system 32 d.zip
- SHA256 c7dbd71b100acc6e7a140ffc38c5dbeada123ea6fc1ac51c726aac3eefe77027
Overview
overview
7Static
static
3system 32 d.zip
windows10-2004-x64
1system 32 d.zip
windows11-ltsc_2024-x64
1CustomInstallExec.exe
windows10-2004-x64
1DFDWiz.exe
windows10-2004-x64
3DataExchangeHost.exe
windows10-2004-x64
4DataStoreC...ol.exe
windows10-2004-x64
3Defrag.exe
windows10-2004-x64
7DeviceCensus.exe
windows10-2004-x64
6DeviceCred...nt.exe
windows10-2004-x64
4DeviceEject.exe
windows10-2004-x64
1DeviceEnroller.exe
windows10-2004-x64
1DevicePair...rd.exe
windows10-2004-x64
1DeviceProperties.exe
windows10-2004-x64
1DiskSnapshot.exe
windows10-2004-x64
1Dism.exe
windows10-2004-x64
1ctfmon.exe
windows10-2004-x64
1cttune.exe
windows10-2004-x64
1cttunesvr.exe
windows10-2004-x64
1curl.exe
windows10-2004-x64
1curl.exe
windows11-ltsc_2024-x64
1dasHost.exe
windows10-2004-x64
1dccw.exe
windows10-2004-x64
1dcomcnfg.exe
windows10-2004-x64
5ddodiag.exe
windows10-2004-x64
1deployment...er.exe
windows10-2004-x64
1desktopimgdownldr.exe
windows10-2004-x64
1dfrgui.exe
windows10-2004-x64
1dialer.exe
windows10-2004-x64
1directxdat...er.exe
windows10-2004-x64
1diskpart.exe
windows10-2004-x64
1diskperf.exe
windows10-2004-x64
1diskraid.exe
windows10-2004-x64
4Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
system 32 d.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral2
Sample
system 32 d.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral3
Sample
CustomInstallExec.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral4
Sample
DFDWiz.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
300 seconds
Behavioral task
behavioral5
Sample
DataExchangeHost.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
300 seconds
Behavioral task
behavioral6
Sample
DataStoreCacheDumpTool.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
300 seconds
Behavioral task
behavioral7
Sample
Defrag.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
300 seconds
Behavioral task
behavioral8
Sample
DeviceCensus.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
17 signatures
300 seconds
Behavioral task
behavioral9
Sample
DeviceCredentialDeployment.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
300 seconds
Behavioral task
behavioral10
Sample
DeviceEject.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral11
Sample
DeviceEnroller.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral12
Sample
DevicePairingWizard.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral13
Sample
DeviceProperties.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral14
Sample
DiskSnapshot.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral15
Sample
Dism.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral16
Sample
ctfmon.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral17
Sample
cttune.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral18
Sample
cttunesvr.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral19
Sample
curl.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral20
Sample
curl.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral21
Sample
dasHost.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral22
Sample
dccw.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral23
Sample
dcomcnfg.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
300 seconds
Behavioral task
behavioral24
Sample
ddodiag.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral25
Sample
deploymentcsphelper.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral26
Sample
desktopimgdownldr.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral27
Sample
dfrgui.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral28
Sample
dialer.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral29
Sample
directxdatabaseupdater.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral30
Sample
diskpart.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral31
Sample
diskperf.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral32
Sample
diskraid.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
300 seconds
General
- Target system 32 d.zip
- Size 2.1MB
- Sample261026-s6y8dsxwby
- SHA256 c7dbd71b100acc6e7a140ffc38c5dbeada123ea6fc1ac51c726aac3eefe77027
- MD5 814829f91635ec96ef7e674abfef789c
- SHA1 2e7001fe1f81d674ebe977143e22a31bb2c2f546
- SHA512 9e189d1b2695c10979d7cd5650178ac6b999e2b6603b86d23e7ca2d433639cd4df01b0ae924ca36bfdc4c565591962ade3b1b720575def168bba720a1874cb0a
- SSDEEP 49152:49I4eHbtINXsomdR4bvHzFOvC8aVhxRI74TTHrMp:bfbSyr4brFn8aVO74TTA
- TLSH T15BA533C082CC719DC91BA9A4DB7A505B449A844C5C3C5F0371F99BEE34D85EEB327AE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 26 IoCs
Checks for missing Authenticode signature.
resource unpack001/CustomInstallExec.exe unpack001/DFDWiz.exe unpack001/DataStoreCacheDumpTool.exe unpack001/Defrag.exe unpack001/DeviceCredentialDeployment.exe unpack001/DeviceEject.exe unpack001/DeviceEnroller.exe unpack001/DevicePairingWizard.exe unpack001/DeviceProperties.exe unpack001/DiskSnapshot.exe unpack001/ctfmon.exe unpack001/cttune.exe unpack001/cttunesvr.exe unpack001/dasHost.exe unpack001/dccw.exe unpack001/dcomcnfg.exe unpack001/ddodiag.exe unpack001/deploymentcsphelper.exe unpack001/desktopimgdownldr.exe unpack001/dfrgui.exe unpack001/dialer.exe unpack001/directxdatabaseupdater.exe unpack001/diskpart.exe unpack001/diskperf.exe unpack001/diskraid.exe unpack001/diskusage.exe
File Explorer
-
system 32 d.zip.zip 2.1MB
-
CustomInstallExec.exe.exe 160KB
-
DFDWiz.exe.exe 76KB
-
DataExchangeHost.exe.exe 291KB
-
DataStoreCacheDumpTool.exe.exe 196KB
-
Defrag.exe.exe 236KB
-
DeviceCensus.exe.exe 163KB
-
DeviceCredentialDeployment.exe.exe 120KB
-
DeviceEject.exe.exe 48KB
-
DeviceEnroller.exe.exe 564KB
-
DevicePairingWizard.exe.exe 120KB
-
DeviceProperties.exe.exe 92KB
-
DiskSnapshot.exe.exe 96KB
-
Dism.exe.exe 331KB
-
ctfmon.exe.exe 68KB
-
cttune.exe.exe 152KB
-
cttunesvr.exe.exe 64KB
-
curl.exe.exe 799KB
-
dasHost.exe.exe 196KB
-
dccw.exe.exe 168KB
-
dcomcnfg.exe.exe 32KB
-
ddodiag.exe.exe 68KB
-
deploymentcsphelper.exe.exe 60KB
-
desktopimgdownldr.exe.exe 156KB
-
dfrgui.exe.exe 140KB
-
dialer.exe.exe 68KB
-
directxdatabaseupdater.exe.exe 172KB
-
diskpart.exe.exe 172KB
-
diskperf.exe.exe 48KB
-
diskraid.exe.exe 348KB
-
diskusage.exe.exe 72KB
CustomInstallExec.exe
- IMPHASH b07424b7b485a1b9c50409e7c2d04a76
- SHA256 bd6f1d094d88f586fbb13d30fd5412759b3782d2e58a99d91729cb9d75c07a18
- MD5 f09fa2cd63629b28bdebfc80de3b7b47
- SHA1 a51c4b126c3e220e8768e9b36639de58a4ff23a1
- SHA512 3f3441088c60f6bdb87786e647860bd7dd5587874e4d1c4d208877e6b4ad4e53974d92e53d96c8f1a337c0d2fed5f01fa0d81429375f214ca00657336d4a904e
- SSDEEP 1536:EtRGD7su1GJXbShVNVbkkTwqrPHP6LIx9T9ShvO9BpVHNu6dbKmzIEVmnlc7DR/G:EtQXTxVb4q76LY8hMLk6JKmzIc0ODR/
- TLSH T13CF36B256BA654F9D439807CCA93810AE372747343264BEF5AD641EE0FA7AC01D3EBD4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
11152
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
CustomInstallExec.pdb
msvcp_win
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
_initterm_e
_initterm
_c_exit
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configthreadlocale
_o__configure_wide_argv
_o__crt_atexit
_o__errno
_o__exit
_o__get_wide_winmain_command_line
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
memmove
_o__wcsicmp
_o__wtoi
_o__wtoi64
_o_exit
_o_free
_o_malloc
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
__CxxFrameHandler3
_CxxThrowException
_o___stdio_common_vsnwprintf_s
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA
LoadStringW
GetModuleFileNameW
api-ms-win-core-synch-l1-1-0
CreateMutexExW
ReleaseSemaphore
WaitForSingleObject
AcquireSRWLockExclusive
CreateSemaphoreExW
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseSRWLockExclusive
ReleaseMutex
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetErrorMode
GetLastError
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
OpenProcessToken
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringOrdinal
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemDirectoryW
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateStringReference
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventUnregister
EventSetInformation
EventActivityIdControl
EventRegister
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoGetActivationFactory
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-processenvironment-l1-1-0
GetCommandLineW
api-ms-win-core-com-l1-1-0
CoInitializeEx
CoCreateInstance
CoUninitialize
api-ms-win-security-base-l1-1-0
IsValidSid
GetSidSubAuthority
GetTokenInformation
GetSidSubAuthorityCount
api-ms-win-core-psapi-l1-1-0
K32GetModuleFileNameExW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-windowserrorreporting-l1-1-0
WerSetFlags
WerGetFlags
api-ms-win-shcore-obsolete-l1-1-0
CommandLineToArgvW
ntdll
NtQueryInformationProcess
NtQueryMutant
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolQueueTask
api-ms-win-rtcore-ntuser-window-l1-1-0
EnableWindow
AllowSetForegroundWindow
SetWindowTextW
DefWindowProcW
EnumWindows
ShowWindow
SetForegroundWindow
RegisterClassExW
CreateWindowExW
GetWindowThreadProcessId
comctl32
InitCommonControlsEx
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
Name
.text
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
296B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=66, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=1192, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=32, id=261, version=33145,
count=14, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
DFDWiz.exe
- IMPHASH 6a73ca60b481df35c069d7a319044450
- SHA256 211c577f2902087ad252982e90ac0f00c6712bd536fc99328e3572ae76263805
- MD5 5b264cec1d25fc6db61dd469eefacd52
- SHA1 e1e9da41b8f84a7ff3f1d4cf71bdb7c8fbc8d328
- SHA512 506e6662a02ec7478db92b897167fdba32979150e59fddfe558f6d5f405c1267e58eb296d1f16124e9ed6f560444501611970697b48cb10c750fc6ce82c19a73
- SSDEEP 768:0dPCcSBOoIBiRbxJLn8qy61HRO4uX18WYoLJuZUTopCj1MPWGNUbPGS:0dqJLh1xfkVspNS
- TLSH T12F73E86D92F830A9D4B68334857223659A31B4393F129AEF01F0C5396F16AF09F39F56
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4496
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
DFDWiz.pdb
advapi32
TraceMessage
OpenProcessToken
RegOpenKeyExW
EventWrite
RegQueryInfoKeyW
RegCloseKey
RegEnumKeyExW
RegDeleteKeyW
ConvertStringSecurityDescriptorToSecurityDescriptorW
LookupPrivilegeValueW
AdjustTokenPrivileges
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
EventRegister
EventUnregister
RegEnumValueW
kernel32
GetCurrentThreadId
HeapAlloc
GetCurrentProcess
CreateFileW
HeapFree
OpenMutexW
GetProcAddress
LocalFree
GetVersionExW
FormatMessageW
GetProcessHeap
HeapSetInformation
RegisterApplicationRestart
Sleep
CloseHandle
OutputDebugStringA
QueryActCtxW
GetModuleHandleExW
GetModuleFileNameW
CreateActCtxW
FindActCtxSectionStringW
LoadLibraryW
ActivateActCtx
GetLastError
DeactivateActCtx
CreateMutexW
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
SetLastError
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
DeviceIoControl
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
GetVolumePathNamesForVolumeNameW
user32
MessageBoxW
msvcrt
__C_specific_handler
_vsnwprintf
memcmp
_callnewh
free
_XcptFilter
_amsg_exit
_wcsicmp
malloc
?terminate@@YAXXZ
_commode
_fmode
_acmdln
memset
_initterm
__setusermatherr
_ismbblead
_cexit
_exit
exit
__set_app_type
__getmainargs
__CxxFrameHandler4
memcpy
ole32
CoCreateGuid
CoCreateInstance
CoUninitialize
CoInitializeEx
StringFromGUID2
ntdll
RtlCaptureContext
RtlVirtualUnwind
WinSqmAddToStream
WinSqmEndSession
WinSqmStartSession
WinSqmSetDWORD
RtlLookupFunctionEntry
setupapi
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDeviceInterfaceDetailW
oleaut32
SysFreeString
SysAllocString
VariantInit
VariantClear
Name
.text
Size
36KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=4, id=259, version=33138,
count=23, id=260, version=33138,
count=5, id=261, version=33138,
count=21, id=257, version=33138,
count=172, id=1, productName=Unmarked objects,
count=20, id=264, version=33138,
count=1, id=255, version=33138,
count=1, id=258, version=33138,
DataExchangeHost.exe
- IMPHASH 25efadf3feeb5474e531ab0dff5137db
- SHA256 37d9071564bffd911d8c6aba6b82b350005bccb848388b95ca87aeb13c7a9caa
- MD5 a35dcc33de9643dc74dbbb8e0532079f
- SHA1 575b8632b46654494a0e10f8ee62e78956f1edd9
- SHA512 6435d6c46241d8c0227514183174863ff4e071313cb4a5084245da1eb488b568ec5f944bab611987e1bcd8bfb0649bdd2e4e09be31b7ff959ba5fb85f128e3d6
- SSDEEP 3072:BnhYqEgnkFHnLizq9x6Cc7RcpKl9cix9DlmnIJLgUFao8FABI9i/AxLsfFLRbosw:h+qEgnkFHZ9URuifInIJLgcL8uw6josE
- TLSH T136544C6E27E80CE5E97BD17CC582860AF67178615322D2CF02E1426B4F27FE4AD39B51
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
83:00:b4:84:ef:5a:3f:d6:5e:6b:74:84:61:f1:13:28:99:5f:a8:82:35:3c:b3:25:2f:df:31:e3:8a:b5:e2:97
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 18, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Windows Production PCA 2023,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
83:00:b4:84:ef:5a:3f:d6:5e:6b:74:84:61:f1:13:28:99:5f:a8:82:35:3c:b3:25:2f:df:31:e3:8a:b5:e2:97
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 18, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2026 RSA2048-SHA256,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:16:a1:29:a0:c1:87:02:f4:4f:00:00:00:00:00:16
Issuer
CN=Microsoft Windows Production PCA 2026 RSA2048-SHA256,O=Microsoft Corporation,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 6, 2026 - Aug 5, 2027
Subject
CN=Microsoft Windows Production PCA 2026 RSA2048-SHA256,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:1e:e9:35:2b:ec:86:01:54:15:00:00:00:00:00:1e
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 4, 2026 - Aug 4, 2031
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:591A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:14:8d:cd:23:44:ee:06:df:72:00:01:00:00:02:14
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:43:b8:18:0a:66:21:27:1e:b0:00:00:00:00:01:43
Issuer
CN=Windows Production PCA 2023,O=Microsoft Corporation,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 18, 2026 - Jun 17, 2027
Subject
CN=Windows Production PCA 2023,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:17:85:bd:56:09:4b:f8:c8:21:00:00:00:00:00:17
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 13, 2023 - Jun 13, 2035
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6B05-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:11:45:18:39:9b:43:cf:fc:6c:00:01:00:00:02:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Minor OS version
