Dxpserver.zip
- SHA256 0f821c080208c1ab1c63acf0edd944bf701769be2ce3325d4a33cb2b60d77e7b
Overview
overview
7Static
static
3Dxpserver.zip
windows10-2004-x64
1Dxpserver.zip
windows11-ltsc_2024-x64
1DWWIN.exe
windows10-2004-x64
1DisplaySwitch.exe
windows10-2004-x64
3DmNotifica...er.exe
windows10-2004-x64
1DmOmaCpMo.exe
windows10-2004-x64
1DpiScaling.exe
windows10-2004-x64
7DsmUserTask.exe
windows10-2004-x64
3Dxpserver.exe
windows10-2004-x64
6Eap3Host.exe
windows10-2004-x64
1EaseOfAcce...og.exe
windows10-2004-x64
1dispdiag.exe
windows10-2004-x64
1djoin.exe
windows10-2004-x64
1dllhost.exe
windows10-2004-x64
1dllhst3g.exe
windows10-2004-x64
1dmcertinst.exe
windows10-2004-x64
1dmcfghost.exe
windows10-2004-x64
1dmclient.exe
windows10-2004-x64
1dnscacheugc.exe
windows10-2004-x64
4doskey.exe
windows10-2004-x64
1dpapimig.exe
windows10-2004-x64
1dpnsvr.dll
windows10-2004-x64
1driverquery.exe
windows10-2004-x64
1drvinst.exe
windows10-2004-x64
1dsregcmd.exe
windows10-2004-x64
1dstokenclean.exe
windows10-2004-x64
5dtdump.exe
windows10-2004-x64
1dusmtask.exe
windows10-2004-x64
1dvdplay.exe
windows10-2004-x64
6dwm.exe
windows10-2004-x64
7dxdiag.exe
windows10-2004-x64
7dxgiadaptercache.exe
windows10-2004-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Dxpserver.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Dxpserver.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
DWWIN.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
DisplaySwitch.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
DmNotificationBroker.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
DmOmaCpMo.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
DpiScaling.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
DsmUserTask.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral9
Sample
Dxpserver.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
Eap3Host.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
EaseOfAccessDialog.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
dispdiag.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
djoin.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
dllhost.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
dllhst3g.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
dmcertinst.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
dmcfghost.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
dmclient.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
dnscacheugc.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
doskey.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
dpapimig.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
dpnsvr.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
driverquery.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
drvinst.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
dsregcmd.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
dstokenclean.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
dtdump.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
dusmtask.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
dvdplay.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral30
Sample
dwm.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral31
Sample
dxdiag.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral32
Sample
dxgiadaptercache.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target Dxpserver.zip
- Size 1.7MB
- Sample261026-t5mnmsfs41
- SHA256 0f821c080208c1ab1c63acf0edd944bf701769be2ce3325d4a33cb2b60d77e7b
- MD5 11a2661aeab49df09fa3141a7f1dcc77
- SHA1 8ccbe30de7351b59e0da9a97c287730c611cfeb8
- SHA512 4ac38c00ad1568f7e24ca46007c8ec2172d241b7eb3e96ef427154a65172a820c74a0d44f7f2a97f01b1fa076a0abe2d94fb283c15bf65749883ca07912dd9cc
- SSDEEP 49152:g0aS/9r6XkTs9xU6X6jtvaunrg19uNUOL/3fYFD:g0l/9Of9xAjtCig14NxL/v8D
- TLSH T18F85333F83EB2FC4F1DE15BBDB5EA832138667281B04662E340927497C5D07B852BB59
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 28 IoCs
Checks for missing Authenticode signature.
resource unpack001/DWWIN.EXE unpack001/DmNotificationBroker.exe unpack001/DmOmaCpMo.exe unpack001/DpiScaling.exe unpack001/DsmUserTask.exe unpack001/Dxpserver.exe unpack001/Eap3Host.exe unpack001/EaseOfAccessDialog.exe unpack001/dispdiag.exe unpack001/djoin.exe unpack001/dllhst3g.exe unpack001/dmcertinst.exe unpack001/dmcfghost.exe unpack001/dmclient.exe unpack001/dnscacheugc.exe unpack001/doskey.exe unpack001/dpapimig.exe unpack001/dpnsvr.exe unpack001/driverquery.exe unpack001/drvinst.exe unpack001/dsregcmd.exe unpack001/dstokenclean.exe unpack001/dtdump.exe unpack001/dusmtask.exe unpack001/dvdplay.exe unpack001/dwm.exe unpack001/dxdiag.exe unpack001/dxgiadaptercache.exe
File Explorer
-
Dxpserver.zip.zip 1.7MB
-
DWWIN.EXE.exe 256KB
-
DisplaySwitch.exe.exe 1.8MB
-
DmNotificationBroker.exe.exe 52KB
-
DmOmaCpMo.exe.exe 60KB
-
DpiScaling.exe.exe 100KB
-
DsmUserTask.exe.exe 56KB
-
Dxpserver.exe.exe 304KB
-
Eap3Host.exe.exe 40KB
-
EaseOfAccessDialog.exe.exe 312KB
-
dispdiag.exe.exe 188KB
-
djoin.exe.exe 104KB
-
dllhost.exe.exe 91KB
-
dllhst3g.exe.exe 72KB
-
dmcertinst.exe.exe 200KB
-
dmcfghost.exe.exe 64KB
-
dmclient.exe.exe 168KB
-
dnscacheugc.exe.exe 60KB
-
doskey.exe.exe 44KB
-
dpapimig.exe.exe 100KB
-
dpnsvr.exe.dll 36KB
-
driverquery.exe.exe 104KB
-
drvinst.exe.exe 440KB
-
dsregcmd.exe.exe 472KB
-
dstokenclean.exe.exe 40KB
-
dtdump.exe.exe 160KB
-
dusmtask.exe.exe 76KB
-
dvdplay.exe.exe 40KB
-
dwm.exe.exe 132KB
-
dxdiag.exe.exe 332KB
-
dxgiadaptercache.exe.exe 128KB
DWWIN.EXE
- IMPHASH 108a2da7958a6300a0a1e37e8d9c3c40
- SHA256 cdd16f625ff62b92320fd498a2299f304f120d816fc0bded37cc1d1022a4e6b8
- MD5 33584a3d69ba1bf8afa58f4490fda3ac
- SHA1 39c312766037d8851a792b18254a9ff06ea6dcde
- SHA512 4d49cc1e3964a399ef567972eea30cae9efa3d8d340a86deb045126d9dfd8b435121fa6a1a5ba557636ae1b2b965067c46a846a52bd67a3cbbbb843b05229f65
- SSDEEP 6144:R7mcxbANv/e1dLG7AkDLDOpp/HZJYj7n:R75ANvMLG7tDLDOdJ6n
- TLSH T14D443B6CA3E428F5E876C23CC5925319DA72742D2722CACF01E085793F13AF5AA39F55
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
8768
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
dwwin.pdb
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
_initterm
_initterm_e
_c_exit
api-ms-win-crt-private-l1-1-0
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__wcsicmp
_o__wcsnicmp
_o__wcstoui64
memmove
_o__wtoi
_o__wtoi64
_o_exit
_o_free
_o_isspace
_o_malloc
_o_terminate
_o_tolower
_o_towlower
_o_wcscpy_s
_o_wcstol
__C_specific_handler
__current_exception
__current_exception_context
_o__exit
_o__errno
_o__get_initial_wide_environment
__CxxFrameHandler4
__std_terminate
wcschr
wcsrchr
wcsstr
__CxxFrameHandler3
_CxxThrowException
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
_o___p___wargv
_o___p___argc
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
wcsncmp
memset
wcscmp
wcsnlen
kernel32
Module32FirstW
CreateToolhelp32Snapshot
SearchPathW
IsWow64Process2
GetApplicationRestartSettings
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
SetLastError
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
OutputDebugStringW
CreateFileMappingW
LoadLibraryExW
GetSystemDirectoryW
GetSystemWow64DirectoryW
FreeLibrary
FreeLibraryAndExitThread
UnmapViewOfFile
MultiByteToWideChar
GetUserDefaultUILanguage
LocalFree
WaitForSingleObjectEx
WaitForMultipleObjectsEx
GetTickCount64
SetEvent
WaitForSingleObject
MapViewOfFile
DeleteFileW
Sleep
ExpandEnvironmentStringsW
GetCommandLineW
HeapSetInformation
CloseHandle
WideCharToMultiByte
Module32NextW
DebugBreak
GetModuleFileNameA
GetModuleHandleExW
HeapFree
GetProcAddress
HeapAlloc
GetProcessHeap
FormatMessageW
CreateSemaphoreExW
EnterCriticalSection
ReleaseSemaphore
LeaveCriticalSection
InitializeCriticalSectionEx
OpenSemaphoreW
ReleaseSRWLockShared
CreateMutexExW
AcquireSRWLockShared
DeleteCriticalSection
SetEnvironmentVariableW
GetTickCount
QueryFullProcessImageNameW
K32GetModuleFileNameExW
VirtualAlloc
VirtualFree
CreateEventW
IsWow64Process
DuplicateHandle
GetThreadId
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
CreateMutexW
ResetEvent
CompareStringOrdinal
GetWindowsDirectoryW
VirtualQueryEx
GetPackageFamilyName
GetVersionExW
ResolveDelayLoadedAPI
DelayLoadFailureHook
InitializeCriticalSectionAndSpinCount
GetLastError
ReadProcessMemory
GetLogicalDriveStringsW
QueryDosDeviceW
GetDriveTypeW
FindClose
K32EnumProcessModules
GlobalMemoryStatusEx
ReleaseMutex
GetModuleHandleW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
OpenEventW
GetModuleHandleExA
OpenMutexW
LoadLibraryW
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoTaskMemFree
api-ms-win-service-private-l1-1-0
I_QueryTagInformation
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetExitCodeThread
CreateProcessW
GetProcessTimes
InitializeProcThreadAttributeList
OpenProcessToken
CreateThread
TerminateProcess
UpdateProcThreadAttribute
OpenThread
DeleteProcThreadAttributeList
GetProcessId
wer
WerpAddTerminationReason
WerpSetTtdStatus
WerReportCreate
WerReportSubmit
WerReportCloseHandle
WerpGetReportFlags
WerpSetCallBack
WerReportAddDump
WerpPromptUser
WerpCreateIntegratorReportId
WerpSetIntegratorReportId
WerpAddAppCompatData
WerpFreeString
WerpIsTransportAvailable
WerReportSetUIOption
WerReportAddFile
WerReportSetParameter
WerpSetReportFlags
bcrypt
BCryptDestroyHash
BCryptCreateHash
BCryptHashData
BCryptFinishHash
ntdll
RtlFreeSid
NtAlpcSendWaitReceivePort
NtAlpcConnectPort
NtQueryInformationToken
RtlInitUnicodeString
RtlAllocateAndInitializeSid
NtQuerySystemInformation
NtClose
NtWaitForSingleObject
NtOpenEvent
NtQueryInformationProcess
ZwUpdateWnfStateData
DbgPrint
NtResumeProcess
NtSuspendProcess
EtwTraceMessage
RtlNtStatusToDosError
ZwQueryInformationThread
RtlSetThreadErrorMode
RtlGetUnloadEventTraceEx
DbgPrintEx
NtCreateFile
NtDeviceIoControlFile
NtAllocateVirtualMemory
NtFreeVirtualMemory
NtSetSystemInformation
RtlAdjustPrivilege
NtQueryInformationThread
NtOpenKey
RtlFreeHeap
RtlAllocateHeap
RtlNtStatusToDosErrorNoTeb
RtlCompareUnicodeString
RtlInitUnicodeStringEx
NtQueryValueKey
RtlDetermineDosPathNameType_U
RtlGetNtSystemRoot
RtlGetCurrentTransaction
RtlSetCurrentTransaction
NtWaitForMultipleObjects
EtwEventWriteNoRegistration
RtlImageNtHeaderEx
ZwQueryWnfStateNameInformation
advapi32
RegDeleteKeyA
RegSetKeySecurity
BuildSecurityDescriptorW
RegGetKeySecurity
CreateWellKnownSid
RegDeleteValueW
EventRegister
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
EventUnregister
EventWriteTransfer
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegGetValueW
RegCreateKeyExW
RegSetValueExW
OpenSCManagerW
CloseServiceHandle
RegSetKeyValueW
RegDeleteKeyW
diagnosticdatasettings
TelGetWerTelemetryMode
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-libraryloader-l1-2-0
LoadStringW
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
api-ms-win-core-file-l1-1-0
CreateFileW
GetFileSizeEx
GetFileAttributesW
api-ms-win-security-base-l1-1-0
FreeSid
AllocateAndInitializeSid
CheckTokenMembership
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-version-l1-1-0
GetFileVersionInfoSizeExW
VerQueryValueW
GetFileVersionInfoExW
api-ms-win-service-management-l1-1-0
OpenServiceW
StartServiceW
api-ms-win-shcore-obsolete-l1-1-0
CommandLineToArgvW
Name
.text
Size
176KB
Virtual Size
173KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
48KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=257, version=33145,
count=63, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1410, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=17, id=260, version=33145,
count=5, id=259, version=33145,
count=37, id=261, version=33145,
count=47, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
DisplaySwitch.exe
- IMPHASH 8dad94493947cb0fe4b73bfe3295dc8b
- SHA256 775296b6dd6bfbb3684d272a70606f40c2311a5c144f1328b37117e3b3ff074c
- MD5 69c62cf38dd646c8bcd9a2b4f1633c38
- SHA1 92e1893dfce02b1173d516eec3b3df92f3467342
- SHA512 75222d8d820ba64ec75e54fc91abd35d08bf5d6ed452c2a58743269aac9f46cae87ed6e1b199ff5640c11270ecc0d54bae0b4158949cbd0b1e2524fdc2c38223
- SSDEEP 3072:FhP4YFPSTgNz4gvl1Oy/iIZvk0G15Kr7SEtbIQ:F+YFPS8NzFt1Oy/iue55mV
- TLSH T16995A5557653EC94E242583C0A6FD2E54D9B3CA06B7802E336BBB77E8C7CF857524282
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
99:2f:43:97:ef:72:61:56:d3:ed:9a:b6:6c:3e:e9:f9:55:a5:72:c3:bc:4e:70:71:95:51:a6:6a:1f:c8:ce:dc
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 3, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A400-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:ec:e0:2b:a4:82:d0:91:52:80:00:01:00:00:01:ec
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
82752
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
DisplaySwitch.pdb
advapi32
EventRegister
EventWriteTransfer
EventUnregister
RegGetValueW
kernel32
CompareStringOrdinal
GetCurrentThreadId
DecodePointer
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
RaiseException
InitOnceExecuteOnce
EncodePointer
GetCommandLineW
AcquireSRWLockShared
LoadLibraryW
LocalFree
ReleaseSRWLockShared
user32
TranslateMessage
DispatchMessageW
SystemParametersInfoW
SetDisplayConfig
GetMessageW
PostThreadMessageW
msvcrt
__CxxFrameHandler3
_callnewh
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
memcpy
_commode
_fmode
_wcmdln
memset
__C_specific_handler
_initterm
_cexit
_lock
__setusermatherr
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
free
_purecall
malloc
policymanager
PolicyManager_GetPolicyInt
api-ms-win-core-com-l1-1-0
CoResumeClassObjects
CoRegisterClassObject
CoRevokeClassObject
CoAddRefServerProcess
CoReleaseServerProcess
CoUninitialize
CoInitializeEx
api-ms-win-core-winrt-l1-1-0
RoRevokeActivationFactories
RoRegisterActivationFactories
RoActivateInstance
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
RoOriginateErrorW
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsIsStringEmpty
WindowsCreateString
WindowsCreateStringReference
WindowsStringHasEmbeddedNull
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentProcessId
GetStartupInfoW
TerminateProcess
api-ms-win-core-errorhandling-l1-1-0
SetLastError
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetProcAddress
FreeLibrary
GetModuleHandleW
GetModuleFileNameW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-processthreads-l1-1-1
GetProcessMitigationPolicy
api-ms-win-core-heap-l2-1-0
LocalAlloc
api-ms-win-core-handle-l1-1-0
CloseHandle
combase
ord140
imm32
ImmDisableIME
Name
.text
Size
88KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.imrsiv
Size
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
20KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
440B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=34, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33138,
count=6, id=261, version=33138,
count=15, id=257, version=33138,
