Predictablefuture-AI.zip
- SHA256 d9dff0b7d479433587bec7d55a4d16570cca62178bdf9486c8ab5817a8b8c537
Overview
overview
4Static
static
3main modul...AI.exe
windows10-2004-x64
4main modul...AI.exe
windows11-ltsc_2024-x64
1main modul...47.dll
windows10-2004-x64
1main modul...er.dll
windows10-2004-x64
1main module/dxil.dll
windows10-2004-x64
1main module/dxil.dll
windows11-ltsc_2024-x64
1main modul...ol.dll
windows10-2004-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
main module/Main Startup AI.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
main module/Main Startup AI.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
main module/d3dcompiler_47.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
main module/dxcompiler.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
main module/dxil.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
main module/dxil.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
main module/winspool.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target Predictablefuture-AI.zip
- Size 20.7MB
- Sample260905-ahcelssgre
- SHA256 d9dff0b7d479433587bec7d55a4d16570cca62178bdf9486c8ab5817a8b8c537
- MD5 0439c7d9f91b96550f2adcc820962bd7
- SHA1 b34fce68fc9f5145b1a90a9ba2c7d61ab6435711
- SHA512 b09d8f033eb57e9d6164d07ef380c8a92558403c4153a575a9281cae1ae93bbd3aa234d690c4007a63fc499994eb96cc635d05e157fc41ce74a7b60889e63181
- SSDEEP 393216:QzkFDH4amD47MBk/imkp7h2r3sDw+mNQ1mgAKogEgRZnOpqYg0oL:74KlamQh4+ISmhVPgGqYgNL
- TLSH T1E8273301E13CF30BDFA641FE95B85C64BAEA481CF675D4AB2764AC3359C3AC1A113726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/main module/winspool.drv
File Explorer
-
Predictablefuture-AI.zip.zip 20.7MB
-
main module/IwaKeyDistribution/iwa-key-distribution.pb2KB
-
main module/IwaKeyDistribution/manifest.json115B
-
main module/LICENSE1KB
-
main module/Main Startup AI.exe.exe 15.3MB
-
main module/PLS SEE MORE.txt3KB
-
main module/VERSION35B
-
main module/WidevineCdm/LICENSE473B
-
main module/WidevineCdm/_platform_specific/win_x64/widevinecdm.dll.sig1KB
-
main module/WidevineCdm/manifest.json938B
-
main module/d3dcompiler_47.dll.dll 4.5MB
-
main module/dxcompiler.dll.dll 24.5MB
-
main module/dxil.dll.dll 1.4MB
-
main module/winspool.drv.dll 963KB
main module/IwaKeyDistribution/iwa-key-distribution.pb
- SHA256 dd0906858e00463ba28c47b1c45f1c21010d11b9bec289fc314f28905396086d
- MD5 f8cdac19c2772c139a904ee6b3145011
- SHA1 6107199d78aecc567b2991a787673ad98d4ee9ae
- SHA512 8661ebcb474b0afac3263da0340acbac4379716f59a852fdd9acd1d40854e31282c71e7fde660002a52d8d2a93d62194d6bb436c0f281bc9074483fa78a3d966
- TLSH T1C54140128716EC09DA6F4BA78B425A11F05538233C3D84AB97DE0B73EBC5372437386A
- MD5 SHA1 SHA512 TLSH
main module/IwaKeyDistribution/manifest.json
- SHA256 14ec5487b2b65a37a98fb0335957bde082b3ee12afe5b8b94d9968bf0ffefae6
- MD5 4fac3f556eda4e889fcb25ddded0cbe0
- SHA1 995999b592a3527c1679bad20d2d93a0051474a5
- SHA512 9ad6cc8d349b9a76e14c012013f293a8e120693a2f6c348df06a02fab4fd015f27a8443d849fd3227772a98bcee9824dc63ee6909fc410df0e9d76c1d677b043
- TLSH T1B9B09B315C415D3214D01F1412E5434257613D071411641559D7140665CC136557231E
- MD5 SHA1 SHA512 TLSH
main module/LICENSE
- SHA256 911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad
- MD5 7998cb338f82d15c0eff93b7004d272a
- SHA1 35ca00c1c9042b449d2d9b16234307841fe3a411
- SHA512 01bda7fb373d97f330be46a53e2dfa98cf67ea86d74f703ba47c076d9a2f54cf5b2b371b357c51ca547045c79eefede4bc7edb0c5ceb3372a0b8bbd9d7dcff82
- TLSH T17431625722800FA35AD22B5031AAAEC0F09DD03D3F23AA04286EF384577B52FC8F7081
- MD5 SHA1 SHA512 TLSH
main module/Main Startup AI.exe
- IMPHASH b60d142e4e08a961cef4281a2d95eda1
- SHA256 290e4aa7ed64c728138711c011e89aab7aa48dbc1ae430371dc2be4100b92bf0
- MD5 c02dc2ca96fe9841963883c0fe177399
- SHA1 7e42e66e9198c258da48a6194577e3dbd424463a
- SHA512 d7acf551d0764fcfb9a895701679981f76b2ff73f99bce5da2c6c3f2f0556ee33f45d0d98848fee96a6ccfa24e09c26303705c5f094e945e647f53f7e4716faf
- SSDEEP 393216:Y6OPZedL1pUAuPXiuZ08RBCxXJq3oeNy8x:KedJp9uPXiuZ08RBCxXJxWy8x
- TLSH T1B0F69D96B2945AB4D142FA3CC91183AEF22DFC5C5B51838342DA7D746E733A81C29FB1
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
7f:06:3f:79:bb:d4:d0:15:e4:e4:85:61:8a:bb:16:d7:13:e3:16:2f:1c:fd:d3:b7:a9:43:00:b7:29:be:07:7e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Krzysztof Kowalczyk,O=Krzysztof Kowalczyk,L=San Diego,ST=California,C=US
Chains
Oct 25, 2023
CN=Krzysztof Kowalczyk,O=Krzysztof Kowalczyk,L=San Diego,ST=California,C=US
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
CN=Krzysztof Kowalczyk,O=Krzysztof Kowalczyk,L=San Diego,ST=California,C=US
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Digest
86:8c:7e:62:e4:5f:b6:5d:15:40:36:20:26:88:59:c6:26:8a:f7:ee
