Songify.zip
- SHA256 ca3d52d3edf9d5f8e0c082dfca4a49a0a740b2595c901a7633ebce17265d9270
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Songify.zip
Resource
win11-20260911-en
windows11-21h2-x64
2 signatures
900 seconds
General
- Target Songify.zip
- Size 85.9MB
- Sample261014-3fz24styct
- SHA256 ca3d52d3edf9d5f8e0c082dfca4a49a0a740b2595c901a7633ebce17265d9270
- MD5 ba460a2e85a1f9d39cfe6b06f8dfba42
- SHA1 139febdbb34bc348066aa7aad0ad301c2bfd3493
- SHA512 5aa20bec7df7abfbfe29471cb70594563d4c9499f5eb374210195e7000b4b453c4b65326e8b95bae5c8dc50d801adc4538f13f2596d161c55fa60719c4368e6b
- SSDEEP 1572864:pgt3Dp0nvD7GT5jwTIrog42j6TAKdI0mf2F+68iG+PBqWYMWbHc1w0imfG+YOEVw:QEbKNoM9j6s2+68yqW76cqKG+YOmO46/
- TLSH T1F51833C82F9A838E3844880C1D9D5BACDC37F074AD97E53B936B83957B6797E124D806
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Songify.exe
File Explorer
-
Songify.zip.zip 85.9MB
-
Songify.dll.config317B
-
Songify.exe.exe 91.9MB
-
runtimes\win-arm64\native\WebView2Loader.dll147KB
-
runtimes\win-x64\native\WebView2Loader.dll.dll 159KB
-
runtimes\win-x86\native\WebView2Loader.dll.dll 121KB
Songify.dll.config
- SHA256 869a5ed727d638f8530596a78c508ee041b9a422e19025159c34a42b54f0aeb5
- MD5 324bb284f5000fa3a63b7e31c6bba29c
- SHA1 23e6dc4fdd4effa8e3336df36b8b8fd9d0989a1d
- SHA512 13430938be89c475835234fcaa4c14cd172ad4b53c10ef8cadc20590705ca8a6c5c3d4ccaeaa2c465371ea8894f4bfdc7e2df75c4103f91e76e52344a4f65ef2
- TLSH T1EEE07D83290C0C534D274673D3C74410EA31331610040C4CB0BEBA215B0315D4753423
- MD5 SHA1 SHA512 TLSH
Songify.exe
- IMPHASH 8a34d2e5912e3d13caec44729685a874
- SHA256 1fe9327db6c46e5ff654d2882f0374a2097556072ffd4ede6ebf261a744539b1
- MD5 ac1c3656c561bdfe548a9964eb3d34d0
- SHA1 08ad4f3ee0d97c40452ba887c01c710e74fd4b97
- SHA512 626cb6d56265be34da90dd9fad2fd50bf8f50f8549f975b33c54cc5329d67c166487cddee1a3eefdf22b386a1927f60a53eb6a6e321deb844554fc805d291882
- SSDEEP 1572864:0QqNhJ3Ql++RMr5fU6zhcq1XnMwkylZxxJvZKWcXX4ek2mnn7ob3+OUAVkZqf4kw:0QsTktaV39DnXrxxJM6Vn74+Grf4keBF
- TLSH T1CB282256A2A800DCD4BBC0BC8557C617EBB134651BA056EB21E496F92F23FE13A7DF10
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
6067232
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\src\runtime\artifacts\obj\coreclr\windows.x64.Release\Corehost.Static\singlefilehost.pdb
kernel32
ActivateActCtx
FindResourceW
GetWindowsDirectoryW
GetModuleHandleW
LoadLibraryExW
LoadLibraryExA
RtlCaptureContext
WideCharToMultiByte
GetConsoleOutputCP
MapViewOfFileEx
SetLastError
SetThreadErrorMode
RaiseException
SetConsoleCtrlHandler
DebugBreak
FlsAlloc
FlsSetValue
FlsGetValue
GetLocaleInfoEx
GetUserDefaultLocaleName
FlushProcessWriteBuffers
ReadFile
CreateNamedPipeA
GetCurrentProcess
WriteFile
WaitForMultipleObjects
WaitForSingleObject
DuplicateHandle
DisconnectNamedPipe
CreateEventW
CreateFileA
CancelIoEx
GetOverlappedResult
ConnectNamedPipe
FlushFileBuffers
SetEvent
ResetEvent
WaitForSingleObjectEx
VirtualAlloc
VirtualFree
VirtualQuery
VirtualProtect
SleepEx
SwitchToThread
MultiByteToWideChar
SuspendThread
ResumeThread
LCMapStringEx
FormatMessageW
LocalFree
GetModuleFileNameW
GetEnvironmentVariableW
CreateFileW
GetFullPathNameW
HeapAlloc