0
Major OS version
10
Entry point
13536
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
DataExchangeHost.pdb
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
_c_exit
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__get_wide_winmain_command_line
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
memmove
_o_abort
_o_ceilf
_o_exit
_o_floor
_o_free
_o_iswspace
_o_malloc
_o_memcpy_s
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
__CxxFrameHandler3
_CxxThrowException
_o__exit
_o__errno
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
_o__cexit
_o__callnewh
wcschr
_o___stdio_common_vswprintf
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
FindResourceExW
GetModuleHandleW
LockResource
GetModuleHandleExW
LoadLibraryExW
GetProcAddress
GetModuleFileNameA
FreeLibrary
LoadResource
api-ms-win-core-synch-l1-1-0
SetEvent
ReleaseSRWLockShared
ResetEvent
DeleteCriticalSection
WaitForSingleObjectEx
AcquireSRWLockExclusive
CreateMutexExW
ReleaseSRWLockExclusive
CreateSemaphoreExW
InitializeCriticalSection
ReleaseMutex
AcquireSRWLockShared
WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection
CreateEventW
ReleaseSemaphore
EnterCriticalSection
OpenSemaphoreW
api-ms-win-core-heap-l1-1-0
HeapFree
HeapSetInformation
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
RaiseException
GetLastError
SetErrorMode
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
OpenProcessToken
TerminateProcess
GetProcessId
GetStartupInfoW
SetPriorityClass
OpenThreadToken
GetCurrentThread
GetCurrentThreadId
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
GetLocaleInfoW
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-processthreads-l1-1-1
OpenProcess
SetProcessMitigationPolicy
GetProcessMitigationPolicy
IsProcessorFeaturePresent
api-ms-win-core-com-l1-1-0
CoCancelCall
CoIncrementMTAUsage
CoInitializeSecurity
CoFreeUnusedLibrariesEx
CoUninitialize
CoCreateInstance
CoInitializeEx
CoGetCallerTID
CoDecrementMTAUsage
CreateStreamOnHGlobal
CoTaskMemRealloc
CoMarshalInterface
CoGetCallContext
CoResumeClassObjects
CoDisableCallCancellation
CoReleaseServerProcess
CoCreateFreeThreadedMarshaler
CoAddRefServerProcess
CoGetMalloc
CoReleaseMarshalData
CoRevokeClassObject
CoTaskMemAlloc
CoUnmarshalInterface
CoMarshalInterThreadInterfaceInStream
CoTaskMemFree
CoRegisterClassObject
CoEnableCallCancellation
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoRegisterActivationFactories
RoGetActivationFactory
RoRevokeActivationFactories
api-ms-win-core-winrt-error-l1-1-0
GetRestrictedErrorInfo
SetRestrictedErrorInfo
RoTransformError
RoOriginateErrorW
RoOriginateError
api-ms-win-core-winrt-string-l1-1-0
WindowsCompareStringOrdinal
WindowsCreateStringReference
WindowsGetStringLen
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsDeleteString
WindowsDuplicateString
WindowsCreateString
WindowsGetStringRawBuffer
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
InitOnceExecuteOnce
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InterlockedPushEntrySList
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-security-base-l1-1-0
DuplicateTokenEx
GetTokenInformation
GetSidSubAuthority
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventRegister
EventSetInformation
EventActivityIdControl
EventWriteTransfer
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolQueueTask
SHTaskPoolAllowThreadReuse
api-ms-win-core-winrt-error-l1-1-1
IsErrorPropagationEnabled
RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
RoOriginateLanguageException
api-ms-win-core-registry-l1-1-0
RegGetValueW
api-ms-win-core-file-l1-1-0
CompareFileTime
api-ms-win-core-localization-obsolete-l1-2-0
GetUserDefaultUILanguage
api-ms-win-core-threadpool-legacy-l1-1-0
DeleteTimerQueueTimer
CreateTimerQueueTimer
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-shcore-stream-winrt-l1-1-0
CreateStreamOverRandomAccessStream
api-ms-win-shcore-stream-l1-1-0
IStream_Reset
IStream_Read
IStream_Size
ntdll
ZwQueryWnfStateData
RtlNtStatusToDosError
RtlCompareUnicodeString
RtlNtStatusToDosErrorNoTeb
RtlAllocateHeap
RtlInitUnicodeString
NtQueryInformationToken
RtlFreeHeap
api-ms-win-core-debug-l1-1-1
CheckRemoteDebuggerPresent
api-ms-win-core-heap-obsolete-l1-1-0
GlobalUnlock
GlobalLock
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-atoms-l1-1-0
GlobalGetAtomNameW
api-ms-win-security-capability-l1-1-0
CapabilityCheck
api-ms-win-rtcore-ntuser-window-l1-1-0
GetClassInfoExW
RegisterClassExW
KillTimer
ShowWindow
ScreenToClient
SendMessageW
DispatchMessageW
GetForegroundWindow
ClientToScreen
DestroyWindow
SetForegroundWindow
WindowFromPoint
GetWindowLongW
GetParent
GetWindowThreadProcessId
GetDesktopWindow
AllowSetForegroundWindow
GetWindowRect
GetPropW
GetMessageW
DefWindowProcW
SetTimer
GetWindowLongPtrW
SetWindowLongPtrW
TranslateMessage
CreateWindowExW
PostMessageW
UnregisterClassW
d2d1
ord7
d3d11
D3D11CreateDevice
api-ms-win-rtcore-ntuser-private-l1-1-0
CreateWindowInBand
api-ms-win-ntuser-sysparams-l1-1-0
GetSystemMetrics
dwrite
DWriteCreateFactory
api-ms-win-rtcore-ntuser-clipboard-l1-1-0
GetClipboardFormatNameW
api-ms-win-appmodel-runtime-l1-1-0
GetPackageFullName
combase
ord69
ord99
twinapi
ord12
ord11
dcomp
DCompositionCreateDevice2
ord1019
user32
ord2557
GetTopLevelWindow
SendInput
ReleaseCapture
ord2521
SetCapture
AttachThreadInput
GetSysColor
GetAsyncKeyState
SetProcessDefaultLayout
GetWindowDpiAwarenessContext
GetCapture
IsIconic
ord2550
msvcp_win
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?width@ios_base@std@@QEBA_JXZ
?good@ios_base@std@@QEBA_NXZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?flags@ios_base@std@@QEBAHXZ
?uncaught_exception@std@@YA_NXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGXZ
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?width@ios_base@std@@QEAA_J_J@Z
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG0@Z
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
oleaut32
SetErrorInfo
GetErrorInfo
SysStringLen
SysFreeString
Name
.text
Size
176KB
Virtual Size
174KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.imrsiv
Size
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
60KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=119, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=1383, id=1, productName=Unmarked objects,
count=10, id=257, version=33145,
count=37, id=261, version=33145,
count=24, id=264, version=33145,
count=13, id=260, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
DataStoreCacheDumpTool.exe
- IMPHASH d3b137b608e5c76814b93a93addd85af
- SHA256 1b45ae1ea4afaea82aa5046feb6c862ea3c70a31ebcd89ed5c1b2ea48dfbd6ce
- MD5 fdbb5c34de153033d92706330bd22c4a
- SHA1 0dd4c31f9ef76ba047bc5f04e0acb9ecc39c5f25
- SHA512 787d85664bee486694bf7bb4e3828fc94227522c01f71fa2f36d3d59c39f5e25a6b05f942e0c184d9965e2017c4366ef3f0418fa6472bb5d21e4b99557e5e664
- SSDEEP 3072:STpwdOHjRtwvfs++1vySyqtpmYIzR6W5TnRIXfxLpFdejsjTfgQmx:STO8DRtwXt+1vEqmmWlnqAjQ
- TLSH T13B142A1B37E800E5E177A17C99620606F6B37826133192DF0798817E1F67FE8AD39B61
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
114112
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
DataStoreCacheDumpTool.pdb
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
_initterm
_initterm_e
_c_exit
api-ms-win-crt-private-l1-1-0
_o__crt_atexit
_o__errno
_o__exit
_o__fileno
_o__get_errno
_o__get_initial_wide_environment
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_errno
_o__set_fmode
_o__set_new_mode
_o__setmode
memmove
_o__wfopen
_o_ceilf
_o_exit
_o_fclose
_o_free
_o_malloc
_o_sqrt
_o_terminate
_o_towupper
__C_specific_handler
__CxxFrameHandler3
__current_exception
__current_exception_context
_CxxThrowException
_o___stdio_common_vfwprintf
_o__cexit
_o__callnewh
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
_o__configure_wide_argv
_o___p___wargv
_o___p___argc
_o__configthreadlocale
_o___acrt_iob_func
wcsrchr
__std_terminate
__CxxFrameHandler4
_o___stdio_common_vswprintf
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleHandleW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleExW
FreeLibrary
LoadLibraryExW
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
Sleep
api-ms-win-core-synch-l1-1-0
OpenSemaphoreW
WaitForSingleObjectEx
CreateMutexExW
CreateSemaphoreExW
AcquireSRWLockShared
SetEvent
ReleaseSRWLockExclusive
CreateEventExW
AcquireSRWLockExclusive
ReleaseMutex
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection
DeleteCriticalSection
ResetEvent
CreateEventW
ReleaseSRWLockShared
ReleaseSemaphore
EnterCriticalSection
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
GetLastError
RaiseException
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoTaskMemAlloc
CoWaitForMultipleHandles
StringFromGUID2
CoUninitialize
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoInitializeEx
CoTaskMemRealloc
api-ms-win-core-processthreads-l1-1-0
OpenThreadToken
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentThread
OpenProcessToken
GetCurrentProcess
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-shell-shdirectory-l1-1-0
ord290
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventRegister
EventWriteTransfer
EventUnregister
api-ms-win-core-path-l1-1-0
PathCchRemoveFileSpec
PathCchCanonicalizeEx
api-ms-win-core-psapi-l1-1-0
K32GetModuleFileNameExW
api-ms-win-core-registry-l1-1-0
RegGetValueW
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-winrt-string-l1-1-0
WindowsDuplicateString
WindowsDeleteString
WindowsCreateStringReference
WindowsGetStringRawBuffer
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoGetActivationFactory
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-shlwapi-obsolete-l1-1-0
StrStrIW
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-shlwapi-legacy-l1-1-0
PathIsFileSpecW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
api-ms-win-core-file-l1-1-0
GetFileSize
CreateFileW
ReadFile
api-ms-win-shcore-stream-l1-1-0
IStream_Reset
SHCreateMemStream
IStream_Read
IStream_Size
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
Name
.text
Size
120KB
Virtual Size
118KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
592B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=70, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=11, id=260, version=33145,
count=5, id=259, version=33145,
count=1192, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=35, id=261, version=33145,
count=4, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
Defrag.exe
- IMPHASH 1137331d40d7c5943ca6b7219091a1ce
- SHA256 29f2edf4d25f3c14686e74d0189fe13b74e8cee3ae6d93394503ceb974dda30e
- MD5 07a82c856dfd8456f52ff5220dc92272
- SHA1 a13027994b82fcb95e609b43f0a1370e4fafd149
- SHA512 ecc9b56027e8ed5e5bc0f0a3bbb14d64464ec3e5535fa202b523aea5621813d10a1d7c46b85d673eb818094a132c9be468e1994b3924b3ee1bb5b7f09b2b20a2
- SSDEEP 6144:fSrUzouMbBGz0UF19wsfXC3lRGOUZGKc4YFnwjCpW:f+U80S3lRkRc4YFwjsW
- TLSH T1A834AE0532A862D4D2B2967981627A14D773B8300B3613EF0BDC94BF5F67AF19D39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
6832
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
defrag.pdb
msvcrt
_snprintf
realloc
exit
_exit
_cexit
mbtowc
localeconv
iswspace
__setusermatherr
_initterm
fclose
wprintf
_XcptFilter
_vsnwprintf
memcpy_s
_amsg_exit
sprintf_s
__C_specific_handler
swscanf_s
_fmode
_commode
_wcsicmp
free
fflush
wcschr
memmove
memcpy
_callnewh
_vscwprintf
__wgetmainargs
printf
?terminate@@YAXXZ
__set_app_type
__CxxFrameHandler3
_lock
_onexit
fputws
_unlock
_wsetlocale
malloc
_wfopen
__dllonexit
memset
ntdll
RtlGetPersistedStateLocation
RtlGetLastNtStatus
RtlSetThreadErrorMode
RtlNtStatusToDosError
EtwTraceMessage
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlFreeHeap
RtlAllocateHeap
RtlCaptureStackBackTrace
oleaut32
SysAllocString
SysStringLen
VariantClear
VariantInit
SysFreeString
api-ms-win-core-file-l1-1-0
GetVolumePathNameW
GetVolumeInformationW
FindFirstFileW
FindNextFileW
FindClose
GetFileAttributesW
DeleteFileW
GetFullPathNameW
CreateFileW
GetTempFileNameW
CreateDirectoryW
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableLevel
GetTraceLoggerHandle
GetTraceEnableFlags
TraceMessage
RegisterTraceGuidsW
UnregisterTraceGuids
api-ms-win-core-console-l1-1-0
GetConsoleOutputCP
SetConsoleCtrlHandler
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
CreateThread
TerminateProcess
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoDisconnectObject
CoTaskMemFree
CoCreateInstance
CoInitializeEx
CoUninitialize
CoCreateGuid
api-ms-win-core-file-l1-2-3
GetTempPath2W
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
GetCommandLineW
api-ms-win-core-sysinfo-l1-1-0
GetSystemDirectoryW
GetTickCount64
GetTickCount
GetSystemTimeAsFileTime
GetVersionExW
api-ms-win-core-synch-l1-1-0
CreateEventW
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
ResetEvent
WaitForSingleObject
SetEvent
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
GetModuleHandleW
LoadStringW
LoadLibraryExW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapSetInformation
api-ms-win-core-localization-l1-2-0
FormatMessageW
SetThreadUILanguage
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister
rpcrt4
UuidCreate
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
RegCloseKey
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedPushEntrySList
InterlockedPopEntrySList
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
sxshared
SxTracerDebuggerBreak
SxTracerShouldTrackFailure
SxTracerGetThreadContextRetail
api-ms-win-eventing-controller-l1-1-0
ControlTraceW
EnableTraceEx2
StartTraceW
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-file-l2-1-0
MoveFileExW
api-ms-win-core-file-l1-2-0
GetVolumeNameForVolumeMountPointW
GetVolumePathNamesForVolumeNameW
Name
.text
Size
64KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
124KB
Virtual Size
123KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
196B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=70, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=4, id=259, version=33145,
count=23, id=260, version=33145,
count=218, id=1, productName=Unmarked objects,
count=9, id=257, version=33145,
count=7, id=261, version=33145,
count=20, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
DeviceCensus.exe
- IMPHASH 45d0478325c6d1956d67826b54478791
- SHA256 16d6f401c795a924cc44e161c05f9d0e5122488e98571f60c5b88ffca7d63419
- MD5 60691f29aab11acc5927d98bd189b702
- SHA1 4d6d5aeeeb1a941bacff3feda52973ba1b919140
- SHA512 b48d3e4dd1504646bc03d2fd9e677f1c17f31912b4ed265dce62030a03565e914a7d503a823d9117c20354e85f0e55132a0ed6a1cc7dca1e49cb9d3f7cbc837b