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Krzysztof Kowalczyk,O=Krzysztof Kowalczyk,L=San Diego,ST=California,C=US
Chains
Oct 25, 2023
CN=Krzysztof Kowalczyk,O=Krzysztof Kowalczyk,L=San Diego,ST=California,C=US
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
CN=Krzysztof Kowalczyk,O=Krzysztof Kowalczyk,L=San Diego,ST=California,C=US
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Krzysztof Kowalczyk,O=Krzysztof Kowalczyk,L=San Diego,ST=California,C=US
Serial Number
c8:a7:9a:cf:a2:0c:a4:15:09:24:5c:1f:7f:64:ff:c4
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 24, 2021 - Aug 23, 2024
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Mar 12, 2019 - Dec 31, 2028
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 2, 2019 - Jan 18, 2038
Subject
CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 3, 2023 - Aug 2, 2034
Minor OS version
0
Major OS version
6
Entry point
5589188
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\kjk\src\sumatrapdf\out\rel64\SumatraPDF.pdb
comctl32
ImageList_EndDrag
ImageList_Add
ImageList_DragEnter
ImageList_DragMove
ImageList_BeginDrag
ImageList_Create
ImageList_AddMasked
ord345
ord410
ord413
InitCommonControlsEx
ord412
ImageList_Destroy
CreatePropertySheetPageW
ImageList_GetIconSize
ImageList_Draw
kernel32
SystemTimeToFileTime
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetLogicalDrives
CloseHandle
FindResourceW
GetModuleHandleW
MulDiv
VerSetConditionMask
VerifyVersionInfoW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
HeapCreate
HeapFree
GetCurrentProcess
TerminateProcess
GetEnvironmentVariableA
WaitForSingleObject
GetCurrentThreadId
GetLocaleInfoA
CreateToolhelp32Snapshot
QueryPerformanceFrequency
Sleep
IsDebuggerPresent
DebugBreak
CreateMutexW
ReleaseMutex
DecodePointer
LoadLibraryExA
WriteConsoleW
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
HeapSize
GetProcessHeap
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
LCMapStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetConsoleOutputCP
ReadConsoleW
SetEnvironmentVariableW
GetModuleHandleExW
FreeLibraryAndExitThread
SetFilePointerEx
LCMapStringEx
TlsFree
InitializeCriticalSectionAndSpinCount
EncodePointer
RtlUnwind
RtlPcToFileHeader
RtlUnwindEx
InitializeCriticalSectionEx
GetStartupInfoW
InitializeSListHead
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateSemaphoreW
GetProcessAffinityMask
ReleaseSemaphore
GetConsoleMode
MoveFileW
FlushFileBuffers
GetFileType
SetEndOfFile
CreateHardLinkW
RemoveDirectoryW
DeviceIoControl
SetThreadPriority
SetLastError
SetConsoleCtrlHandler
GetCurrentDirectoryW
FoldStringW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
TzSpecificLocalTimeToSystemTime
IsDBCSLeadByte
GetCPInfo
CompareStringW
AreFileApisANSI
LocalFileTimeToFileTime
RaiseException
FileTimeToDosDateTime
FileTimeToLocalFileTime
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualFree
VirtualProtect
GetSystemDirectoryW
OpenThread
VirtualQuery
GetThreadContext
GetModuleHandleA
ResumeThread
SuspendThread
Thread32First
Thread32Next
AllocConsole
FormatMessageA
CreateProcessW
InitializeSRWLock
InitializeConditionVariable
GetThreadGroupAffinity
InitOnceBeginInitialize
InitOnceComplete
WakeConditionVariable
GetEnvironmentVariableW
FreeLibrary
LoadLibraryW
OutputDebugStringW
LoadLibraryExW
GetProcAddress
GetModuleFileNameW
GetFileAttributesW
OutputDebugStringA
GetTempPathW
GetUserDefaultUILanguage
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
SetErrorMode
GetDateFormatW
GetTimeFormatW
MoveFileExW
LoadResource
LockResource
SizeofResource
SetThreadExecutionState
GlobalAddAtomW
GlobalDeleteAtom
GetTickCount
GetSystemTime
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
GetCurrentThread
Process32FirstW
Process32NextW
OpenProcess
ExitProcess
GetCommandLineW
GetLastError
SetUnhandledExceptionFilter
Module32NextW
PeekNamedPipe
LocalFree
SetCurrentDirectoryW
LoadLibraryA
AttachConsole
GetVersionExW
GetStdHandle
SetConsoleScreenBufferSize
GetCurrentProcessId
HeapDestroy
AddVectoredExceptionHandler
GlobalMemoryStatusEx
Module32FirstW
HeapAlloc
CreateThread
GetSystemInfo
HeapReAlloc
SetEvent
GetConsoleScreenBufferInfo
ReadDirectoryChangesW
QueueUserAPC
ResetEvent
ExitThread
WaitForMultipleObjectsEx
CompareFileTime
CancelIo
GetFileTime
GetDriveTypeW
GetTempFileNameW
CopyFileW
DeleteFileW
GetFileAttributesExW
GetFileInformationByHandle
SetFileAttributesW
GetVolumePathNameW
SetFileTime
GetDriveTypeA
GetPrivateProfileIntW
CreateEventW
GetShortPathNameW
GetLongPathNameW
WritePrivateProfileStringW
GetFileSizeEx
GetACP
MultiByteToWideChar
GetExitCodeProcess
ReadFile
SetFilePointer
TlsSetValue
TlsAlloc
TlsGetValue
CreateEventA
GetModuleFileNameA
GetFullPathNameA
FindClose
