27, id=261, version=35207,
count=5, id=259, version=35207,
count=1, id=256, version=35207,
count=1, id=255, version=35207,
count=1, id=258, version=35207,
vcruntime140_1_clr0400.dll
- IMPHASH 65c7a2e8e0413a5ffb6aba196e99b171
- SHA256 cbf8cf639b66f64af2398a5c321fb88f9f612ee664227e154fe4324d6aad0d2a
- MD5 151d101504df935c97a7a25f93492f9d
- SHA1 5e3f79710fd4ebfec6abafd7c83ba31523d6b3c5
- SHA512 2472620ff288ad9055806f7ab9039f68409609c9320b70e735b4da693f4b4baf15976d00c090753cc3307cf367fda2da345e50faeba97cbfd402b8e4021d0c73
- SSDEEP 384:5fnvMCmWEKhUcSLt5a9k6KrOE5fY/ntz5txWE6Wg+XfwJjx12ncS7INWrukWi2H1:mCm5KhUcwrHY/ntTxT6kvr7yUiGR9z
- TLSH T1A0034B94637C8086E46B85B4C4E35F6BFE39F5619750928F0AA0815D2F637D0E63E32A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ba:c0:6a:6e:1b:65:17:50:50:61:7a:56:02:33:72:16:11:59:2e:91:be:1b:83:81:7a:c5:e8:f3:f3:8c:54:47
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 25, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:af
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9600-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:d8:fc:4b:33:a5:1d:d8:85:15:00:01:00:00:01:d8
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 25, 2023 - Feb 1, 2024
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
16736
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1_clr0400.amd64.pdb
api-ms-win-crt-runtime-l1-1-0
terminate
abort
api-ms-win-crt-heap-l1-1-0
malloc
calloc
free
api-ms-win-crt-string-l1-1-0
strcpy_s
wcsncmp
vcruntime140_clr0400
__processing_throw
__C_specific_handler
memmove
__current_exception
kernel32
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
RtlUnwindEx
RtlLookupFunctionEntry
LoadLibraryExW
GetProcAddress
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
EncodePointer
RaiseException
RtlPcToFileHeader
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetLastError
SetLastError
TlsAlloc
__CxxFrameHandler4
__NLG_Dispatch2
__NLG_Return2
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
1020B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
316B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=28900,
count=2, id=257, version=30034,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=49, id=1, productName=Unmarked objects,
count=5, id=259, version=30034,
count=7, id=260, version=30034,
count=26, id=261, version=30034,
count=1, id=256, version=30034,
count=1, id=255, version=30034,
count=1, id=258, version=30034,
vcruntime140_clr0400.dll
- IMPHASH 590f6799072507af057ea1640c6a6f1f
- SHA256 fe36a4265c680988a9b6c7fc840e28a75e7c06642fe5357263d1e519f0e3bd46
- MD5 504d3eafd33028830035748cb09d3c0b
- SHA1 a86349f09cb64811c4670a83149d25191cdb47e7
- SHA512 306ef95035741b62a500243f509a7a7e7b53d5830844b9ceb845f7b3c3cd46f14b382a15986b270d2a83f3165470e61d04bae5fc917d50a899d20f52c52c0190
- SSDEEP 1536:S6r2HwX4jSnzo9pnOFl0nmRlpUnaFuy+6IpwRecbGlWMgzg:SYv06FanmFMaFuF6IpwRecbGlW5M
- TLSH T1FBA36C5A76A482B7D07BD178C0E24A5BE771B850877093CF03B6496A5F23BE05E3D362
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c8:2c:83:f5:7b:0b:c9:8f:57:63:19:00:27:dc:03:79:5a:00:df:3f:a1:8a:e4:0d:a9:3c:4a:71:23:c8:37:06
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 25, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:af
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cf:52:36:be:71:4b:cd:48:ca:00:01:00:00:01:cf
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 25, 2023 - Feb 1, 2024
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
64352
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140_clr0400.amd64.pdb
ucrtbase_clr0400
calloc
strncmp
atol
__stdio_common_vsprintf_s
wcsncmp
abort
strcpy_s
malloc
free
terminate
kernel32
TlsAlloc
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
RtlUnwind
EncodePointer
RaiseException
RtlPcToFileHeader
InterlockedPushEntrySList
InterlockedFlushSList
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
RtlLookupFunctionEntry
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleW
RtlUnwindEx
QueryPerformanceCounter
_CreateFrameInfo
_CxxThrowException
_FindAndUnlinkFrame
_IsExceptionObjectToBeDestroyed
_SetWinRTOutOfMemoryExceptionCallback
__AdjustPointer
__BuildCatchObject
__BuildCatchObjectHelper
__C_specific_handler
__C_specific_handler_noexcept
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxFrameHandler2
__CxxFrameHandler3
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__FrameUnwindFilter
__GetPlatformExceptionInfo
__NLG_Dispatch2
__NLG_Return2
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__TypeMatch
__current_exception
__current_exception_context
__intrinsic_setjmp
__intrinsic_setjmpex
__processing_throw
__report_gsfailure
__std_exception_copy
__std_exception_destroy
__std_terminate
__std_type_info_compare
__std_type_info_destroy_list
__std_type_info_hash
__std_type_info_name
__telemetry_main_invoke_trigger
__telemetry_main_return_trigger
__unDName
__unDNameEx
__uncaught_exception
__uncaught_exceptions
__vcrt_GetModuleFileNameW
__vcrt_GetModuleHandleW
__vcrt_InitializeCriticalSectionEx
__vcrt_LoadLibraryExW
_get_purecall_handler
_get_unexpected
_is_exception_typeof
_local_unwind
_purecall
_set_purecall_handler
_set_se_translator
longjmp
memchr
memcmp
memcpy
memmove
memset
set_unexpected
strchr
strrchr
strstr
unexpected
wcschr
wcsrchr
wcsstr
Name
.text
Size
62KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
416B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=28900,
count=3, id=257, version=30034,
count=44, id=1, productName=Unmarked objects,
count=13, id=259, version=30034,
count=16, id=260, version=30034,
count=31, id=261, version=30034,
count=1, id=256, version=30034,
count=1, id=255, version=30034,
count=1, id=258, version=30034,
vcruntime140_threads.dll
- IMPHASH 5ec0377a6cf6fab1a21b56f09428ef6a
- SHA256 219915cf20822f34d5e7c1fdd4e21ae7f3396881096c51036225fb8f84b47afa
- MD5 e57bb2cda101fda5c72f3af09b035bd6
- SHA1 77363f6b41d022dbd34e182a93087fc63a5b08cb
- SHA512 cab172e140cc2da4444a0c37a42187c4bd29997aa5522f5cf076d8d40cb0116a9e905162349204415213c75ff34cca98cdcc5a7ee9535a8d28945af726545441
- SSDEEP 768:CjJ+AiHEFeLUIHmJ9crFciw4DY0zxOW9zeLCbpiFds9z9:+uHEwLUIHscrFcig0zUizGEpiFdkz9
- TLSH T126037C86D7684487E9EA9870C2B9DA47BD3EBBD20B5041DF4381FA480D633C2EA3571D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
52:04:c0:18:bc:ef:04:8a:39:46:93:78:00:c8:86:0b:3b:d1:dc:01:7b:76:54:b9:df:dd:66:2e:9f:a5:9c:07
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 10, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
52:04:c0:18:bc:ef:04:8a:39:46:93:78:00:c8:86:0b:3b:d1:dc:01:7b:76:54:b9:df:dd:66:2e:9f:a5:9c:07
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 10, 2025
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:0d:c4:e7:bb:f4:af:f8:f0:90:00:00:00:00:01:0d
Issuer
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 15, 2025 - May 15, 2026
Subject
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:14:9d:fb:c3:1f:1f:63:c3:10:00:00:00:00:00:14
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
May 1, 2013 - May 1, 2028
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:651A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:f5:99:09:94:bc:f1:c6:50:8c:00:01:00:00:01:f5
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:7f:2f:42:2a:73:53:08:de:ea:00:00:00:00:04:7f
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 15, 2025 - May 15, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:4C1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:ff:12:38:7c:f7:c1:65:d6:a1:00:01:00:00:01:ff
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Minor OS version
0
Major OS version
6
Entry point
9104
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_threads.amd64.pdb
api-ms-win-crt-runtime-l1-1-0
_cexit
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
_execute_onexit_table
abort
_beginthreadex
_errno
api-ms-win-crt-heap-l1-1-0
calloc
malloc
free
api-ms-win-crt-time-l1-1-0
_timespec64_get
_timespec32_get
vcruntime140
__std_type_info_destroy_list
__C_specific_handler
__CxxFrameHandler3
memset
memcpy
kernel32
AcquireSRWLockExclusive
SwitchToThread
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetThreadId
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetExitCodeThread
Sleep
WaitForSingleObject
SleepConditionVariableSRW
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
ExitThread
CloseHandle
GetLastError
ReleaseSRWLockExclusive
ReleaseSRWLockShared
InitOnceExecuteOnce
AcquireSRWLockShared
GetCurrentThreadId
_cnd_timedwait32
_cnd_timedwait64
_mtx_timedlock32
_mtx_timedlock64
_thrd_sleep32
_thrd_sleep64
call_once
cnd_broadcast
cnd_destroy
cnd_init
cnd_signal
cnd_wait
mtx_destroy
mtx_init
mtx_lock
mtx_trylock
mtx_unlock
thrd_create
thrd_current
thrd_detach
thrd_equal
thrd_exit
thrd_join
thrd_yield
tss_create
tss_delete
tss_get
tss_set
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
804B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=30795,
count=2, id=257, version=35207,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=64, id=1, productName=Unmarked objects,
count=3, id=259, version=35207,
count=8, id=260, version=35207,
count=12, id=261, version=35207,
count=1, id=256, version=35207,
count=1, id=255, version=35207,
count=1, id=258, version=35207,
vds_ps.dll
- IMPHASH 509983e0be6579db09ad8d9d4c7fec70
- SHA256 b37d099632846317c2f7badd8df7f8f416a67b6df779e53b63ba8d4c925ec806
- MD5 2a28976f461e6ab0e0f4471b0ec4888a
- SHA1 0e2cdce5eb5ea0b04d43d54c22ad30fe4072d87f
- SHA512 cebbc64a7ad182267fdddf478395479feebe4b6089e6234c5084c15aea181e0af5c68fbfb2e5cb88ef42e368bcd4be6456fcc770c6fa79be359c539345eabff2
- SSDEEP 1536:pI1vXYcpRx3v3Dzujsviv0ooB7v+HO5XmbqKiIvdbwq2vVhivDLnX:kvXYcpRx3v3fujBFO5Xm6hCHnX
- TLSH T1AFB30EDBB24448B7C0385A35449B4E25672BDD085BD28FC351A8623D1EBB3C1BF35BA5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4752
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vds_ps.pdb
msvcrt
_amsg_exit
__C_specific_handler
_initterm
malloc
free
_XcptFilter
rpcrt4
NdrDllCanUnloadNow
NdrDllRegisterProxy
NdrDllUnregisterProxy
NdrOleAllocate
NdrOleFree
NdrDllGetClassObject
kernel32
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
DisableThreadLibraryCalls
Sleep
GetCurrentProcessId
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
80KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33145,
count=4, id=259, version=33145,
count=31, id=1, productName=Unmarked objects,
count=7, id=257, version=33145,
count=1, id=256, version=33145,
count=4, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vdsbas.dll
- IMPHASH 10731082f9c45c22302480a758a6e3aa
- SHA256 28ffe915b88aa3bba90687d2cd0aa2e9e4473a08ceb96435efe9e0afd0c39ff1
- MD5 5f0f56bcc5ffabc218ea57b2deb0c377
- SHA1 2b3089ee176ec6763f7edfe0a110aa466e5d5248
- SHA512 395267913d54b2c87a7ac2c9a2e40061f3215a73b73be492990a2080757fb4cfe1dd38b01ebad973c92f5254cf3bedf1b371fa3c5c2ffdee069c1b91f1cb261d
- SSDEEP 6144:1uLw9sn+Kjmm94Bx6BUXURk1Cy8y1n62nqOZO/zRG5PeumPCqoW:wLw9sn+KjmmyxsUXUZ07vlx
- TLSH T152642B1DA7AB14DAD6B3E038D453584AD2B3B07443548ADF59D8C2FA6E07EDCA639F00
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
8384
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vdsbas.pdb
msvcrt
_wcsicmp
memmove_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
__dllonexit
memcpy_s
??0exception@@QEAA@AEBQEBD@Z
towupper
??0exception@@QEAA@AEBQEBDH@Z
?what@exception@@UEBAPEBDXZ
__CxxFrameHandler4
??1exception@@UEAA@XZ
_vsnwprintf
_onexit
_callnewh
memset
_CxxThrowException
__CxxFrameHandler3
wcsstr
_unlock
realloc
memcpy
wcscat_s
memcmp
memmove
_XcptFilter
_lock
_amsg_exit
wcschr
malloc
free
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
__C_specific_handler
_ltow
_purecall
??3@YAXPEAX@Z
_initterm
wcscmp
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
CreateSemaphoreExW
DeleteCriticalSection
ReleaseSemaphore
ReleaseMutex
CreateMutexExW
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObjectEx
InitializeCriticalSection
WaitForSingleObject
OpenSemaphoreW
InitializeCriticalSectionEx
ntdll
NtQuerySystemInformation
NtPowerInformation
NtDeviceIoControlFile
RtlConvertSharedToExclusive
NtQueryVolumeInformationFile
RtlAcquireResourceExclusive
RtlInitializeResource
RtlReleaseResource
RtlAcquireResourceShared
RtlConvertExclusiveToShared
RtlDeleteResource
oleaut32
VarUI4FromStr
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
LoadResource
GetModuleFileNameA
DisableThreadLibraryCalls
FindResourceExW
FreeLibrary
GetModuleFileNameW
SizeofResource
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoCreateGuid
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
api-ms-win-core-string-l2-1-0
CharPrevW
CharNextW
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-registry-l1-1-0
RegEnumValueW
RegCloseKey
RegQueryInfoKeyW
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegEnumKeyExW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
lstrcpynW
lstrlenW
api-ms-win-core-memory-l1-1-0
VirtualQuery
VirtualAlloc
VirtualProtect
api-ms-win-core-sysinfo-l1-1-0
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
HeapDestroy
GetProcessHeap
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-processthreads-l1-1-0
CreateThread
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
devobj
DevObjEnumDeviceInterfaces
DevObjGetClassDevs
DevObjCreateDeviceInfoList
DevObjDestroyDeviceInfoList
api-ms-win-core-file-l1-1-0
SetFilePointer
SetFilePointerEx
WriteFile
QueryDosDeviceW
CreateFileW
FindVolumeClose
FindFirstVolumeW
FindNextVolumeW
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-devices-config-l1-1-1
CM_Get_Parent
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
user32
DefWindowProcW
PeekMessageW
GetMessageW
PostThreadMessageW
RegisterDeviceNotificationW
UnregisterDeviceNotification
vdsutil
?Prev@CRtlListIter@@QEAAAEAV1@XZ
?Next@CRtlListIter@@QEAAAEAV1@XZ
?GetEntry@CRtlListIter@@QEAAPEAVCRtlEntry@@XZ
?RemoveAll@CRtlList@@QEAAXXZ
?End@CRtlList@@QEAA?AVCRtlListIter@@XZ
?Begin@CRtlList@@QEAA?AVCRtlListIter@@XZ
??1CRtlList@@QEAA@XZ
??0CRtlList@@QEAA@P6AXPEAVCRtlEntry@@@Z@Z
RegisterProvider
VdsTraceEx
AddEventSource
UnregisterProvider
RemoveEventSource
VdsHeapFree
??1CRtlMap@@UEAA@XZ
?Uninitialize@CVdsPnPNotificationBase@@QEAAXXZ
?Begin@CRtlMap@@QEAA?AVCRtlMapIter@@XZ
?RemoveAll@CRtlMap@@QEAAXH@Z
?Uninitialize@CVdsAsyncObjectBase@@SAXXZ
?GetEntryPointer@CRtlListIter@@QEAAPEAXXZ
?Next@CRtlMapIter@@QEAAAEAV1@XZ
GetInterfaceDetailData
OpenDevice
GetDeviceName
VdsHeapAlloc
?Insert@CRtlMap@@QEAAHAEAVCRtlEntry@@0@Z
?Remove@CRtlMap@@QEAAHAEAVCRtlEntry@@@Z
VdsTraceExW
?InsertUnique@CRtlMap@@QEAAHAEAVCRtlEntry@@0@Z
VdsTraceW
GetDiskLayout
BacksBootVolume
BootBackedByWim
GetRegistryValue
?Find@CRtlMap@@QEAAHAEAVCRtlEntry@@PEAV2@@Z
?Append@CPrvEnumObject@@QEAAJPEAUIUnknown@@@Z
?Reset@CPrvEnumObject@@UEAAJXZ
IsWinPE
GetFMIFSQueryDeviceInfo
GetFMIFSQueryDeviceInfoByHandle
?Initialize@CVdsPnPNotificationBase@@QEAAKXZ
?Initialize@CVdsAsyncObjectBase@@SAKXZ
GetDeviceAndMediaType
?RegisterHandle@CVdsPnPNotificationBase@@QEAAKPEAXPEAPEAX@Z
?UnregisterHandle@CVdsPnPNotificationBase@@QEAAXPEAX@Z
??0CVdsCallTracer@@QEAA@KPEBD@Z
?InsertTailPointer@CRtlList@@QEAAHPEAX@Z
?Remove@CRtlList@@QEAAXAEAVCRtlListIter@@@Z
?Next@CPrvEnumObject@@UEAAJKPEAPEAUIUnknown@@PEAK@Z
?Skip@CPrvEnumObject@@UEAAJK@Z
?Clone@CPrvEnumObject@@UEAAJPEAPEAUIEnumVdsObject@@@Z
??0CVdsAsyncObjectBase@@QEAA@XZ
??1CVdsAsyncObjectBase@@QEAA@XZ
QueryObjects
?SetCompletionStatus@CVdsAsyncObjectBase@@QEAAXJK@Z
?Signal@CVdsAsyncObjectBase@@QEAAXXZ
SetDiskLayout
GuidToString
?QueryStatus@CVdsAsyncObjectBase@@UEAAJPEAJPEAK@Z
GetVolumeDiskExtentInfo
GetDeviceManufacturerInfo
IsMediaPresent
GetMediaGeometryEx
GetStorageAccessAlignmentProperty
CreateDeviceInfoSet
GetDeviceId
GetDeviceRegistryPropertyByInfo
VdsAllocateEmptyString
GetDeviceRegistryPropertyByInst
GetDeviceLocationEx
GetDeviceNumber
VdsDoesDiskHaveArcPath
IsDiskClustered
GetDiskFlags
GetDiskOfflineReason
IsDiskReadOnly
IsDiskCurrentStateReadOnly
GetBootFromDiskNumber
GetBootDiskNumber
?InsertPointer@CRtlList@@QEAAHAEAVCRtlListIter@@PEAX@Z
??4CRtlList@@QEAAAEAV0@AEAV0@@Z
IsRamDrive
?Register@CVdsPnPNotificationBase@@QEAAKPEAU_NotificationListeningRequest@@K@Z
GetDefaultAlignment
LockDismountVolume
WriteBootCode
GetPartitionInformation
IsClientSKU
GetDiskRedundancyCount
GetMediaGeometry
VdsAllocateString
GetDiskIdentifiers
?WaitImpl@CVdsAsyncObjectBase@@QEAAJPEAJ@Z
InitializeRundownProtection
WaitForRundownProtectionRelease
?Unregister@CVdsPnPNotificationBase@@QEAAXPEAU_NotificationListeningRequest@@@Z
AcquireRundownProtection
ReleaseRundownProtection
LogError
LogWarning
??0CRtlMap@@QEAA@KP6AXPEAVCRtlEntry@@@Z1@Z
??1CVdsCallTracer@@QEAA@XZ
IsVdsLoggingEnabled
??0?$CVdsHandleImpl@$0?0@@QEAA@XZ
??0?$CVdsHandleImpl@$0A@@@QEAA@XZ
??0?$CVdsHeapPtr@E@@QEAA@XZ
??0?$CVdsHeapPtr@G@@QEAA@XZ
??0?$CVdsHeapPtr@U_AUCTION_THREAD_PARAMETER@@@@QEAA@XZ
??0?$CVdsHeapPtr@U_DRIVE_LAYOUT_INFORMATION_EX@@@@QEAA@XZ
??0?$CVdsHeapPtr@U_VDS_DRIVE_LAYOUT_INFORMATION_EX@@@@QEAA@XZ
??0?$CVdsPtr@E@@QEAA@XZ
??0?$CVdsPtr@G@@QEAA@XZ
??0?$CVdsPtr@U_AUCTION_THREAD_PARAMETER@@@@QEAA@XZ
??0?$CVdsPtr@U_DRIVE_LAYOUT_INFORMATION_EX@@@@QEAA@XZ
??0?$CVdsPtr@U_VDS_DRIVE_LAYOUT_INFORMATION_EX@@@@QEAA@XZ
??0CPrvEnumObject@@QEAA@XZ
??0CRtlSharedLock@@QEAA@XZ
??0CVdsCriticalSection@@QEAA@PEAU_RTL_CRITICAL_SECTION@@@Z
??0CVdsPnPNotificationBase@@QEAA@XZ
??0CVdsUnlockIt@@QEAA@AEAJ@Z
??1?$CVdsHandleImpl@$0?0@@QEAA@XZ
??1?$CVdsHandleImpl@$0A@@@QEAA@XZ
??1?$CVdsHeapPtr@E@@QEAA@XZ
??1?$CVdsHeapPtr@G@@QEAA@XZ
??1?$CVdsHeapPtr@U_AUCTION_THREAD_PARAMETER@@@@QEAA@XZ
??1?$CVdsHeapPtr@U_DRIVE_LAYOUT_INFORMATION_EX@@@@QEAA@XZ
??1?$CVdsHeapPtr@U_VDS_DRIVE_LAYOUT_INFORMATION_EX@@@@QEAA@XZ
??1?$CVdsPtr@E@@QEAA@XZ
??1?$CVdsPtr@G@@QEAA@XZ
??1?$CVdsPtr@U_AUCTION_THREAD_PARAMETER@@@@QEAA@XZ
??1?$CVdsPtr@U_DRIVE_LAYOUT_INFORMATION_EX@@@@QEAA@XZ
??1?$CVdsPtr@U_VDS_DRIVE_LAYOUT_INFORMATION_EX@@@@QEAA@XZ
??1CPrvEnumObject@@QEAA@XZ
??1CRtlSharedLock@@QEAA@XZ
??1CVdsCriticalSection@@QEAA@XZ
??1CVdsPnPNotificationBase@@QEAA@XZ
??1CVdsUnlockIt@@QEAA@XZ
??4?$CVdsHandleImpl@$0A@@@QEAAPEAXPEAX@Z
??4?$CVdsHeapPtr@E@@QEAAPEAEPEAE@Z
??4?$CVdsHeapPtr@G@@QEAAPEAGPEAG@Z
??4?$CVdsHeapPtr@U_AUCTION_THREAD_PARAMETER@@@@QEAAPEAU_AUCTION_THREAD_PARAMETER@@PEAU1@@Z
??4?$CVdsHeapPtr@U_VDS_DRIVE_LAYOUT_INFORMATION_EX@@@@QEAAPEAU_VDS_DRIVE_LAYOUT_INFORMATION_EX@@PEAU1@@Z
??8?$CVdsHandleImpl@$0A@@@QEBA_NPEAX@Z
??8?$CVdsPtr@E@@QEBA_NPEAE@Z
??8?$CVdsPtr@G@@QEBA_NPEAG@Z
??8?$CVdsPtr@U_AUCTION_THREAD_PARAMETER@@@@QEBA_NPEAU_AUCTION_THREAD_PARAMETER@@@Z
??9?$CVdsPtr@E@@QEBA_NPEAE@Z
??B?$CVdsHandleImpl@$0?0@@QEAAPEAXXZ
??B?$CVdsPtr@E@@QEBAPEAEXZ
??B?$CVdsPtr@G@@QEBAPEAGXZ
??B?$CVdsPtr@U_AUCTION_THREAD_PARAMETER@@@@QEBAPEAU_AUCTION_THREAD_PARAMETER@@XZ
??B?$CVdsPtr@U_DRIVE_LAYOUT_INFORMATION_EX@@@@QEBAPEAU_DRIVE_LAYOUT_INFORMATION_EX@@XZ
??B?$CVdsPtr@U_VDS_DRIVE_LAYOUT_INFORMATION_EX@@@@QEBAPEAU_VDS_DRIVE_LAYOUT_INFORMATION_EX@@XZ
??C?$CVdsPtr@U_AUCTION_THREAD_PARAMETER@@@@QEBAPEAU_AUCTION_THREAD_PARAMETER@@XZ
??C?$CVdsPtr@U_DRIVE_LAYOUT_INFORMATION_EX@@@@QEBAPEAU_DRIVE_LAYOUT_INFORMATION_EX@@XZ
??C?$CVdsPtr@U_VDS_DRIVE_LAYOUT_INFORMATION_EX@@@@QEBAPEAU_VDS_DRIVE_LAYOUT_INFORMATION_EX@@XZ
??I?$CVdsHandleImpl@$0?0@@QEAAPEAPEAXXZ
??I?$CVdsPtr@U_DRIVE_LAYOUT_INFORMATION_EX@@@@QEAAPEAPEAU_DRIVE_LAYOUT_INFORMATION_EX@@XZ
??I?$CVdsPtr@U_VDS_DRIVE_LAYOUT_INFORMATION_EX@@@@QEAAPEAPEAU_VDS_DRIVE_LAYOUT_INFORMATION_EX@@XZ
??_FCRtlList@@QEAAXXZ
??_FCRtlMap@@QEAAXXZ
?AcquireRead@CRtlSharedLock@@AEAAXXZ
?AcquireWrite@CRtlSharedLock@@AEAAXXZ
?AllowCancel@CVdsAsyncObjectBase@@QEAAXXZ
?Attach@?$CVdsPtr@G@@QEAAXPEAG@Z
?Attach@?$CVdsPtr@U_DRIVE_LAYOUT_INFORMATION_EX@@@@QEAAXPEAU_DRIVE_LAYOUT_INFORMATION_EX@@@Z
?Attach@?$CVdsPtr@U_VDS_DRIVE_LAYOUT_INFORMATION_EX@@@@QEAAXPEAU_VDS_DRIVE_LAYOUT_INFORMATION_EX@@@Z
?Close@?$CVdsHandleImpl@$0?0@@QEAAXXZ
?CurrentThreadIsWriter@CRtlSharedLock@@QEAAHXZ
?Detach@?$CVdsHandleImpl@$0?0@@QEAAPEAXXZ
?Detach@?$CVdsPtr@G@@QEAAPEAGXZ
?Detach@?$CVdsPtr@U_AUCTION_THREAD_PARAMETER@@@@QEAAPEAU_AUCTION_THREAD_PARAMETER@@XZ
?Detach@?$CVdsPtr@U_DRIVE_LAYOUT_INFORMATION_EX@@@@QEAAPEAU_DRIVE_LAYOUT_INFORMATION_EX@@XZ
?Detach@?$CVdsPtr@U_VDS_DRIVE_LAYOUT_INFORMATION_EX@@@@QEAAPEAU_VDS_DRIVE_LAYOUT_INFORMATION_EX@@XZ
?DisallowCancel@CVdsAsyncObjectBase@@QEAAXXZ
?Downgrade@CRtlSharedLock@@AEAAXXZ
?GetOutputType@CVdsAsyncObjectBase@@QEAA?AW4_VDS_ASYNC_OUTPUT_TYPE@@XZ
?IsCancelRequested@CVdsAsyncObjectBase@@QEAAHXZ
?Release@CRtlSharedLock@@AEAAXXZ
?SetOutput@CVdsAsyncObjectBase@@QEAAXU_VDS_ASYNC_OUTPUT@@@Z
?SetOutputType@CVdsAsyncObjectBase@@QEAAXW4_VDS_ASYNC_OUTPUT_TYPE@@@Z
?SetPositionToLast@CPrvEnumObject@@QEAAXXZ
?Upgrade@CRtlSharedLock@@AEAAXXZ
?ZeroAsyncOut@CVdsAsyncObjectBase@@QEAAXXZ
?m_ExtraLogging@CVdsTraceSettings@@QEAAHXZ
?m_NoDebuggerLogging@CVdsTraceSettings@@QEAAHXZ
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
196KB
Virtual Size
193KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
104KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=52, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=17, id=260, version=33145,
count=5, id=259, version=33145,
count=267, id=1, productName=Unmarked objects,
count=7, id=257, version=33145,
count=7, id=261, version=33145,
count=1, id=256, version=33145,
count=13, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vdsdyn.dll
- IMPHASH f4f7c98d2e04620010b233eb0b9ed3b9
- SHA256 1b0f71370ca29457717936120a540dc4803b303096e7b8c5803ce53aee491d07
- MD5 080ac4ce1740df0854bfa6ddee28626c
- SHA1 a80da4049966bdcc22b74420995d716efbec0103
- SHA512 946f8667058ca1b8baa3cd6e6d0ab225b9e717abc54e8426c51d5ed4334f05d21b9b2ff4374ff008583e12c337de6e04d2ceb16ca1f706b5a484effb4360d169
- SSDEEP 6144:VbwFuYR+iJ9vA11oY/LNIM60IH4YLiua/KtjJOOl8LZfNxVv4XSqsux471qborsv:1wmiTvQKYjmH9v/gZP1vXjBYJ
- TLSH T1BFD43118B7FD1146F1B656F6AF77A0415633BDB517BDE0CF0088812A9967EC089B2B32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7232
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vdsdyn.pdb
msvcrt
_amsg_exit
_XcptFilter
?terminate@@YAXXZ
memmove
memcpy
__CxxFrameHandler3
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
_lock
_unlock
__dllonexit
_onexit
_callnewh
_wcsupr
_ltow
_wtol
wcsstr
wcsncmp
_wcsnicmp
_wcsicmp
_vsnwprintf
??1type_info@@UEAA@XZ
realloc
memcmp
__CxxFrameHandler4
wcscat_s
malloc
free
__C_specific_handler
_initterm
_purecall
??3@YAXPEAX@Z
??0exception@@QEAA@AEBQEBD@Z
memset
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
ReleaseSemaphore
WaitForSingleObject
SetEvent
EnterCriticalSection
InitializeCriticalSection
CreateEventW
LeaveCriticalSection
ntdll
NtQuerySystemInformation
RtlNtStatusToDosError
NtDeviceIoControlFile
NtPowerInformation
RtlConvertExclusiveToShared
RtlAcquireResourceExclusive
RtlInitializeResource
RtlReleaseResource
RtlAcquireResourceShared
RtlDeleteResource
RtlConvertSharedToExclusive
oleaut32
VarUI4FromStr
api-ms-win-core-heap-l1-1-0
HeapDestroy
GetProcessHeap
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
SizeofResource
LoadResource
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
FindResourceExW
DisableThreadLibraryCalls
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoCreateInstance
CoCreateGuid
CoTaskMemAlloc
CoTaskMemRealloc
api-ms-win-core-string-l2-1-0
CharPrevW
CharNextW
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
api-ms-win-core-registry-l1-1-0
RegDeleteValueW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegEnumValueW
RegQueryInfoKeyW
RegEnumKeyExW
RegCreateKeyExW
RegOpenKeyExW
api-ms-win-core-string-obsolete-l1-1-0
lstrcpynW
lstrcmpiW
api-ms-win-core-memory-l1-1-0
VirtualAlloc
VirtualQuery
VirtualProtect
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
GetSystemInfo
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
CreateSemaphoreW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
CreateThread
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
devobj
DevObjDestroyDeviceInfoList
DevObjGetDeviceInterfaceDetail
DevObjEnumDeviceInterfaces
DevObjGetClassDevs
DevObjCreateDeviceInfoList
api-ms-win-core-registry-l2-1-0
RegOpenKeyW
api-ms-win-eventlog-legacy-l1-1-0
RegisterEventSourceW
ReportEventW
DeregisterEventSource
api-ms-win-core-file-l1-1-0
QueryDosDeviceW
CreateFileW
SetFilePointerEx
WriteFile
FlushFileBuffers
api-ms-win-core-kernel32-legacy-l1-1-0
GetComputerNameW
api-ms-win-devices-config-l1-1-1
CM_Get_Parent
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
user32
CreateWindowExW
GetMessageW
PostThreadMessageW
UnregisterClassW
UnregisterDeviceNotification
RegisterClassW
TranslateMessage
DispatchMessageW
DefWindowProcW
RegisterDeviceNotificationW
DestroyWindow
vdsutil
??0CVdsCallTracer@@QEAA@KPEBD@Z
?Prev@CRtlListIter@@QEAAAEAV1@XZ
?Next@CRtlListIter@@QEAAAEAV1@XZ
?GetEntry@CRtlListIter@@QEAAPEAVCRtlEntry@@XZ
?RemoveAll@CRtlList@@QEAAXXZ
?End@CRtlList@@QEAA?AVCRtlListIter@@XZ
?Begin@CRtlList@@QEAA?AVCRtlListIter@@XZ
??1CRtlList@@QEAA@XZ
??0CRtlList@@QEAA@P6AXPEAVCRtlEntry@@@Z@Z
VdsHeapFree
VdsTraceExW
VdsHeapAlloc
RegisterProvider
AddEventSource
UnregisterProvider
??1CVdsCallTracer@@QEAA@XZ
IsDeviceFullyInstalled
GetIsRemovable
IsVdsLoggingEnabled
GuidToString
GetDefaultAlignment
GetStorageAccessAlignmentProperty
VdsDoesDiskHaveArcPath
VdsTraceEx
IsDiskCurrentStateReadOnly
GetBootFromDiskNumber
CreateDeviceInfoSet
GetDeviceRegistryPropertyByInfo
GetDeviceRegistryPropertyByInst
GetDeviceLocationPath
GetDeviceName
SetDiskLayout
IsClientSKU
GetDiskRedundancyCount
GetDiskOfflineReason
VdsTraceW
LockDismountVolume
GetBootVolumeHandle
MirrorBcdObjects
LockVolume
DeleteBcdObjects
InitializeRundownProtection
WaitForRundownProtectionRelease
AcquireRundownProtection
ReleaseRundownProtection
??0CRtlMap@@QEAA@KP6AXPEAVCRtlEntry@@@Z1@Z
GetDiskLayout
??0CPrvEnumObject@@QEAA@XZ
??0CRtlSharedLock@@QEAA@XZ
??0CVdsCriticalSection@@QEAA@PEAU_RTL_CRITICAL_SECTION@@@Z
??0CVdsPnPNotificationBase@@QEAA@XZ
??0CVdsUnlockIt@@QEAA@AEAJ@Z
??1CPrvEnumObject@@QEAA@XZ
??1CRtlSharedLock@@QEAA@XZ
??1CVdsCriticalSection@@QEAA@XZ
??1CVdsPnPNotificationBase@@QEAA@XZ
??1CVdsUnlockIt@@QEAA@XZ
??_FCRtlList@@QEAAXXZ
??_FCRtlMap@@QEAAXXZ
?AcquireRead@CRtlSharedLock@@AEAAXXZ
?AcquireWrite@CRtlSharedLock@@AEAAXXZ
?AllowCancel@CVdsAsyncObjectBase@@QEAAXXZ
?CurrentThreadIsWriter@CRtlSharedLock@@QEAAHXZ
?DisallowCancel@CVdsAsyncObjectBase@@QEAAXXZ
?Downgrade@CRtlSharedLock@@AEAAXXZ
?GetOutputType@CVdsAsyncObjectBase@@QEAA?AW4_VDS_ASYNC_OUTPUT_TYPE@@XZ
?IsCancelRequested@CVdsAsyncObjectBase@@QEAAHXZ
?Release@CRtlSharedLock@@AEAAXXZ
?SetOutput@CVdsAsyncObjectBase@@QEAAXU_VDS_ASYNC_OUTPUT@@@Z
?SetOutputType@CVdsAsyncObjectBase@@QEAAXW4_VDS_ASYNC_OUTPUT_TYPE@@@Z
?SetPositionToLast@CPrvEnumObject@@QEAAXXZ
?Upgrade@CRtlSharedLock@@AEAAXXZ
?ZeroAsyncOut@CVdsAsyncObjectBase@@QEAAXXZ
?m_ExtraLogging@CVdsTraceSettings@@QEAAHXZ
?m_NoDebuggerLogging@CVdsTraceSettings@@QEAAHXZ