count=105, id=1, productName=Unmarked objects,
count=16, id=264, version=33138,
count=21, id=260, version=33138,
count=1, id=255, version=33138,
count=1, id=258, version=33138,
DmNotificationBroker.exe
- IMPHASH 0c5288313525ae57d7dd27a2d2349249
- SHA256 712d1e37910db9fb3f97edd21aedd77ca7bd3abccffa1520ac5b26911c29401c
- MD5 e505efdaf170879c1592a6e774fae652
- SHA1 b7ff5272dff08fdd2bca7b7dd007220806b0967a
- SHA512 373e7e05c88c3dd8b197cc045d15e72adf3c5591adca9abc568d6064ebf458d03f072689df19eb033222e99bd1b5a7508c9d9ce78bce0ee7214d3f26bf5c78f9
- SSDEEP 768:v0QUWSbYb4DqLsqI/JT4WU7IE8l0/y3utjVm+nMud:cSvb45qI/JT4WU7ID+/yetjVz
- TLSH T195333959636904D9F7A6427D91370A45D0B6F030876317EF61B0C2BA0F37BE1AE79AC2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5152
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
DmNotificationBroker.pdb
msvcrt
free
_purecall
__CxxFrameHandler4
??3@YAXPEAX@Z
malloc
__CxxFrameHandler3
memmove
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_commode
_fmode
_wcmdln
memset
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_wcsicmp
_callnewh
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_CxxThrowException
memcpy
??1type_info@@UEAA@XZ
api-ms-win-core-processenvironment-l1-1-0
GetCommandLineW
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoUninitialize
CoTaskMemAlloc
CoInitializeEx
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-processthreads-l1-1-0
CreateThread
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetStartupInfoW
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-shcore-obsolete-l1-1-0
CommandLineToArgvW
dmcmnutils
CopyString
api-ms-win-core-synch-l1-1-0
WaitForSingleObject
api-ms-win-core-handle-l1-1-0
CloseHandle
rpcrt4
RpcBindingFree
NdrClientCall3
RpcBindingCreateW
RpcBindingBind
I_RpcExceptionFilter
user32
TranslateMessage
GetMessageW
DispatchMessageW
dui70
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z
StrToID
?GetClassInfoPtr@RichText@DirectUI@@SAPEAUIClassInfo@2@XZ
?GetClassInfoPtr@TouchEdit2@DirectUI@@SAPEAUIClassInfo@2@XZ
UnInitProcessPriv
UnInitThread
InitThread
InitProcessPriv
?CreateBool@Value@DirectUI@@SAPEAV12@_N@Z
?VisibleProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?CreateString@Value@DirectUI@@SAPEAV12@PEBGPEAUHINSTANCE__@@@Z
?SetValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@@Z
?ContentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?_ZeroRelease@Value@DirectUI@@AEAAXXZ
?Destroy@DUIXmlParser@DirectUI@@QEAAXXZ
?GetEncodedContentString@Element@DirectUI@@QEAAJPEAG_K@Z
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJPEBGPEAUHINSTANCE__@@1@Z
?Create@DUIXmlParser@DirectUI@@SAJPEAPEAV12@P6APEAVValue@2@PEBGPEAX@Z2P6AX11H2@Z2@Z
?CreateElement@DUIXmlParser@DirectUI@@QEAAJPEBGPEAVElement@2@1PEAKPEAPEAV32@@Z
windows.ui.immersive
ord101
ord100
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.imrsiv
Size
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
632B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=28, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=4, id=259, version=33136,
count=95, id=1, productName=Unmarked objects,
count=11, id=257, version=33136,
count=9, id=261, version=33136,
count=8, id=264, version=33136,
count=23, id=260, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
DmOmaCpMo.exe
- IMPHASH 376551b64bb593b54d460fb21e719389
- SHA256 5b386f630cd540b80becbe9248cfd37a7e8c6fda6f5dc3615f1e7ddb43e39218
- MD5 9c762c65e0ee1f25d88abfd0f6fb0f43
- SHA1 e1ae166893f586124d8ab1060ea2d0b6c7ae91e0
- SHA512 5f5ae1a1b003efd2af6df1246d7dd126e138be220f88cc7f847302c005e549bed7f3ff8eb9b2eac84e349b2c3bee9e51ed09aea03e51ce57bceec641d3e271c7
- SSDEEP 768:AkmeJgj/kznw8fyIGhT1f2pOm7yRthTokg9avpd4D80De71q17KEFFG1:ZjJgEffehpAJIXoG4s817KR1
- TLSH T1BE534B0EB7A520E9E576823C8452491AE1B1B03167525BFF03A4C1BE1F23BF4A93DF61
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5152
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
DmOmaCpMo.pdb
msvcrt
sprintf_s
_errno
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
memcpy_s
_vsnwprintf
??3@YAXPEAX@Z
malloc
_CxxThrowException
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_commode
_fmode
_acmdln
memset
__C_specific_handler
_initterm
__CxxFrameHandler3
__setusermatherr
_ismbblead
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
__CxxFrameHandler4
_callnewh
memcpy
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventRegister
EventActivityIdControl
EventUnregister
EventSetInformation
api-ms-win-core-file-l1-1-0
GetFileSize
ReadFile
api-ms-win-core-processenvironment-l1-1-0
GetCommandLineW
api-ms-win-core-com-l1-1-0
CoInitializeEx
CLSIDFromString
StringFromGUID2
CoUninitialize
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-handle-l1-1-0
CloseHandle
oleaut32
SysFreeString
api-ms-win-core-synch-l1-2-0
WakeAllConditionVariable
Sleep
SleepConditionVariableSRW
api-ms-win-core-processthreads-l1-1-0
GetStartupInfoW
GetCurrentProcess
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
omadmapi
ord64
ord44
dmcmnutils
CopyString
dmprocessxmlfiltered
MdmProcessConfigXmlWithAttributes
dsclient
DSOpenSharedFile
rpcrt4
UuidCreate
UuidFromStringW
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoUninitialize
RoInitialize
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-synch-l1-1-0
ReleaseMutex
WaitForSingleObject
CreateSemaphoreExW
AcquireSRWLockExclusive
CreateMutexExW
ReleaseSemaphore
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseSRWLockExclusive
dmenrollengine
GetEnrollmentType
msvcp110_win
?_Xbad_alloc@std@@YAXXZ
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
184B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=44, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=21, id=260, version=33145,
count=114, id=1, productName=Unmarked objects,
count=15, id=257, version=33145,
count=12, id=261, version=33145,
count=5, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
DpiScaling.exe
- IMPHASH 68ee9f8ea2c6bb076ad89433a0383f39
- SHA256 58012ed021e4e99afd7c5efb2fdbf433fafe2c8c51ef0676e1ab72b59e709eaa
- MD5 d0fdcdb82be3f5f5bc5bca35a9002aab
- SHA1 d58efe6adf2a1e956c0ae248655d6e0b11107b7d
- SHA512 4e4c22b7493c3ceb987bcc868db1236903a1c7e3a1146d9553f1c7bf33679cf8109ae2ecb6a90c7634c8dd3c64e4137b06d30d669f44e645b3cb040c8f0aad24
- SSDEEP 1536:/p0ZXM91OwxgwYfPSqlGv+BNXNvuZS36EDtAZ7jz6dTdMQiMtYwJjM:R+iOwNMSqoKXNvuZAFDqXzlzQw
- TLSH T14CA3C002728410D9D4384232D8B78AB539B5AC300B6206EF7668E65F5F317D6BA736FD
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5056
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
DpiScaling.pdb
user32
LoadStringW
msvcrt
_cexit
?terminate@@YAXXZ
_XcptFilter
_amsg_exit
__wgetmainargs
__set_app_type
exit
_fmode
_wcmdln
memset
__C_specific_handler
_exit
_initterm
__setusermatherr
_commode
shell32
ord100
shlwapi
ord388
api-ms-win-core-com-l1-1-0
CoUninitialize
CoCreateInstance
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetStartupInfoW
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
ole32
CoInitialize
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
264B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
72KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
136B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=261, version=33136,
count=1, productName=Unmarked objects (old),
count=4, id=259, version=33136,
count=21, id=260, version=33136,
count=11, id=257, version=33136,
count=40, id=1, productName=Unmarked objects,
count=2, id=264, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
DsmUserTask.exe
- IMPHASH 1ee43f9d519bf6ddb773408973b344d8
- SHA256 4ca522be6a9e4a4bc93ff4a6f78045a52dd0fb3fa7f72f9271be6fccd31d6c2d
- MD5 43187f609baebaad3cda845206526536
- SHA1 69adb2f518bc141e2a240c8310d6d6b2d380a758
- SHA512 a50bd76ea236139701fc34451842778dfd9f370bd5759522df1e34fc7471ffe4fe45eb827c191b64833c6241435915500c40146fa8813080c3508010e6cac37e
- SSDEEP 768:ZVSP1dPqPS+SipvEcxvndBxh8N0CRD9LpnbZjK1p:X+b+SipvXBn9hXy/ZjKv
- TLSH T144435B09A3E810E5E479427D8E73550EE172B524A32162EF63A4C17E1FB3FF0A439B95
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4992
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
DsmUserTask.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
_register_thread_local_exe_atexit_callback
_c_exit
api-ms-win-crt-private-l1-1-0
_o__cexit
_o__configthreadlocale
_o__configure_wide_argv
_o__crt_atexit
_o__errno
_o__exit
_o__get_wide_winmain_command_line
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
memcpy
_o_exit
_o_free
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf
__std_terminate
__CxxFrameHandler4
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
wcschr
_CxxThrowException
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
LoadStringW
GetModuleHandleExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameA
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-eventing-classicprovider-l1-1-0
RegisterTraceGuidsW
TraceMessage
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
UnregisterTraceGuids
api-ms-win-core-com-l1-1-0
CoUninitialize
CoTaskMemFree
CLSIDFromString
CoTaskMemAlloc
CoCreateInstance
CoInitializeEx
api-ms-win-devices-query-l1-1-0
DevFreeObjectProperties
DevFreeObjects
DevGetObjectProperties
DevFindProperty
DevGetObjects
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegGetValueW
RegOpenKeyExW
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-0
GetStartupInfoW
GetCurrentProcess
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
Name
.text
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.imrsiv
Size
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
948B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
172B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=47, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1131, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33140,
count=26, id=261, version=33140,
count=6, id=264, version=33140,
count=11, id=260, version=33140,
count=1, id=253, version=33140,
count=1, id=255, version=33140,
count=1, id=258, version=33140,
Dxpserver.exe
- IMPHASH b2c7314042cc2257162a9523f1874d1f
- SHA256 4c5908c1181ae4f0157a8cee9a9520c9cbf20dcd190e5cc456ccc03a2346a181
- MD5 cd69ac3dbc6999bdfc93b198e9dcbfc1
- SHA1 04d7d846e84c5483b2910e8c629f20b75e1216bb
- SHA512 5d3e9688dde2ef841ba71c5fe02103a8296117e0fd654b5ffd60fb92ea2515aaa96322d9644abac19d7fba63b3446d86095bb873acf07ae42eb0b86b78cdc7e2
- SSDEEP 6144:0zDXaTtvFBYjDoeo2h3Ngo8X7rmrQAl6:GXaTtvFBwDoeoCHi/N
- TLSH T131642A5D27E81CE4E9B6D23CC5538209D7B278756B11D6CF02A082BA5F33AD4AD39F21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
8496
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
DXPServer.pdb
advapi32
TraceMessage
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
EventRegister
EventUnregister
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
RegNotifyChangeKeyValue
EventWriteTransfer
EventSetInformation
EventActivityIdControl
RegGetValueW
RegQueryValueExW
kernel32
GetModuleHandleW
lstrcmpiW
RaiseException
LeaveCriticalSection
EnterCriticalSection
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceExW
GetModuleFileNameW
InitializeCriticalSection
DeleteCriticalSection
GetTickCount
WaitForSingleObject
ReleaseSemaphore
SetLastError
CreateSemaphoreW
CreateMutexW
CreateEventW
SetEvent
GetCommandLineW
GetCurrentThreadId
CreateThread
Sleep
FormatMessageW
LoadLibraryExW
HeapAlloc
HeapFree
GetModuleHandleExW
GetModuleFileNameA
DebugBreak
IsDebuggerPresent
CloseHandle
ResetEvent
ReleaseMutex
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForSingleObjectEx
AcquireSRWLockExclusive
OpenSemaphoreW
CreateThreadpoolTimer
GetSystemTimeAsFileTime
InitOnceBeginInitialize
GetCurrentProcessId
CreateMutexExW
InitOnceComplete
CreateSemaphoreExW
ReleaseSRWLockExclusive
ExpandEnvironmentStringsW
LocalFree
InitializeCriticalSectionAndSpinCount
GetProcAddress
FreeLibrary
FindClose
FindNextFileW
MoveFileW
CopyFileExW
SetFileAttributesW
GetProcessHeap
GetLastError
CreateFileW
CompareStringOrdinal
GetCurrentProcess
VirtualAlloc
LoadLibraryExA
EncodePointer
DecodePointer
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
InitializeSListHead
GetStartupInfoW
SystemTimeToFileTime
GetUserGeoID
GetUserDefaultLCID
GetSystemDefaultLCID
LCIDToLocaleName
LCMapStringW
GetSystemInfo
CompareFileTime
GetFileMUIPath
GetFileAttributesW
SetFilePointer
FindFirstFileW
OutputDebugStringW
VirtualFree
gdi32
CreateCompatibleBitmap
DeleteDC
SetLayout
SelectObject
CreateCompatibleDC
DeleteObject
CreateDIBSection
CreateRectRgn
user32
SetWindowRgn
ShowWindow
CheckMenuItem
DeleteMenu
ModifyMenuW
InsertMenuW
LoadStringW
GetSystemMenu
GetIconInfo
IsWindowUnicode
GetMessageA
IsIconic
PostQuitMessage
DrawIconEx
CreateIconIndirect
DestroyIcon
EnumWindows
RegisterClassExW
SetWindowTextW
DispatchMessageA
CharUpperW
PostThreadMessageW
GetMessageW
MsgWaitForMultipleObjects
DispatchMessageW
GetWindowLongW
DefWindowProcW
PostMessageW
GetMenuState
LoadImageW
SendMessageW
UnregisterClassA
GetSystemMetrics
TranslateMessage
PeekMessageW
CharNextW
CallWindowProcW
GetWindowLongPtrW
RegisterWindowMessageW
GetClassInfoExW
LoadCursorW
SetWindowLongPtrW
CreateWindowExW
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_c_exit
_initterm
_register_thread_local_exe_atexit_callback
api-ms-win-crt-private-l1-1-0
_o__configthreadlocale
_o__configure_wide_argv
_o__crt_atexit
_o__errno
_o__exit
_o__get_wide_winmain_command_line
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o_bsearch
_o_exit
_o_free
_o_iswspace
_o_malloc
_o_memcpy_s
_o_qsort
_o_terminate
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstoul
__current_exception
__current_exception_context
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___p__commode
__C_specific_handler
_o__cexit
_o__callnewh
memcmp
memcpy
memmove
ole32
CoUninitialize
CoInitializeEx
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
StringFromGUID2
CoCreateGuid
CoCreateInstance
CoResumeClassObjects
CoRevokeClassObject
CoRegisterClassObject
CoSuspendClassObjects
CoUnmarshalInterface
PropVariantClear
CoDisconnectObject
CoMarshalInterThreadInterfaceInStream
PropVariantCopy
CoFreeUnusedLibrariesEx
oleaut32
VariantChangeType
SysStringLen
RegisterTypeLi
LoadTypeLi
SysAllocString
VariantClear
SysFreeString
VarUI4FromStr
UnRegisterTypeLi
VariantInit
shlwapi
PathFileExistsW
PathAppendW
ord615
ord487
SHCreateStreamOnFileEx
SHStrDupW
ord16
UrlEscapeW
SHCreateStreamOnFileW
PathParseIconLocationW
PathRemoveFileSpecW
propsys
StgDeserializePropVariant
PropVariantToGUID
PSCreateMemoryPropertyStore
PropVariantCompareEx
PSGetPropertyDescriptionByName
PSGetPropertyDescriptionListFromString
PropVariantChangeType
PropVariantToStringAlloc
PSGetPropertyKeyFromName
shell32
SHParseDisplayName
ord165
SHQueryUserNotificationState