- SSDEEP 3072:dRfm7SGo6vLuFwMqs+ADGdb5CLFj65kXN:Lfm7XlvrABFjCg
- TLSH T101F36B1AB7A930FAF5628238D5A19822DB72B575071193DF45E4C03C1E1BBE4AE3CB85
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
35:0c:4c:e0:31:c8:a6:ea:ed:00:5b:cb:b5:5b:fc:15:26:2a:dd:3c:a6:c0:6c:c7:50:99:e1:6d:9e:93:50:68
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 18, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Windows Production PCA 2023,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
35:0c:4c:e0:31:c8:a6:ea:ed:00:5b:cb:b5:5b:fc:15:26:2a:dd:3c:a6:c0:6c:c7:50:99:e1:6d:9e:93:50:68
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 18, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2026 RSA2048-SHA256,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:17:d4:df:d9:e3:95:0b:e7:ef:00:00:00:00:00:17
Issuer
CN=Microsoft Windows Production PCA 2026 RSA2048-SHA256,O=Microsoft Corporation,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 6, 2026 - Aug 5, 2027
Subject
CN=Microsoft Windows Production PCA 2026 RSA2048-SHA256,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:1e:e9:35:2b:ec:86:01:54:15:00:00:00:00:00:1e
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 4, 2026 - Aug 4, 2031
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:3605-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:13:b0:43:35:66:cf:af:95:e8:00:01:00:00:02:13
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:44:4e:42:4c:8a:cb:02:7e:2b:00:00:00:00:01:44
Issuer
CN=Windows Production PCA 2023,O=Microsoft Corporation,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 18, 2026 - Jun 17, 2027
Subject
CN=Windows Production PCA 2023,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:17:85:bd:56:09:4b:f8:c8:21:00:00:00:00:00:17
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 13, 2023 - Jun 13, 2035
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A000-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:2b:bb:00:50:ff:4d:3b:9a:a1:00:01:00:00:02:2b
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Minor OS version
0
Major OS version
10
Entry point
7024
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
DeviceCensus.pdb
msvcrt
__wgetmainargs
_cexit
wcsstr
_vsnwprintf
??_V@YAXPEAX@Z
_wtoi64
_exit
_vsnprintf
wcsrchr
strcpy_s
_amsg_exit
sprintf_s
_wcsnicmp
wcschr
wcscpy_s
wcscat_s
iswspace
_wcslwr
strncmp
_unlock
__dllonexit
exit
wcstok_s
_XcptFilter
memmove
memcpy
__setusermatherr
_CxxThrowException
_lock
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
_initterm
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_onexit
_callnewh
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_commode
_fmode
__C_specific_handler
_wcmdln
malloc
_purecall
__set_app_type
strchr
_wcsicmp
memset
__CxxFrameHandler3
??3@YAXPEAX@Z
memcmp
ntdll
RtlxAnsiStringToUnicodeSize
RtlAnsiStringToUnicodeString
RtlUpcaseUnicodeChar
RtlGetNativeSystemInformation
ZwQuerySystemInformation
ZwUnmapViewOfSection
ZwMapViewOfSection
LdrResSearchResource
RtlVerifyVersionInfo
ZwCreateSection
ZwQueryInformationFile
ZwCreateFile
RtlAppendUnicodeToString
ZwQueryValueKey
RtlInitUnicodeStringEx
ZwEnumerateKey
ZwOpenKey
RtlFreeUnicodeString
RtlDosPathNameToNtPathName_U_WithStatus
RtlMultiByteToUnicodeN
RtlEqualString
ZwClose
EtwEventRegister
EtwEventWrite
EtwEventUnregister
RtlLeaveCriticalSection
RtlFreeHeap
RtlInitializeCriticalSection
RtlInitAnsiString
RtlEnterCriticalSection
RtlReAllocateHeap
RtlAllocateHeap
RtlDeleteCriticalSection
VerSetConditionMask
RtlAppendUnicodeStringToString
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
NtCreateFile
RtlInitString
NtQueryInformationFile
NtClose
RtlInitUnicodeString
RtlDosPathNameToRelativeNtPathName_U_WithStatus
LdrGetDllHandle
LdrGetProcedureAddress
api-ms-win-core-libraryloader-l1-2-0
SetDefaultDllDirectories
GetModuleHandleW
LoadLibraryExW
FreeLibrary
GetProcAddress
GetModuleHandleExA
GetModuleFileNameW
GetModuleHandleExW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
GetCommandLineW
api-ms-win-core-com-l1-1-0
CoUninitialize
CoInitializeEx
api-ms-win-core-processthreads-l1-1-0
GetStartupInfoW
CreateProcessAsUserW
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
api-ms-win-core-synch-l1-1-0
WaitForSingleObject
api-ms-win-shcore-obsolete-l1-1-0
CommandLineToArgvW
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-kernel32-legacy-l1-1-0
WTSGetActiveConsoleSessionId
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
GetLocalTime
GetSystemDirectoryW
dcntel
SetCustomTriggerEx
RunUserContextCensus
SetCustomTrigger
RunSystemContextCensus
GetCensusRegistryLocation
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-kernel32-legacy-l1-1-1
VerifyVersionInfoW
api-ms-win-core-namedpipe-l1-1-0
WaitNamedPipeW
SetNamedPipeHandleState
api-ms-win-core-file-l1-1-0
CreateFileW
WriteFile
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringA
IsDebuggerPresent
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventWriteTransfer
EventUnregister
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
Name
.text
Size
76KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=50, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=22, id=260, version=33145,
count=195, id=1, productName=Unmarked objects,
count=7, id=257, version=33145,
count=9, id=261, version=33145,
count=19, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
DeviceCredentialDeployment.exe
- IMPHASH 22b0e1449afd6d7cd56a84228f5587f3
- SHA256 6613b627fe4a34fa3f829729e56ad6f5110f91291993f8bc58ebd9940ef01106
- MD5 689c3c6599d442734453d742468179a3
- SHA1 9680f25d12487b59d4bc24a9ae4c03e0c47e843e
- SHA512 fcead3d7f3fbd45673d322fe56636427ee90b9be350097098de471ca9c58d2625532fffefb4e4f36db66ad225c3b5ac1266fc6dc4207bdfa67fe6df00882c1f5
- SSDEEP 3072:YIuKzOl+gG4dXB9gM+bBjzFqgCRzp/mDgs2HnU6tl:TPzq+gG4dXPgM+bBjzFqgCRzp/m87U6
- TLSH T1E6C3F92E61F510E4F679B53D88530929F771746213229BEF03A180BE1F6BAE06C3DB65
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
8128
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
DeviceCredentialDeployment.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_c_exit
_register_thread_local_exe_atexit_callback
_initterm
api-ms-win-crt-private-l1-1-0
_o__errno
_o__exit
_o__get_initial_wide_environment
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
memcpy
_o__wcsicmp
_o_exit
_o_free
_o_malloc
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
_CxxThrowException
__CxxFrameHandler3
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
_o___p___wargv
_o___p___argc
__std_terminate
__CxxFrameHandler4
api-ms-win-crt-string-l1-1-0
memset
devicecredential
DeviceCredentialScanDeploymentData
DeviceCredentialUpdateDeploymentData
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetModuleHandleExA
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
api-ms-win-core-synch-l1-1-0
CreateSemaphoreExW
CreateMutexExW
ReleaseSRWLockExclusive
SetEvent
WaitForSingleObject
CreateEventExW
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
ReleaseSemaphore
AcquireSRWLockExclusive
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-processthreads-l1-1-0
CreateThread
GetCurrentProcess
OpenProcessToken
TerminateProcess
GetCurrentThreadId
GetExitCodeThread
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
api-ms-win-eventing-provider-l1-1-0
EventActivityIdControl
EventUnregister
EventWriteTransfer
EventRegister
EventSetInformation
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
Sleep
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegQueryInfoKeyW
RegGetValueW
RegQueryValueExW
RegCloseKey
RegEnumKeyExW
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-winrt-l1-1-0
RoUninitialize
RoInitialize
RoActivateInstance
RoGetActivationFactory
api-ms-win-power-setting-l1-1-0
PowerSettingRegisterNotification
api-ms-win-core-console-l3-2-0
GetConsoleWindow
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
api-ms-win-security-base-l1-1-0
EqualSid
GetTokenInformation
api-ms-win-core-com-l1-1-0
CoWaitForMultipleHandles
CoCreateFreeThreadedMarshaler
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateStringReference
WindowsCreateString
api-ms-win-core-kernel32-legacy-l1-1-0
WTSGetActiveConsoleSessionId
api-ms-win-security-lsalookup-l1-1-0
LookupAccountNameLocalW
LookupAccountSidLocalW
api-ms-win-rtcore-ntuser-powermanagement-l1-1-0
UnregisterPowerSettingNotification
ntdll
RtlGetDeviceFamilyInfoEnum
RtlInitUnicodeString
RtlDeriveCapabilitySidsFromName
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
Name
.text
Size
64KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
200B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
428B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=33145,
count=95, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1256, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33145,
count=5, id=259, version=33145,
count=32, id=261, version=33145,
count=8, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
DeviceEject.exe
- IMPHASH 18d9c700cbb02b0617ecc006a52b659f
- SHA256 5bc9a9c1153a37f239b8443fd264753a28093bd92455dbfb6deef4bdb17c393f
- MD5 9eb2fbc2d7f299c7e0acad945ad9620a
- SHA1 be3aa9784b22229db3e2fa55784f749955a446f5
- SHA512 58efd5c03975bb89bddcb1021152e4e73bafc0226fdeb367fd28edd3bce53c3ee6d4bf2baec16fae7afa7d1a5d99692216e38d4fd713a2f725f4317e52996be1
- SSDEEP 384:KdRx/uBpN9XmQ1nxMTIWywW5JY0ehA/9gnl0:KdeLNr1xMsbJYQ/9gnl0
- TLSH T144234A41A3A685D5F13202794473466016BCFD314BA20BEF35A4B52F1F32EC16A3BBD6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4416
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
DeviceEject.pdb
msvcrt
__set_app_type
swscanf
_amsg_exit
?terminate@@YAXXZ
exit
_fmode
_acmdln
memset
_XcptFilter
_initterm
__setusermatherr
_ismbblead
_cexit
_commode
_exit
__getmainargs
__C_specific_handler
ntdll
RtlCaptureContext
RtlNtStatusToDosError
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-core-processenvironment-l1-1-0
GetCommandLineW
api-ms-win-security-base-l1-1-0
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-heap-l1-1-0
HeapSetInformation
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
FreeLibrary
GetProcAddress
api-ms-win-core-processthreads-l1-1-0
GetStartupInfoW
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
ExitProcess
GetCurrentThreadId
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
shell32
CommandLineToArgvW
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
276B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
136B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=261, version=33136,
count=1, productName=Unmarked objects (old),
count=4, id=259, version=33136,
count=20, id=260, version=33136,
count=49, id=1, productName=Unmarked objects,
count=7, id=257, version=33136,
count=2, id=264, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
DeviceEnroller.exe
- IMPHASH e35e05f6a47d85a6473e79cd9348198e
- SHA256 95b8040c1967d7d0c03441446b94c26289d5fb481501e378d396a60a97d50132
- MD5 5d282b40fb57db9e704232c1356065de
- SHA1 979e59138efd10ed7f447cb9c32d25391420e870
- SHA512 d8a9caa2173b20e1d22a6d3b8c599ab55296b4f77fabebc09ba5717bce63bdac81b2cb046bd1ae2624cbde9df4c3315b26c4bac6a642de3f421fd68960e33aeb
- SSDEEP 12288:Ue7i0PRr0fWfEYVaaa/N8B7qjAbPADdtFz0grZ:bt1sWqjNdtF0gr
- TLSH T140C4191E53F802D4F276E27899674509FA72386213328ADF1291817D1F7BEE49D36F22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
17888
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
deviceenroller.pdb
api-ms-win-crt-string-l1-1-0
wcsncmp
memset
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
_initterm
_c_exit
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__wcsicmp
_o__wcsnicmp
_o__wtoi
_o__initialize_narrow_environment
memmove
_o_exit
_o_free
_o_malloc
_o_rand
_o_srand
_o_terminate
_o_wcsncpy_s
_o_wcstod
_o_wmemcpy_s
__CxxFrameHandler3
__current_exception
__current_exception_context
_CxxThrowException
_o__get_narrow_winmain_command_line
_o__exit
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__configthreadlocale
_o__cexit
_o__callnewh
_o__invalid_parameter_noinfo_noreturn
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnwprintf_s
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
wcsstr
__C_specific_handler
__std_terminate
__CxxFrameHandler4
__C_specific_handler_noexcept
memcmp
memcpy
dmenrollengine
ord10
GetIsRecoveryAllowed
EnrollEngineInitialize
SetEnrollState
GetEnrollmentLinkedEnrollmentId
SetMmpcEnrollmentFlag
GetEnrollmentType
GetEnrollmentTenantID
MmpcDiscoverEndpoint
GetEnrollmentCertStore
GetEnrollmentClientCertThumbprint
ord7
GetEnrollmentAadResourceUrl
GetEnrollmentEntDmId
GetEnrollmentPartnerOpaqueID
ord3
GetEnrollmentState
GetEnrollmentSID
ord1
GetEnrollmentAuthPolicy
dmcmnutils
InvStrCmpIW
DmGetActiveUserSid
UnicodeToMB
MBToUnicode
OmaDmRegistryGetString
DmGetAadUserToken
DmRevertToSelf
CopyString
DmGetCurrentUserSid
OmaDmRegistrySetDWORD
OmDmRegistryAllocAndGetString
OmaDmRegistrySetString
OmaDmRegistrySetBinary
BigStrcat
DmDeleteTask
HexStringToBinary
DmRemoveToastNotificationByExecutablePath
OmaDmRegistryGetAllSubKeys
EncodeBase64W
DmImpersonate
OmaDmRegistryDeleteValue
DmRaiseToastNotificationAndWait
OmaDmRegistryGetDWORD
DmGetAadDeviceToken
DmRemoveToastNotification
SafeWideCharToMultiByte
DmRaiseToastNotification
DmWnfQuery
DmDisableTask
omadmapi
ord114
ord105
ord64
ord47
ord22
ord52
ord34
ord101
ord104
ord119
ord54
ord117
ord103
ord23
ord56
ord37
ord18
ord118
ord102
ntdll
RtlIsStateSeparationEnabled
RtlNtStatusToDosError
RtlCaptureContext
NtDeleteWnfStateName
RtlIsMultiUsersInSessionSku
RtlGetDeviceFamilyInfoEnum
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlNtStatusToDosErrorNoTeb
NtCreateWnfStateName
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
combase
ord69
ord154
umpdc
PdcActivationClientActivityRequest
PdcActivationClientUnregister
PdcActivationClientRegister
xmllite
CreateXmlReaderInputWithEncodingName
CreateXmlReader
api-ms-win-shcore-stream-l1-1-0
SHCreateMemStream
dmenterprisediagnostics
RecordDiagnosticsError
dcsvc
DeclaredConfigurationResourceCleanup
api-ms-win-core-libraryloader-l1-2-0
LoadStringW
GetModuleFileNameA
GetModuleHandleW
SizeofResource
LoadResource
GetModuleHandleExW
LockResource
FreeLibrary
GetProcAddress
GetModuleFileNameW
FindResourceExW
LoadLibraryExW
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
AcquireSRWLockShared
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
CreateSemaphoreExW
ResetEvent
ReleaseSRWLockExclusive
CreateEventW
WaitForMultipleObjectsEx
InitializeCriticalSectionEx