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
288KB
Virtual Size
285KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
320KB
Virtual Size
319KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=52, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=16, id=260, version=33145,
count=5, id=259, version=33145,
count=196, id=1, productName=Unmarked objects,
count=7, id=257, version=33145,
count=7, id=261, version=33145,
count=1, id=256, version=33145,
count=12, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vdsutil.dll
- IMPHASH ec50a8a75985b067cc8a7f431fce3fd0
- SHA256 2e6b2da0835e27a667b0ea5c232c643ede0a1838317a24db79595a4fe2f40fe8
- MD5 f5a9059042231e118d024c6b32ae3c07
- SHA1 5cc1b77107adb6c07f400d16270e04ad2250d04f
- SHA512 8dbc9788b47d820b0799d6f002e16436aa3dcf1f1cf6ebd5f4ea874d8b75cc8772a625e63e05afa2ae81e6b1c801881bac1a50663fe55716ca43be0d80dd6567
- SSDEEP 3072:WDwn8vRi2BhyG1jXuuc+0iPfvp1SLFzGvLrntv8p62:W9vk2BhyG1jXNcbiPHkutv8p6
- TLSH T147042A2D73A620AAE1B3D17C85A20862E6337435572652FF01E4C1BE4E277D5EE3AF11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7264
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vdsutil.pdb
msvcrt
malloc
_callnewh
_ui64tow
_wcstoui64
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
memcmp
_CxxThrowException
__CxxFrameHandler3
memcpy
memmove
__CxxFrameHandler4
_XcptFilter
_amsg_exit
mbstowcs_s
free
_initterm
?terminate@@YAXXZ
_lock
_unlock
__dllonexit
_onexit
??1type_info@@UEAA@XZ
wcsstr
_wcsupr
wcsncmp
_wcsnicmp
_wcsicmp
__C_specific_handler
_vsnprintf
_vsnwprintf
_purecall
??3@YAXPEAX@Z
??0exception@@QEAA@AEBQEBDH@Z
memset
ntdll
RtlCompareString
RtlInitializeGenericTableAvl
RtlEnumerateGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlInsertElementGenericTableAvl
RtlEnumerateGenericTableWithoutSplayingAvl
NtOpenFile
NtClose
NtQueryDirectoryObject
RtlCompareUnicodeStrings
RtlInitUnicodeString
NtQuerySystemInformation
RtlNtStatusToDosError
DbgPrintEx
RtlConvertExclusiveToShared
RtlConvertSharedToExclusive
RtlAcquireResourceExclusive
RtlAcquireResourceShared
RtlReleaseResource
RtlDeleteResource
RtlInitializeResource
NtOpenDirectoryObject
oleaut32
VariantClear
SysStringLen
SysAllocString
VariantInit
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayPutElement
SafeArrayCreateVectorEx
SafeArrayGetElement
SysFreeString
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
LeaveCriticalSection
WaitForSingleObject
InitializeCriticalSection
SetEvent
ResetEvent
InitializeCriticalSectionAndSpinCount
CreateEventW
EnterCriticalSection
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-processthreads-l1-1-0
CreateThread
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
UnregisterTraceGuids
GetTraceEnableFlags
GetTraceLoggerHandle
RegisterTraceGuidsW
GetTraceEnableLevel
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegSetValueExW
RegDeleteKeyExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoCreateGuid
CoTaskMemAlloc
CoSetProxyBlanket
CoCreateInstance
StringFromGUID2
api-ms-win-core-heap-l1-1-0
HeapDestroy
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetProcAddress
LoadStringW
DisableThreadLibraryCalls
LoadLibraryExW
GetModuleFileNameW
FreeLibrary
api-ms-win-security-base-l1-1-0
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
InitializeSecurityDescriptor
InitializeAcl
FreeSid
AddAccessAllowedAce
AllocateAndInitializeSid
GetLengthSid
api-ms-win-core-file-l1-1-0
DefineDosDeviceW
GetDriveTypeW
WriteFile
GetDiskFreeSpaceExW
GetVolumePathNameW
SetFilePointer
CreateFileW
QueryDosDeviceW
ReadFile
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-sysinfo-l1-1-0
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetTickCount
GetComputerNameExW
api-ms-win-eventlog-legacy-l1-1-0
ReportEventW
DeregisterEventSource
RegisterEventSourceW
api-ms-win-core-kernel32-legacy-l1-1-0
GetComputerNameW
devobj
DevObjGetDeviceInterfaceDetail
DevObjGetDeviceInstanceId
DevObjCreateDeviceInfoList
DevObjGetClassDevs
DevObjEnumDeviceInfo
DevObjDestroyDeviceInfoList
DevObjGetDeviceProperty
DevObjGetDeviceRegistryProperty
DevObjOpenDeviceInfo
DevObjOpenDeviceInterface
api-ms-win-devices-config-l1-1-1
CM_Get_Device_IDW
CM_Get_Parent
api-ms-win-core-string-obsolete-l1-1-0
lstrlenW
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-sysinfo-l1-2-0
VerSetConditionMask
GetNativeSystemInfo
api-ms-win-core-kernel32-legacy-l1-1-1
VerifyVersionInfoW
ws2_32
GetAddrInfoW
FreeAddrInfoW
WSAStartup
WSAAddressToStringW
WSACleanup
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
user32
TranslateMessage
DispatchMessageW
GetWindowLongPtrW
PostThreadMessageW
SetTimer
KillTimer
RegisterDeviceNotificationW
UnregisterDeviceNotification
RegisterClassW
CreateWindowExW
UnregisterClassW
SetWindowLongPtrW
GetMessageW
DestroyWindow
DefWindowProcW
bcd
BcdEnumerateElementTypes
BcdGetElementDataWithFlags
BcdDeleteElement
BcdCopyObject
BcdQueryObject
BcdCloseStore
BcdDeleteObject
BcdOpenSystemStore
BcdCloseObject
BcdEnumerateObjects
BcdOpenObject
BcdGetElementData
BcdSetElementData
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
??0?$CVdsHandleImpl@$0?0@@QEAA@XZ
??0CGlobalResource@@QEAA@XZ
??0CPrvEnumObject@@QEAA@XZ
??0CRtlList@@QEAA@P6AXPEAVCRtlEntry@@@Z@Z
??0CRtlMap@@QEAA@KP6AXPEAVCRtlEntry@@@Z1@Z
??0CRtlSharedLock@@QEAA@XZ
??0CVdsAsyncObjectBase@@QEAA@XZ
??0CVdsCallTracer@@QEAA@KPEBD@Z
??0CVdsCriticalSection@@QEAA@PEAU_RTL_CRITICAL_SECTION@@@Z
??0CVdsPnPNotificationBase@@QEAA@XZ
??0CVdsTraceSettings@@QEAA@XZ
??0CVdsUnlockIt@@QEAA@AEAJ@Z
??0CVdsWmiVariantObjectArrayEnum@@QEAA@XZ
??1?$CVdsHandleImpl@$0?0@@QEAA@XZ
??1CGlobalResource@@QEAA@XZ
??1CPrvEnumObject@@QEAA@XZ
??1CRtlList@@QEAA@XZ
??1CRtlMap@@UEAA@XZ
??1CRtlSharedLock@@QEAA@XZ
??1CVdsAsyncObjectBase@@QEAA@XZ
??1CVdsCallTracer@@QEAA@XZ
??1CVdsCriticalSection@@QEAA@XZ
??1CVdsPnPNotificationBase@@QEAA@XZ
??1CVdsUnlockIt@@QEAA@XZ
??1CVdsWmiVariantObjectArrayEnum@@QEAA@XZ
??4?$CVdsHandleImpl@$0?0@@QEAAPEAXPEAX@Z
??4CRtlList@@QEAAAEAV0@AEAV0@@Z
??8?$CVdsHandleImpl@$0?0@@QEBA_NPEAX@Z
??B?$CVdsHandleImpl@$0?0@@QEAAPEAXXZ
??_FCRtlList@@QEAAXXZ
??_FCRtlMap@@QEAAXXZ
?AcquireRead@CRtlSharedLock@@AEAAXXZ
?AcquireWrite@CRtlSharedLock@@AEAAXXZ
?AllowCancel@CVdsAsyncObjectBase@@QEAAXXZ
?Append@CPrvEnumObject@@QEAAJPEAUIUnknown@@@Z
?Attach@CVdsWmiVariantObjectArrayEnum@@QEAAJPEAUtagVARIANT@@@Z
?Begin@CRtlList@@QEAA?AVCRtlListIter@@XZ
?Begin@CRtlMap@@QEAA?AVCRtlMapIter@@XZ
?Cancel@CVdsAsyncObjectBase@@UEAAJXZ
?Clear@CPrvEnumObject@@QEAAXXZ
?Clone@CPrvEnumObject@@UEAAJPEAPEAUIEnumVdsObject@@@Z
?CreateListenThread@CVdsPnPNotificationBase@@AEAAKXZ
?CurrentThreadIsWriter@CRtlSharedLock@@QEAAHXZ
?Detach@CVdsWmiVariantObjectArrayEnum@@QEAAJXZ
?DisallowCancel@CVdsAsyncObjectBase@@QEAAXXZ
?Downgrade@CRtlSharedLock@@AEAAXXZ
?End@CRtlList@@QEAA?AVCRtlListIter@@XZ
?Find@CRtlMap@@QEAAHAEAVCRtlEntry@@PEAV2@@Z
?FindPtr@CRtlMap@@QEAAHAEAVCRtlEntry@@PEAPEAV2@@Z
?GetEntry@CRtlListIter@@QEAAPEAVCRtlEntry@@XZ
?GetEntryPointer@CRtlListIter@@QEAAPEAXXZ
?GetNode@CRtlListIter@@QEAAPEAVCRtlListEntry@@XZ
?GetOutputType@CVdsAsyncObjectBase@@QEAA?AW4_VDS_ASYNC_OUTPUT_TYPE@@XZ
?GetWindowHandle@CVdsPnPNotificationBase@@QEAAPEAUHWND__@@XZ
?Initialize@CGlobalResource@@QEAAJXZ
?Initialize@CVdsAsyncObjectBase@@SAKXZ
?Initialize@CVdsPnPNotificationBase@@QEAAKXZ
?Insert@CRtlList@@QEAAHAEAVCRtlListIter@@AEAVCRtlEntry@@@Z
?Insert@CRtlMap@@QEAAHAEAVCRtlEntry@@0@Z
?InsertHead@CRtlList@@QEAAHAEAVCRtlEntry@@@Z
?InsertHeadPointer@CRtlList@@QEAAHPEAX@Z
?InsertPointer@CRtlList@@QEAAHAEAVCRtlListIter@@PEAX@Z
?InsertTail@CRtlList@@QEAAHAEAVCRtlEntry@@@Z
?InsertTailPointer@CRtlList@@QEAAHPEAX@Z
?InsertUnique@CRtlMap@@QEAAHAEAVCRtlEntry@@0@Z
?IsCancelRequested@CVdsAsyncObjectBase@@QEAAHXZ
?IsDone@CRtlListIter@@QEAAHXZ
?IsFinished@CVdsAsyncObjectBase@@QEAAHXZ
?Next@CPrvEnumObject@@UEAAJKPEAPEAUIUnknown@@PEAK@Z
?Next@CRtlListIter@@QEAAAEAV1@XZ
?Next@CRtlMapIter@@QEAAAEAV1@XZ
?Next@CVdsWmiVariantObjectArrayEnum@@QEAAJPEAPEAUIWbemClassObject@@@Z
?NotificationThread@CVdsPnPNotificationBase@@AEAAKPEAX@Z
?NotificationThreadEntry@CVdsPnPNotificationBase@@CAKPEAX@Z
?Prev@CRtlListIter@@QEAAAEAV1@XZ
?QueryStatus@CVdsAsyncObjectBase@@UEAAJPEAJPEAK@Z
?Register@CVdsPnPNotificationBase@@QEAAKPEAU_NotificationListeningRequest@@K@Z
?RegisterHandle@CVdsPnPNotificationBase@@QEAAKPEAXPEAPEAX@Z
?Release@CRtlSharedLock@@AEAAXXZ
?Remove@CRtlList@@QEAAXAEAVCRtlListIter@@@Z
?Remove@CRtlMap@@QEAAHAEAVCRtlEntry@@@Z
?RemoveAll@CRtlList@@QEAAXXZ
?RemoveAll@CRtlMap@@QEAAXH@Z
?Reset@CPrvEnumObject@@UEAAJXZ
?Reset@CVdsWmiVariantObjectArrayEnum@@QEAAJXZ
?SetCompletionStatus@CVdsAsyncObjectBase@@QEAAXJK@Z
?SetOutput@CVdsAsyncObjectBase@@QEAAXU_VDS_ASYNC_OUTPUT@@@Z
?SetOutputType@CVdsAsyncObjectBase@@QEAAXW4_VDS_ASYNC_OUTPUT_TYPE@@@Z
?SetPositionToLast@CPrvEnumObject@@QEAAXXZ
?Signal@CVdsAsyncObjectBase@@QEAAXXZ
?Skip@CPrvEnumObject@@UEAAJK@Z
?Uninitialize@CVdsAsyncObjectBase@@SAXXZ
?Uninitialize@CVdsPnPNotificationBase@@QEAAXXZ
?Unregister@CVdsPnPNotificationBase@@QEAAXPEAU_NotificationListeningRequest@@@Z
?UnregisterHandle@CVdsPnPNotificationBase@@QEAAXPEAX@Z
?Upgrade@CRtlSharedLock@@AEAAXXZ
?WaitImpl@CVdsAsyncObjectBase@@QEAAJPEAJ@Z
?WindowProcEntry@CVdsPnPNotificationBase@@CA_JPEAUHWND__@@I_K_J@Z
?ZeroAsyncOut@CVdsAsyncObjectBase@@QEAAXXZ
?m_ExtraLogging@CVdsTraceSettings@@QEAAHXZ
?m_NoDebuggerLogging@CVdsTraceSettings@@QEAAHXZ
AcquireRundownProtection
AddEventSource
AllocateAndGetVolumePathName
AssignTempVolumeName
BacksBootVolume
BootBackedByWim
CoFreeStringArray
CreateDeviceInfoSet
DeleteBcdObjects
DeleteNetworkShare
DllMain
GarbageCollectDriveLetters
GetBootDiskNumber
GetBootFromDiskNumber
GetBootVolumeHandle
GetDefaultAlignment
GetDeviceAndMediaType
GetDeviceId
GetDeviceLocation
GetDeviceLocationEx
GetDeviceLocationPath
GetDeviceManufacturerInfo
GetDeviceName
GetDeviceNumber
GetDeviceRegistryPropertyByInfo
GetDeviceRegistryPropertyByInst
GetDiskFlags
GetDiskIdentifiers
GetDiskLayout
GetDiskOfflineReason
GetDiskRedundancyCount
GetFMIFSEnableCompressionRoutine
GetFMIFSFormatEx2Routine
GetFMIFSGetDefaultFilesystemRoutine
GetFMIFSQueryDeviceInfo
GetFMIFSQueryDeviceInfoByHandle
GetFileSystemRecognitionName
GetInterfaceDetailData
GetIsRemovable
GetMediaGeometry
GetMediaGeometryEx
GetPartitionInformation
GetRegistryValue
GetStorageAccessAlignmentProperty
GetSystemVolumeHandle
GetVolumeDiskExtentInfo
GetVolumeGuidPathnames
GetVolumeName
GetVolumePath
GetVolumeSize
GetVolumeUniqueId
GuidToString
InitializeRundownProtection
InitializeSecurityDescriptorHelper
InvalidateDiskCache
IoctlMountmgrQueryPointsDevicePath
IsClientSKU
IsDeviceFullyInstalled
IsDiskClustered
IsDiskCurrentStateReadOnly
IsDiskReadOnly
IsDriveLetter
IsEfiFirmware
IsLocalComputer
IsMediaPresent
IsNoAutoMount
IsRamDrive
IsRunningOnAMD64
IsVdsLoggingEnabled
IsWinPE
LockDismountVolume
LockVolume
LogError
LogEvent
LogInfo
LogWarning
MirrorBcdObjects
MountVolume
OpenDevice
QueryObjects
QueryVolPersistentState
ReInitializeRundownProtection
RegisterProvider
ReleaseRundownProtection
RemoveEventSource
RemoveTempVolumeName
RundownCompleted
SetDiskLayout
StartReferenceHistory
StopReferenceHistory
UnInitializeGlobalResouce
UnregisterProvider
VdsAllocateEmptyString
VdsAllocateString
VdsAssert
VdsDisableCOMFatalExceptionHandling
VdsDoesDiskHaveArcPath
VdsHeapAlloc
VdsHeapFree
VdsInitializeCriticalSection
VdsIscsiCacheSessionDevices
VdsIscsiCheckEqualIpAddress
VdsIscsiGetIpAddressFromInstance
VdsIscsiIpAddressToIpsecId
VdsIscsiIpAddressToString
VdsIscsiIpsecIdToIpAddress
VdsIscsiIsIscsiLun
VdsIscsiSetIpAddressInInstance
VdsTrace
VdsTraceEx
VdsTraceExHelper
VdsTraceExW
VdsTraceExWHelper
VdsTraceW
VdsWmiCallMethod
VdsWmiConnectToNamespace
VdsWmiCopyFromVariantByteArray
VdsWmiCopyToVariantByteArray
VdsWmiCreateClassInstance
VdsWmiCreateVariantArray
VdsWmiFindInstanceOfClass
VdsWmiGetBoolFromInstance
VdsWmiGetByteFromInstance
VdsWmiGetByteInVariantByteArray
VdsWmiGetMethodArgumentObject
VdsWmiGetObjectFromInstance
VdsWmiGetObjectInVariantObjectArray
VdsWmiGetUlongFromInstance
VdsWmiGetUlonglongFromInstance
VdsWmiSetBoolInInstance
VdsWmiSetByteInInstance
VdsWmiSetObjectInInstance
VdsWmiSetStringInInstance
VdsWmiSetUlongInInstance
VdsWmiSetUlonglongInInstance
WaitForRundownProtectionRelease
WriteBootCode
Name
.text
Size
80KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
64KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
596B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=62, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=16, id=260, version=33145,
count=4, id=259, version=33145,
count=213, id=1, productName=Unmarked objects,
count=7, id=257, version=33145,
count=7, id=261, version=33145,
count=1, id=256, version=33145,
count=15, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vdsvd.dll
- IMPHASH b9c51d13540b73b197b9eb0211014f89
- SHA256 9d111a197553c31c987e9ef715a54bea5b725f3b2094765dd92f3782c49bfee6
- MD5 69485a6fa519b4ca0125fb89664d64dd
- SHA1 582b9a8638090c8cf48a81862ab79197dd73e0ed
- SHA512 071cf513082346a51822c7e8b863d3356522d578f8df427749b50f5e66078c329eed91cb4da05ed4e7335afda74c46dd6d65b9f6db918b0afb8c23b1a15149f9
- SSDEEP 3072:6nv/9lNFCBx2tynpOcR5Rqe7fZa7CR3y0ndG/+4+OxdyLNCX/+n:I3jNFCBx2tynwjrQCX
- TLSH T14FB3D51D2BAA399AE16A857991635D5AC372F0302311ABFF01D4C07E4FA7BC48E39F11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7328
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vdsvd.pdb
msvcrt
memcmp
memmove
memcpy
__CxxFrameHandler3
??3@YAXPEAX@Z
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
_XcptFilter
??0exception@@QEAA@AEBQEBD@Z
_callnewh
_amsg_exit
_wcsicmp
_initterm
_lock
realloc
wcscat_s
_unlock
__dllonexit
_onexit
malloc
free
_purecall
__C_specific_handler
??1type_info@@UEAA@XZ
memset
oleaut32
VarUI4FromStr
ntdll
RtlAcquireResourceExclusive
RtlConvertExclusiveToShared
RtlReleaseResource
RtlDeleteResource
RtlInitializeResource
RtlAcquireResourceShared
RtlConvertSharedToExclusive
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
SetEvent
InitializeCriticalSection
CreateEventW
WaitForSingleObject
ResetEvent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoRevertToSelf
CoImpersonateClient
CoCreateGuid
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-heap-l1-1-0
HeapDestroy
GetProcessHeap
api-ms-win-core-file-l1-1-0
GetFullPathNameW
DeleteFileW
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-io-l1-1-0
CancelIoEx
DeviceIoControl
api-ms-win-core-libraryloader-l1-2-0
LoadResource
DisableThreadLibraryCalls
SizeofResource
FindResourceExW
GetModuleFileNameW
GetModuleHandleW
LoadLibraryExW
GetProcAddress
FreeLibrary
api-ms-win-core-string-l2-1-0
CharPrevW
CharNextW
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteValueW
RegEnumValueW
RegCloseKey
RegSetValueExW
api-ms-win-core-string-obsolete-l1-1-0
lstrcpynW
lstrcmpiW
api-ms-win-core-memory-l1-1-0
VirtualQuery
VirtualAlloc
VirtualProtect
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
CreateThread
GetCurrentThread
OpenThreadToken
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
api-ms-win-security-base-l1-1-0
ImpersonateSelf
AdjustTokenPrivileges
RevertToSelf
api-ms-win-security-lsalookup-l2-1-0
LookupPrivilegeValueW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
virtdisk
GetStorageDependencyInformation
CreateVirtualDisk
DetachVirtualDisk
CompactVirtualDisk
MergeVirtualDisk
ExpandVirtualDisk
GetVirtualDiskOperationProgress
OpenVirtualDisk
AttachVirtualDisk
GetVirtualDiskInformation
vdsutil
?Prev@CRtlListIter@@QEAAAEAV1@XZ
??0CRtlList@@QEAA@P6AXPEAVCRtlEntry@@@Z@Z
??1CRtlList@@QEAA@XZ
??0CVdsCallTracer@@QEAA@KPEBD@Z
??1CVdsCallTracer@@QEAA@XZ
?Begin@CRtlList@@QEAA?AVCRtlListIter@@XZ
?End@CRtlList@@QEAA?AVCRtlListIter@@XZ
?GetEntry@CRtlListIter@@QEAAPEAVCRtlEntry@@XZ
?RemoveAll@CRtlList@@QEAAXXZ
VdsTraceExW
VdsTraceEx
?Next@CRtlListIter@@QEAAAEAV1@XZ
VdsHeapAlloc
OpenDevice
RegisterProvider
UnregisterProvider
VdsAllocateString
?Next@CRtlMapIter@@QEAAAEAV1@XZ
??1CRtlMap@@UEAA@XZ
?RemoveAll@CRtlMap@@QEAAXH@Z
?Insert@CRtlMap@@QEAAHAEAVCRtlEntry@@0@Z
?Begin@CRtlMap@@QEAA?AVCRtlMapIter@@XZ
?Find@CRtlMap@@QEAAHAEAVCRtlEntry@@PEAV2@@Z
?Remove@CRtlMap@@QEAAHAEAVCRtlEntry@@@Z
?Append@CPrvEnumObject@@QEAAJPEAUIUnknown@@@Z
?Reset@CPrvEnumObject@@UEAAJXZ
?Next@CPrvEnumObject@@UEAAJKPEAPEAUIUnknown@@PEAK@Z
?Skip@CPrvEnumObject@@UEAAJK@Z
?Clone@CPrvEnumObject@@UEAAJPEAPEAUIEnumVdsObject@@@Z
??0CRtlMap@@QEAA@KP6AXPEAVCRtlEntry@@@Z1@Z
VdsHeapFree
??0CPrvEnumObject@@QEAA@XZ
??0CRtlSharedLock@@QEAA@XZ
??0CVdsCriticalSection@@QEAA@PEAU_RTL_CRITICAL_SECTION@@@Z
??0CVdsPnPNotificationBase@@QEAA@XZ
??0CVdsUnlockIt@@QEAA@AEAJ@Z
??1CPrvEnumObject@@QEAA@XZ
??1CRtlSharedLock@@QEAA@XZ
??1CVdsCriticalSection@@QEAA@XZ
??1CVdsPnPNotificationBase@@QEAA@XZ
??1CVdsUnlockIt@@QEAA@XZ
??_FCRtlList@@QEAAXXZ
??_FCRtlMap@@QEAAXXZ
?AcquireRead@CRtlSharedLock@@AEAAXXZ
?AcquireWrite@CRtlSharedLock@@AEAAXXZ
?AllowCancel@CVdsAsyncObjectBase@@QEAAXXZ
?CurrentThreadIsWriter@CRtlSharedLock@@QEAAHXZ
?DisallowCancel@CVdsAsyncObjectBase@@QEAAXXZ
?Downgrade@CRtlSharedLock@@AEAAXXZ
?GetOutputType@CVdsAsyncObjectBase@@QEAA?AW4_VDS_ASYNC_OUTPUT_TYPE@@XZ
?IsCancelRequested@CVdsAsyncObjectBase@@QEAAHXZ
?Release@CRtlSharedLock@@AEAAXXZ
?SetOutput@CVdsAsyncObjectBase@@QEAAXU_VDS_ASYNC_OUTPUT@@@Z
?SetOutputType@CVdsAsyncObjectBase@@QEAAXW4_VDS_ASYNC_OUTPUT_TYPE@@@Z
?SetPositionToLast@CPrvEnumObject@@QEAAXXZ
?Upgrade@CRtlSharedLock@@AEAAXXZ
?ZeroAsyncOut@CVdsAsyncObjectBase@@QEAAXXZ
?m_ExtraLogging@CVdsTraceSettings@@QEAAHXZ
?m_NoDebuggerLogging@CVdsTraceSettings@@QEAAHXZ
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
48KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
36KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=48, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=18, id=260, version=33145,
count=5, id=259, version=33145,
count=156, id=1, productName=Unmarked objects,
count=7, id=257, version=33145,
count=4, id=261, version=33145,
count=1, id=256, version=33145,
count=9, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
veinterop.dll
- IMPHASH 7ddf52c2bb9fba1f32b8c14bb9fe2481
- SHA256 c3e06169d7b0c19bd83ea939a68112741e03a9c50d7132b9225feb420e7b3311
- MD5 25260e3ecda47dcbe3a5faa4cdf96b5b
- SHA1 8c5224ac2f2079048d8a1f0911a1cbafebb6cb78
- SHA512 826252c7aa56159926a47043c09e9131ed830ffbd1ca89ef688ef11bddd36e62419c41a4ea1d1ed1eec520888234da7d9989364c0ac91de6ed6f8fc2f63a33dc
- SSDEEP 768:tSaGP7KYsKl7QxpjtdywP7rM+/p9Rdv1PKCf9zoP:rA7KYsKlsLTPHb/p9BPKozG
- TLSH T116234C99935830E5F9A9DA74829AD50BEE74756B07200AFF0AE0D4BC0F177C1DB38B16
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
03:09:00:58:b8:2e:09:9c:84:aa:63:a1:4c:2b:87:73:a7:43:ef:2d:14:f2:83:02:88:e1:ec:2f:e3:15:8c:ca
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:55:46:a8:83:17:24:6f:63:e9:00:00:00:00:05:55
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 13, 2025 - Oct 18, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6F1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1c:09:55:15:d7:c3:59:07:d1:00:01:00:00:02:1c
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
4736
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
veinterop.pdb
vertdll
NtTerminateProcess
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlUnhandledExceptionFilter
memcpy
HeapFree
EnclaveGetAttestationReport
EnclaveEncryptDataForTrustlet
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
HeapAlloc
GetProcessHeap
memset
bcrypt
BCryptDestroySecret
BCryptGenerateSymmetricKey
BCryptSecretAgreement
BCryptImportKeyPair
BCryptDeriveKey
BCryptExportKey
BCryptEncrypt
BCryptDestroyKey
BCryptFinalizeKeyPair
BCryptDecrypt
BCryptGenerateKeyPair
BCryptGenRandom
CloseUserBoundKeyAuthContext
CloseUserBoundKeySession
CreateUserBoundKeyRequestForDeriveSharedSecret
CreateUserBoundKeyRequestForRetrieveAuthorizationContext
GetUserBoundKeyAuthContext
InitializeUserBoundKeySession
ProtectUserBoundKey
UnprotectUserBoundKey
ValidateUserBoundKeyAuthContext
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
456B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=257, version=33145,
count=26, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=6, id=260, version=33145,
count=4, id=259, version=33145,
count=1, id=256, version=33145,
count=3, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
verifier.dll
- IMPHASH 938a38368f28e5cdfe0de2254c4760ad
- SHA256 a3c459a503022e3592a37067d5ac730b08083baef68e8c37d0db6976f2e3f1be
- MD5 b741b095354df9cd04319f72ccdffada
- SHA1 2adfab2e6e7b1d3d434604fc3d4430071acb0a01
- SHA512 f07b72c6c9dc2a8a2cd8e33aca754abfca76929a83abcc4202a2ea332846665b801dda4459d5ca4c9f9c3b3a53e5b7c1f30f1b34894935034e6553beabccea42
- SSDEEP 3072:wYZia6i1EPpoe8NbHC+pcG47RU976VpKUZRD3BZXvVKbFoBhYIWTVBKNFQxV3Zsm:7ia/S2e89Xpczu97AHRZXdhXWTfqsb/
- TLSH T170840A5663F94118F9F77B7899B601658A727C96AF38C2CF0280416E4EB2FC49D34B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a5:9c:1c:db:3a:23:5a:c5:e6:27:bd:2c:3f:70:c1:de:ae:7b:10:bd:5d:af:b5:a7:2d:f2:5f:db:86:aa:c1:84
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 28, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:571A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:fb:cb:cb:6c:37:67:e5:30:95:00:01:00:00:01:fb
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
40688
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
verifier.pdb
ntdll
RtlDllShutdownInProgress
RtlCompareUnicodeString
NtQuerySystemTime
RtlAllocateHeap
RtlRandom
NtQueryPerformanceCounter
RtlInitUnicodeString
RtlCaptureStackBackTrace
RtlEnterCriticalSection
RtlInitializeCriticalSection
RtlLeaveCriticalSection
DbgPrint
RtlDeleteCriticalSection
NtFreeVirtualMemory
RtlGetUserInfoHeap
RtlDestroyHeap
RtlValidateHeap
RtlInitializeGenericTableAvl
RtlInitializeSRWLock
DbgPrintEx
NtQueryVirtualMemory
RtlDeleteElementGenericTableAvl
NtQuerySystemInformation
NtOpenEvent
RtlUpcaseUnicodeChar
NtQueryInformationProcess
RtlReleaseSRWLockExclusive
RtlLookupElementGenericTableAvl
RtlAcquireSRWLockExclusive
NtAllocateVirtualMemory
RtlInsertElementGenericTableAvl
RtlAcquireSRWLockShared
RtlReleaseSRWLockShared
NtReadVirtualMemory
RtlEnumerateGenericTableAvl
RtlInitializeCriticalSectionEx
RtlSizeHeap
RtlSetUserFlagsHeap
NtQueryEvent
NtProtectVirtualMemory
RtlSetUserValueHeap
RtlFreeHeap
RtlFlushSecureMemoryCache
RtlSetHeapInformation
RtlCreateHeap
RtlUnlockHeap
RtlLockHeap
RtlRaiseException
LdrLockLoaderLock
LdrUnlockLoaderLock
RtlCaptureContext
RtlReportException
NtTerminateProcess
LdrGetProcedureAddress
LdrUnloadDll
LdrLoadDll
RtlDecodePointer
RtlInitAnsiString
RtlEncodePointer
RtlFreeAnsiString
LdrFindResource_U
RtlUnicodeStringToAnsiString
LdrAccessResource
LdrQueryImageFileKeyOption
LdrQueryImageFileExecutionOptions
RtlImageNtHeader
EtwEventWriteTransfer
RtlSetEnvironmentVariable
EtwEventUnregister
EtwEventRegister
NtWriteVirtualMemory
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnhandledExceptionFilter
memmove
__C_specific_handler
_vsnwprintf
_wcsicmp
_vsnprintf
sscanf_s
wcstoul
wcsstr
_stricmp
RtlQueryHeapInformation
NtOpenThread
NtSuspendThread
NtClose
LdrQueryProcessModuleInformation
RtlNtStatusToDosError
NtResumeThread
RtlAddVectoredExceptionHandler
RtlEqualUnicodeString
LdrGetDllHandle
RtlDeleteResource
RtlAcquireResourceShared
NtDelayExecution
RtlAcquirePebLock
RtlReleaseResource
RtlInitializeResource
RtlAcquireResourceExclusive
RtlRemoveVectoredExceptionHandler
NtQueryInformationThread
RtlFindClearBitsAndSet
NtQueryObject
RtlReleasePebLock
RtlInterlockedPushEntrySList
RtlSplay
RtlDelete
RtlInitializeSListHead
RtlpWaitForCriticalSection
RtlInitializeCriticalSectionAndSpinCount
RtlTryEnterCriticalSection
RtlConvertExclusiveToShared
RtlRaiseStatus
RtlConvertSharedToExclusive
RtlInterlockedPopEntrySList
LdrFindEntryForAddress
iswspace
RtlEnumerateGenericTableWithoutSplayingAvl
_wcsnicmp
RtlQueryDepthSList
NtCreateEvent
RtlDeregisterWait
NtSetEvent
RtlRegisterWait
NtOpenProcessTokenEx
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
NtOpenKey
RtlConvertSidToUnicodeString
NtQueryInformationToken
NtDeleteValueKey
NtSetValueKey
NtQueryValueKey
NtGetContextThread
RtlDeregisterWaitEx
RtlWalkFrameChain
NtClearEvent
RtlFreeUnicodeString
RtlSetThreadPoolStartFunc
RtlCheckForOrphanedCriticalSections
NtWaitForMultipleObjects
NtCreateKey
NtWaitForSingleObject
NtCreateSection
NtUnmapViewOfSection
NtOpenSection
NtMapViewOfSection
memcpy
memset
AVrfAPILookupCallback
VerifierAddFreeMemoryCallback
VerifierCheckPageHeapAllocation
VerifierCreateRpcPageHeap
VerifierDeleteFreeMemoryCallback
VerifierDestroyRpcPageHeap
VerifierDisableFaultInjectionExclusionRange
VerifierDisableFaultInjectionTargetRange
VerifierEnableFaultInjectionExclusionRange
VerifierEnableFaultInjectionTargetRange
VerifierEnumerateResource
VerifierForceNormalHeap
VerifierGetInfoForException
VerifierGetMemoryForDump
VerifierGetPropertyValueByName
VerifierGetProviderHelper
VerifierIsAddressInAnyPageHeap
VerifierIsCurrentThreadHoldingLocks
VerifierIsDllEntryActive
VerifierIsPerUserSettingsEnabled
VerifierQueryRuntimeFlags
VerifierRedirectStopFunctions
VerifierSetFaultInjectionProbability
VerifierSetFlags
VerifierSetRuntimeFlags
VerifierStopMessage
Name
.text
Size
152KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
32KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
136KB
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=257, version=33138,
count=151, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=8, id=260, version=33138,
count=4, id=259, version=33138,
count=1, id=256, version=33138,
count=36, id=264, version=33138,
count=1, id=255, version=33138,
count=1, id=258, version=33138,
version.dll
- IMPHASH 215123f5eba5c4b85368cd4f89b61c21
- SHA256 cea99f212af557a9613150c5509631403ed0f05f5d9a06ac42039bd59b40e39a
- MD5 0793e3f7fad65b159b5f242400bfc140
- SHA1 3bc52801fc66150d0a2d064c1df3770b88d2fad2
- SHA512 d1bf36744aacec8a95665f56f5ce4cf00685f836c4905b5a51dee55c803fafe6fc8069a08fe3959761b5a2e6367a2283077828958cb4888b909f7d402f6fd917
- SSDEEP 1536:Y9DVZmckVPxIiTPqMwsK2ulzxA6lEJLPGzn:Y9uckVPxIiTPqMwszulzxA6lExur
- TLSH T1DC435A5D677C2098F9A316B89171AA17AA307370133022FF46F1D5380D173E4AA38FBA
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ad:9f:e0:84:b6:fb:ba:ec:84:ff:f0:c4:97:fe:3e:62:ce:c8:8b:5d:93:f2:f2:7a:33:59:50:f5:ad:cf:b6:79
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 3, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:DC00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:e8:50:b0:80:cf:2b:72:99:4d:00:01:00:00:01:e8
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
5168
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
version.pdb
msvcrt
memcmp
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
_vsnwprintf
_vsnprintf
memset
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
GetLastError
api-ms-win-core-version-l1-1-0
VerFindFileW
GetFileVersionInfoSizeExW
VerQueryValueW
GetFileVersionInfoExW