ShellExecuteExW
ord155
SHCreateShellItemArrayFromIDLists
ord6
Shell_NotifyIconW
SHGetPropertyStoreForWindow
dwmapi
DwmSetIconicThumbnail
DwmSetWindowAttribute
gdiplus
GdipSetSmoothingMode
GdipCreateFromHDC
GdipGetImageHeight
GdipGetImageWidth
GdiplusShutdown
GdipFree
GdipDisposeImage
GdipDrawImageRectI
GdipCloneImage
GdipCreateBitmapFromFile
GdiplusStartup
GdipDeleteGraphics
GdipAlloc
ntdll
RtlGetNativeSystemInformation
WinSqmIsOptedIn
WinSqmIncrementDWORD
WinSqmSetDWORD
WinSqmEndSession
WinSqmAddToStreamEx
WinSqmStartSession
RtlCaptureContext
RtlVirtualUnwind
WinSqmSetString
RtlLookupFunctionEntry
xmllite
CreateXmlReader
rpcrt4
UuidFromStringW
msi
ord113
crypt32
CertVerifyCertificateChainPolicy
wintrust
CryptCATAdminReleaseContext
CryptCATAdminReleaseCatalogContext
CryptCATCatalogInfoFromContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminAcquireContext
CryptCATAdminCalcHashFromFileHandle
WinVerifyTrustEx
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
Name
.text
Size
176KB
Virtual Size
174KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
56KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
44KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=15, id=260, version=33145,
count=5, id=259, version=33145,
count=29, id=261, version=33145,
count=35, id=257, version=33145,
count=1346, id=1, productName=Unmarked objects,
count=37, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
Eap3Host.exe
- IMPHASH 4e592bc1cd35b54d7c2f7a5e75c3b5e0
- SHA256 e58c1daa4c67607b527b4e406cf99f2dcc3e087022e8f9b6fbc88532a7b9f2ef
- MD5 746c582449bb9a9cf12b09eb47341f98
- SHA1 69e52d53d417a5c120bc5ac9284635117d9c5444
- SHA512 3abaa7959a840a47984e569c4714c80bd5293fb4fad7f2632157fa41c9c7309c07746a18be13be746a5f554cd230dd5a625f0052769fc78a9ec8b113ee5e6a2c
- SSDEEP 384:aDN2svBS016FJ9byhMObF/eaewnmO8fJJQaKW9aW:aDN2YwqhMO/ehO8fJJQaB
- TLSH T1DF030789A79458DAF536A53D88A3520ED0B2F6015B2296CF27D1035F0E37FE0AD35BD4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4864
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Eap3Host.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_c_exit
_register_thread_local_exe_atexit_callback
_initterm
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configthreadlocale
_o__configure_narrow_argv
_o__crt_atexit
_o__exit
_o__get_narrow_winmain_command_line
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_new_mode
_o_exit
_o_free
_o_malloc
_o_terminate
__C_specific_handler
__CxxFrameHandler3
__current_exception
__current_exception_context
_CxxThrowException
_o___p__commode
_o___stdio_common_vfprintf
_o___std_exception_destroy
_o___std_exception_copy
_o___acrt_iob_func
wcschr
_o__set_fmode
api-ms-win-crt-string-l1-1-0
memset
ntdll
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-com-l1-1-0
CoGetClassObject
CoRegisterClassObject
CoRevokeClassObject
CoInitializeEx
CoTaskMemAlloc
CLSIDFromString
CoInitializeSecurity
CoRegisterSurrogate
CoUninitialize
api-ms-win-core-synch-l1-1-0
CreateEventW
SetEvent
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
api-ms-win-service-management-l1-1-0
CloseServiceHandle
OpenServiceW
OpenSCManagerW
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
api-ms-win-service-management-l2-1-0
QueryServiceStatusEx
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetStartupInfoW
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
user32
DispatchMessageW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjects
PostQuitMessage
Name
.text
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
660B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
196B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=33145,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1110, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=4, id=259, version=33145,
count=27, id=261, version=33145,
count=3, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
EaseOfAccessDialog.exe
- IMPHASH 2305827b6ded24f57948d6c59c9c7301
- SHA256 42b6b172831b0b0cc1457af7902a646821914c5a8c335eccfe9dc62c44704d1a
- MD5 fba85b033e882d79a6111f562b8037ae
- SHA1 3595461a6e5d12e95f649f303355c10da55bbb94
- SHA512 9677fd839680f87297cc102fac275b3176f9180a176d4b53f58ce72795afcbff1751d1b6192fb50ff228d61c784a9e02a31a1cdf3fc416df4a456f71bd2b5c84
- SSDEEP 3072:74mQlVoqiDm/uIdW+Fa4yDr65UwvgGZ2TwzxNwuN7LXB+nce5v7EUZI2+nee5v7T:74NVoqiDQLWjZ+G5G0IPlSAT09
- TLSH T1E364F709A3FE01A9F1F6A67C99B20506D573BC164735C2DF02AC065E2F63FD49836B62
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
9248
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
EaseOfAccessDialog.pdb
advapi32
EventRegister
EventUnregister
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
EventSetInformation
TraceMessage
EventWriteTransfer
RegCloseKey
RegOpenKeyExW
RegEnumKeyExW
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
RegGetValueW
OpenProcessToken
GetTokenInformation
ConvertSidToStringSidW
RegLoadMUIStringW
RegDeleteTreeW
RegNotifyChangeKeyValue
RegEnumValueW
kernel32
LoadLibraryExW
CompareStringOrdinal
CreateEventW
OpenMutexW
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
SetLastError
EnterCriticalSection
ReleaseSemaphore
GetModuleHandleExW
LeaveCriticalSection
InitializeCriticalSectionEx
WaitForThreadpoolTimerCallbacks
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
HeapSize
HeapReAlloc
HeapDestroy
InitializeCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
LocalFree
ExpandEnvironmentStringsW
OpenProcess
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
CreateProcessW
DeleteProcThreadAttributeList
GetFileAttributesW
DeleteFileW
K32EnumProcesses
ProcessIdToSessionId
K32EnumProcessModules
LoadResource
FindResourceExW
LockResource
InitOnceComplete
MultiByteToWideChar
CreateMutexW
InitOnceBeginInitialize
SizeofResource
RaiseException
HeapSetInformation
IsDebuggerPresent
DebugBreak
WideCharToMultiByte
GetModuleHandleW
GetProcessHeap
GetCurrentProcessId
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
GetProcAddress
HeapAlloc
CreateThreadpoolTimer
ReleaseSRWLockShared
SetThreadpoolTimer
CloseHandle
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
CloseThreadpoolTimer
OutputDebugStringW
ReleaseSRWLockExclusive
GetLastError
FormatMessageW
FreeLibrary
OpenJobObjectW
IsProcessInJob
SetEvent
OOBEComplete
GetThreadPreferredUILanguages
GetLocaleInfoEx
MulDiv
VirtualProtect
LoadLibraryExA
GetSystemInfo
VirtualQuery
InterlockedPushEntrySList
K32GetModuleBaseNameW
user32
MessageBoxW
SetWindowTextW
LoadStringW
SystemParametersInfoW
SetWindowPos
SetFocus
GetFocus
GetWindowRect
GetWindowLongW
AdjustWindowRectExForDpi
ShowWindow
DispatchMessageW
TranslateMessage
GetMessageW
PostQuitMessage
DestroyWindow
KillTimer
SetTimer
PostMessageW
DefWindowProcW
GetWindowLongPtrW
SetWindowLongPtrW
MoveWindow
IsWindow
CreateWindowExW
RegisterClassExW
MonitorFromWindow
GetMonitorInfoW
GetDpiForWindow
SetForegroundWindow
SetDesktopColorTransform
SendNotifyMessageW
GetThreadDesktop
GetUserObjectInformationW
GetWindowThreadProcessId
GetShellWindow
GetKeyState
SendInput
UnregisterClassA
LoadIconW
api-ms-win-crt-string-l1-1-0
memmove_s
wcscspn
memset
wcscmp
wcsspn
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
_c_exit
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__get_wide_winmain_command_line
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__ltow_s
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__wcsicmp
_o__wcslwr_s
_o__wcsnicmp
_o__wtoi
_o_abort
_o_exit
_o_free
_o_iswspace
_o_malloc
_o_memcpy_s
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
__CxxFrameHandler3
_CxxThrowException
wcsstr
wcschr
wcsrchr
_o__exit
_o__errno
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
memmove
ntdll
NtQueryWnfStateData
RtlLookupFunctionEntry
RtlCaptureContext
WinSqmIncrementDWORD
WinSqmAddToStream
WinSqmIsOptedIn
RtlVirtualUnwind
oleacc
AccessibleObjectFromWindow
ole32
CoTaskMemFree
CoTaskMemAlloc
CoInitialize
CoUninitialize
PropVariantClear
CoCreateInstance
CoCreateFreeThreadedMarshaler
oleaut32
SysFreeString
SysStringLen
GetErrorInfo
SetErrorInfo
shell32
ShellExecuteW
dui70
InitThread
?Create@NativeHWNDHost@DirectUI@@SAJPEBG0PEAUHWND__@@PEAUHICON__@@HHHHHHPEAUHINSTANCE__@@IPEAPEAV12@@Z
?EndDefer@Element@DirectUI@@QEAAXK@Z
?GetHWND@NativeHWNDHost@DirectUI@@QEAAPEAUHWND__@@XZ
?ShowWindow@NativeHWNDHost@DirectUI@@QEAAXH@Z
StartMessagePump
?Destroy@NativeHWNDHost@DirectUI@@QEAAXXZ
UnInitThread
UnInitProcessPriv
?_OnUIStateChanged@HWNDElement@DirectUI@@MEAAXGG@Z
?Initialize@HWNDElement@DirectUI@@QEAAJPEAUHWND__@@_NIPEAVElement@2@PEAK@Z
??1HWNDElement@DirectUI@@UEAA@XZ
??0HWNDElement@DirectUI@@QEAA@XZ
?GetAccessibleImpl@HWNDElement@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
?Register@HWNDElement@DirectUI@@SAJXZ
?GetWindowClassNameAndStyle@HWNDElement@DirectUI@@UEAAXPEAPEBGPEAI@Z
?WndProc@HWNDElement@DirectUI@@UEAA_JPEAUHWND__@@I_K_J@Z
?CreateStyleParser@HWNDElement@DirectUI@@UEAAJPEAPEAVDUIXmlParser@2@@Z
?RemoveTooltip@HWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z
?ActivateTooltip@HWNDElement@DirectUI@@UEAAXPEAVElement@2@K@Z
?UpdateTooltip@HWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z
?OnCompositionChanged@HWNDElement@DirectUI@@UEAAXXZ
?OnWmSettingChanged@HWNDElement@DirectUI@@UEAAX_K_J@Z
?OnWmThemeChanged@HWNDElement@DirectUI@@UEAAX_K_J@Z
?OnGetDlgCode@HWNDElement@DirectUI@@UEAAXPEAUtagMSG@@PEA_J@Z
?OnNoChildWithShortcutFound@HWNDElement@DirectUI@@UEAAXPEAUKeyboardEvent@2@@Z
?OnInput@HWNDElement@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?OnImmersiveColorSchemeChanged@HWNDElement@DirectUI@@UEAAXXZ
?OnThemeChanged@HWNDElement@DirectUI@@UEAAXPEAUThemeChangedEvent@2@@Z
?OnEvent@HWNDElement@DirectUI@@UEAAXPEAUEvent@2@@Z
?OnDestroy@HWNDElement@DirectUI@@UEAAXXZ
?OnGroupChanged@HWNDElement@DirectUI@@UEAAXH_N@Z
?OnPropertyChanged@HWNDElement@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?Host@NativeHWNDHost@DirectUI@@QEAAXPEAVElement@2@@Z
?GetUiaFocusDelegate@Element@DirectUI@@UEAAPEAV12@XZ
?HandleUiaEventListener@Element@DirectUI@@UEAAXPEAUEvent@2@@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@@Z
?HandleUiaPropertyListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?HandleUiaDestroyListener@Element@DirectUI@@UEAAXXZ
?GetElementProviderImpl@Element@DirectUI@@UEAAJPEAVInvokeHelper@2@PEAPEAVElementProvider@2@@Z
?GetUIAElementProvider@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?DefaultAction@Element@DirectUI@@UEAAJXZ
?DoubleBuffered@Element@DirectUI@@QEAAX_N@Z
?OnUnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
?OnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MEAAXHH@Z
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UEAAXPEAUtagRECT@@@Z
?MessageCallback@Element@DirectUI@@UEAAIPEAUtagGMSG@@@Z
?RemoveBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
?AddBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
?SetKeyFocus@Element@DirectUI@@UEAAXXZ
?EnsureVisible@Element@DirectUI@@UEAA_NHHHH@Z
?GetAdjacent@Element@DirectUI@@UEAAPEAV12@PEAV12@HPEBUNavReference@2@K@Z
?Remove@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?Insert@Element@DirectUI@@UEAAJPEAPEAV12@II@Z
?Add@Element@DirectUI@@QEAAJPEAV12@@Z
?Add@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?GetContentSize@Element@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?Paint@Element@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z
?OnMouseFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?OnKeyFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?OnPropertyChanged@Element@DirectUI@@UEAAXPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?GetContentStringAsDisplayed@Element@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z
?Destroy@Element@DirectUI@@QEAAJ_N@Z
?Destroy@Layout@DirectUI@@QEAAXXZ
?Create@FillLayout@DirectUI@@SAJPEAPEAVLayout@2@@Z
?LoadFromResource@DUIFactory@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG1PEAVElement@2@PEAKPEAPEAV42@1@Z
??1DUIFactory@DirectUI@@QEAA@XZ
??0DUIFactory@DirectUI@@QEAA@PEAUHWND__@@@Z
?DestroyWindow@NativeHWNDHost@DirectUI@@QEAAXXZ
?GetClassInfoW@HWNDElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ
?GetHWND@HWNDElement@DirectUI@@UEAAPEAUHWND__@@XZ
?IsMSAAEnabled@HWNDElement@DirectUI@@UEAA_NXZ
?CanSetFocus@HWNDElement@DirectUI@@UEAA_NXZ
?SetLayout@Element@DirectUI@@QEAAJPEAVLayout@2@@Z
?GetClassInfoPtr@CCPushButton@DirectUI@@SAPEAUIClassInfo@2@XZ
?SetAccessible@Element@DirectUI@@QEAAJ_N@Z
?SetVisible@Element@DirectUI@@QEAAJ_N@Z
?GetKeyFocused@Element@DirectUI@@UEAA_NXZ
?QueryInterface@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?GetID@Element@DirectUI@@QEAAGXZ
?SetLayoutPos@Element@DirectUI@@QEAAJH@Z
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z
StrToID
InitProcessPriv
?Click@Button@DirectUI@@SA?AVUID@@XZ
?GetKeyFocusedElement@HWNDElement@DirectUI@@SAPEAVElement@2@XZ
?IsRTLReading@Element@DirectUI@@UEAA_NXZ
?IsContentProtected@Element@DirectUI@@UEAA_NXZ
shcore
IsProcessInIsolatedContainer
dwmapi
DwmSetWindowAttribute
mscms
ord260
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
Name
.text
Size
160KB
Virtual Size
159KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
116KB
Virtual Size
115KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
908B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=11, id=260, version=33145,
count=5, id=259, version=33145,
count=33, id=261, version=33145,
count=27, id=257, version=33145,
count=1372, id=1, productName=Unmarked objects,
count=1, id=253, version=33145,
count=26, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
dispdiag.exe
- IMPHASH 50e2b8fc1408538abaaab4e8b0808a57
- SHA256 0129ab3ad337352d1d58a6145d2a110499ff88c8a482348653f2066dcfb0f74a
- MD5 9e9819b2eed2b77f38322206a709becd
- SHA1 76dc057a310c2abdf2e99d684b69b7e4406dee83
- SHA512 a53b90a9c909905e424b10f1d900e70617464cbc94da5a5459d7216fc5f86befd5ec8eb7d21866c695143b105db47a7708fb40edd4a4ebf32b19cc2d7a5586ce
- SSDEEP 3072:64PcmUpndwS/atTI9aZP44T8DykqIXQi21btoUMHFzDGx:hPKp3489aZP44T88IEnoUIFzDG
- TLSH T1F814092967EA10E8F5B796389D714252E672B821673096DF02D0C27D1F23FE4B939F12
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5488
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
dispdiag.pdb
msvcp_win
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?good@ios_base@std@@QEBA_NXZ
?uncaught_exception@std@@YA_NXZ
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
_register_thread_local_exe_atexit_callback
_c_exit
api-ms-win-crt-private-l1-1-0
_o__errno
_o__exit
_o__get_initial_wide_environment
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
memmove
_o__wcsnicmp
_o__wtoi
_o_exit
_o_free
_o_isspace
_o_iswprint
_o_isxdigit
_o_malloc
_o_strtoul
_o_terminate
_o_tolower
_o_wcscpy_s
__current_exception
__current_exception_context
__CxxFrameHandler3
_CxxThrowException