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
OpenEventW
SetEvent
ReleaseMutex
WaitForSingleObject
ReleaseSemaphore
CreateEventExW
ReleaseSRWLockShared
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
RaiseException
SetLastError
GetLastError
UnhandledExceptionFilter
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsDeleteString
api-ms-win-core-processthreads-l1-1-0
SetThreadPriority
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
OpenThreadToken
GetCurrentThreadId
OpenProcessToken
GetStartupInfoW
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-winrt-l1-1-0
RoInitialize
RoActivateInstance
RoGetActivationFactory
RoUninitialize
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
oleaut32
SysAllocStringByteLen
VariantInit
VariantClear
VariantTimeToSystemTime
VarUI4FromStr
VariantChangeTypeEx
SysAllocStringLen
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayUnlock
SafeArrayGetLBound
SysFreeString
SysStringByteLen
SafeArrayCreate
SysAllocString
SafeArrayLock
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-eventing-provider-l1-1-0
EventActivityIdControl
EventRegister
EventSetInformation
EventUnregister
EventWriteTransfer
api-ms-win-core-synch-l1-2-0
InitOnceComplete
Sleep
InitOnceBeginInitialize
api-ms-win-security-lsalookup-l2-1-0
LookupAccountSidW
LookupPrivilegeValueW
LookupAccountNameW
api-ms-win-core-processenvironment-l1-1-0
GetCommandLineW
ExpandEnvironmentStringsW
api-ms-win-core-shutdown-l1-1-0
InitiateSystemShutdownExW
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegCloseKey
RegQueryInfoKeyW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegGetValueW
RegDeleteValueW
RegDeleteTreeW
RegCreateKeyExW
RegOpenCurrentUser
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
samcli
NetLocalGroupAddMembers
NetLocalGroupGetMembers
NetUserGetInfo
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-url-l1-1-0
UrlUnescapeW
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW
ConvertSidToStringSidW
api-ms-win-core-kernel32-legacy-l1-1-0
GetComputerNameW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-security-base-l1-1-0
AdjustTokenPrivileges
GetLengthSid
RevertToSelf
GetTokenInformation
CopySid
ImpersonateLoggedOnUser
netutils
NetApiBufferFree
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount64
GetSystemTime
GetTickCount
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-winrt-error-l1-1-0
SetRestrictedErrorInfo
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
FileTimeToSystemTime
api-ms-win-core-file-l1-1-0
CompareFileTime
FileTimeToLocalFileTime
sspicli
GetUserNameExW
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
api-ms-win-core-registry-l2-1-0
RegDeleteKeyW
crypt32
CertFreeCertificateContext
CertCloseStore
CertFindCertificateInStore
CertOpenStore
declaredconfiguration
DMOrchestratorRefreshPerEnrollment
DMOrchestratorRefresh
msvcp_win
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@J@Z
?good@ios_base@std@@QEBA_NXZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGD@Z
?put@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@G@Z
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?uncaught_exception@std@@YA_NXZ
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
Name
.text
Size
384KB
Virtual Size
380KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
120KB
Virtual Size
116KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
24KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=111, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33145,
count=5, id=259, version=33145,
count=1607, id=1, productName=Unmarked objects,
count=22, id=257, version=33145,
count=40, id=261, version=33145,
count=78, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
DevicePairingWizard.exe
- IMPHASH fc75d6764fd6ee0adc5985692902a1d4
- SHA256 0ab9f2923dac072716a8380ec909ea9f74b9f1755f149c2a41f61b49d93633a2
- MD5 de6471e5de8b40227d9c3fa89c79c7d6
- SHA1 672a0b4bcabe6abb76aa9edb0e729bf38ed8ab15
- SHA512 f525a733539469801c1505ede2303b67329c15822799998087c15fc58f3a8eaf8be9b423f9170452cf0ee2e8fb673960ed78bde55055076175b8829a65fd9232
- SSDEEP 1536:eb9plgNEI8PhXSH6GAPUABA9vrAN0y1h9qZ3qOT8:s9IQMHeUABA9vENF1ro8
- TLSH T121C3D6D9B65814DBDDF4C3BCD17D8B15DB70B85003157ADBAE9043A94AAAACC3838F81
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
8656
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
DevicePairingWizard.pdb
advapi32
EventUnregister
EventSetInformation
EventRegister
EventActivityIdControl
EventWriteTransfer
kernel32
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
SetLastError
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
HeapAlloc
GetProcAddress
CreateMutexExW
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
WideCharToMultiByte
DebugBreak
IsDebuggerPresent
InitOnceBeginInitialize
InitOnceComplete
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
mfc42u
ord6887
ord4598
ord5039
ord659
ord1063
ord4214
ord6886
ord665
ord2752
ord3916
ord4770
ord4983
ord4371
ord3164
ord4077
ord4083
ord4082
ord3046
ord3166
ord3052
ord3366
ord3231
ord4815
ord3362
ord3243
ord3049
ord6053
ord5711
ord5730
ord5065
ord4368
ord5724
ord5722
ord3468
ord2412
ord5615
ord1388
ord4191
ord6071
ord2515
ord2559
ord4836
ord6813
ord1463
ord1584
msvcrt
_wcmdln
_fmode
_commode
?terminate@@YAXXZ
_exit
_unlock
__dllonexit
_onexit
??1type_info@@UEAA@XZ
exit
__set_app_type
__wgetmainargs
memset
_XcptFilter
__C_specific_handler
_CxxThrowException
_initterm
__setusermatherr
_purecall
isspace
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
_amsg_exit
??1exception@@UEAA@XZ
memcpy_s
_vsnwprintf
_cexit
_lock
__CxxFrameHandler4
shlwapi
StrCmpNIW
api-ms-win-core-com-l1-1-0
CoInitializeEx
CoCreateInstance
CoUninitialize
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetStartupInfoW
TerminateProcess
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
Name
.text
Size
32KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
52KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
320B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=20, id=260, version=33145,
count=11, id=261, version=33145,
count=11, id=257, version=33145,
count=129, id=1, productName=Unmarked objects,
count=3, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
DeviceProperties.exe
- IMPHASH 0eb7b2d0db9f4d84aa42ca86f448e719
- SHA256 59c4bd37da9c5f1a52814e92adb22c5aeb3dc842a6fba683fb3abfab3485fc4a
- MD5 fd14bd910cd70fa00e0e16748bc14257
- SHA1 d798a1a9123bd9ba47cd76d652d67e2bbb30a513
- SHA512 40fad6f520a578ceb1468daf32961278fccce888cf726c18a6d93c2ae84be0d0fb12724a4496e0e162371b67fce11c23037c1f5d4b62d276c96a1b3cc0adcdae
- SSDEEP 768:59fswWkt3jWzV/0vM3EDs73D8hayJpVsQnhGc0bnH1CJv7VLjQAAAAAAe:51sM3jRM3EDs73YayJdnGbnH1Ch7
- TLSH T14A938D91B24485A6D8E8C7FDD4BE87058B246931435439E33D38E35A39BBBCC7936887
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4864
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
DeviceProperties.pdb
kernel32
LoadLibraryW
HeapSetInformation
GetProcAddress
FreeLibrary
GetLastError
user32
IsWindow
msvcrt
_cexit
?terminate@@YAXXZ
_commode
_fmode
__C_specific_handler
_initterm
__setusermatherr
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_wtoi64
_wtoi
_wcsicmp
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
64KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
136B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=261, version=33136,
count=1, productName=Unmarked objects (old),
count=4, id=259, version=33136,
count=20, id=260, version=33136,
count=7, id=257, version=33136,
count=40, id=1, productName=Unmarked objects,
count=2, id=264, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
DiskSnapshot.exe
- IMPHASH 9be1e8d7c5d5b113af20c778ef464358
- SHA256 e3efc11f128f6e10eae8e15c9aa100201aa89631377b8c9e4db1314dd46659f0
- MD5 ab82d082274cb2c9f85fb96439229a15
- SHA1 46363807f9f1b1fb808391cbb2394e1b45b301c3
- SHA512 9eb11056274fe24a4bdc47d9f88cb7499b7ba7210840675e93d6d74c538b8eb75eb2310f22cf556d81708738f4449a5da95d0848fc499808c7051411217014f8
- SSDEEP 768:rGcI5oYFUm9UGUq18SSPgzzbfTcBa6zPNAVJskC93x/rNPO5ZDW1LKrHaHpHB77O:rm5orJIDwBa6zPWPchIL+0sHrwZ+iYe
- TLSH T1D4A33B3A76E811F5D1B691B88DE45A06FB72F4251B3047DF00D185A91F2AFE1DC3AB82
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5728
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
DiskSnapshot.pdb
msvcp_win
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
_c_exit
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configthreadlocale
_o__configure_wide_argv
_o__crt_atexit
_o__errno
_o__exit
_o__get_initial_wide_environment
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo_noreturn
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o___p___argc
_o__wcsdup
_o__wcslwr_s
_o__wfopen
_o__wstat64i32
_o_exit
_o_fclose
_o_fputws
_o_fread
_o_free
_o_malloc
_o_rand
_o_srand
_o_terminate
_o_towlower
_o_wmemcpy_s
__C_specific_handler
__current_exception
__current_exception_context
__CxxFrameHandler3
_CxxThrowException
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vfwprintf
_o___acrt_iob_func
wcsstr
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
_o___p__commode
wcsrchr
wcschr
_o___p___wargv
memmove
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
wcscmp
ntdll
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
RtlGetVersion
RtlOsDeploymentState
RtlGetDeviceFamilyInfoEnum
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
GetCommandLineW
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegEnumKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegGetValueW
api-ms-win-core-com-l1-1-0
CoCreateInstance
api-ms-win-core-winrt-l1-1-0
RoInitialize
RoUninitialize
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventWriteTransfer
EventUnregister
EventActivityIdControl
EventRegister
rpcrt4
UuidFromStringW
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-file-l1-1-0
GetDiskFreeSpaceExW
CreateFileW
ReadFile
api-ms-win-core-file-l1-2-0
GetVolumeNameForVolumeMountPointW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemTime
api-ms-win-core-synch-l1-1-0
OpenMutexW
ReleaseMutex
WaitForSingleObject
CreateMutexW
crypt32
CryptBinaryToStringW
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleFileNameW
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
cryptsp
CryptReleaseContext
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptAcquireContextW
CryptCreateHash
diagnosticdatasettings
TelIsTelemetryTypeAllowed
Name
.text
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
192B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=54, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33138,
count=5, id=259, version=33138,
count=1142, id=1, productName=Unmarked objects,
count=7, id=257, version=33138,
count=34, id=261, version=33138,
count=11, id=264, version=33138,
count=1, id=253, version=33138,
count=1, id=255, version=33138,
count=1, id=258, version=33138,
Dism.exe
- IMPHASH 0b0871867c2362fd2187ee2ee484bcd7
- SHA256 d0c6f65b0b7e0be7c659b382f635aec27080af2ae731d7b3b4011f05a51e6ac2
- MD5 84205b0abf76c59e5ca7035009e59540
- SHA1 1834d7b043076743c2e1bdf85c9d972dbd350af9
- SHA512 8fe5c68fb33215011cb27510bec3f3873f4f2ad2223bb5e052e13104ec3cf672ee37b4c0b9be81cebdce63fad142f3a2ba038001ee9893844fc67df68d4fc356
- SSDEEP 3072:WxLcV0EmfLQiCkeS7bpKoJFF69zeB4XeOXept5JZ+aD76WJrkQnDmSFwjntnNZmx:a00nLQmbc9zeBp5r+W6QfhDbLSr3Y
- TLSH T14774D90977FC0894F6B3B23589718645DAB2B8515B36C3DF5290823D1E37AEA9D34F22
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
f0:5f:c8:ee:7a:86:db:4e:fc:4e:05:27:83:a0:11:53:54:c5:ba:d8:5b:e7:8d:d1:83:a1:f8:ad:0b:a7:4a:66
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 18, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Windows Production PCA 2023,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
f0:5f:c8:ee:7a:86:db:4e:fc:4e:05:27:83:a0:11:53:54:c5:ba:d8:5b:e7:8d:d1:83:a1:f8:ad:0b:a7:4a:66
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 18, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2026 RSA2048-SHA256,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:17:d4:df:d9:e3:95:0b:e7:ef:00:00:00:00:00:17
Issuer
CN=Microsoft Windows Production PCA 2026 RSA2048-SHA256,O=Microsoft Corporation,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 6, 2026 - Aug 5, 2027
Subject
CN=Microsoft Windows Production PCA 2026 RSA2048-SHA256,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:1e:e9:35:2b:ec:86:01:54:15:00:00:00:00:00:1e
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 4, 2026 - Aug 4, 2031
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A400-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:28:f0:a5:87:d7:f3:c8:1e:40:00:01:00:00:02:28
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:44:4e:42:4c:8a:cb:02:7e:2b:00:00:00:00:01:44
Issuer
CN=Windows Production PCA 2023,O=Microsoft Corporation,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 18, 2026 - Jun 17, 2027
Subject
CN=Windows Production PCA 2023,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:17:85:bd:56:09:4b:f8:c8:21:00:00:00:00:00:17
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 13, 2023 - Jun 13, 2035
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:401A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:19:5e:b2:d8:54:75:f4:b1:8d:00:01:00:00:02:19
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Minor OS version
0
Major OS version
10
Entry point
8240
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
Dism.pdb
msvcrt
towlower
_snwscanf_s
wcsstr
iswalpha
_wcsnicmp
__RTDynamicCast
memcmp
??3@YAXPEAX@Z
memset
realloc
_errno
_onexit
__dllonexit
_unlock
wcsncmp
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_commode
_fmode
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_callnewh
wcscpy_s
wcsrchr
calloc
malloc
_purecall
_wcsicmp
free
_vsnwprintf
towupper
_getwch
vswprintf_s
_vscwprintf
_wcslwr_s
wcschr
wprintf
memmove_s
memcpy_s
__C_specific_handler
??_V@YAXPEAX@Z
__CxxFrameHandler3
_lock
wcscmp
advapi32
IsValidSecurityDescriptor
GetAclInformation
InitializeAcl
AddAce
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
MakeAbsoluteSD
GetSecurityDescriptorControl
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
GetSecurityDescriptorOwner
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
GetSidLengthRequired
InitializeSid
GetSidSubAuthority
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
EventUnregister
EventRegister
EventWriteTransfer
EventActivityIdControl
UnregisterTraceGuids
InitiateSystemShutdownExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
TraceEvent
GetLengthSid
CopySid
IsValidSid
kernel32