api-ms-win-core-localization-l1-2-0
IsDBCSLeadByte
api-ms-win-core-version-l1-1-1
GetFileVersionInfoSizeW
GetFileVersionInfoW
api-ms-win-core-file-l1-1-0
CreateFileW
DeleteFileW
GetFileAttributesW
DeleteFileA
GetFileSize
GetFullPathNameA
SetFileTime
GetFileTime
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-processthreads-l1-1-0
TlsSetValue
GetCurrentThreadId
TlsFree
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
TlsGetValue
TlsAlloc
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
GetProcAddress
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-versionansi-l1-1-0
VerQueryValueA
VerFindFileA
GetFileVersionInfoSizeExA
GetFileVersionInfoExA
api-ms-win-core-versionansi-l1-1-1
GetFileVersionInfoA
GetFileVersionInfoSizeA
api-ms-win-core-version-private-l1-1-0
GetFileVersionInfoByHandle
kernelbase
lstrcmpiA
lstrcmpiW
lstrlenW
ntdll
RtlAllocateHeap
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlUnicodeStringToAnsiString
NlsMbCodePageTag
kernel32
_llseek
_lwrite
_lread
_lopen
_lclose
_lcreat
LZCreateFileW
LZCloseFile
LZInit
LZCopy
LZClose
MoveFileW
GetFileVersionInfoA
GetFileVersionInfoByHandle
GetFileVersionInfoExA
GetFileVersionInfoExW
GetFileVersionInfoSizeA
GetFileVersionInfoSizeExA
GetFileVersionInfoSizeExW
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerFindFileA
VerFindFileW
VerInstallFileA
VerInstallFileW
VerLanguageNameA
VerLanguageNameW
VerQueryValueA
VerQueryValueW
Name
.text
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
552B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
132B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=36, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33138,
count=4, id=259, version=33138,
count=84, id=1, productName=Unmarked objects,
count=9, id=257, version=33138,
count=1, id=256, version=33138,
count=9, id=264, version=33138,
count=1, id=255, version=33138,
count=1, id=258, version=33138,
vertdll.dll
- SHA256 1b5b909dcb4d9dc73a036ddfb9b97a80da54925dba72f2c0cce36c58edf5d33a
- MD5 f12a519a656ca0e666f2dc42b4f7790e
- SHA1 2a6053be48c55722b2b6fb7e27fe233473964073
- SHA512 8939ac98319cdab9191977f980fd8af3fb95f917e2a090eee9de13b51a41f19019f69a478b4ad75c56f1e377c78239b6aaf00b2aa40e0e728ef6bb7dd4a5afb7
- SSDEEP 3072:07eaw1X9YgttttNKA5sWz3uVwnfhGxPUW80CCNV1ne3YzqqK7kssg:079w1mgttttNpGWDuVwnJGxMDCNK3P
- TLSH T18E249E55B2B818FAD977823DC697871BD7B1780113106ACF03958B792F93BE0AA3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
63:3b:16:68:ef:c2:32:c8:cc:3e:89:3e:73:43:ef:5b:8a:03:f0:a6:82:c2:39:95:38:aa:2e:6b:62:20:74:0a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:55:46:a8:83:17:24:6f:63:e9:00:00:00:00:05:55
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 13, 2025 - Oct 18, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3703-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1f:3a:70:69:e4:a2:30:2e:95:00:01:00:00:02:1f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
33040
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vertdll.pdb
AcquireSRWLockExclusive
AcquireSRWLockShared
CallEnclave
CloseHandle
CloseThreadpoolTimer
CreateEventW
CreateThreadpoolTimer
DbgPrint
DelayLoadFailureHook
DeleteCriticalSection
DeleteSynchronizationBarrier
DeviceIoControl
DisableThreadLibraryCalls
EnclaveCopyIntoEnclave
EnclaveCopyOutOfEnclave
EnclaveEncryptDataForTrustlet
EnclaveGetAttestationReport
EnclaveGetEnclaveInformation
EnclaveRestrictContainingProcessAccess
EnclaveSealData
EnclaveUnsealData
EnclaveUsesAttestedKeys
EnclaveVerifyAttestationReport
EnterCriticalSection
EnterSynchronizationBarrier
EtwEventRegister
EtwEventUnregister
EtwEventWrite
EtwEventWriteTransfer
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwRegisterTraceGuidsW
EtwTraceMessage
EtwUnregisterTraceGuids
EventRegister
EventSetInformation
EventUnregister
EventWriteTransfer
ExpInterlockedPopEntrySListEnd
ExpInterlockedPopEntrySListFault
ExpInterlockedPopEntrySListResume
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnabledXStateFeatures
GetFipsModeFromIumKernelState
GetLastError
GetModuleFileNameW
GetModuleHandleExW
GetProcAddress
GetProcessHeap
GetProcessHeaps
GetProcessId
GetSeedFromIumKernelState
GetSystemDirectoryW
GetSystemInfo
GetXStateFeaturesMask
HeapAlloc
HeapCompact
HeapCreate
HeapDestroy
HeapFree
HeapLock
HeapReAlloc
HeapSize
HeapUnlock
I_QueryTagInformation
InitializeConditionVariable
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSListHead
InitializeSRWLock
InitializeSynchronizationBarrier
InterlockedFlushSList
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedPushListSList
InterlockedPushListSListEx
IsProcessorFeaturePresent
KiUserExceptionDispatcher
LdrDisableThreadCalloutsForDll
LdrResolveDelayLoadedAPI
LeaveCriticalSection
LoadLibraryExW
LoadLibraryW
LocalFree
LocateXStateFeature
MultiByteToWideChar
NtClose
NtDeviceIoControlFile
NtOpenFile
NtOpenKey
NtQueryInformationProcess
NtQueryValueKey
NtTerminateProcess
OpenProcessToken
OutputDebugStringW
PrivilegeCheck
QueryDepthSList
QueryFullProcess
QueryFullProcessImageNameW
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegisterWaitForSingleObjectEx
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ResolveDelayLoadedAPI
RtlAcquireResourceExclusive
RtlAcquireResourceShared
RtlAllocateHeap
RtlAssert
RtlCallEnclave
RtlCallEnclaveReturn
RtlCaptureContext
RtlCompareUnicodeString
RtlDeleteCriticalSection
RtlDeleteResource
RtlDllShutdownInProgress
RtlEnclaveCallDispatch
RtlEnclaveCallDispatchReturn
RtlEnterCriticalSection
RtlFreeHeap
RtlGetCurrentProcessorNumberEx
RtlGetLastNtStatus
RtlGetSystemGlobalData
RtlImageNtHeader
RtlInitUnicodeString
RtlInitializeCriticalSection
RtlInitializeResource
RtlLeaveCriticalSection
RtlLookupFunctionEntry
RtlNtStatusToDosError
RtlPcToFileHeader
RtlRaiseStatus
RtlReleaseResource
RtlReleaseResourceShared
RtlTimeFieldsToTime
RtlUnhandledExceptionFilter
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetCriticalSectionSpinCount
SetLastError
SetThreadStackGuarantee
SetThreadpoolTimer
SetUnhandledExceptionFilter
SleepConditionVariableCS
SleepConditionVariableSRW
TerminateEnclave
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsGetValue2
TlsSetValue
TryAcquireSRWLockExclusive
TryAcquireSRWLockShared
TryEnterCriticalSection
UnregisterWaitEx
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForThreadpoolTimerCallbacks
WaitOnAddress
WakeAllConditionVariable
WakeByAddressAll
WakeByAddressSingle
WakeConditionVariable
WideCharToMultiByte
__C_specific_handler
__chkstk
_local_unwind
_vsnwprintf
_wcsicmp
_wcsnicmp
_wsplitpath_s
memcmp
memcpy
memmove
memset
qsort
wcscmp
wcscpy_s
wcsncmp
wcsncpy_s
Name
.text
Size
120KB
Virtual Size
119KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.00cfg
Size
4KB
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.mrdata
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
400B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, productName=Unmarked objects (old),
count=26, id=260, version=33145,
count=1, id=256, version=33145,
count=27, id=259, version=33145,
count=70, id=264, version=33145,
count=8, id=261, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vfpapi.dll
- IMPHASH 3f12f86ec9b54ac29c210d197a3e97d2
- SHA256 faed7352cb0a6f504e18e03dd83a945126ed407ffb133f5bd44e59154ffa3b6c
- MD5 8d737333f76314a2034255723f8308ac
- SHA1 72fce94a4676ea08ae4809ec6ee599db416b89f9
- SHA512 abf5b56e39362650969d284c62d664af5c493452bcafa84f11d917a4200f20006d19594499709863bebcacd8479c7640ece5420c770a81d9ba6bdcc794ed7319
- SSDEEP 3072:KzIvOibLPTWstvJlDQwMT/CFEMRZffaNqeEzRs:ZXQwMTxNqzz
- TLSH T1E5F3086573E93065F1B3A5B8DCB6824597B6F8A06B3293DF1180812E1F73BD09D35B22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5824
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vfpapi.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o_malloc
_o_qsort
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_CxxThrowException
__CxxFrameHandler3
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
ntdll
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
RtlCompareMemory
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-io-l1-1-0
DeviceIoControl
GetOverlappedResult
api-ms-win-core-file-l1-1-0
CreateFileW
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
api-ms-win-core-sysinfo-l1-1-0
GetVersionExW
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
GetModuleFileNameA
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionEx
WaitForSingleObject
EnterCriticalSection
CreateSemaphoreExW
InitializeCriticalSection
LeaveCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseSRWLockShared
ReleaseMutex
CreateMutexExW
CreateEventA
AcquireSRWLockShared
ReleaseSemaphore
DeleteCriticalSection
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventUnregister
EventSetInformation
MaskAddress
VfcAddObject
VfcAddObjectSet
VfcBlockLayerCreation
VfcBlockPort
VfcBlockPortOnRestore
VfcCleanNatRangeFlows
VfcClearLayerActivePings
VfcDePreserveVlan
VfcDeleteLayerMetadataKey
VfcDepositNatRange
VfcDeregisterEvent
VfcDeregisterEventEx
VfcDeserializeObjectsGlobal
VfcDeserializeObjectsOnPort
VfcDeserializeObjectsOnSwitch
VfcDisablePingResponder
VfcDisablePort
VfcEnablePingResponder
VfcEnablePort
VfcForceAddObjectSet
VfcGetInformation
VfcGetLayerMetadataValue
VfcInitializeDescriptor
VfcInjectPacket
VfcInjectPacketEx
VfcInterceptEvent
VfcInterceptEventEx
VfcInterceptEventEx2
VfcInterceptEventEx3
VfcListLayerActivePings
VfcListLayerMetadataKeys
VfcListLayerMetadataValues
VfcListObject
VfcMappingEvent
VfcMatchTupleAtLayer
VfcMonitoringPing
VfcNatEvent
VfcNatEventAsync
VfcOpenDevice
VfcPersistHostState
VfcPrepareForUninstall
VfcPreserveVlan
VfcProcessTuples
VfcReleaseList
VfcRemoveAllObject
VfcRemoveMapping
VfcRemoveMappingEx
VfcRemoveNatRange
VfcRemoveObject
VfcReplaceGroupAndRules
VfcReplaceLayerFlowTableAddress
VfcReplaceObjectSet
VfcSampleFlowState
VfcSerializeObjectsGlobal
VfcSerializeObjectsOnPort
VfcSerializeObjectsOnSwitch
VfcSetDirectInterfaceMode
VfcSetGlobalGftMultiTenancy
VfcSetGroupCondition
VfcSetGroupOption
VfcSetHeuristicTimerUpdates
VfcSetInformation
VfcSetLayerMetadataValue
VfcSetPktMonState
VfcSetPortTraceFilters
VfcSetTraceFilteringState
VfcUnblockLayerCreation
VfcUnblockPort
VfcUnblockPortOnRestore
VfcWithdrawNatRange
VmsEnumeratePort
VmsSendDeviceIoControl
VmsSendFilterIoControlEx
Name
.text
Size
72KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
48KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
740B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=41, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1137, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=20, id=261, version=33145,
count=1, id=256, version=33145,
count=26, id=264, version=33145,
count=2, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vfuprov.dll
- IMPHASH b25a64467a45babee4bed823af9c9c8a
- SHA256 1f2d7cd374ab1dc0ff365673f903b9771115a0c878efeeca8ae11c7153ec4ac7
- MD5 89eb027d358049e806e751169573f653
- SHA1 ef77e699669f1821d9609377154135977f628c28
- SHA512 96679ff55a6cc801f3ed877e2e31e067c4b0aa6d309cf6b04f4ed53c11f4bc2dd5b93b953a9616c7a536a75e29ff00aa667ee9dcf862d9be727962b00465f89c
- SSDEEP 3072:h+NQJQk/9PMSFKoao6NW6932Kba+1Fa8FhG90:YmJQkB9FsMs2KX5FA
- TLSH T1E5D3396E369810B5E57AD07C8A964E06D3B2B065032157FF039081BE5F27FE8AD3EB50
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7328
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vfuprov.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o_ceilf
_o_free
_o_malloc
__C_specific_handler
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
memmove
memcmp
memcpy
_CxxThrowException
__CxxFrameHandler3
api-ms-win-crt-string-l1-1-0
memset
kernel32
DeleteCriticalSection
AcquireSRWLockShared
LocalFree
CreateThreadpoolTimer
ReleaseSRWLockShared
SetThreadpoolTimer
AcquireSRWLockExclusive
CloseThreadpoolTimer
ReleaseSRWLockExclusive
WaitForThreadpoolTimerCallbacks
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsDebuggerPresent
DebugBreak
WideCharToMultiByte
GetModuleHandleW
GetProcessHeap
GetCurrentProcessId
CreateMutexExW
GetProcAddress
HeapAlloc
CloseHandle
OpenSemaphoreW
WaitForSingleObjectEx
InitOnceComplete
DisableThreadLibraryCalls
OutputDebugStringW
GetLastError
FormatMessageW
ReleaseMutex
GetCurrentThreadId
WaitForSingleObject
GetModuleHandleExW
ReleaseSemaphore
SetLastError
HeapFree
CreateSemaphoreExW
InitOnceBeginInitialize
GetModuleFileNameA
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventSetInformation
EventRegister
EventUnregister
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoTaskMemFree
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegCreateKeyExW
RegCloseKey
api-ms-win-security-base-l1-1-0
CopySid
GetLengthSid
IsValidSid
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
ntdll
RtlPublishWnfStateData
RtlEqualSid
RtlLengthSid
RtlInitUnicodeString
NtQueryWnfStateData
ext-ms-win-session-wtsapi32-l1-1-0
WTSQuerySessionInformationW
WTSEnumerateSessionsW
WTSFreeMemory
msvcp_win
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-security-lsapolicy-l1-1-0
LsaFreeMemory
LsaClose
LsaLookupNames2
LsaOpenPolicy
SruInitializeProvider
SruUninitializeProvider
Name
.text
Size
80KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=1180, id=1, productName=Unmarked objects,
count=2, id=257, version=33145,
count=24, id=261, version=33145,
count=1, id=256, version=33145,
count=6, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vfwwdm32.dll
- IMPHASH 1ea7e889d1638727df6d078956525c7e
- SHA256 bc20e4e849af9748c09c6411bd4bcb1ed96dbe297eb17acfc160f755b557ce22
- MD5 bcaef5f154fb0d4cb1386138874829e4
- SHA1 34afb48dabf259393a776f1fd56f8405ed4d1972
- SHA512 c2de71a3de9d301abaeba1d54fe0848e6f4574f3fd2717e703363e73a6d4e0cc4c228f7d281b0d387122c4da682853c0e7975f4c0e38d37629d998a89c4f7990
- SSDEEP 1536:tYvvGYj626U+2i8nvGYW7HRJicXNYKiv5gVW:GvvF6U+DNxscXcv5gV
- TLSH T1C6933A4D23F520E9E576613885628B5AE3B2B861133197EF4BE0C27D5F23BD0AD39B11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5152
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vfwwdm32.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__purecall
_o__seh_filter_dll
memcpy
_o_free
_o_malloc
_o_strtol
_o__cexit
_o__callnewh
_o___stdio_common_vsprintf
_o___std_type_info_destroy_list
__C_specific_handler
api-ms-win-crt-string-l1-1-0
memset
strcmp
ksuser
KsCreatePin
user32
CreateWindowExA
RegisterClassA
LoadCursorA
SetForegroundWindow
GetClientRect
GetWindowRect
DefWindowProcA
PostQuitMessage
DispatchMessageA
GetMessageA
UnregisterClassA
FindWindowA
GetClassInfoA
SendMessageA
WinHelpA
GetWindowLongPtrA
SetWindowLongPtrA
GetParent
IsWindowEnabled
EnableWindow
SetWindowTextA
MessageBoxA
LoadStringA
ShowWindow
GetDlgItem
kernel32
DeviceIoControl
CreateEventA
GetLastError
VirtualFree
WideCharToMultiByte
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
WaitForMultipleObjectsEx
ResumeThread
SetThreadPriority
CreateThread
ExitThread
SetEvent
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
OutputDebugStringA
DisableThreadLibraryCalls
FreeLibrary
GetModuleHandleA
GetProcAddress
LoadLibraryA
GetOverlappedResult
CloseHandle
CancelIo
WaitForSingleObject
VirtualAlloc
winmm
DefDriverProc
timeGetTime
DriverCallback
advapi32
RegSetValueExA
RegCloseKey
RegCreateKeyExA
RegQueryValueExA
ole32
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoInitializeEx
oleaut32
OleCreatePropertyFrame
SysFreeString
comctl32
CreatePropertySheetPageA
ord17
PropertySheetA
DllMain
DriverProc
VfwWdm
Name
.text
Size
48KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
268B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=257, version=33138,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1161, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33138,
count=4, id=259, version=33138,
count=18, id=261, version=33138,
count=1, id=256, version=33138,
count=25, id=264, version=33138,
count=1, id=253, version=33138,
count=1, id=255, version=33138,
count=1, id=258, version=33138,
vid.dll
- IMPHASH ac69538b5024d6222f74142f222a5aac
- SHA256 9b538c07fa65c09d406956371ef3c68f4bce4e1fa9f694e4ccb727409366fa26
- MD5 fc00b014adb5e4cac8dc7ff03c57ce5b
- SHA1 7a10320fe5c9f0ab42f68eb0c46742ef809891e3
- SHA512 739cd439b06bf64e09b9ab9d2650c865df2894b3c7a2c454f8699dd459680522c7a2f40d9b627268b16a5ea1386cb67ea2fd39cda0cb8f2135c4b30aaface769
- SSDEEP 3072:GoiSOgMzTcbW99WokWkJS/ujjz8w6W8jrI+rdVg/ACgx1rxg4YuKet5Jf5:BiVgRbW94okWkJSGjjRiRa4YuKeJx
- TLSH T1DC44C53C239E2014DABBCE3889E15590D563B4301B715AFF35E2C5788D276C9BB36E92
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
1e:e5:20:e2:a2:5a:ca:e9:d2:f3:ef:5b:bf:a0:d0:05:fe:a1:1e:74:d2:98:f6:25:d7:12:1d:16:44:06:24:85
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 27, 2025
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:19:da:dd:aa:8b:dc:44:b2:92:00:00:00:00:05:19
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 19, 2025 - Jun 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8D00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:0d:0d:77:be:7b:36:8f:7f:e3:00:01:00:00:02:0d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
31344
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vid.pdb
ntdll
memcpy
RtlVirtualUnwind
RtlLookupFunctionEntry
NtDeviceIoControlFile
RtlGUIDFromString
RtlRbRemoveNode
RtlRbInsertNodeEx
_vsnwprintf
RtlDosPathNameToNtPathName_U
RtlAllocateHeap
RtlSetLastWin32ErrorAndNtStatusFromNtStatus
RtlFreeHeap
wcscpy_s
wcschr
RtlNtStatusToDosError
NtWaitForSingleObject
RtlCaptureContext
__chkstk
memset
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
GetLastError
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer
api-ms-win-core-synch-l1-1-0
InitializeSRWLock
LeaveCriticalSection
EnterCriticalSection
AcquireSRWLockExclusive
DeleteCriticalSection
InitializeCriticalSection
CreateEventW
AcquireSRWLockShared
ReleaseSRWLockExclusive
ReleaseSRWLockShared
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExA
FreeLibrary
DisableThreadLibraryCalls
GetProcAddress
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-string-l1-1-0
CompareStringW
api-ms-win-core-file-l1-1-0
CreateFileW
api-ms-win-core-file-l2-1-0
ReOpenFile
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
api-ms-win-core-perfcounters-l1-1-0
PerfSetCounterRefValue
PerfCreateInstance
PerfStartProvider
PerfDeleteInstance
PerfSetCounterSetInfo
PerfStopProvider
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
GetSystemInfo
api-ms-win-core-memory-l1-1-0
VirtualQuery
VirtualProtect
VidAdjustNestedTlbSize
VidAllocateMemoryBlockReadWriteBuffers
VidAssertVirtualProcessorInterrupt
VidAttachPartition
VidChangePartitionLifeState
VidCheckForIoIntercept
VidClearVirtualProcessorInterrupt
VidCloneTemplateCreate
VidCloneTemplateDestroy
VidCloneTemplateDestroyDetached
VidCloneTemplateDetach
VidCloseStatisticsHandle
VidControlGpaAccessTracking
VidCreateCpuGroup
VidCreateDaxFileMemoryBlock
VidCreateExoPartition
VidCreateMemoryBlock
VidCreateMemoryBlockGpaRange
VidCreateMmioGpaRange
VidCreatePartition
VidCreateSynicPort
VidCreateVaGpaRange
VidDeleteCpuGroup
VidDeletePartition
VidDepositPartitionMemory
VidDestroyGpaRange
VidDestroyGpaRangeCheckSecure
VidDestroyMemoryBlock
VidDestroyMemoryBlockReadWriteBuffers
VidDestroySynicPort
VidDetachPartition
VidDisablePartitionVtl
VidDisableVpVtl
VidDllStatsGetPartitionCounters
VidDllStatsGetSharedBuffer
VidDllStatsGetVmPerfRootInstance
VidDmBalloon
VidDmConsolidationDisable
VidDmConsolidationEnable
VidDmHotAdd
VidDmHotAddUndo
VidDmMemoryBlockQueryTopology
VidDmSlpDisable
VidDmSlpQuery
VidDmSlpSetup
VidDmSlpWaitForDisable
VidDmUnBalloon
VidDmWorkingSetModify
VidEncryptDecryptData
VidEpfRestore
VidEpfSave
VidEpfSuspendBegin
VidEpfSuspendEnd
VidExoAccessVaFault
VidExoBrokerReceive
VidExoBrokerSend
VidExoControlGpaAccessTracking
VidExoGetVpState
VidExoInstallIntercept
VidExoMapGpaRange
VidExoPinGpaRanges
VidExoRegisterInterceptResult
VidExoSetVpState
VidExoUnmapGpaRange
VidExoUnpinGpaRanges
VidExoVpCreate
VidExoVpDestroy
VidExoVpMap
VidFlushMemoryBlockMapping
VidFlushMemoryBlockPageRange
VidGetCpuGroupProperty
VidGetExoPartitionProperty
VidGetExoSystemInformation
VidGetExoSystemTopology
VidGetHvLogicalProcessorCount
VidGetHvLogicalProcessorRuntime
VidGetHvMemoryBalance
VidGetHvPartitionId
VidGetHvVpRuntime
VidGetIsolationLuid
VidGetMemoryBlockProtectionBitmap
VidGetPartitionIds
VidGetPartitionProperty
VidGetProcessorTopology
VidGetRootReferenceTime
VidGetRpcSession
VidGetSecurityCookie
VidGetSystemInformation
VidGetSystemTopology
VidGetVirtualProcessorRunningStatus
VidGetVirtualProcessorState
VidGetVirtualProcessorStateEx
VidGpaAccessTrackingDisable
VidGpaAccessTrackingEnable
VidHandleMessageAndGetNextMessage
VidInitEncryptionKeys
VidInjectSyntheticMachineCheckEvent
VidIsolatedInsertPages
VidMapHvGlobalStatsPage
VidMapHvLocalStatsPage
VidMapHvRootStatsPage
VidMapHypercallDoorbellPage
VidMapMemoryBlockPageRange
VidMapMemoryBlockPageRangeEx
VidMapVpStatePage
VidMarkPagePoisoned
VidMemPartEnumerate
VidMemPartGetIndexFromName
VidMemPartGetNameFromIndex
VidMemReserveGetTarget
VidMemReserveIoSpaceConvert
VidMemReserveIoSpacePagesAdd
VidMemReserveIoSpacePagesRelease
VidMemReservePagesAdd
VidMemReservePagesRelease
VidMemReserveSetTarget
VidMemXferConnectClose
VidMemXferConnectDisable
VidMemXferConnectEnable
VidMemXferConnectOpen
VidMemXferSendAsync
VidMessageSlotHandleAndGetNext
VidMessageSlotMap
VidOpenStatisticsHandle
VidPhuBegin
VidPhuCommit
VidPhuEnd
VidPhuFreePersistedData
VidPhuOpenMemoryBlockFile
VidPhuPersistGpaRange
VidPhuPersistMemoryBlock
VidPopulateCpuidInformation
VidPrefetchDirectMapRanges
VidPreparePartitionOperation
VidProtectMemoryBlockPages
VidQueryMemoryBlockFaultClusterInfo
VidQueryMemoryBlockInformation
VidQueryPartitionInformation
VidQueryVaGpaRangeWorkingSetInfo
VidReadMemoryBlockPageRange
VidReadWriteMappedMemoryBlockPageRange
VidReadWriteMemoryBlockPageRange
VidRegisterApicEoiHandler
VidRegisterCpuidHandler
VidRegisterCpuidResult
VidRegisterExceptionHandler
VidRegisterHypervisorRestartHandler
VidRegisterIoPortHandler
VidRegisterMsrAddressHandler
VidRegisterMsrHandler
VidRegisterTripleFaultHandler
VidReleaseEncryptionKeys
VidReleasePages
VidReopenExoPartition
VidReservePages
VidResetPartition
VidResetPoisonedPage
VidRestorePartitionState
VidSavePartitionState
VidSchedulerAssistRestore
VidSchedulerAssistSave
VidSchedulerAssistSuspend
VidSetCpuGroupAffinity
VidSetCpuGroupProperty
VidSetMailboxKey
VidSetMemoryBlockClientNotifications
VidSetMemoryBlockFlushAfterWrite
VidSetMemoryBlockNotificationQueue
VidSetPartitionCpuFrequencyCap
VidSetPartitionCpuResourcePriorities
VidSetPartitionFriendlyName
VidSetPartitionProperty
VidSetPeerProcess
VidSetPropertySynicPort
VidSetSystemInformation
VidSetVirtualProcessorState
VidSetVirtualProcessorStateEx
VidSetupMessageQueue
VidSevSnpControlStateRestore
VidSevSnpControlStateSave
VidSevSnpIssueNestedPspRequests
VidSgxResetMemoryBlocks
VidStartVirtualProcessor
VidStatsMap
VidStatsMapMemoryPartition
VidStatsMapNuma
VidStatsUnMap
VidStatsUnMapMemoryPartition
VidStatsUnMapNuma
VidStopVirtualProcessor
VidSuspendApply
VidSuspendClear
VidTeardownPartitionOperation
VidTranslateGpa
VidTranslateGvaToGpa
VidTriggerCreate
VidTriggerDestroy
VidTriggerUpdateParameters
VidTrimPartitionMemory
VidUnmapHvGlobalStatsPage
VidUnmapHvLocalStatsPage
VidUnmapHvRootStatsPage
VidUnmapMemoryBlockPageRange
VidUnprotectMemoryBlockPages
VidUnregisterCpuidResult
VidUnregisterHandler
VidVsmCheckGpaPageVtlAccess
VidVsmEnableVpVtl
VidVsmGetMemoryBlockProtections
VidVsmGetPartitionConfig
VidVsmPrecommitMgmtVtlPageRange
VidVsmQueryProtectionsDirty
VidVsmSetMemoryBlockProtections
VidVsmSetPartitionConfig
VidWriteMemoryBlockPageRange
Name
.text
Size
128KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
48KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
164B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=30, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=33145,
count=79, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=7, id=260, version=33145,
count=4, id=259, version=33145,
count=1, id=256, version=33145,
count=9, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
virtdisk.dll
- IMPHASH 1ff9296bda9343066bb49eb8ef3d77d4
- SHA256 194b3efbb5f0d1820959cc04ad00ce5d728690d23f83c1a65eaa7bff7990bc9e
- MD5 34794260050cb3795f211ff6e5bdc6a7
- SHA1 343f3043729e2f190d39a5cf59a614db6ec8ff41
- SHA512 a12981002f8d0e3b97e2ad65dd05775ceb99cf328ecb0782904106d77a64b5cd937a26a0246a8af68b18c58a4dba72556fdd305dd54e7c14bd7aabf730ce3306
- SSDEEP 1536:pn3zaRWrnpdnJDUQ3KSOyM15WjY6VTC+1OlMVeggP7zU:F5npdJDUpSO9AjL+cOlGeggD4
- TLSH T171A36C5AA6A520A9D47BD174C2A28306BA32B479271587EF03F0D53C1F17BD16F38F89
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
4b:8d:b7:19:81:15:3f:3b:70:18:f6:5f:6b:78:bb:61:95:b7:41:21:a1:27:7f:e9:a5:ac:4f:b9:62:50:f6:cf
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:3605-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:13:b0:43:35:66:cf:af:95:e8:00:01:00:00:02:13
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
22112
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
VirtDisk.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___stdio_common_vswprintf_s
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
_o___stdio_common_vswprintf
memcpy
_o_free
_o_malloc
__C_specific_handler
_o___std_type_info_destroy_list
wcsrchr
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
UnregisterTraceGuids
RegisterTraceGuidsW
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventUnregister
EventWriteTransfer
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-file-l1-1-0
GetFileTime
DeleteFileW
CreateFileW
GetFinalPathNameByHandleW
GetFileInformationByHandle
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-io-l1-1-0
DeviceIoControl
GetOverlappedResult
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-kernel32-legacy-l1-1-0
MoveFileW
api-ms-win-core-file-l2-1-0
CopyFileExW
api-ms-win-security-base-l1-1-0
ImpersonateSelf
GetSecurityDescriptorLength
MakeSelfRelativeSD
AdjustTokenPrivileges
IsValidSecurityDescriptor
RevertToSelf
api-ms-win-core-string-l1-1-0
CompareStringW
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTime
GetSystemTimeAsFileTime
api-ms-win-core-rtlsupport-l1-1-0
RtlCompareMemory
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-0
OpenThreadToken
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
GetCurrentThread
api-ms-win-core-synch-l1-1-0
CreateEventW
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
ntdll
RtlAppendUnicodeToString
NtCreateEvent
NtDeviceIoControlFile
NtWaitForSingleObject
NtClose
DbgPrint
RtlComputeCrc32
RtlNtStatusToDosError
RtlFreeHeap
RtlAllocateHeap
RtlAppendUnicodeStringToString
NtCreateFile
RtlInitUnicodeString
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
AddVirtualDiskParent
ApplySnapshotVhdSet
AttachVirtualDisk