_o__crt_atexit
_o___stdio_common_vswscanf
_o__configure_wide_argv
_o__configthreadlocale
_o___stdio_common_vswprintf
_o__cexit
_o___p__commode
_o___p___wargv
_o__callnewh
_o___p___argc
_o___stdio_common_vfwprintf
_o___acrt_iob_func
_o___stdio_common_vfprintf
__C_specific_handler
__std_terminate
__CxxFrameHandler4
memcmp
_o___std_exception_destroy
_o___std_exception_copy
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
GetModuleFileNameA
GetProcAddress
GetModuleHandleExW
FreeLibrary
GetModuleHandleW
api-ms-win-core-synch-l1-1-0
SetEvent
LeaveCriticalSection
CreateEventW
InitializeCriticalSectionEx
WaitForSingleObject
EnterCriticalSection
CreateSemaphoreExW
ResetEvent
ReleaseSemaphore
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
ReleaseMutex
ReleaseSRWLockShared
ReleaseSRWLockExclusive
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
CreateThread
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-file-l1-1-0
WriteFile
DeleteFileW
CreateDirectoryW
FindClose
CreateFileW
FindFirstFileW
api-ms-win-devices-query-l1-1-0
DevGetObjectProperties
DevFreeObjectProperties
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegGetValueW
RegCreateKeyExW
RegSetValueExW
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemInfo
GetLocalTime
GetVersionExW
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-service-management-l1-1-0
OpenSCManagerW
OpenServiceW
api-ms-win-service-winsvc-l1-1-0
QueryServiceStatus
api-ms-win-shcore-scaling-l1-1-1
SetProcessDpiAwareness
GetDpiForMonitor
api-ms-win-core-com-l1-1-0
CoUninitialize
CoInitializeEx
CoCreateGuid
CoCreateInstance
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
GetCurrentDirectoryW
GetStdHandle
oleaut32
SysAllocStringByteLen
SysAllocString
SysFreeString
VariantClear
SysStringByteLen
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-util-l1-1-0
Beep
api-ms-win-eventing-controller-l1-1-0
ControlTraceW
StartTraceW
EnableTraceEx2
api-ms-win-eventing-consumer-l1-1-0
OpenTraceW
ProcessTrace
api-ms-win-core-console-l1-1-0
ReadConsoleInputW
WriteConsoleW
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
devobj
DevObjGetDeviceInterfaceDetail
DevObjGetClassDevs
DevObjDestroyDeviceInfoList
DevObjOpenDeviceInterface
DevObjGetDeviceInstanceId
DevObjEnumDeviceInterfaces
DevObjGetDeviceRegistryProperty
DevObjEnumDeviceInfo
DevObjGetDeviceProperty
DevObjOpenDevRegKey
DevObjCreateDeviceInfoList
api-ms-win-ntuser-sysparams-l1-1-0
GetDisplayConfigBufferSizes
QueryDisplayConfig
EnumDisplaySettingsExW
EnumDisplayDevicesW
EnumDisplayMonitors
SystemParametersInfoW
DisplayConfigGetDeviceInfo
GetMonitorInfoW
GetSystemMetrics
api-ms-win-gdi-dpiinfo-l1-1-0
GetCurrentDpiInfo
wmiclnt
WmiExecuteMethodW
WmiQuerySingleInstanceW
WmiOpenBlock
WmiDevInstToInstanceNameW
WmiCloseBlock
dispdiag2
RunDispDiag2
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
ntdll
RtlAdjustPrivilege
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
Name
.text
Size
108KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
48KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
420B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=84, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=14, id=260, version=33145,
count=5, id=259, version=33145,
count=1236, id=1, productName=Unmarked objects,
count=7, id=257, version=33145,
count=35, id=261, version=33145,
count=7, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
djoin.exe
- IMPHASH 5d555d1766498faf7eeccba464238966
- SHA256 0f2ee312586ccb31ecfd06e0285e38e8c50dad06b8de8bc078a8dc00791b09da
- MD5 8f5501f4239ea4ffeb16b83c847313a9
- SHA1 b4c45dcc18599056d7b932abf29ab4a443ad4c43
- SHA512 26aecfa89367c8e3639f8a773657230fa0cc7c09e6836bce0a7b9f444ce3a2a0047e0f29014489c59ebbbd42a2e9a86e31f6b813ab4b07d6095a57302b494ef4
- SSDEEP 1536:qqhr9a/+KihJtF+Tc6HGm/RL3eXrD5QJ:qqTcChJtF+XHGQ7qf
- TLSH T190A3FA0623F92048F1B36F795A7602254A37BC616B35C2EF1298D16D5FA3AD09E34F63
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4944
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
djoin.pdb
msvcrt
__iob_func
memset
wcsrchr
__CxxFrameHandler4
_wcsnicmp
wcsncmp
memcpy
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_fmode
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
malloc
free
printf
wcschr
wcscpy_s
_vsnprintf
_wtoi
_commode
_wcsicmp
setlocale
_vsnwprintf
fwprintf
swprintf_s
wprintf
netprovfw
NetCreateProvisioningPackage
NetRequestProvisioningPackageInstall
NetpRequestProvisioningPackageInstallForIMC
NetpAnalyzeProvisioningPackage
NetpProvDomainJoinLicensingCheck
api-ms-win-core-localization-l1-2-0
SetThreadPreferredUILanguages
FormatMessageW
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
FreeLibrary
GetModuleFileNameW
LoadStringW
LoadLibraryExW
GetModuleHandleW
api-ms-win-core-file-l1-1-0
GetFullPathNameW
ReadFile
DeleteFileW
CreateFileW
WriteFile
GetFileAttributesW
CreateDirectoryW
GetFileSize
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegUnLoadKeyW
RegLoadKeyW
RegDeleteValueW
RegSetValueExW
RegSaveKeyExW
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW
api-ms-win-core-console-l1-1-0
GetConsoleOutputCP
api-ms-win-core-processenvironment-l1-1-0
GetStdHandle
ExpandEnvironmentStringsW
api-ms-win-service-management-l1-1-0
OpenServiceW
OpenSCManagerW
CloseServiceHandle
StartServiceW
api-ms-win-eventing-controller-l1-1-0
ControlTraceW
StartTraceW
rpcrt4
RpcStringFreeW
UuidCreate
UuidToStringW
netutils
NetApiBufferFree
NetApiBufferAllocate
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
logoncli
DsGetDcNameW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
GetVersionExW
GetWindowsDirectoryW
GetTickCount64
wkscli
NetUseDel
NetJoinDomain
NetUseAdd
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-heap-l1-1-0
HeapFree
HeapSetInformation
GetProcessHeap
HeapAlloc
api-ms-win-service-winsvc-l1-1-0
QueryServiceStatus
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-eventing-legacy-l1-1-0
EnableTrace
ntdll
NtOpenProcessToken
RtlFreeHeap
RtlGetNtProductType
DbgPrint
NtDuplicateToken
RtlAllocateHeap
NtClose
NtAdjustPrivilegesToken
RtlNtStatusToDosError
NtSetInformationThread
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateEventW
OpenEventW
SetEvent
WaitForSingleObject
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableFlags
GetTraceLoggerHandle
GetTraceEnableLevel
UnregisterTraceGuids
TraceEvent
RegisterTraceGuidsW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
Name
.text
Size
32KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
960B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
20KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
292B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=72, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=4, id=259, version=33145,
count=20, id=260, version=33145,
count=200, id=1, productName=Unmarked objects,
count=7, id=257, version=33145,
count=6, id=261, version=33145,
count=21, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
dllhost.exe
- IMPHASH 796b776ac798e3e406820b5ae752c421
- SHA256 abee3c2607c26494f903f9b59a7063ae106d7d33701d69db3864e42e9b019c7c
- MD5 726e6d37067671cba7ed44da4661161c
- SHA1 c7ea04b0418741d2748df8607860f9a30b0f7db3
- SHA512 fbb49a47d96447b27d0abf688a95e0c9699472d9763f4347971a6ef80f31471b77c58bd3f96da91fbb63ab40e1ddbfbd3c7966166335343a9ed38f7a09cbe5c3
- SSDEEP 1536:pMAIDbZexe/hceMgWELCNigtsc50gl71vy6d18kzIgYzX:pD0bZhNkxNrmc6gl7Zy6gk8b
- TLSH T188938D9E627820C6F567D03CC561C616E8B1B6A6231161FF03E0D1BC5F63BD8A63CB99
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
f4:18:cd:70:c8:d6:b9:ad:80:92:4c:f8:4c:3b:19:2d:6e:1c:69:21:0f:23:ee:6f:a4:79:e3:39:c3:af:00:63
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 18, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Windows Production PCA 2023,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
f4:18:cd:70:c8:d6:b9:ad:80:92:4c:f8:4c:3b:19:2d:6e:1c:69:21:0f:23:ee:6f:a4:79:e3:39:c3:af:00:63
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 18, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2026 RSA2048-SHA256,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:16:a1:29:a0:c1:87:02:f4:4f:00:00:00:00:00:16
Issuer
CN=Microsoft Windows Production PCA 2026 RSA2048-SHA256,O=Microsoft Corporation,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 6, 2026 - Aug 5, 2027
Subject
CN=Microsoft Windows Production PCA 2026 RSA2048-SHA256,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:1e:e9:35:2b:ec:86:01:54:15:00:00:00:00:00:1e
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 4, 2026 - Aug 4, 2031
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8900-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:22:41:d2:f6:aa:ff:c8:b5:ff:00:01:00:00:02:22
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:43:b8:18:0a:66:21:27:1e:b0:00:00:00:00:01:43
Issuer
CN=Windows Production PCA 2023,O=Microsoft Corporation,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 18, 2026 - Jun 17, 2027
Subject
CN=Windows Production PCA 2023,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:17:85:bd:56:09:4b:f8:c8:21:00:00:00:00:00:17
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 13, 2023 - Jun 13, 2035
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9600-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:26:35:b4:3e:67:43:93:f6:1f:00:01:00:00:02:26
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Minor OS version
0
Major OS version
10
Entry point
5424
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
dllhost.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_c_exit
_register_thread_local_exe_atexit_callback
_initterm
api-ms-win-crt-private-l1-1-0
_o__cexit
_o__configthreadlocale
_o__configure_wide_argv
_o__crt_atexit
_o__errno
_o__exit
_o__get_wide_winmain_command_line
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
memmove
_o__wcsicmp
_o_exit
_o_free
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
_o___stdio_common_vswprintf
_o___p__commode
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
ntdll
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-com-private-l1-1-0
CoRegisterSurrogateEx
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
ReleaseSemaphore
DeleteCriticalSection
CreateSemaphoreExW
ReleaseSRWLockShared
WaitForSingleObjectEx
ReleaseMutex
AcquireSRWLockExclusive
CreateMutexExW
LeaveCriticalSection
OpenSemaphoreW
WaitForSingleObject
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
AcquireSRWLockShared
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapSetInformation
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError
api-ms-win-core-processthreads-l1-1-0
GetStartupInfoW
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-com-l1-1-0
CoInitializeEx
IIDFromString
CoUninitialize
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
api-ms-win-core-processthreads-l1-1-1
SetProcessMitigationPolicy
IsProcessorFeaturePresent
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
Name
.text
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
204B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=39, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1126, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=22, id=261, version=33145,
count=3, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
dllhst3g.exe
- IMPHASH 796b776ac798e3e406820b5ae752c421
- SHA256 2e39f126213e217f4c39c19033676324a35741738af8f11f6c855559c7b23392
- MD5 3d87459e77708185d6bde0143ad1ade5
- SHA1 176c5b95a8a99341c62f94a2f741b7d1fb088b0e
- SHA512 ca9f4e6338ff3b84c557e13502d82473e030393f8dde9123201ffca21b386e40258ee3e54a99b4e187ffafcd7ebcaeca1ecc31f8c06d0eb98fe8dbc66f271f13
- SSDEEP 1536:AMAIDbZeJe/hceMgWELCl9g/o9X04PS/:AD0bZZNkxleQeIS/
- TLSH T18073295E727820EAF466813DC5624219D1F1B435632266FF03E0C1BDAF63BE86539F92
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5424
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
dllhst3g.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_c_exit
_register_thread_local_exe_atexit_callback
_initterm
api-ms-win-crt-private-l1-1-0
_o__cexit
_o__configthreadlocale
_o__configure_wide_argv
_o__crt_atexit
_o__errno
_o__exit
_o__get_wide_winmain_command_line
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
memmove
_o__wcsicmp
_o_exit
_o_free
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
_o___stdio_common_vswprintf
_o___p__commode
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
ntdll
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-com-private-l1-1-0
CoRegisterSurrogateEx
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
ReleaseSemaphore
DeleteCriticalSection
CreateSemaphoreExW
ReleaseSRWLockShared
WaitForSingleObjectEx
ReleaseMutex
AcquireSRWLockExclusive
CreateMutexExW
LeaveCriticalSection
OpenSemaphoreW
WaitForSingleObject
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
AcquireSRWLockShared
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapSetInformation
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError
api-ms-win-core-processthreads-l1-1-0
GetStartupInfoW
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-com-l1-1-0
CoInitializeEx
IIDFromString
CoUninitialize
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
api-ms-win-core-processthreads-l1-1-1
SetProcessMitigationPolicy
IsProcessorFeaturePresent
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
Name
.text
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
204B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=39, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1126, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=22, id=261, version=33145,
count=3, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
dmcertinst.exe
- IMPHASH 56c29dd9855e467f2412fda869738ae6
- SHA256 48061474071b8de5d86091dfdfbfd16c3b8040f2bc7560bcbe0e0676f986c4e3
- MD5 db3592cfb3364a34710af99d06891e9c
- SHA1 94da44680a8c71b811f1e190c8ccc0c93c9f7965
- SHA512 3882feb35b23155611d05d602a514fd89b54abfb9582ef30cde8605936d80f18e2784b4aaff2c4712d5556689ede370f7211059071a52867f60a630402f5abcf
- SSDEEP 6144:PnrTU0W38vs+0hQU4mcTt0ayIQcQsimSOBwZN:frTU0W38vs+0hQU4mcTt0avrQJv
- TLSH T11714072E23EA10F5E5768278C9821606F6727862131195EF43D6817E0E7BFE8BC39F51
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
12336
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
dmcertinst.pdb
msvcp_win
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?_Xlength_error@std@@YAXPEBD@Z
??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z
??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Incref@facet@locale@std@@UEAAXXZ
??Bid@locale@std@@QEAA_KXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?in@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
api-ms-win-crt-runtime-l1-1-0