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
GetFileInformationByHandleEx
FindFirstFileNameW
DeviceIoControl
SetFileAttributesW
SetFileInformationByHandle
DeleteFileW
FindNextFileNameW
CopyFileExW
CreateDirectoryW
GetLongPathNameW
GetFinalPathNameByHandleW
SearchPathW
GetVersionExW
GetModuleHandleW
GetModuleHandleExW
FreeLibrary
InitializeCriticalSection
EnterCriticalSection
SetEvent
LeaveCriticalSection
GetLastError
CloseHandle
SetThreadUILanguage
SetErrorMode
SetConsoleCtrlHandler
OutputDebugStringW
GetCommandLineW
HeapFree
GetProcessHeap
Sleep
GetCurrentProcess
DeleteCriticalSection
RaiseException
GetCurrentThreadId
CompareStringW
SizeofResource
LockResource
LoadResource
FindResourceExW
GetStdHandle
HeapAlloc
WriteConsoleW
LocalAlloc
WideCharToMultiByte
WriteFile
LocalFree
GetFileType
GetConsoleMode
GetModuleFileNameW
IsWow64Process
FormatMessageW
GetFileAttributesW
SetLastError
CreateFileW
MultiByteToWideChar
GetSystemInfo
OpenProcess
QueryFullProcessImageNameW
HeapSize
HeapReAlloc
HeapDestroy
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
TerminateProcess
OutputDebugStringA
GetSystemWindowsDirectoryW
ExpandEnvironmentStringsW
GetTempFileNameW
GetFullPathNameW
GetFileInformationByHandle
FindFirstFileW
FindNextFileW
FindClose
WaitForSingleObject
LoadLibraryExW
GetDriveTypeW
GetProcAddress
GetTickCount
ole32
CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoCreateInstance
user32
CharLowerBuffW
oleaut32
SysAllocString
GetErrorInfo
SysFreeString
VariantClear
SysStringLen
LoadRegTypeLi
LoadTypeLi
SysStringByteLen
VarBstrCmp
SysAllocStringByteLen
SysAllocStringLen
ntdll
NtQueryInformationProcess
RtlNtStatusToDosError
NtQueryInformationFile
RtlAllocateHeap
RtlFreeHeap
NtSetInformationFile
RtlGetVersion
version
VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
Name
.text
Size
156KB
Virtual Size
154KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
96KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
32KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=4, id=259, version=33145,
count=26, id=260, version=33145,
count=307, id=1, productName=Unmarked objects,
count=15, id=257, version=33145,
count=16, id=261, version=33145,
count=44, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
ctfmon.exe
- IMPHASH b539389d4be1dd68c8213a539feb41fb
- SHA256 d72a59e34b0fe2e3e4939b54945a92cc43779a85ea59b72583ba0b128a5b3308
- MD5 fb95fea7acb50925e15416b593b556f3
- SHA1 2bcefe3b85a6aa0cf0bf64c1848e64e7ef6c0b86
- SHA512 63f9ade06960135f4ef2f9852db7c924f86e8a0f853af4046b1244a048618eb70ef21604333df97edf726539b67869c4a7e69c5abcfe29ad5c8fd4cf57ef9e3e
- SSDEEP 1536:BxPXOGBm+N7VMhNT2pQ5bfme8wac0uGGznJsX:nGGBn+f2Gj8wavcnJ8
- TLSH T1F863174E627830EAF167813CC8624619E1B1B435235126FF13E4D2BEEF63AE46539F91
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4976
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ctfmon.pdb
kernel32
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
SetLastError
EnterCriticalSection
ReleaseSemaphore
GetModuleHandleExW
LeaveCriticalSection
InitializeCriticalSectionEx
WaitForThreadpoolTimerCallbacks
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
ReleaseSRWLockExclusive
OutputDebugStringW
CloseThreadpoolTimer
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
SetThreadpoolTimer
ReleaseSRWLockShared
CreateThreadpoolTimer
HeapAlloc
GetProcAddress
CreateMutexExW
AcquireSRWLockShared
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
DebugBreak
IsDebuggerPresent
HeapSetInformation
WerSetFlags
GetCommandLineW
UnhandledExceptionFilter
GetTickCount
GetCurrentProcess
GetSystemTimeAsFileTime
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
Sleep
TerminateProcess
LocalFree
msvcrt
__setusermatherr
_initterm
__C_specific_handler
memset
_acmdln
_fmode
_commode
_lock
_ismbblead
__dllonexit
_onexit
?terminate@@YAXXZ
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
_cexit
_unlock
wcstol
wcsstr
_wcsnicmp
wcspbrk
memmove_s
_vsnwprintf
_exit
memcpy_s
memcmp
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
msctfmonitor
DoMsCtfMonitor
Name
.text
Size
36KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
204B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=261, version=33145,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=20, id=260, version=33145,
count=9, id=257, version=33145,
count=83, id=1, productName=Unmarked objects,
count=7, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
cttune.exe
- IMPHASH 53b020cffe1a279eb56abc5ad3ca9b91
- SHA256 49bd02ad9ac65fce885857900e30981f4550b8762c1d19f90ce246f0a8a812b9
- MD5 e6721a3067da44d2fc26bd0ab81f6066
- SHA1 afea1d057c2d899d64357ccdfad6fc727eee4060
- SHA512 241f0a78167027cc1119287487867599acd8f907ff3580d9a74f51bf392b73dff8d4a7fc59e3f2bcb84b6f1a3da61169cd52a2d6cddede5bb5117676ce19ffd3
- SSDEEP 3072:N96/GJ+qUG01Z+cZAa7ocvZI5Gb1ef3RoXpR7cuoOY56uc:NJ+fG+4EoeZI5Gb1ef3UAuoOY
- TLSH T114E3295D72BA31FAD566913CC5464659F6B3B830232262EF02D0C6BDDB23AD87939F01
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5344
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
cttune.pdb
advapi32
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
EventWriteTransfer
EventRegister
EventUnregister
OpenProcessToken
GetTokenInformation
CreateWellKnownSid
CheckTokenMembership
RegCreateKeyExW
RegSetValueExW
kernel32
WaitForSingleObjectEx
EnterCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
WaitForSingleObject
VerifyVersionInfoW
CreateThreadpoolTimer
GetCurrentProcessId
CreateMutexExW
CreateSemaphoreExW
LeaveCriticalSection
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
ReleaseMutex
ReleaseSemaphore
SetLastError
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
OutputDebugStringW
IsDebuggerPresent
DebugBreak
GetModuleFileNameA
GetModuleHandleExW
GetProcAddress
GetModuleHandleW
GetCurrentThreadId
FormatMessageW
GetCurrentProcess
HeapFree
GetProcessHeap
HeapAlloc
CloseHandle
CreateMutexW
GetLastError
OpenSemaphoreW
GetTickCount64
VerSetConditionMask
MulDiv
CloseThreadpoolTimer
gdi32
Polyline
CreatePen
GetTextMetricsW
SetBkMode
SetStretchBltMode
StretchBlt
CreateCompatibleBitmap
CreateDIBSection
PatBlt
CreateSolidBrush
SetTextColor
GdiSetBatchLimit
GetStockObject
DeleteDC
BitBlt
GdiAlphaBlend
SelectObject
CreateCompatibleDC
GetObjectW
CreateFontIndirectW
GetDeviceCaps
DeleteObject
SetBkColor
user32
FindWindowW
SetForegroundWindow
EndDialog
SetTimer
KillTimer
DialogBoxParamW
ShowWindow
EnableWindow
CheckDlgButton
IsDlgButtonChecked
CheckRadioButton
EnumDisplaySettingsW
EnumDisplayDevicesW
LoadCursorW
GetSysColor
DestroyWindow
CopyImage
CreateWindowExW
DrawTextW
GetFocus
MapWindowPoints
FillRect
RedrawWindow
IsCharAlphaNumericW
InvalidateRect
SetWindowTextW
MessageBoxW
SystemParametersInfoW
RegisterClassExW
DefWindowProcW
TrackMouseEvent
EndPaint
SendMessageW
GetSysColorBrush
FrameRect
BeginPaint
DrawFocusRect
ChangeDisplaySettingsExW
SetFocus
SetWindowLongW
GetParent
PostMessageW
SetWindowLongPtrW
SetDlgItemTextW
GetDlgItem
GetClientRect
MapDialogRect
GetWindowLongW
SendDlgItemMessageW
SendMessageTimeoutW
SetWindowPos
GetWindowRect
GetSystemMetrics
GetProcessDefaultLayout
ReleaseDC
LoadStringW
GetDC
GetWindowLongPtrW
PtInRect
msvcrt
_cexit
__C_specific_handler
_onexit
__setusermatherr
_initterm
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
_ismbblead
_wtoi
_vsnwprintf
memset
_purecall
free
__CxxFrameHandler3
_CxxThrowException
_callnewh
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
malloc
wcschr
_acmdln
_fmode
_commode
_lock
_unlock
__dllonexit
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_XcptFilter
memmove_s
memcpy_s
realloc
memcmp
oleaut32
VariantInit
SafeArrayGetUBound
SafeArrayGetLBound
SysFreeString
SysAllocString
SafeArrayGetElement
VariantClear
api-ms-win-core-com-l1-1-0
StringFromGUID2
CoUninitialize
CoInitializeEx
CoCreateInstance
CoInitializeSecurity
CoSetProxyBlanket
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetStartupInfoW
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
comctl32
ord381
PropertySheetW
InitCommonControlsEx
dwrite
DWriteCreateFactory
ntdll
WinSqmIncrementDWORD
WinSqmAddToStream
ole32
CoGetObject
oleacc
LresultFromObject
CreateStdAccessibleObject
setupapi
SetupDiOpenDeviceInterfaceW
SetupDiGetDeviceInterfaceDetailW
SetupDiGetDeviceInstanceIdW
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
uxtheme
CloseThemeData
DrawThemeParentBackground
GetThemeFont
GetThemeSysFont
GetThemeSysColor
IsThemeActive
OpenThemeData
GetThemeColor
shlwapi
ord628
Name
.text
Size
108KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=25, id=260, version=33145,
count=4, id=261, version=33145,
count=27, id=257, version=33145,
count=232, id=1, productName=Unmarked objects,
count=31, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
cttunesvr.exe
- IMPHASH 48d0d721c33308995faab78d1005d498
- SHA256 3ad27fc6d50f5ad75b0c3e0378c7a32d062d3e95fa5d7259c0601dfcada8d3f3
- MD5 1bfffd25a7434da255901a517c6113bf
- SHA1 71db67288667db5d7a1b4adc3b313c96797eb692
- SHA512 c362d776886aed9c74cea924011ad1e04004a966afe84c9cddb57e7067dde3fe27fd2c24d89a31c13bdca8afb2922726134901741ff91fd7465e2db9d981797b
- SSDEEP 768:UCVMj7MZ/OP+8JyEkBC0o2lnVjLMyGfhABL1GyEMz3RInolNX/f1HTG:Az1a/Tj/MyGf+0y9OnWDzG
- TLSH T10253084AB3DC60E9F1A6813945267645E572FC2157D116FF23A8B23D8F33BD1AE38A01
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5648
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
cttunesvr.pdb
advapi32
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
kernel32
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryExW
GetModuleHandleW
lstrcmpiW
RaiseException
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceExW
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetCommandLineW
SetEvent
GetCurrentThreadId
Sleep
CreateEventW
CreateThread
CloseHandle
WaitForSingleObject
GetStartupInfoW
OutputDebugStringA
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
user32
GetMessageW
TranslateMessage
DispatchMessageW
CharUpperW
CharNextW
UnregisterClassA
PostThreadMessageW
msvcrt
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
?terminate@@YAXXZ
_callnewh
wcscat_s
wcscpy_s
_purecall
memcpy_s
free
malloc
wcsncpy_s
__C_specific_handler
_onexit
__dllonexit
_unlock
_lock
memset
realloc
_errno
_commode
_fmode
_wcmdln
_XcptFilter
memcmp
ole32
CoRevokeClassObject
CoCreateInstance
StringFromGUID2
CoRegisterClassObject
CoUninitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoInitialize
oleaut32
UnRegisterTypeLi
RegisterTypeLi
LoadRegTypeLi
SysStringLen
SysFreeString
LoadTypeLi
SysAllocString
VarUI4FromStr
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
360B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=23, id=260, version=33145,
count=6, id=261, version=33145,
count=13, id=257, version=33145,
count=113, id=1, productName=Unmarked objects,
count=8, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
curl.exe
- IMPHASH e847d0a4b546f22477911ad1714ba42b
- SHA256 73d24149ff289afc49ec41f08918ef9faa727d39ad993e929757dc2ddafab805
- MD5 9cc9716a95325e70a9e95b9d07d127d5
- SHA1 7add347d181f52908c03b0ecede2d293fe01e112
- SHA512 47d7635582c2c41ad5a29a798790ddeef59cfda539e7a4455be78d3ad745a48800e4e8f25cb56a9aeb09de58744a3f14dda5089b1b730235dc86d736aaac5626
- SSDEEP 24576:NVrztILiwnJyqMOjkizxp2wbj4PDISdhcXTL:3rq7J9jkiNp2wbIcXH
- TLSH T183057D656BB400E6D0A7C275C6539A07EBF2F095276087CB47A5C96A3F536B22F3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
36:f7:a1:f6:5a:5e:5d:fd:24:70:8c:db:19:a7:b0:e9:7f:09:e1:c1:63:76:df:5f:31:e9:2c:e0:49:fe:ca:52
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 24, 2026
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:fe:fe:8a:48:b5:ce:c4:60:f1:00:00:00:00:01:fe
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:F002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:20:24:e1:e6:e0:17:b9:b4:8e:00:01:00:00:02:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
18928
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\__w\1\s\_build\src\RelWithDebInfo\curl.pdb
ws2_32
WSAEnumNetworkEvents
getsockopt
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSACreateEvent
WSACloseEvent
getsockname
WSAGetLastError
recv
socket
ioctlsocket
closesocket
htonl
connect
send
gethostname
getaddrinfo
freeaddrinfo
WSASetLastError
listen
shutdown
setsockopt
bind
accept
recvfrom
sendto
__WSAFDIsSet
select
WSACleanup
WSAStartup
WSAIoctl
getpeername
ntohs
htons
api-ms-win-core-console-l2-1-0
GetConsoleScreenBufferInfo
api-ms-win-core-processenvironment-l1-1-0
GetStdHandle
SetStdHandle
SearchPathW
GetEnvironmentVariableA
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-console-l1-1-0
SetConsoleCtrlHandler
SetConsoleMode
GetConsoleMode
WriteConsoleW
api-ms-win-core-file-l1-1-0
GetFileTime
GetFullPathNameW
SetEndOfFile
GetFileType
ReadFile
CreateFileW
SetFileTime
api-ms-win-core-processthreads-l1-1-0
TlsFree
TlsSetValue
GetCurrentProcess
CreateThread
TlsAlloc
TlsGetValue
TerminateThread
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-toolhelp-l1-1-0
Module32FirstW
Module32NextW
CreateToolhelp32Snapshot
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameA
FreeLibrary
GetProcAddress
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
api-ms-win-core-sysinfo-l1-1-0
GetSystemTime
api-ms-win-core-synch-l1-1-0
WaitForSingleObjectEx
InitializeCriticalSectionEx
EnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
LeaveCriticalSection
SleepEx
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
api-ms-win-core-synch-l1-2-0
InitializeConditionVariable
Sleep
SleepConditionVariableCS
WakeConditionVariable
api-ms-win-core-file-l2-1-0
MoveFileExW
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-2-0
VerSetConditionMask
api-ms-win-core-kernel32-legacy-l1-1-1
VerifyVersionInfoW
api-ms-win-core-localization-l1-2-0
FormatMessageA
IdnToAscii
IdnToUnicode
bcrypt
BCryptGenRandom
wldap32
ord145
ord216
ord142
ord41
ord14
ord147
ord79
ord27
ord26
ord127
ord46
ord117
ord301
ord219
ord133
ord73
ord208
ord167
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-namedpipe-l1-1-0
PeekNamedPipe
iphlpapi
if_nametoindex
api-ms-win-security-cryptoapi-l1-1-0
CryptGetHashParam
CryptHashData
CryptAcquireContextW
CryptCreateHash
CryptDestroyHash
CryptReleaseContext
crypt32
CertCreateCertificateChainEngine
PFXImportCertStore
CertFreeCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertFindCertificateInStore
CertOpenStore
CryptStringToBinaryW
CertFindExtension
CryptDecodeObjectEx
CertGetCertificateChain
CertFreeCertificateChainEngine
CertAddCertificateContextToStore
CryptQueryObject
CertFreeCertificateChain