BreakMirrorVirtualDisk
CompactVirtualDisk
CompleteForkVirtualDisk
CreateVirtualDisk
DeleteSnapshotVhdSet
DeleteVirtualDiskMetadata
DetachVirtualDisk
EnumerateVirtualDiskMetadata
ExpandVirtualDisk
ForkVirtualDisk
GetAllAttachedVirtualDiskPhysicalPaths
GetStorageDependencyInformation
GetVirtualDiskInformation
GetVirtualDiskMetadata
GetVirtualDiskOperationProgress
GetVirtualDiskPhysicalPath
MergeVirtualDisk
MirrorVirtualDisk
ModifyVhdSet
OpenVirtualDisk
QueryChangesVirtualDisk
RawSCSIVirtualDisk
ResizeVirtualDisk
SetVirtualDiskInformation
SetVirtualDiskMetadata
TakeSnapshotVhdSet
Name
.text
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
164B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=51, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1140, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=4, id=259, version=33145,
count=13, id=261, version=33145,
count=1, id=256, version=33145,
count=15, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vmbuspipe.dll
- IMPHASH 2c08e129fbcf616c1663d378678e5966
- SHA256 e43d0a27c80993b175a1a694cb497a477f06c9c7d56ed2af8e24a1890f151b91
- MD5 a152ddb96149e84f3e1bb920587cb002
- SHA1 aba55d0b67400dba5d7e8f8a01f58cab30beb25a
- SHA512 410d3280b7772c312c117bbd805f87743edef9ac78fc59af3a4e2e16d659ffdd3a9727f4ed7bf315aa8bc62c21d94926ee4da300f9ee1d3db285a5d5016dfd30
- SSDEEP 1536:oe4ibxZLtpfgH1fh7/nb2wAJ+BnpRwD6O8OsgPhz:oqPgB1nbHcD78Osgp
- TLSH T1E6837D8E379524FAE0B7913CC5D3460AE6B6B9615B1107EF03A0C1AD0F23BE8663CB55
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
58:5e:32:af:44:3e:5c:a2:5b:8c:8d:58:58:98:53:77:2c:fa:ae:14:fb:56:2a:1c:27:a4:66:03:22:01:f5:3c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:4C1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:18:25:d9:92:05:e2:e7:e5:e4:00:01:00:00:02:18
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
5376
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vmbuspipe.pdb
api-ms-win-crt-string-l1-1-0
wcsncmp
memset
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__register_onexit_function
_o__seh_filter_dll
memcpy
_o_free
_o_malloc
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___stdio_common_vswprintf
wcsrchr
__std_terminate
__CxxFrameHandler4
ntdll
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlInitUnicodeString
RtlCaptureContext
NtOpenFile
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetProcAddress
DisableThreadLibraryCalls
GetModuleHandleW
GetModuleHandleExW
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolWorkCallbacks
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegCloseKey
api-ms-win-core-synch-l1-1-0
WaitForSingleObjectEx
SetEvent
CreateMutexExW
ReleaseMutex
WaitForSingleObject
OpenSemaphoreW
LeaveCriticalSection
ReleaseSemaphore
EnterCriticalSection
CreateSemaphoreExW
DeleteCriticalSection
InitializeCriticalSectionEx
CreateEventW
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError
api-ms-win-core-file-l1-1-0
CreateFileW
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-com-l1-1-0
IIDFromString
StringFromGUID2
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-devices-config-l1-1-1
CM_Unregister_Notification
CM_Register_Notification
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
devobj
DevObjDestroyDeviceInfoList
DevObjEnumDeviceInterfaces
DevObjOpenDevRegKey
DevObjCreateDeviceInfoList
DevObjGetClassDevs
DevObjGetDeviceInstanceId
DevObjGetDeviceInterfaceDetail
VmbusPipeClientEnumeratePipes
VmbusPipeClientOpenChannel
VmbusPipeClientOpenChannelEx
VmbusPipeClientReadyForChannelNotification
VmbusPipeClientRegisterChannelNotification
VmbusPipeClientUnregisterChannelNotification
VmbusPipeClientWaitChannel
VmbusPipeServerConnectPipe
VmbusPipeServerOfferChannel
VmbusPipeServerOfferChannelEx
Name
.text
Size
32KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
192B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=33145,
count=45, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1138, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=22, id=261, version=33145,
count=1, id=256, version=33145,
count=5, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vmbuspiper.dll
- IMPHASH ff0ee98db84a765c65392708267eb3bb
- SHA256 1bc15027f897924b2b17ce6f59a3c3923532924e7e83b0042644ff54769bc7f9
- MD5 9981f5589d78074ab45e9790b88a0c8d
- SHA1 d69a343000fa0eafb322a4864f5d940f3776fe6f
- SHA512 e83d2b126fec1185629733d487e33629a0e2b921df49f8f9d6c29def6bd3eb23e7d3ed77b6ad08a55ae8dd8d7e02b674494b7202f263ed94b689f87f0596cba5
- SSDEEP 1536:csCHdP++uEUhCD3MqQnTbL+Ow7u2gPyGM1z2S:csCHMkxSHw7u2g6N1iS
- TLSH T134739E8D77A820D6E8B6817CC593C61AF1B175A157101AFF03A0C1BD2F63BE4A63CB59
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
00:cf:2e:fb:11:be:00:01:74:06:a2:71:1e:c8:65:87:d2:a2:49:36:9d:04:68:56:42:20:b6:b1:a9:f8:fc:31
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:F002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:20:24:e1:e6:e0:17:b9:b4:8e:00:01:00:00:02:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
5344
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vmbuspiper.pdb
api-ms-win-crt-string-l1-1-0
wcsncmp
memset
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__register_onexit_function
_o__seh_filter_dll
memcpy
_o_free
_o_malloc
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___stdio_common_vswprintf
wcsrchr
__std_terminate
__CxxFrameHandler4
ntdll
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlInitUnicodeString
RtlCaptureContext
NtOpenFile
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetProcAddress
DisableThreadLibraryCalls
GetModuleHandleW
GetModuleHandleExW
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegCloseKey
api-ms-win-core-synch-l1-1-0
WaitForSingleObjectEx
CreateEventW
ReleaseMutex
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
CreateMutexExW
OpenSemaphoreW
SetEvent
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError
api-ms-win-core-file-l1-1-0
CreateFileW
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-com-l1-1-0
IIDFromString
StringFromGUID2
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-devices-config-l1-1-1
CM_Unregister_Notification
CM_Register_Notification
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
devobj
DevObjDestroyDeviceInfoList
DevObjEnumDeviceInterfaces
DevObjOpenDevRegKey
DevObjCreateDeviceInfoList
DevObjGetClassDevs
DevObjGetDeviceInstanceId
DevObjGetDeviceInterfaceDetail
VmbusPipeClientEnumeratePipes
VmbusPipeClientOpenChannel
VmbusPipeClientOpenChannelEx
VmbusPipeClientWaitChannel
VmbusPipeServerConnectPipe
VmbusPipeServerOfferChannel
VmbusPipeServerOfferChannelEx
Name
.text
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
192B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=33145,
count=43, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1130, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=22, id=261, version=33145,
count=1, id=256, version=33145,
count=5, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vmbusvdev.dll
- IMPHASH c13012670aa97ffded73840863378947
- SHA256 a3c7e71fa1e9864babb60b218dfa2e0434fa4d545f08122dc9c90fa57213a408
- MD5 17e6d78f7b9d0807a61e3fd856776525
- SHA1 07de661f051a6135197550ac2e3e9438e364ea1e
- SHA512 1f355dfdd1e6c60159306b82948b552fcccaaa67d2fee3d6ba61f15aa48147c5ba86b1f5ed25fe31645f395360a0dfd7f81d769f94b352d3dc41e5aa5aa9064d
- SSDEEP 3072:OEJ1hC6SzD0aE0mwxq2rZTM7OcJazseBcnVJywDevhINerHN9duybIhFgI0:OIhIgaEptGM6cJ8seBoJyW1NmHN9duyf
- TLSH T135445B1E76A900F5F5778178CA92861AF2737825472193DF02E0827D4F2BBF8A93DB15
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
0b:2f:21:15:99:ed:1a:f9:59:66:b6:51:97:9a:6e:1e:3e:6c:de:8a:e8:35:57:87:7a:93:ec:9d:9e:3c:96:f0
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:521A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:17:71:fb:2e:a5:af:01:1d:ea:00:01:00:00:02:17
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
7936
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vmbusvdev.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
memmove
_o__wcsicmp
_o_ceilf
_o_free
_o_malloc
_o_terminate
_o_wcscpy_s
_o_wcstoll
_o_wcstoull
__CxxFrameHandler3
__current_exception
__current_exception_context
_CxxThrowException
_o__execute_onexit_table
_o__errno
_o__aligned_malloc
_o__aligned_free
__std_terminate
_o__crt_atexit
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o__configure_narrow_argv
_o___stdio_common_vswprintf
__C_specific_handler
_o___stdio_common_vsnwprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
__CxxFrameHandler4
_o___std_exception_copy
_o__cexit
memcmp
memcpy
_o__callnewh
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleHandleExW
GetModuleFileNameW
GetModuleFileNameA
GetModuleHandleW
api-ms-win-core-synch-l1-1-0
CreateEventExW
CreateSemaphoreExW
EnterCriticalSection
ReleaseSemaphore
LeaveCriticalSection
InitializeCriticalSectionEx
WaitForSingleObject
InitializeCriticalSection
ReleaseMutex
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseSRWLockShared
CreateMutexExW
CreateEventW
AcquireSRWLockShared
DeleteCriticalSection
InitializeSRWLock
ResetEvent
SetEvent
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegGetValueW
RegDeleteValueW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyExW
RegQueryInfoKeyW
api-ms-win-core-threadpool-l1-2-0
StartThreadpoolIo
WaitForThreadpoolIoCallbacks
SetThreadpoolThreadMaximum
CloseThreadpoolIo
CloseThreadpoolWork
SetThreadpoolTimer
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolWorkCallbacks
CreateThreadpoolWait
CancelThreadpoolIo
WaitForThreadpoolTimerCallbacks
CreateThreadpoolWork
SubmitThreadpoolWork
TrySubmitThreadpoolCallback
CreateThreadpoolTimer
CreateThreadpoolIo
CloseThreadpool
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
OpenProcessToken
GetCurrentProcess
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureStackBackTrace
RtlPcToFileHeader
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventUnregister
EventEnabled
EventSetInformation
EventWriteTransfer
EventWrite
api-ms-win-core-com-l1-1-0
StringFromCLSID
CoTaskMemFree
CoTaskMemAlloc
xmllite
CreateXmlReader
CreateXmlReaderInputWithEncodingName
oleaut32
SysFreeString
api-ms-win-core-synch-l1-2-0
SleepConditionVariableSRW
InitOnceComplete
InitOnceBeginInitialize
WakeByAddressAll
InitializeConditionVariable
WakeAllConditionVariable
api-ms-win-core-sysinfo-l1-1-0
GetVersionExW
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
api-ms-win-core-shlwapi-legacy-l1-1-0
PathIsUNCServerShareW
PathIsUNCServerW
mpr
WNetGetResourceInformationW
api-ms-win-core-file-l1-1-0
CreateFileW
GetFileAttributesW
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-security-base-l1-1-0
GetLengthSid
GetTokenInformation
CopySid
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
api-ms-win-core-io-l1-1-0
GetOverlappedResult
CancelIoEx
DeviceIoControl
ntdll
NtOpenFile
NtSetInformationFile
api-ms-win-core-psapi-l1-1-0
K32GetModuleInformation
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
136KB
Virtual Size
134KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
52KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
40KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=71, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1200, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=33, id=261, version=33145,
count=1, id=256, version=33145,
count=16, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vmchipset.dll
- IMPHASH 1f85a46e65dd305a8e6df0dbbbe8810c
- SHA256 44228ea9f2f94c7c5c22cbbf719d5d649b6120618f742dc48c53ded1dc3460c9
- MD5 0f7c89406f637665cdf699024c7e7496
- SHA1 2e2980d7bdc02e87153b36ac0bd657b87e6dd0a8
- SHA512 8b1d6ed5302bcb6c72bb0b0bbadbfa3139040db1f537402b3aef465ee20cbd8bcaca6cb25f426fe8b4d6973fcf4620e4b1b86ee03637b5f6a08a738b7f85ee34
- SSDEEP 12288:uFypg1QTz33e/kYL0DGbZ10ce59H/D1adVgDUItzE/quUXiobotvy4qkC:/pPTz+sYQDGfw55D1aSVtzUDGgvNqv
- TLSH T15B458D6A6BAD00E5D87FD0BCCDA3850AE5B238A5437197CF05A0426D0F6BFE4593E361
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
b0:9c:b2:9c:ee:08:73:cb:7f:a1:1f:f0:3d:b4:7a:d1:08:d7:64:4a:05:ac:3e:d7:a7:71:ee:b5:13:23:6a:34
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:4C1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:18:25:d9:92:05:e2:e7:e5:e4:00:01:00:00:02:18
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
158256
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vmchipset.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__malloc_base
_o__purecall
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
_o__wcsdup
_o__wcsicmp
_o__wcsnicmp
memmove
_o__wcstoui64
_o_abort
_o_calloc
_o_ceilf
_o_free
_o_isalnum
_o_iswascii
_o_iswspace
_o_malloc
_o_realloc
_o_setlocale
_o_strcpy_s
_o_terminate
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstod
_o_wcstoll
_o_wcstoul
_o_wcstoull
__CxxFrameHandler3
__current_exception
__current_exception_context
_CxxThrowException
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__calloc_base
_o__execute_onexit_table
_o__callnewh
_o__errno
wcsstr
__AdjustPointer
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o__free_base
_o___stdio_common_vsnwprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___pctype_func
strchr
_o____mb_cur_max_func
_o____lc_locale_name_func
_o____lc_collate_cp_func
_o____lc_codepage_func
__std_terminate
__C_specific_handler
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
wcsnlen
api-ms-win-core-libraryloader-l1-2-0
LoadResource
GetProcAddress
LockResource
GetModuleFileNameW
GetModuleHandleW
GetModuleHandleExW
SizeofResource
GetModuleFileNameA
LoadLibraryExW
LoadStringW
FreeLibrary
api-ms-win-core-synch-l1-1-0
ReleaseMutex
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
LeaveCriticalSection
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseSemaphore
CreateEventW
ReleaseSRWLockShared
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
InitializeCriticalSection
SetEvent
ResetEvent
CreateMutexExW
EnterCriticalSection
InitializeSRWLock
CreateEventExW
TryAcquireSRWLockExclusive
AcquireSRWLockShared
DeleteCriticalSection
CreateSemaphoreExW
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
HeapSize
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
api-ms-win-core-registry-l1-1-0
RegDeleteValueW
RegGetValueW
RegCloseKey
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegDeleteKeyExW
RegEnumKeyExW
RegOpenKeyExW
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolThreadMaximum
CloseThreadpool
CreateThreadpoolWork
SubmitThreadpoolWork
TrySubmitThreadpoolCallback
CreateThreadpoolIo
CloseThreadpoolIo
CloseThreadpoolTimer
CancelThreadpoolIo
SetThreadpoolWait
CloseThreadpoolWork
WaitForThreadpoolTimerCallbacks
WaitForThreadpoolWaitCallbacks
CreateThreadpoolTimer
WaitForThreadpoolWorkCallbacks
SetThreadpoolTimer
StartThreadpoolIo
CloseThreadpoolWait
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
RtlCaptureStackBackTrace
RtlPcToFileHeader
api-ms-win-core-localization-l1-2-0
LCMapStringEx
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-string-l1-1-0
GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte
CompareStringEx
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventUnregister
EventActivityIdControl
EventSetInformation
EventRegister
EventWrite
EventEnabled
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
WaitOnAddress
WakeByAddressAll
Sleep
SleepConditionVariableSRW
WakeAllConditionVariable
SleepConditionVariableCS
WakeConditionVariable
InitializeConditionVariable
api-ms-win-core-psapi-l1-1-0
K32GetModuleInformation
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-sysinfo-l1-1-0
GetTickCount64
GetLocalTime
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
GetVersionExW
GetSystemDirectoryW
api-ms-win-core-com-l1-1-0
StringFromCLSID
CoTaskMemFree
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
CoCreateInstance
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
InterlockedFlushSList
api-ms-win-core-processthreads-l1-1-1
GetCurrentProcessorNumberEx
IsProcessorFeaturePresent
vmprox
SetVmErrInfo
api-ms-win-crt-locale-l1-1-0
_unlock_locales
_lock_locales
ntdll
RtlDosPathNameToNtPathName_U_WithStatus
NtQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlFreeUnicodeString
RtlAllocateHeap
NtCreateFile
RtlInitUnicodeStringEx
RtlFreeHeap
RtlNtStatusToDosError
RtlUnsubscribeWnfStateChangeNotification
xmllite
CreateXmlReader
CreateXmlWriterOutputWithEncodingName
CreateXmlReaderInputWithEncodingName
CreateXmlWriter
oleaut32
SetErrorInfo
SysFreeString
SysStringLen
SysAllocString
api-ms-win-core-heap-l2-1-0
LocalReAlloc
LocalFree
LocalAlloc
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
FileTimeToSystemTime
GetTimeZoneInformation
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
api-ms-win-core-shlwapi-legacy-l1-1-0
PathIsUNCServerShareW
PathSkipRootW
PathIsUNCServerW
PathIsRelativeW
mpr
WNetGetResourceInformationW
api-ms-win-core-file-l1-1-0
ReadFile
CreateFileW
GetFinalPathNameByHandleW
CreateDirectoryW
GetFileInformationByHandle
DeleteFileW
GetFileSizeEx
GetFileAttributesW
api-ms-win-core-memory-l1-1-0
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
rpcrt4
RpcEpResolveBinding
UuidFromStringW
RpcMgmtInqIfIds
RpcBindingSetAuthInfoExW
RpcBindingFree
UuidCreate
NdrClientCall3
UuidCompare
RpcStringBindingComposeW
RpcBindingSetOption
RpcBindingFromStringBindingW
RpcStringFreeW
RpcIfIdVectorFree
bcrypt
BCryptGenRandom
api-ms-win-core-sysinfo-l1-2-0
GetSystemFirmwareTable
GetSystemTimePreciseAsFileTime
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-io-l1-1-0
CancelIoEx
GetOverlappedResult
DeviceIoControl
api-ms-win-core-version-l1-1-1
GetFileVersionInfoSizeW
GetFileVersionInfoW
api-ms-win-core-version-l1-1-0
VerQueryValueW
api-ms-win-core-libraryloader-l1-2-1
FindResourceW
api-ms-win-core-path-l1-1-0
PathCchRemoveFileSpec
PathCchAddBackslash
PathCchCombineEx
api-ms-win-core-perfcounters-l1-1-0
PerfSetCounterRefValue
PerfStopProvider
PerfCreateInstance
PerfStartProvider
PerfSetCounterSetInfo
PerfDeleteInstance
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
720KB
Virtual Size
716KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
288KB
Virtual Size
285KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
48KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
48KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
280B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=97, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1343, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=32, id=261, version=33145,
count=1, id=256, version=33145,
count=122, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vmcompute.dll
- IMPHASH 8c1fa2a40c3512120c08f325789c38df
- SHA256 405dd9cce950250edd9f2612983949df3adb974bab067b931c060033879050ce
- MD5 5fd34841d5f3d5dfba54d51115e213ae
- SHA1 eba6c83a966f28e608e5ba8fb8d2837fc49df4cd
- SHA512 3d46f9b75e30b6ac424d2ee74d97fc2bef3de023087ceaad618ba1f1085faed7d471bd3949f85c5e570537feb31c3ad3a49d0ba6295c57aedd57f7fb9f85ad11
- SSDEEP 12288:EEjRbncAjG4PlH2Al+W0IDlNrK8WC2e6O3/eEVCCvSbIdmEj:3R4AJF3wW0IhNVWC2e6CWEVCtbIdZ
- TLSH T1E1057D2D66AC01E5E0BAC279DA538A16FAB27461033297CF1250C27D5F1FFE45A3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
82:ea:e8:91:b6:d7:0f:c2:66:76:ab:db:2a:ff:f7:62:9e:a3:b0:7d:86:ee:e8:0c:2f:d6:9f:67:58:d2:64:a6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9600-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:26:35:b4:3e:67:43:93:f6:1f:00:01:00:00:02:26
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
12384
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vmcompute.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__purecall
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
_o__ultow_s
_o__wcsicmp
_o__wcsnicmp
_o__wcstoi64
_o__wcstoui64
_o__wcsupr
memmove
_o_abort
_o_calloc
_o_ceilf
_o_free
_o_iswspace
_o_malloc
_o_strcpy_s
_o_terminate
_o_towupper
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstod
_o_wcstoul
__CxxFrameHandler3
__current_exception
__current_exception_context
_CxxThrowException
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__crt_atexit
_o__aligned_malloc
wcsstr
wcsrchr
_o__aligned_free
_o__configure_narrow_argv
wcschr
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o__execute_onexit_table
_o__errno
_o__invalid_parameter_noinfo_noreturn
__AdjustPointer
_o___stdio_common_vsnwprintf_s
_o__invalid_parameter_noinfo
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__cexit
_o__callnewh
__std_terminate
__C_specific_handler
__CxxFrameHandler4
memchr
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
strcmp
strncmp
wcsnlen
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
GetModuleFileNameA
GetProcAddress
GetModuleFileNameW
GetModuleHandleW
FreeLibrary
GetModuleHandleExA
GetModuleHandleExW
api-ms-win-core-synch-l1-1-0
ReleaseSemaphore
LeaveCriticalSection
InitializeCriticalSectionEx
WaitForSingleObject
ReleaseMutex
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WaitForSingleObjectEx
EnterCriticalSection
OpenSemaphoreW
ReleaseSRWLockShared
CreateMutexExW
AcquireSRWLockShared
ResetEvent
CreateEventW
DeleteCriticalSection
CreateSemaphoreExW
CreateEventExW
SetEvent
InitializeSRWLock
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
api-ms-win-core-synch-l1-2-0
WakeAllConditionVariable
InitOnceBeginInitialize
WaitOnAddress
InitializeConditionVariable
WakeConditionVariable
InitOnceComplete
SleepConditionVariableSRW
WakeByAddressAll
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
RaiseException
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
SetLastError
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
TlsSetValue
TlsFree
TlsGetValue
TlsAlloc
GetCurrentThread
OpenThreadToken
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureStackBackTrace
RtlPcToFileHeader
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventWriteTransfer
EventUnregister
EventWriteEx
EventEnabled
EventSetInformation
EventActivityIdControl
EventWrite
api-ms-win-core-registry-l1-1-0
RegDeleteValueW
RegOpenKeyExW
RegGetValueW
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegSetValueExW
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolWaitCallbacks
WaitForThreadpoolTimerCallbacks
SetThreadpoolWait
FreeLibraryWhenCallbackReturns
CloseThreadpoolWait
SetThreadpoolTimer
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
CreateThreadpoolWait
CloseThreadpoolTimer
CreateThreadpoolTimer
CallbackMayRunLong
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-psapi-l1-1-0
K32GetModuleInformation
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-sysinfo-l1-1-0
GetTickCount64
GetSystemTimeAsFileTime
GetTickCount
GetVersionExW
GetSystemInfo
api-ms-win-core-com-l1-1-0
CoDisableCallCancellation
CoCancelCall
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc
CoEnableCallCancellation
CoGetObjectContext
CoCreateInstance
CoInitializeEx
rpcrt4
RpcExceptionFilter
UuidCreate
NdrClientCall3
RpcBindingCreateW
RpcBindingBind
UuidFromStringW
RpcBindingFree
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
api-ms-win-core-file-l1-1-0
SetFileAttributesW
FindFirstFileW
FindNextFileW
FindClose
GetVolumePathNameW
ReadFile
GetFileSizeEx
WriteFile
DeleteFileW
CreateFileW
CreateDirectoryW
FindVolumeClose
FindNextVolumeW
GetFileAttributesW
FlushFileBuffers
FindFirstVolumeW
GetFinalPathNameByHandleW
SetEndOfFile
SetFilePointerEx
api-ms-win-core-windowserrorreporting-l1-1-1
WerRegisterCustomMetadata
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-shlwapi-legacy-l1-1-0
PathIsRelativeW
PathFileExistsW
PathIsUNCServerW
PathSkipRootW
PathIsUNCServerShareW
ws2_32
closesocket
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-security-base-l1-1-0
SetPrivateObjectSecurityEx
AddAccessAllowedAce
IsValidSid
GetSecurityDescriptorDacl
GetSidSubAuthority
GetSidLengthRequired
SetSecurityDescriptorOwner
InitializeSid
GetLengthSid
CreateWellKnownSid
CopySid
CheckTokenMembership
SetSecurityDescriptorDacl
IsValidSecurityDescriptor
CreatePrivateObjectSecurityWithMultipleInheritance
GetAce
GetSecurityDescriptorControl
InitializeAcl
AdjustTokenPrivileges
RevertToSelf
InitializeSecurityDescriptor
MakeSelfRelativeSD
SetSecurityDescriptorGroup
GetSecurityDescriptorLength
DestroyPrivateObjectSecurity
ImpersonateSelf
api-ms-win-core-path-l1-1-0
PathCchCombineEx
PathCchFindExtension
PathCchRemoveFileSpec
PathCchAddBackslash
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-core-file-l2-1-0
CreateHardLinkW
CopyFile2
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
kernelbase
LocalAlloc
GetVolumeNameForVolumeMountPointW
Sleep
ntdll
ZwDeviceIoControlFile
ZwQueryDirectoryObject
ZwOpenSymbolicLinkObject
ZwOpenDirectoryObject
RtlLengthSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlSetDaclSecurityDescriptor
ZwCreateKey
ZwLoadKey
RtlAddAccessAllowedAceEx
RtlAllocateAndInitializeSid
RtlLengthSid
ZwDeleteValueKey
RtlFreeSid
ZwDeleteKey
ZwEnumerateKey
ZwQueryValueKey
RtlCreateAcl
ZwSetSecurityObject
ZwUnloadKey
RtlCreateSecurityDescriptor
ZwSetValueKey
ZwOpenKey
RtlFreeHeap
NtQueryVolumeInformationFile
LdrGetDllHandle
ZwOpenFile
RtlInitAnsiString
ZwQuerySystemInformation
NtAdjustPrivilegesToken
NtOpenProcessTokenEx
NtSetInformationThread
NtOpenThreadTokenEx
NtClose
RtlImpersonateSelf
ZwReleaseMutant
NtDeviceIoControlFile
NtOpenFile
ZwQueryKey
ZwWaitForSingleObject
ZwQueryAttributesFile
RtlStringFromGUID
RtlAppendUnicodeToString
RtlUpcaseUnicodeChar
RtlAllocateHeap
RtlRunOnceComplete
RtlGUIDFromString
ZwQuerySymbolicLinkObject
RtlRunOnceBeginInitialize
ZwClose
ZwOpenMutant
RtlInitUnicodeString
NtOpenJobObject
RtlNtStatusToDosError
RtlDosPathNameToNtPathName_U_WithStatus
RtlFreeUnicodeString
NtQueryEaFile
NtSetCachedSigningLevel2
RtlFindNextForwardRunClear
RtlNumberOfSetBits
RtlInitializeSRWLock
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
NtSetEaFile
RtlReleaseRelativeName
NtWaitForSingleObject
RtlDosPathNameToRelativeNtPathName_U_WithStatus
LdrGetProcedureAddress
NtCreateFile
api-ms-win-core-winrt-l1-1-0
RoUninitialize
RoInitialize
api-ms-win-devices-config-l1-1-1
CM_Unregister_Notification
CM_MapCrToWin32Err
CM_Register_Notification
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
api-ms-win-core-featurestaging-l1-1-0
SubscribeFeatureStateChangeNotification
RecordFeatureUsage
UnsubscribeFeatureStateChangeNotification
GetFeatureEnabledState
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
combase
ord139
api-ms-win-core-memory-l1-1-0
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
ActivateLayer
ApplyRegistryChangesToLayer
ComputeSystemExists
CreateBaseImageVHD
CreateBaseImageVHDWithFolders
CreateComputeSystem
CreateDifferencingVHD
CreateLayer
CreateProcessInComputeSystem
CreateProcessWithStdHandlesInComputeSystem
CreateSandboxLayer
DeactivateLayer
DestroyLayer
DismountVhdByHandle
EnumerateComputeSystems
ExpandSandboxSize
ExportLayer
GetComputeSystemProperties