FindFirstFileW
GetFullPathNameW
FindNextFileW
lstrcpynW
GetWindowsDirectoryW
WideCharToMultiByte
GetLocaleInfoW
SetNamedPipeHandleState
WriteFile
CreateFileW
CreateDirectoryW
user32
SystemParametersInfoW
GetMessagePos
WindowFromDC
IsWindowEnabled
GetUpdateRect
SetRectEmpty
GetClassInfoExW
RegisterWindowMessageW
GetCursorPos
ClientToScreen
SetLayeredWindowAttributes
DeferWindowPos
GetPropW
RemovePropW
BeginDeferWindowPos
SetPropW
EndDeferWindowPos
HideCaret
SetClassLongPtrW
ShowCaret
IsCharAlphaNumericW
WindowFromPoint
GetWindowThreadProcessId
GetMessageW
AllowSetForegroundWindow
LoadBitmapW
TranslateAcceleratorW
LoadCursorW
GetClassNameW
SetParent
MapVirtualKeyW
ScreenToClient
IsWindow
CharLowerBuffW
GetAncestor
IsCharUpperW
CheckRadioButton
EndDialog
SetDlgItemTextW
SendDlgItemMessageW
DialogBoxIndirectParamW
IsDlgButtonChecked
BringWindowToTop
SetWindowLongW
CheckDlgButton
DialogBoxParamW
MoveWindow
OpenClipboard
CloseClipboard
EmptyClipboard
ReuseDDElParam
ShowWindowAsync
IsWindowUnicode
UnpackDDElParam
ModifyMenuW
CheckMenuRadioItem
GetMenuItemID
GetMenu
SetMenuItemInfoW
SetMenu
DrawTextExW
InsertMenuW
GetWindowLongW
GetWindow
FindWindowExW
GetFocus
IsChild
MessageBeep
GetDesktopWindow
UpdateWindow
MessageBoxW
MsgWaitForMultipleObjects
DispatchMessageW
SendMessageW
PeekMessageW
TranslateMessage
GetDlgItem
PostQuitMessage
PostMessageW
EnableWindow
MessageBoxA
CreateMenu
LoadIconW
SetActiveWindow
DestroyWindow
GetMenuItemInfoW
GetSystemMenu
CallWindowProcW
GetWindowRect
IsWindowVisible
SetWindowPos
GetMenuItemCount
SetWindowLongPtrW
CreateWindowExW
CreatePopupMenu
GetWindowLongPtrW
RegisterClassExW
GetClassLongPtrW
SendInput
DdeFreeStringHandle
DdeDisconnect
DrawTextW
CheckMenuItem
SetClipboardData
DdeFreeDataHandle
DdeClientTransaction
DdeUninitialize
DdeInitializeW
TrackMouseEvent
GetMonitorInfoW
GetWindowInfo
DdeConnect
DdeCreateStringHandleW
DestroyCursor
EnumDisplayMonitors
MonitorFromWindow
MonitorFromRect
CopyImage
GetKeyState
AdjustWindowRectEx
OemToCharA
CharToOemA
OemToCharBuffA
CharLowerW
CharUpperW
CharToOemBuffW
TrackPopupMenu
ShowWindow
InvalidateRgn
OffsetRect
RedrawWindow
MapWindowPoints
SetMenuDefaultItem
GetSysColor
GetForegroundWindow
DestroyAcceleratorTable
DestroyMenu
FindWindowW
GetWindowDC
TrackPopupMenuEx
RemoveMenu
GetClientRect
IsZoomed
AppendMenuW
DrawIconEx
EnableMenuItem
DrawEdge
GetParent
DrawFrameControl
InvalidateRect
SetScrollInfo
DefWindowProcW
ShowScrollBar
GetDC
FillRect
GetCursor
GetScrollInfo
GetScrollPos
GetCapture
SetTimer
SetFocus
SetCapture
SetCursor
KillTimer
ReleaseCapture
IsIconic
ReleaseDC
GetSystemMetrics
BeginPaint
SetForegroundWindow
EndPaint
CreateAcceleratorTableW
IsDialogMessageW
gdi32
SetROP2
GetObjectA
GetTextExtentPoint32W
ExtTextOutW
GetObjectW
CreateDIBSection
GetTextExtentPoint32A
SetLayout
CreateRoundRectRgn
SelectClipRgn
RoundRect
BitBlt
StartPage
AbortDoc
EndDoc
CreateDCW
GetDeviceCaps
SetMapMode
StartDocW
EndPage
Polyline
LineTo
MoveToEx
SetBkColor
Ellipse
CreateFontIndirectW
CreatePatternBrush
CreateBitmap
SetBkMode
GetClipBox
CreateRectRgn
SetViewportOrgEx
ExcludeClipRect
ExtSelectClipRgn
SetBrushOrgEx
SelectObject
CreateCompatibleDC
PatBlt
StretchBlt
GetStockObject
DeleteDC
SetTextColor
CreatePen
Rectangle
DeleteObject
CreateSolidBrush
GetDIBColorTable
SetWorldTransform
SetStretchBltMode
SetDIBits
TextOutW
GetDIBits
SetGraphicsMode
SetDIBColorTable
CreateCompatibleBitmap
winspool.drv
DocumentPropertiesW
ord203
OpenPrinterW
GetPrinterW
EnumPrintersW
DeviceCapabilitiesW
ClosePrinter
comdlg32
GetOpenFileNameW
GetSaveFileNameW
PrintDlgExW
advapi32
CryptDestroyHash
RegQueryInfoKeyW
RegCloseKey
RegQueryValueExW
RegGetValueW
RegEnumKeyW
InitializeSecurityDescriptor
CheckTokenMembership
FreeSid
OpenProcessToken
RegSetKeySecurity
SetFileSecurityW
LookupPrivilegeValueW
AdjustTokenPrivileges
CryptAcquireContextW
CryptCreateHash
CryptHashData
RegOpenKeyExW
CryptGetHashParam
CryptReleaseContext
SetSecurityDescriptorDacl
AllocateAndInitializeSid
shell32
SHGetDesktopFolder
ShellExecuteExW
DragAcceptFiles
SHChangeNotify
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHGetMalloc
DragFinish
DragQueryFileW
SHBindToParent
SHAddToRecentDocs
SHGetFolderPathW
SHFileOperationW
CommandLineToArgvW
ole32
CoSetProxyBlanket
CreateStreamOnHGlobal
CoInitialize
CoCreateInstance
OleUninitialize
OleInitialize
CoTaskMemAlloc
CoTaskMemFree
CoGetMalloc
ReleaseStgMedium
CoUninitialize
oleaut32
VariantInit
VariantClear
SysFreeString
SysAllocString
SafeArrayPutElement
SafeArrayCreateVector
Name
.text
Size
5.6MB
Virtual Size
5.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6.2MB
Virtual Size
6.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
136KB
Virtual Size
135KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
897KB
Virtual Size
896KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=35, id=259, version=30795,
count=9, id=253, version=32533,
count=20, id=260, version=32533,
count=12, id=259, version=32533,
count=47, id=260, version=30795,
count=1, id=262, version=30795,
count=231, id=261, version=30795,
count=1, id=263, version=30795,
count=95, id=261, version=32533,
count=25, id=257, version=30795,
count=724, id=1, productName=Unmarked objects,
count=85, productName=Unmarked objects (old),
count=723, id=264, version=32825,
count=1, id=255, version=32825,
count=1, id=258, version=32825,
main module/PLS SEE MORE.txt
- SHA256 33d3e134bb14370f722b5ad55b2ce10f762cca8a1219e88131d231ef100b9f3a
- MD5 35bc6d47b862d9981375b908e1daae56
- SHA1 580a66a3a435f09098063fdb47c4a76693150a8a
- SHA512 cdcf03f041cd8ca09a0f9479e5cd0bc065d39606ecb1b76a2812b8579f9bd4ee7eb253b732a9a8148acfcd214c837f908f4705cacfeb420994c55b126d98735a
- TLSH T16071531FB31417204E5211D8750F36DFF771896A036C52B128FD806A394626A837A6E9
- MD5 SHA1 SHA512 TLSH
main module/VERSION
- SHA256 abe46ae8f122de59f40ec8cf3eb77ee6e89d00e8fee634e39b247574249a7779
- MD5 b368ef4514bcac46e07bcd074fd6b426
- SHA1 790137fbf4feda7a1668b4c40730b6c5df63b13d
- SHA512 367acb5c2dbccdddcf14b889387a0683a9c309882adb78248b225b96f5f36238d4ea2512155e4817fa01b51a89f5b111f5174724d5fb7135e6d861906f536699
- MD5 SHA1 SHA512
main module/WidevineCdm/LICENSE
- SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
- MD5 7406820f5d56fda6baffa951c60679d2
- SHA1 e7d4894993e506e235d55b3e47aed019d0584148
- SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
- TLSH T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
- MD5 SHA1 SHA512 TLSH
main module/WidevineCdm/_platform_specific/win_x64/widevinecdm.dll.sig
- SHA256 93d006399636fcdeec201a82419225bad5f341afc08bfff3474b7b47309f806c
- MD5 6ce1f49e94aecae870ede44dfe1cfe44
- SHA1 18939307c9cb1aea9da004aa388af955e82733b8
- SHA512 7eed438fde0b12e346e0660ad7cf4896623f76d8980ba8a1aab4eddb21aa4d5798979a28b4c4882f21aa6fb71da3ed8962ad3387f2e4cd020778d7b998fb46a6
- TLSH T1182176DDFDB422981D806A2D4DA9E429DE3111C1792004FB47679686BCA335175C416D
- MD5 SHA1 SHA512 TLSH
main module/WidevineCdm/manifest.json
- SHA256 ff166cbb759674bcb225c00bf0eef50cbda7fbd0eb941371d55729bd704d54aa
- MD5 98c0db5a3e2b9b17ab10218ec6351125
- SHA1 966cea6092254ae54fcc34b8a3747a81d35ef948
- SHA512 dd0b6a583dca51e5efb891a6faea211bc83f92e2f95d2614fad0dd5bb2cff8dabaacfadd0abe0bf3a916b83cf4947c5ebf3972a4783033ad4b1ca51ac414ec1a
- TLSH T14F113A148C388D9335E4BAA21CD6580557661D9F4CC27F58379E561D8F1C86BA27362C
- MD5 SHA1 SHA512 TLSH
main module/d3dcompiler_47.dll
- IMPHASH 743865990ba9629a654f1d23f6ee14f7
- SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
- MD5 19e527a35241c171d37dc1e6c530053c
- SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
- SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
- SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
- TLSH T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
70:22:96:6a:50:48:c5:aa:70:a0:c4:10:4c:38:4b:fc:0a:0d:7f:3c:bb:a6:e9:7c:00:9c:f9:06:fe:d2:1e:58
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 26, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 8, 2024 - Jun 23, 2035
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:87:bc:82:6e:85:a1:ae:53:a8:00:00:00:00:00:87
Issuer
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 8, 2025 - May 6, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:651A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:15:18:03:d3:81:07:26:7c:53:00:01:00:00:02:15
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
1493760
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D3DCompiler_47.pdb
kernel32
WriteFile
FreeLibrary
Sleep
TlsAlloc
TlsSetValue
HeapDestroy
TlsGetValue
TlsFree
GetFullPathNameW
GetFullPathNameA
GetEnvironmentVariableA
VirtualFree
VirtualAlloc
GetSystemInfo
GetProcAddress
LoadLibraryExW
SetLastError
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentThreadId
GetStdHandle
GetFileType
GetStartupInfoW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
VirtualProtect
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
GetModuleHandleW
GetModuleHandleExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetFilePointerEx
ReadFile
SetStdHandle
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
RaiseException
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetModuleFileNameW
ReadConsoleW
HeapSize
HeapReAlloc
WriteConsoleW
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
RtlUnwindEx
InterlockedFlushSList
RtlPcToFileHeader
EncodePointer
LocalAlloc
LocalFree
GetFileSizeEx
GetLastError
CreateFileW
HeapFree
GetProcessHeap