HeapFree
CreateFileMappingW
HeapCreate
GetProcessHeap
HeapDestroy
VerSetConditionMask
VerifyVersionInfoW
QueueUserAPC
SetThreadPriority
GetThreadPriority
TlsSetValue
TlsAlloc
WaitForMultipleObjectsEx
SignalObjectAndWait
RtlLookupFunctionEntry
SetThreadStackGuarantee
LocateXStateFeature
SetErrorMode
RaiseFailFastException
GetExitCodeProcess
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
AddVectoredExceptionHandler
GetThreadContext
SetThreadContext
GetEnabledXStateFeatures
InitializeContext
RtlRestoreContext
SetXStateFeaturesMask
CopyContext
GetModuleHandleExW
GetCommandLineW
CreateProcessW
GetCPInfo
ExitProcess
OutputDebugStringW
RtlInstallFunctionTableCallback
GetLogicalProcessorInformationEx
SetThreadGroupAffinity
GetThreadGroupAffinity
UnmapViewOfFile
GetProcessAffinityMask
QueryInformationJobObject
FlushInstructionCache
RtlDeleteFunctionTable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
InitializeConditionVariable
WakeAllConditionVariable
AcquireSRWLockShared
SleepConditionVariableSRW
ReleaseSRWLockShared
CreateMemoryResourceNotification
WerRegisterRuntimeExceptionModule
RtlUnwind
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
OpenEventW
ExitThread
HeapReAlloc
TlsGetValue
GetFileSize
RtlAddFunctionTable
CreateSemaphoreExW
ReleaseSemaphore
GetSystemDefaultLCID
GetUserDefaultLCID
OutputDebugStringA
QueryThreadCycleTime
SetFilePointer
MapViewOfFile
Sleep
RemoveDirectoryW
CreateDirectoryW
GetEnvironmentStringsW
GetSystemTime
GetSystemTimeAsFileTime
FreeLibrary
GetCurrentProcessId
GetProcAddress
CreateThread
GetSystemInfo
CloseHandle
GetActiveProcessorGroupCount
GetCurrentThread
GetLastError
FreeEnvironmentStringsW
GetCurrentThreadId
CreateActCtxW
GetStdHandle
FindNextFileW
EnterCriticalSection
FindFirstFileExW
GetFileSizeEx
InitializeCriticalSection
GetTempPathW
FindClose
GetFileAttributesW
GetConsoleMode
GetFileAttributesExW
LoadLibraryA
GetCurrentDirectoryW
WriteConsoleW
DeleteCriticalSection
CreateFileMappingA
LeaveCriticalSection
GetTickCount64
QueryPerformanceFrequency
QueryPerformanceCounter
IsDebuggerPresent
GetNumaHighestNodeNumber
SetThreadAffinityMask
SetThreadIdealProcessorEx
GetThreadIdealProcessorEx
VirtualAllocExNuma
GetNumaProcessorNodeEx
VirtualUnlock
GetLargePageMinimum
IsProcessInJob
K32GetProcessMemoryInfo
GetLogicalProcessorInformation
GlobalMemoryStatusEx
RtlVirtualUnwind
IsProcessorFeaturePresent
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsFree
TryAcquireSRWLockExclusive
GetExitCodeThread
GetStringTypeW
InitializeCriticalSectionEx
DecodePointer
SetEnvironmentVariableW
GetProcessGroupAffinity
GetCurrentProcessorNumberEx
advapi32
LookupPrivilegeValueW
RegGetValueW
SetKernelObjectSecurity
RegQueryValueExW
RegOpenKeyExW
GetSidSubAuthorityCount
GetSidSubAuthority
GetTokenInformation
OpenProcessToken
RegCloseKey
SetThreadToken
RevertToSelf
OpenThreadToken
EventWrite
EventRegister
EventWriteTransfer
DeregisterEventSource
RegisterEventSourceW
ReportEventW
AdjustTokenPrivileges
ole32
CLSIDFromProgID
CoCreateGuid
CoTaskMemAlloc
CoUnmarshalInterface
CoMarshalInterface
CoGetMarshalSizeMax
CoCreateFreeThreadedMarshaler
CoGetClassObject
CoGetContextToken