CertGetNameStringW
sspicli
InitSecurityInterfaceW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-crt-string-l1-1-0
strspn
strncmp
strpbrk
strcmp
_stricmp
wcscpy_s
_strdup
strcspn
wcsncmp
wcscmp
wcsncpy_s
api-ms-win-crt-runtime-l1-1-0
terminate
_crt_atexit
abort
_c_exit
_register_thread_local_exe_atexit_callback
__p___wargv
__p___argc
_register_onexit_function
_initialize_onexit_table
_configure_wide_argv
_exit
_initialize_wide_environment
_cexit
exit
strerror_s
_initterm_e
_seh_filter_exe
_initterm
_get_initial_wide_environment
_errno
_set_app_type
api-ms-win-crt-heap-l1-1-0
realloc
_set_new_mode
free
malloc
calloc
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
fputc
fflush
_write
_set_fmode
_fseeki64
_wsopen_s
_wfreopen_s
_wfsopen
fgets
feof
__p__commode
fseek
getc
puts
fread
_setmode
ferror
ftell
fclose
_close
_isatty
_get_osfhandle
_lseeki64
_read
_fileno
fputs
fwrite
__stdio_common_vsprintf
api-ms-win-crt-filesystem-l1-1-0
_fstat64
_fullpath
_unlink
_wstat64
_mkdir
api-ms-win-crt-math-l1-1-0
_fdopen
__setusermatherr
api-ms-win-crt-utility-l1-1-0
qsort
bsearch
api-ms-win-crt-conio-l1-1-0
_getch
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
setlocale
_configthreadlocale
api-ms-win-crt-time-l1-1-0
_time64
_localtime64_s
strftime
_gmtime64_s
kernel32
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
InitializeSListHead
RtlCaptureContext
IsDebuggerPresent
UnhandledExceptionFilter
RtlLookupFunctionEntry
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
RtlVirtualUnwind
api-ms-win-core-rtlsupport-l1-1-0
RtlUnwindEx
Name
.text
Size
572KB
Virtual Size
572KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
187KB
Virtual Size
186KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=30795,
count=10, id=259, version=35207,
count=16, id=260, version=35207,
count=39, id=261, version=35207,
count=6, id=260, version=35228,
count=89, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=253, id=1, productName=Unmarked objects,
count=186, id=264, version=35228,
count=1, id=255, version=35228,
count=1, id=151,
count=1, id=258, version=35228,
dasHost.exe
- IMPHASH 38240f90327359bcbccacd3a7a8bb01e
- SHA256 bf1d4f636556984af4b41084d8295ced9c99982b2229adc7d37039d678e79f4e
- MD5 2d1acbc2ef4845b5dabb378e729ee3e0
- SHA1 8ee97409ece9e937f0147ccd5eb7d81d03a84a2a
- SHA512 e75e824f34775b64f8e85790d4a1204c609fd7fe760487638545adcff709c6f07607b5ce3d81ca83700ab4309c2e008c1759a97cf609af0a47f82baced7a2347
- SSDEEP 3072:7wo4ERPM5KnaMNsVHFzIpWfBWCwP/dkBwbBOPag:7N4EtMknaMNsv0pPtOPa
- TLSH T1E214191E76B924E5E07A8239C9964216F3B2B065171217CF02E0C3799F57AEDBE39F40
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5536
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
dasHost.pdb
api-ms-win-crt-runtime-l1-1-0
_c_exit
_register_thread_local_exe_atexit_callback
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__errno
_o__exit
_o__get_initial_wide_environment
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
memmove
_o__wcsicmp
_o_exit
_o_free
_o_malloc
_o_terminate
__current_exception
__current_exception_context
_CxxThrowException
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
_o___p___wargv
_o___p___argc
__C_specific_handler
__std_terminate
__CxxFrameHandler4
__C_specific_handler_noexcept
memcmp
memcpy
__CxxFrameHandler3
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
FreeLibrary
GetModuleHandleW
GetProcAddress
GetModuleHandleExW
LoadLibraryExW
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockShared
InitializeSRWLock
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
InitializeCriticalSection
ReleaseSRWLockExclusive
SetEvent
CreateEventW
ReleaseMutex
WaitForSingleObject
ResetEvent
InitializeCriticalSectionEx
LeaveCriticalSection
DeleteCriticalSection
ReleaseSemaphore
EnterCriticalSection
CreateMutexExW
AcquireSRWLockShared
CreateSemaphoreExW
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks
SubmitThreadpoolWork
CreateThreadpoolWork
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolWait
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-processthreads-l1-1-0
OpenThreadToken
TerminateProcess
GetCurrentProcess
OpenProcessToken
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
SetThreadToken
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringOrdinal
rpcrt4
MesHandleFree
RpcStringFreeW
RpcStringBindingComposeW
NdrClientCall3
NdrMesTypeEncode3
NdrMesTypeAlignSize3
NdrAsyncServerCall
NdrServerCallAll
Ndr64AsyncServerCallAll
NdrServerCall2
RpcBindingFromStringBindingW
RpcBindingSetOption
RpcServerUseProtseqEpW
I_RpcMapWin32Status
RpcServerRegisterIf3
RpcServerUnregisterIfEx
RpcSsDestroyClientContext
RpcAsyncCompleteCall
MesEncodeIncrementalHandleCreate
MesIncrementalHandleReset
RpcExceptionFilter
RpcBindingFree
I_RpcBindingInqLocalClientPID
RpcImpersonateClient
RpcRevertToSelf
I_RpcExceptionFilter
UuidFromStringW
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableLevel
TraceMessage
GetTraceEnableFlags
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
wpprecorderum
WppAutoLogStart
WppAutoLogTrace
WppAutoLogStop
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSecurityDescriptorToStringSecurityDescriptorW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-eventing-provider-l1-1-0
EventActivityIdControl
EventWriteTransfer
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-security-base-l1-1-0
CreateWellKnownSid
AdjustTokenPrivileges
DuplicateToken
DestroyPrivateObjectSecurity
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegOpenKeyExW
RegGetValueW
RegEnumKeyExW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
ntdll
RtlInitUnicodeString
api-ms-win-devices-query-l1-1-1
DevGetObjectPropertiesEx
api-ms-win-devices-query-l1-1-0
DevFreeObjectProperties
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-security-lsalookup-l2-1-0
LookupPrivilegeValueW
api-ms-win-security-provider-l1-1-0
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetEntriesInAclW
Name
.text
Size
120KB
Virtual Size
118KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=67, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33145,
count=5, id=259, version=33145,
count=1222, id=1, productName=Unmarked objects,
count=4, id=257, version=33145,
count=34, id=261, version=33145,
count=37, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
dccw.exe
- IMPHASH 4d1042c0e3992b4814e48907b016b97b
- SHA256 239de24f070cc6534c8e31985112a76a2e1290181aa854731db93cae27b71e00
- MD5 bdd8fe199f483a7914cfae3726b4e613
- SHA1 479a1d4b6540a74ee5126f321c7f38d418d7d318
- SHA512 50d905e2522f02ad9e58bee8ed0643ecf85b8f2a086824b1bca54f6e5e526ad9e1d31dbc6854eef12c167cf0242a067b299eba3ed18d461f3426fdb1e83fbdf1
- SSDEEP 3072:FE+ApC0VcFLkkoiWWzrA1FNcz8sDZRLHnrT3RaUv63JpKUeZ5r58Rm4VQOB2q+Aw:FE+CC0eFvg2z8qjRaUy3JpKUeZ5r58R+
- TLSH T102F3F98E32A930E5E166817CC9464545F7B2B431272166EF03E0C27D9F23AE9BD39F61
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5968
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
dccw.pdb
advapi32
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
EventRegister
EventUnregister
EventWrite
RegQueryValueExW
kernel32
OpenSemaphoreW
CreateThreadpoolTimer
CreateMutexW
GetCurrentProcessId
CreateMutexExW
EnterCriticalSection
lstrcmpW
CreateFileW
WriteFile
CopyFileW
WaitForSingleObject
WideCharToMultiByte
GetSystemDirectoryW
LocalFree
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
FindResourceW
LockResource
GetTickCount
InitializeCriticalSectionEx
WaitForSingleObjectEx
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
ReleaseMutex
ReleaseSemaphore
CloseHandle
SetLastError
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
OutputDebugStringW
IsDebuggerPresent
DebugBreak
GetModuleFileNameA
GetModuleHandleExW
HeapFree
HeapAlloc
GetProcessHeap
FormatMessageW
HeapSetInformation
InitializeCriticalSection
GetModuleFileNameW
FindResourceExW
LoadResource
SizeofResource
MultiByteToWideChar
GetSystemTimeAsFileTime
lstrcmpiW
GetModuleHandleW
LoadLibraryExW
GetProcAddress
FreeLibrary
GetSystemTime
GetLastError
LeaveCriticalSection
RaiseException
DeleteCriticalSection
GetCurrentThreadId
CreateSemaphoreExW
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
VirtualFree
GetCurrentProcess
VirtualAlloc
LoadLibraryExA
EncodePointer
DecodePointer
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
Sleep
GetStartupInfoW
OutputDebugStringA
gdi32
StretchBlt
GetStockObject
DeleteDC
CreateDCW
GetDeviceCaps
CreateSolidBrush
SetTextColor
SetBkColor
SetBkMode
GetDeviceGammaRamp
SetDeviceGammaRamp
GetTextExtentPoint32W
GetObjectW
CreateCompatibleDC
SelectObject
SetStretchBltMode
CreateCompatibleBitmap
DeleteObject
user32
GetWindow
GetWindowLongW
LoadStringW
UnregisterClassA
GetWindowTextW
GetWindowTextLengthW
ShowWindow
GetDC
ReleaseDC
KillTimer
SetTimer
SetWindowTextW
PostMessageW
MapDialogRect
EnumChildWindows
DisplayConfigGetDeviceInfo
QueryDisplayConfig
GetDisplayConfigBufferSizes
EnumDisplayDevicesW
ShowCursor
LoadCursorW
SetCursor
GetMonitorInfoW
EnumDisplayMonitors
MonitorFromWindow
GetParent
FillRect
SystemParametersInfoForDpi
GetDpiForWindow
InflateRect
GetClientRect
GetFocus
GetClassNameW
InvalidateRect
MoveWindow
MapWindowPoints
GetWindowRect
GetDlgItem
DefWindowProcW
SendMessageW
CallWindowProcW
SetWindowPos
SetForegroundWindow
OpenIcon
SetWindowLongPtrW
MonitorFromRect
SendMessageTimeoutW
AllowSetForegroundWindow
GetWindowThreadProcessId
FindWindowW
RegisterWindowMessageW
GetActiveWindow
GetSystemMetrics
CharNextW
DestroyWindow
MessageBoxW
GetWindowLongPtrW
msvcrt
_errno
_onexit
__dllonexit
?terminate@@YAXXZ
memcpy
memcmp
iswupper
towlower
realloc
_unlock
_lock
_commode
_fmode
_wcmdln
memset
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_callnewh
swscanf_s
wcsstr
_wcsupr
_purecall
memmove_s
_vsnwprintf
memcpy_s
malloc
wcsncpy_s
free
__C_specific_handler
powf
ntdll
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
WinSqmAddToStream
dxva2
GetNumberOfPhysicalMonitorsFromHMONITOR
GetPhysicalMonitorsFromHMONITOR
DestroyPhysicalMonitors
GetMonitorBrightness
SetMonitorBrightness
GetMonitorContrast
SetMonitorContrast
GetVCPFeatureAndVCPFeatureReply
SetVCPFeature
mscms
GetColorProfileFromHandle
DccwCreateDisplayProfileAssociationList
WcsCreateIccProfile
GetColorDirectoryW
InstallColorProfileW
CloseColorProfile
DccwGetDisplayProfileAssociationList
SetColorProfileElement
SetColorProfileElementSize
DccwReleaseDisplayProfileAssociationList
WcsDisassociateColorProfileFromDevice
WcsSetDefaultColorProfile
UninstallColorProfileW
WcsGetCalibrationManagementState
DccwGetGamutSize
WcsOpenColorProfileW
WcsGetDefaultColorProfile
WcsGetUsePerUserProfiles
WcsSetCalibrationManagementState
DccwSetDisplayProfileAssociationList
shell32
ShellExecuteW
gdiplus
GdiplusStartup
GdiplusShutdown
GdipCreateFromHDC
GdipDeleteGraphics
GdipCreateSolidFill
GdipDeleteBrush
GdipAlloc
GdipFillRectangleI
GdipCreateLineBrushI
GdipFree
GdipCreateBitmapFromStream
GdipCloneImage
GdipDisposeImage
GdipCreateHBITMAPFromBitmap
comctl32
DestroyPropertySheetPage
CreatePropertySheetPageW
PropertySheetW
TaskDialogIndirect
oleaut32
SysFreeString
VarUI4FromStr
SysAllocString
api-ms-win-core-com-l1-1-0
CoCreateInstance
StringFromCLSID
CreateStreamOnHGlobal
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
Name
.text
Size
108KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=22, id=260, version=33145,
count=6, id=261, version=33145,
count=25, id=257, version=33145,
count=281, id=1, productName=Unmarked objects,
count=44, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
dcomcnfg.exe
- IMPHASH 4c7f165da8da80935d61c0512a3469c1
- SHA256 d868f8a6c8f204e98adb95f5687a943e2ce8aed697c875116c7db223a198bab7
- MD5 f600a35a785aeb4be83d8a473c089ee5
- SHA1 3a795eaf8666b5bf4a95306c730b492d822050b2
- SHA512 5500c15fafac545961972127e3ccaa3915ac0cf05e0e257cc2b8384daabe3a6f3da4f1ff234a80b7e5d437f47ffe55d395acd7cebb5a1f3b7c6226ceb36fedc7
- SSDEEP 192:dpgw0qLNcK3Ex+wV8E4+f5RFPNcxlnc3dtIoeo0w7f6W0EW:b6qRcCyLaEPff6WdWoYW0EW
- TLSH T18FE2D705E7A414EAF03A437654B3130679B8F63147611BEF7458625A1F32BC1BB37AD2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4864
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
DCOMCnfg.pdb
kernel32
GetCurrentProcess
GetSystemDirectoryW
FormatMessageW
GetLastError
CloseHandle
HeapSetInformation
LocalFree
CreateProcessW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
TerminateProcess
user32
MessageBoxW
msvcrt
__C_specific_handler
_fmode
_commode
?terminate@@YAXXZ
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
_vsnwprintf
_initterm
_cexit
__setusermatherr
memset
ntdll
RtlCaptureContext
NtQueryInformationProcess
RtlLookupFunctionEntry
RtlVirtualUnwind
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
276B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
136B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=261, version=33136,
count=1, productName=Unmarked objects (old),
count=4, id=259, version=33136,
count=20, id=260, version=33136,
count=9, id=257, version=33136,
count=42, id=1, productName=Unmarked objects,
count=2, id=264, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
ddodiag.exe
- IMPHASH 835450f6c906da1e68b05e2c968111e4
- SHA256 644944880f24c344db8761f5aed47cdee582da5077ea6621445abf0cc9d19fe1
- MD5 aceacbea36379af386cbd632ff30c05a
- SHA1 bec1b30b6457f7eabaa66af900d9f468e74ed720
- SHA512 bc1f5a66be68ae7f6bebce8a96ea47dce9b770fdb7c6cafc8cf34ae7a6ab4bd35cd15559e3c458aaad4da82368b7af0d05081148d69b53874be20ce8d84347cd
- SSDEEP 1536:Y/HumujWSdGK/hc3aZkLmMgMaouZl6iw99FlY:Y/HumyWIr
- TLSH T10163305162D936EEF0B665F95F728709EA2EF4D0131286EF26F0422A0E32DC09F75635
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
9632
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
DDODiag.pdb
msvcrt
?terminate@@YAXXZ
_commode
_wcsicmp
_fmode
__C_specific_handler
_initterm
__setusermatherr
_cexit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_callnewh
malloc
free
_vsnwprintf
_exit
memset
kernel32
SetFilePointerEx
TerminateProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
Sleep
FileTimeToSystemTime
GetTempPath2W
CloseHandle
GetLastError
DuplicateHandle
CreateFileW
WriteFile
GetCurrentProcess
GetFileSizeEx
ReadFile
ole32
PropVariantClear
CoInitializeEx
CoCreateInstance
CoUninitialize
CoTaskMemAlloc
CoTaskMemFree
StringFromCLSID
xmllite
CreateXmlWriter
Name
.text
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
456B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
696B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=4, id=259, version=33145,
count=22, id=260, version=33145,