UnmapViewOfFile
GetFileSize
CreateFileMappingW
MapViewOfFile
GetFileAttributesW
SetFileAttributesW
DeleteFileW
SetEndOfFile
DeviceIoControl
InitializeCriticalSectionAndSpinCount
MapViewOfFileEx
CreateFileMappingA
ExpandEnvironmentStringsW
HeapAlloc
OutputDebugStringA
CloseHandle
LeaveCriticalSection
EnterCriticalSection
lstrcmpiA
HeapCreate
GetModuleFileNameA
CreateFileA
DeleteCriticalSection
InitializeCriticalSection
WideCharToMultiByte
FindClose
FindFirstFileExW
FindNextFileW
GetCommandLineA
GetCommandLineW
GetDriveTypeW
GetCurrentDirectoryW
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
MultiByteToWideChar
GetStringTypeW
DisableThreadLibraryCalls
advapi32
CryptDestroyHash
CryptAcquireContextW
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
CryptGetHashParam
CryptCreateHash
CryptHashData
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
CryptReleaseContext
rpcrt4
UuidCreate
D3DAssemble
D3DCompile
D3DCompile2
D3DCompileFromFile
D3DCompressShaders
D3DCreateBlob
D3DCreateFunctionLinkingGraph
D3DCreateLinker
D3DDecompressShaders
D3DDisassemble
D3DDisassemble10Effect
D3DDisassemble11Trace
D3DDisassembleRegion
D3DGetBlobPart
D3DGetDebugInfo
D3DGetInputAndOutputSignatureBlob
D3DGetInputSignatureBlob
D3DGetOutputSignatureBlob
D3DGetTraceInstructionOffsets
D3DLoadModule
D3DPreprocess
D3DReadFileToBlob
D3DReflect
D3DReflectLibrary
D3DReturnFailure1
D3DSetBlobPart
D3DStripShader
D3DWriteBlobToFile
DebugSetMute
Name
.text
Size
3.4MB
Virtual Size
3.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
916KB
Virtual Size
913KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
64KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
124KB
Virtual Size
123KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
4KB
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
36KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=148, id=1, productName=Unmarked objects,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=60, id=261, version=27316,
count=1, id=260, version=27316,
count=1, productName=Unmarked objects (old),
count=30, id=259, version=33145,
count=227, id=261, version=33145,
count=67, id=260, version=33145,
count=1, id=256, version=33145,
count=136, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
main module/dxcompiler.dll
- IMPHASH cb1c31153b2195b8d3996116a8998d6d
- SHA256 07f0b097d57221e10ca618e7b682224b1bf7f6cc423a56b195d32363ba08f3b8
- MD5 8d71d6d9f922223aa7d7179ed5b9d586
- SHA1 3803439ae4f7627ff9a4f423399719a9daa387d2
- SHA512 abe908ad029670ad20a0b47e3983836d006ea87a4640d88ef8baa18e8a7022da2a7764512cf1453404bfdfe59455ac9b205bdcbdfa02fc6f26288af312f6118a
- SSDEEP 393216:E2tXtlgJasElLmqQWaEuUpw8j5dAz7Opw02e:5Ze0V5u7Opw02e
- TLSH T1ED473A122646D49DC059C879C7678B26CA6C30E73FA7B9DFC0F461252B79EAC1B39234
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
fe:f9:6a:e8:86:85:68:22:50:f1:f9:db:8f:3b:42:78:e6:ca:dd:82:4d:ac:96:2b:5a:f2:49:ec:ef:1f:7c:0e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Apr 28, 2026
SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
0b:50:cf:24:6b:26:3e:fd:85:a7:29:31:51:58:f3:ff
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 8, 2024 - Apr 10, 2027
Minor OS version
0
Major OS version
10
Entry point
20667360
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
dxcompiler.dll.pdb
kernel32
AcquireSRWLockExclusive
CloseHandle
CompareStringOrdinal
CompareStringW
CreateDirectoryW
CreateFileMappingW
CreateFileW
CreateHardLinkW
CreateThread
DecodePointer
DeleteCriticalSection
DeleteFileW
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
ExitThread
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FormatMessageA
FreeEnvironmentStringsW
FreeLibrary
FreeLibraryAndExitThread
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetConsoleScreenBufferInfo
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDateFormatW
GetEnvironmentStringsW
GetFileAttributesW
GetFileInformationByHandle
GetFileSizeEx
GetFileType
GetLastError
GetLocaleInfoW
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetNativeSystemInfo
GetOEMCP
GetProcAddress
GetProcessHeap
GetProcessTimes
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemInfo
GetSystemTimeAsFileTime
GetTempPathW
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
HeapAlloc
HeapFree
HeapQueryInformation
HeapReAlloc
HeapSize
HeapValidate
HeapWalk
InitializeCriticalSection
InitializeCriticalSectionEx
InitializeSListHead
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
LCMapStringW
LeaveCriticalSection
LoadLibraryExW
LocalFree
MapViewOfFile
MoveFileExW
MultiByteToWideChar
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadConsoleW
ReadFile
ReleaseSRWLockExclusive
RemoveDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetConsoleTextAttribute
SetEndOfFile
SetEnvironmentVariableW
SetFilePointerEx
SetFileTime
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
Sleep
SleepConditionVariableSRW
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualProtect
VirtualQuery
WaitForSingleObject
WakeAllConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
user32
UnregisterClassA
advapi32
EventRegister
EventUnregister
EventWriteTransfer
ole32
CoTaskMemAlloc
CoTaskMemFree
oleaut32
SysAllocString
SysAllocStringByteLen
SysAllocStringLen
SysFreeString
SysStringByteLen
SysStringLen
VarBstrCat
VariantClear
VariantCopy
VariantInit
DxcCreateInstance
DxcCreateInstance2
Name
.text
Size
20.1MB
Virtual Size
20.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3.7MB
Virtual Size
3.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
32KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
622KB
Virtual Size
622KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
25B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
71KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
main module/dxil.dll
- IMPHASH d491d5c5bf90bc0c2622735f43de4080
- SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
- MD5 c9a7241ce83437d54a82522aa0b54575
- SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
- SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
- SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
- TLSH T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
af:ea:7c:16:de:21:8c:35:55:07:34:fb:89:38:8c:65:19:01:2b:95:5d:37:f0:a4:17:bb:12:5b:59:02:7c:1f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 26, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 8, 2024 - Jun 23, 2035
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:86:e7:71:94:b9:4d:ff:09:fb:00:00:00:00:00:86
Issuer
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 8, 2025 - May 6, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:521A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:17:71:fb:2e:a5:af:01:1d:ea:00:01:00:00:02:17
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
450288
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\__w\1\b\build\x64\DXC\Release\bin\Symbols.pri\dxil.pdb
kernel32
DeleteCriticalSection
MoveFileExW
InitializeCriticalSectionEx
GetLastError
CreateHardLinkW
InitializeCriticalSection
GetModuleFileNameW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
SetFileTime
RemoveDirectoryW
GetFileType
GetFileInformationByHandle
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
CreateDirectoryW
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
ReadFile
LoadLibraryExW
FreeLibrary
InitializeCriticalSectionAndSpinCount
EncodePointer
InterlockedFlushSList
RtlUnwindEx
RtlPcToFileHeader
InitializeSListHead
GetCurrentProcessId
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
IsDebuggerPresent
OutputDebugStringW
RaiseException
EnterCriticalSection
LeaveCriticalSection
GetCurrentDirectoryW
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
MultiByteToWideChar
WideCharToMultiByte
GetStdHandle
GetProcessTimes
GetCurrentProcess
GetConsoleMode
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetSystemTimeAsFileTime
CloseHandle
CreateFileW
TerminateProcess
LocalFree
FormatMessageA
GetLocaleInfoEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
GetCurrentThreadId
QueryPerformanceCounter
QueryPerformanceFrequency
GetTempPathW
GetModuleHandleW
GetProcAddress
WakeAllConditionVariable
SleepConditionVariableSRW
ole32
CoTaskMemFree
CoTaskMemAlloc
CoGetMalloc
advapi32
EventUnregister
EventRegister
EventWriteTransfer
api-ms-win-crt-heap-l1-1-0
free
calloc
malloc
api-ms-win-crt-runtime-l1-1-0
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_initterm_e
_execute_onexit_table
_errno
_crt_atexit
_invalid_parameter_noinfo_noreturn
_cexit
_initterm
abort
terminate
api-ms-win-crt-string-l1-1-0
isdigit
isprint
strcpy_s
toupper
isalpha
wcsncmp
isalnum
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
__stdio_common_vsprintf_s
__acrt_iob_func
_write
_read
_open_osfhandle
_lseek
_close
fwrite
_setmode
_get_osfhandle
__stdio_common_vsnprintf_s
_chsize
_wsopen_dispatch
_fileno
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
_fpclass
ceilf
api-ms-win-crt-convert-l1-1-0
atoi
DxcCreateInstance
DxcCreateInstance2
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
248KB
Virtual Size
248KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=34321,
count=11, id=260, version=34321,
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=260, version=34808,
count=50, id=261, version=34321,
count=9, id=257, version=28900,
count=211, id=1, productName=Unmarked objects,
count=168, id=261, version=34808,
count=1, id=256, version=34808,