GetHostProperties
GetLayerMountPath
GrantVmAccess
GrantVmGroupAccess
HNSCall
HcsAddComputeSystemResource
HcsCloseComputeSystem
HcsCloseProcess
HcsCrashComputeSystem
HcsCreateComputeSystem
HcsCreateProcess
HcsEnumerateComputeSystems
HcsEnumerateVmWorkerProcesses
HcsFindVmWorkerProcesses
HcsGetComputeSystemProperties
HcsGetProcessInfo
HcsGetProcessProperties
HcsGetServiceProperties
HcsGetWorkerProcessJob
HcsModifyComputeSystem
HcsModifyComputeSystemResource
HcsModifyComputeSystemWithUserToken
HcsModifyProcess
HcsModifyServiceSettings
HcsOpenComputeSystem
HcsOpenProcess
HcsPauseComputeSystem
HcsRegisterComputeSystemCallback
HcsRegisterProcessCallback
HcsRemoveComputeSystemResource
HcsResumeComputeSystem
HcsSaveComputeSystem
HcsShutdownComputeSystem
HcsSignalProcess
HcsStartComputeSystem
HcsStartVmWorkerProcess
HcsSubmitWerReport
HcsTerminateComputeSystem
HcsTerminateProcess
HcsUnregisterComputeSystemCallback
HcsUnregisterProcessCallback
ImportLayer
LayerExists
ModifyComputeSystemResource
MountVhdForSetup
NameToGuid
PrepareLayer
PrepareLayerEx
ProcessBaseImage
ProcessHostImage
ProcessImage
ProcessImageEx
ProcessUtilityHostImage
ProcessUtilityImage
ResizeConsoleInComputeSystem
RevokeVmAccess
ShutdownComputeSystem
StartComputeSystem
TerminateComputeSystem
TerminateProcessInComputeSystem
UnprepareLayer
UnprepareLayerEx
WaitForProcessInComputeSystem
Name
.text
Size
536KB
Virtual Size
532KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
PAGE
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
PAGECMRC
Size
4KB
Virtual Size
130B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
184KB
Virtual Size
180KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
28KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
376B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=33145,
count=109, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1541, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=32, id=261, version=33145,
count=8, id=259, version=33145,
count=1, id=256, version=33145,
count=159, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vmcomputeeventlog.dll
- SHA256 7b295d45e5965d44e9b624c676d6b7296fa020e366a06da238056cfbc10dee2d
- MD5 23e363ca60fffa08da5dcec531bf266a
- SHA1 45d8d79f553f9fdf3f1a73659af29ad8b8bcecfb
- SHA512 9222636f35611ac2471aa1106e96f1bec5985be4d2c19ace410301b085ab1adf3b52176fcfe16f8cb35eb64e464bbc06a6dd0e2036c879747f34ebb48efc198b
- SSDEEP 768:0BChB4optgOkK37hNunqCxwE//Uc4NJ4JmWFH1PsULi9zppP:0NVPs1z/
- TLSH T17523200057FD8205F8B74F785ABBEB923A767A595D10C68E2270E75C1C79380DF2236A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c7:b1:3c:c3:f1:1b:cf:10:59:1a:3b:44:5b:48:c7:ee:f8:fd:6a:e7:17:be:b3:a3:2a:6f:81:2e:12:75:e9:5e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 28, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:19:da:dd:aa:8b:dc:44:b2:92:00:00:00:00:05:19
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 19, 2025 - Jun 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:F002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:20:24:e1:e6:e0:17:b9:b4:8e:00:01:00:00:02:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
4KB
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
28KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vmdevicehost.dll
- IMPHASH 8f2af915f2a956495688a9a2912fa76c
- SHA256 b8e219cbc02b0a72c014c04f14ca690a3a34faee06d706c5aa661b618c144769
- MD5 212d380de1709113d0d9f9daaffe8966
- SHA1 602830654a5b8d26e49dd0f85054b7baec8121b8
- SHA512 297e1571bd94debcd5224b9f6ce6d51cccc0045e132aa38db69b86159a459ea2cdc50c407a7f25b714adfa80e3ae60ac3d159c6652ab6a48554b082e44af307b
- SSDEEP 6144:byjX3JOmmCNLgp2+vk4Fq+1AXZgKZvxc1:bKX3JOVae2+mpgK4
- TLSH T1A6444A2E76AC04B5EDB79178D9574606E2B274240362D3CF02E0827D5F2BBF8693EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
8064
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
VmDeviceHost.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_abort
_o_free
_o_malloc
_o_terminate
_o_wcstod
_o_wcstoull
__CxxFrameHandler3
__current_exception
__current_exception_context
_CxxThrowException
_o__crt_atexit
_o__configure_narrow_argv
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o__cexit
_o___std_exception_copy
_o__callnewh
_o__beginthreadex
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
__std_terminate
__C_specific_handler
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleFileNameA
GetProcAddress
GetModuleFileNameW
GetModuleHandleExW
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
DeleteCriticalSection
CreateMutexExW
WaitForSingleObjectEx
AcquireSRWLockExclusive
AcquireSRWLockShared
ReleaseSemaphore
ReleaseSRWLockExclusive
SetEvent
ReleaseSRWLockShared
ReleaseMutex
CreateSemaphoreExW
ResetEvent
WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection
InitializeSRWLock
OpenSemaphoreW
api-ms-win-core-synch-l1-2-0
SleepConditionVariableSRW
InitOnceComplete
WakeAllConditionVariable
SignalObjectAndWait
InitOnceBeginInitialize
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
OpenProcessToken
GetCurrentProcess
GetCurrentThreadId
TerminateProcess
api-ms-win-core-rtlsupport-l1-1-0
RtlPcToFileHeader
RtlCaptureStackBackTrace
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-eventing-provider-l1-1-0
EventWrite
EventWriteTransfer
EventEnabled
EventSetInformation
EventRegister
EventUnregister
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegOpenKeyExW
RegGetValueW
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-psapi-l1-1-0
K32GetModuleInformation
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-com-l1-1-0
CoUninitialize
CoInitializeSecurity
CoDisableCallCancellation
CoTaskMemFree
CoEnableCallCancellation
CoCancelCall
CoInitializeEx
rpcrt4
UuidCompare
oleaut32
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayUnaccessData
api-ms-win-security-base-l1-1-0
CopySid
GetLengthSid
MakeAbsoluteSD
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
GetTokenInformation
InitializeSid
GetSecurityDescriptorControl
GetSidLengthRequired
GetSidSubAuthority
SetSecurityDescriptorOwner
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
api-ms-win-security-provider-l1-1-0
GetSecurityInfo
SetEntriesInAclW
SetSecurityInfo
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-security-sddl-l1-1-0
ConvertStringSidToSidW
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-memory-l1-1-0
UnmapViewOfFile
MapViewOfFile
VirtualQuery
HdvCreateDeviceInstance
HdvCreateGuestMemoryAperture
HdvCreateSectionBackedMmioRange
HdvDeliverGuestInterrupt
HdvDestroyGuestMemoryAperture
HdvDestroySectionBackedMmioRange
HdvInitializeDeviceHost
HdvInitializeDeviceHostEx
HdvInitializeDeviceHostForProxy
HdvInitializeDeviceHostForProxyEx
HdvProxyDeviceHost
HdvReadGuestMemory
HdvRegisterDoorbell
HdvRegisterDoorbellPage
HdvTeardownDeviceHost
HdvUnregisterDoorbell
HdvUnregisterDoorbellPage
HdvWriteGuestMemory
Name
.text
Size
136KB
Virtual Size
135KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
40KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
80B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=73, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1204, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=24, id=261, version=33145,
count=1, id=256, version=33145,
count=22, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vmdynmem.dll
- IMPHASH 45fd0c6d7b8990b4ecccb589f8079fc1
- SHA256 e51bf939a8900881ead611565efc43f28527d3b21b7b431eec82429bd932c52b
- MD5 716492227e7a523fa484cf14546b37e3
- SHA1 4309a4a23f2adf58082a3a7a4d532b2c18ad82ea
- SHA512 3214907a58e1079549d16ba0b57a38f7371daed6621b6c51fd0529af6836494025d9a1f3b9fc6c264b699335ea2b672d7fb789219a3a3e692e9efe1cc2803d5c
- SSDEEP 6144:YepOTNPJhfnAvT0BAu0YaFRwQQKceyuwnSTtXRz:qTNPJlny0Ou0VrXziq
- TLSH T15C843C29A6ED04E4F177D17C89A78905FAB27820472196CF1190C27D2F2BFE4AD3DB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
84:f8:f2:0c:2c:af:3f:b4:77:89:2d:2d:a2:7c:d1:da:72:d2:af:5e:1c:f6:3c:91:ca:a8:c7:62:bb:08:57:01
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:431A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1d:4b:c0:92:87:38:85:7e:39:00:01:00:00:02:1d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
10704
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vmdynmem.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
_o__wcsicmp
_o_abort
_o_calloc
_o_ceilf
_o_free
_o_malloc
_o_terminate
_o_wcscpy_s
_o_wcstod
_o_wcstoull
__current_exception
__AdjustPointer
__CxxFrameHandler3
__current_exception_context
_CxxThrowException
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__C_specific_handler
__CxxFrameHandler4
memcmp
memcpy
memmove
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetProcAddress
GetModuleHandleExW
GetModuleFileNameA
GetModuleFileNameW
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
InitializeCriticalSection
ReleaseMutex
EnterCriticalSection
SetEvent
ReleaseSRWLockExclusive
ResetEvent
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
CreateSemaphoreExW
InitializeSRWLock
ReleaseSemaphore
InitializeCriticalSectionEx
ReleaseSRWLockShared
AcquireSRWLockExclusive
WaitForSingleObject
OpenSemaphoreW
WaitForSingleObjectEx
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
SleepConditionVariableCS
WaitOnAddress
InitOnceComplete
WakeByAddressAll
SleepConditionVariableSRW
InitializeConditionVariable
WakeAllConditionVariable
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetLastError
RaiseException
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureStackBackTrace
RtlPcToFileHeader
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-eventing-provider-l1-1-0
EventActivityIdControl
EventWrite
EventWriteTransfer
EventRegister
EventSetInformation
EventEnabled
EventUnregister
api-ms-win-core-registry-l1-1-0
RegQueryInfoKeyW
RegSetValueExW
RegGetValueW
RegDeleteKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryValueExW
RegCreateKeyExW
RegDeleteValueW
RegCloseKey
api-ms-win-core-threadpool-l1-2-0
TrySubmitThreadpoolCallback
CloseThreadpool
CloseThreadpoolWork
CancelThreadpoolIo
StartThreadpoolIo
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
SetThreadpoolThreadMaximum
WaitForThreadpoolWorkCallbacks
CreateThreadpoolTimer
CloseThreadpoolIo
CloseThreadpoolTimer
SubmitThreadpoolWork
CreateThreadpoolIo
CreateThreadpoolWork
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-psapi-l1-1-0
K32GetModuleInformation
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
GetVersionExW
GetTickCount64
xmllite
CreateXmlReaderInputWithEncodingName
CreateXmlReader
api-ms-win-core-com-l1-1-0
StringFromCLSID
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
mpr
WNetGetResourceInformationW
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-file-l1-1-0
GetFileAttributesW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
oleaut32
SysFreeString
api-ms-win-core-shlwapi-legacy-l1-1-0
PathIsUNCServerShareW
PathIsUNCServerW
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
GetCurrentProcessorNumberEx
vmprox
SetVmErrInfo
ntdll
NtQuerySection
NtOpenSection
RtlNtStatusToDosError
RtlInitUnicodeString
api-ms-win-core-perfcounters-l1-1-0
PerfSetCounterSetInfo
PerfDeleteInstance
PerfCreateInstance
PerfStopProvider
PerfSetCounterRefValue
PerfStartProvider
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
216KB
Virtual Size
213KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
80KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=71, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1218, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=31, id=261, version=33145,
count=1, id=256, version=33145,
count=26, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vmfirmware.dll
- SHA256 4fe86e4b71d814f2d679d32bfc813b9b2600a4f1cbfe67c3feb6689e681a53f6
- MD5 57d7d2e2db40e5dd426197c0dbe2eccf
- SHA1 4c23c46d4b98ca8a9ab6c1d35194f018d8b71b02
- SHA512 7394c64a139f10fa5b80ee75b4c7b7757fffb2561bcae5d53584597f846cc50a5c57fa56c479a84a4f032fe30208d7e05a6316ee92beffbf288d507bc74b42f3
- SSDEEP 49152:Q8S4cKxowou4omcvQeUbZrKpBEOTSNgQExEkB/5FiRH7SNbTMHC:vSFXwyc3Eg/aRbSZl
- TLSH T10E56F65661D4C068E01682B2C891C6F6E2F07D5AE721EB8B13E17ED77BB3670252F391
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
7b:63:09:2b:d6:7b:c8:d0:b5:4c:01:3d:84:43:cb:2c:75:06:19:53:f7:e1:c2:4d:b2:4b:58:76:09:d4:8f:85
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 8, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:19:da:dd:aa:8b:dc:44:b2:92:00:00:00:00:05:19
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 19, 2025 - Jun 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:09:08:07:e0:f9:5c:8c:e6:55:00:01:00:00:02:09
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
4KB
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6.1MB
Virtual Size
6.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vmfirmwarehcl.dll
- SHA256 cde5863f2466e6339d415f19f460e150d3dc119256dd1dc6f20be637eb9e91bf
- MD5 76d57d212b4ab0f4d0dd3c9ed8676490
- SHA1 d3316687cf1fa548d9a31099f7a4323ac02f3cc3
- SHA512 6f6bd1757c92ac2c4cbf20ff9b3b7ca0ab950356c7df661941ba0b44254c3c2ad61f048d534093b1124a64515a173705c75b42a972a1343945e36ac3a7d9e74e
- SSDEEP 196608:JSdw4iaRbSbK/UfSdw4iaRbS1Sdw4iaRbSBf/UySdw4iaRbSPoSdw4iaRbSnR/Uy:JSdErSdE7SdEzSdExoSdEL
- TLSH T16C87181262D4C469E4168272C995C6B6F2F07D59E720DBCB13E07ED77BB36B0292E390
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
1c:87:8b:01:80:19:c7:c7:ab:85:86:69:1a:18:4b:63:6a:c3:65:b6:1b:b2:09:1e:31:12:57:10:65:97:9e:47
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8603-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:25:80:c7:37:c6:cd:aa:77:49:00:01:00:00:02:25
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
4KB
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
34.5MB
Virtual Size
34.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vmflexio.dll
- IMPHASH d6ee4c1d67b6c43cd1ef08fb1da6d557
- SHA256 8d40de3cbf7f1510a01742e2a402bc7107afd0cbbc28bd2edb33d6b29fad1969
- MD5 d243765be6aaeed94163140168c1dc95
- SHA1 af5959566944e8dcf9f4ca6836ec5c4ebdb53905
- SHA512 9e8b0dfe41b4328aab433579efcd06b48281b9153a01c6caa267c6bd36f789bcb7c25e141455414a579aa931ed280e96661e71617a00451ea93b183cc3dbfa41
- SSDEEP 12288:Ykbuweunv1qdXVy3EYgzu71byZcSooUjce+rrZ533JDKoOKb+LGXBhNo/d1Euyf2:VKCv1ulsEYgzu70ZcSooUjce+rrZ533i
- TLSH T11AD44A3DF6A802D5D43AD17D8A538926F9723415033566DB2990C3BD1FAFBE46B3EA00
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
24:3f:15:f7:72:06:0c:37:b7:b6:ec:7c:1d:da:e7:38:23:06:09:46:5c:cb:03:48:b8:db:d5:5f:34:2a:f9:8f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3303-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:21:33:c0:35:fb:d2:0f:21:a4:00:01:00:00:02:21
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
18064
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vmflexio.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
_o_abort
_o_calloc
_o_free
_o_iswspace
_o_malloc
_o_terminate
_o_wcscpy_s
_o_wcstod
_o_wcstoll
_o_wcstoull
__current_exception
__AdjustPointer
__CxxFrameHandler3
__current_exception_context
_CxxThrowException
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__C_specific_handler
__CxxFrameHandler4
memcmp
memcpy
memmove
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameW
GetModuleFileNameA
GetModuleHandleExW
GetProcAddress
GetModuleHandleW
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
ReleaseSRWLockShared
CreateEventW
InitializeSRWLock
TryAcquireSRWLockShared
EnterCriticalSection
OpenSemaphoreW
ReleaseSemaphore
WaitForSingleObjectEx
AcquireSRWLockExclusive
ResetEvent
ReleaseMutex
LeaveCriticalSection
SetEvent
CreateSemaphoreExW
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
CreateEventExW
WaitForSingleObject
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegDeleteKeyExW
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolWait
CreateThreadpoolWork
SubmitThreadpoolWork
CallbackMayRunLong
WaitForThreadpoolWorkCallbacks
CloseThreadpoolWork
FreeLibraryWhenCallbackReturns
WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlCaptureContext
RtlCaptureStackBackTrace
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-com-l1-1-0
CoGetObjectContext
StringFromCLSID
CoCreateFreeThreadedMarshaler
CoDisableCallCancellation
CoEnableCallCancellation
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoCancelCall
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventWrite
EventEnabled
EventActivityIdControl
EventRegister
EventSetInformation
EventUnregister
xmllite
CreateXmlReader
CreateXmlReaderInputWithEncodingName
oleaut32
VariantClear
SysAllocString
SysStringLen
VariantInit
SysFreeString
SafeArrayPtrOfIndex
SetErrorInfo
SafeArrayCreateVectorEx
VariantCopy
SysStringByteLen
SafeArrayPutElement
SafeArrayUnaccessData
VariantChangeTypeEx
SafeArrayAccessData
SafeArrayRedim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetVartype
SafeArrayDestroy
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-synch-l1-2-0
InitOnceComplete
SleepConditionVariableSRW
WakeAllConditionVariable
InitOnceBeginInitialize
api-ms-win-core-file-l1-1-0
CreateFileW
api-ms-win-core-psapi-l1-1-0
K32GetModuleInformation
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-2-0
GetSystemTimePreciseAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
vmprox
GetVmErrInfo
SetVmErrInfo
ntdll
RtlCompressBuffer
RtlGetCompressionWorkSpaceSize
RtlDecompressBufferEx
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
376KB
Virtual Size
375KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
144KB
Virtual Size
143KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=63, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1220, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=30, id=261, version=33145,
count=7, id=259, version=33145,
count=1, id=256, version=33145,
count=23, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vmhbmgmt.dll
- IMPHASH 9fd9822ea7d17ef591b920e5db602f8a
- SHA256 8870647006eccc63339949741e5ef1f4375ce85f4b17db2482e4ded1381485b8
- MD5 1313e0785ac48dbb0d0dc6b6a1952cdf
- SHA1 902f177a3a1d5681a0c0929783901dbecc6b15a3
- SHA512 b4dbddab4ffddb5f9433a37b0d513b67cb3e25df666e7f6352636d6a513738b47d5ec7a4f2819377c81a6229340ed00dbee0bf6aaaf6bdaef226c7f70d509dab
- SSDEEP 1536:w8xyeKSPHxhSP8xROUf9S6fYMBnyE3kKpLEWS7msj/l2sfct2TgIbzx2kIyK9frP:w8AoRA8pBw2yi2PmA/ib
- TLSH T123D32A2A776C10E9D539907C88438E1EE3B1B4614B1257DF269083AF0FA7FE46D3AB54
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
8304
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vmhbmgmt.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o_free
_o_malloc
__CxxFrameHandler3
_CxxThrowException
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__C_specific_handler
__CxxFrameHandler4
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleHandleExW
GetModuleHandleW
DisableThreadLibraryCalls
GetModuleFileNameA
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceExecuteOnce
InitOnceComplete
api-ms-win-core-synch-l1-1-0
WaitForSingleObject
CreateMutexExW
ReleaseMutex
AcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSemaphore
ReleaseSRWLockExclusive
WaitForSingleObjectEx
CreateSemaphoreExW
AcquireSRWLockShared
OpenSemaphoreW
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
api-ms-win-core-winrt-string-l1-1-0
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsGetStringRawBuffer
api-ms-win-core-com-l1-1-0
CoRevertToSelf
CoCreateFreeThreadedMarshaler
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-processthreads-l1-1-0
OpenProcessToken
GetCurrentThreadId
GetCurrentProcess
OpenThreadToken
GetCurrentThread
GetCurrentProcessId
TerminateProcess
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
RoOriginateError
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-eventing-provider-l1-1-0
EventActivityIdControl
EventRegister
EventUnregister
EventSetInformation
EventWriteTransfer
rpcrt4
UuidCompare
api-ms-win-security-base-l1-1-0
DuplicateTokenEx
AccessCheck
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-core-heap-l2-1-0
LocalFree
combase
ord168
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
64KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
36KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
744B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=57, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1145, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=23, id=261, version=33145,
count=1, id=256, version=33145,
count=7, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vmiccore.dll
- IMPHASH 84d8b89e24a2a33cf4351ad1d2f018e4
- SHA256 4cd5c98e21887a1e1cf672dee5b5e58a048625930d5e158d12bf8dca3105862e
- MD5 bacb919b226ad256d8c013ebce6a7463
- SHA1 531a674ac8498d73d16c5728758afe164be34f2b
- SHA512 8cf6f543dde30e238834e5baf7eeadc96f23f67689eb8a30d46406f93863f3a4346d40e54735724ac83b129445e4fa5fa2b733091dd6606d12a2afa11ff4d798
- SSDEEP 6144:TLwgXew3eDfYFaKgUCGdhEN+hkEzJk2IAAA7:QgXewmfnUCwNhzCA
- TLSH T16B843A2E76E808A4F97791B889638605F7B378610731E2CF11A0827D6F2BFE4593DB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
04:4d:d4:b8:e3:a9:c0:cd:da:9a:5b:91:3d:9d:18:1d:d4:21:35:72:e0:f4:ea:a9:e2:e3:f5:b1:5b:75:7f:ad
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:F002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:20:24:e1:e6:e0:17:b9:b4:8e:00:01:00:00:02:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
8944
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vmiccore.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
_o___std_exception_destroy
memmove
_o_abort
_o_free
_o_malloc
_o_terminate
_o_wcscpy_s
_o_wcstod
_o_wcstoull
__CxxFrameHandler3
__current_exception
__current_exception_context
_CxxThrowException
_o___std_exception_copy
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o__beginthreadex
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
__std_terminate
__C_specific_handler
__CxxFrameHandler4
_o___std_type_info_name
memcmp
_o___std_type_info_destroy_list
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleFileNameA
GetModuleHandleExW
FreeLibrary
GetProcAddress
GetModuleFileNameW
api-ms-win-core-synch-l1-1-0
CreateMutexExW
ResetEvent
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
InitializeSRWLock
CreateSemaphoreExW
ReleaseSRWLockExclusive
DeleteCriticalSection
ReleaseMutex
SetEvent
InitializeCriticalSection
WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
ReleaseSemaphore
CreateEventW
AcquireSRWLockShared
api-ms-win-core-synch-l1-2-0
InitOnceComplete
WakeAllConditionVariable
InitOnceBeginInitialize
SleepConditionVariableSRW
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureStackBackTrace
RtlPcToFileHeader
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventWrite
EventActivityIdControl
EventRegister
EventSetInformation
EventEnabled
EventWriteTransfer
api-ms-win-core-registry-l1-1-0
RegDeleteKeyExW
RegGetValueW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-psapi-l1-1-0
K32GetModuleInformation
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoTaskMemAlloc
StringFromCLSID
CoCreateInstance
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
vmprox
SetVmErrInfo
xmllite
CreateXmlReaderInputWithEncodingName
CreateXmlReader
api-ms-win-core-file-l1-1-0
CompareFileTime
CreateFileW
WriteFile
ReadFile
api-ms-win-core-io-l1-1-0
GetOverlappedResult
DeviceIoControl
CancelIoEx
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
FileTimeToSystemTime
api-ms-win-core-sysinfo-l1-2-0
GetSystemTimePreciseAsFileTime
api-ms-win-power-base-l1-1-0
PowerRegisterSuspendResumeNotification
PowerUnregisterSuspendResumeNotification
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-io-l1-1-1
CancelIo
oleaut32
SysFreeString
vmbuspiper
VmbusPipeServerConnectPipe
VmbusPipeServerOfferChannel
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
200KB
Virtual Size
196KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
84KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=33145,
count=75, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1191, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=31, id=261, version=33145,
count=1, id=256, version=33145,
count=40, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vmictimeprovider.dll
- IMPHASH 146ca3b3b9456ad39afca695147a56ac
- SHA256 7f14036497ee9a3f0c9ddca7f0aa2e0f3b2855d2698bdf0e139fb346b33757d6
- MD5 9bc82ad52e21831c054d47feda2abe6b
- SHA1 6fd13b0cb4abbbce0c2f49e106225a64d687611c
- SHA512 50b501c5e33fe0275f16a990e0d09a77a671d19a10f2efa8dc7de97bac3239e4262ba23307a025d609dafe7b002fc9731e3a984077fc8b77bff401b5a5d60a37
- SSDEEP 1536:eOQOrxoqKVAHh2SwMYgy05KCrInr7qQNnbIm4LXYTpMP5zl:eOpxBui3phyO0lnDoXUpMBJ
- TLSH T1CEA36B6D72A820A5E57A903CC5A64A09E7B1B4A5131267EF03E0C1BD4F53BE03D3EF65
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d7:a8:35:96:9e:92:7a:9c:55:89:f4:bc:f3:a4:08:57:9b:34:b2:67:f6:ee:28:10:24:a1:44:b8:7c:31:96:07
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:3605-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:13:b0:43:35:66:cf:af:95:e8:00:01:00:00:02:13
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
7696
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vmictimeprovider.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__beginthreadex
_o_free
_o_malloc
_o_wcscat_s
_o_wcscpy_s
_CxxThrowException
_o__cexit
_o___std_type_info_destroy_list
_o__callnewh
_o___std_exception_destroy
_o___std_exception_copy
_o___stdio_common_vswprintf
__CxxFrameHandler3
__std_terminate
__C_specific_handler
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
GetModuleHandleExW
GetModuleHandleW
GetModuleFileNameA
GetProcAddress
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-core-synch-l1-1-0
CreateSemaphoreExW
CreateMutexW
EnterCriticalSection
ReleaseSemaphore
OpenEventW
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
LeaveCriticalSection
SetEvent
ReleaseSRWLockExclusive
OpenMutexW
CreateEventW
ReleaseMutex
WaitForSingleObject
InitializeCriticalSectionEx
InitializeCriticalSection
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventSetInformation
EventRegister
EventWriteTransfer
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetVersionExW
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
rpcrt4
RpcStringFreeW
api-ms-win-core-memory-l1-1-0
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
OpenFileMappingW
api-ms-win-core-heap-l2-1-0
LocalFree
TimeProvClose
TimeProvCommand
TimeProvOpen
Name
.text
Size
48KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
288B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=53, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1152, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=25, id=261, version=33145,
count=1, id=256, version=33145,
count=5, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vmpmem.dll
- IMPHASH 9d4a151bf79e85496020aa46b8e57b50
- SHA256 da5341514adba4015f1ded742d84fb333802d82d59abdf73bbcb1ddcf582df8e