count=57, id=1, productName=Unmarked objects,
count=11, id=257, version=33145,
count=4, id=261, version=33145,
count=4, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
deploymentcsphelper.exe
- IMPHASH fd5f5ec125478f4eb05eaeafd3817f80
- SHA256 d2c9d5aa29814261dd625634c7e901a094e83d5c55cc3dda594cab4e7347c573
- MD5 8e64639cb729a0514878e9f456cd8f02
- SHA1 edd0ac21182bf46c151b09c4130fa01c963938b0
- SHA512 ede8250300fcfb957806c06ccb2f5c41d8daf0559303d764bffec7a683e8103c7a754d6fa0e2bcd3ef067f3b3f0e26bc1887780c995f1b0dd7c3228b4d0eebc2
- SSDEEP 768:WW666o1qOEY8jiK5xbJILWSR2PHoYKyl07AHZV5N9z:WvAqM6iK5xbJNSA+cHRNt
- TLSH T1B853196D769934EAE2B6823C86200285D772F17167432BFF14E0C17AAF577D1AE39E01
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
6272
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
deploymentcsphelper.pdb
msvcrt
__C_specific_handler
_wcmdln
__setusermatherr
_cexit
_exit
exit
__set_app_type
_fmode
_amsg_exit
_XcptFilter
memmove
memcpy
__CxxFrameHandler3
_CxxThrowException
_commode
?what@exception@@UEBAPEBDXZ
??3@YAXPEAX@Z
_lock
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
_unlock
__dllonexit
_onexit
memset
??0exception@@QEAA@AEBQEBDH@Z
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
??0exception@@QEAA@AEBQEBD@Z
__wgetmainargs
_callnewh
malloc
wcsstr
_purecall
_vsnprintf
wcschr
_wcsnicmp
wcsncmp
_initterm
__CxxFrameHandler4
ntdll
RtlAllocateHeap
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlFreeHeap
kernel32
GetProcessHeap
HeapFree
GetLastError
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
GetStartupInfoW
Sleep
CompareStringW
wdscore
CurrentIP
ConstructPartialMsgVW
WdsInitialize
WdsSetupLogMessageW
WdsTerminate
shell32
CommandLineToArgvW
dismapi
DismInitialize
DismDisableFeature
DismEnableFeature
DismCloseSession
DismOpenSession
DismRemoveCapability
DismGetCapabilities
DismGetFeatures
DismAddCapability
DismShutdown
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
api-ms-win-core-errorhandling-l1-1-0
SetLastError
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-heap-l1-1-0
HeapAlloc
api-ms-win-core-file-l1-1-0
CreateDirectoryW
GetFullPathNameW
GetFileAttributesW
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer
Name
.text
Size
24KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
532B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=46, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=4, id=259, version=33136,
count=20, id=260, version=33136,
count=164, id=1, productName=Unmarked objects,
count=11, id=257, version=33136,
count=8, id=261, version=33136,
count=13, id=264, version=33136,
count=1, id=258, version=33136,
desktopimgdownldr.exe
- IMPHASH 8a42a5f2a611448daba8f9fd7aa284bb
- SHA256 2e899ada672ecee67dacebf3d1f5ac80e2053ef4cac9e0e5325e408a8d6b6b31
- MD5 f94608aa14d53be658e277e3135af231
- SHA1 ce77edb60ed0305596e84e2cbab8c2b55393d93f
- SHA512 e9a1fc3e264b7f7da74290599bfbc9af2b5198e7d4a3809066a4d75cd0598ab1eb4ccf42f9ae846ccc89d343e8f3b8ddd9a7915e38f7bc51a9b6163f5dbaec56
- SSDEEP 3072:a26fOGXjjashQS5ZZ1ArKq9WMF4JPZAWuXuYD7W8FHq8Tz:YO4nast5MZfNFHq8T
- TLSH T1F5F35C2D32E910F5E576D17CC9A24919E3B2B061231267DF06E081BD5F53AE87C3DBA1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
8688
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
desktopimgdownldr.pdb
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
_initterm_e
_c_exit
_initterm
api-ms-win-crt-private-l1-1-0
_o__errno
_o__exit
_o__get_initial_wide_environment
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
memmove
_o_exit
_o_free
_o_isalnum
_o_malloc
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
_CxxThrowException
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
_o___stdio_common_vswprintf
_o___std_exception_destroy
_o___std_exception_copy
_o__cexit
_o___p__commode
_o___p___wargv
_o__callnewh
_o___p___argc
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetModuleHandleW
GetModuleFileNameA
GetProcAddress
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockShared
EnterCriticalSection
ReleaseSemaphore
SetEvent
LeaveCriticalSection
CreateEventW
InitializeCriticalSection
InitializeCriticalSectionEx
WaitForSingleObject
ReleaseMutex
ReleaseSRWLockExclusive
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
AcquireSRWLockExclusive
CreateSemaphoreExW
WaitForSingleObjectEx
OpenSemaphoreW
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentProcessId
OpenProcessToken
GetCurrentThread
OpenThreadToken
GetCurrentThreadId
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
WideCharToMultiByte
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventActivityIdControl
EventWriteTransfer
EventSetInformation
EventRegister
api-ms-win-security-base-l1-1-0
IsValidSid
GetTokenInformation
GetSecurityDescriptorDacl
GetLengthSid
crypt32
CryptBinaryToStringW
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-core-file-l1-1-0
FindFirstFileExW
DeleteFileW
CreateFileW
FindNextFileW
FindClose
GetFileSize
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoTaskMemAlloc
CoCreateGuid
CoUninitialize
CoCreateInstance
PropVariantClear
CoInitializeEx
CoDisconnectObject
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFileExistsW
SHExpandEnvironmentStringsW
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
oleaut32
SysStringLen
SysFreeString
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegCreateKeyExW
RegCloseKey
ntdll
RtlPublishWnfStateData
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
GetPersistedFileLocationW
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-shell-shdirectory-l1-1-0
ord292
api-ms-win-security-provider-l1-1-0
SetNamedSecurityInfoW
GetNamedSecurityInfoW
api-ms-win-core-path-l1-1-0
PathCchCombine
msvcp_win
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
Name
.text
Size
96KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
340B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=77, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=30, id=261, version=33145,
count=1183, id=1, productName=Unmarked objects,
count=2, id=257, version=33145,
count=4, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
dfrgui.exe
- IMPHASH e02b33fb7ce2e238746dc109061febbd
- SHA256 fb229970fedc678c81e139ecbfbf162a3399d33a0ced96ffb3f2eae8f86f3d97
- MD5 c16203fabc68b97efccf848a5174203f
- SHA1 65412ce7fb1fa741af473863d921329abf66a607
- SHA512 4c3f922891b7ca0d27aab705867ba779bd3c93039ed60ebd76715970d48ed5c35ed69c671be1ff5c7ddaf31e6dd75e07ad514900282ca8bb06db1ebaf716fc5a
- SSDEEP 3072:EgraAD7oaBSH1Zof8faAPisaU5xVGkJKk/xVrqoV+WgE:6taBSvpaWPaI7
- TLSH T151E3061932B922E8E2A2C57981662511CBB774311B3213EF1BD8C47E4F67EE1AD39F11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5184
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
dfrgui.pdb
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
OpenProcessToken
EventSetInformation
EventRegister
EventUnregister
RegCloseKey
EventWriteTransfer
RegCreateKeyExW
TraceMessage
DuplicateToken
ControlTraceW
StartTraceW
EnableTraceEx2
CheckTokenMembership
GetTokenInformation
CreateWellKnownSid
RegQueryValueExW
RegSetValueExW
kernel32
FormatMessageW
FreeLibrary
GetProcAddress
LoadLibraryW
Sleep
GetFileAttributesW
CreateThread
LoadLibraryExW
LocalAlloc
GetSystemDirectoryW
ExpandEnvironmentStringsW
MoveFileExW
DeviceIoControl
CreateFileW
FindClose
FindNextFileW
FindFirstFileW
TerminateProcess
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
GetStartupInfoW
InitializeSListHead
InterlockedPopEntrySList
RtlCaptureStackBackTrace
InterlockedPushEntrySList
SystemTimeToFileTime
LeaveCriticalSection
EnterCriticalSection
GetVersionExW
SetEvent
DeleteCriticalSection
InitializeCriticalSection
GetVolumeNameForVolumeMountPointW
GetTimeFormatW
GetDateFormatW
SetLastError
WaitForSingleObject
CreateEventW
CloseHandle
SetErrorMode
GetProcessHeap
HeapSetInformation
RegisterApplicationRestart
GetCommandLineW
GetLocalTime
GetCurrentProcess
LocalFree
GetLastError
CreateDirectoryW
DeleteFileW
gdi32
DeleteDC
GdiFlush
SelectObject
SetLayout
CreateCompatibleDC
DeleteObject
CreateDIBSection
GetObjectW
CreateFontIndirectW
GetDeviceCaps
SetBkColor
ExtTextOutW
SetTextColor
user32
MessageBoxW
RegisterWindowMessageW
GetDlgItemTextW
SetDlgItemTextW
EnumWindows
GetWindowTextW
SendMessageTimeoutW
GetDlgItem
SendMessageW
SetWindowTextW
GetDC
ReleaseDC
SetForegroundWindow
DialogBoxParamW
GetWindowRect
MoveWindow
GetSystemMetrics
ClientToScreen
GetClientRect
DestroyIcon
GetWindowLongW
SetWindowLongW
SetFocus
GetDesktopWindow
ChangeWindowMessageFilterEx
LoadImageW
SetWindowPos
PostMessageW
ShowWindow
BeginPaint
MapWindowPoints
GetSysColor
EndPaint
SetWindowLongPtrW
EndDialog
EnableWindow
IsDlgButtonChecked
DestroyWindow
GetWindowLongPtrW
GetSysColorBrush
LoadStringW
CheckDlgButton
DrawFrameControl
OffsetRect
InflateRect
SetTimer
KillTimer
msvcrt
_initterm
__C_specific_handler
memset
_ismbblead
_fmode
_commode
__CxxFrameHandler3
wcstok
__setusermatherr
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
_callnewh
malloc
free
_purecall
_wtol
_wcsicmp
sprintf_s
memcpy_s
_acmdln
memcpy
wcscmp
_vsnwprintf
_vscwprintf
iswspace
?terminate@@YAXXZ
shell32
SHGetStockIconInfo
SHGetFileInfoW
CommandLineToArgvW
ShellExecuteExW
oleaut32
SysAllocString
SystemTimeToVariantTime
SysStringLen
SysFreeString
VariantTimeToSystemTime
VariantInit
VariantClear
rpcrt4
UuidCreate
comctl32
ImageList_Destroy
ImageList_Create
ord345
ImageList_ReplaceIcon
ImageList_Add
ImageList_AddMasked
InitCommonControlsEx
ord344
ntdll
RtlFreeHeap
WinSqmAddToStream
RtlCaptureContext
RtlLookupFunctionEntry
RtlAllocateHeap
EtwTraceMessage
RtlNtStatusToDosError
RtlGetLastNtStatus
RtlGetPersistedStateLocation
RtlVirtualUnwind
sxshared
SxTracerShouldTrackFailure
SxTracerGetThreadContextRetail
SxTracerDebuggerBreak
api-ms-win-core-com-l1-1-0
CoInitializeSecurity
CoCreateInstance
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc
CoDisconnectObject
CoInitializeEx
Name
.text
Size
88KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
200B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=4, id=259, version=33145,
count=25, id=260, version=33145,
count=7, id=261, version=33145,
count=27, id=257, version=33145,
count=311, id=1, productName=Unmarked objects,
count=24, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
dialer.exe
- IMPHASH d569fd246c6af2314c25cd79f2851571
- SHA256 4a1a2de5480477d6cbc5c9311fc9a85e9066718f1c25674f4adebc277f5b1765
- MD5 ebf736ca7926ceea07f3247e6ea7f408
- SHA1 6c79597f5a4daca123800414eb2a5794db40083a
- SHA512 c44d4eb74d3420d21c816e65672bce1cdf34c6c8621aa82d3a891dfaac02d14565f8d8b35b49a081de50fa058719a236f60c6de802de241e698123365b564b68
- SSDEEP 768:N1VtGAlo199sWFBW/vB16qYhBEGYz/KE56QEG/WNydbjNaiNY6/bko6Sd:bGSqXuvB16qYhBErzdrv9YsWSd
- TLSH T19463070E77E830EAD87A8279A6B20365D576B4302B115BFF26D4C07D9F23BC49935E06
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4864
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
dialer.pdb
advapi32
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
kernel32
HeapSetInformation
LocalFree
GetModuleHandleW
GetTickCount
lstrcmpW
RtlVirtualUnwind
GetLastError
FormatMessageW
LocalAlloc
CreateMutexW
lstrlenW
CloseHandle
RtlLookupFunctionEntry
RtlCaptureContext
SetUnhandledExceptionFilter
GetCurrentProcess
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
gdi32
GetStockObject
GetTextExtentPoint32W
SetBkColor
LPtoDP
CreateFontIndirectW
SelectObject
user32
LoadStringW
LoadAcceleratorsW
DrawIcon
GetSystemMetrics
EndDialog
SendMessageW
FillRect
MessageBoxW
SetWindowPos
GetDC
DestroyWindow
GetFocus
GetWindowRect
ShowWindow
CreateDialogParamW
GetMessageW
GetWindowTextLengthW
EnableWindow
CheckDlgButton
PostQuitMessage
GetSysColorBrush
EnableMenuItem
SystemParametersInfoW
GetParent
DialogBoxParamW
UpdateWindow
SetForegroundWindow
EndPaint
GetActiveWindow
DispatchMessageW
IsDialogMessageW
DefDlgProcW
PeekMessageW
SetDlgItemTextW
RegisterClassW
GetDlgItemTextW
SendDlgItemMessageW
GetSysColor
WinHelpW
SetFocus
TranslateAcceleratorW
TranslateMessage
GetClipboardData
LoadIconW
FindWindowW
LoadCursorW
GetDlgItem
GetClientRect
PostMessageW
BeginPaint
ReleaseDC
IsClipboardFormatAvailable
IsIconic
api-ms-win-crt-string-l1-1-0
wcscspn
wcsspn
memset
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
_register_thread_local_exe_atexit_callback
_c_exit
api-ms-win-crt-private-l1-1-0
_o___stdio_common_vswprintf
_o__cexit
_o__configthreadlocale
_o__configure_narrow_argv
_o__crt_atexit
_o__exit
_o__get_narrow_winmain_command_line
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__itow
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__wtoi
_o_exit
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
_o___p__commode
memmove
shell32
ShellAboutW
tapi32
lineNegotiateAPIVersion
lineTranslateAddressW
lineGetTranslateCapsW
lineInitializeExW
lineTranslateDialogW
lineDeallocateCall
lineConfigDialogW
lineOpenW
lineShutdown
lineDrop
lineGetAppPriorityW
lineGetDevCapsW
lineClose
lineGetRequestW
lineSetAppPriorityW
lineRegisterRequestRecipient
lineMakeCallW
lineGetAddressCapsW
Name
.text
Size
28KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
792B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
140B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=4, id=259, version=33145,
count=20, id=261, version=33145,
count=13, id=257, version=33145,
count=1183, id=1, productName=Unmarked objects,
count=2, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
directxdatabaseupdater.exe
- IMPHASH 74b611f908f64357720abbf5daf48bf3
- SHA256 57e9245e979c23542c8a5459fb29583c83775733e6904ab1ccaabe1e8cbc537e
- MD5 87574c05b8b64c4a61857ad7cd9785f7
- SHA1 9ff13c8f0dec297c419d730d762212fbba201c07
- SHA512 7b41b7cc3ef02325951c8113b6dcbe5dfc68e73674c203839c2fcb222cbde23c47c38ffbe0e29543745effa367e5eae329db289ff036249848041b2310abb3bb
- SSDEEP 3072:lIrp5eEr5dUL9D8U8u13p2+Sy5MGRKyT0CHiLx:a5eo5dC9gI3p2mtftHi
- TLSH T18604397E32A910F5D5B7D17CC982060AF7B278615316A3EF06D282B80F57BD4793AB90
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
10672
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
DirectXDatabaseUpdater.pdb
msvcp_win
?_Gninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?_Init@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXXZ
?getloc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEBA?AVlocale@2@XZ
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBGHH@Z
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
??1?$basic_istream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?read@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@PEAG_J@Z