CoGetObjectContext
CoReleaseMarshalData
CoInitializeEx
CoRegisterInitializeSpy
CoWaitForMultipleHandles
CoUninitialize
CoRevokeInitializeSpy
CoTaskMemFree
oleaut32
SetErrorInfo
GetErrorInfo
SysFreeString
SysStringLen
CreateErrorInfo
QueryPathOfRegTypeLi
LoadTypeLibEx
SafeArrayGetVartype
VariantChangeType
SysAllocString
LoadRegTypeLi
SysAllocStringLen
VariantClear
VariantInit
VarCyFromDec
SafeArrayDestroy
SafeArrayAllocDescriptorEx
GetRecordInfoFromTypeInfo
SafeArraySetRecordInfo
SafeArrayAllocData
SafeArrayGetElemsize
SysStringByteLen
SysAllocStringByteLen
SafeArrayCreateVector
SafeArrayPutElement
SafeArrayGetDim
SafeArrayGetLBound
user32
MessageBoxW
LoadStringW
shell32
ShellExecuteW
api-ms-win-crt-string-l1-1-0
iswspace
strncpy
iswascii
_strnicmp
iswupper
strncmp
strncpy_s
towlower
wcscat_s
_wcsdup
wcscpy_s
wcsncpy_s
isalpha
strnlen
wcsncat_s
strncat_s
towupper
strcpy_s
strcmp
_stricmp
strcat_s
isspace
tolower
wcsncmp
_strdup
strtok_s
wcsnlen
strlen
_wcsnicmp
_wcsicmp
isdigit
api-ms-win-crt-heap-l1-1-0
_callnewh
realloc
_aligned_malloc
malloc
_set_new_mode
free
calloc
_aligned_free
api-ms-win-crt-convert-l1-1-0
atoi
atol
_wcstoui64
strtol
_wtoi
_ltow_s
strtoull
strtoul
wcstoul
_atoi64
api-ms-win-crt-stdio-l1-1-0
fputwc
__stdio_common_vsprintf_s
_set_fmode
__stdio_common_vfprintf
__acrt_iob_func
__p__commode
ftell
fseek
__stdio_common_vsprintf
fopen
__stdio_common_vfwprintf
setvbuf
_setmode
_dup
_fileno
fclose
__stdio_common_vswprintf
_flushall
fwrite
__stdio_common_vsnwprintf_s
__stdio_common_vsnprintf_s
_wfsopen
_write
__stdio_common_vsscanf
fgets
fflush
fputs
_wfopen
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-runtime-l1-1-0
_invoke_watson
_invalid_parameter_noinfo
_wcserror_s
_beginthreadex
abort
_register_thread_local_exe_atexit_callback
_c_exit
__p___wargv
__p___argc
_errno
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
terminate
_controlfp_s
api-ms-win-crt-filesystem-l1-1-0
_wremove
_wrename
api-ms-win-crt-math-l1-1-0
truncf
ilogbf
copysignf
copysign
ceilf
round
asinh
cbrt
cos
acosh
atanh
modf
acoshf
cbrtf
atanhf
modff
asinhf
_fdopen
fmodf
fmod
tanhf
fmaf
fma
floorf
__setusermatherr
acos
acosf
asin
asinf
atan
atan2
atan2f
log10
log10f
log2
log2f
logf
floor
expf
pow
log
powf
exp
coshf
roundf
cosh
sin
sinf
cosf
sinh
sinhf
trunc
sqrt
sqrtf
tan
tanf
tanh
atanf
ceil
api-ms-win-crt-time-l1-1-0
_gmtime64_s
_time64
wcsftime
api-ms-win-crt-locale-l1-1-0
_create_locale
__pctype_func
___mb_cur_max_func
___lc_codepage_func
_configthreadlocale
setlocale
_lock_locales
_unlock_locales
_free_locale
___lc_locale_name_func
BrotliDecoderAttachDictionary
BrotliDecoderCreateInstance
BrotliDecoderDecompress
BrotliDecoderDecompressStream
BrotliDecoderDestroyInstance
BrotliDecoderErrorString
BrotliDecoderGetErrorCode
BrotliDecoderHasMoreOutput
BrotliDecoderIsFinished
BrotliDecoderIsUsed
BrotliDecoderSetMetadataCallbacks
BrotliDecoderSetParameter
BrotliDecoderTakeOutput
BrotliDecoderVersion
BrotliDefaultAllocFunc
BrotliDefaultFreeFunc
BrotliEncoderAttachPreparedDictionary
BrotliEncoderCompress
BrotliEncoderCompressStream
BrotliEncoderCreateInstance
BrotliEncoderDestroyInstance