- MD5 0ca9d6bffd19def9826251fb4fe5bcf3
- SHA1 091c6bc782c0aaebcd3e77c273f3c7b106755509
- SHA512 c668b94877efeffb696a8eb3bb30ac041de61383069ef4c209db058db739562f6af2a33ee3ab78a1c2f58e10fb96c2322797fb62da25789a310d41589e274e8d
- SSDEEP 6144:arjEebz3BfLwbRlHVy+n80pAPjIkJg8vJyob4zruYw:a8ebzFLYRlHj8TtvJxuy
- TLSH T15EC46D6EA66804F5E57AD17CCA578A07E7B274A1032197CB0290C27D2F5FFE4693EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
64:39:93:50:0d:03:e1:f0:82:62:97:bd:ae:af:76:49:a6:43:ea:b4:6a:a7:d4:c6:26:f4:a6:3c:aa:66:8a:1c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:591A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:14:8d:cd:23:44:ee:06:df:72:00:01:00:00:02:14
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
9328
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vmpmem.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
_o_abort
_o_calloc
_o_free
_o_malloc
_o_qsort
_o_terminate
_o_wcscpy_s
_o_wcstod
_o_wcstoull
__current_exception
__AdjustPointer
__CxxFrameHandler3
__current_exception_context
_CxxThrowException
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnwprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__C_specific_handler
__CxxFrameHandler4
memcmp
memcpy
memmove
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetModuleHandleW
GetModuleFileNameW
GetModuleHandleExW
GetProcAddress
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
ReleaseSRWLockShared
WaitForSingleObjectEx
LeaveCriticalSection
SetEvent
ResetEvent
AcquireSRWLockShared
InitializeCriticalSection
DeleteCriticalSection
ReleaseSRWLockExclusive
OpenSemaphoreW
ReleaseSemaphore
CreateSemaphoreExW
InitializeSRWLock
WaitForSingleObject
CreateEventW
CreateMutexExW
ReleaseMutex
InitializeCriticalSectionEx
AcquireSRWLockExclusive
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
RaiseException
GetLastError
api-ms-win-core-registry-l1-1-0
RegDeleteKeyExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegGetValueW
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolIo
CloseThreadpoolWork
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpool
SetThreadpoolTimer
CancelThreadpoolIo
SetThreadpoolThreadMaximum
CloseThreadpoolIo
CloseThreadpoolTimer
TrySubmitThreadpoolCallback
StartThreadpoolIo
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureStackBackTrace
RtlPcToFileHeader
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-com-l1-1-0
CoCreateInstance
StringFromCLSID
CoTaskMemAlloc
CoTaskMemFree
xmllite
CreateXmlReaderInputWithEncodingName
CreateXmlReader
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventUnregister
EventWriteTransfer
EventWrite
EventRegister
EventActivityIdControl
EventEnabled
oleaut32
SysFreeString
api-ms-win-core-synch-l1-2-0
WakeAllConditionVariable
InitializeConditionVariable
SleepConditionVariableSRW
InitOnceComplete
InitOnceBeginInitialize
WakeByAddressAll
WaitOnAddress
rpcrt4
UuidCreate
api-ms-win-core-file-l1-1-0
CreateFileW
GetFileSizeEx
ReadFile
WriteFileGather
GetFinalPathNameByHandleW
GetVolumeInformationByHandleW
ReadFileScatter
FlushFileBuffers
WriteFile
SetFileInformationByHandle
api-ms-win-core-memory-l1-1-0
CreateFileMappingW
api-ms-win-core-io-l1-1-0
DeviceIoControl
GetOverlappedResult
ntdll
NtSetInformationFile
RtlAreBitsClear
RtlFindSetBits
RtlAreBitsSet
RtlSetAllBits
RtlClearBits
RtlInitializeBitMap
RtlRandomEx
RtlClearAllBits
RtlSetBits
RtlFindLastBackwardRunClear
api-ms-win-core-psapi-l1-1-0
K32GetModuleInformation
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
vmprox
GetVmErrInfo
SetVmErrInfo
api-ms-win-devices-config-l1-1-1
CM_Register_Notification
CM_Unregister_Notification
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
336KB
Virtual Size
335KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
112KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
48KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=85, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1247, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=29, id=261, version=33145,
count=1, id=256, version=33145,
count=52, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vmprox.dll
- IMPHASH d208a62232a4f9d02ec951a1413d2e4a
- SHA256 ae9a4f43b42b9cf0293fad7b16b28bc439f65002568494fdccf2ec3c74d1cb3a
- MD5 d2955c1ea6ef6dc2b54682a189ef55a7
- SHA1 5974d5a9b04899dca9e967058b3e1a9e7df8572a
- SHA512 0914c27cfb1a16b545ce0476a2ef97fabac36b2217f7aa0a96f44435280cea53a228b3bdcd6e1e295a18bb5bf8d5af324b2cbf9f78997a7c064ec790b50a2ed6
- SSDEEP 6144:BedWjj6jIPukG/s6JQMHmnv19o9+HEZ4kT4qrX/EsJhiqsKeNSvW6+w2QEOzETZ0:gd0j6kPukGhJRmnv19N6ET1Xg/
- TLSH T13894171EEA9808B6C47A513C847B0614E3B2BC2857A2C7CB3154923E5E7BFE55F39B44
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c4:48:6b:88:b2:5e:61:d7:cb:52:34:2e:74:7c:d3:c8:0f:3f:d2:42:f5:5a:ff:1e:fe:18:61:e1:aa:2a:a1:4e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:521A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:17:71:fb:2e:a5:af:01:1d:ea:00:01:00:00:02:17
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
6240
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vmprox.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
_o__strnicmp
memmove
_o__errno
_o__wcsicmp
_o__wcsnicmp
_o_free
_o_malloc
_o_wcscpy_s
__CxxFrameHandler3
_CxxThrowException
_o__callnewh
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o__crt_atexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o___std_type_info_destroy_list
_o__cexit
_o___std_exception_destroy
_o___std_exception_copy
wcschr
__std_terminate
__C_specific_handler
__CxxFrameHandler4
__RTDynamicCast
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleFileNameW
GetModuleHandleW
GetModuleFileNameA
GetModuleHandleExW
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
ReleaseSemaphore
InitializeCriticalSection
CreateSemaphoreExW
SetEvent
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
ResetEvent
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
InitializeSRWLock
ReleaseSRWLockExclusive
LeaveCriticalSection
ReleaseMutex
WaitForSingleObject
InitializeCriticalSectionEx
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
api-ms-win-core-synch-l1-2-0
InitOnceComplete
WakeAllConditionVariable
InitOnceBeginInitialize
SleepConditionVariableSRW
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyExW
RegCreateKeyExW
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
TlsGetValue
TerminateProcess
TlsSetValue
GetCurrentThreadId
TlsFree
GetCurrentProcess
TlsAlloc
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlCaptureStackBackTrace
RtlPcToFileHeader
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-com-l1-1-0
StringFromCLSID
CoTaskMemFree
CoGetStandardMarshal
CoGetStdMarshalEx
CoUnmarshalInterface
CoTaskMemAlloc
CoCreateInstance
CoGetMarshalSizeMax
CoMarshalInterface
api-ms-win-core-processthreads-l1-1-1
OpenProcess
IsProcessorFeaturePresent
api-ms-win-eventing-provider-l1-1-0
EventEnabled
EventUnregister
EventSetInformation
EventRegister
EventWrite
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-psapi-l1-1-0
K32GetModuleInformation
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
oleaut32
VARIANT_UserFree64
VARIANT_UserMarshal64
VARIANT_UserSize64
VARIANT_UserFree
VARIANT_UserUnmarshal
VARIANT_UserMarshal
VariantClear
SafeArrayAccessData
LPSAFEARRAY_UserFree64
LPSAFEARRAY_UserUnmarshal64
LPSAFEARRAY_UserMarshal64
LPSAFEARRAY_UserSize64
LPSAFEARRAY_UserFree
LPSAFEARRAY_UserUnmarshal
LPSAFEARRAY_UserMarshal
LPSAFEARRAY_UserSize
SafeArrayCreateVector
SysAllocStringLen
SafeArrayUnaccessData
VARIANT_UserSize
SysStringLen
SysReAllocStringLen
SafeArrayCreateVectorEx
SysAllocString
SysFreeString
SafeArrayDestroy
SystemTimeToVariantTime
SafeArrayGetElemsize
BSTR_UserFree64
BSTR_UserUnmarshal64
BSTR_UserMarshal64
BSTR_UserSize64
BSTR_UserFree
BSTR_UserUnmarshal
BSTR_UserMarshal
BSTR_UserSize
SafeArrayPutElement
SafeArrayGetVartype
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayPtrOfIndex
SafeArrayRedim
VariantCopy
SafeArrayCopy
VARIANT_UserUnmarshal64
rpcrt4
IUnknown_QueryInterface_Proxy
NdrClientCall3
NdrOleFree
NdrOleAllocate
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
UuidCompare
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrDllRegisterProxy
NdrDllUnregisterProxy
UuidEqual
api-ms-win-eventing-tdh-l1-1-0
TdhGetManifestEventInformation
api-ms-win-security-base-l1-1-0
EqualSid
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-com-midlproxystub-l1-1-0
ObjectStublessClient10
ObjectStublessClient11
ObjectStublessClient9
ObjectStublessClient7
NdrProxyForwardingFunction3
NdrProxyForwardingFunction4
ObjectStublessClient5
NdrProxyForwardingFunction5
NdrProxyForwardingFunction6
NdrProxyForwardingFunction7
NdrProxyForwardingFunction8
NdrProxyForwardingFunction9
ObjectStublessClient13
ObjectStublessClient6
ObjectStublessClient8
ObjectStublessClient4
ObjectStublessClient12
ObjectStublessClient3
NdrProxyForwardingFunction13
ConnectToSynth3dVideoResourcePool
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo
GetVmErrInfo
IsErrorReported
SetVmErrInfo
Name
.text
Size
176KB
Virtual Size
175KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
196KB
Virtual Size
194KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=61, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1249, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=57, id=260, version=33145,
count=5, id=259, version=33145,
count=27, id=261, version=33145,
count=1, id=256, version=33145,
count=20, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vmrdvcore.dll
- IMPHASH 19561b643868f4f6c551b832bdc1adcc
- SHA256 a435c637bbe4593ef40f09937907e795e326116f8ff8b081e3a434e52cd42924
- MD5 d632e759798c35241fc784e150aa7baf
- SHA1 72654e05a090a88ffd062861be207e655a5a4f41
- SHA512 0a9a5b4d286335640e6cf3dc2f5721825dded784206e482d4cc607b7522852f0ef7a61f3d7880756940b9ab0e38590a7ad24232736aa3bd4f071fab6dd28e6a4
- SSDEEP 6144:t/WO1EAfk09tPKGUPtZMN1MJnL0g7ZuLMQKQIqPzg1+LDACkD831LOsxtYt+VYSo:tV3KG2ZS1MJL0g7Qj3tQbbODC
- TLSH T1E8A4E61DA3F80018F4F6977899760964AA7238292F31C9CF01A5D47D3F26EE48DB4B5B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4928
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vmrdvcore.pdb
msvcrt
__CxxFrameHandler4
_wcsicmp
_vsnwprintf
memmove
wcscspn
_vsnwprintf_s
??_V@YAXPEAX@Z
??3@YAXPEAX@Z
wcsrchr
wcsncmp
_wcsnicmp
?terminate@@YAXXZ
iswalpha
wcschr
??1type_info@@UEAA@XZ
swprintf_s
_callnewh
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
memcmp
_onexit
__dllonexit
_unlock
_lock
?what@exception@@UEBAPEBDXZ
__C_specific_handler
_XcptFilter
_CxxThrowException
__CxxFrameHandler3
_initterm
malloc
free
memcpy
_purecall
_amsg_exit
_wtol
memset
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
DisableThreadLibraryCalls
GetProcAddress
FreeLibrary
LoadLibraryExW
GetModuleHandleExW
api-ms-win-core-synch-l1-2-0
SleepConditionVariableSRW
WakeAllConditionVariable
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetExitCodeThread
GetCurrentThread
GetCurrentProcessId
CreateThread
OpenProcessToken
GetCurrentThreadId
OpenThreadToken
GetExitCodeProcess
CreateProcessW
ResumeThread
SuspendThread
TerminateProcess
api-ms-win-core-sysinfo-l1-1-0
GetLocalTime
GetVersionExW
GetSystemTimeAsFileTime
GetTickCount
GetComputerNameExW
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-core-synch-l1-1-0
OpenEventW
WaitForSingleObject
ReleaseSRWLockExclusive
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
CreateEventW
ResetEvent
LeaveCriticalSection
SetEvent
InitializeCriticalSectionAndSpinCount
AcquireSRWLockExclusive
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableFlags
GetTraceLoggerHandle
GetTraceEnableLevel
TraceMessage
UnregisterTraceGuids
RegisterTraceGuidsW
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-threadpool-l1-2-0
SubmitThreadpoolWork
CallbackMayRunLong
CreateThreadpoolWork
WaitForThreadpoolWorkCallbacks
CloseThreadpoolWork
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-registry-l1-1-0
RegEnumKeyExW
RegDeleteTreeW
RegLoadKeyW
RegUnLoadKeyW
RegQueryValueExW
RegGetValueW
RegCreateKeyExW
RegOpenKeyExW
RegNotifyChangeKeyValue
RegDeleteValueW
RegCloseKey
RegSetValueExW
api-ms-win-core-file-l1-1-0
GetShortPathNameW
GetFileAttributesW
CreateDirectoryW
FindFirstVolumeW
DeleteVolumeMountPointW
SetFileAttributesW
CreateFileW
RemoveDirectoryW
FindClose
FindNextFileW
FindFirstFileW
ReadFile
FindVolumeClose
DeleteFileW
FindNextVolumeW
WriteFile
GetLongPathNameW
api-ms-win-core-kernel32-legacy-l1-1-0
MoveFileW
GetComputerNameW
api-ms-win-security-base-l1-1-0
GetAclInformation
IsValidSid
GetLengthSid
EqualSid
GetFileSecurityW
CreateWellKnownSid
SetFileSecurityW
DeleteAce
AdjustTokenPrivileges
SetSecurityDescriptorDacl
GetAce
MakeAbsoluteSD
GetSecurityDescriptorDacl
api-ms-win-core-string-l1-1-0
CompareStringEx
api-ms-win-core-kernel32-legacy-l1-1-1
VerifyVersionInfoW
SetVolumeMountPointW
api-ms-win-core-file-l2-1-0
CreateSymbolicLinkW
GetFileInformationByHandleEx
CopyFileExW
MoveFileWithProgressW
api-ms-win-core-heap-obsolete-l1-1-0
LocalSize
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-file-l1-2-0
GetVolumePathNamesForVolumeNameW
GetVolumeNameForVolumeMountPointW
api-ms-win-core-io-l1-1-0
GetOverlappedResult
DeviceIoControl
api-ms-win-core-namedpipe-l1-1-0
SetNamedPipeHandleState
ConnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeW
api-ms-win-core-io-l1-1-1
CancelIo
api-ms-win-core-sysinfo-l1-2-0
VerSetConditionMask
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
TzSpecificLocalTimeToSystemTime
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
VmRdvCore_CreateInstance
VmRdvCore_GetInstance
VmRdvCore_TerminateInstance
Name
.text
Size
312KB
Virtual Size
311KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
124KB
Virtual Size
123KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=62, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33138,
count=20, id=260, version=33138,
count=304, id=1, productName=Unmarked objects,
count=3, id=257, version=33138,
count=12, id=261, version=33138,
count=1, id=256, version=33138,
count=46, id=264, version=33138,
count=1, id=255, version=33138,
count=1, id=258, version=33138,
vmserial.dll
- IMPHASH ef929b28325aab0ce8082b7a80b69589
- SHA256 22717f496995aeef22ec95447db251fdcc9500987cb9f900513ceddaa950ae37
- MD5 037f27810b371b850a7e715e8ee94b3e
- SHA1 0d380835946174d7ad9110e6f1ad4df2d01218a4
- SHA512 f43b00813a0353ebbe578b30d95303764c5a56a623d596a45f65a94e0a2bd13e6628e2753f2747c3df03892797e24a0c4196cfc3bb255f1a0f3f571baa2e209f
- SSDEEP 12288:4mkAgeZy6ZqqDQcdEZETLpa+R1u0W22ibUmmaC+HXcyS81c/D/aCw:HBy6IqDKsLDT3cyeDiX
- TLSH T141C46C2EB6A803F1E176E1388957460AE7B17461172293CB16A0D27E1F2BFF45E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
0c:23:42:18:f2:c3:a4:f8:fc:94:ea:b1:54:1e:3e:c9:01:8f:53:9a:1e:98:19:5e:a4:5e:4b:36:99:55:a7:b2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:7F00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1e:a3:ac:a4:6e:39:6f:7c:49:00:01:00:00:02:1e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
9200
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vmserial.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__free_base
_o__Getdays
_o__Getmonths
_o__Gettnames
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__ldclass
_o__malloc_base
_o__purecall
_o__realloc_base
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
_o__Strftime
memmove
_o__W_Getdays
_o__W_Getmonths
_o__W_Gettnames
_o__wcsdup
_o__Wcsftime
_o__wcstoui64
_o_abort
_o_calloc
_o_ceilf
_o_free
_o_frexp
_o_islower
_o_isprint
_o_isspace
_o_isupper
_o_localeconv
_o_malloc
_o_setlocale
_o_strtod
_o_strtof
_o_terminate
_o_tolower
_o_wcscpy_s
_o_wcstod
_o_wcstoull
__CxxFrameHandler3
__current_exception
__current_exception_context
__RTDynamicCast
_CxxThrowException
_o__execute_onexit_table
_o__errno
_o__dclass
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__calloc_base
_o__callnewh
_o__beginthreadex
__RTtypeid
__AdjustPointer
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnwprintf_s
_o___std_type_info_name
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___pctype_func
_o____mb_cur_max_func
_o____lc_locale_name_func
_o____lc_collate_cp_func
_o____lc_codepage_func
__std_terminate
__C_specific_handler
__CxxFrameHandler4
memchr
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
strcspn
wcsnlen
memset
__strncnt
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
FreeLibrary
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleW
GetModuleFileNameA
GetProcAddress
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockExclusive
InitializeSRWLock
WaitForSingleObject
ResetEvent
InitializeCriticalSection
InitializeCriticalSectionEx
CreateEventExW
LeaveCriticalSection
CreateEventW
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
CreateSemaphoreExW
EnterCriticalSection
SetEvent
ReleaseSemaphore
ReleaseMutex
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
WaitForMultipleObjectsEx
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
Sleep
SleepConditionVariableSRW
InitializeConditionVariable
WaitOnAddress
WakeByAddressAll
WakeAllConditionVariable
SleepConditionVariableCS
InitOnceComplete
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
SetLastError
GetLastError
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
SetThreadPriority
GetCurrentProcess
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlCaptureStackBackTrace
RtlVirtualUnwind
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventWriteTransfer
EventWrite
EventEnabled
EventSetInformation
EventRegister
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegGetValueW
RegDeleteKeyExW
RegCloseKey
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CloseThreadpoolTimer
CreateThreadpoolTimer
CreateThreadpoolWork
CloseThreadpool
WaitForThreadpoolTimerCallbacks
CloseThreadpoolIo
TrySubmitThreadpoolCallback
SetThreadpoolThreadMaximum
StartThreadpoolIo
CreateThreadpoolIo
CancelThreadpoolIo
SubmitThreadpoolWork
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks
api-ms-win-core-localization-l1-2-0
GetCPInfo
LCMapStringEx
FormatMessageW
GetLocaleInfoEx
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-psapi-l1-1-0
K32GetModuleInformation
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
GetStringTypeW
MultiByteToWideChar
CompareStringEx
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoTaskMemFree
StringFromCLSID
CoTaskMemAlloc
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
GetCurrentProcessorNumberEx
api-ms-win-crt-locale-l1-1-0
_unlock_locales
_lock_locales
xmllite
CreateXmlReaderInputWithEncodingName
CreateXmlReader
oleaut32
SafeArrayGetElemsize
SafeArrayCreateVectorEx
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayUnaccessData
SafeArrayAccessData
SysFreeString
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-namedpipe-l1-1-0
PeekNamedPipe
DisconnectNamedPipe
ConnectNamedPipe
api-ms-win-core-file-l1-1-0
ReadFile
WriteFile
api-ms-win-core-io-l1-1-0
GetOverlappedResult
CancelIoEx
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
vmprox
SetVmErrInfo
api-ms-win-core-perfcounters-l1-1-0
PerfSetCounterRefValue
PerfStopProvider
PerfStartProvider
PerfCreateInstance
PerfSetCounterSetInfo
PerfDeleteInstance
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
360KB
Virtual Size
357KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
112KB
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
56KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=71, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1241, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=29, id=261, version=33145,
count=1, id=256, version=33145,
count=63, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vmsif.dll
- IMPHASH 7cdbf713379b3d8deec0dae8bbf57dfe
- SHA256 b5f4bf30eb75c02c93dc06c22ea4f08e9dca83eb85172ca02d60f5a113306a2d
- MD5 f8adcdaf56c9a84a20157e8181f601c9
- SHA1 cff58a5a45595711bed0a8bd10d6d2ef60b70ce4
- SHA512 f37a6666485d427bab447f43bb1b1d779d6ce434204c74488ab6cb0a98fde86ff06b1647bdcc31326b88f044e8ac94851ddccbf970d5c3e9718d215cb882d7b6
- SSDEEP 3072:uw7UOsKT0OVqod5GpPLlvJ+QkpNfR2SKDpFJXhFllw6y2uq012FOTgHd:HUOsq0rA5szlvNeR2SQZXplI2uq01Yf
- TLSH T181744B34B7E520A5F5BBE1BCDAA24206FBB27496133141CF0651457E2E73BE0AE39712
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
be:30:86:de:76:ca:44:6f:0e:ed:29:79:b2:d7:db:6e:a2:fb:24:03:cd:af:4d:36:0f:a2:c1:59:1d:4c:5c:af
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:551A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1b:d0:b2:b8:02:67:f7:72:cf:00:01:00:00:02:1b
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
14528
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vmsif.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
memmove
_o__wcsicmp
_o_calloc
_o_free
_o_malloc
_o_terminate
_o_wcscpy_s
_o_wcsncpy_s
__C_specific_handler
__current_exception
__current_exception_context
_o__crt_atexit
__CxxFrameHandler4
__std_terminate
__CxxFrameHandler3
_CxxThrowException
_o__execute_onexit_table
_o__errno
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__configure_narrow_argv
_o__cexit
_o__callnewh
__C_specific_handler_noexcept
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
wcscmp
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetModuleHandleExW
GetProcAddress
FreeLibrary
SizeofResource
LoadResource
DisableThreadLibraryCalls
LoadLibraryExW
GetModuleHandleW
FindResourceExW
GetModuleFileNameW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetVersionExW
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-io-l1-1-0
GetOverlappedResult
CancelIoEx
DeviceIoControl
api-ms-win-core-synch-l1-1-0
OpenSemaphoreW
SetEvent
InitializeCriticalSectionAndSpinCount
InitializeSRWLock
ResetEvent
CreateEventW
CreateEventA
CreateSemaphoreExW
InitializeCriticalSection
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
EnterCriticalSection
ReleaseSRWLockShared
ReleaseSemaphore
WaitForSingleObject
WaitForSingleObjectEx
AcquireSRWLockExclusive
LeaveCriticalSection
ReleaseSRWLockExclusive
ReleaseMutex
InitializeCriticalSectionEx
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-file-l1-1-0
CreateFileW
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventUnregister
EventRegister
EventSetInformation
ntdll
RtlGUIDFromString
RtlInitUnicodeString
RtlNtStatusToDosError
oleaut32
VarUI4FromStr
api-ms-win-core-com-l1-1-0
CoUninitialize
StringFromGUID2
CoDisconnectContext
CoRegisterClassObject
CLSIDFromString
CoTaskMemRealloc
CoRevokeClassObject
CoInitializeEx
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
api-ms-win-core-registry-l1-1-0
RegDeleteValueW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegQueryInfoKeyW
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
devobj
DevObjOpenDevRegKey
DevObjDestroyDeviceInfoList
DevObjChangeState
DevObjGetClassDevs
DevObjCreateDeviceInfoList
DevObjEnumDeviceInfo
netsetupapi
NetSetupClose
NetSetupFreeObjects
NetSetupSetObjectProperties
NetSetupCommit
NetSetupInitialize
NetSetupGetObjects
NetSetupRollback
fwpuclnt
FwpmProviderCreateEnumHandle0
FwpmEngineOpen0
FwpmProviderEnum0
FwpmFreeMemory0
FwpmProviderDestroyEnumHandle0
FwpmFilterDestroyEnumHandle0
FwpmFilterEnum0
FwpmFilterCreateEnumHandle0
FwpmEngineClose0
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
VmsIfCapsFindCapability
VmsIfCapsGetCapability
VmsIfCapsInitializeLibrary
VmsIfCapsIsFeaturePresent
VmsIfCapsIsFixPresent
VmsIfCapsQueryCapabilities
VmsIfDioNicSetAddresses
VmsIfDioNicSetMacAddress
VmsIfDioNicSetPacketFilter
VmsIfDioNicSetPacketFilterEx
VmsIfDriverClose
VmsIfDriverOpen
VmsIfDriverOpenWithFileName
VmsIfExecMonitorConfigGet
VmsIfExecMonitorConfigSet
VmsIfExecMonitorOpsGet
VmsIfExecMonitorOpsGetCurrentInterval
VmsIfExecMonitorOpsGetHistory
VmsIfExecMonitorOpsGetRangeBasedHistory
VmsIfExecMonitorPendingGet
VmsIfExecMonitorReset
VmsIfGetInitState
VmsIfGlobalParameterQuery
VmsIfGlobalParameterSet
VmsIfInitializeEventServer
VmsIfIoctlAddToInputBuffer
VmsIfIoctlDeinitializeOperation
VmsIfIoctlGetOutputBuffer
VmsIfIoctlGetOutputRecord
VmsIfIoctlInitializeOperation
VmsIfIoctlResizeOutputBuffer
VmsIfIoctlSendIoctl
VmsIfMemFree
VmsIfNicAllocateVF
VmsIfNicCollectInternalStats
VmsIfNicConnect
VmsIfNicConnectEx
VmsIfNicCreateEmulated
VmsIfNicCreateSynthetic
VmsIfNicDeleteEmulated
VmsIfNicDeleteMiniport
VmsIfNicDeleteMiniportLW
VmsIfNicDeleteSynthetic
VmsIfNicDisableMiniport
VmsIfNicDisableOptimizations
VmsIfNicDisconnect
VmsIfNicDisconnectEx
VmsIfNicEnableMiniport
VmsIfNicEnableOptimizations
VmsIfNicEndSave
VmsIfNicEnumerate
VmsIfNicEnumerateEx
VmsIfNicFreeVF
VmsIfNicGetAddresses
VmsIfNicGetDropReasons
VmsIfNicGetInfo
VmsIfNicGetInfoEx
VmsIfNicGetInternalStats
VmsIfNicGetStats
VmsIfNicGetStatus
VmsIfNicGetVfInfo
VmsIfNicGetVmqInfo
VmsIfNicGetVrssEntryCount
VmsIfNicGetVrssInfo
VmsIfNicInitializeMiniport
VmsIfNicInitializeMiniportLW
VmsIfNicMorphToEmulatedNic
VmsIfNicMorphToEmulatedNicEx
VmsIfNicMorphToSynthNic
VmsIfNicNotifyInitializeExternal
VmsIfNicNotifyInitializeMiniport
VmsIfNicNotifyRestored
VmsIfNicPausedEmulated
VmsIfNicPausedSynthetic
VmsIfNicRelearnMac
VmsIfNicRestore
VmsIfNicResumeEmulated
VmsIfNicResumeSynthetic
VmsIfNicSendStatus
VmsIfNicSendStatusEx
VmsIfNicSetConnectionInfo
VmsIfNicSetInfo
VmsIfNicSuspendSynthetic
VmsIfNicVmphuBegin
VmsIfNicVmphuComplete
VmsIfPhysicalNicGetStoredVlanId
VmsIfPhysicalNicRemove
VmsIfPortCreate
VmsIfPortCreateEx
VmsIfPortCreateWithHandle
VmsIfPortDelete
VmsIfPortDeleteEx
VmsIfPortEnumerate
VmsIfPortEnumerateEx
VmsIfPortEnumerateLearnedMacAddresses
VmsIfPortFeatureStatusFree
VmsIfPortFeatureStatusQuery
VmsIfPortGetEncapInfo
VmsIfPortGetHandleCount
VmsIfPortGetInfo
VmsIfPortGetInfoEx
VmsIfPortGetRequiredExtensions
VmsIfPortGetStats
VmsIfPortGetVlanSettings
VmsIfPortOpenWithHandle
VmsIfPortPropertyAdd
VmsIfPortPropertyEnumerate
VmsIfPortPropertyFree
VmsIfPortPropertyListFree
VmsIfPortPropertyQuery
VmsIfPortPropertyRemove
VmsIfPortPropertyUpdate
VmsIfPortSetEncapInfo
VmsIfPortSetEncapInfoEx
VmsIfPortSetInfo
VmsIfPortSetRequiredExtensions
VmsIfPortSetSecurityInfo
VmsIfPortSetVlanSettings
VmsIfProcClearProfilerStats
VmsIfProcGetProfilerStats
VmsIfProcGetStats
VmsIfProcsEnumerate
VmsIfProcsEnumerateEx
VmsIfRegisterHandle
VmsIfShutdownEventServer
VmsIfSwitchCreate
VmsIfSwitchCreateEx
VmsIfSwitchDelete
VmsIfSwitchDeregisterProtocol
VmsIfSwitchDisableOptimization
VmsIfSwitchEnableOptimization
VmsIfSwitchEnumerate
VmsIfSwitchEnumerateEx
VmsIfSwitchExtensionEnable
VmsIfSwitchExtensionEnumerate
VmsIfSwitchExtensionFree
VmsIfSwitchExtensionGet
VmsIfSwitchExtensionReorder
VmsIfSwitchFeatureStatusFree
VmsIfSwitchFeatureStatusQuery
VmsIfSwitchGetInfo
VmsIfSwitchGetInfoEx
VmsIfSwitchGetInternalStats
VmsIfSwitchGetStats
VmsIfSwitchListenIcmpEcho
VmsIfSwitchPropertyAdd
VmsIfSwitchPropertyEnumerate
VmsIfSwitchPropertyFree
VmsIfSwitchPropertyListFree
VmsIfSwitchPropertyQuery
VmsIfSwitchPropertyRemove