count=1, id=255, version=34808,
count=1, id=151,
count=1, id=258, version=34808,
main module/winspool.drv
- IMPHASH 873076e5898304e931762d5077ae3fe9
- SHA256 5c6f9dc0f273000ce05913cc6f899acb5c89fb2bbcb9e22cfe59a804d16de702
- MD5 e0ce92f4dbc516dbfd27489fb30f8b3b
- SHA1 767e3397171edc6a321fef9296386a4b0e9a2f13
- SHA512 1775d2d8424210d73f0f736a4a35ee0c814e3c2fe743b37c1a9db42f075e7efddb3949dbc5599e5de44fe559b896b944a92eeec2ca0e15affe77b4a5913ec139
- SSDEEP 24576:cBZEMuXjnGTRzq3bPQKN/hxZJRRqAK0C733slRG1:cB6TnGTRzhKN/zrqAK0C7slRG
- TLSH T145258D0DF3B80555E47786398497461AEBB278252712D3CF12A0C27C5F27BE5AF39B22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
67872
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
winspool.pdb
msvcrt
_unlock
_amsg_exit
_XcptFilter
_callnewh
malloc
wcstok_s
_stricmp
_initterm
free
_onexit
_vsnwprintf
__CxxFrameHandler3
memset
memmove
memcpy
memcmp
_wcsnicmp
wcsstr
wcschr
_purecall
wcstoul
_wsplitpath_s
_wmakepath_s
_lock
wcsncpy_s
wcspbrk
memmove_s
iswprint
_wcsdup
wcsncmp
wcsrchr
swprintf_s
__dllonexit
__C_specific_handler
_wcsicmp
memcpy_s
sqrt
_wcslwr
wcscmp
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetModuleFileNameA
DisableThreadLibraryCalls
LoadLibraryExW
FreeLibrary
LoadStringW
FreeLibraryAndExitThread
GetModuleFileNameW
api-ms-win-core-synch-l1-1-0
SetEvent
CreateEventW
ReleaseSemaphore
EnterCriticalSection
ReleaseMutex
ResetEvent
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
WaitForSingleObject
CreateMutexW
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
LeaveCriticalSection
CreateSemaphoreExW
AcquireSRWLockExclusive
InitializeCriticalSectionEx
WaitForSingleObjectEx
CreateMutexExW
OpenSemaphoreW
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
HeapCreate
GetProcessHeap
HeapDestroy
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
RaiseException
GetLastError
api-ms-win-core-processthreads-l1-1-0
GetExitCodeProcess
ProcessIdToSessionId
OpenThreadToken
GetCurrentThread
GetProcessTimes
GetCurrentThreadId
OpenProcessToken
TerminateProcess
SetThreadToken
CreateProcessAsUserW
GetCurrentProcess
CreateThread
TlsSetValue
CreateProcessW
GetCurrentProcessId
TlsGetValue
TlsFree
TlsAlloc
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-registry-l1-1-0
RegDeleteValueW
RegOpenKeyExW
RegGetValueW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegOpenCurrentUser
RegCloseKey
api-ms-win-core-heap-l2-1-0
GlobalFree
LocalFree
LocalAlloc
GlobalAlloc
api-ms-win-core-string-l1-1-0
CompareStringW
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-sidebyside-l1-1-0
DeactivateActCtx
CreateActCtxW
ActivateActCtx
ReleaseActCtx
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
WakeAllConditionVariable
Sleep
SleepConditionVariableSRW
InitOnceComplete
api-ms-win-core-memory-l1-1-0
VirtualFree
VirtualAlloc
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
api-ms-win-core-file-l1-1-0
GetFileSize
SetFilePointer
ReadFile
GetTempFileNameW
FindClose
FindFirstFileW
GetFileType
CreateDirectoryW
GetFileAttributesW
CreateFileW
WriteFile
GetFullPathNameW
SetFileAttributesW
FindNextFileW
RemoveDirectoryW
DeleteFileW
SetEndOfFile
api-ms-win-core-sysinfo-l1-2-0
GetProductInfo
api-ms-win-core-sysinfo-l1-1-0
GetVersionExW
GetSystemInfo
GetTickCount
GetSystemWindowsDirectoryW
GetSystemDirectoryW
GetTickCount64
GetSystemTimeAsFileTime
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
LoadLibraryA
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
lstrcmpW
api-ms-win-security-base-l1-1-0
SetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetSecurityDescriptorOwner
GetSidSubAuthority
SetSecurityDescriptorSacl
IsValidSecurityDescriptor
GetSidSubAuthorityCount
GetSecurityDescriptorLength
MakeSelfRelativeSD
SetSecurityDescriptorGroup
RevertToSelf
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
InitializeSecurityDescriptor
CopySid
GetLengthSid
GetTokenInformation
api-ms-win-core-processenvironment-l1-1-0
SetCurrentDirectoryW
SearchPathW
GetCurrentDirectoryW
api-ms-win-core-kernel32-legacy-l1-1-0
DnsHostnameToComputerNameW
GetComputerNameW
api-ms-win-core-file-l1-2-0
GetTempPathW
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
CloseThreadpoolWork
SetThreadpoolTimer
WaitForThreadpoolWorkCallbacks
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SubmitThreadpoolWork
CreateThreadpoolWork
api-ms-win-core-file-l2-1-0
MoveFileExW
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
api-ms-win-core-registry-l1-1-1
RegDeleteKeyValueW
RegSetKeyValueW
api-ms-win-core-file-l2-1-2
CopyFileW
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
ntdll
RtlValidRelativeSecurityDescriptor
RtlIsThreadWithinLoaderCallout
EtwUnregisterTraceGuids
EtwGetTraceEnableFlags