BrotliEncoderDestroyPreparedDictionary
BrotliEncoderHasMoreOutput
BrotliEncoderIsFinished
BrotliEncoderMaxCompressedSize
BrotliEncoderPrepareDictionary
BrotliEncoderSetParameter
BrotliEncoderTakeOutput
BrotliEncoderVersion
BrotliGetDictionary
BrotliGetTransforms
BrotliSetDictionaryData
BrotliSharedDictionaryAttach
BrotliSharedDictionaryCreateInstance
BrotliSharedDictionaryDestroyInstance
BrotliTransformDictionaryWord
CLRJitAttachState
DotNetRuntimeContractDescriptor
DotNetRuntimeInfo
MetaDataGetDispenser
_kBrotliContextLookupTable
_kBrotliPrefixCodeRanges
g_CLREngineMetrics
g_dacTable
Name
.text
Size
6.4MB
Virtual Size
6.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.CLR_UEF
Size
512B
Virtual Size
215B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
95KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
229KB
Virtual Size
228KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Section
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
30KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=11, id=259, version=35207,
count=19, id=260, version=35207,
count=68, id=260, version=35228,
count=101, id=261, version=35207,
count=8, id=260, version=33145,
count=13, id=257, version=33145,
count=509, id=1, productName=Unmarked objects,
count=22, id=259, version=35228,
count=571, id=265, version=35228,
count=1, id=256, version=35228,
count=1, id=255, version=35228,
count=1, id=258, version=35228,
runtimes\win-arm64\native\WebView2Loader.dll
- SHA256 5a5cf33bdce364d72cbb56d59e24e5cf77ee38976d4f8b392a151e0013215703
- MD5 c257365c5b9c3faa1db9e59d452668d9
- SHA1 b4ef306851f80b3d0250c390c30b08964cd3055b
- SHA512 8123e67234e3340ff8ab89e04c4008a5ba2fc6627a7db15bb3e3f8801778605fb3df726957fd1aadbc5a32ff2f3a27d455aeff8fc13fd6bd8434c34821378894
- SSDEEP 3072:sooFFN8pQ7g7X9sQHJARTbn5d7cEtJ5iSJRVHZ:js8pd+bnbwEtJQSJRj
- TLSH T16EE31A9367DD1843E6D6E73CCC638950172BFAB88934C95E6152010EDE2FBC1DEB1A26
- MD5 SHA1 SHA512 SSDEEP TLSH
runtimes\win-x64\native\WebView2Loader.dll
- IMPHASH 1d9cc3b38dfd9bed2be6d6bf0e209d61
- SHA256 c66e4a92fdc7a216118e43b7a5024ea2200e8c43f9310bf20d96a0084f82c5bc
- MD5 0243cb84351c92ddea3fc0334f3a52ae
- SHA1 d80c01c98f0ed8af1be111abefcbbf6c9f3938bf
- SHA512 74314c87eed82b1c9415462be3259a6626599047a18821cadc73c0c0c62cbd54948d6311ad4de9955fc2d4f2098ccb17aebeee8929ac2741bafc38ceb51a9585
- SSDEEP 3072:d94EUQHTN8gVEeemaXpNbVf7W5AOVU9dPTwnhrEtJe6ub9VY/3A:3dzeDZNbbVf7W+cnhEtJC3H
- TLSH T194F35C57B3E500BBE1B7C234C9634A56E776B8115B609AEF03A4427A1F13BD0AE3D760
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
77:28:d0:57:a2:4b:5e:a5:f7:75:de:a8:49:f9:33:4a:fe:99:43:b0:c9:af:7c:06:c7:59:14:08:7e:7a:73:e6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 23, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:33:4e:c2:48:56:4c:2b:5c:6f:00:00:00:00:02:33
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8603-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:25:80:c7:37:c6:cd:aa:77:49:00:01:00:00:02:25
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
22288
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WebView2Loader.dll.pdb
kernel32
AcquireSRWLockExclusive
CloseHandle