VmsIfSwitchPropertyUpdate
VmsIfSwitchRequiredExtensionsFree
VmsIfSwitchResetExtensionMiniport
VmsIfSwitchSendIcmpEcho
VmsIfSwitchServicingEnd
VmsIfSwitchServicingStart
VmsIfSwitchSetInfo
VmsIfSwitchShutdown
VmsIfSwitchValidateLearnedMacAddress
VmsIfVmqGroupsEnumerate
VmsIfVswitchCallerAuditEnumerate
VmsIfVswitchCallerAuditEnumerateEx
Name
.text
Size
184KB
Virtual Size
180KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
92KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=33145,
count=71, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1218, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33145,
count=5, id=259, version=33145,
count=29, id=261, version=33145,
count=1, id=256, version=33145,
count=41, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vmsifcore.dll
- IMPHASH b08da616e32a83e1b7968ec94ba042df
- SHA256 9613692735d58db9d0fbf0760214e74ccc68434810f46a8973e49be33a091bab
- MD5 313fbb22850ad9453f71e716cda76e26
- SHA1 8ceed8b40b02b2c7c5db4bb661c93e335f921046
- SHA512 608aa6f5919688f7e19034e33991c358f0db0eccdcbc05cc29681ded7fe4d2c98c3d1a24f248495f4720fdc1898aaafc99bf60f9bf7edeb6da7310d1944af43d
- SSDEEP 1536:QUQFPlASXwXyPhl1TiJzpJp81wYH5/kDfY/i1K681zT8Z8BlMsgP/z1:QUQX1XVZqz/pmZsWi1K6MzT8CUsgHp
- TLSH T174E3D765B7E82025F2B37AB8DDB682459B76F5912B3293DF1140805E0F63BD09E35B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
16:ba:e6:06:39:eb:d0:f3:00:8c:1c:da:69:f8:03:d8:92:9d:40:4f:c0:6e:0f:da:3c:01:bf:91:68:28:59:e2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:7F00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1e:a3:ac:a4:6e:39:6f:7c:49:00:01:00:00:02:1e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
5696
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vmsifcore.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o_malloc
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
_CxxThrowException
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__CxxFrameHandler3
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-io-l1-1-0
GetOverlappedResult
DeviceIoControl
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetVersionExW
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleHandleW
DisableThreadLibraryCalls
GetModuleHandleExW
GetModuleFileNameA
api-ms-win-core-synch-l1-1-0
InitializeCriticalSection
CreateSemaphoreExW
EnterCriticalSection
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
CreateEventA
ReleaseSRWLockShared
ReleaseSemaphore
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
LeaveCriticalSection
ReleaseSRWLockExclusive
ReleaseMutex
InitializeCriticalSectionEx
WaitForSingleObject
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CloseThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-file-l1-1-0
CreateFileW
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
VmsIfCapsFindCapability
VmsIfCapsGetCapability
VmsIfCapsInitializeLibrary
VmsIfCapsIsFeaturePresent
VmsIfCapsIsFixPresent
VmsIfCapsQueryCapabilities
VmsIfCoreDeinitialize
VmsIfCoreInitialize
VmsIfDriverClose
VmsIfDriverOpen
VmsIfDriverOpenWithFileName
VmsIfIoEnumeratorExecuteEx
VmsIfIoEnumeratorPrepareEx
VmsIfIoExecuteEx
VmsIfIoFinalize
VmsIfIoPrepareEx
VmsIfMemFree
VmsIfRegisterHandle
Name
.text
Size
56KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
788B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=41, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1127, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=21, id=261, version=33145,
count=1, id=256, version=33145,
count=16, id=264, version=33145,
count=2, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vmsifproxystub.dll
- IMPHASH 8195c1a3a9ef9c56eb5289e90a6fab07
- SHA256 f91e571226c0f6bb089d579ca0064fa30dbbaab2ebbf16d7f78262410a27b438
- MD5 ef75464134439958a183d2cfe4acfb29
- SHA1 b975718648bf11f3d18afabcef75e691a72d654f
- SHA512 84ae79a6edae34665fa0c847226eb491ae4ddfaf2782cb33293f0916aee5b7a0522f3a625601e84865b8c26522e8ae89a5a4aa005534e2318186469572e9ea1a
- SSDEEP 384:qXQDLmNI5zvVUzXeQvyV9ug6WAiW2MDBRJWjspR9zzcHz:yO/zviSqyVXMSM1PWjsD9zgT
- TLSH T181332AC1AB282442F879AA3841D7DE53A438FE852792C6DB13D0929D0C677C4DF3A79D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
79:be:92:fe:c5:af:c0:34:ec:41:c7:f4:f5:4d:90:41:3f:75:3e:91:1f:d9:64:7b:41:aa:c7:b2:b8:fe:83:75
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 24, 2025
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:a7:04:3e:e4:22:c8:34:fa:fc:00:00:00:00:04:a7
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2024 - Sep 11, 2025
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A935-03E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:e9:0f:71:30:7e:5d:f1:12:36:00:01:00:00:01:e9
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
5056
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vmsifproxystub.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___std_type_info_destroy_list
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
__C_specific_handler
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
rpcrt4
NdrDllCanUnloadNow
NdrOleFree
NdrOleAllocate
NdrDllUnregisterProxy
NdrDllRegisterProxy
NdrDllGetClassObject
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo
Name
.text
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
340B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=27, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1091, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33140,
count=4, id=259, version=33140,
count=11, id=261, version=33140,
count=1, id=256, version=33140,
count=4, id=264, version=33140,
count=1, id=253, version=33140,
count=1, id=255, version=33140,
count=1, id=258, version=33140,
vmsmb.dll
- IMPHASH 15c6121831069708bc1742f9c11752b2
- SHA256 e9a244839016f33c873bbda5f900ab4dc17d83b896e7dcbe38fac9b86f60aba1
- MD5 bc2309395ae3f39f168673f5a6cdb79e
- SHA1 cb3c5ce985bea93bbf6b951b5f31afa64de25452
- SHA512 24017d35e2b5a659d22f1084904e9dc30e8e952fffb85eec07474d4f0aed1c73677515c2102e31202b7e53b739740c07852ef578da1a191c0bb15b7acf502a03
- SSDEEP 6144:Qw96XgKXXx8QA8w9Qe+IgPJhXrzEpBeLOOd/hEz:N6XTXXxlDw9QNTPjIpB/Gyz
- TLSH T1E8A45C6DEBD804E0E57B917CD9738606E67278A8072192CF1590827D2FB7FE0A93DB50
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d3:bf:12:17:07:54:02:d1:af:3b:00:53:9b:a6:64:24:3d:bf:3a:06:6c:3e:47:65:cc:b7:53:a6:71:58:bb:06
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9600-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:26:35:b4:3e:67:43:93:f6:1f:00:01:00:00:02:26
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
12752
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vmsmb.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__free_base
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__malloc_base
_o__purecall
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
memmove
_o__wcsdup
_o__wcsicmp
_o__wcsnicmp
_o_abort
_o_free
_o_iswspace
_o_malloc
_o_realloc
_o_setlocale
_o_terminate
_o_wcscpy_s
_o_wcstod
_o_wcstoull
__CxxFrameHandler3
__current_exception
__current_exception_context
_CxxThrowException
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__calloc_base
_o__callnewh
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___pctype_func
strchr
_o____mb_cur_max_func
_o____lc_locale_name_func
_o____lc_collate_cp_func
_o____lc_codepage_func
__std_terminate
__C_specific_handler
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
wcsnlen
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
GetProcAddress
GetModuleHandleExW
GetModuleHandleW
GetModuleFileNameW
LoadLibraryExW
GetModuleFileNameA
api-ms-win-core-synch-l1-1-0
ReleaseMutex
InitializeCriticalSection
SetEvent
EnterCriticalSection
ResetEvent
CreateSemaphoreExW
InitializeSRWLock
ReleaseSemaphore
AcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSRWLockExclusive
WaitForSingleObjectEx
CreateEventExW
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
LeaveCriticalSection
InitializeCriticalSectionEx
WaitForSingleObject
OpenSemaphoreW
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
SetLastError
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegGetValueW
RegOpenKeyExW
RegDeleteKeyExW
RegSetValueExW
RegCloseKey
api-ms-win-core-threadpool-l1-2-0
StartThreadpoolIo
CloseThreadpool
CloseThreadpoolWork
WaitForThreadpoolTimerCallbacks
TrySubmitThreadpoolCallback
CreateThreadpoolWork
CreateThreadpoolTimer
CancelThreadpoolIo
WaitForThreadpoolWorkCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolIo
SetThreadpoolThreadMaximum
SubmitThreadpoolWork
CloseThreadpoolIo
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
api-ms-win-core-rtlsupport-l1-1-0
RtlPcToFileHeader
RtlCaptureStackBackTrace
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-localization-l1-2-0
FormatMessageW
LCMapStringEx
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
GetStringTypeW
CompareStringEx
WideCharToMultiByte
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventWrite
EventActivityIdControl
EventWriteTransfer
EventUnregister
EventSetInformation
EventEnabled
api-ms-win-core-com-l1-1-0
StringFromCLSID
CoTaskMemFree
CoTaskMemAlloc
xmllite
CreateXmlReaderInputWithEncodingName
CreateXmlReader
oleaut32
SysFreeString
api-ms-win-core-synch-l1-2-0
WaitOnAddress
SleepConditionVariableCS
InitOnceComplete
WakeAllConditionVariable
SleepConditionVariableSRW
InitOnceBeginInitialize
InitializeConditionVariable
WakeByAddressAll
ws2_32
socket
bind
closesocket
ntdll
NtQueryDirectoryFile
NtQueryInformationFile
RtlInitUnicodeString
api-ms-win-core-file-l1-1-0
ReadFile
api-ms-win-core-io-l1-1-0
GetOverlappedResult
api-ms-win-core-psapi-l1-1-0
K32GetModuleInformation
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
GetCurrentProcessorNumberEx
IsProcessorFeaturePresent
vmusrv
VmusrvSupportsPause
VmusrvEnginePause
VmusrvEngineStop
VmusrvCleanup
VmusrvInitialize
VmusrvEngineRestore
VmusrvEngineResume
VmusrvRemoveShare
VmusrvAddShare
VmusrvUpdateShareAllowedFileList
VmusrvOpenFile
VmusrvEngineSave
api-ms-win-crt-locale-l1-1-0
_unlock_locales
_lock_locales
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-perfcounters-l1-1-0
PerfStartProvider
PerfCreateInstance
PerfStopProvider
PerfSetCounterSetInfo
PerfDeleteInstance
PerfSetCounterRefValue
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
244KB
Virtual Size
242KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
92KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
44KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
28KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=71, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1232, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=29, id=261, version=33145,
count=1, id=256, version=33145,
count=49, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vmsynthstor.dll
- IMPHASH fa1e78ce9daee779e85e0f48aca8a442
- SHA256 c903ece383a9e85916c2872116881c426a1865108a1b81c84dfdbe7a44ba1205
- MD5 a2a76b3e287fc469547cdf4d86a6c65c
- SHA1 65372d8ba66e22b7dfa0438ac12b2fcc69b291a6
- SHA512 c4d88728299490cf4bd5b8bdd4748238e2f6fb5809b813b2cde85dfff74542dce0c9a010e0835e687208a8d09eaaa69309cf9e46b508773e3d6cfeddf7fa56ef
- SSDEEP 6144:CVWXNRfHxzkfQO3rI8g+gI7fmsKqlQGq2JSQKuo0cU3Hv43cLV0JSNdZv10Z0VVt:rXN/zzWZzfmsKK78QKu3Bv4sxrVuu
- TLSH T19AB46D3DE66900E5E57AC17CC9A34606FA7278A9032197DF1590C27D2F6BFE0A93DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
04:10:37:60:34:85:e9:0b:2d:42:c6:9f:fa:89:c2:fe:07:c1:ce:7f:c0:14:22:c7:3e:57:37:b1:c0:b8:13:d9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:651A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:15:18:03:d3:81:07:26:7c:53:00:01:00:00:02:15
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
9760
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
VmSynthStor.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
memmove
_o__wcsicmp
_o_abort
_o_ceilf
_o_free
_o_isalnum
_o_iswalpha
_o_iswascii
_o_malloc
_o_terminate
_o_towlower
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstod
_o_wcstoll
_o_wcstoull
__CxxFrameHandler3
__current_exception
__current_exception_context
_CxxThrowException
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o__execute_onexit_table
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o__errno
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
wcsstr
__std_terminate
__C_specific_handler
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetModuleFileNameW
FindResourceExW
LoadResource
LockResource
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
api-ms-win-core-synch-l1-1-0
InitializeCriticalSection
SetEvent
ResetEvent
InitializeCriticalSectionEx
WaitForSingleObject
CreateEventW
WaitForMultipleObjectsEx
ReleaseSemaphore
EnterCriticalSection
ReleaseMutex
InitializeSRWLock
LeaveCriticalSection
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CreateSemaphoreExW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
SetLastError
UnhandledExceptionFilter
api-ms-win-core-registry-l1-1-0
RegEnumKeyExW
RegQueryInfoKeyW
RegCreateKeyExW
RegGetValueW
RegDeleteValueW
RegDeleteKeyExW
RegCloseKey
RegQueryValueExW
RegSetValueExW
RegOpenKeyExW
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolWork
CancelThreadpoolIo
StartThreadpoolIo
CloseThreadpoolIo
CreateThreadpoolIo
TrySubmitThreadpoolCallback
WaitForThreadpoolIoCallbacks
SetThreadpoolThreadMinimum
CloseThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
CreateThreadpoolCleanupGroup
SubmitThreadpoolWork
CreateThreadpoolWork
CloseThreadpool
SetThreadpoolThreadMaximum
CreateThreadpool
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-processthreads-l1-1-0
CreateThread
GetCurrentThread
GetCurrentProcess
GetCurrentThreadId
GetExitCodeThread
GetCurrentProcessId
TerminateProcess
OpenThreadToken
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureStackBackTrace
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-eventing-provider-l1-1-0
EventEnabled
EventWrite
EventRegister
EventSetInformation
EventUnregister
EventActivityIdControl
EventWriteTransfer
api-ms-win-core-synch-l1-2-0
WakeAllConditionVariable
InitOnceBeginInitialize
InitializeConditionVariable
WaitOnAddress
WakeByAddressAll
WakeConditionVariable
SleepConditionVariableSRW
InitOnceComplete
InitOnceExecuteOnce
api-ms-win-core-psapi-l1-1-0
K32GetModuleInformation
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-sysinfo-l1-1-0
GetVersionExW
GetSystemTimeAsFileTime
GetTickCount
GetComputerNameExW
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoGetCallContext
StringFromCLSID
xmllite
CreateXmlReader
CreateXmlReaderInputWithEncodingName
oleaut32
SafeArrayCreateVectorEx
SysFreeString
VariantInit
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayPutElement
SafeArrayGetVartype
SafeArrayGetElemsize
SafeArrayPtrOfIndex
VariantClear
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayRedim
SafeArrayGetLBound
SysAllocString
SysStringLen
SysAllocStringLen
SafeArrayCopy
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
api-ms-win-core-shlwapi-legacy-l1-1-0
PathIsUNCServerShareW
PathAppendW
PathFindExtensionW
PathStripPathW
PathRemoveFileSpecW
PathIsRelativeW
PathIsUNCServerW
api-ms-win-core-file-l1-1-0
GetFileAttributesW
GetFileAttributesExW
GetVolumePathNameW
GetDriveTypeW
CreateFileW
ntdll
RtlNtStatusToDosError
RtlDosPathNameToNtPathName_U_WithStatus
RtlDosPathNameToRelativeNtPathName_U_WithStatus
RtlFreeUnicodeString
NtSetInformationFile
NtCreateFile
RtlInitUnicodeStringEx
NtFsControlFile
NtQueryInformationFile
rpcrt4
RpcStringFreeW
UuidToStringW
api-ms-win-core-io-l1-1-0
GetOverlappedResult
DeviceIoControl
CancelIoEx
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
vmprox
GetVmErrInfo
SetVmErrInfo
bcrypt
BCryptHashData
BCryptOpenAlgorithmProvider
BCryptFinishHash
BCryptCreateHash
BCryptCloseAlgorithmProvider
BCryptDestroyHash
devobj
DevObjEnumDeviceInterfaces
DevObjGetDeviceInterfaceDetail
DevObjGetClassDevs
DevObjGetDeviceInstanceId
DevObjDestroyDeviceInfoList
DevObjEnumDeviceInfo
DevObjCreateDeviceInfoList
api-ms-win-core-kernel32-legacy-l1-1-0
GetComputerNameW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
288KB
Virtual Size
285KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
116KB
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
80B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=83, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1289, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33145,
count=5, id=259, version=33145,
count=31, id=261, version=33145,
count=1, id=256, version=33145,
count=27, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vmuidevices.dll
- IMPHASH 3c0df545e663d99e11b27c67cb1a6b75
- SHA256 e48bf88a70ce3cfabf8c58aa5edfb4e9c5d9821550a0a6d8ec68b54e97f5ebfb
- MD5 001f19978753366680d88ba9a395fc29
- SHA1 3d07333aa54cbfc5067d302779003feba57db1fa
- SHA512 66dd5b2cb2d3a51f4c542a366efaec7e7a4bfcc9f0345856b45f27a649446731ec78c22e44ddfb9dc1016101e30f09389426b73b89bf00c78f6d0cb702759603
- SSDEEP 12288:l4ugXm5g1knWjDgv0/3St/BwIINznVBPsgr20Nk3NHqLCzm6:9gXmfWjDgM/it/pOhCKLCzm6
- TLSH T1BBD44C5963A903E5E4B7E27CC9638519E5B278648371C7CF01A0826E1F67FE09D3E722
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
f4:2d:53:86:3b:95:39:8e:d7:ab:bb:a0:d6:f3:11:da:ff:72:47:c9:2f:e7:09:45:65:6d:a4:95:2d:4b:41:2d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A400-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:28:f0:a5:87:d7:f3:c8:1e:40:00:01:00:00:02:28
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
73072
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
VmUiDevices.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
_o__wcsicmp
memmove
_o_abort
_o_calloc
_o_ceilf
_o_free
_o_malloc
_o_terminate
_o_wcscpy_s
_o_wcstoull
__CxxFrameHandler3
__current_exception
__current_exception_context
_CxxThrowException
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
__RTtypeid
__AdjustPointer
_o__execute_onexit_table
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o__errno
_o___stdio_common_vsnwprintf_s
_o___std_type_info_name
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__C_specific_handler
__CxxFrameHandler4
__RTDynamicCast
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleW
FreeLibrary
GetProcAddress
GetModuleFileNameW
api-ms-win-core-synch-l1-1-0
ReleaseSemaphore
OpenSemaphoreW
EnterCriticalSection
WaitForSingleObjectEx
CreateSemaphoreExW
CreateMutexExW
CreateEventW
AcquireSRWLockShared
LeaveCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseMutex
DeleteCriticalSection
WaitForSingleObject
InitializeSRWLock
InitializeCriticalSectionEx
SetEvent
ResetEvent
ReleaseSRWLockShared
InitializeCriticalSection
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
SetLastError
RaiseException
UnhandledExceptionFilter
api-ms-win-core-registry-l1-1-0
RegDeleteKeyExW
RegCloseKey
RegSetValueExW
RegDeleteValueW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegGetValueW
RegCreateKeyExW
RegOpenKeyExW
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolThreadMaximum
CloseThreadpoolTimer
CloseThreadpool
CreateThreadpoolWork
SubmitThreadpoolWork
TrySubmitThreadpoolCallback
CreateThreadpoolIo
WaitForThreadpoolTimerCallbacks
CloseThreadpoolIo
StartThreadpoolIo
CancelThreadpoolIo
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
OpenProcessToken
api-ms-win-core-rtlsupport-l1-1-0
RtlPcToFileHeader
RtlVirtualUnwind
RtlCaptureContext
RtlCaptureStackBackTrace
RtlLookupFunctionEntry
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventActivityIdControl
EventUnregister
EventRegister
EventEnabled
EventSetInformation
EventWrite
api-ms-win-core-synch-l1-2-0
InitializeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
Sleep
SleepConditionVariableCS
WakeByAddressAll
WaitOnAddress
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-psapi-l1-1-0
K32GetModuleInformation
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTime
GetSystemTimeAsFileTime
GetComputerNameExW
GetVersionExW
api-ms-win-core-com-l1-1-0
CoCreateInstance
StringFromCLSID
CoTaskMemFree
CoTaskMemAlloc
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-core-interlocked-l1-1-0
InterlockedPushEntrySList
InterlockedFlushSList
InterlockedPopEntrySList
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
GetCurrentProcessorNumberEx
IsProcessorFeaturePresent
vmbuspiper
VmbusPipeServerConnectPipe
VmbusPipeServerOfferChannel
vmprox
SetVmErrInfo
oleaut32
SafeArrayCreateVectorEx
SafeArrayGetUBound
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetLBound
SysStringLen
SafeArrayDestroy
SysFreeString
xmllite
CreateXmlReader
CreateXmlReaderInputWithEncodingName
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
api-ms-win-core-shlwapi-legacy-l1-1-0
PathIsUNCServerW
PathIsUNCServerShareW
mpr
WNetGetResourceInformationW
api-ms-win-core-file-l1-1-0
ReadFile
WriteFile
GetFileAttributesW
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
ntdll
RtlDecompressBufferEx
RtlInitUnicodeString
NtOpenFile
api-ms-win-core-io-l1-1-0
GetOverlappedResult
DeviceIoControl
CancelIoEx
api-ms-win-security-base-l1-1-0
MakeAbsoluteSD
SetSecurityDescriptorDacl
SetKernelObjectSecurity
GetSecurityDescriptorControl
GetTokenInformation
GetLengthSid
CopySid
InitializeSecurityDescriptor
CreateWellKnownSid
api-ms-win-security-provider-l1-1-0
SetEntriesInAclW
api-ms-win-security-sddl-l1-1-0
ConvertStringSidToSidW
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
ws2_32
setsockopt
WSASocketW
WSAStartup
bind
closesocket
WSAIoctl
WSADuplicateSocketW
crypt32
CertCompareCertificateName
CertOpenStore
CertGetNameStringW
CertFindCertificateInStore
CertGetCertificateChain
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CryptAcquireCertificatePrivateKey
CertCloseStore
CertFreeCertificateChain
CertVerifySubjectCertificateContext
CertFreeCertificateContext
CertVerifyCertificateChainPolicy
api-ms-win-core-kernel32-legacy-l1-1-0
SetFileCompletionNotificationModes
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
api-ms-win-security-base-l1-2-0
CheckTokenMembershipEx
authz
AuthzAccessCheck
AuthzInitializeContextFromToken
AuthzFreeContext
AuthzFreeResourceManager
AuthzInitializeResourceManager
api-ms-win-core-perfcounters-l1-1-0
PerfIncrementULongCounterValue
PerfSetULongCounterValue
PerfStopProvider
PerfSetCounterSetInfo
PerfDeleteInstance
PerfSetCounterRefValue
PerfCreateInstance
PerfStartProvider
api-ms-win-security-cryptoapi-l1-1-0
CryptReleaseContext
ncrypt
NCryptFreeObject
bcrypt
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
352KB
Virtual Size
349KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
164KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
36KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=33145,
count=101, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1310, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=6, id=259, version=33145,
count=31, id=261, version=33145,
count=1, id=256, version=33145,
count=58, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vmusrv.dll
- IMPHASH abec358f4d0ed2e5304e06c8a50d54c9
- SHA256 8e7cdb71da6851c89b1eb3bcbda7723284dc0a28abccaaf88029e7fc18c5f7ca
- MD5 d5605d946c6ec1a213ecd3e2537cff92
- SHA1 eb1e43efbe0675296138580598f2f2c7a0fc2b29
- SHA512 bfd92ffe02587501f6547fc4bd9bcf282ebf71c7a8ff95de56714d187d3eec7b19ff78ce2393fa41ea1e4fc69e51e937d8d296557819db8d50d94d80fc3a2972
- SSDEEP 12288:AvVswBOQfwG9kPx/BQ6Vx2O1BHJG4eXsRx2ATbN9sDsjflqMTviQ8PTPlYEPMo6q:kxfwYC/du+qrlMwHvpbDMB9xAIL5mFGc
- TLSH T1FDF47D3D629621D8D83FD07DCA838226FEB17850432666DB49A04A654F3BFF4B53EB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ba:0a:66:82:5d:64:85:77:02:41:66:53:20:34:cf:ef:5e:4f:cb:8e:fd:e0:e0:78:98:52:24:af:08:fd:c1:1a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:23:4f:d9:60:24:53:cf:fe:2b:00:01:00:00:02:23
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
309184
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vmusrv.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsnicmp
_o_abort
_o_calloc
_o_ceilf
_o_free
_o_malloc
_o_terminate
_o_wcstod
__C_specific_handler
__current_exception
__current_exception_context
_CxxThrowException
_o__cexit
_o__callnewh
_o__aligned_malloc
_o__aligned_free
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___std_type_info_destroy_list
_o__execute_onexit_table
_o___std_exception_destroy
_o___std_exception_copy
_o__errno
__AdjustPointer
__CxxFrameHandler3
_o__crt_atexit
_o__configure_narrow_argv
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
GetModuleFileNameA
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
AcquireSRWLockShared
SetEvent
ReleaseSRWLockShared
CreateMutexExW
InitializeSRWLock
CreateEventW
LeaveCriticalSection
OpenSemaphoreW
WaitForSingleObjectEx
EnterCriticalSection
CreateEventExW
DeleteCriticalSection
ReleaseMutex
InitializeCriticalSectionEx
WaitForSingleObject
InitializeCriticalSection
ReleaseSemaphore
TryAcquireSRWLockShared
ReleaseSRWLockExclusive
CreateSemaphoreExW
ResetEvent
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetLastError
SetUnhandledExceptionFilter
RaiseException
GetLastError
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
ResumeThread
TerminateProcess
CreateThread
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventWriteTransfer
EventSetInformation
EventUnregister
EventActivityIdControl
api-ms-win-core-synch-l1-2-0
WaitOnAddress
WakeByAddressAll
SleepConditionVariableSRW
WakeAllConditionVariable
InitOnceBeginInitialize
InitOnceComplete
Sleep
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolCleanupGroupMembers
SetThreadpoolThreadMinimum
SetThreadpoolThreadMaximum
StartThreadpoolIo
CloseThreadpoolCleanupGroup
TrySubmitThreadpoolCallback
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolIo
CloseThreadpool
CreateThreadpoolCleanupGroup
WaitForThreadpoolIoCallbacks
CancelThreadpoolIo
CloseThreadpoolIo
CreateThreadpoolWait
CloseThreadpoolWait
CreateThreadpool
SetThreadpoolWait
api-ms-win-core-perfcounters-l1-1-0
PerfStartProviderEx
PerfCreateInstance
PerfSetCounterSetInfo
PerfSetCounterRefValue
PerfStopProvider
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlPcToFileHeader
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
ntdll
NtReadFile
NtDeviceIoControlFile
NtCreateWaitCompletionPacket
RtlMapGenericMask
NtSetVolumeInformationFile
NtQueryVolumeInformationFile
NtQueryInformationFile
NtQuerySecurityObject
RtlLengthSecurityDescriptor
NtQueryEaFile
NtSetEaFile
NtSetInformationFile
NtNotifyChangeDirectoryFile
RtlCopyUnicodeString
NtCreateSection
NtQuerySection
NtLockFile
NtUnlockFile
NtCreateEvent
NtWaitForSingleObject
NtFlushBuffersFile
NtQueryDirectoryFile
NtDuplicateObject
NtCreateFile
NtAssociateWaitCompletionPacket
RtlAppendUnicodeToString
RtlInitUnicodeString
RtlEqualUnicodeString
NtCancelIoFileEx
NtWriteFile
NtClose
DbgPrint
RtlValidRelativeSecurityDescriptor
RtlCompareUnicodeString
RtlNtStatusToDosError
NtQuerySystemTime
RtlNtStatusToDosErrorNoTeb
NtOpenFile
RtlGUIDFromString
NtOpenSection