_initterm
_c_exit
_initterm_e
_register_thread_local_exe_atexit_callback
api-ms-win-crt-private-l1-1-0
_o__get_wide_winmain_command_line
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__wcsicmp
memmove
_o__wcsnicmp
_o_exit
_o_free
_o_malloc
_o_terminate
_o_wcscpy_s
_o_wcstok_s
_o_wcstoul
__C_specific_handler
__current_exception
__current_exception_context
_CxxThrowException
_o__exit
_o__errno
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
_o__cexit
_o__callnewh
__CxxFrameHandler3
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
wcsstr
wcsrchr
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
wcscmp
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
GetProcAddress
GetModuleFileNameW
LoadStringW
GetModuleHandleExW
GetModuleFileNameA
FreeLibrary
GetModuleHandleW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcessId
OpenProcessToken
GetCurrentProcess
GetStartupInfoW
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
RaiseException
SetLastError
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockExclusive
ReleaseSRWLockShared
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionEx
EnterCriticalSection
WaitForSingleObject
AcquireSRWLockExclusive
ReleaseSemaphore
OpenSemaphoreW
ReleaseMutex
ResetEvent
InitializeCriticalSectionAndSpinCount
WaitForMultipleObjectsEx
CreateEventW
WaitForSingleObjectEx
CreateEventExW
SetEvent
CreateMutexExW
OpenEventW
AcquireSRWLockShared
CreateSemaphoreExW
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegDeleteTreeW
RegDeleteKeyExW
api-ms-win-core-namedpipe-l1-1-0
WaitNamedPipeW
api-ms-win-core-file-l1-1-0
CreateFileW
ReadFile
api-ms-win-core-com-l1-1-0
CoInitializeEx
CoUninitialize
CoGetApartmentType
CoWaitForMultipleHandles
CoCreateInstance
CreateStreamOnHGlobal
GetHGlobalFromStream
CoCreateFreeThreadedMarshaler
api-ms-win-core-processenvironment-l1-1-0
GetCommandLineW
api-ms-win-core-heap-l2-1-0
GlobalFree
LocalFree
LocalAlloc
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
GetSystemTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-heap-obsolete-l1-1-0
GlobalLock
ntdll
RtlIsStateSeparationEnabled
omadmapi
ord64
ord35
certenroll
ord45
umpdc
Pdcv2ActivationClientDeactivate
Pdcv2ActivationClientRegister
Pdcv2ActivationClientActivate
Pdcv2ActivationClientUnregister
Pdcv2ActivationClientRenewActivation
declaredconfiguration
DMOrchestratorUpdateDocStatus
oleaut32
SysFreeString
SysAllocString
SysStringLen
VariantClear
VariantInit
api-ms-win-core-winrt-l1-1-0
RoUninitialize
RoInitialize
RoActivateInstance
RoGetActivationFactory
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventRegister
EventUnregister
EventWriteTransfer
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
ncrypt
NCryptOpenStorageProvider
NCryptDeleteKey
NCryptOpenKey
NCryptFreeObject
NCryptGetProperty
crypt32
CryptEncodeObjectEx
CertGetCertificateContextProperty
CertFindCertificateInStore
CryptSetKeyIdentifierProperty
CertFreeCertificateContext
CryptUnprotectData
CertOpenStore
CertDeleteCertificateFromStore
CertCloseStore
CryptBinaryToStringW
rpcrt4
UuidCreate
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
dmcmnutils
UnicodeToMB
BinaryToHexString
CopyString
OmaDmRegistryGetDWORD
HexStringToBinary
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
Name
.text
Size
120KB
Virtual Size
116KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
48KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
160B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
620B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=84, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=11, id=260, version=33145,
count=5, id=259, version=33145,
count=1317, id=1, productName=Unmarked objects,
count=21, id=257, version=33145,
count=36, id=261, version=33145,
count=32, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
dmcfghost.exe
- IMPHASH 2f19490b74dd6ee37c2761f9da1f56e7
- SHA256 992fb4bc28025a397dfb14ea2087090410dc626ff73de9dd915b20fd3f6b90c9
- MD5 3084374cb37d892832fe14416016c3d0
- SHA1 eaa5767cbe9778fe37d7d525c67558ecca32b9ca
- SHA512 1e66fbbab0ecaee8d7e51801afa14f2ce923774b5afe3cc5bfc3b752cd120ad320160303c47b55b6dc6adb3b967487dbfc91a855efe101eb896eee48ddbdc656
- SSDEEP 768:JplJfwO231CWJJWGl0aK51M3KKyE/B2n/:JplJERJWG+z1M3/yE/En/
- TLSH T12E533A4A67A900E9F5BB4B7888760215A276F5305B22D6DF62E0C27D0D73BE09D34F92
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4512
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
dmcfghost.pdb
msvcrt
_acmdln
__C_specific_handler
??1type_info@@UEAA@XZ
memmove
memcpy
_initterm
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_purecall
_callnewh
malloc
_vsnwprintf
memset
__setusermatherr
_fmode
_commode
__CxxFrameHandler3
?terminate@@YAXXZ
_lock
_unlock
__CxxFrameHandler4
_ismbblead
_cexit
_onexit
__dllonexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
??3@YAXPEAX@Z
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventRegister
EventUnregister
api-ms-win-core-synch-l1-1-0
OpenEventW
WaitForSingleObject
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
GetModuleHandleW
FreeLibrary
GetProcAddress
LoadStringW
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-processthreads-l1-1-0
GetExitCodeProcess
GetStartupInfoW
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
CreateProcessW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
dmpushproxy
ord9
ord1
ord11
ord3
ord10
dmcmnutils
CopyString
DmInformUser
BigStrcat
DmGetCurrentUserSid
InvStrCmpIW
OmaDmRegistrySetString
QueryPolicy
dsclient
DSFreeString
DSRemoveSharingToken
DSCreateSharedFileToken
oleaut32
SysAllocString
SysStringLen
SysFreeString
SysAllocStringLen
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoUninitialize
CoInitializeEx
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-file-l1-1-0
DeleteFileW
WriteFile
GetTempFileNameW
CreateFileW
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
omadmapi
ord109
dmxmlhelputils
XMLHSkipXMLProlog
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
Name
.text
Size
16KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
568B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=44, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=22, id=260, version=33145,
count=109, id=1, productName=Unmarked objects,
count=13, id=257, version=33145,
count=10, id=261, version=33145,
count=9, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
dmclient.exe
- IMPHASH 19e169535433ba989a4ade32c3f6ed8f
- SHA256 258fd0b17d63a0bec87c5480b6e7ec5b881cc118945418d822b7996258cee0de
- MD5 f824293f7e903d2ac945ed63329e89af
- SHA1 f25cd5e43eb81316679f7d873a653e0e4660276c
- SHA512 5f25dd7f34822b60e464b1e398ecc2d94d7c081beea509b9789d7ca68837cc5f05b35611b385564411f53ec434a243d024bf29fad09290e5d8adb56a4f61b805
- SSDEEP 3072:49XaEnORzTvdOAPZsb3PeGff+ZuQwsBAD1D+7p0d:4EEnORzTvrOPeGHD/h1D+p
- TLSH T1FBF3F63E22E924E4E57AE27894560A16FEB13032231256EF0690D07D5F2FAE47D3EF51
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
9728
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
dmclient.pdb
msvcrt
__C_specific_handler
_fmode
_commode
?terminate@@YAXXZ
_lock
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
_initterm
_CxxThrowException
__CxxFrameHandler3
__setusermatherr
_callnewh
_unlock
malloc
__dllonexit
_onexit
??0exception@@QEAA@AEBV0@@Z
_amsg_exit
_cexit
??0exception@@QEAA@XZ
_exit
__CxxFrameHandler4
??1type_info@@UEAA@XZ
__set_app_type
??1exception@@UEAA@XZ
memcmp
__wgetmainargs
memcpy
memmove
_purecall
_XcptFilter
??0exception@@QEAA@AEBQEBD@Z
??3@YAXPEAX@Z
wcsnlen
_wtoi64
memmove_s
vswprintf_s
_vscwprintf
_wcsicmp
memcpy_s
_vsnwprintf
??_V@YAXPEAX@Z
exit
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExA
GetModuleFileNameA
GetProcAddress
GetModuleHandleW
GetModuleHandleExW
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegGetValueW
RegCreateKeyExW
RegCloseKey
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
AcquireSRWLockShared
DeleteCriticalSection
ReleaseMutex
WaitForSingleObjectEx
SetEvent
ReleaseSemaphore
CreateEventExW
CreateSemaphoreExW
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
ReleaseSRWLockShared
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
CreateMutexExW
OpenSemaphoreW
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
RaiseException
UnhandledExceptionFilter
SetLastError
api-ms-win-core-com-l1-1-0
CoCreateFreeThreadedMarshaler
CoCreateInstance
CoTaskMemFree
CLSIDFromString
CoWaitForMultipleHandles
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventWriteTransfer
EventRegister
EventUnregister
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsDeleteString
api-ms-win-core-winrt-l1-1-0
RoInitialize
RoActivateInstance
RoUninitialize
RoGetActivationFactory
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
OpenThreadToken
TerminateProcess
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
GetUserPreferredUILanguages
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemTime
GetTickCount
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-string-l2-1-0
CharLowerBuffW
api-ms-win-core-file-l1-1-0
ReadFile
FindFirstFileW
FindClose
DeleteFileW
WriteFile
FindNextFileW
CreateDirectoryW
GetFileSize
api-ms-win-core-file-l1-2-0
CreateFile2
api-ms-win-security-base-l1-1-0
RevertToSelf
GetTokenInformation
ImpersonateLoggedOnUser
api-ms-win-security-lsalookup-l2-1-0
LookupAccountSidW
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
api-ms-win-core-heap-l2-1-0
LocalFree
crypt32
CryptStringToBinaryW
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CloseThreadpoolTimer
CreateThreadpoolTimer
ntdll
NtQueryWnfStateData
RtlGetDeviceFamilyInfoEnum
api-ms-win-core-registry-l2-1-0
RegDeleteKeyW
api-ms-win-shcore-stream-l1-1-0
SHCreateStreamOnFileW
xmllite
CreateXmlReader
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
GetPersistedFileLocationW
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
Name
.text
Size
100KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
200B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=74, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=26, id=260, version=33145,
count=194, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=13, id=261, version=33145,
count=13, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
dnscacheugc.exe
- IMPHASH 2afa1e55a104ddb3b0868afcd58eadb4
- SHA256 95133819c8decb2e56345fdd04b89ef7cbb441a0aa43f75aa47607d55d754339
- MD5 efa9d9b5e36140c0e60e28847017189d
- SHA1 a8e2bf058790a75702bf2082d77f8e613b1bcf30
- SHA512 c72ac582398916f7c7612ff02669227a04e0d435f4361e2788b2f202d6ae1bca27da7aa5ffbc3d92e557584f0e7f02fb035f692f41baee0f1bbb577de5e4181d
- SSDEEP 768:gABsiP4Vw4scrB4bFZ14YjsIc+fFa84j:gABBP4jyDnc+ff4j
- TLSH T11D53D70957E81098F6B35FB98A754209D672B8316F71C3EF21A4C97E1E22AD4DE34F21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4912
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
dnscacheugc.pdb
msvcrt
_fmode
_initterm
__setusermatherr
_commode
?terminate@@YAXXZ
_lock
_cexit
_unlock
__dllonexit
wcstoul
_exit
exit
_onexit
__C_specific_handler
_XcptFilter
_amsg_exit
_vsnprintf
wcsrchr
__getmainargs
_vsnwprintf
wcschr
__set_app_type
wcsncmp
_wcsnicmp
memcpy
memset
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegEnumKeyExW
RegCreateKeyExW
RegSetValueExW
RegEnumValueW
RegCloseKey
RegQueryInfoKeyW
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
iphlpapi
ConvertInterfaceNameToLuidW
ConvertInterfaceAliasToLuid
ConvertStringToInterfacePhysicalAddress
ConvertInterfaceLuidToGuid
ParseNetworkString
ConvertInterfacePhysicalAddressToLuid
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
ntdll
RtlAllocateHeap
RtlFreeHeap
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
api-ms-win-core-file-l1-1-0
GetFileAttributesW
CreateDirectoryW
GetFullPathNameW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
Name
.text
Size
20KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
816B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
184B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=56, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=261, version=33145,
count=1, productName=Unmarked objects (old),
count=4, id=259, version=33145,
count=20, id=260, version=33145,
count=146, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=16, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
doskey.exe
- IMPHASH 333a855a49d58ed59384daca47e93669
- SHA256 7e593969455a03083089f4e917a899e785dd7c527068861a877073cc67b2a0e8
- MD5 a256df68ac945d489efd910920620810
- SHA1 a9e098e142c266abf207469f0fba291386df1d97
- SHA512 a900b70acad6c7759a259331b4def3a4e326402750a9e157735960f36a60c12c5d63cd5d5014104bb88d2b8c8bee0247df835ee0679c9245c795448485c526eb
- SSDEEP 384:gW0NhSOrvHj4giCriuBWx8iM3uLX0F+fWoiWAE:ghwOrvHj4giCrrzi3X0F+z
- TLSH T11F13A72C537631E6E1A6823DC452058248BE7671732A7AFF28D1C139CE1B6EED93CD91
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4864
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
doskey.pdb
ulib
?PrepareToParse@ARGUMENT_LEXEMIZER@@QEAAEPEAVWSTRING@@@Z
??1DSTRING@@UEAA@XZ
?SetCaseSensitive@ARGUMENT_LEXEMIZER@@QEAAXE@Z
??1OBJECT@@UEAA@XZ
?IsValueSet@ARGUMENT@@QEAAEXZ
?QueryFile@SYSTEM@@SAPEAVFSN_FILE@@PEBVPATH@@EPEAE@Z
??0PATH_ARGUMENT@@QEAA@XZ
?Initialize@WSTRING@@QEAAEPEBDK@Z
?ReadLine@STREAM@@QEAAEPEAVWSTRING@@E@Z
??0STREAM_MESSAGE@@QEAA@XZ
??1STREAM_MESSAGE@@UEAA@XZ
?Initialize@STREAM_MESSAGE@@QEAAEPEAVSTREAM@@00@Z
?Set@STREAM_MESSAGE@@UEAAEKW4MESSAGE_TYPE@@K@Z
??0FLAG_ARGUMENT@@QEAA@XZ
?Initialize@WSTRING@@QEAAEPEBGK@Z
?Strchr@WSTRING@@QEBAKGK@Z
?Stricmp@WSTRING@@QEBAJPEBV1@@Z
?Initialize@PATH_ARGUMENT@@QEAAEPEADE@Z
?Initialize@WSTRING@@QEAAEPEBV1@KK@Z
?DeleteChAt@WSTRING@@QEAAXKK@Z
?QueryWSTR@WSTRING@@QEBAPEAGKKPEAGKE@Z
?Strcat@WSTRING@@QEAAEPEBV1@@Z
Get_Standard_Output_Stream
?Display@MESSAGE@@QEAAEPEBDZZ
?DisplayMsg@MESSAGE@@QEAAEKW4MESSAGE_TYPE@@KPEBDZZ
?MakeFileToken@MESSAGE@@SA_KPEBD@Z
??0STRING_ARGUMENT@@QEAA@XZ
??1STRING_ARGUMENT@@UEAA@XZ
?Initialize@STRING_ARGUMENT@@QEAAEPEAD@Z
??0ARGUMENT_LEXEMIZER@@QEAA@XZ
??1ARGUMENT_LEXEMIZER@@UEAA@XZ
?Initialize@ARGUMENT_LEXEMIZER@@QEAAEPEAVARRAY@@@Z
?DoParsing@ARGUMENT_LEXEMIZER@@QEAAEPEAVARRAY@@@Z
?PutSeparators@ARGUMENT_LEXEMIZER@@QEAAXPEBD@Z
??1PATH_ARGUMENT@@UEAA@XZ
?QueryInvalidArgument@ARGUMENT_LEXEMIZER@@QEAAPEAVWSTRING@@XZ
?Initialize@FLAG_ARGUMENT@@QEAAEPEAD@Z
??0REST_OF_LINE_ARGUMENT@@QEAA@XZ
?Initialize@REST_OF_LINE_ARGUMENT@@QEAAEXZ
??0ARRAY@@QEAA@XZ
??1ARRAY@@UEAA@XZ
?Initialize@ARRAY@@QEAAEKK@Z
?Put@ARRAY@@UEAAEPEAVOBJECT@@@Z
?QueryStream@FSN_FILE@@QEAAPEAVFILE_STREAM@@W4STREAMACCESS@@K@Z
??0LONG_ARGUMENT@@QEAA@XZ
?Initialize@LONG_ARGUMENT@@QEAAEPEAD@Z
Get_Standard_Input_Stream
??0DSTRING@@QEAA@XZ
kernel32
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
Sleep
GetConsoleCommandHistoryLengthW