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwRegisterTraceGuidsW
EtwEventRegister
EtwEventUnregister
RtlNtStatusToDosError
EtwEventEnabled
WinSqmIsOptedIn
WinSqmAddToStreamEx
EtwEventWriteTransfer
NtFsControlFile
EtwEventSetInformation
RtlGetVersion
ZwQueryWnfStateData
EtwTraceMessage
EtwEventWrite
api-ms-win-security-activedirectoryclient-l1-1-0
DsFreeNameResultW
DsUnBindW
DsBindWithSpnExW
DsCrackNamesW
kernel32
InitializeCriticalSection
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
ADVANCEDSETUPDIALOG
AbortPrinter
AddFormA
AddFormW
AddJobA
AddJobW
AddMonitorA
AddMonitorW
AddPortA
AddPortExA
AddPortExW
AddPortW
AddPrintProcessorA
AddPrintProcessorW
AddPrintProvidorA
AddPrintProvidorW
AddPrinterA
AddPrinterConnection2A
AddPrinterConnection2W
AddPrinterConnectionA
AddPrinterConnectionW
AddPrinterDriverA
AddPrinterDriverExA
AddPrinterDriverExW
AddPrinterDriverW
AddPrinterW
AdvancedDocumentPropertiesA
AdvancedDocumentPropertiesW
AdvancedSetupDialog
ClosePrinter
CloseSpoolFileHandle
CommitSpoolData
ConfigurePortA
ConfigurePortW
ConnectToPrinterDlg
ConvertAnsiDevModeToUnicodeDevmode
ConvertUnicodeDevModeToAnsiDevmode
CorePrinterDriverInstalledA
CorePrinterDriverInstalledW
CreatePrintAsyncNotifyChannel
CreatePrinterIC
DEVICECAPABILITIES
DEVICEMODE
DeleteFormA
DeleteFormW
DeleteJobNamedProperty
DeleteMonitorA
DeleteMonitorW
DeletePortA
DeletePortW
DeletePrintProcessorA
DeletePrintProcessorW
DeletePrintProvidorA
DeletePrintProvidorW
DeletePrinter
DeletePrinterConnectionA
DeletePrinterConnectionW
DeletePrinterDataA
DeletePrinterDataExA
DeletePrinterDataExW
DeletePrinterDataW
DeletePrinterDriverA
DeletePrinterDriverExA
DeletePrinterDriverExW
DeletePrinterDriverPackageA
DeletePrinterDriverPackageW
DeletePrinterDriverW
DeletePrinterIC
DeletePrinterKeyA
DeletePrinterKeyW
DevQueryPrint
DevQueryPrintEx
DeviceCapabilities
DeviceCapabilitiesA
DeviceCapabilitiesW
DeviceMode
DevicePropertySheets
DocumentEvent
DocumentPropertiesA
DocumentPropertiesW
DocumentPropertySheets
EXTDEVICEMODE
EndDocPrinter
EndPagePrinter
EnumFormsA
EnumFormsW
EnumJobNamedProperties
EnumJobsA
EnumJobsW
EnumMonitorsA
EnumMonitorsW
EnumPortsA
EnumPortsW
EnumPrintProcessorDatatypesA
EnumPrintProcessorDatatypesW
EnumPrintProcessorsA
EnumPrintProcessorsW
EnumPrinterDataA
EnumPrinterDataExA
EnumPrinterDataExW
EnumPrinterDataW
EnumPrinterDriversA
EnumPrinterDriversW
EnumPrinterKeyA
EnumPrinterKeyW
EnumPrintersA
EnumPrintersW
ExtDeviceMode
FindClosePrinterChangeNotification
FindFirstPrinterChangeNotification
FindNextPrinterChangeNotification
FlushPrinter
FreePrintNamedPropertyArray
FreePrintPropertyValue
FreePrinterNotifyInfo
GetCorePrinterDriversA
GetCorePrinterDriversW
GetDefaultPrinterA
GetDefaultPrinterW
GetFormA
GetFormW
GetJobA
GetJobNamedPropertyValue
GetJobW
GetPrintExecutionData
GetPrintOutputInfo
GetPrintProcessorDirectoryA
GetPrintProcessorDirectoryW
GetPrinterA
GetPrinterDataA
GetPrinterDataExA
GetPrinterDataExW
GetPrinterDataW
GetPrinterDriver2A
GetPrinterDriver2W
GetPrinterDriverA
GetPrinterDriverDirectoryA
GetPrinterDriverDirectoryW
GetPrinterDriverPackagePathA
GetPrinterDriverPackagePathW
GetPrinterDriverW
GetPrinterW
GetSpoolFileHandle
InstallPrinterDriverFromPackageA
InstallPrinterDriverFromPackageW
IsValidDevmodeA
IsValidDevmodeW
OpenPrinter2A
OpenPrinter2W
OpenPrinterA
OpenPrinterW
PerfClose
PerfCollect
PerfOpen
PlayGdiScriptOnPrinterIC
PrinterMessageBoxA
PrinterMessageBoxW
PrinterProperties
QueryColorProfile
QueryRemoteFonts
QuerySpoolMode
ReadPrinter
RegisterForPrintAsyncNotifications
ReportJobProcessingProgress
ResetPrinterA
ResetPrinterW
ScheduleJob
SeekPrinter
SetDefaultPrinterA
SetDefaultPrinterW
SetFormA
SetFormW
SetJobA
SetJobNamedProperty
SetJobW
SetPortA
SetPortW
SetPrinterA
SetPrinterDataA
SetPrinterDataExA
SetPrinterDataExW
SetPrinterDataW
SetPrinterW
SetSplwow64AppCompat
SplDriverUnloadComplete
SpoolerDevQueryPrintW
SpoolerPrinterEvent
StartDocDlgA
StartDocDlgW
StartDocPrinterA
StartDocPrinterW
StartPagePrinter
UnRegisterForPrintAsyncNotifications
UploadPrinterDriverPackageA
UploadPrinterDriverPackageW
WaitForPrinterChange
WritePrinter
XcvDataW
Name
.text
Size
338KB
Virtual Size
337KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
127KB
Virtual Size
127KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
87KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.mrdata
Size
383KB
Virtual Size
382KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
count=74, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=27412,
count=20, id=260, version=27412,
count=369, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=5, id=261, version=27412,
count=1, id=256, version=27412,
count=113, id=269, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,