NtFsControlFile
api-ms-win-core-io-l1-1-0
CreateIoCompletionPort
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
CancelIoEx
GetOverlappedResult
DeviceIoControl
api-ms-win-core-registry-l1-1-0
RegGetValueW
rpcrt4
UuidCreate
bcrypt
BCryptDuplicateHash
BCryptGetProperty
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptHashData
BCryptOpenAlgorithmProvider
BCryptCreateHash
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
vmbuspiper
VmbusPipeServerConnectPipe
VmusrvAddShare
VmusrvCleanup
VmusrvEnginePause
VmusrvEngineRestore
VmusrvEngineResume
VmusrvEngineSave
VmusrvEngineStop
VmusrvInitialize
VmusrvOpenFile
VmusrvRemoveShare
VmusrvSupportsPause
VmusrvUpdateShareAllowedFileList
Name
.text
Size
512KB
Virtual Size
510KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
140KB
Virtual Size
136KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
24KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
992B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=33145,
count=59, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1246, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=30, id=261, version=33145,
count=1, id=256, version=33145,
count=83, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vmvirtio.dll
- IMPHASH 5be5e6c798f56d2f9d4075cc95e87b5f
- SHA256 1ad6be6174da5ddc7dc6b081385fca692c78f390f1f714d5c7a08afcba3fb934
- MD5 a23dabc284928b810df1e8c8cad840c6
- SHA1 f2e3fad240a9893dfb050d5cbc4dcd3a5280c45b
- SHA512 c56875a7c03aefbe0d21094170bb07808a6eddbae44dc25d0d9f6af5f6e66467d14d04c3d8860c303c11395f63fa63fe95079ba269e3c1386e0f7a01373bb915
- SSDEEP 3072:odXGfJ9hVqXQCWI/ur7Vp9KMK5MgvSl4rK0CKwMgRS:nfJpqXQRF9A6mrKls
- TLSH T173F35A6A369C00B6E57AE13CC9878A0AF7B37461171163CF0290827D1F67BE86E3DB55
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
be:d5:0d:2e:a8:2f:96:df:07:72:4a:78:9b:e7:14:2e:d0:1d:fc:de:f7:1f:8f:c9:18:f3:7d:70:c1:b2:c5:b5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:3605-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:13:b0:43:35:66:cf:af:95:e8:00:01:00:00:02:13
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
7360
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vmvirtio.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_abort
_o_free
_o_malloc
_o_terminate
_o_wcstod
__CxxFrameHandler3
__current_exception
__current_exception_context
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
__std_terminate
__C_specific_handler
__CxxFrameHandler4
__RTDynamicCast
memcmp
memcpy
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_CxxThrowException
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA
GetProcAddress
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
ReleaseSemaphore
CreateEventExW
SetEvent
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
CreateSemaphoreExW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseMutex
WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
CallbackMayRunLong
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolWait
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventSetInformation
EventRegister
EventWriteTransfer
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
VirtioCompleteWorkCallbackAsync
VirtioCreateInstance
VirtioDeleteInstance
VirtioDisableQueues
VirtioEnableQueues
VirtioGetDriverFeatures
VirtioGetPciPnpId
VirtioMemoryStreamAdvance
VirtioMemoryStreamGetCurrentReadSpanLength
VirtioMemoryStreamGetCurrentWriteSpanLength
VirtioMemoryStreamGetNextReadBuffer
VirtioMemoryStreamGetNextWriteBuffer
VirtioMemoryStreamRead
VirtioMemoryStreamWrite
VirtioPauseQueues
VirtioReadConfigSpace
VirtioReadInterceptedBar
VirtioRestoreQueues
VirtioResumeQueues
VirtioSaveQueues
VirtioWriteConfigSpace
VirtioWriteInterceptedBar
Name
.text
Size
96KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=47, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1147, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=23, id=261, version=33145,
count=1, id=256, version=33145,
count=14, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vmvpci.dll
- IMPHASH b5a957729848f6aa0616665d3e564044
- SHA256 a200d27ac687783007a23856b5343e4a6612dbb7f76732affa921bb7627436c4
- MD5 a6c3deecc181c6654d70a5b947d6d3bb
- SHA1 0711bba4867faa08b74932f3aa7163ab489dcccc
- SHA512 45adce5d32c6c79d16a54e78b7d1e775e115251d7e65190b8bc47dbe3b5a4a85554da13b6a9786043e89190a4c9548e67e0a09744f1b266818b23b554622cb8b
- SSDEEP 6144:Ok0ZNhwvZgT9imcO3GC4w4b2NfvVvrz3C9M0/MSXvM0CXd90w4kwEw:WZNhwvnmV3GC4IvVvvC9M00C4p4kwE
- TLSH T11DA46C5EE66C00E4E176D07CCE678A06E67274590321A6CB22A4D27D1F2BFF86D3E750
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
11264
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vmvpci.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
memmove
_o_abort
_o_calloc
_o_free
_o_malloc
_o_terminate
_o_wcscpy_s
_o_wcstod
__CxxFrameHandler3
__current_exception
__current_exception_context
_CxxThrowException
_o__configure_narrow_argv
_o__execute_onexit_table
_o__cexit
_o__errno
_o__callnewh
_o__beginthreadex
_o__aligned_malloc
_o__aligned_free
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__AdjustPointer
__std_terminate
__C_specific_handler
__CxxFrameHandler4
_o__crt_atexit
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameW
GetProcAddress
api-ms-win-core-synch-l1-1-0
SetEvent
ReleaseMutex
AcquireSRWLockExclusive
ResetEvent
WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection
WaitForSingleObjectEx
InitializeCriticalSection
ReleaseSRWLockShared
CreateEventExW
CreateEventW
ReleaseSemaphore
CreateMutexExW
EnterCriticalSection
AcquireSRWLockShared
DeleteCriticalSection
CreateSemaphoreExW
InitializeSRWLock
OpenSemaphoreW
ReleaseSRWLockExclusive
InitializeCriticalSectionAndSpinCount
api-ms-win-core-synch-l1-2-0
InitOnceComplete
SleepConditionVariableSRW
WakeAllConditionVariable
WaitOnAddress
InitOnceBeginInitialize
WakeByAddressAll
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
RaiseException
GetLastError
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureStackBackTrace
RtlLookupFunctionEntry
RtlCaptureContext
RtlPcToFileHeader
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventRegister
EventActivityIdControl
EventWrite
EventWriteTransfer
EventEnabled
EventUnregister
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegCloseKey
RegGetValueW
RegQueryValueExW
RegDeleteKeyExW
RegOpenKeyExW
RegCreateKeyExW
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolWait
CloseThreadpoolWork
SubmitThreadpoolWork
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SetThreadpoolWait
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolWaitCallbacks
CloseThreadpoolTimer
StartThreadpoolIo
WaitForThreadpoolTimerCallbacks
CreateThreadpoolIo
CloseThreadpoolWait
WaitForThreadpoolIoCallbacks
CancelThreadpoolIo
CloseThreadpoolIo
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-psapi-l1-1-0
K32GetModuleInformation
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-com-l1-1-0
CoGetObjectContext
CoTaskMemFree
StringFromCLSID
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
oleaut32
SysAllocString
ntdll
RtlCmDecodeMemIoResource
NtOpenFile
RtlDecompressBufferEx
RtlCmEncodeMemIoResource
api-ms-win-core-realtime-l1-1-0
QueryUnbiasedInterruptTime
devobj
DevObjDestroyDeviceInfoList
DevObjOpenDeviceInfo
DevObjCreateDeviceInfoList
DevObjGetDeviceProperty
api-ms-win-core-io-l1-1-0
GetOverlappedResult
DeviceIoControl
CancelIoEx
api-ms-win-core-file-l1-1-0
CreateFileW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
300KB
Virtual Size
296KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
92KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=67, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1207, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=33, id=261, version=33145,
count=7, id=259, version=33145,
count=1, id=256, version=33145,
count=38, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vmwpctrl.dll
- IMPHASH 314a7ab7262912084b8cf2a9798a299e
- SHA256 dd32af477080e825dc280effbfdb02175fd515341fbb3ca0af47be8eb4b030f9
- MD5 b052dae9a075f597da5225c71fab7de9
- SHA1 3617ea5048dbf947397164755f9a52efb79525f4
- SHA512 3cd855967386336765a68841265e220430463acf26f036795fa368a36755c8b2b47ae172364fd663686ac9ff69f018e912c47b52cb901066e77b9f9a7e719b29
- SSDEEP 1536:Mo/qCWEr2OphyZmiFK8j1VZUHUxqsHbc+pPwuITwPYGG7d49iy5kpLd2v1JlP/Sz:MoSzwpRB8r6s7cQ4KOh491ALkv3l3S
- TLSH T1A9C34A3D366820B5E172913CC9924605E7B1B86623215BFF02D1D2BD1F23BE1AD39F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
cc:7d:73:4f:70:a8:8b:af:9e:43:b8:20:f7:75:78:fa:0e:a8:2e:ae:e2:78:53:94:4b:52:ef:32:be:93:ce:db
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:7F00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1e:a3:ac:a4:6e:39:6f:7c:49:00:01:00:00:02:1e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
5840
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vmwpctrl.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o_free
_o_malloc
__CxxFrameHandler3
_CxxThrowException
_o___stdio_common_vswprintf_s
_o___std_type_info_destroy_list
_o__cexit
_o___std_exception_destroy
_o___std_exception_copy
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
__std_terminate
__C_specific_handler
__CxxFrameHandler4
memcmp
memmove
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleHandleExW
GetModuleHandleW
GetModuleFileNameW
GetModuleFileNameA
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSemaphore
InitializeCriticalSectionEx
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
InitializeSRWLock
CreateSemaphoreExW
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
LeaveCriticalSection
ReleaseSRWLockShared
WaitForSingleObject
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegGetValueW
RegOpenKeyExW
RegCloseKey
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CloseThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlPcToFileHeader
RtlVirtualUnwind
RtlCaptureStackBackTrace
RtlLookupFunctionEntry
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-eventing-provider-l1-1-0
EventEnabled
EventRegister
EventSetInformation
EventUnregister
EventWrite
api-ms-win-core-psapi-l1-1-0
K32GetModuleInformation
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
SleepConditionVariableSRW
InitOnceComplete
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-security-base-l1-1-0
CopySid
CreateRestrictedToken
CreateWellKnownSid
InitializeSid
GetSidLengthRequired
AllocateLocallyUniqueId
FreeSid
GetTokenInformation
SetTokenInformation
GetSidSubAuthority
AdjustTokenPrivileges
GetLengthSid
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
userenv
CreateAppContainerProfile
DeleteAppContainerProfile
DeriveAppContainerSidFromAppContainerName
rpcrt4
UuidIsNil
sspicli
LogonUserExExW
api-ms-win-security-lsalookup-l1-1-0
LookupAccountSidLocalW
api-ms-win-security-lsalookup-l2-1-0
LookupPrivilegeValueW
api-ms-win-security-provider-l1-1-0
SetEntriesInAclW
api-ms-win-security-base-private-l1-1-1
CreateAppContainerToken
api-ms-win-security-sddl-l1-1-0
ConvertStringSidToSidW
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
combase
ord139
AllocateVmWorkerProcessCapabilities
CreateVmWorkerProcessToken
FreeWorkerProcessCapabilities
GetAppContainerName
GetVmWorkerProcess
Name
.text
Size
60KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
288B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=69, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1167, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=24, id=261, version=33145,
count=1, id=256, version=33145,
count=8, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vmwpevents.dll
- SHA256 55dccad544d9e6ec807cc2d56a377b6e4c78d176e1234b381861d88648031030
- MD5 a5ae034cf50cd32e5e4c91b2d82e44e7
- SHA1 eeca44bdf8107df92d7c933beb2d630f3d10ccad
- SHA512 913ed7efedbf96c0ad53fb661d7884226cdcc1e2952974917333fe55f84e5a8ba973a60415913280b9825fd30385f21cceda72cba541d926aac8eb2af39c4c5c
- SSDEEP 768:hf26P0Of1ehHt+I7hHt+xPC5uoxV9eYxTyNtC99WmkyNjbnf8jiMPazA+YCZDtRe:hvyXFHLru7t8/2L9asCeIP6zP
- TLSH T1EED3AB00A7ECC212F8B70F74D9BB9FA27A72F9516DA1855F6BB1532D0874750CE2063A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
25:60:15:5b:dd:13:14:80:e1:52:0a:e5:d9:30:bd:45:49:14:32:97:39:c4:30:b3:10:49:2a:4c:c0:af:26:d9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 27, 2025
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:18:41:84:19:ad:cb:ad:29:4f:00:00:00:00:05:18
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 19, 2025 - Jun 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6F1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:fc:18:a0:af:cc:69:5a:87:3a:00:01:00:00:01:fc
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
4KB
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
112KB
Virtual Size
109KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vp9fs.dll
- IMPHASH 206b32650a6283d9066317740157517a
- SHA256 b6a44ae59bb5ebadbfd4f35acdea3d83185eeb8bb0ae26100f79608701373c38
- MD5 7355a9f400fa75496f7f8463afe5b473
- SHA1 acd8e28bc7db94a553651eedba393d223e548664
- SHA512 d5f7e5f1d578a999cd82b9b492f2ec8ca74551723087feb8e326f9492b5740541447c50d8314bb4f3ef9f751021e7ca9c99c6c3b068814b3aad9bcb4bcf4247a
- SSDEEP 6144:97hQxTJC0BqMoXlXp0dOV6/4oJCYY1ZvJhE2:97hQxcFXlXpmOI/4oqbS2
- TLSH T1A6645C2D72AC08F5E97AD07D8983C90AF7B270650362C6DB0690C2796F5BFE4A53DB50
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
34:d7:18:5f:8d:b4:a9:7e:0b:7a:cc:7d:f5:40:aa:28:a7:98:a9:ef:36:4c:e7:47:e3:42:1e:47:33:9a:96:78
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:591A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:14:8d:cd:23:44:ee:06:df:72:00:01:00:00:02:14
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
13600
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vp9fs.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_abort
_o_free
_o_iswalpha
_o_malloc
_o_strtoul
_o_terminate
_o_towlower
__current_exception
__AdjustPointer
__CxxFrameHandler3
_CxxThrowException
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__C_specific_handler
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
GetModuleFileNameA
api-ms-win-core-synch-l1-1-0
WaitForSingleObjectEx
OpenSemaphoreW
LeaveCriticalSection
ReleaseSemaphore
AcquireSRWLockExclusive
CreateSemaphoreExW
EnterCriticalSection
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
WaitForSingleObject
ReleaseSRWLockShared
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
ReleaseMutex
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
SetLastError
SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter
GetLastError
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CreateThreadpoolTimer
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
WaitForThreadpoolTimerCallbacks
CloseThreadpoolWork
CloseThreadpoolTimer
StartThreadpoolIo
CancelThreadpoolIo
WaitForThreadpoolIoCallbacks
CloseThreadpoolIo
CreateThreadpoolIo
DisassociateCurrentThreadFromCallback
CreateThreadpoolWork
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-rtlsupport-l1-1-0
RtlPcToFileHeader
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
SleepConditionVariableSRW
InitOnceComplete
WakeAllConditionVariable
InitOnceExecuteOnce
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventSetInformation
EventWriteTransfer
EventRegister
api-ms-win-core-file-l1-1-0
FlushFileBuffers
ReadFile
WriteFile
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
ntdll
NtCreateFile
NtFsControlFile
NtSetInformationFile
NtCreateEvent
NtClose
NtDeviceIoControlFile
NtOpenDirectoryObject
RtlDosPathNameToNtPathName_U_WithStatus
RtlFreeHeap
RtlGUIDFromString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
NtQueryInformationFile
ws2_32
socket
setsockopt
WSASend
WSARecv
getsockname
closesocket
WSACleanup
WSAStartup
WSASocketW
bind
listen
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
api-ms-win-core-file-l1-2-0
GetVolumePathNamesForVolumeNameW
mswsock
AcceptEx
api-ms-win-core-io-l1-1-0
CancelIoEx
api-ms-win-core-kernel32-legacy-l1-1-0
SetFileCompletionNotificationModes
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
lxutil
LxUtilFsReadLinkLength
LxUtilFsRename
LxUtilFsQueryStatLxInformationByName
LxUtilFsCreateRenameInformation
LxUtilXattrRemove
LxUtilXattrGet
LxUtilXattrSet
LxUtilXattrList
LxUtilFsInitialize
LxUtilNtPathToLxPath
LxUtilNtStatusToLxError
LxUtilDirectoryEnumeratorCleanup
LxUtilFsCreateLinkReparseBuffer
LxUtilFsReadReparseLink
LxUtilFsReadAppExecLink
LxUtilFsDeleteFile
LxUtilFsIsAppExecLink
LxUtilFsChmod
LxUtilFsFileModeToReparseTag
LxUtilFsDetermineCreationInfo
LxUtilSymlinkRead
LxUtilFsSetTimes
LxUtilNtFileNameEscapeInPlace
LxUtilFsGetLxAttributes
LxUtilFsQueryStatLxInformation
LxUtilFsCreateNtLinkReparseBuffer
LxUtilFsGetLxFileSystemAttributes
LxUtilTranslateWidePathToLxPath
LxUtilFsTruncate
LxUtilFsReadDir
LxUtilFsDeleteReadOnlyFile
LxUtilFsConvertMode
LxUtilFsDeleteFileCore
LxUtilFsUpdateLxAttributes
LxUtilNtPathEscapeInPlace
LxUtilFsCreateMetadataEaBuffer
LxUtilFsGetFileSystemBlockSize
vmvirtio
VirtioMemoryStreamGetCurrentWriteSpanLength
VirtioDeleteInstance
VirtioReadConfigSpace
VirtioMemoryStreamWrite
VirtioReadInterceptedBar
VirtioEnableQueues
VirtioCompleteWorkCallbackAsync
VirtioWriteInterceptedBar
VirtioPauseQueues
VirtioResumeQueues
VirtioCreateInstance
VirtioGetPciPnpId
VirtioWriteConfigSpace
VirtioMemoryStreamRead
VirtioMemoryStreamGetCurrentReadSpanLength
vmdevicehost
HdvCreateDeviceInstance
HdvInitializeDeviceHostForProxy
HdvCreateGuestMemoryAperture
HdvDestroyGuestMemoryAperture
HdvTeardownDeviceHost
HdvDeliverGuestInterrupt
CreatePlan9FileSystem
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
212KB
Virtual Size
209KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
64KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=257, version=33145,
count=65, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1251, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33145,
count=5, id=259, version=33145,
count=26, id=261, version=33145,
count=1, id=256, version=33145,
count=23, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vpnike.dll
- IMPHASH 0a85e24276f399bcead376615c8ce726
- SHA256 47548983b046e7e3cdee3b320e82a7f6f04c71f3059ba49d684c0ff27a8f7ebb
- MD5 f7e24557247d3dcfd464bcff436947d0
- SHA1 2c1d5417fb768bf8e776ea7a97883e8457456dd7
- SHA512 b5d72de538974df2ef7312371f3b197ceec96a67d150eb4b811c487e6575ce0cf4dc74da0a350f1b63672cb33b52285293a2759c85dc9f49788949f1d41a3131
- SSDEEP 12288:LMspKMAGDaIO7IEG0OF7AZEJFOxg+vIeD:LMslNDaI0IE5OyYFOxgte
- TLSH T173F4F629A3F90194F0B697789D779225EA727C193B30C5DF1060842E6F62FE05E79B32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
6176
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vpnike.pdb
msvcrt
_itow_s
wcsstr
_wcslwr
atol
_strnicmp
atoi
mbstowcs
strtok
memcmp
memcpy
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
__CxxFrameHandler3
_CxxThrowException
_callnewh
??0exception@@QEAA@AEBQEBDH@Z
malloc
free
strstr
wcsncpy
_itoa_s
strchr
wcschr
??0exception@@QEAA@AEBQEBD@Z
?what@exception@@UEBAPEBDXZ
memmove_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
memcpy_s
_vsnwprintf
_purecall
_vsnprintf
_stricmp
__CxxFrameHandler4
memset
fwpuclnt
FwpmIPsecTunnelDeleteByKey0
FwpmProviderContextGetByKey3
FwpmEngineSetOption0
FwpmIPsecTunnelAdd2
IPsecSaContextCreateEnumHandle0
IkeextSaDeleteById0
IkeextSaUpdateAdditionalAddressesByTunnelId0
FwpmEngineOpen0
IkeextSaEnum2
FwpmFreeMemory0
FwpmNetEventUnsubscribe0
FwpmNetEventSubscribe4
IPsecSaContextDestroyEnumHandle0
IPsecSaInitiateAsync0
FwpmProviderContextCreateEnumHandle0
IPsecSaContextEnum1
FwpmEngineClose0
IkeextSaDestroyEnumHandle0
IkeextSaCreateEnumHandle0
FwpmProviderContextEnum3
FwpmEngineGetOption0
IkeextSaUpdatePreferredAddressesByTunnelId0
ntdll
RtlPublishWnfStateData
RtlIpv4StringToAddressW
RtlIpv6StringToAddressW
RtlNtStatusToDosError
EtwTraceMessage
RtlQueueWorkItem
NtQueryInformationToken
RtlTimeToSecondsSince1970
RtlLocalTimeToSystemTime
RtlTimeFieldsToTime
RtlIpv4AddressToStringW
RtlIpv6AddressToStringW
RtlIpv4AddressToStringA
RtlIpv6AddressToStringA
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlIpv6StringToAddressA
api-ms-win-core-threadpool-l1-2-0
SubmitThreadpoolWork
SetThreadpoolThreadMaximum
WaitForThreadpoolWorkCallbacks
CreateThreadpoolCleanupGroup
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolWork
SetThreadpoolTimer
CloseThreadpoolTimer
CloseThreadpool
CreateThreadpool
SetThreadpoolThreadMinimum
CloseThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
CreateThreadpoolWork
api-ms-win-core-heap-l1-1-0
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceLoggerHandle
GetTraceEnableFlags
UnregisterTraceGuids
TraceMessage
GetTraceEnableLevel
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventSetInformation
EventRegister
EventUnregister
api-ms-win-core-synch-l1-1-0
WaitForSingleObject
EnterCriticalSection
ReleaseSemaphore
LeaveCriticalSection
ResetEvent
SetEvent
CreateSemaphoreExW
InitializeCriticalSectionEx
AcquireSRWLockShared
CreateMutexExW
ReleaseMutex
InitializeCriticalSectionAndSpinCount
ReleaseSRWLockShared
CreateEventA
OpenSemaphoreW
DeleteCriticalSection
InitializeCriticalSection
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
api-ms-win-core-registry-l1-1-0
RegDeleteValueW
RegQueryInfoKeyW
RegSetValueExW
RegQueryValueExA
RegCreateKeyExW
RegOpenKeyExW
RegGetValueW
RegOpenKeyExA
RegQueryValueExW
RegCloseKey
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetModuleHandleExA
DisableThreadLibraryCalls
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
iphlpapi
ConvertInterfaceLuidToIndex
GetBestInterfaceEx
ConvertInterfaceIndexToLuid
ConvertInterfaceLuidToGuid
ConvertInterfaceGuidToLuid
GetIpAddrTable
GetIfEntry2
SetCurrentThreadCompartmentId
GetUnicastIpAddressEntry
SetIpForwardEntry
DeleteIpForwardEntry
GetIpForwardTable
GetPerAdapterInfo
GetAdaptersInfo
CancelMibChangeNotify2
NotifyUnicastIpAddressChange
ConvertIpv4MaskToLength
GetCurrentThreadCompartmentId
GetAdaptersAddresses
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-file-l1-1-0
CreateFileA
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-processthreads-l1-1-0
OpenProcessToken
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-heap-l2-1-0
LocalReAlloc
LocalAlloc
LocalFree
rpcrt4
RpcRaiseException
RpcAsyncCompleteCall
UuidCreate
RpcServerRegisterAuthInfoA
I_RpcBindingIsClientLocal
RpcServerUnregisterIf
RpcServerRegisterIfEx
RpcImpersonateClient
RpcRevertToSelf
RpcServerUseProtseqEpA
NdrServerCall2
NdrAsyncServerCall
NdrServerCallAll
Ndr64AsyncServerCallAll
api-ms-win-security-base-l1-1-0
ImpersonateLoggedOnUser
CheckTokenMembership
api-ms-win-core-sysinfo-l1-1-0
GetLocalTime
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-security-lsalookup-l2-1-0
LookupAccountNameW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-threadpool-legacy-l1-1-0
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
api-ms-win-core-kernel32-legacy-l1-1-0
GetComputerNameA
rtutils
RouterLogEventA
TracePrintfExA
TraceDeregisterExA
TraceRegisterExA
TraceDeregisterA
TraceVprintfExA
eappprxy
EapHostPeerEndSession
EapHostPeerSetUIContext
EapHostPeerGetResult
EapHostPeerGetSendPacket
EapHostPeerGetUIContext
EapHostPeerGetResponseAttributes
EapHostPeerBeginSession
EapHostPeerProcessReceivedPacket
EapHostPeerClearConnection
EapHostPeerFreeEapError
EapHostPeerSetResponseAttributes
rasapi32
RasUpdateConnection
RasSetEapUserDataAEx
rasman
RasSendProtocolResultToRasman
RasDeviceGetInfo
RasSetTunnelEndPoints
RasPortGetStatisticsEx
RasDeAllocateRoute
RasGetKey
RasPortGetBundle
RasInitializeNoWait
RasSetPortUserData
RasAllocInterfaceLuidIndex
RasFreeInterfaceLuidIndex
RasUpdateDefaultRouteSettings
RasAllocateRoute
RasProtocolStarted
RasSetConnectionUserData
RasActivateRoute
RasGetTimeSinceLastActivity
RasGetPortUserData
rasmans
NlmGetBestCostNetworkConnection
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-registry-l2-1-0
RegEnumKeyW
RegCreateKeyW
api-ms-win-core-string-obsolete-l1-1-0
lstrlenW
InitializeProtocolEngine
InitializeServerProtocolEngine
SendMessageToProtocolEngine
UninitializeProtocolEngine
UninitializeServerProtocolEngine
VpnIkeRoamToBestCostInterface
Name
.text
Size
496KB
Virtual Size
492KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
188KB
Virtual Size
186KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
352B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=74, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=17, id=260, version=33145,
count=5, id=259, version=33145,
count=362, id=1, productName=Unmarked objects,
count=17, id=257, version=33145,
count=6, id=261, version=33145,
count=1, id=256, version=33145,
count=80, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
vpnikeapi.dll
- IMPHASH 3f2364da6c1e89ecb1179551a3bfe832
- SHA256 4062772f2b832bb1709ce74e5779a2349463768904174cc1d9ebae9fcba420ba
- MD5 133af834a4d28d99f08ad675308f1cfc
- SHA1 104766f517cba0e22c6c8a01f742ee703d04065c
- SHA512 bb3393ae5394e791bcea4b1a12a6287e4640009fd492f9340b08dbc99c6901deff2ee3f2fb4a7853a445fd20ac6bace7f8dcf2dd2210f76c94a9f7185491b436
- SSDEEP 768:ElzNhM/9Ng6/XLjMwVLklR42CAjwEOvGpoyas6/vz4vdz:ON0gu5kl9C8fOvV50vdz
- TLSH T18783C839D3E82060D5B79A75C9B71A34CA74B8285F6142DF4B60C61E9F63BE14B30F62
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
6272
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vpnikeapi.pdb
msvcrt
_initterm
malloc
free
_amsg_exit
_vsnwprintf
_XcptFilter
__C_specific_handler
memset
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
api-ms-win-eventing-classicprovider-l1-1-0
UnregisterTraceGuids
GetTraceEnableFlags
TraceMessage
GetTraceEnableLevel
GetTraceLoggerHandle
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventWriteTransfer
EventRegister
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-security-base-l1-1-0
FreeSid
AllocateAndInitializeSid
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
CancelProcessEapAuthPacket
CloseTunnel
CreateTunnel
FreeConfigurationPayloadBuffer
FreeEapAuthAttributes
FreeEapAuthPacket
FreeIDPayloadBuffer
FreeTrafficSelectors
GetConfigurationPayloadRequest
GetIDPayload
GetOptionalIDrPayload
GetServerEapAuthRequestPacket
GetTrafficSelectorsRequest
NewRasIncomingCall
ProcessAdditionalAddressNotification
ProcessConfigurationPayloadReply
ProcessConfigurationPayloadRequest
ProcessEapAuthPacket
ProcessTrafficSelectorsReply
ProcessTrafficSelectorsRequest
QueryEapAuthAttributes
RemoveTrafficSelectors
TunnelAuthDone
UpdateTunnel
Name
.text
Size
28KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
552B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=28, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=15, id=260, version=33145,
count=4, id=259, version=33145,
count=76, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=1, id=256, version=33145,
count=10, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,