AddConsoleAliasW
HeapSetInformation
GetConsoleAliasesLengthW
GetConsoleMode
ExpungeConsoleCommandHistoryW
GetConsoleCommandHistoryW
GetConsoleAliasExesW
SetConsoleMode
SetConsoleNumberOfCommandsW
GetStdHandle
GetConsoleAliasesW
GetConsoleAliasExesLengthW
ntdll
RtlFreeHeap
RtlAllocateHeap
msvcrt
?terminate@@YAXXZ
_commode
_fmode
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
Name
.text
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
264B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
132B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=261, version=33136,
count=1, productName=Unmarked objects (old),
count=4, id=259, version=33136,
count=19, id=260, version=33136,
count=9, id=257, version=33136,
count=96, id=1, productName=Unmarked objects,
count=2, id=264, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
dpapimig.exe
- IMPHASH 2802ab937a66981e5b2c99164c983cc5
- SHA256 251a68841ba51e8919640c3b61438644de266c14698966464028f13115a497f6
- MD5 ead89de6bd51d5650b37a722340f1644
- SHA1 cc0dcc7e49ef137a98b3101a7540a85d914253ba
- SHA512 69b5580ee0bddac7c7d62528c0ae7789200d3869cec37e18278112c75dfb56d008d7845e047164b4a5868bf759428bb2451cce4ef6b9b9b371d36cae5cc3b714
- SSDEEP 1536:deG7/OMqgUsZLAZ00l3uU1HIED1fCbWpygzU:ddLYjGLAuSJj16bE
- TLSH T13FA3AE0D5269A089E23B4635E4629B699230BC20133519FF75DCB27F2F35FE17A38E15
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4496
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
dpapimig.pdb
advapi32
GetTokenInformation
GetSidIdentifierAuthority
RegEnumValueW
OpenThreadToken
GetLengthSid
ConvertSidToStringSidW
RegOpenKeyExW
OpenProcessToken
IsValidSid
RegDeleteTreeW
RegEnumKeyExW
ConvertStringSidToSidW
CopySid
GetSidSubAuthority
GetSidSubAuthorityCount
RegCloseKey
kernel32
GetCurrentThread
LocalAlloc
CompareStringOrdinal
GetCurrentProcess
GetCommandLineW
CloseHandle
LocalFree
GetLastError
user32
LoadIconW
MessageBoxW
PostMessageW
LoadStringW
msvcrt
memset
_initterm
__setusermatherr
_ismbblead
_cexit
_exit
exit
__set_app_type
_acmdln
_amsg_exit
_XcptFilter
free
_callnewh
malloc
wcsncmp
__C_specific_handler
_fmode
_commode
__getmainargs
?terminate@@YAXXZ
crypt32
CryptUpdateProtectedState
api-ms-win-core-com-l1-1-0
CoUninitialize
samcli
NetUserModalsGet
netutils
NetApiBufferFree
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-processthreads-l1-1-0
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
comctl32
PropertySheetW
ord345
ole32
CoInitialize
shell32
CommandLineToArgvW
dui70
?SetMaxLength@Edit@DirectUI@@QEAAJH@Z
?LoadPage@TaskPage@DirectUI@@MEAAJPEAVHWNDElement@2@PEAUHINSTANCE__@@PEAPEAVElement@2@PEAPEAVDUIXmlParser@2@@Z
?InitPropSheetPage@TaskPage@DirectUI@@MEAAXPEAU_PROPSHEETPAGEW@@@Z
?OnQueryCancel@TaskPage@DirectUI@@MEAA_JXZ
?OnReset@TaskPage@DirectUI@@MEAA_JXZ
?SetEnabled@Element@DirectUI@@QEAAJ_N@Z
?OnWizFinish@TaskPage@DirectUI@@MEAA_JXZ
?OnWizNext@TaskPage@DirectUI@@MEAA_JXZ
?OnQueryInitialFocus@TaskPage@DirectUI@@MEAAPEAVElement@2@XZ
?OnMessage@TaskPage@DirectUI@@MEAA_NI_K_JPEA_J@Z
?OnListenerAttach@TaskPage@DirectUI@@MEAAXPEAVElement@2@@Z
?OnListenerDetach@TaskPage@DirectUI@@MEAAXPEAVElement@2@@Z
?OnListenedPropertyChanging@TaskPage@DirectUI@@MEAA_NPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z
?OnListenedPropertyChanged@TaskPage@DirectUI@@MEAAXPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z
?OnListenedInput@TaskPage@DirectUI@@MEAAXPEAVElement@2@PEAUInputEvent@2@@Z
UnInitThread
UnInitProcessPriv
??0TaskPage@DirectUI@@QEAA@XZ
??1TaskPage@DirectUI@@UEAA@XZ
?DUICreatePropertySheetPage@TaskPage@DirectUI@@QEAAJPEAUHINSTANCE__@@@Z
?PropSheet_SendMessage@TaskPage@DirectUI@@IEAA_JI_K_J@Z
?LoadParser@TaskPage@DirectUI@@MEAAJPEAPEAVDUIXmlParser@2@@Z
?CreateDUICP@TaskPage@DirectUI@@EEAAJPEAVHWNDElement@2@PEAUHWND__@@1PEAPEAVElement@2@PEAPEAVDUIXmlParser@2@@Z
?CreateParserCP@TaskPage@DirectUI@@EEAAJPEAPEAVDUIXmlParser@2@@Z
?DestroyCP@TaskPage@DirectUI@@EEAAXXZ
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z
?GetEncodedContentString@Element@DirectUI@@QEAAJPEAG_K@Z
StrToID
InitThread
?Click@Button@DirectUI@@SA?AVUID@@XZ
InitProcessPriv
?SetContentString@Element@DirectUI@@QEAAJPEBG@Z
?SetLayoutPos@Element@DirectUI@@QEAAJH@Z
?SetVisible@Element@DirectUI@@QEAAJ_N@Z
?OnWizBack@TaskPage@DirectUI@@MEAA_JXZ
Name
.text
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
444B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
184B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=4, id=259, version=33136,
count=20, id=260, version=33136,
count=3, id=261, version=33136,
count=17, id=257, version=33136,
count=113, id=1, productName=Unmarked objects,
count=2, id=264, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
dpnsvr.exe
- IMPHASH 0666ed1f1c919f3b819158a8dd8a47af
- SHA256 7bacf93d7efd1870cc8def5876998ab4d58e58091be80185fcd1497e85ff7b63
- MD5 30ef03cf89144a84e09d6346eea737fd
- SHA1 2212c94ba307c202500caaf2d4bc4472d7123524
- SHA512 328889190b8aa7b4d7cf3729ab5717fb18e092471f9913d5927cba9fa0fe9775627c28942c10f1e7fa7833b57161161455e5130c7cd133cad14bc15cbbbe96b1
- SSDEEP 192:orNRVYK6xzTDPU1j8bemOwpKp0khLnkCWxuW:oBRZMDYjAemO7p0kJWxuW
- TLSH T186F2188A7F9E38AAF875C23D85A32A1A9079F514476647EF0391025D4C3AFD06D34FE2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5056
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
stub.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___std_type_info_destroy_list
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
__C_specific_handler
api-ms-win-crt-string-l1-1-0
memset
kernel32
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
DllMain
Name
.text
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
456B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
132B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33140,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1083, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=9, id=260, version=33140,
count=4, id=259, version=33140,
count=11, id=261, version=33140,
count=1, id=256, version=33140,
count=2, id=264, version=33140,
count=1, id=253, version=33140,
count=1, id=255, version=33140,
count=1, id=258, version=33140,
driverquery.exe
- IMPHASH f4cbc5954ae383c6d57bb0ef9d12ad90
- SHA256 84b5a5ebdc2cf3f4e76ecb4c76de2fe082efa48ca0e7897aab4780c033008f9d
- MD5 aa78714456ddb357ed632f6ca3d4b990
- SHA1 96dc36747b9c3be6a8c50f41ad9c9e1d20d6d2d8
- SHA512 92d5162a9eee01c7939a3c82cbd5baf29c4d9fe27de96b26249d893a80697a5e6682fabaf88445c1af20c6e18a2462165ab299153c4246024d50d217af322112
- SSDEEP 1536:94Uwo+N68RxTs5dhRODc/7S1IjmnVpGzpSuRSJHjYuPPdE5IvxeW:94UoShrSTnXGzCj9Euvx5
- TLSH T10CA3E61EA39930F5D462D138C9864266D372B0312361A3FF67E0CA7A9F17BD1AD39E10
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4944
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
drvqry.pdb
kernel32
GetNumberFormatW
CreateFileW
CreateFileMappingW
CloseHandle
MapViewOfFile
UnmapViewOfFile
GetDateFormatW
GetTimeFormatW
GetModuleHandleW
GetProcAddress
GetCurrentProcess
GetLocaleInfoW
GetUserDefaultLocaleName
LocaleNameToLCID
GetUserDefaultLCID
FormatMessageW
LocalAlloc
WriteConsoleW
GetStdHandle
GetLastError
GetModuleFileNameW
SetLastError
GetComputerNameExW
HeapSize
HeapReAlloc
HeapAlloc
HeapValidate
HeapFree
GetProcessHeap
ReadConsoleW
ReadFile
SetConsoleMode
MultiByteToWideChar
ExitProcess
CompareStringA
GetThreadLocale
CompareStringW
lstrlenW
lstrlenA
GetConsoleMode
GetFileType
WideCharToMultiByte
FindStringOrdinal
SetThreadUILanguage
CreateMutexW
GetConsoleOutputCP
FileTimeToSystemTime
msvcrt
memcpy
_fmode
_CxxThrowException
?terminate@@YAXXZ
wcstok
??1type_info@@UEAA@XZ
_commode
memset
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
free
_callnewh
malloc
wcschr
_vsnwprintf
_wcsicmp
_wtoi
localtime
_stricmp
_strnicmp
_wcsnset
_ltow
swprintf_s
_wsetlocale
__CxxFrameHandler4
__iob_func
_memicmp
_errno
wcstod
wcstol
wcstoul
_fileno
_get_osfhandle
fprintf
fflush
oleaut32
SysAllocString
SysAllocStringByteLen
SysStringLen
SysFreeString
VariantInit
VariantCopy
VariantClear
VariantChangeType
api-ms-win-core-com-l1-1-0
CoInitializeSecurity
CoTaskMemAlloc
CoInitializeEx
CoTaskMemFree
CoUninitialize
CoCreateInstance
sspicli
GetUserNameExW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
ntdll
VerSetConditionMask
RtlVerifyVersionInfo
user32
wsprintfW
CharUpperW
LoadStringW
mpr
WNetAddConnection2W
WNetCancelConnection2W
WNetGetLastErrorW
framedynos
??4CHString@@QEAAAEBV0@PEBG@Z
?ReleaseBuffer@CHString@@QEAAXH@Z
??0CHString@@QEAA@XZ
??4CHString@@QEAAAEBV0@AEBV0@@Z
??0CHString@@QEAA@PEBG@Z
?Mid@CHString@@QEBA?AV1@H@Z
?Find@CHString@@QEBAHG@Z
?GetBufferSetLength@CHString@@QEAAPEAGH@Z
?Format@CHString@@QEAAXPEBGZZ
?FindOneOf@CHString@@QEBAHPEBG@Z
?Left@CHString@@QEBA?AV1@H@Z
??1CHString@@QEAA@XZ
?Compare@CHString@@QEBAHPEBG@Z
?GetData@CHString@@IEBAPEAUCHStringData@@XZ
?GetBuffer@CHString@@QEAAPEAGH@Z
shlwapi
StrCmpNW
ws2_32
GetNameInfoW
GetAddrInfoW
WSACleanup
WSAStartup
WSAGetLastError
FreeAddrInfoW
version
GetFileVersionInfoSizeExW
GetFileVersionInfoExW
VerQueryValueW
srvcli
NetServerGetInfo
netutils
NetApiBufferFree
Name
.text
Size
64KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=24, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33140,
count=25, id=260, version=33140,
count=7, id=261, version=33140,
count=21, id=257, version=33140,
count=165, id=1, productName=Unmarked objects,
count=12, id=264, version=33140,
count=1, id=255, version=33140,
count=1, id=258, version=33140,
drvinst.exe
- IMPHASH e2594da532c017bb035845f28c67c577
- SHA256 4bb26477cd3d17318a787f5d13d7dfb7dd190c10ca254b908f672afe14bac339
- MD5 2e3a612e9848e68eef1e308693df7593
- SHA1 a4eb86eb74be676c5e91f41ad4b9ca7505361c7d
- SHA512 8d7b045d826bfd42573d46c125b973725f88638c6b7a3aa1f400d8316054bb17ba0bea59b2d87e5900226d414188fac55768527b9ccddd4f669d90dcd652ad6a
- SSDEEP 12288:KoC/6joL1Gr9MREYM22Jp3CGXIC1uyvB:q6UL1GJV3CGI/yvB
- TLSH T176A44B1D63A910F9E977C138C9474122EAB1B879235213DF96A4C57C9F0BAE47A3EF01
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
6016
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
drvinst.pdb
msvcrt
memcmp
memcpy
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
_commode
_fmode
_initterm
strncmp
_wcslwr
qsort
toupper
_vsnprintf
__setusermatherr
wcsrchr
_cexit
wcschr
_wcsnicmp
_exit
_resetstkoflw
exit
_vsnwprintf
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
swscanf
_wcsicmp
__C_specific_handler
wcsstr
memmove_s
_purecall
??3@YAXPEAX@Z
memmove
memcpy_s
wcsncmp
memset
ntdll
EtwEventWriteTransfer
EtwEventSetInformation
RtlIsStateSeparationEnabled
NtFlushBuffersFileEx
RtlPublishWnfStateData
NtDeleteValueKey
NtSetValueKey
NtQueryValueKey
NtQueryKey
NtCreateKey
NtOpenKey
RtlInitUnicodeString
RtlFreeUnicodeString
RtlFormatCurrentUserKeyPath
RtlRandomEx
RtlPrefixUnicodeString
RtlUpcaseUnicodeString
RtlInitUnicodeStringEx
NtClose
NtSetInformationFile
NtQueryInformationFile
RtlGetVersion
RtlNtStatusToDosErrorNoTeb
RtlUpcaseUnicodeChar
RtlMultiByteToUnicodeN
RtlMultiByteToUnicodeSize
RtlUnicodeToMultiByteN
RtlUnicodeToMultiByteSize
ZwQueryValueKey
ZwOpenKey
ZwQuerySystemInformation
ZwClose
RtlFreeHeap
RtlReAllocateHeap
RtlAllocateHeap
NtSystemDebugControl
ZwEnumerateValueKey
RtlAppendUnicodeStringToString
VerSetConditionMask
RtlVerifyVersionInfo
RtlDosPathNameToNtPathName_U_WithStatus
ZwCreateFile
RtlRunOnceExecuteOnce
RtlCopyUnicodeString
ZwOpenFile
RtlGetFullPathName_UEx
ZwEnumerateKey
ZwQueryInformationFile
ZwCreateSection
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwQueryDirectoryFile
RtlpEnsureBufferSize
RtlNtPathNameToDosPathName
RtlGetNativeSystemInformation
RtlInitString
RtlxAnsiStringToUnicodeSize
RtlAnsiStringToUnicodeString
LdrResSearchResource
RtlAppendUnicodeToString
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
NtQuerySystemInformation
EtwEventRegister
EtwEventUnregister
RtlNtStatusToDosError
NtQueryInformationProcess
DbgPrintEx
RtlGUIDFromString
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
LoadResource
GetProcAddress
LockResource
GetModuleHandleW
GetModuleHandleExW
GetModuleHandleExA
GetModuleFileNameA
FreeLibrary
LoadLibraryExA
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
CreateMutexW
CreateEventW
OpenEventW
CreateSemaphoreExW
EnterCriticalSection
ReleaseSemaphore
LeaveCriticalSection
InitializeCriticalSectionEx
WaitForSingleObject
ReleaseMutex
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseSRWLockShared
SleepEx
CreateMutexExW
AcquireSRWLockShared
WaitForMultipleObjectsEx
SetEvent
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
HeapSetInformation
api-ms-win-core-errorhandling-l1-1-0
SetErrorMode
SetUnhandledExceptionFilter
GetLastError
RaiseException
SetLastError
UnhandledExceptionFilter
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CloseThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
ExitProcess
TerminateProcess
OpenProcessToken
GetCurrentThreadId
CreateThread
GetCurrentProcess
GetExitCodeThread
api-ms-win-core-localization-l1-2-0
FormatMessageW
LCMapStringW
GetThreadLocale
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-console-l1-1-0
SetConsoleCtrlHandler
api-ms-win-devices-config-l1-1-1
CM_Set_DevNode_Registry_PropertyW
CM_Get_Class_PropertyW
CM_Open_DevNode_Key
CM_Get_DevNode_PropertyW
CM_MapCrToWin32Err
CM_Get_Child
CM_Get_Device_IDW
CM_Get_Sibling
CM_Locate_DevNodeW
CM_Setup_DevNode
CM_Get_DevNode_Status
CM_Set_DevNode_PropertyW
CM_Get_DevNode_Registry_PropertyW
api-ms-win-core-processenvironment-l1-1-0
GetCommandLineA
GetCommandLineW
ExpandEnvironmentStringsW
api-ms-win-core-memory-l1-1-0
UnmapViewOfFile
MapViewOfFile
VirtualQuery
CreateFileMappingW
VirtualProtect
api-ms-win-core-processthreads-l1-1-1
OpenProcess
IsProcessorFeaturePresent
api-ms-win-core-realtime-l1-1-0
QueryUnbiasedInterruptTime
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-wow64-l1-1-0
IsWow64Process
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetTickCount
GetLocalTime
GetSystemWindowsDirectoryW
GetWindowsDirectoryW
GetSystemTime
GetTickCount64
GetSystemInfo
api-ms-win-security-base-l1-1-0
CheckTokenMembership
SetSecurityDescriptorDacl
FreeSid
AddAccessAllowedAceEx
GetTokenInformation
IsValidSid
InitializeSecurityDescriptor
InitializeAcl
GetLengthSid
DuplicateTokenEx
AllocateAndInitializeSid
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringOrdinal
CompareStringW
api-ms-win-core-file-l1-1-0
FindFirstFileW
GetFullPathNameW
SetEndOfFile
SetFilePointer
SetFileAttributesW
GetTempFileNameW
DeleteFileW
GetFileInformationByHandle
GetFinalPathNameByHandleW
FlushFileBuffers
GetFileAttributesW
GetFileSize
FindClose
CreateFileW
CreateDirectoryW
FindNextFileW
WriteFile
FileTimeToLocalFileTime
GetFileAttributesExW
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-registry-l1-1-0