?seekg@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?_Getcat@?$codecvt@GDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
??0_Lockit@std@@QEAA@H@Z
??Bid@locale@std@@QEAA_KXZ
?good@ios_base@std@@QEBA_NXZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGXZ
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?in@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??1_Lockit@std@@QEAA@XZ
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?id@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG0@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@H@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?setf@ios_base@std@@QEAAHHH@Z
?put@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@GPEBUtm@@PEBG3@Z
?_Getcat@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Xlength_error@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-string-l1-1-0
memset
wcsncmp
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
_initterm_e
_c_exit
_initterm
api-ms-win-crt-private-l1-1-0
_o___stdio_common_vswprintf
_o___stdio_common_vswscanf
_o__callnewh
_o__cexit
_o__configthreadlocale
_o__configure_wide_argv
_o__crt_atexit
_o__errno
_o__exit
_o__fseeki64
_o__get_initial_wide_environment
_o__get_stream_buffer_pointers
_o__gmtime64
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__lock_file
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_new_mode
memmove
_o__unlock_file
_o__wcsicmp
_o_exit
_o_fclose
_o_fflush
_o_fgetc
_o_fgetpos
_o_fgetwc
_o_fputc
_o_fputwc
_o_fread
_o_free
_o_fsetpos
_o_fwrite
_o_malloc
_o_setvbuf
_o_terminate
_o_ungetc
_o_ungetwc
__C_specific_handler
__current_exception
__current_exception_context
_CxxThrowException
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
_o___p___wargv
_o___p___argc
memcmp
memcpy
wcsrchr
__std_terminate
__CxxFrameHandler4
_o__set_fmode
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventWriteTransfer
EventRegister
EventUnregister
EventActivityIdControl
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GetModuleFileNameA
GetModuleHandleExW
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-file-l1-1-0
GetTempFileNameW
FindFirstFileW
DeleteFileW
FindClose
api-ms-win-core-synch-l1-1-0
WaitForSingleObjectEx
AcquireSRWLockExclusive
CreateSemaphoreExW
EnterCriticalSection
CreateMutexExW
ReleaseSRWLockExclusive
ReleaseSemaphore
DeleteCriticalSection
ReleaseMutex
AcquireSRWLockShared
LeaveCriticalSection
WaitForSingleObject
OpenSemaphoreW
ReleaseSRWLockShared
InitializeCriticalSectionEx
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
GetLastError
RaiseException
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoInitializeEx
StringFromGUID2
CoTaskMemFree
CLSIDFromString
CoUninitialize
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegOpenKeyExW
RegCloseKey
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
OpenProcessToken
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetThreadLocale
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-sysinfo-l1-1-0
GetWindowsDirectoryW
GetSystemTimeAsFileTime
api-ms-win-core-file-l2-1-0
MoveFileExW
api-ms-win-core-sysinfo-l1-2-0
VerSetConditionMask
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-kernel32-legacy-l1-1-1
VerifyVersionInfoW
api-ms-win-oobe-notification-l1-1-0
OOBEComplete
api-ms-win-security-base-l1-1-0
EqualSid
GetTokenInformation
RevertToSelf
AllocateAndInitializeSid
ImpersonateLoggedOnUser
FreeSid
api-ms-win-shell-shdirectory-l1-1-0
ord290
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
WindowsGetStringRawBuffer
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
profapi
ord104
oleaut32
VariantInit
SysFreeString
SysAllocString
VariantClear
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
bcrypt
BCryptCreateHash
BCryptHashData
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptOpenAlgorithmProvider
BCryptGetProperty
dismapi
DismOpenSession
_DismRemovePackageEx
DismCloseSession
DismGetPackages
DismShutdown
DismInitialize
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
Name
.text
Size
100KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
64B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
424B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=78, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=11, id=260, version=33145,
count=5, id=259, version=33145,
count=1308, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=30, id=261, version=33145,
count=14, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
diskpart.exe
- IMPHASH 118596c58b789852789b781d0af467c7
- SHA256 a9882c2c19922af201780dbce7b2f8d41b0d4341784e63bf40baf3a986ca0c7b
- MD5 827fb5c9d45277cb36aef1cacaaca0f0
- SHA1 d089d8b5983bd13f04b434daeeedfe385dd45c5a
- SHA512 cdfef8568c91e00efd199ed5ca67d2e488e1a7ea7806bea187b16edc09d1d669419f60a042c41a10edc1743f183ceec90ac7d67b6cae75f7a98f3546624f93d2
- SSDEEP 3072:toUBw0TrydKPgSWBj91/xRTDywTnNXrChXxJ64+85aYPgaCg1Sr:toqTTry2gS+FVDJyBJ64x5aYPkg
- TLSH T1CF041A0B22D521E9D726F17CC987052AE6B2B026333316EF179085764F6BAF0BD36B51
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7728
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
diskpart.pdb
advapi32
RegCloseKey
RegOpenKeyW
kernel32
DeviceIoControl
CreateFileW
GetLastError
CloseHandle
SetConsoleCtrlHandler
GetStdHandle
GetModuleFileNameW
SetThreadUILanguage
GetVersionExW
GetConsoleMode
HeapSetInformation
ExitProcess
GetComputerNameW
GetFileType
RegisterApplicationRestart
ExpandEnvironmentStringsW
Sleep
WriteFile
LocalAlloc
FormatMessageW
LoadLibraryW
GetWindowsDirectoryW
WriteConsoleW
LocalFree
GetModuleHandleW
FreeLibrary
WideCharToMultiByte
msvcrt
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_CxxThrowException
__CxxFrameHandler3
memcpy
memmove
_XcptFilter
_amsg_exit
__wgetmainargs
__set_app_type
exit
_exit
_cexit
__setusermatherr
??0exception@@QEAA@AEBQEBD@Z
__C_specific_handler
_fmode
_commode
?terminate@@YAXXZ
_lock
_unlock
__dllonexit
_onexit
??1type_info@@UEAA@XZ
memcmp
_wtoi64
_wcsupr
_wtoi
wcsrchr
_wcstoui64
_ui64tow
_initterm
_ltow
wcstol
towupper
iswalpha
swscanf
_wcsnicmp
fgetwc
wcspbrk
setvbuf
_wfopen
fclose
setlocale
malloc
free
wcsstr
wcschr
_errno
??3@YAXPEAX@Z
wcstoul
_vsnwprintf
_callnewh
_wtol
wcsspn
_ultow
_wcsicmp
__CxxFrameHandler4
_purecall
__iob_func
memset
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
StringFromGUID2
CoCreateGuid
CoUninitialize
rpcrt4
UuidCreate
UuidToStringW
RpcStringFreeW
UuidFromStringW
api-ms-win-core-version-l1-1-0
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW
api-ms-win-core-libraryloader-l1-2-0
LoadStringW
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
Name
.text
Size
120KB
Virtual Size
118KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33138,
count=24, id=260, version=33138,
count=8, id=261, version=33138,
count=7, id=257, version=33138,
count=123, id=1, productName=Unmarked objects,
count=14, id=264, version=33138,
count=1, id=255, version=33138,
count=1, id=258, version=33138,
diskperf.exe
- IMPHASH dc6d1d7f9f08441240b20ad5298c254d
- SHA256 c1acdd0625341f7034cf698237f13f42f78eda2fc32037babe44b7f05401687a
- MD5 79c3c1aba4a41528dbfc72b8c1e37466
- SHA1 b06da61a7b6fad9df57b93e00e6b80f60df2f2ef
- SHA512 6c761132fe57e425e8f42d41b39f31d152fc9ebb4fbfbfe69ed11a40e4a1f500e5f6610b8398fa88b9044eea98ab5e977e6b1dd7978d6e0cf09cbf8acd4ad15e
- SSDEEP 384:Vf2NQEGuD6pDwzhWXakU6WBPAUIl58OnTziOMD+5ecK9uFZZhhpINWYJWj:VOQCEDabkLL8gviOMDIhK2ZZhvI5E
- TLSH T126233C4567E510EDFA76577A89A25215D0B2BD302751C6EF17E0427E0F32BE0A838FC2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4880
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
diskperf.pdb
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
_c_exit
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__cexit
_o__configthreadlocale
_o__configure_narrow_argv
_o__crt_atexit
_o__exit
_o__get_initial_narrow_environment
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o___stdio_common_vswprintf
_o__wcsicmp
_o__wcsupr
_o__wtoi
_o_exit
_o_free
_o_malloc
_o_setlocale
_o_terminate
_o_wcstok
__C_specific_handler
__current_exception
__current_exception_context
_o___p___argv
_o___p___argc
_o___stdio_common_vfwprintf
_o___acrt_iob_func
_o___p__commode
api-ms-win-crt-string-l1-1-0
memset
wcscmp
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegDeleteValueW
api-ms-win-core-file-l1-1-0
FindNextVolumeW
FindFirstVolumeW
CreateFileW
GetFileType
FindVolumeClose
api-ms-win-core-processenvironment-l1-1-0
GetStdHandle
GetCommandLineW
ntdll
NtQuerySystemInformation
RtlInitUnicodeString
NtClose
NtOpenFile
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-registry-l2-1-0
RegConnectRegistryW
api-ms-win-core-localization-l1-2-0
SetThreadUILanguage
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetVersionExW
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-heap-l1-1-0
HeapSetInformation
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
LoadStringW
api-ms-win-core-console-l1-1-0
WriteConsoleW
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
Name
.text
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
696B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
140B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=45, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1112, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33138,
count=4, id=259, version=33138,
count=20, id=261, version=33138,
count=2, id=264, version=33138,
count=1, id=253, version=33138,
count=1, id=255, version=33138,
count=1, id=258, version=33138,
diskraid.exe
- IMPHASH 183225e1c1196e5fe09576daea97598d
- SHA256 8f84297a24e0addcbd785c4c4626aabbd134ee785975060301c3c571156eddbb
- MD5 26cd33c01408a78e7ff0f282ff0ba762
- SHA1 acb01af516796435f8becc35ee7efee180e94269
- SHA512 aacbc82f61d4b802288020def2fb528f96781d7bf94a294b4489812a3665af0d700dee73602874aa396a216dd8bdd8f561da57006781204c5b90560d321e7b00
- SSDEEP 6144:5VfUba6ZV199RKHiMVNzJ6/Wo4SPrXYu+o:5VfUba639RAVNzGXa
- TLSH T18974084507A323F9EF7ED0B4445EA10DFE223905C33EAAE79DB709154B63BD1983A249
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5152
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
diskraid.pdb
advapi32
EventSetInformation
EventRegister
EventWriteTransfer
EventUnregister
kernel32
Sleep
WideCharToMultiByte
lstrcmpiW
GetCurrentThreadId
GetCurrentProcessId
SetConsoleCtrlHandler
GetStdHandle
GetModuleFileNameW
SetThreadUILanguage
GetConsoleMode
GetLastError
HeapSetInformation
GetLocalTime
GetComputerNameW
GetFileType
RegisterApplicationRestart
WriteFile
LocalAlloc
FormatMessageW
WriteConsoleW
LocalFree
GetModuleHandleW
msvcrt
_wtoi
fclose
__iob_func
_wcsicmp
_wcsnicmp
setvbuf
setlocale
exit
free
fprintf
malloc
_vsnprintf
_XcptFilter
memcpy
?terminate@@YAXXZ
_commode
_fmode
__C_specific_handler
_wtol
_initterm
_vsnwprintf
_wfopen
__setusermatherr
fgetwc
_exit
__set_app_type
__wgetmainargs
_amsg_exit
_cexit
memset
ws2_32
htons
WSAAddressToStringW
WSAStartup
WSACleanup
api-ms-win-core-com-l1-1-0
StringFromGUID2
CoTaskMemFree
CoInitializeEx
CoTaskMemAlloc
CoCreateInstance
CoUninitialize
ntdll
RtlIpv6AddressToStringExW
api-ms-win-core-version-l1-1-0
VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
api-ms-win-core-libraryloader-l1-2-0
LoadStringW
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
??0CDrCallTracer@@QEAA@KQEBD0PEBJ@Z
??1CDrCallTracer@@QEAA@XZ
?LogMessage@CDrCallTracer@@QEAAXKPEADZZ
Name
.text
Size
276KB
Virtual Size
273KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
712B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=261, version=33136,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33136,
count=22, id=260, version=33136,
count=9, id=257, version=33136,
count=91, id=1, productName=Unmarked objects,
count=22, id=264, version=33136,
count=1, id=256, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
diskusage.exe
- IMPHASH 4035afb8177e22854751b7c711bb93bc
- SHA256 5a0cf16b5d9284142a2afc75918e4e1c9c04198a0cd65bed368b4f1e17415b9f
- MD5 96fbcf843b9f0c66a36c2971d3af9171
- SHA1 a3a2edbc7c600b12bb3e4a405f6aca9546e42f1b
- SHA512 c27fa2465c42fae1e7be97118a6ae5567032e11725cb342a3c04fc4bc701d6cc6804144b0abc589f9ecf9acc085b967fdc63f5b0ba654bc11df00a67e9e77fcc
- SSDEEP 768:jPizSoh4zAdsFgIMlAPG7H4NHcNbgWhTgrpmdi/WJ0v37wn1UcPmcFh:jm48sKsG7H4RcNbFhTlmFPidP1h
- TLSH T14573191D63E930E4F4B792B895A60201E676B431636252FF03F0D2395F27AE0BA39F55
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4864
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
diskusage.pdb
msvcrt
_wcsicmp
?terminate@@YAXXZ
_commode
_fmode
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__C_specific_handler
_XcptFilter
wprintf
malloc
_wcsnicmp
free
wcschr
memmove
memcpy
memcmp
_local_unwind
_wcstoui64
atoi
_errno
wcstoul
wcscpy_s
iswspace
_vsnwprintf
wcsncmp
memset
kernel32
RtlCompareMemory
GetDateFormatW
SystemTimeToTzSpecificLocalTime
GetTimeFormatW
GetNumberFormatW
FileTimeToSystemTime
GetLocaleInfoA
GetLocaleInfoW
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
GetFileInformationByHandle
CreateFileW
FindNextFileW
FindFirstFileExW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FindFirstFileW
GetFullPathNameW
GetStdHandle
GetPrivateProfileIntW
FindClose
GetPrivateProfileStringW
GetConsoleMode
GetLastError
CloseHandle
GetCurrentDirectoryW
SetLastError
GetConsoleOutputCP
WriteFile
SetConsoleMode
FormatMessageW
WriteConsoleW
LocalFree
GetModuleHandleW
WideCharToMultiByte
GetFileType
Sleep
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
DeviceIoControl
advapi32
AllocateAndInitializeSid
FreeSid
CheckTokenMembership
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
ntdll
RtlInsertElementGenericTableAvl
RtlDeleteCriticalSection
RtlIsDosDeviceName_U
RtlDosPathNameToRelativeNtPathName_U
RtlReleaseRelativeName
RtlCopyUnicodeString
NtQueryDirectoryFileEx
NtClose
RtlEnterCriticalSection
RtlInitializeCriticalSection
RtlFreeHeap
RtlLookupElementGenericTableAvl
RtlInitializeGenericTableAvl
NtCreateFile
RtlIsNameInExpression
NtQueryInformationFile
RtlUpcaseUnicodeString
RtlAppendUnicodeToString
RtlAppendUnicodeStringToString
NtOpenFile
RtlNtStatusToDosError
RtlDosPathNameToNtPathName_U
RtlInitUnicodeString
RtlFreeUnicodeString
RtlLeaveCriticalSection
Name
.text
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
300B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=261, version=33145,
count=1, productName=Unmarked objects (old),
count=4, id=259, version=33145,
count=21, id=260, version=33145,
count=115, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=7, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,