CreateFileW
DeleteCriticalSection
EncodePointer
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetEnvironmentVariableW
GetFileAttributesW
GetFileType
GetLastError
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemInfo
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
InitializeSListHead
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalAlloc
LocalFree
MultiByteToWideChar
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
RaiseException
ReleaseSRWLockExclusive
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
SleepConditionVariableSRW
TerminateProcess
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WakeAllConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
CompareBrowserVersions
CreateCoreWebView2Environment
CreateCoreWebView2EnvironmentWithOptions
GetAvailableCoreWebView2BrowserVersionString
GetAvailableCoreWebView2BrowserVersionStringWithOptions
Name
.text
Size
87KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
runtimes\win-x86\native\WebView2Loader.dll
- IMPHASH fc5524164f76bcf031ad21ff132f18fe
- SHA256 a08c57142946e5a554d9d5c018e27dcbb09248be8ad44852667b96564bbceeda
- MD5 0195a020de6922707643eb79ce4dc3ba
- SHA1 d02fd9aac7ced19d2e80f124803fc414d4fbbfae
- SHA512 6041760849dca59b8f908acfc78f93021e5a2fffdc1a3e82b12c93d8eae0f65d35d67d8d6adea118174105cd6a9007f3a6a691315ea737a67ea9fc877e438a24
- SSDEEP 3072:npYPhcNtdORs3uf7hY2TILt3CVbAUT3nAfEtJK7CG2vHN71:pYP2xeftV8LenmEtJ2CPfN7
- TLSH T16EC36B0075E08031E4AF15790978DA759B3F79B0DF608EEF279815AA4E34BD09F35B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
5a:15:20:78:e2:0d:11:20:4e:d0:ee:2e:6c:04:9f:6a:8d:4e:6a:da:4d:4b:64:b0:b6:4b:98:6e:97:7e:ad:20
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 23, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:33:4e:c2:48:56:4c:2b:5c:6f:00:00:00:00:02:33
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:7F00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1e:a3:ac:a4:6e:39:6f:7c:49:00:01:00:00:02:1e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
19632
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
WebView2Loader.dll.pdb
kernel32
AcquireSRWLockExclusive
CloseHandle
CreateFileW
DecodePointer
DeleteCriticalSection
EncodePointer
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetEnvironmentVariableW
GetFileAttributesW
GetFileType
GetLastError
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemInfo
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
InitializeSListHead
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalAlloc
LocalFree
MultiByteToWideChar
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
RaiseException
ReleaseSRWLockExclusive
RtlUnwind
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
SleepConditionVariableSRW
TerminateProcess
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WakeAllConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
CompareBrowserVersions
CreateCoreWebView2Environment
CreateCoreWebView2EnvironmentWithOptions
GetAvailableCoreWebView2BrowserVersionString
GetAvailableCoreWebView2BrowserVersionStringWithOptions
Name
.text
Size
69KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