RegEnumValueW
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegCloseKey
RegDeleteTreeW
RegEnumKeyExW
RegCreateKeyExW
RegFlushKey
api-ms-win-core-file-l2-1-0
MoveFileExW
CreateHardLinkW
CopyFileExW
api-ms-win-core-sysinfo-l1-2-0
GetNativeSystemInfo
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
FindResourceW
api-ms-win-security-provider-l1-1-0
SetEntriesInAclW
SetSecurityInfo
api-ms-win-core-file-l2-1-2
CopyFileW
api-ms-win-core-windowserrorreporting-l1-1-0
WerRegisterFile
api-ms-win-core-file-l1-2-3
GetTempPath2W
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-apiquery-l2-1-0
IsApiSetImplemented
Name
.text
Size
296KB
Virtual Size
293KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
108KB
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
832B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=76, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=261, version=33145,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=23, id=260, version=33145,
count=433, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=73, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
dsregcmd.exe
- IMPHASH 37b5c60ebfe97f276d5851800b4b0dd7
- SHA256 78cfafc3329fe00c75151d8a5b8f4f8876971501c8b79f97d0e4e03d0f609d57
- MD5 4e448acbde9685770ac541e8d8b4ab8f
- SHA1 4486d949784ef7fd861e7f770600cbbbf762d77e
- SHA512 02cd2b9b85b7410f2f27d801ac977031b28a3a1b37b294915de49779ece4965df553fc852d165e666dbabf5c6b5435c7e5c0db869f04522e00c56fe40b25f8f2
- SSDEEP 6144:3FnThDgqvT536Jx1dUlxPYe/Kdf+lKOVqtoUzH0d4m5AL3iV:tThDgqvT0HU/6YgO1UzHcPw3
- TLSH T196A43A1973E805E4F2B2A13D89538A0EE5F2B85507239ACF5250D37A1E3BEE99D35F10
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7024
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
dsregcmd.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_c_exit
_register_thread_local_exe_atexit_callback
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__gmtime64_s
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__mbsinc
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__strlwr_s
_o__ultoa_s
_o__wcsicmp
_o__wcslwr_s
memmove
_o__wtoi
_o__wtol
_o_calloc
_o_ceilf
_o_exit
_o_free
_o_iswspace
_o_malloc
_o_memcpy_s
_o_realloc
_o_terminate
_o_wcscat_s
_o_wcscpy_s
_o_wcsftime
_o_wcsncpy_s
__C_specific_handler
__current_exception
__current_exception_context
_o__exit
_o__get_initial_wide_environment
_o__errno
_o__difftime64
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
_o__cexit
_o__callnewh
_o__beginthreadex
__std_type_info_compare
wcschr
wcsstr
__CxxFrameHandler3
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
_o___p___wargv
_o___p___argc
__std_terminate
__CxxFrameHandler4
_CxxThrowException
__C_specific_handler_noexcept
__RTDynamicCast
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
wcsspn
strncmp
wcsnlen
wcscspn
wcspbrk
wcsncmp
memset
wcscmp
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExA
GetModuleHandleW
GetModuleHandleExW
SizeofResource
LockResource
GetModuleFileNameA
GetProcAddress
GetModuleFileNameW
FindResourceExW
LoadResource
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionAndSpinCount
SetEvent
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CreateEventW
ReleaseMutex
ResetEvent
WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection
ReleaseSemaphore
EnterCriticalSection
CreateSemaphoreExW
InitializeCriticalSection
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapSize
HeapDestroy
HeapAlloc
HeapReAlloc
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetUnhandledExceptionFilter
SetLastError
GetLastError
UnhandledExceptionFilter
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
TerminateProcess
OpenThreadToken
GetExitCodeThread
OpenProcessToken
TerminateThread
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetVersionExW
GetSystemTimeAsFileTime
GetTickCount64
api-ms-win-core-interlocked-l1-1-0
InterlockedPushEntrySList
InitializeSListHead
InterlockedPopEntrySList
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
FlushInstructionCache
IsProcessorFeaturePresent
dsreg
DsrCLI
api-ms-win-core-com-l1-1-0
CoInitializeEx
CoCreateInstance
CoUninitialize
CreateStreamOnHGlobal
CoTaskMemAlloc
StringFromGUID2
CLSIDFromProgID
CLSIDFromString
CoGetClassObject
CoCreateGuid
secur32
FreeCredentialsHandle
AcquireCredentialsHandleW
InitializeSecurityContextW
GetUserNameExW
DeleteSecurityContext
QuerySecurityPackageInfoW
FreeContextBuffer
SetCredentialsAttributesW
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegCreateKeyExW
RegGetValueW
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventWriteTransfer
EventUnregister
api-ms-win-core-heap-l2-1-0
GlobalAlloc
LocalFree
LocalAlloc
msvcp_win
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?widen@?$ctype@G@std@@QEBAGD@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
??Bid@locale@std@@QEAA_KXZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@K@Z
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?_Random_device@std@@YAIXZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??7ios_base@std@@QEBA_NXZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@_J@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?good@ios_base@std@@QEBA_NXZ
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?_Xlength_error@std@@YAXPEBD@Z
?id@?$ctype@G@std@@2V0locale@2@A
?uncaught_exception@std@@YA_NXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
oleaut32
OleCreateFontIndirect
VarBstrCmp
SysAllocString
LoadTypeLi
LoadRegTypeLi
SysFreeString
SysStringLen
GetErrorInfo
SysStringByteLen
VariantClear
VariantInit
SysAllocStringLen
VariantCopy
VariantChangeType
DispCallFunc
winhttp
WinHttpConnect
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpSetCredentials
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpSetStatusCallback
WinHttpSendRequest
WinHttpCloseHandle
WinHttpSetOption
WinHttpReceiveResponse
WinHttpCrackUrl
WinHttpOpen
wininet
InternetOpenW
InternetSetOptionW
InternetCloseHandle
crypt32
CryptFindOIDInfo
CryptAcquireCertificatePrivateKey
CertCloseStore
CertFreeCertificateContext
CertFindCertificateInStore
CertOpenStore
bcrypt
BCryptHashData
BCryptCreateHash
BCryptFinishHash
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptDestroyHash
BCryptCloseAlgorithmProvider
ncrypt
NCryptSignHash
NCryptFreeObject
NCryptDeleteKey
gdi32
CreateCompatibleBitmap
SelectObject
DeleteObject
CreateCompatibleDC
DeleteDC
GetStockObject
GetObjectW
GetDeviceCaps
BitBlt
CreateSolidBrush
userenv
UnloadUserProfile
api-ms-win-rtcore-ntuser-window-l1-1-0
SendMessageW
GetWindow
SetFocus
GetFocus
IsChild
SetWindowTextW
GetWindowTextW
RegisterWindowMessageW
GetClassInfoExW
SetWindowLongPtrW
GetWindowLongPtrW
GetClassNameW
GetClientRect
MoveWindow
ScreenToClient
DefWindowProcW
CreateWindowExW
CallWindowProcW
SetWindowPos
GetParent
ClientToScreen
IsWindow
RegisterClassExW
SetWindowLongW
SetTimer
GetMessageW
TranslateMessage
DispatchMessageW
PostThreadMessageW
DestroyWindow
GetWindowLongW
PostQuitMessage
GetDesktopWindow
PostMessageW
api-ms-win-rtcore-ntuser-draw-l1-1-0
RedrawWindow
api-ms-win-core-heap-obsolete-l1-1-0
GlobalLock
GlobalUnlock
api-ms-win-core-largeinteger-l1-1-0
MulDiv
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpW
api-ms-win-eventlog-legacy-l1-1-0
DeregisterEventSource
ReportEventW
RegisterEventSourceW
api-ms-win-security-cryptoapi-l1-1-0
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptSignHashW
CryptCreateHash
wkscli
NetGetJoinInformation
netutils
NetApiBufferFree
api-ms-win-core-kernel32-legacy-l1-1-0
GetComputerNameW
api-ms-win-security-base-l1-1-0
EqualDomainSid
CopySid
GetTokenInformation
IsValidSid
GetLengthSid
api-ms-win-security-lsalookup-l2-1-0
LookupAccountNameW
api-ms-win-core-memory-l1-1-0
VirtualAlloc
VirtualFree
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-crt-time-l1-1-0
_time64
user32
ReleaseDC
DestroyAcceleratorTable
UnregisterClassA
UnhookWindowsHookEx
LoadCursorW
InvalidateRect
InvalidateRgn
FillRect
ReleaseCapture
SetCapture
CreateAcceleratorTableW
GetSysColor
GetDlgItem
EndPaint
BeginPaint
GetKeyState
SetWindowsHookExW
CallNextHookEx
GetDC
LoadIconW
GetWindowTextLengthW
ole32
OleLockRunning
OleInitialize
OleRun
OleUninitialize
Name
.text
Size
304KB
Virtual Size
303KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
124KB
Virtual Size
123KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=95, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33145,
count=6, id=259, version=33145,
count=1468, id=1, productName=Unmarked objects,
count=22, id=257, version=33145,
count=96, id=264, version=33145,
count=1, id=253, version=33145,
count=37, id=261, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
dstokenclean.exe
- IMPHASH f1d06b8c52f369e9c51a17b21e2bd700
- SHA256 caae9bab010d01176fdddaee82ff9272bcc04adceee3eb16c3ff62bea7ab29f3
- MD5 3a26ab8676ff8f9388535ad9277c09f5
- SHA1 28aa3d75d57ca4f330f43c800f69ff70015fd7ff
- SHA512 ca4e6d887e41bc5971e30bfd50e7d78e9fa9a96c16897fa65a5b4e7865fe90662d4c8badc5851a6dcfd27f2f3c1c801511ec3f5c570879bcf1360536afb24da7
- SSDEEP 192:PFcGksY+1Mo4Lo5H4lcwh9ioVtU7Wd/flVtALW3EW6:fTY+1f4uH4Kafq7WHVmW3EW
- TLSH T1B303D749A7AA0CD6F5B5AB7D85B246096135B9340B73C7DF0E60415A0E33EC09F39BA2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4896
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
dstokenclean.pdb
msvcrt
_XcptFilter
_exit
exit
__set_app_type
_initterm
__wgetmainargs
_fmode
_commode
_cexit
__C_specific_handler
_vsnwprintf
?terminate@@YAXXZ
_lock
_unlock
_amsg_exit
_onexit
__setusermatherr
__dllonexit
memset
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
Sleep
InitOnceComplete
api-ms-win-core-synch-l1-1-0
CreateMutexW
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
dsclient
DSRemoveExpiredTokens
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventRegister
EventWriteTransfer
Name
.text
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
396B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=24, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=261, version=33145,
count=1, productName=Unmarked objects (old),
count=4, id=259, version=33145,
count=20, id=260, version=33145,
count=45, id=1, productName=Unmarked objects,
count=5, id=257, version=33145,
count=4, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
dtdump.exe
- IMPHASH 7214abaed3437d8a99de74ea1fcdcbfb
- SHA256 1b52612eb8471aa496cd8c59b1aed3b3c863093e0cc88b06f8cd22531fdef58e
- MD5 8801416712f563055cf49fb794315480
- SHA1 e1d7fdf72611198816c225cf1b3299d7215089e9
- SHA512 c58b2bddc814e8c85b200de1940c3a4b56644682d4e8956dbc4c03dede850c817f30ee1cfa1471510bf819090695a34ea819253754f9fc3d6aea383dce82268f
- SSDEEP 3072:JvNBGnVtNhKrSwkyCStIrtADkyvf3sM26zkaZ5TRMwHZPvWR2DUKIBae/1e0Pz+m:BGRgIceNxPz+rYcDoVgkHi
- TLSH T1FEF34A3B77A434E9E97AA07AD551420AC7B17475032313EF1680817E0E57EE8EE3EA35
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
20496
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
dtdump.pdb
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
api-ms-win-crt-string-l1-1-0
strcspn
memset
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
_c_exit
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o___stdio_common_vswprintf
_o__callnewh
_o__cexit
_o__configthreadlocale
_o__configure_wide_argv
_o__crt_atexit
_o__errno
_o__exit
_o__get_initial_wide_environment
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
memmove
_o__wcsicmp
_o__wcsnicmp
_o__wcstoi64
_o__wcstoui64
_o_abort
_o_exit
_o_free
_o_iswspace
_o_malloc
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
_CxxThrowException
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
_o___p__commode
_o___p___wargv
_o___p___argc
memcmp
memcpy
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleHandleExW
FreeLibrary
LoadLibraryExW
GetProcAddress
GetModuleFileNameA
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
CreateSemaphoreExW
ReleaseSRWLockExclusive
ReleaseMutex
WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection
ReleaseSemaphore
EnterCriticalSection
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventSetInformation
EventUnregister
EventWriteTransfer
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
Name
.text
Size
72KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
64B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=42, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=30, id=261, version=33145,
count=1149, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=4, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
dusmtask.exe
- IMPHASH cc19e8a9e61823a0e5ae3ef168d94c36
- SHA256 a966a0c5c014615c5bbd52648a0e0ce6774b6e70139a3522c9aa89d208ba4a1c
- MD5 31690fe32719cc38b52e0271d81b6017
- SHA1 903c3717386c6767d13f6c84972700fedf8940b2
- SHA512 d1fcfff0248294b981ac9f9d17f9bb5232fd1639d28b9d62079247c91490002141b0edca71259cf8a38900f6d542c735b85ad06c8f3055bd2f9ea52e1ea696ce
- SSDEEP 1536:VZgXDSWMZBXlohXvUazAPCml/BVKzwbsVjnLh:zeEBa9Ua0lJVmV7Lh
- TLSH T188733A5EA6B824E9F5B5813DC5530529D2B2F420672197EF03A0C17E2F63BE4693CF92
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5184
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
dusmtask.pdb
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm
_register_thread_local_exe_atexit_callback
_c_exit
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configthreadlocale
_o__configure_wide_argv
_o__crt_atexit
_o__errno
_o__exit
_o__get_initial_wide_environment
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
memmove
_o_exit
_o_free
_o_malloc
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
_CxxThrowException
_o___stdio_common_vswprintf
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
_o___p___wargv
_o___p___argc
__std_terminate
__CxxFrameHandler4
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
LoadLibraryExA
GetProcAddress
GetModuleHandleW
GetModuleFileNameA
LoadStringW
GetModuleHandleExW
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseMutex
WaitForSingleObjectEx
ReleaseSemaphore
OpenSemaphoreW
CreateMutexExW
CreateSemaphoreExW
WaitForSingleObject
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
RaiseException
SetLastError
SetUnhandledExceptionFilter
api-ms-win-core-com-l1-1-0
CoInitializeEx
CoUninitialize
CoCreateInstance
ntdll
RtlQueryWnfStateData
RtlGetDeviceFamilyInfoEnum
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-memory-l1-1-0
VirtualQuery
VirtualProtect
Name
.text
Size
32KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
216B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=44, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=11, id=260, version=33145,
count=5, id=259, version=33145,
count=26, id=261, version=33145,
count=1129, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=3, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
dvdplay.exe
- IMPHASH 3cb4a4cdeb02e4c28fd0c394b4cd7597
- SHA256 ca692f9c3d22fac77a84d1155ae4b757664cc50386310c59a6d827ee5b58cca1
- MD5 34ff13972c60308b5ca77d0e38530a39
- SHA1 1c0059e6d0a328ab997f170705d2aff39ec3adb5
- SHA512 5ce625098c42eaab7f85f3ae26a6bec3352aee5b71b6d59c7a1831f5ff52a2d770fd3e1b20f14f5bb9967566a9674b0df79888e73470c6b370a6c70ebf601b62
- SSDEEP 192:ZxunqBO1u2UwoKebzXmgljoBJ+79H9rRoVjWmQPjhFikWdZW:ZTuu2LczXPZ6egD8lWdZW
- TLSH T1D503E781FA5408D9F879863E8A5392A9E079BF116B2247CF3BE4124E0D35FD59931BC1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4864
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
dvdplay.pdb
advapi32
RegGetValueW
kernel32
SearchPathW
CreateProcessW
GetCurrentProcess
GetModuleHandleW
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
api-ms-win-crt-runtime-l1-1-0
_initterm
_register_thread_local_exe_atexit_callback
_c_exit
_initterm_e
api-ms-win-crt-private-l1-1-0
_o___p__commode
_o__cexit
_o__configthreadlocale
_o__configure_narrow_argv
_o__crt_atexit
_o__exit
_o__get_narrow_winmain_command_line
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o_exit
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
api-ms-win-crt-string-l1-1-0
memset
Name
.text
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
444B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
140B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33138,
count=5, id=259, version=33138,
count=19, id=261, version=33138,
count=5, id=257, version=33138,
count=1088, id=1, productName=Unmarked objects,
count=2, id=264, version=33138,
count=1, id=253, version=33138,
count=1, id=255, version=33138,
count=1, id=258, version=33138,
dwm.exe
- IMPHASH 8d30a1b63388f964dc361483107f1b75
- SHA256 7fb9981c58663f7687e5404369cd5434ce7e043c1b805cc8512961d2fc5f1cf8
- MD5 a9c244b06a6521b27573d3eae853d0ed
- SHA1 fb319a20e1e192ccac3df481c5b1021c2babb78b
- SHA512 263c8c945bf88da33cc40acafb29f0a511dd266968b8a5d8f8e9514e122e904b432014fee2786051eb76a887eb94880327984bb3663d81748e960607a96ba821
- SSDEEP 3072:Jr0u3lvS9hnnd9LfbF0jp8lVD4kJBX/QXay:WmvS7nnvLfbx94wX/QXa
- TLSH T183D35B1D37E910E5E57A917CC592460DE7B2B82157119BDF03A042BD4F23FE86C39BA1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
19408
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
dwm.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_set_error_mode
_initterm_e
_c_exit
_register_thread_local_exe_atexit_callback
_invoke_watson
api-ms-win-crt-private-l1-1-0
_o__errno
_o__exit
_o__get_wide_winmain_command_line
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
memmove
_o__wcsicmp
_o__wtof
_o_exit
_o_free
_o_malloc
_o_terminate
__C_specific_handler
__CxxFrameHandler3
__current_exception
__current_exception_context
_CxxThrowException
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
_o___stdio_common_vswprintf
_o__cexit
_o__callnewh
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
wcscmp
api-ms-win-core-windowserrorreporting-l1-1-0
WerSetFlags
api-ms-win-core-windowserrorreporting-l1-1-3
WerSetMaxProcessHoldMilliseconds
api-ms-win-core-windowserrorreporting-l1-1-1
WerUnregisterCustomMetadata
WerRegisterCustomMetadata
api-ms-win-eventlog-legacy-l1-1-0
ReportEventW
RegisterEventSourceW
DeregisterEventSource
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetModuleHandleExA
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-synch-l1-1-0
ReleaseMutex
InitializeCriticalSectionEx
LeaveCriticalSection
ReleaseSemaphore
EnterCriticalSection
TryAcquireSRWLockExclusive
CreateEventW
CreateSemaphoreExW
WaitForSingleObject
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
OpenSemaphoreW
WaitForSingleObjectEx
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
HeapSetInformation
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
RaiseException
SetUnhandledExceptionFilter
SetErrorMode
SetLastError
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
ExitProcess
TerminateProcess
GetCurrentProcess
ProcessIdToSessionId
GetStartupInfoW
OpenProcessToken
GetCurrentThreadId
SetPriorityClass
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
api-ms-win-security-base-l1-1-0
AdjustTokenPrivileges
CheckTokenMembership
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegGetValueW
RegOpenKeyExW
RegSetValueExW
RegCloseKey
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
RtlCaptureStackBackTrace
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-version-l1-1-1
GetFileVersionInfoW
GetFileVersionInfoSizeW
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventRegister
EventUnregister
EventWriteTransfer
api-ms-win-core-version-l1-1-0
VerQueryValueW
rpcrt4
RpcStringFreeW
UuidCreate
UuidToStringW
api-ms-win-core-memory-l1-1-0
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
api-ms-win-core-util-l1-1-0
Beep
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-composition-redirection-l1-1-0
DwmInitializePort
api-ms-win-composition-windowmanager-l1-1-0
ord101
api-ms-win-dx-d3dkmt-l1-1-0
D3DKMTCheckVidPnExclusiveOwnership
D3DKMTSetProcessSchedulingPriorityClass
D3DKMTEscape
api-ms-win-dx-d3dkmt-l1-1-1
D3DKMTOpenAdapterFromLuid
api-ms-win-rtcore-ntuser-private-l1-1-0
RegisterSessionPort
api-ms-win-rtcore-ntuser-private-l1-1-2
DwmKernelStartup
api-ms-win-rtcore-ntuser-window-l1-1-0
PostMessageW
TranslateMessage
DestroyWindow
DispatchMessageW
DefWindowProcW
PostQuitMessage
GetMessageW
RegisterClassExW
CreateWindowExW
win32u
NtUserGetDwmCursorShape
NtDesktopCaptureBits
ntdll
NtAlpcSendWaitReceivePort
RtlUnsubscribeWnfStateChangeNotification
RtlNtStatusToDosError
RtlSubscribeWnfStateChangeNotification
NtAlpcDeletePortSection
NtSetInformationProcess
RtlFreeSid
RtlAllocateAndInitializeSid
RtlGetDeviceFamilyInfoEnum
NtQueryInformationProcess
EtwEventRegister
EtwEventUnregister
EtwEventWriteTransfer
EtwEventSetInformation
NtQuerySystemInformation
RtlPublishWnfStateData
dxgi
DXGIDeclareAdapterRemovalSupport
coremessaging
CoreUICreate
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
dwmcore
MilCompositionEngine_Initialize
msvcp_win
_Query_perf_counter
?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_frequency
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-errorhandling-l1-1-3
TerminateProcessOnMemoryExhaustion
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
Name
.text
Size
68KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
468B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=99, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=15, id=260, version=33145,
count=5, id=259, version=33145,
count=1247, id=1, productName=Unmarked objects,
count=8, id=257, version=33145,
count=32, id=261, version=33145,
count=18, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
dxdiag.exe
- IMPHASH fcc446c58fd4b3ff245f727283b22088
- SHA256 0601f86c74871d1cf03dd1e5df8a546eacd981680f9eef49b528adda72e05a47
- MD5 87289eef3af6f45eb11d49ec65ff421b
- SHA1 c801ccf3a378367444b753fe28ece2d7caae4651
- SHA512 aa154fe8e358debedd4629af1af29454544335bfaa5f03de21f5377606a66e0eff42678a6d4f42b8b9be5c7094b07aac0ffc975887a14a9c101be56ba14fbb8b
- SSDEEP 6144:h5fC8KznFufrOqK/zSBT2DTo+XpjbkOhvuoX4MXKFUbP:zwzFKIzSMDTo+X1JXrbP
- TLSH T1DA74C41A62E80064F2B38A388A739023D9737C516B3195DF1254A6296FB7ED0F975F33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
6496
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
dxdiag.pdb
advapi32
EventActivityIdControl
RegQueryValueExW
RegDeleteValueW
EventUnregister
RegOpenKeyExW
RegSetValueExW
EventSetInformation
RegCreateKeyExW
RegFlushKey
EventRegister
EventWriteTransfer
RegCloseKey
RegNotifyChangeKeyValue
RegEnumValueW
RegEnumKeyExW
kernel32
HeapSetInformation
DeleteCriticalSection
FreeLibrary
RegisterApplicationRestart
GetVersionExW
LoadLibraryW
Wow64EnableWow64FsRedirection
GetNativeSystemInfo
GetSystemInfo
CreateMutexExW
CloseHandle
SetEvent
GetLastError
GetSystemDirectoryW
GetProcAddress
GetCurrentDirectoryW
HeapAlloc
CreateThreadpoolTimer
WaitForSingleObject
SetThreadpoolTimer
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
CloseThreadpoolTimer
OutputDebugStringW
ReleaseSRWLockExclusive
CreateEventW
ReleaseMutex
GetFileAttributesW
WaitForThreadpoolTimerCallbacks
InitializeCriticalSectionEx
GetModuleFileNameW
GetModuleHandleExW
ReleaseSemaphore
lstrlenW
SetLastError
HeapFree
CreateSemaphoreExW
GetModuleFileNameA
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeCriticalSection
LeaveCriticalSection
GetProcessHeap
WideCharToMultiByte
Sleep
FormatMessageW
GetCurrentThreadId
WaitForMultipleObjects
GetCommandLineW
EnterCriticalSection
ReleaseSRWLockShared
DebugBreak
GetFullPathNameW
AcquireSRWLockShared
WriteFile
CreateFileW
gdi32
GetTextMetricsW
GetTextExtentPoint32W
SelectObject
user32
CheckDlgButton
KillTimer
GetDlgItem
GetClientRect
SetWindowsHookExW
LoadIconW
TranslateMessage
SetFocus
UnhookWindowsHookEx
IsWindowEnabled
PeekMessageW
IsDialogMessageW
SetTimer
DispatchMessageW
ShowWindow
LoadStringW
GetWindowLongPtrW
GetDesktopWindow
DialogBoxParamW
SetWindowTextW
EndDialog
CallNextHookEx
SendMessageW
ScreenToClient
MessageBoxW
SetWindowPos
GetDC
DestroyWindow
GetFocus
GetWindowRect
PostMessageW
ShowScrollBar
GetKeyState
AdjustWindowRectEx
CreateDialogParamW
SetScrollInfo
PostQuitMessage
MsgWaitForMultipleObjects
GetWindowLongW
ScrollWindow
UpdateWindow
SetForegroundWindow
ReleaseDC
GetScrollInfo
EnableWindow
msvcp_win
??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ
??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z
?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?_Incref@facet@locale@std@@UEAAXXZ
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
??Bid@locale@std@@QEAA_KXZ
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
api-ms-win-crt-string-l1-1-0
wcscmp
memset
wcsncmp
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_c_exit
_register_thread_local_exe_atexit_callback
_initterm
api-ms-win-crt-private-l1-1-0
_o___stdio_common_vswprintf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswscanf
_o__beginthreadex
_o__callnewh
_o__cexit
_o__configthreadlocale
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__exit
_o__get_narrow_winmain_command_line
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
__CxxFrameHandler3
_o__purecall
_o__putws
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__wcsnicmp
_o__wtoi
_o__wtoi64
_o_exit
_o_free
_o_iswdigit
_o_malloc
_o_rand
_o_realloc
_o_terminate
_o_wcstok
__C_specific_handler
__current_exception
__current_exception_context
_CxxThrowException
_o___stdio_common_vsprintf
memcmp
memcpy
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
wcsrchr
__std_terminate
wcsstr
__CxxFrameHandler4
wcschr
memmove
comctl32
ord17
ImageList_Destroy
ImageList_Create
ImageList_ReplaceIcon
comdlg32
GetSaveFileNameW
shell32
ShellExecuteW
ole32
CoInitializeSecurity
CoUninitialize
CoCreateInstance
CoInitializeEx
oleaut32
VariantInit
SysAllocString
SysFreeString
VariantClear
Name
.text
Size
192KB
Virtual Size
189KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
84KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
32KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
412B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33145,
count=5, id=259, version=33145,
count=35, id=261, version=33145,
count=21, id=257, version=33145,
count=1249, id=1, productName=Unmarked objects,
count=6, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
dxgiadaptercache.exe
- IMPHASH 907c563c179f1ab1054789c8545d8a9b
- SHA256 c9b99973f798e05abbe650d5cf6ecc009ede69ca15155ee046fb8b9f4355616d
- MD5 df380a02f2978089123b99e3f187f194
- SHA1 0280bac3d182fbd1367f6580c8bccdd0fe43d086
- SHA512 986e1742f2ddbdbf43573a7432342354aed2be3a39776f696e639228ccf130e3220e88c99f65ef8504d0746fd0c41c301126bfc38e3a9bbf2ae3593a9fe07ca5
- SSDEEP 1536:YDFc06VYxlQh+ca2a61dhJMAdTPdhmghacLXVNC7VRIpFtI7R0/orIXdkTn5a:YJcrtdh2AjPM8VNC72Ft7orIdw5a
- TLSH T165D3296E32A920F5E576C17C85A14A06E7B1B4651312A7FF02E0C1BD0F67BE86C39F91
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
8800
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
DXGIAdapterCache.pdb
msvcp_win
?id@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A
??1_Lockit@std@@QEAA@XZ
??Bid@locale@std@@QEAA_KXZ
?good@ios_base@std@@QEBA_NXZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
??0_Lockit@std@@QEAA@H@Z
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?put@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@GPEBUtm@@PEBG3@Z
?_Getcat@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Xlength_error@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-runtime-l1-1-0
_c_exit
_register_thread_local_exe_atexit_callback
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o___std_exception_copy
_o___std_exception_destroy
_o___stdio_common_vswprintf
_o__callnewh
_o__cexit
_o__configthreadlocale
_o__configure_wide_argv
_o__crt_atexit
_o__errno
_o__exit
_o__get_initial_wide_environment
_o__gmtime64
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
memmove
_o__wcsicmp
_o_exit
_o_free
_o_malloc
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
_CxxThrowException
_o___p__commode
_o___p___wargv
_o___p___argc
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
_o__purecall
api-ms-win-crt-string-l1-1-0
memset
wcscmp
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventRegister
EventActivityIdControl
EventSetInformation
EventWriteTransfer
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
GetModuleHandleW
GetProcAddress
GetModuleHandleExW
GetModuleFileNameA
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
WaitForSingleObject
AcquireSRWLockShared
CreateSemaphoreExW
InitializeCriticalSectionEx
LeaveCriticalSection
ReleaseMutex
WaitForSingleObjectEx
CreateMutexExW
OpenSemaphoreW
ReleaseSRWLockShared
ReleaseSRWLockExclusive
EnterCriticalSection
ReleaseSemaphore
AcquireSRWLockExclusive
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
RaiseException
GetLastError
ntdll
NtCommitTransaction
NtCreateTransaction
RtlPublishWnfStateData
NtClose
api-ms-win-core-com-l1-1-0
CoUninitialize
CoInitializeEx
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegOpenKeyExW
RegGetValueW
RegCloseKey
RegSetValueExW
RegDeleteTreeW
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
WindowsGetStringRawBuffer
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
Name
.text
Size
72KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
136B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
316B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=62, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=5, id=259, version=33145,
count=1215, id=1, productName=Unmarked objects,
count=3, id=257, version=33145,
count=30, id=261, version=33145,
count=3, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,